{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "metadata": {
    "timestamp": "2026-01-09T19:20:50Z",
    "tools": {
      "components": [
        {
          "bom-ref": "d0b4239b-3a5b-4c7f-9e5e-9f5789e6ec6e",
          "type": "application",
          "authors": [
            {
              "bom-ref": "9eeedb2b-b44f-4107-80ca-17bb8b58775e",
              "name": "Binarly Inc."
            }
          ],
          "name": "Binarly Transparency Platform",
          "version": "3.0"
        }
      ]
    },
    "authors": [
      {
        "bom-ref": "d5e49442-68b5-4834-819a-95f5b5a3148e",
        "name": "Binarly Inc."
      }
    ],
    "component": {
      "bom-ref": "7f4624d5-ef2d-4608-b2bb-f06428058ebf",
      "type": "application",
      "supplier": {
        "name": "binarly"
      },
      "name": "BMC_X13AST2600-ROT20-D301MS_20250802_01.05.02_STDsp.bin"
    }
  },
  "components": [
    {
      "bom-ref": "9b561a06-1ac9-4d06-822a-9ef34fad1cc3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "79fc7e9d-1be6-4bd6-ab6c-46f84bc9f05a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0d740c24-34f2-47dd-ba19-94f0052125bb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "79d39007-7988-4afe-a1f1-e55371a85461",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fc9d4bed-b77e-482e-a502-f13c2f6406bb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1cbd086c-55b0-4a33-9e0d-180fb9285191",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8b26a210-5815-4915-85df-e9de790e9c55",
      "type": "library",
      "group": "gnu",
      "name": "gcc",
      "version": "12.2.0",
      "licenses": [
        {
          "expression": "GPL-3.0-with-GCC-exception OR GFDL-1.3-or-later"
        }
      ],
      "purl": "pkg:generic/gnu/gcc@12.2.0"
    },
    {
      "bom-ref": "b9828792-1129-4b33-9e66-c55032c9a436",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e2250801-0be9-411d-ad1a-49325e19881a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3a16d261-6073-4bcf-b588-6376bc33d0c7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3a7381cf-5c70-49e8-85af-b58a005d3e66",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cd33f1b8-cff7-4a72-87aa-c8193e3d6d2b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fa776110-86a0-41cb-9da6-79ddcd4661d9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f54ecaea-1561-40ed-8ad3-0ffff912e610",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fb27982e-e7b5-4acd-92b9-c67aa05b9a1d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2cc9da07-5da6-4937-8774-c7fcad593e41",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e86f5e3a-26f8-4277-ac9c-857a2c89e4b3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c7ea3f93-cd03-4f24-a6c0-837ba793379c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a59d7d9d-2e57-485a-9097-a027af094ca7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b61ea630-2cb9-4e75-9079-5540b21cbcec",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d8ece867-c61d-49dc-a5ab-83d017a25723",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "23b11a4a-83fb-4626-bd70-ace652ab1552",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f98c2866-01cc-4c24-aa8a-41506ecb6be1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "478ffebf-6d20-43d4-b3d3-661c2bb58f15",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d161a0f2-ed56-447c-b0bf-eddc03e14188",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "463b1c39-129f-42d1-9943-4e4c987747ee",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4f3138df-c8d8-4b26-9059-b63443ecc625",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6bd7b7d9-8de5-44da-ad58-36269d924e63",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "48c53c22-606f-4edf-a723-d3a2c609f9a1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1c7a2c6e-67f6-4f95-af75-7021340e04b6",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "5332b8aa-d033-40da-90ae-be6cb47e1310",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "53ee835d-80a0-4af7-98ce-6497c9f597bd",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5a335cd7-5076-4175-8a19-9e146dc553ad",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "45061d71-fc41-40f2-9422-a60714a8b362",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b90568c3-3919-4283-8943-0ea133c8d556",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a4b4ba59-3f9a-4d2e-98e2-27ada2938188",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "af5d0e4a-0172-447d-8367-f6c30367c21e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3f71e96e-4f91-4492-86f0-c017db9a37de",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5f87b46d-a3d4-4776-ad66-97bf586573f0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "bb5b3db4-9950-4f3b-b1e7-a604be82cb17",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "76712cee-33d3-49ee-bb8e-f7f1842b201f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "dea0a772-58b2-4b57-9a08-20e87bccd935",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b56c2f7d-e505-436b-8bbd-1e606925877f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3ba69ae4-bd52-436d-85af-e36f212a79e3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b7584104-40f2-4856-b5fc-d0151dd06075",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e95c096d-ad82-47ca-927d-0b4b953408e7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "588a4d08-507a-444d-b5a3-514ad1b34d7e",
      "type": "library",
      "group": "isc",
      "name": "bind",
      "version": "9.18.24",
      "licenses": [
        {
          "expression": "MPL-2.0"
        }
      ],
      "purl": "pkg:generic/isc/bind@9.18.24"
    },
    {
      "bom-ref": "1933f416-ea35-434b-9a7c-7c7bee784868",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "30c77dc3-b1bf-4715-be84-25bdfcf2487f",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "06145865-2540-4779-bcd1-15f200005bda",
      "type": "library",
      "group": "libseccomp_project",
      "name": "libseccomp",
      "version": "2.5.4",
      "licenses": [
        {
          "expression": "LGPL-2.1-only"
        }
      ],
      "purl": "pkg:generic/libseccomp_project/libseccomp@2.5.4"
    },
    {
      "bom-ref": "08168e0e-93ad-4d2b-8074-719583a49cdf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "38ef042e-d7eb-4c99-a18a-8b1e00ca18f7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d5fa4712-44b0-4d24-8a73-576cb1b74ba7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e93a6319-71f5-4052-a73e-cd9426396033",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0a92b2c5-7e9d-422f-9f42-19b397c1adff",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "157093f7-f09b-4dcd-bf1c-69721402a50a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7a41d766-1d9b-4a00-a3ba-72fca530c8a4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0a2dd9fd-5f2e-4cbf-8882-767ecfee5379",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3cd87c2c-ba87-4091-81b9-b63f8ab791cc",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2aaae198-cd7b-4404-8172-8c07a188f907",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f676e07d-ed0d-4aad-bb23-e21c801f2fbb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f162bd1f-767e-4cb0-a3c4-355ac28e9008",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "794ac274-3e3f-48d6-8b2a-aa6fc332e479",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "14a6096c-f5f4-417b-bde1-61097bc1c230",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c797382a-f009-4d01-8d92-a399929e9b5d",
      "type": "library",
      "group": "ntp",
      "name": "ntp",
      "version": "4.2.8p12",
      "purl": "pkg:generic/ntp/ntp@4.2.8p12"
    },
    {
      "bom-ref": "5b5e6b7c-3722-4389-abe9-1dc02e08a5b9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "700f4858-542b-4b91-b0b5-48c55c017dd7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cbd5c2ea-af30-43c8-88d8-b80edf68c558",
      "type": "library",
      "group": "gnu",
      "name": "gcc",
      "version": "4.9.1",
      "licenses": [
        {
          "expression": "GPL-3.0-with-GCC-exception OR GFDL-1.3-or-later"
        }
      ],
      "cpe": "cpe:2.3:a:gnu:gcc:4.9.1:*:*:*:*:*:*:*",
      "purl": "pkg:generic/gnu/gcc@4.9.1"
    },
    {
      "bom-ref": "1d581af4-6bc4-40e4-bc67-5662c4c01a1c",
      "type": "library",
      "group": "gnu",
      "name": "gcc",
      "version": "9.2.0",
      "licenses": [
        {
          "expression": "GPL-3.0-with-GCC-exception OR GFDL-1.3-or-later"
        }
      ],
      "cpe": "cpe:2.3:a:gnu:gcc:9.2.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/gnu/gcc@9.2.0"
    },
    {
      "bom-ref": "0d20d755-d0ed-4b34-b93b-16ae2ccd990d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c57fd219-0f37-40f2-96dd-c59df870290e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5e730a23-e92d-423e-a8a9-88f8b7735cb3",
      "type": "library",
      "group": "libuv_project",
      "name": "libuv",
      "version": "1.45.0",
      "purl": "pkg:generic/libuv_project/libuv@1.45.0"
    },
    {
      "bom-ref": "eeca640e-b720-48b8-bf85-29786bcbd6a4",
      "type": "library",
      "group": "libuv",
      "name": "libuv",
      "version": "1.45.0",
      "cpe": "cpe:2.3:a:libuv:libuv:1.45.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/libuv/libuv@1.45.0"
    },
    {
      "bom-ref": "09713aec-edd9-4f69-a0f5-ad8e9561e9a5",
      "type": "library",
      "group": "gnu",
      "name": "ncurses",
      "version": "6.3",
      "licenses": [
        {
          "expression": "MIT-open-group"
        }
      ],
      "cpe": "cpe:2.3:a:gnu:ncurses:6.3:-:*:*:*:*:*:*",
      "purl": "pkg:generic/gnu/ncurses@6.3"
    },
    {
      "bom-ref": "0d578627-e02f-4e44-a847-da0418ebb473",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ffa71a88-a975-4a92-8a24-3b875816d4d1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c7f561a3-3faf-4a66-997a-f2ad701e26cf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1bb30056-4f21-4739-8ed9-122cc13fe81e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a21eb115-ef67-48d9-bcad-7515889d7222",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a8942adb-927f-4a97-b17f-2078dae5591b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "bd960ca9-6355-490f-a347-8a1fd64bba10",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ba0e9294-ca03-4fa6-8f03-861cf2c2facd",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0e7718e5-c512-4a67-8713-0c572930ab99",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a0ccbb30-9b45-4168-afff-ed61380f5ddc",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "89105a15-58b9-4846-ab83-0b74d5236226",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7ca99322-de75-4f85-a78b-9f1a1961a6a1",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "ab16b956-4a90-42d8-b077-5028e62666ce",
      "type": "library",
      "group": "d-bus",
      "name": "d-bus",
      "version": "1.14.0",
      "purl": "pkg:generic/d-bus/d-bus@1.14.0"
    },
    {
      "bom-ref": "cd54e6d0-f208-46be-9c26-6fcdef278a84",
      "type": "library",
      "group": "d-bus_project",
      "name": "d-bus",
      "version": "1.14.0",
      "purl": "pkg:generic/d-bus_project/d-bus@1.14.0"
    },
    {
      "bom-ref": "5ea1275a-a65b-4f52-8456-f64df4fe2709",
      "type": "library",
      "group": "freedesktop",
      "name": "dbus",
      "version": "1.14.0",
      "licenses": [
        {
          "expression": "(AFL-2.1 OR GPL-2.0-or-later)"
        }
      ],
      "cpe": "cpe:2.3:a:freedesktop:dbus:1.14.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/freedesktop/dbus@1.14.0"
    },
    {
      "bom-ref": "2f808b83-528d-48d2-bc09-2d00f9e76a78",
      "type": "library",
      "group": "freedesktop",
      "name": "libdbus",
      "version": "1.14.0",
      "purl": "pkg:generic/freedesktop/libdbus@1.14.0"
    },
    {
      "bom-ref": "70f60432-3378-4c4d-9b54-fea176f70509",
      "type": "library",
      "group": "dbus-broker_project",
      "name": "dbus-broker",
      "version": "1.14.0",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:generic/dbus-broker_project/dbus-broker@1.14.0"
    },
    {
      "bom-ref": "4c654829-1f08-4fbb-950f-9c7545741387",
      "type": "library",
      "group": "haxx",
      "name": "curl",
      "version": "8.9.1",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "cpe": "cpe:2.3:a:haxx:curl:8.9.1:*:*:*:*:*:*:*",
      "purl": "pkg:generic/haxx/curl@8.9.1"
    },
    {
      "bom-ref": "06fa955c-7300-4e1b-a668-7dd1e72bce88",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a8dfb3e1-8aea-438a-ad15-b143ecb2a4ed",
      "type": "library",
      "group": "d-bus",
      "name": "d-bus",
      "version": "1.14.0",
      "purl": "pkg:generic/d-bus/d-bus@1.14.0"
    },
    {
      "bom-ref": "06fb79f0-8929-4a40-ad27-0b63d1a1cd28",
      "type": "library",
      "group": "d-bus_project",
      "name": "d-bus",
      "version": "1.14.0",
      "purl": "pkg:generic/d-bus_project/d-bus@1.14.0"
    },
    {
      "bom-ref": "5133a880-6d7a-4665-a575-0503ccea64c2",
      "type": "library",
      "group": "freedesktop",
      "name": "dbus",
      "version": "1.14.0",
      "licenses": [
        {
          "expression": "(AFL-2.1 OR GPL-2.0-or-later)"
        }
      ],
      "cpe": "cpe:2.3:a:freedesktop:dbus:1.14.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/freedesktop/dbus@1.14.0"
    },
    {
      "bom-ref": "e190916e-d98c-4c9a-a944-b0ab8fa780c2",
      "type": "library",
      "group": "freedesktop",
      "name": "libdbus",
      "version": "1.14.0",
      "purl": "pkg:generic/freedesktop/libdbus@1.14.0"
    },
    {
      "bom-ref": "bf8283f2-bc46-4b2e-ac90-fbff74133508",
      "type": "library",
      "group": "dbus-broker_project",
      "name": "dbus-broker",
      "version": "1.14.0",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:generic/dbus-broker_project/dbus-broker@1.14.0"
    },
    {
      "bom-ref": "688ccafe-848f-4348-b4e0-75193a9d833a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ec101214-c46f-417a-8cdf-142a88395b06",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e236a483-877b-4a35-a3a5-fe9da6df979a",
      "type": "library",
      "group": "isc",
      "name": "bind",
      "version": "9.18.24",
      "licenses": [
        {
          "expression": "MPL-2.0"
        }
      ],
      "purl": "pkg:generic/isc/bind@9.18.24"
    },
    {
      "bom-ref": "8915d1d8-0773-4f81-af37-29b5c7d2690a",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "7aa10eb4-a6fe-4f0a-ae3b-cef07338ca26",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "cdef7a1b-ece2-47a6-913b-937af22edb61",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "9f03e280-52d4-4bd8-ad4d-34b520d9aa88",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a54306cd-2b79-4946-b771-318ee77aed5c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c1025292-66cc-4a2e-8fab-1fe9c0a426f4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4e7364d9-3b60-40e8-91bb-41b047f7b671",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "57808831-6add-427f-8194-9a177c6718f6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "36aa2791-00d3-4dbb-b657-e75816e2618a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a5f0062d-6bf0-4e3c-937e-72bdbee42289",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "87c90878-5693-4a26-8b59-de1c104069a2",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "93868e97-b5d0-47f1-9df3-ebdee1a7db5d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "811e0579-5938-428c-9b1e-0528e46caf85",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4f8826c8-5085-444c-bf7d-0746baee6429",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5b148268-fd6a-49b4-910a-730f33b60f47",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0213cf86-d802-4d18-a4e4-ffb66bae7281",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8e42bf39-d7b8-4646-be55-91a3abf99843",
      "type": "library",
      "group": "stunnel",
      "name": "stunnel",
      "version": "5.54",
      "licenses": [
        {
          "expression": "GPL-2.0-or-later"
        }
      ],
      "cpe": "cpe:2.3:a:stunnel:stunnel:5.54:*:*:*:*:*:*:*",
      "purl": "pkg:generic/stunnel/stunnel@5.54"
    },
    {
      "bom-ref": "f80c5357-0ced-4eb5-93d1-876d499b8876",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "beeb2052-5cc9-467c-adb7-dfc478072431",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b56e3148-331c-49ea-b3b0-265bd1e3f148",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cbe42680-3fc1-4b22-9f82-205dc65a6df6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e30162b2-fc94-4cad-9446-d38657267c0c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "79abca91-1839-4e53-bfe3-f806ae5d4c97",
      "type": "library",
      "group": "gnu",
      "name": "glibc",
      "version": "2.36",
      "licenses": [
        {
          "expression": "GPL-2.0-or-later OR LGPL-2.1-or-later"
        }
      ],
      "cpe": "cpe:2.3:a:gnu:glibc:2.36:*:*:*:*:*:*:*",
      "purl": "pkg:generic/gnu/glibc@2.36"
    },
    {
      "bom-ref": "47c48075-5e85-41b8-bbfe-27d6ac422cd6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "80708387-f74c-4562-9770-50f4ebe32842",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ab455cd2-b625-4e8a-9947-c3571939d105",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ff51973a-17bc-439f-a532-b63ec4860e27",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "28cd39ad-08ac-41ea-842d-62edaa1db2b6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b6634ac8-7da1-4a1f-b001-5a85dff2e0dc",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "06837841-9214-4449-a4d3-e2fc59aface1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "43b88476-290f-4f4d-8125-a8ca61184517",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d5d489d0-c32a-4d7f-875b-eaa57f26e134",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d1e3c823-38c8-4092-ad06-5ab43cda47e0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f961ad1e-0783-42bc-92a9-ee7e2a5bfff7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cc8fa288-3084-493d-9fe8-e89d22cf4b31",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2d577fdf-4af3-4699-b29f-afc9b1d60a33",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "29bcc62b-11ac-4b19-9b0a-3c7d7d5fa445",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "85e521d8-afde-4703-80d0-9309b83c0aff",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c5cac6c4-4f7b-4fcf-a1b7-78c37ef5a6be",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1deda17c-a004-44d1-8360-ad7cf8372dc4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d5767527-c387-46cc-91de-aa7fc22b20f1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "22f9558d-05ce-42ad-a1b2-cccf393400ba",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "92cd1776-2574-469e-bc65-529a7963e87f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d718ada5-e4d3-4f57-a658-2a56029fafdd",
      "type": "library",
      "group": "openssl",
      "name": "openssl",
      "version": "1.1.1w",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "cpe": "cpe:2.3:a:openssl:openssl:1.1.1w:*:*:*:*:*:*:*",
      "purl": "pkg:generic/openssl/openssl@1.1.1w"
    },
    {
      "bom-ref": "89cce52e-31c3-4f9f-ab40-6a8362c750d1",
      "type": "library",
      "group": "openssl",
      "name": "openssl",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ]
    },
    {
      "bom-ref": "1414470e-9401-4f0d-b0cd-8d9bf0f315e3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8cdac6b8-4c25-4e67-8cd2-3d694f98ca23",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1823cf8e-6c93-44be-9316-53f384b42e62",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "18731bd6-9f4c-4c9b-9b11-95623f2e4185",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c2521c4c-4347-48e0-bfac-638f04489e26",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2849e41c-d987-44a4-afb7-ed0367040cea",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "bd5a8161-bcf5-4a02-94c4-dd8ba699cf5d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "64afb47d-fb7f-42d4-9fff-3bde1c7b66d3",
      "type": "library",
      "group": "isc",
      "name": "bind",
      "version": "9.18.24",
      "licenses": [
        {
          "expression": "MPL-2.0"
        }
      ],
      "purl": "pkg:generic/isc/bind@9.18.24"
    },
    {
      "bom-ref": "232aca93-0e32-4166-b5f0-7ecf9462b913",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "1f63813d-d925-41d9-843c-33d79c236689",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "0937e902-3cfc-404f-ab21-d531ad84746b",
      "type": "library",
      "group": "linux",
      "name": "linux_kernel",
      "version": "5.4.62",
      "cpe": "cpe:2.3:o:linux:linux_kernel:5.4.62:*:*:*:*:*:*:*",
      "purl": "pkg:generic/linux/linux_kernel@5.4.62"
    },
    {
      "bom-ref": "ea86af82-bd87-4925-b1d7-538ab0c12eae",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7ce9f326-5531-4afb-8523-69bac79708e2",
      "type": "library",
      "group": "openbsd",
      "name": "openssh",
      "version": "9.8p1",
      "licenses": [
        {
          "expression": "0BSD OR BSD-2-Clause OR BSD-3-Clause OR ISC OR LicenseRef-Public-Domain OR MIT"
        }
      ],
      "purl": "pkg:generic/openbsd/openssh@9.8p1"
    },
    {
      "bom-ref": "53ac54b8-07e1-492b-9c58-215bbb5f9b19",
      "type": "library",
      "group": "openssh",
      "name": "openssh",
      "version": "9.8p1",
      "licenses": [
        {
          "expression": "0BSD OR BSD-2-Clause OR BSD-3-Clause OR ISC OR LicenseRef-Public-Domain OR MIT"
        }
      ],
      "purl": "pkg:generic/openssh/openssh@9.8p1"
    },
    {
      "bom-ref": "ca777da4-1012-4ded-b786-b5cfccaa632f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4b09cbcd-17db-4ac1-b3f1-59f0745a6fe3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "876922f7-bf73-49a2-8715-45dac70bdffa",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "0b16b430-774b-4ccd-9522-f2c8827de252",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c09aaf3b-238b-4085-b17c-c3b76a814731",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "411cd19f-d63c-4ad1-8fa9-86bf09f939cf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8ef4a7ca-d149-4345-8ac5-57dcb89ee922",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "bfb7f52d-4f28-4a80-8176-d1fefeb0339d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ff8f377d-989a-427e-b2f3-7232ca28923d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0da06006-3be2-4265-afda-b23b0c423590",
      "type": "library",
      "group": "gnu",
      "name": "gcc",
      "version": "4.1.1",
      "licenses": [
        {
          "expression": "GPL-3.0-with-GCC-exception OR GFDL-1.3-or-later"
        }
      ],
      "cpe": "cpe:2.3:a:gnu:gcc:4.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:generic/gnu/gcc@4.1.1"
    },
    {
      "bom-ref": "1a39166b-aded-4939-a713-45e7bcb53ca9",
      "type": "library",
      "group": "libexpat_project",
      "name": "libexpat",
      "version": "2.2.9",
      "cpe": "cpe:2.3:a:libexpat_project:libexpat:2.2.9:*:*:*:*:*:*:*",
      "purl": "pkg:generic/libexpat_project/libexpat@2.2.9"
    },
    {
      "bom-ref": "bc45c2ff-643a-4ace-81ed-ba11d2e6a6bd",
      "type": "library",
      "group": "libexpat_project",
      "name": "libexpat",
      "version": "\u003c=2.5.0",
      "licenses": [
        {
          "expression": "MIT"
        }
      ]
    },
    {
      "bom-ref": "ad700ad7-0b1b-43f7-9b6d-0814a3c04fae",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "90c98916-70bb-420b-b4f1-59b0232a8c46",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "000002b5-7ea4-49d0-b371-adcef5f96c3d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libcimcClientSfcbLocal.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f82286127ecb8964115de88cab6ca9673731d"
        },
        {
          "alg": "SHA-256",
          "content": "19378c0b68daf27eb1566ce78c6598ba7214a554ea354c8e6ee6d960d7912ebf"
        },
        {
          "alg": "MD5",
          "content": "86c95df95a995dd22b523f9a26f56b3b"
        }
      ]
    },
    {
      "bom-ref": "000d8527-800f-45f1-91fb-af850cdef26d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpcre.so.1.2.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c86814283f02c01beb1e257bbe6879818c6f87ff"
        },
        {
          "alg": "SHA-256",
          "content": "b7d0bd3e139d156347f8dbe6e7edb759fe04a6597f43e136c775f829ce9eb3eb"
        },
        {
          "alg": "MD5",
          "content": "1ca4569cf03e096b920faf07f6ed55dd"
        }
      ]
    },
    {
      "bom-ref": "0013d7d5-27bc-421f-8a03-1cbdfbc2b374",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptables-save",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "a4a839ad-49c8-4652-ae00-99e70e878176",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/KCSInterface.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2d7ada4193b6b3be0cb02018d3b2aa2f61223f1f"
        },
        {
          "alg": "SHA-256",
          "content": "d3b423b148a873f6ea16eaf77949ebd3c51c479551ad780b33cdff7e80cd93b7"
        },
        {
          "alg": "MD5",
          "content": "4622048e9f6ff35b02f52aafb998181f"
        }
      ]
    },
    {
      "bom-ref": "a4b39832-d3b2-4d4f-a3ab-9cbb17d4a7d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_dns.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "27f361d184e1e72b07efdfd2b60a902d28c35379"
        },
        {
          "alg": "SHA-256",
          "content": "2cb3d1a4c35f3df359e2ace771951f28bb95d07ad3ca59f845f8549616030159"
        },
        {
          "alg": "MD5",
          "content": "219694e30fe0a675c954f0654ba30f6b"
        }
      ]
    },
    {
      "bom-ref": "a4b6f6fa-d65f-4906-91d5-24729b7ae4df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9cb0cfb2817cd467b680129376bfeff638607181"
        },
        {
          "alg": "SHA-256",
          "content": "ba405028c03a8402788600455008c921a1383e6379f7876b967b711005d979f3"
        },
        {
          "alg": "MD5",
          "content": "e00e22e52eb5208c7ef86f920f28de46"
        }
      ]
    },
    {
      "bom-ref": "a4c3015b-4c3b-4201-b8f1-65bd6115cb8c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_SmartCooling.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d88810e8a6e0b2b077f5c2968157b8d6748c4f48"
        },
        {
          "alg": "SHA-256",
          "content": "5ba8e7f8b31247e9e716833e1971b247d1a5c9338d6cce138973371b9d169181"
        },
        {
          "alg": "MD5",
          "content": "b2311151ff99bbb7266b511d7f62fb11"
        }
      ]
    },
    {
      "bom-ref": "a4cac266-c00d-4ead-a60c-7bad5350010b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SNMPv3.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "be957d0003908d1b18e7e1a6938e48e017e93003"
        },
        {
          "alg": "SHA-256",
          "content": "0f20f4da71a075c0de4ebf84be6976e89fc5d4cf90097bf142b034b9456af834"
        },
        {
          "alg": "MD5",
          "content": "fe0e09f67617f0fa8685f25604b1b066"
        }
      ]
    },
    {
      "bom-ref": "a4ccd1ec-4850-40b6-9f71-89d3d51a2e18",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/nic_port_1.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "13bc312f0f077cbb7b63980feecdc3b63102a47c"
        },
        {
          "alg": "SHA-256",
          "content": "a62392a8ebc287d26d9c40d97535eb4671b3d431931caaef15626e898fb62729"
        },
        {
          "alg": "MD5",
          "content": "28fc6f0f3dfa27893c0322d623f20243"
        }
      ]
    },
    {
      "bom-ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/setlogcons",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a5039b57-77dc-4ed6-a55c-3bb542992971",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/sfcb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90616720a38bd1433a9721d13e1fba1a430eae3f"
        },
        {
          "alg": "SHA-256",
          "content": "9ca470582c8ed965dbfbb1d247bcba500e20601a2acc3c17b0051c93e4e5bdca"
        },
        {
          "alg": "MD5",
          "content": "df856a21c68ec17f13380aff6e247558"
        }
      ]
    },
    {
      "bom-ref": "a507105e-dc21-4b23-aae8-44213cbb314e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/du",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a51c574f-e37f-4785-839a-5f75433aa2e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/calfwcrc16",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cc14bab258b095585f1a528503c23a0cc5f76d2a"
        },
        {
          "alg": "SHA-256",
          "content": "4eea6919084937e3c8d3c19bcaba16a6dbf03cc181933a5c9378d21aeb35d27e"
        },
        {
          "alg": "MD5",
          "content": "ed0d9aef4c44bc700142af143645c022"
        }
      ]
    },
    {
      "bom-ref": "a5208142-4019-407b-a37c-980541f30904",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libkmod.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6f45a68931ea375908a18f457def4b0770bea50"
        },
        {
          "alg": "SHA-256",
          "content": "c7b098c5e5b8ff6cfcdca806164c1e0d292c8ccafc5cb36a355106020fa6d523"
        },
        {
          "alg": "MD5",
          "content": "be69052287f9e07633f385c59a28957f"
        }
      ]
    },
    {
      "bom-ref": "a52096cd-6c7d-4233-8ece-1e1d7e13e658",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nandwrite",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a563b9b0-cb25-4932-b8ad-4d9cf1c7e270",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rpm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a580b2e1-5a52-4297-bbf8-58a7a806b27d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/genSslCert.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dff9c6bc512ea8e5f8cdca1352a549ab11baf9bf"
        },
        {
          "alg": "SHA-256",
          "content": "a5ab812f940aba3b93cf3beea49cfe4ed651293183e521a2b481b77bac66367f"
        },
        {
          "alg": "MD5",
          "content": "4b61267dd0ac621e92cba3283c0ddc62"
        }
      ]
    },
    {
      "bom-ref": "a5be950e-451c-4ed2-bc3f-d402f694af4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SNMPv2.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a9680e6f81f5dea725d34ce99fb4915ccc1e0b6f"
        },
        {
          "alg": "SHA-256",
          "content": "5292d9b1160f55629ffc0cc0fb2e621f29a6a0bb92dee4ee18a43e7a247c514a"
        },
        {
          "alg": "MD5",
          "content": "5443d9b9f82c33f295ffa200d4a71beb"
        }
      ]
    },
    {
      "bom-ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/seq",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a5d71f5b-191e-428d-87ae-3507418bd937",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/10_interop.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5cebaa5ef0ec1e75c0950fc561fb4aad1fdf82b4"
        },
        {
          "alg": "SHA-256",
          "content": "7e4dfb555afb3320157d74314b2ecae88d05b97f6b89bb5b138d903be92564a1"
        },
        {
          "alg": "MD5",
          "content": "423a91a8a1bd3ea1e1444a29c1c29c25"
        }
      ]
    },
    {
      "bom-ref": "a5e6805f-e8d4-4de4-bb51-43c4d2519bc7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBT_GAP",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "903d4599b2467e5bf52f8ae837a4811d26739afb"
        },
        {
          "alg": "SHA-256",
          "content": "30fae4eea1a1116a82c8d039044c324222deb79318c967a0611c702a8a9ceb55"
        },
        {
          "alg": "MD5",
          "content": "a3ab195ee79aa2a34cf13e76a6ca1a15"
        }
      ]
    },
    {
      "bom-ref": "a5ec65a5-360d-4c6c-80d9-401969c895d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libcrammd5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a2c93e2fef7fed59b95b71ab2c2961b03c6e41d3"
        },
        {
          "alg": "SHA-256",
          "content": "b84e7acb656385ac3cb9f9827081163873d0bd5f7231d5757152b3675b62b567"
        },
        {
          "alg": "MD5",
          "content": "52c4c3decbb577c1b3580b0c6939c671"
        }
      ]
    },
    {
      "bom-ref": "a5f4b5de-094b-4c5b-9fb9-b70bad716d39",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fw_setenv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "50683d8dba4e1b89e4f6e1b573358dce943af59c"
        },
        {
          "alg": "SHA-256",
          "content": "a07bcbdeca3bb3e7a6e1164d112f003dff9445cabf32442c7c2193e9e17bef91"
        },
        {
          "alg": "MD5",
          "content": "1a49f85bec84e5af03f40620735fff5c"
        }
      ]
    },
    {
      "bom-ref": "a5faf6b4-e734-4ba0-bba5-012263eace8d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_timer",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "60624d52793cc75aaed11a2f09f9da233607a712"
        },
        {
          "alg": "SHA-256",
          "content": "a54e6459fa1ad5ebdc48f57efd298899c8b6a0fbab02809288ebca006b639d16"
        },
        {
          "alg": "MD5",
          "content": "72bfa312dc3cd9ebc8c6bf4b062a6281"
        }
      ]
    },
    {
      "bom-ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/gconv/UTF-32.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ef114f5f988efde43abd8d582f92df497601b1a1"
        },
        {
          "alg": "SHA-256",
          "content": "fafcef253f4d47a7f9ba4fca3752c11df991937892b720198b26dd2610969ea0"
        },
        {
          "alg": "MD5",
          "content": "cbbfcf0b3de323934752833a7881916e"
        }
      ]
    },
    {
      "bom-ref": "a65912b9-b70f-4b0e-bf39-13f61a32817a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mktemp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a686f827-ec51-4ac6-a116-b8a0a768b296",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SNMPv2_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ecacbc1895df74c2d785beae17850b4779f19535"
        },
        {
          "alg": "SHA-256",
          "content": "8ac37e725c4a522f0e8ef6316fe88e02d7cc4d11991e907597d5304dc86c1c10"
        },
        {
          "alg": "MD5",
          "content": "978b554995c01f34b1268948c3b8ea04"
        }
      ]
    },
    {
      "bom-ref": "a68a393e-d3d3-44d6-b5e7-251ed2ee3d5d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unxz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a6a9b867-31c9-4787-b1ac-951c7cb0a1e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dumpkmap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a6f57ff9-c52c-4ff3-96cc-4f15ca83f4f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_compat.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d96f3079932f7eea9b312c9d9cc4f35f4b916bc2"
        },
        {
          "alg": "SHA-256",
          "content": "07e54b12bfe49788e02b246ad6cb5779eb5ad8d987f94663759011117adfd400"
        },
        {
          "alg": "MD5",
          "content": "ea0a208c0464cb133a708a1776c75b38"
        }
      ]
    },
    {
      "bom-ref": "c6658798-b541-4df5-8b55-f8582e62c1ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "076e06f895811a2d6cfa7efe30781e9923ee361a"
        },
        {
          "alg": "SHA-256",
          "content": "3fd7f8927b75bf01c928ca2b2ec5b285f9c48016cbccf8cc87d79831e61a7d49"
        },
        {
          "alg": "MD5",
          "content": "231cfb6dd5ef5bee0d2779ba1d13f2e8"
        }
      ]
    },
    {
      "bom-ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/httpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c67dd4e3-aaca-4cd3-88da-c09b75de18a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt_mit.so.12",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "c69ce6f6-20d8-4e84-900d-c9cec76023f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/lightbox.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6626394b1c80e91807a5ce2b01fcc1f04f93b5ae"
        },
        {
          "alg": "SHA-256",
          "content": "55b505ae614b3abb02af11e4cc46ffdb980b38f8f1ce4ff9aa4482cc3b825fd2"
        },
        {
          "alg": "MD5",
          "content": "66cbb6f6f4b0385f61e1c2dbaf550801"
        }
      ]
    },
    {
      "bom-ref": "c6c857f2-3b81-45ad-b430-dc8abd591c9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt_mit.so.12",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "c6cba35b-05ce-4a1e-a374-c89786912323",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/smallSysLock.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4e06e97385999b31f4eaeca5c632c795cd2c3445"
        },
        {
          "alg": "SHA-256",
          "content": "224ee56e927d46127eb6d7bdd720889da7fcf7258e8325d8945a96541d18ad5a"
        },
        {
          "alg": "MD5",
          "content": "173a4c8d529496740542e938d044d28e"
        }
      ]
    },
    {
      "bom-ref": "c6d0ec12-36e8-4a1c-ac60-8dd456f81d03",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/factory_dedicateOnly.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d68c884adc5a635ac1c6111b28ee596377aaf8f5"
        },
        {
          "alg": "SHA-256",
          "content": "b33bb7852989a90d0fb3b637638bca83728d7bbfdae3b7fa8ca04199c4bc3311"
        },
        {
          "alg": "MD5",
          "content": "cb0a97f2e12de3696690fc654649e1b1"
        }
      ]
    },
    {
      "bom-ref": "c6d71efb-42e3-4468-ae89-5e10ae522fc7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libscram.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05846d6ce7b0adf863cf226acf203a14a0f46fae"
        },
        {
          "alg": "SHA-256",
          "content": "0a60aa782cbc7b4a26bbc0884b7660f2430844608e3f356c99aa20e4193683da"
        },
        {
          "alg": "MD5",
          "content": "0357e1497a56fc4a7fbbcc9bf9f5ae2d"
        }
      ]
    },
    {
      "bom-ref": "c6e21ece-d3d5-4191-a64c-63233295e3a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/stunnel/stunnel.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "51dc4296f2cb3850b4df7c44f8b3f24612478a5f"
        },
        {
          "alg": "SHA-256",
          "content": "ebb0a550addfbee7e63e86851a184623a551f991029795904b6ccf5db4896a37"
        },
        {
          "alg": "MD5",
          "content": "21f3ccbd3298173d5c6a15f2c9d99836"
        }
      ]
    },
    {
      "bom-ref": "c6f303e1-33ce-4d3d-b993-381d6977580e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e648f2944e3fee0a25bdd435caeb8e67244011b"
        },
        {
          "alg": "SHA-256",
          "content": "058e02d2632396a729c1ca42c9340a1b335d415e73b53d22c81566b8d64faa0d"
        },
        {
          "alg": "MD5",
          "content": "faa2c9f0bd3204e02db68b93cd4930b1"
        }
      ]
    },
    {
      "bom-ref": "c73a6347-23df-4f38-b371-b0fdfd56f879",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfuse.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd14575ff1d42b6f6821f6b227ada95dc435a3cd"
        },
        {
          "alg": "SHA-256",
          "content": "5f05c0d27c4c697920def19f3108a3c8634eceaf13565bcf017c5933ff30457a"
        },
        {
          "alg": "MD5",
          "content": "cb7d57930c79fa5537837e65f93596f9"
        }
      ]
    },
    {
      "bom-ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f3b26259-c9de-405f-90c0-efa955b0bdd3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_sol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9248f2accd55d5f20e887a39a0ac28ce89ac99c8"
        },
        {
          "alg": "SHA-256",
          "content": "71fcdd3a5e4eeb1bf4489d1aaa1f4216438bc7587e70167607b22d25062c05b7"
        },
        {
          "alg": "MD5",
          "content": "1574f890373d7b5420d3389f67eb9d38"
        }
      ]
    },
    {
      "bom-ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/mkfifo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f4033d5d-62a1-4de4-ac79-a718afcf0c70",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4cab72f601a55b266c6fb68b26d763a364178be9"
        },
        {
          "alg": "SHA-256",
          "content": "a077372c85d6c4c97debb0272439694858d6a2a4abecd56b9c0d8ca3acc10a04"
        },
        {
          "alg": "MD5",
          "content": "d5aa2d1aca1941ddc4d5a43bafbd3073"
        }
      ]
    },
    {
      "bom-ref": "f41e1d4f-0e41-4652-9ca1-225d699d160b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/echo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f42711a1-891b-41f5-9765-82fd31de6d4b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b9564c2e65f78cd86074c1a6fdf224ddc4f7e64"
        },
        {
          "alg": "SHA-256",
          "content": "8bbd61a07cc4f4ed2daabd9af5f18385d46f5721068848f7fde639a92957d275"
        },
        {
          "alg": "MD5",
          "content": "3db2a536cd5aa4c902b101f22df6c3fe"
        }
      ]
    },
    {
      "bom-ref": "00187ac6-ae30-4a7a-9ff8-b1c0be481c6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/BiosFile_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "465e3f89f97db67931abab8ee6a6813c7c992d38"
        },
        {
          "alg": "SHA-256",
          "content": "ccde39e629aa6006fa5686741545e280e18c06e13fc1dbb0eb51b2b380cfa095"
        },
        {
          "alg": "MD5",
          "content": "176a418faf243aec692e99d1b360517a"
        }
      ]
    },
    {
      "bom-ref": "001bb4b2-1058-4b77-8c6e-8a1e9c1de296",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libudev.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ff1e2b43955dc5c42fd606f8dda9790ca480ee7"
        },
        {
          "alg": "SHA-256",
          "content": "b20b16b8f14376bbd4b9f8f999c13b276e7d6d26a299d86a72e1475e51f2875b"
        },
        {
          "alg": "MD5",
          "content": "c990c4007218b2af20439fe051fd72d0"
        }
      ]
    },
    {
      "bom-ref": "1a654e4e-c942-4ce3-9ae8-c2f6e6142338",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f9cc65cb8332dc2a947d05a69898067b10ce715b"
        },
        {
          "alg": "SHA-256",
          "content": "15380651977b7d24e04d03b6d5a3b73cc4151fb737c63acac28dcd24a5df498f"
        },
        {
          "alg": "MD5",
          "content": "0dacd210446dea36f35e740943c87afc"
        }
      ]
    },
    {
      "bom-ref": "1a706a76-db44-42ef-ba04-6f7138a3a93b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamVoltage.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6130f1aeaf0535cdc99f8ee8f08d450aa5c2ab16"
        },
        {
          "alg": "SHA-256",
          "content": "3c2cc7181b7f7bf8c2047ac2f7d81c02838a8930778fee19b7cce246fef70cc5"
        },
        {
          "alg": "MD5",
          "content": "80f0acc8b9de23be88324ef2421508bf"
        }
      ]
    },
    {
      "bom-ref": "1aa200ea-eb7f-4615-a348-94eacdfab652",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/yes",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1ab06a43-24f1-4dba-b361-ad0752aa7c47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_15_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20a05ba40ccf06a742cd4fcaa1e71fd5c3d91d8e"
        },
        {
          "alg": "SHA-256",
          "content": "64086c6e489b5ea90bc3eef396ec6c662b838a8babaa1efd60f41aefc07c245d"
        },
        {
          "alg": "MD5",
          "content": "24087a38c55eae0f3cf5a3c5e47c76a5"
        }
      ]
    },
    {
      "bom-ref": "1ac10346-ad97-456a-8b90-f88856120843",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/shortcut.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fdc19be87fcc1c51633aafc0b97d12113393a086"
        },
        {
          "alg": "SHA-256",
          "content": "9facffdc32e2f2f9e751ddf8728df3d4a6e07d829c533cfebbcca2d5fb0586d5"
        },
        {
          "alg": "MD5",
          "content": "3e19be32bce2d819025b660281088e5d"
        }
      ]
    },
    {
      "bom-ref": "1ad5f173-e681-40f4-919c-f1fc09edfb3a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/halt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1ad89fab-89c0-4734-b827-aae2b1cf62b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamCtemp.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "84ee91f4cbb8808255dddb5aa9eccb20ab75ccd4"
        },
        {
          "alg": "SHA-256",
          "content": "d6ed7b243b8974fe001f00b7b8d945b47dce7a224035ea8cd80229384500279c"
        },
        {
          "alg": "MD5",
          "content": "405577968690f26675e70dea1ff0437a"
        }
      ]
    },
    {
      "bom-ref": "1adabe31-43b9-48b6-9dec-ba200f7dddcc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkdb5.so.10",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adfd60fecd3221a987ff21090e377ec40f929d56"
        },
        {
          "alg": "SHA-256",
          "content": "4ecdceb0baf3964c1941fab95f45fe3c2697d2bba9af30a2fcd3732adad68e33"
        },
        {
          "alg": "MD5",
          "content": "869143339ba07ddeaa68b2a3a69e9cdc"
        }
      ]
    },
    {
      "bom-ref": "1ae21fb9-5e85-418c-a983-23060492fac1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SMCRAKP.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f01b4ca01716bc6f9636e89915e7846c264911fc"
        },
        {
          "alg": "SHA-256",
          "content": "9119e4a4deed1d8b0e9ad7000f5224d4b3979a22689c1beb143c2f94b7b18107"
        },
        {
          "alg": "MD5",
          "content": "01bced271e69ebdf1f73bd3f83d08293"
        }
      ]
    },
    {
      "bom-ref": "1ae5e5a8-1b4f-4d5d-b22d-5874396d454c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd37de3090443113cbd8d1a9b419b2c582d3da01"
        },
        {
          "alg": "SHA-256",
          "content": "98a5e52ebf149de37f38990590265ff19856aaec62db520ce98040e168669232"
        },
        {
          "alg": "MD5",
          "content": "207545854d37b49a2827bfb3024f4cfa"
        }
      ]
    },
    {
      "bom-ref": "1af086c0-6cda-4c0b-b89a-9f2ece122b6f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/DumpCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6a1e541822e963e881e7d9e3575a0df706f82b96"
        },
        {
          "alg": "SHA-256",
          "content": "7c564ab5cd36017d189de30c0893278322199c41328031363e693f35902deb4b"
        },
        {
          "alg": "MD5",
          "content": "feda57b3131712eb199ec30c6783b277"
        }
      ]
    },
    {
      "bom-ref": "1af6eec4-9603-4d0b-a30d-2c801f8c294e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/conspy",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/usleep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1aff7f2a-8b50-4b86-91f1-6c012792e406",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xxd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1b2b20b1-f72d-4f8a-8dc5-2417d8300a9f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcUtil.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd2bad991e3ec21e29d761cff15df94152a8a82f"
        },
        {
          "alg": "SHA-256",
          "content": "7d4367bec76360c7db93d6eb01bba49547ea380107f6306e961ff8e4deceffd3"
        },
        {
          "alg": "MD5",
          "content": "3699b0eb231fe372d9776ca25587e7dd"
        }
      ]
    },
    {
      "bom-ref": "1b3d49cd-9764-4172-b82a-399aee001ea3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libzstd.so.1.5.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f49b92e2d483a59646a741a5b9340d63e93ee1f"
        },
        {
          "alg": "SHA-256",
          "content": "c495d603579c6a203727a66bf4f2af4789ee8815d4635c22bfb2e2e68ad68142"
        },
        {
          "alg": "MD5",
          "content": "4302560a4ea0a94a90150adf74e25e49"
        }
      ]
    },
    {
      "bom-ref": "1b4702b6-ac84-47c7-acfa-6e3998b4777c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/networkctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a5881807eb048eb789ffb4909ac742a36893150"
        },
        {
          "alg": "SHA-256",
          "content": "64112556f7e099ed656959aa32281ac63392372c961634a3a5ca488a0dfce7d2"
        },
        {
          "alg": "MD5",
          "content": "903b1c1f5471b3195f2b067b17f02edc"
        }
      ]
    },
    {
      "bom-ref": "1b72714a-3264-498a-94a3-34d3edb30be3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ftpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a49314e8-eecf-4163-9142-4c805e8ec45e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_17.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47a91b924a993c1d2658ddb16cfb5fb338d3457c"
        },
        {
          "alg": "SHA-256",
          "content": "e92cfe60b67781ff3f4a3cacded9f4fb5aa64b0510a4ebe5db741f0ccf710305"
        },
        {
          "alg": "MD5",
          "content": "81cd6381996501840a0213abe8924bb6"
        }
      ]
    },
    {
      "bom-ref": "a4977a69-57cd-43f7-b29f-928a72c84260",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/user_pw_unlock.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "052a055c38c7afe4d87c8314caac85d5b7ed4206"
        },
        {
          "alg": "SHA-256",
          "content": "1baaf02741e7f72ead7709c6ab84f92958e6638fca95e2bc7d26ceabebc054cc"
        },
        {
          "alg": "MD5",
          "content": "859eb9a5819b7ac5a3887100e23f846c"
        }
      ]
    },
    {
      "bom-ref": "a4a6cc69-b43c-4e2c-a91b-aac00763d480",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkfs.vfat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c8547a1e-a94f-4900-9bc0-8d36bffe9c41",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RoleGroupCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c1b0e642932fd7fed46237761b5489e5797dd655"
        },
        {
          "alg": "SHA-256",
          "content": "39167d050fbea9c93e88247293313fdf3eb4511e898c42c973cc2433a3198779"
        },
        {
          "alg": "MD5",
          "content": "75c69969c7fc0fab36f4fac243d464fc"
        }
      ]
    },
    {
      "bom-ref": "c854bcb7-252a-49f4-b4f7-15aa374033cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmPolicyCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7a0db15093aff7828f39fc2acff6c9bec2192bc0"
        },
        {
          "alg": "SHA-256",
          "content": "c41740b9d0dddcb00116639e145a1516e55b5649e701d79dbbb7eeb7f80073bf"
        },
        {
          "alg": "MD5",
          "content": "69f9c171b582f0afd2cd525fa186504c"
        }
      ]
    },
    {
      "bom-ref": "c88a5444-8ae9-416b-a31b-4b948ac0203f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo.all.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd95964e349c2d0d0f99a5a70ae6fbc213cf40dc"
        },
        {
          "alg": "SHA-256",
          "content": "16a568356b1038ccb26aeeb1d7b09c0b5f6f1d4c37c8787c7234f4f4d7d7127b"
        },
        {
          "alg": "MD5",
          "content": "ad45c5e963d31afd3eb9ab807afa41a6"
        }
      ]
    },
    {
      "bom-ref": "c88f8135-b9b0-4666-b66f-73f7b9164448",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/ld-linux.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3636a7eba387bb5e1ccf7ce671e7266831373069"
        },
        {
          "alg": "SHA-256",
          "content": "17ca988d6dfc4686b54da143476d0f13fab9a374bb61883e0172645a4a222369"
        },
        {
          "alg": "MD5",
          "content": "e623f9f83ab0e413b6f79cc08d8d4bba"
        }
      ]
    },
    {
      "bom-ref": "f47ed3a4-8386-494b-88c1-dd7bb9ee2f0b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libcrammd5.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a2c93e2fef7fed59b95b71ab2c2961b03c6e41d3"
        },
        {
          "alg": "SHA-256",
          "content": "b84e7acb656385ac3cb9f9827081163873d0bd5f7231d5757152b3675b62b567"
        },
        {
          "alg": "MD5",
          "content": "52c4c3decbb577c1b3580b0c6939c671"
        }
      ]
    },
    {
      "bom-ref": "f48ff213-5bac-4bad-8d71-d159c3ef7822",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_hesiod.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c93d3ebff914ce1afe6fe9693cbe3dad38e4ece2"
        },
        {
          "alg": "SHA-256",
          "content": "2a1d13ca184e6e52a8b9598407f101fd670071ba3da8d7e35ba56ffd92737026"
        },
        {
          "alg": "MD5",
          "content": "f6e6d6f43a82e628f1a4d9f3d11bd853"
        }
      ]
    },
    {
      "bom-ref": "f49cbb31-7585-43ad-b60a-a797c01e2bfb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/ikvmd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2f27d267eb90c9eaaa88d1ee5465b569284017ec"
        },
        {
          "alg": "SHA-256",
          "content": "c8dc14d4d352c6a8b02c82a55d8e2da2f00afe5be23778c498983ecbdbefc339"
        },
        {
          "alg": "MD5",
          "content": "14c47d952073af77c26d9eb4d725d55e"
        }
      ]
    },
    {
      "bom-ref": "f4a76330-86e1-408d-9f00-081174fac482",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/linuxrc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f4c56090-a109-40db-92d8-4abd9634a09f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f12c835331c81e017079e8d6e483002a12c88bc"
        },
        {
          "alg": "SHA-256",
          "content": "3de13320e0ccc7e2cd9053f6a0dc7fad192181db130f29a4f8e9e2e5bc59bdea"
        },
        {
          "alg": "MD5",
          "content": "b5eccbcbfbea259e3717cb49c98e9611"
        }
      ]
    },
    {
      "bom-ref": "f50f811d-6349-46a6-a44c-b04811d4012d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "905bc0c905e6a2a6a61ff8642fe1778df7590a60"
        },
        {
          "alg": "SHA-256",
          "content": "6453ee8d56135820435b9237718c58cd0d4ae29ee44ba4f87b9a7bfaaceaa7af"
        },
        {
          "alg": "MD5",
          "content": "a9966c9ad82ef00a8da07b0eb0faaa8d"
        }
      ]
    },
    {
      "bom-ref": "f511245f-4e41-47a1-a1df-d741423f5988",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f519acd4-ec62-43bd-8dd9-8c14b9131404",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderSf.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ebbd3799bcd41911fa0b956b49169f473ce0cf1e"
        },
        {
          "alg": "SHA-256",
          "content": "f2ac326b4b01425c58cffecb4134a9515516cba2010ed2e976a020bf12496471"
        },
        {
          "alg": "MD5",
          "content": "314169122ba78ca7729a739240627c23"
        }
      ]
    },
    {
      "bom-ref": "f5455021-d9bd-4878-a449-fa09caf41df5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmDomainCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "075ff8e8faa30c31d5d094f3237a5474a80109ab"
        },
        {
          "alg": "SHA-256",
          "content": "dcfa06a39225fc677ac27b0fb6b22d7ec8213c5f0edebc2f3135efd1306a189b"
        },
        {
          "alg": "MD5",
          "content": "2fc7755e4bfdb668c82837505ded86e1"
        }
      ]
    },
    {
      "bom-ref": "f54ae5ee-b90b-499e-b597-a7afbb8c4c20",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/libwin_x86__V1.0.5.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7845f7b232fceb9e0286163392bf1b81a4eb111d"
        },
        {
          "alg": "SHA-256",
          "content": "03712e6207812745f12233cb534612ba4a7f2cefa8a672ee0129a132bb9f2fc3"
        },
        {
          "alg": "MD5",
          "content": "46030034c0c66b57a25bf500b4c96351"
        }
      ]
    },
    {
      "bom-ref": "f5871e39-bcb5-4881-953b-e597e9c1a3f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f58fa016-ba5b-43d0-8bee-96821fec1978",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libBrokenLocale.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bb13ed877fd8f132fd27aeabf10ffba52bb78fb"
        },
        {
          "alg": "SHA-256",
          "content": "d9d3910d28e68c6a3175396b148b112d860ba4e13c4747d149ec25c63daaeebc"
        },
        {
          "alg": "MD5",
          "content": "0721f2748e73d246ec7100a0708ab977"
        }
      ]
    },
    {
      "bom-ref": "f59f296e-1573-4bd9-8a27-0d5b073dc1d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/restore",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74c123a448ad94a342e43357caa989a46f02d3a3"
        },
        {
          "alg": "SHA-256",
          "content": "9b9fd87d96a76df83b0f20a2b9362be612247ded5548b578ba376371271cefec"
        },
        {
          "alg": "MD5",
          "content": "255f1bda42e1909f0859a8f0d7cee4b1"
        }
      ]
    },
    {
      "bom-ref": "f5b432e1-a85a-46a7-ac83-e06b661eeca0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/alert_send_notification.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "146f1c42b7e54848ad27622fc438725effdf8ec2"
        },
        {
          "alg": "SHA-256",
          "content": "d5a5beaae049c6d6f34da0244beb37a09b9e500e25c77018bf4b21606d0af12a"
        },
        {
          "alg": "MD5",
          "content": "f541925781ad96f4ceeadc13dcf560a8"
        }
      ]
    },
    {
      "bom-ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pscan",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f5e4f8db-ced5-4aed-8b0a-e2147f6f598a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/tftpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f5ec4186-9ebc-4639-8ba5-9ed7fa86f903",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b9564c2e65f78cd86074c1a6fdf224ddc4f7e64"
        },
        {
          "alg": "SHA-256",
          "content": "8bbd61a07cc4f4ed2daabd9af5f18385d46f5721068848f7fde639a92957d275"
        },
        {
          "alg": "MD5",
          "content": "3db2a536cd5aa4c902b101f22df6c3fe"
        }
      ]
    },
    {
      "bom-ref": "f61fed65-3cb0-4a06-b872-8fd71c0260b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/[",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f667d14d-825f-4795-b492-5a7b639b8364",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBrokerCore.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "779c0cd06ea905815ea879d895b34b8b3eb36b62"
        },
        {
          "alg": "SHA-256",
          "content": "2cf252b6b66b821b81da98e8530af76c4f02fd48181d6a634c31074cbe6b536d"
        },
        {
          "alg": "MD5",
          "content": "e8f026ed88817f637bce55587cf7b327"
        }
      ]
    },
    {
      "bom-ref": "f6817ede-ed49-470d-ae1a-9a90333586aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.binder.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e25c88eb099883cf9ed4cebc3e4737209206386"
        },
        {
          "alg": "SHA-256",
          "content": "947d7ab1d02efccd1380238bc02e364c19a0e58eee07fc7e1550f677882feb34"
        },
        {
          "alg": "MD5",
          "content": "0f7e389ea2279a62ed230009344f7a92"
        }
      ]
    },
    {
      "bom-ref": "f6870933-b741-4a3e-b950-a78231c1b11d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/RoleGroupCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4e20a31e41a9886249fa20ebb833cc1b1e299e9"
        },
        {
          "alg": "SHA-256",
          "content": "d359d625ee45ff41592d6cafabce927f231c09ad2a7c8659a85b1000d342f72e"
        },
        {
          "alg": "MD5",
          "content": "d116749c63f7360ec9319a751f68467b"
        }
      ]
    },
    {
      "bom-ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ls",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f68bef9b-d4bd-459a-aba4-ffeaec95ddb5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/unmount.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55cb2c9b39bea8b79cbda0a1d11991d2f464e039"
        },
        {
          "alg": "SHA-256",
          "content": "90028a3e0f0d348567add2a559f324a4bb4887bdb6f9b345e4384537e9a5cd01"
        },
        {
          "alg": "MD5",
          "content": "fb1fda758b08783fc52b1ddd869a687c"
        }
      ]
    },
    {
      "bom-ref": "f6c69a52-4380-410b-b8f3-435eaf3a0f3f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2cfaf8a17f97070e1b2eb755b7997aa919d93e1b"
        },
        {
          "alg": "SHA-256",
          "content": "ff29babeb72d03027b377cde3b48a43176585aae7a73001491b130b8cb3318a8"
        },
        {
          "alg": "MD5",
          "content": "60e98682234f1d3f5ebec7b1097bf2ec"
        }
      ]
    },
    {
      "bom-ref": "f6ca127f-431c-48e6-8e98-2d29833f49a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_RecordLog.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66ef8cb4b39548eba128b9bee2b0fa025cd72dc1"
        },
        {
          "alg": "SHA-256",
          "content": "49413ffd81fd19c88958c1db4702ac8bf10b098a82c55dfd14ddf4a9b4134a08"
        },
        {
          "alg": "MD5",
          "content": "711dd9a35cbe15711f21bfa0b8aa3203"
        }
      ]
    },
    {
      "bom-ref": "f6ccdd0f-92a6-47af-bc5c-98a0b08e6644",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/librt-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b728c38d3e6d36827c4da6eb4f6b087c8aa865d0"
        },
        {
          "alg": "SHA-256",
          "content": "dd1abbbaeeed4e8f3b08fda7769e8547eb955a0f1b70d71449af81c6b2451479"
        },
        {
          "alg": "MD5",
          "content": "a54420a8a2aa3bd497cabf575ae1a2d3"
        }
      ]
    },
    {
      "bom-ref": "f6f4b06c-ffd0-47a4-916f-72dba6b095e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bea7d4f2c81eba019c699938d40fc52277586858"
        },
        {
          "alg": "SHA-256",
          "content": "146c25aaaf17677f1bed3cd9a9ebcc0bd2172ee829cfb04c844762d097af3f88"
        },
        {
          "alg": "MD5",
          "content": "c450c852b337fc9cdb67cc7438f1f462"
        }
      ]
    },
    {
      "bom-ref": "f713d887-1697-4553-ae3a-361d9e0d6689",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/setarch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f715632b-2ba2-4c52-8776-559d6e29ff80",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5aca88007e1a19f5070563540f4ca7cf7b520e31"
        },
        {
          "alg": "SHA-256",
          "content": "5015e9c038f83a6353b42a2117561d90e86871e1264fd1540a25880aa0aa94a0"
        },
        {
          "alg": "MD5",
          "content": "594271196d391be87977c3ab38209db3"
        }
      ]
    },
    {
      "bom-ref": "f7224e46-7174-4145-8e10-4afad557280e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/nsupdate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "45524fd7dab4f6dc2b19e3b99f1cdc8997756d84"
        },
        {
          "alg": "SHA-256",
          "content": "31305e0298ec11b2173c2e1bf4712dda1908dabef7c525039e0f07989f48fac1"
        },
        {
          "alg": "MD5",
          "content": "9d67dc395ff9d0bf88c7f632833d47e0"
        }
      ]
    },
    {
      "bom-ref": "f732f606-5f46-4d40-93e7-42f347748c34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fbsplash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f7578b57-579d-4860-bfc7-acf0aa6d8ea4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblldpctl.so.4.9.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5b27957703d8a92ce28a70eaf3e516b9049b19c"
        },
        {
          "alg": "SHA-256",
          "content": "5cefc8e2c67312af4c7360e88a08f83e7208bd33eb744b203b00c2cb72d84250"
        },
        {
          "alg": "MD5",
          "content": "697bac27a7769941bf6ba742252b098a"
        }
      ]
    },
    {
      "bom-ref": "f760cbc4-16c0-4e08-be06-2a1a82167dc9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SET_PT",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f9643a1ab42391692f55608353b7cc2973e45c72"
        },
        {
          "alg": "SHA-256",
          "content": "65d3a106b6cfe16cfad3a87e712ed9d3403ee4e23ff64e7b0fe5e784e959d525"
        },
        {
          "alg": "MD5",
          "content": "9c6c2c5b59efa353ed6cd2903f06366f"
        }
      ]
    },
    {
      "bom-ref": "f790dd65-5f2f-4002-9f67-998f02ac624f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/FilterRuleCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b1bebfa2b37970503db090e971c5eb22ece40688"
        },
        {
          "alg": "SHA-256",
          "content": "b4b4be02acd41837935ea89d9a4591918948add6b5735be7fdb367a6e2dc7196"
        },
        {
          "alg": "MD5",
          "content": "6c7d6d13424cece0c006e4b6c5e76198"
        }
      ]
    },
    {
      "bom-ref": "f7953038-ae7f-48c8-86b5-a6c2e22df3dd",
      "type": "file",
      "name": "./1245380-1982464.optee",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "888000ab5e7a81ef078f6714edcfbe48cc95c902"
        },
        {
          "alg": "SHA-256",
          "content": "09ae1e385697e87e04e20b65a9907b3f88f09bbba72fbbc1c51a6e2710f5b159"
        },
        {
          "alg": "MD5",
          "content": "e6e132a6a2aec1cd66d22b59f1d09388"
        }
      ]
    },
    {
      "bom-ref": "f79e2108-175c-451b-8856-601e8a7f7986",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip6tc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cc7c53291fd1d41a869ff7eb322bb21179d3dad"
        },
        {
          "alg": "SHA-256",
          "content": "afc2309636826a891d1373b061f26872a2d44421949e266a447a1f62887cf0df"
        },
        {
          "alg": "MD5",
          "content": "eda98f670b06862f81dce603bb73173a"
        }
      ]
    },
    {
      "bom-ref": "f7fd194e-1465-4837-a855-f7023f9d9a6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiDiscrete_SensorProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52028d2590e6c00aaba67816c2a939b295ed5e3c"
        },
        {
          "alg": "SHA-256",
          "content": "4dca2527ceed5549003edaff9e1ff777f0f05689cd783e1e1ef27b77b743f522"
        },
        {
          "alg": "MD5",
          "content": "0fa351821b8a3f1a425cf7a6c26c32c5"
        }
      ]
    },
    {
      "bom-ref": "f813c388-2db2-4c61-9625-4dc639ecac8d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fdformat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f81e1e0a-84d3-40b7-aba5-fecf954aca59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_STD.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b65166bffe61b5e3260ab3a1b6f3a05d6ccac87d"
        },
        {
          "alg": "SHA-256",
          "content": "9ed4fc0073f37b40d88b799fdd36e50a4bb4a15263ebf6c5d7b6ba748af7be03"
        },
        {
          "alg": "MD5",
          "content": "591b418f4a46459e6c9a2b2da76bc578"
        }
      ]
    },
    {
      "bom-ref": "f81fc0b2-707c-492f-95c9-1768d76150b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_atomic.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e541b78eda09e704aa81839f4fc97a42efa6fc7b"
        },
        {
          "alg": "SHA-256",
          "content": "bd6bb274402121e16cf454472f8989b00151bef23efa776f8df5c7990cbdd5f3"
        },
        {
          "alg": "MD5",
          "content": "eccf56d6d9937268c8842595c3fee1a9"
        }
      ]
    },
    {
      "bom-ref": "f8240433-3519-4099-8aa3-9b9947b72fea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/window.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1766df3a1540a3bd564db5f10112ab71bce07419"
        },
        {
          "alg": "SHA-256",
          "content": "5d3091d5cfa2760dbb1ae80045f1ad84bfd0cf0f3c43f221682b45175ed116cf"
        },
        {
          "alg": "MD5",
          "content": "4e4db19bc14297afe5b761608499fc86"
        }
      ]
    },
    {
      "bom-ref": "f83f4f1b-1845-4e0b-b66d-89eb9417b519",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9b553c9c7584e97c33c6a1c79e928de1ea7a5037"
        },
        {
          "alg": "SHA-256",
          "content": "60ff5232252fab453912939e96a667e31d857573c70edd9fa24dfe99536b2920"
        },
        {
          "alg": "MD5",
          "content": "54ada575049905abe6c8a0e9e6cd2b15"
        }
      ]
    },
    {
      "bom-ref": "f8588eef-bd46-411a-ba97-3002da051c48",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9daf1e79046b86b2ccaee446524ea89955d62743"
        },
        {
          "alg": "SHA-256",
          "content": "eeec5e8c1cd8f77aa9c7a4bf99c5d3da3ebaca8424de90962a00fa078783ac92"
        },
        {
          "alg": "MD5",
          "content": "8fbd2f730b30033cd39391599b7cf070"
        }
      ]
    },
    {
      "bom-ref": "f87e4e89-6583-4064-89c8-d30462cfbf86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/tunctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f884a9ad-cad8-4928-b1a9-e2b944877fba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ttysize",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f895774a-9349-444e-9794-370bc0a71b63",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14QBH_PLUS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5a11e6e8e3758e4828ebb85bc5a8a60619ab2e5b"
        },
        {
          "alg": "SHA-256",
          "content": "a0553feb2f2c7f66e12fa160a13324e6fd3e2532fc108ae9dc59fd6c99e8d1ab"
        },
        {
          "alg": "MD5",
          "content": "8b5f6904247a50fb6f053d362cb12c49"
        }
      ]
    },
    {
      "bom-ref": "00209d57-f76f-4a38-9ba0-130e69390d92",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/miitool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7e856e4ad44e13b9fed67487f6b1f2f9ae13de09"
        },
        {
          "alg": "SHA-256",
          "content": "79c6930af38a21e97b79e123bdd044c24cdd1216ac67a3192110e48e281995bd"
        },
        {
          "alg": "MD5",
          "content": "3c3e01ab188e983329afea78bc81b547"
        }
      ]
    },
    {
      "bom-ref": "0027a5ee-df44-4799-9e69-4dd3feac193b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/df",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0052d528-fa95-45db-8de9-8c58440a18b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "79b2029db8aec97cc1438fe738409e7761ba079e"
        },
        {
          "alg": "SHA-256",
          "content": "d5acab4c23b5f429800ba9e1cacd372ee1f5264e0d36b9a0e5d2e0e1c64555aa"
        },
        {
          "alg": "MD5",
          "content": "96a5efb85e3a2388ca8db9c3bc12d6b1"
        }
      ]
    },
    {
      "bom-ref": "007f4c79-9ae9-40f4-bb3f-7645c8f363de",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/etc/ddns/tmp/DDNS_CONFIG",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8f297df6ee8de538bf1e406462618724fef65171"
        },
        {
          "alg": "SHA-256",
          "content": "f0e78b3c9c840e3393ee789ff30608a908930cbf6b9ca3feed9f6b6b37cb02aa"
        },
        {
          "alg": "MD5",
          "content": "6863581ab4d8e9d1aae70566d03f4adf"
        }
      ]
    },
    {
      "bom-ref": "0088b473-e3d6-4b29-ab3c-2b4a44952ac7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9c0f91056340ef1c8e99798635c424a6c44826ff"
        },
        {
          "alg": "SHA-256",
          "content": "5b574b1e8ac00708866683d875a4f27fdbf315307801fa886ab9e989a15508ee"
        },
        {
          "alg": "MD5",
          "content": "0c6840656e7c9cba91426b8f8dfec949"
        }
      ]
    },
    {
      "bom-ref": "0088c375-700a-4c15-801d-b2db58b00116",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/MemoryPFA.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0a6a0cac7ad5970f5e22df4cb9c96b2abff3ab0d"
        },
        {
          "alg": "SHA-256",
          "content": "4953c0a270d89c30cc7141b9ac27de606be93261faaca0766c1684e948fd6d3c"
        },
        {
          "alg": "MD5",
          "content": "0cc13cad2ba724eda902ac51a856804c"
        }
      ]
    },
    {
      "bom-ref": "00b6402d-a807-4685-a61f-aa18aed70fdc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tcpsvd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "00b69eb9-a0c1-43b8-a855-710d434ddb88",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/access_load",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "50000b2a9a13a03506fdf0c8b20ac6b758742ed7"
        },
        {
          "alg": "SHA-256",
          "content": "3ea9a1da7c35e163a258f4206f1c5e1b5694bf78402c3d17168eb3f37ebb0178"
        },
        {
          "alg": "MD5",
          "content": "a2e5acf4ff814adce9f4de06bf8b2aca"
        }
      ]
    },
    {
      "bom-ref": "00cab445-ad78-452b-b8e5-cc4254a4fa0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nbd-client",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "00db5dbb-0b19-4c97-bb52-78d4118ac3f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libcrammd5.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a2c93e2fef7fed59b95b71ab2c2961b03c6e41d3"
        },
        {
          "alg": "SHA-256",
          "content": "b84e7acb656385ac3cb9f9827081163873d0bd5f7231d5757152b3675b62b567"
        },
        {
          "alg": "MD5",
          "content": "52c4c3decbb577c1b3580b0c6939c671"
        }
      ]
    },
    {
      "bom-ref": "00e06dd2-2c26-4580-ad5a-fcacbf45925b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmTrigger.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d97808720f2f501fc3a5e19ab4ccdb732d6419c6"
        },
        {
          "alg": "SHA-256",
          "content": "222ec61c48420dc3929519b91f00dbc70d37db06c43a38b3433add434cf487f9"
        },
        {
          "alg": "MD5",
          "content": "1e37a078123f05e3ea63d85edea93b37"
        }
      ]
    },
    {
      "bom-ref": "00e7d85e-c457-4586-b39d-1e319c8e40b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap-ng.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2365de6e4073ba24ee2f825c773395d9bacfafb0"
        },
        {
          "alg": "SHA-256",
          "content": "3aae811e6588809c5a4ead920c4d909c46b78a27f4dabb25c08e2e71f2ac3d0b"
        },
        {
          "alg": "MD5",
          "content": "aa94bc3d29e63c53fc19c8bf711d245d"
        }
      ]
    },
    {
      "bom-ref": "010a844c-2166-413e-aca1-f5f147b8d61c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hotKey.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5c5154c290e698233f5544a71998ee7a0a12e11"
        },
        {
          "alg": "SHA-256",
          "content": "dd59f1d123545e1bfe2449f4c7a1685a8e933e5cee00e95542cf65bcfcbf6278"
        },
        {
          "alg": "MD5",
          "content": "96fdd033df00b286c7cef0b0e45d6d52"
        }
      ]
    },
    {
      "bom-ref": "0112090c-954f-4191-a9d8-b0491a9c63cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58fab334c0c740d0682d0e6d3e37a2a1835e774f"
        },
        {
          "alg": "SHA-256",
          "content": "d0436b04cdf93b84565f93d279c8bb720b2a4e89c05ff11d361906dce9c69a6f"
        },
        {
          "alg": "MD5",
          "content": "1d06313b013870afe4234f2e9b090a29"
        }
      ]
    },
    {
      "bom-ref": "01123f2a-a1f9-4e56-98c5-a666be0a02fb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/script",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "013b6ff0-a611-435b-9dac-d61573401939",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/expr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "013df739-200e-453f-b451-799726081fd3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/renice",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "014cdc4b-1031-4519-8fc6-da8b173c2149",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCertificateAuthentication.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64f619082e9cfd6078c495df4d8891d9deb45e1e"
        },
        {
          "alg": "SHA-256",
          "content": "99f13f1c597f53167d043b5d183c44cad366e1fc41c4770cdceb86d9e8e29413"
        },
        {
          "alg": "MD5",
          "content": "2a98c029aeae7b2fd15b1b96905c5559"
        }
      ]
    },
    {
      "bom-ref": "014f1cb3-dbe4-4fdf-ad66-bfc12ecc4aa3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "01505a68-ee92-4a17-a5f5-0bc6d6677ca2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/webfonts/fa-solid-900.woff2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b2879f9e1d0985a96842bf7f55a2b2cc4c636d04"
        },
        {
          "alg": "SHA-256",
          "content": "3d1080625d3030e88357b3ac9aa377dcec23f1b529c4ad03f7a9a435ccae04be"
        },
        {
          "alg": "MD5",
          "content": "44d537ab79f921fde5a28b2c1636f397"
        }
      ]
    },
    {
      "bom-ref": "0156d3c5-ffcd-40e8-a171-b9225f9c09c6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/klist",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b0a1bf36c9ddca7eda2b4dc4a2ee3f24b3add27b"
        },
        {
          "alg": "SHA-256",
          "content": "babf5afc57fb66a15f410caca9df3817cd23f03ee9f1be5e81c55ff7c348e9d9"
        },
        {
          "alg": "MD5",
          "content": "7a8866cb45380735a699ea002475fefa"
        }
      ]
    },
    {
      "bom-ref": "01788dfe-19bf-40b7-86d5-50b115d5348a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnl-3.so.200.26.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e6a207c7138d771357a991e8d9fbc0a93fefc80"
        },
        {
          "alg": "SHA-256",
          "content": "cc88216cd17a65c6ca6721817f6ac6130ee194eec0d2da45bac902e7eb5f2e04"
        },
        {
          "alg": "MD5",
          "content": "d86be3332539ffe888e994e49ea65c28"
        }
      ]
    },
    {
      "bom-ref": "017cea36-1184-48f2-a565-c4ef2f03a2ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_ssif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16e09d738640432acd84be386726501b44f9e871"
        },
        {
          "alg": "SHA-256",
          "content": "75b5621be8f8174cb2cc9325992413a49ce877758741610e3e2839681d5110b7"
        },
        {
          "alg": "MD5",
          "content": "e0e55b045feebfaef1985445c7d2927f"
        }
      ]
    },
    {
      "bom-ref": "01877e66-985a-4017-a2fb-81bbaf427f77",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/VolumeConfig_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4fccf5e50bfeaf7d2b216c1853fb0fa33381c654"
        },
        {
          "alg": "SHA-256",
          "content": "e373bd94f10be2ba6cc2249fea499ebbef116e61a337da6bec9fe6e95d786132"
        },
        {
          "alg": "MD5",
          "content": "83f89cbbf7353112ea87342108e2e264"
        }
      ]
    },
    {
      "bom-ref": "0193309c-5d04-4bfa-98b2-d6060d13c284",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_special_event_log.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8fa9acd2238cc68d28903228327c9ceb529a7057"
        },
        {
          "alg": "SHA-256",
          "content": "c857d2d1b11b9f391d24ce78449f61928cefca24da48967756dc988027617f86"
        },
        {
          "alg": "MD5",
          "content": "67081c9903cb52b4cbc7c5b813e2bfde"
        }
      ]
    },
    {
      "bom-ref": "01a8a83d-c5fd-4577-836a-50128cbeb0d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network_ssl.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "345e8c86bd9ad97820e12975d89628ae52523d87"
        },
        {
          "alg": "SHA-256",
          "content": "c689390c8254951019918bf2b0e73ebd40eb91c53d7c5d64b5a4201ef67e8f47"
        },
        {
          "alg": "MD5",
          "content": "bbdee5edda3fa738dc46aac0f5b78b30"
        }
      ]
    },
    {
      "bom-ref": "01a93b85-9dda-4e64-b542-2866753ed487",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcDriveExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7eb2ffda61228fc19ecaa98471cca1d61460391a"
        },
        {
          "alg": "SHA-256",
          "content": "dd28eaa4c28552a901b72284ee8c9562794a4a79183eed4c7fa0d6f144b01cec"
        },
        {
          "alg": "MD5",
          "content": "d8ece554edfce4b439d963bc7cd6ede4"
        }
      ]
    },
    {
      "bom-ref": "01b59f23-de1e-44d2-bb72-a01336f0c7ff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libanonymous.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e87edeff86ecac9c26aa2e69142bd56479ce1746"
        },
        {
          "alg": "SHA-256",
          "content": "065c03eeec61dc3cd382e2f2fc28dafdc973e224a98ff2beff8c2e718c56067e"
        },
        {
          "alg": "MD5",
          "content": "57a46a72ebd132436179f961ced8faec"
        }
      ]
    },
    {
      "bom-ref": "01c8613f-6462-4755-9b65-700753412bc4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/watchdog",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "01e2882d-483e-40bb-93a4-32a9e75cd2d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ea499aa6c2c65eaaf700161599306fdb7cf44f6"
        },
        {
          "alg": "SHA-256",
          "content": "4720553d3f400ec32c471129cef87be01a0571700c5095072dedf79732ac4114"
        },
        {
          "alg": "MD5",
          "content": "e47b3ee1984d0c343dd38848cf0985ac"
        }
      ]
    },
    {
      "bom-ref": "01ed9869-2fc6-4356-ba53-c90edb727fa7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfuse.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd14575ff1d42b6f6821f6b227ada95dc435a3cd"
        },
        {
          "alg": "SHA-256",
          "content": "5f05c0d27c4c697920def19f3108a3c8634eceaf13565bcf017c5933ff30457a"
        },
        {
          "alg": "MD5",
          "content": "cb7d57930c79fa5537837e65f93596f9"
        }
      ]
    },
    {
      "bom-ref": "02384364-dacf-4c93-ac2b-ce6835b35830",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/users",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "024edb44-9e4a-4fcb-9a81-cd33216d681b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aa2458b82242be26abe8c8023028195e61a38e59"
        },
        {
          "alg": "SHA-256",
          "content": "59c14ed0b5716e2c0c570a70494d459c9782f5f25b537892a15be726ed9955c4"
        },
        {
          "alg": "MD5",
          "content": "f32a3b2a6a18dfcc707b8230c257da9c"
        }
      ]
    },
    {
      "bom-ref": "02542bc2-5fe5-4bda-b2fb-21832414618a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/enSSL.config",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8f0cf3e09f5211981775eee469ec8643c69ec1db"
        },
        {
          "alg": "SHA-256",
          "content": "789fcc8771833b9578e8d3a96b6991b2353964fe0b43b2a1422f8cee440dec5a"
        },
        {
          "alg": "MD5",
          "content": "28f34fe03a21987c616fab1388c8ef21"
        }
      ]
    },
    {
      "bom-ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libc.so.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbae0235fb64a2369f2bddcee8cb962526de88dc"
        },
        {
          "alg": "SHA-256",
          "content": "c67d5eb747b323a199c3035024d9bc93779d3a47a9cbd286fa476e6d6f001dcd"
        },
        {
          "alg": "MD5",
          "content": "c73c76b05317d4761a2babcf15d3b74f"
        }
      ]
    },
    {
      "bom-ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/base64",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/readprofile",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iproute",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "02a080db-2edf-4520-902c-2cc40fa2ac71",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a3ee1b034312f26063fd57beb7e4fe745dfb6e32"
        },
        {
          "alg": "SHA-256",
          "content": "8b4d28ca70f4cc67a849309632d0e22e2396e767e2b2869eabb78af79d841904"
        },
        {
          "alg": "MD5",
          "content": "557d5df186183e3cca0b182a7169464f"
        }
      ]
    },
    {
      "bom-ref": "02c32201-61d3-4cad-ae7d-59570b0407fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uniq",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ftpput",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "031687d4-32b9-4659-b8a9-c4db5e552aab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setsid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "032969c1-21f4-4917-97a9-1023be61d926",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsmartcols.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4f65766ab540c6b70193402566f7b7c26e1649c"
        },
        {
          "alg": "SHA-256",
          "content": "a8650eaafa62290004086d255a0ff745e1ff6554b0835d7b4bd8291c74760c27"
        },
        {
          "alg": "MD5",
          "content": "ae41e3c5028eb86a96813b93d369966b"
        }
      ]
    },
    {
      "bom-ref": "03378a02-0d7d-4e84-acb6-6e6f7410ac94",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64a2b547509eb25e5aa8eae637179db665f2db3b"
        },
        {
          "alg": "SHA-256",
          "content": "ac8fee0efb46334d63c3208ea0811aa5345d8a25e8771d34fba70aeed6cf7ab9"
        },
        {
          "alg": "MD5",
          "content": "96a81a0f39a5443f6a75174fb329d561"
        }
      ]
    },
    {
      "bom-ref": "0346d4c5-c20c-4a72-8f68-d8998befe09a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libudev.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ff1e2b43955dc5c42fd606f8dda9790ca480ee7"
        },
        {
          "alg": "SHA-256",
          "content": "b20b16b8f14376bbd4b9f8f999c13b276e7d6d26a299d86a72e1475e51f2875b"
        },
        {
          "alg": "MD5",
          "content": "c990c4007218b2af20439fe051fd72d0"
        }
      ]
    },
    {
      "bom-ref": "035a466d-6f40-4144-8688-e39ed8ef969e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nohup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "036a6535-6322-4a24-bb2c-3b74d0b15481",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/watch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0379c716-c80a-4f02-8f24-15cb2465b819",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.grid.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e316a6bb6c31516710a0b16f47d1e14985f9b61"
        },
        {
          "alg": "SHA-256",
          "content": "0ccc961349179e01932c5f02d8f3190333fa2f2d3d27aa2291e8485a0689a5fc"
        },
        {
          "alg": "MD5",
          "content": "b804285ef08d4581e44d1122fb874dbe"
        }
      ]
    },
    {
      "bom-ref": "0388c3cc-d1cf-4192-8e23-9ecde9786b42",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_tftpd.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c62315d143a369a06fee764180584b5cda526aa6"
        },
        {
          "alg": "SHA-256",
          "content": "fd9d5e12bae15c8ff36f0cd01f7818f987dc055779ceaceb70d0c68346f47e06"
        },
        {
          "alg": "MD5",
          "content": "490942dd970f300cdfb311fbfe7e6fb4"
        }
      ]
    },
    {
      "bom-ref": "039a4e05-efbe-4e4d-8092-393b5f9f0bba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcMemoryExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34faae9771eb83061dc3a1599a0d6ab90c654c1b"
        },
        {
          "alg": "SHA-256",
          "content": "b347b3776bd70dff0623c1697a4d31b159ea8f46724c4dd4c7477cd326ddf458"
        },
        {
          "alg": "MD5",
          "content": "49969d945674590c2a5a1b11a2ffc3a8"
        }
      ]
    },
    {
      "bom-ref": "03a89f83-eb80-4755-860a-4d46c2378739",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_SoftwareInstallationServiceProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72fb724a52804e447a3fd2027683fd71d2c999bf"
        },
        {
          "alg": "SHA-256",
          "content": "970771402f4c190961a47590b7dbefe93e11ec49a5b05f11102c3ff7a72dae29"
        },
        {
          "alg": "MD5",
          "content": "29229359f388145246338c31f2ccd4ef"
        }
      ]
    },
    {
      "bom-ref": "03b6bb64-a3a2-4ac5-8b0f-78efa4a77f86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_LogRecord.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5145892cebd82f0babced2adfb51e2869358b942"
        },
        {
          "alg": "SHA-256",
          "content": "fce885b7c1d3a8b4f1cdf035f9590df278c7c27fcba3bdbaf67df92c9a44555c"
        },
        {
          "alg": "MD5",
          "content": "89968a6bb52fb608903d4685cc74a64d"
        }
      ]
    },
    {
      "bom-ref": "03c93935-63b6-49be-8ed3-350f7629b15b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SMCRAKP_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9fcf589ef06fae3550fc9442f1fe780d556b3a1e"
        },
        {
          "alg": "SHA-256",
          "content": "a09b124cdc2893488cd8341ba081cc0c34a69ab07c00888b57f7b04351841b3b"
        },
        {
          "alg": "MD5",
          "content": "33dcd21d97aa1c596f2aaa8a08a70036"
        }
      ]
    },
    {
      "bom-ref": "03cf73cb-d795-45f7-a380-8f378d8ccc35",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_OPT.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "32e7f1bfe8a11b2ccf34701917a5f7956efe5c04"
        },
        {
          "alg": "SHA-256",
          "content": "d7157bd6740afa157dc7f4c63e5cb7d18b435a6416045adbcb4bb3c9d5e2f09f"
        },
        {
          "alg": "MD5",
          "content": "058da1eb68e7c05b6c9beb0c8349874a"
        }
      ]
    },
    {
      "bom-ref": "03dafdd4-1e46-4681-9d52-b346b4a901f1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/OemDumpService_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a98ed614ccfd356ac6b06a443b5eebcabefa269c"
        },
        {
          "alg": "SHA-256",
          "content": "f9f537c1ad25ec25a350093e8948fca3653193b3260c10e3981dc8181c002f9e"
        },
        {
          "alg": "MD5",
          "content": "ebf7b170b015c4b4fbe3bd69c9405623"
        }
      ]
    },
    {
      "bom-ref": "03f21f44-46da-4867-8f53-1bc705f92134",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsmartcols.so.1.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4f65766ab540c6b70193402566f7b7c26e1649c"
        },
        {
          "alg": "SHA-256",
          "content": "a8650eaafa62290004086d255a0ff745e1ff6554b0835d7b4bd8291c74760c27"
        },
        {
          "alg": "MD5",
          "content": "ae41e3c5028eb86a96813b93d369966b"
        }
      ]
    },
    {
      "bom-ref": "041782fd-db5b-4f84-88dc-4bc601b5270a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip6tables",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "0430e961-36a7-4d1c-9dde-5ea55c632143",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/playvideo.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2bab2b888e5fe1abcbe1cc4e7d58b8921b6591c4"
        },
        {
          "alg": "SHA-256",
          "content": "57836903dcf31d17466d4845efef7e8d1691920f12285de1e13d600c5e990d89"
        },
        {
          "alg": "MD5",
          "content": "f81a546cf3ff960a880d9e423d811207"
        }
      ]
    },
    {
      "bom-ref": "043c00f0-9efe-4874-9448-f6912fde9681",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tee",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "045af516-5f24-4f5f-a101-235011fd3ae4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sysinit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e4c5e528092aa1a389d2b0b2b6f7d842ec6246cb"
        },
        {
          "alg": "SHA-256",
          "content": "cabc4ce9c5cdbca59d3183b7eb4f540f8d319259bcc8369071f17243f8fda279"
        },
        {
          "alg": "MD5",
          "content": "e4f44046b49c4a68e5883a5ebe1a1a4c"
        }
      ]
    },
    {
      "bom-ref": "046df221-ab63-4bdc-933d-17e078da5e68",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_LogRecord.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21980db9497cb95e18ec3a96101a4ab87d214b62"
        },
        {
          "alg": "SHA-256",
          "content": "cd9e88bb17564770bbfb53491953c7ad395ffb75e89c0521833e1ae611b833a6"
        },
        {
          "alg": "MD5",
          "content": "2b4f5dc88bb9f2b8c21d31c58b3929a5"
        }
      ]
    },
    {
      "bom-ref": "047cde2f-6048-447d-819f-b77f96d51b78",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcFileRepository.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64efa4bbb1111b4255f6b924d1ae5c549ef40fa8"
        },
        {
          "alg": "SHA-256",
          "content": "d440914639cd70b97dd11d037ef7f623252492f4efa4f9761142b9ee9b5f7e06"
        },
        {
          "alg": "MD5",
          "content": "e6201b393f6c99c6bde694a7d0220fac"
        }
      ]
    },
    {
      "bom-ref": "049ac68d-5a29-46b8-8a56-312d56b826eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/storelibconf.ini",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bf9dc8028df83aafdf84c576c6eefac03d8c9c53"
        },
        {
          "alg": "SHA-256",
          "content": "0a2903cc2f41a48a4b7ebb5125a3b2808d516668ce1f26a2fe3de3d9f55fa0e5"
        },
        {
          "alg": "MD5",
          "content": "104a8056a4ca79cc68a5645395d5a590"
        }
      ]
    },
    {
      "bom-ref": "04a6dbf9-0718-47f7-a69a-4b9fbed074ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/vlock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "04b8b736-c910-4743-b53a-995d20fa1bcc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_21_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9c8a6e8fd33b8f9e4d7aa653bad150625120ece5"
        },
        {
          "alg": "SHA-256",
          "content": "04dc433b52d72b392e8adb676e0aa82ce312253e06bed4166df280afbf8cf0dc"
        },
        {
          "alg": "MD5",
          "content": "c47b2a8646637159a8910625535c3e1f"
        }
      ]
    },
    {
      "bom-ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "051974f1-fec9-47bb-bf52-04e55f301039",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_contract.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66adea2ef92f14748d4d6800243d5a9edaf5ebd2"
        },
        {
          "alg": "SHA-256",
          "content": "30e9570640314eedf4512aed63bbe426fb8edd6673873933a8a2e7a84f301f91"
        },
        {
          "alg": "MD5",
          "content": "afd4be5004dec08528a6356ed33520b4"
        }
      ]
    },
    {
      "bom-ref": "0524c8f2-b3b1-4624-9f1f-14bfcf5d3397",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/details_close.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "221e1180b6137825cf1d8bddaf41586770b47ced"
        },
        {
          "alg": "SHA-256",
          "content": "5cabfb28f8df947c7f5289a5ebc3f38262aa693a176afcec93fde3aa7748f46f"
        },
        {
          "alg": "MD5",
          "content": "cdb0ad00d71eff5be6ca7305cff83ce9"
        }
      ]
    },
    {
      "bom-ref": "0536366b-ab2d-40aa-a3d7-811db174c335",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_15.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb1c538cdbceeca77ae0164234318087c4395fbe"
        },
        {
          "alg": "SHA-256",
          "content": "1a87a8c87d6ceaf677606fa36ab24c6693d29bcc1349e2cb0d6b0795207f326d"
        },
        {
          "alg": "MD5",
          "content": "59c5119b923eb14e9fc007c6e2ccbdae"
        }
      ]
    },
    {
      "bom-ref": "05396339-b918-49ef-aca8-1b6a12ff64cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_summary.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d8b9a1e82c559431abc0182549df9b6b0163cc09"
        },
        {
          "alg": "SHA-256",
          "content": "75338ad35d65190e75ca87cb9f37ea43d7928a2c2fedb515975ae1e80b920afa"
        },
        {
          "alg": "MD5",
          "content": "52f1268ea0d87534ffc4229087c69550"
        }
      ]
    },
    {
      "bom-ref": "05427b2d-e41c-4b2f-99ef-5fa10e9a44ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "054e35cf-c521-4ca5-8a37-86563aeb7c1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/vmedia.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db2b652aee7cfc0de7d81eb38f7ff730b2f065de"
        },
        {
          "alg": "SHA-256",
          "content": "2651bb20fc6da061c003b567795c797969ca49f066ac5e86b47bfdf6dda46855"
        },
        {
          "alg": "MD5",
          "content": "ec5d570423d0d49e8fa1cded7ca26d6d"
        }
      ]
    },
    {
      "bom-ref": "055c16be-5531-4353-ae5f-f775a604a2ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/chvt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "058aac02-1961-445c-ab39-5588a73f0bf5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/video_drv.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a52e68b1c15e3b20f959a3b36141be3efc3d9aaf"
        },
        {
          "alg": "SHA-256",
          "content": "5a619da30d0c854109d94df5acbd950edc815754da28cfe5ad48c12496da017c"
        },
        {
          "alg": "MD5",
          "content": "5b5bf09977710bedad1455eb820b7b9f"
        }
      ]
    },
    {
      "bom-ref": "05977b4b-4300-42ae-8e5a-5ed99ada4bfd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libattr.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0dc02667c1451329e26879d97c53bcae6a8d914"
        },
        {
          "alg": "SHA-256",
          "content": "7f50f91cc02a8bf12119b5d4ce81273c69e1fadd9be499bde0f43c47d0026e07"
        },
        {
          "alg": "MD5",
          "content": "e8feb6b8ac215b468839e2ac31a2f90b"
        }
      ]
    },
    {
      "bom-ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/hush",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "05c223ef-c98c-4682-ac1c-1ac739c46dfc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthInfo.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ae62d997260bfef0ae72df8916d288ce6d3f188d"
        },
        {
          "alg": "SHA-256",
          "content": "205f20146ea6fde893383cff36dfa817fb45fb0fe4904c6482d82788c70a2c7a"
        },
        {
          "alg": "MD5",
          "content": "e06379afd93ff92571a815c7beeb50ad"
        }
      ]
    },
    {
      "bom-ref": "05f560a0-a3a9-45ce-b54d-baf248b76fa0",
      "type": "file",
      "name": "./1118224-1119685.crt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e7981af6aeaafa6b8c553da12d3659cb7cb0c385"
        },
        {
          "alg": "SHA-256",
          "content": "0a44cdb608a78b4abc48900e055535806a985f313a5dc1cd833a6d5fb9b0d5a1"
        },
        {
          "alg": "MD5",
          "content": "b6fabf9b750c3042c2af281883d8f586"
        }
      ]
    },
    {
      "bom-ref": "0607c597-04a2-4afa-918f-7c7683a346dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblldpctl.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5b27957703d8a92ce28a70eaf3e516b9049b19c"
        },
        {
          "alg": "SHA-256",
          "content": "5cefc8e2c67312af4c7360e88a08f83e7208bd33eb744b203b00c2cb72d84250"
        },
        {
          "alg": "MD5",
          "content": "697bac27a7769941bf6ba742252b098a"
        }
      ]
    },
    {
      "bom-ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/eject",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "068fe258-409f-40c1-bbff-72647aeb2ce3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_14_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ab669855557769a37655225b183e25276a71ce4"
        },
        {
          "alg": "SHA-256",
          "content": "7e87fb86f340a69e49b2e52bfa8879e85962dadc0b8cbd02e85c83eac7d59396"
        },
        {
          "alg": "MD5",
          "content": "aed9c973158c293b0123198fe3aa816f"
        }
      ]
    },
    {
      "bom-ref": "06d7e6d3-eeab-4765-aba6-643dde953dd4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkfs.minix",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "06dac57c-b11e-4c61-844b-3040a9b06f21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libscrutiny.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "716587415e47b2f04913f1520e20d06e7556bed8"
        },
        {
          "alg": "SHA-256",
          "content": "81aa70a266356533eac9a6d06664500fd18240e5c892508b078c1fe3424323c6"
        },
        {
          "alg": "MD5",
          "content": "d4e3e2679c8aaa1522ece78015c38386"
        }
      ]
    },
    {
      "bom-ref": "0710a46c-f332-4ce1-a71b-2d4a7d15ba93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit3combo-bmc.so.16.07-0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61422649e3e26f3b6d6fe708c8059e5db14a7cc9"
        },
        {
          "alg": "SHA-256",
          "content": "bc41f5677851f54dffc8a42af4d168ec0dd543ae47874384cff457891bea5846"
        },
        {
          "alg": "MD5",
          "content": "fe9452d41858f2f423b8509ce638967d"
        }
      ]
    },
    {
      "bom-ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/arping",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/killall",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "073376d3-f892-4c9f-86e0-472d86ce7f32",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam_misc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f7070eaa4b489e6f76c6bddaa0b5bcd57f0d3da"
        },
        {
          "alg": "SHA-256",
          "content": "00c1efd1a7673edc66771060c55713d71c76b9a28e5895556a07da506185a94a"
        },
        {
          "alg": "MD5",
          "content": "ee5f5e4e0702d9b4255d053300f869f5"
        }
      ]
    },
    {
      "bom-ref": "07398ddd-b24f-4b4c-8694-3b031bf78992",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libe2p.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b5d34c603dad67131876a198ee5acb6bb94b0fa"
        },
        {
          "alg": "SHA-256",
          "content": "3ebb8f58cd41f3ae8ffe22939e2307dd72068263926b463e813462b1077b5ecf"
        },
        {
          "alg": "MD5",
          "content": "827a4409c74b5dfcc049e1e84dcc687c"
        }
      ]
    },
    {
      "bom-ref": "0754e277-2804-4346-8968-38e062356c72",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "619f743e3cac3b1eb2a265123ce3fdd880c913fb"
        },
        {
          "alg": "SHA-256",
          "content": "28f2d75c56500c916df231fc3fd3f627f2bbdace4ea8789aabba0e2c9bf3f225"
        },
        {
          "alg": "MD5",
          "content": "4d467ca468ef6523bc42cbecd496085f"
        }
      ]
    },
    {
      "bom-ref": "075e87dc-0dde-4e12-bead-96a8ea1abe07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/preference.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "40468e6dd145b9e7965d0c15a6e9180d7aca28f6"
        },
        {
          "alg": "SHA-256",
          "content": "a91b4a06521c456f2753d96c987be57195ceb31d3d93b3aff9d42b0065141e12"
        },
        {
          "alg": "MD5",
          "content": "605f474c502c75c6a4e84831b8f31230"
        }
      ]
    },
    {
      "bom-ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/awk",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "07654863-b5da-470d-899e-0d8f3f740f15",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mkdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "079358b7-675d-437e-ade2-375cda0e52f1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxtables.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f577a10a10b85df6e4036e1bf248a306f361a092"
        },
        {
          "alg": "SHA-256",
          "content": "da2593460f7623d27ec31d44fac5c17e64d06c607ae98f71aad3b9f6e0bfc4d1"
        },
        {
          "alg": "MD5",
          "content": "a332c49f74cbe1d7a553910a49da2de6"
        }
      ]
    },
    {
      "bom-ref": "07b8aae2-d256-4b89-8cc3-2348450f2300",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/nice",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/swapon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "07cfd701-2347-4698-a4b3-325db10dc5bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/rdev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "07ee7806-7897-4489-94a8-46b69e4d9ebd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_type_erasure.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb2cf3b1e236bfd3f326e87220196185df60d742"
        },
        {
          "alg": "SHA-256",
          "content": "781cd33e987ec1dcf8f557dad3bf1a1f93f13419d775976c74ecf082619e6e2f"
        },
        {
          "alg": "MD5",
          "content": "d1c868e78a8d81cee15d17279ee7eb83"
        }
      ]
    },
    {
      "bom-ref": "08075ef2-0533-4823-9167-5506cfb4ff87",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fsync",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "081b62e4-7f89-4050-adc7-ac68efa02920",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/stop",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0cf7366b465289049163149b86863579389a61ba"
        },
        {
          "alg": "SHA-256",
          "content": "a6015048067c78a0cbbf97963b9a53722df4341bf9a511394ae15ecde84bf785"
        },
        {
          "alg": "MD5",
          "content": "6de5ea7cffcf9b9e9b447f3a3da44982"
        }
      ]
    },
    {
      "bom-ref": "0851dee1-9547-43d3-b25d-8d2420e35a11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam_misc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f7070eaa4b489e6f76c6bddaa0b5bcd57f0d3da"
        },
        {
          "alg": "SHA-256",
          "content": "00c1efd1a7673edc66771060c55713d71c76b9a28e5895556a07da506185a94a"
        },
        {
          "alg": "MD5",
          "content": "ee5f5e4e0702d9b4255d053300f869f5"
        }
      ]
    },
    {
      "bom-ref": "08636125-47dd-48db-8dae-a1129f5c9016",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/g_ether.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74f53fd8e4aedbf754df50dc032c434564846030"
        },
        {
          "alg": "SHA-256",
          "content": "c11080c1d35a0f14d1fb6f689e0cb8f26c0c94bad53b15f2245c45cb0259d1bb"
        },
        {
          "alg": "MD5",
          "content": "a198075dbd28f212b435887d34ef6a23"
        }
      ]
    },
    {
      "bom-ref": "086c8ae1-12e8-425f-bdb3-8d9e8e2e8e6b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/ToggleSUM_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47a214dae061d6bbe3acbb0a48378e3ea3c027be"
        },
        {
          "alg": "SHA-256",
          "content": "51086b1d4fa4ce2bdc805649da2988a22391db36ed503e0bd84e56b24528f607"
        },
        {
          "alg": "MD5",
          "content": "4a82d1ebf1748cc36f31c99525c36b86"
        }
      ]
    },
    {
      "bom-ref": "08724ed7-487d-4b4c-84cf-0ec6378c38a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a8e869ac40b0a196bdc57341d45f525121a02749"
        },
        {
          "alg": "SHA-256",
          "content": "046cd031fd012677e6e0921a2bf325be512af99efd4edec1fd0be9355b9bae5e"
        },
        {
          "alg": "MD5",
          "content": "bca03419989ed0964977e1e8a55ce5ac"
        }
      ]
    },
    {
      "bom-ref": "087ec506-19de-4f1b-9b18-58e2174d4456",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ActivateLicense.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bbbd2b50ab77fcc2adc9fbb89a0b62abcaec0128"
        },
        {
          "alg": "SHA-256",
          "content": "bf5361329f35fd4ed73d9ccdc72f1f973fee8ca711b24325952c5606c1c90a52"
        },
        {
          "alg": "MD5",
          "content": "12f9fff20e64837817059fe0b5ffdaa2"
        }
      ]
    },
    {
      "bom-ref": "08866cdb-fcb4-45d3-832c-f50f91d097c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifenslave",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "08a3bb99-5e05-45c5-8d8a-4540479d2960",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f31cd618c3384b19d36e20d305b5727b780cb0e"
        },
        {
          "alg": "SHA-256",
          "content": "b3aaf7a6dfc41f4e3b333684693effa4ae0df0b6f6eaf48b58f164fb396da01b"
        },
        {
          "alg": "MD5",
          "content": "c9accff67a936d210975a33a5503145e"
        }
      ]
    },
    {
      "bom-ref": "08b7282d-0a82-4b9d-9096-c329ee294b80",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/readlink",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "08bb6fac-2d13-49ac-9b99-17e03fc0ab74",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/AOCTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f2a266a2f9040413d1cca094365916b52a84cfd"
        },
        {
          "alg": "SHA-256",
          "content": "a3627bfc19319ddaa9ab3c559e2495a7a07a16a4153934639c983592e0e032b6"
        },
        {
          "alg": "MD5",
          "content": "524a3c304d4b944bb335b54df5806fe0"
        }
      ]
    },
    {
      "bom-ref": "08bc03a9-e542-47b3-916e-80900990a0f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/sbin/lldpcli",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fb2cd5edaaac186d21fb8826bdcafae41092363a"
        },
        {
          "alg": "SHA-256",
          "content": "20a25ef1dce99b6ca179712a533ae23979b78d33591aeb3f75bf5389b12d0151"
        },
        {
          "alg": "MD5",
          "content": "c43129a60df403dee3d535b414694427"
        }
      ]
    },
    {
      "bom-ref": "08f4778c-dd6f-4997-859c-a659c9d0dee5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "08f813ba-1e36-4c08-98a8-f372188bddc4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e997ef2fe3e70cf09bff164b27f77e85bdf494fa"
        },
        {
          "alg": "SHA-256",
          "content": "83be203ba1d903ea64595e13cb1a2c13deedc6e05927507d1c008543df4710f4"
        },
        {
          "alg": "MD5",
          "content": "ef7db7887916338673ad165d85478bdc"
        }
      ]
    },
    {
      "bom-ref": "0926069f-b569-4745-9218-4ade71f5a77e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/insmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "09278433-2cb3-4f71-8086-7471a4a92b58",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmartPower.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fdc65f99787d846977f96ebbd7318a0375cf1fb3"
        },
        {
          "alg": "SHA-256",
          "content": "4c7a433e812bcdeacb1d535b00309b64529a099e88969419a82aa7be4389cac1"
        },
        {
          "alg": "MD5",
          "content": "acce65dffde05619193e76416cf5530f"
        }
      ]
    },
    {
      "bom-ref": "09314032-62b3-45a6-a073-3d67743c1d29",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmThrottlingStatus.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73ffc71e5f7d954ccb01a232c98213a7a60365ea"
        },
        {
          "alg": "SHA-256",
          "content": "83353540e919385ff1cee1fc58f54346ad017899e81aa5aa2a00db081a9bc316"
        },
        {
          "alg": "MD5",
          "content": "f7bcdc632f95abba1b715a178eb96f12"
        }
      ]
    },
    {
      "bom-ref": "093475ca-a01d-4134-aceb-9809902d7e36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthStatus.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "670149f17afdb89965e2051a279f91c97dad87c5"
        },
        {
          "alg": "SHA-256",
          "content": "9b807284062aea85176605b235d38d3ac91da920402c8407b0a21840c024b120"
        },
        {
          "alg": "MD5",
          "content": "ed1453aad408b84a08c54c0e1e866693"
        }
      ]
    },
    {
      "bom-ref": "094fa776-29eb-4798-adfd-0f4eca313cef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/share/crashdump/input/crashdump_input_sprhbm.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "faeb33fc9f7fbc10be72f9809499047370c181f2"
        },
        {
          "alg": "SHA-256",
          "content": "f54fcf4e8a1e541080575396d5aef0bc0fe89d0c4f5aaa1e8082c7f5b6c6816a"
        },
        {
          "alg": "MD5",
          "content": "5ed7425079267955738e2913906f32b2"
        }
      ]
    },
    {
      "bom-ref": "0974a29b-c52e-41b9-b80f-55e3f665d27f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/system.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1bbfa7e25aa2bf32c67ea678988314a67983acac"
        },
        {
          "alg": "SHA-256",
          "content": "acb300b46b9f1fcd8e58c35a8ea439d30cda03efbef2a7557a3796bce624ec75"
        },
        {
          "alg": "MD5",
          "content": "d20b27f936e22e8083263e1509c9abd9"
        }
      ]
    },
    {
      "bom-ref": "09778a9d-3686-4c78-973e-6d60638f974d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ca7f7312728d45a429208c2103ef7228cfb5e2f3"
        },
        {
          "alg": "SHA-256",
          "content": "9c1a33753c69057ce417a96226aa034bbf08711b81bf119b71b179fd86938c21"
        },
        {
          "alg": "MD5",
          "content": "971064ce74143f83260a623e66f2f392"
        }
      ]
    },
    {
      "bom-ref": "09c6d793-dfe8-41a8-9044-eb73e47fb824",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgssapiv2.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c541b111d357841919d2d1bd64336b57303a24f6"
        },
        {
          "alg": "SHA-256",
          "content": "7a362fe229fb410f24aea2b1bdc86276e036258f2fe8ceead61179d71cd54d49"
        },
        {
          "alg": "MD5",
          "content": "f7d2d1f089e9a4353f9dd66b825731d9"
        }
      ]
    },
    {
      "bom-ref": "09ceacbd-7ff2-4a60-b834-edbe44d95c48",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/redfish",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "09ab1dc88d9b6b4473ae1a31872f4fb48c67f183"
        },
        {
          "alg": "SHA-256",
          "content": "693ef42d72bf0c1f6ba42936e1540ba96137f359f32986bd8851fecdcca76792"
        },
        {
          "alg": "MD5",
          "content": "80045a3b740b4b49e1092017b1eefb10"
        }
      ]
    },
    {
      "bom-ref": "09cf976f-05bc-4542-b80e-64ee5c79dfbd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libanl-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6391c9a9e34187de331cef017715fdd70e7ae113"
        },
        {
          "alg": "SHA-256",
          "content": "3906d8dd43c80f8b93ce20bf8607f6ba98c97902ace113dd2593b08db8bc4f74"
        },
        {
          "alg": "MD5",
          "content": "3326856c7732bc373b438ef19761631f"
        }
      ]
    },
    {
      "bom-ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libssl.so.1.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "594871c48f22d331838911db7aec6e843f665382"
        },
        {
          "alg": "SHA-256",
          "content": "3bcf0d5b64eade33f3fbcbd600867cf4e8b32b2845e5095a45ddd89dc09ef41d"
        },
        {
          "alg": "MD5",
          "content": "53d34e537bb10640b23bfbd236170a0a"
        }
      ]
    },
    {
      "bom-ref": "0a008556-137b-4682-b925-15b3bc14a797",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/hotplug.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "46ba72559f4adcbaaee6d113f2b79420056688a8"
        },
        {
          "alg": "SHA-256",
          "content": "6841416b45461bced884f23ce02641346133b945bd1ebc89516228fc242a25cb"
        },
        {
          "alg": "MD5",
          "content": "b37fbc45005f76627890bd7f34700c9d"
        }
      ]
    },
    {
      "bom-ref": "0a031b03-ad03-4a9d-a8d8-cc3b0fbf5861",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcUtil.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd2bad991e3ec21e29d761cff15df94152a8a82f"
        },
        {
          "alg": "SHA-256",
          "content": "7d4367bec76360c7db93d6eb01bba49547ea380107f6306e961ff8e4deceffd3"
        },
        {
          "alg": "MD5",
          "content": "3699b0eb231fe372d9776ca25587e7dd"
        }
      ]
    },
    {
      "bom-ref": "0a14c6bd-a126-434e-8cff-e7d5e4f2cbd4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/88service.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d64ab085efd015c29bed27bf53fa5b8ce5fa8d7"
        },
        {
          "alg": "SHA-256",
          "content": "915b26c55154a9f69225711a6c5c2ca3c34248ee8d854ebdcee01b05e8d51ff5"
        },
        {
          "alg": "MD5",
          "content": "ab67a95829fafb2850489a08e77c336a"
        }
      ]
    },
    {
      "bom-ref": "1b80fbc8-0426-4785-8029-30ed4641b04d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcSystemExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "184752fd48c1a14d17439c500141e9b0a1cd8d24"
        },
        {
          "alg": "SHA-256",
          "content": "e05f2e061e74f9c3ce63aece182033e9ac3ffc9f752235e7fa58f262b2eeccd1"
        },
        {
          "alg": "MD5",
          "content": "27809292f77c52c55692a8eed21cec71"
        }
      ]
    },
    {
      "bom-ref": "1b9550ba-43fc-4e61-9e8a-581549da12ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib8.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "805af848bbc5e9e340b9865ed15fd9c315d4f731"
        },
        {
          "alg": "SHA-256",
          "content": "6ceaa9dfb18357cdbf52de3eb6ce786147ad74c8487d150cc286f2579b9e9114"
        },
        {
          "alg": "MD5",
          "content": "bc0820dc26f5d3dc091333238ec81651"
        }
      ]
    },
    {
      "bom-ref": "1bade9ce-a1fe-4316-aa66-7937d5fafa97",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfdisk.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d82d57a3eba6800a248a928572145f40d24ee25"
        },
        {
          "alg": "SHA-256",
          "content": "914424526ca34a84af8e7bb31fff0b627e96b467fc1d42760abf2f6e650c010e"
        },
        {
          "alg": "MD5",
          "content": "a3a004513f3fb7f45514799e1bd0ec06"
        }
      ]
    },
    {
      "bom-ref": "1bafc419-d64b-4f1e-b701-c38cb3babe9c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/beep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1c0e3f56-5207-4e60-a351-429df967d770",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcGPUExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "67c242bd780eacc9ff44f6b9c23f6c48137a9241"
        },
        {
          "alg": "SHA-256",
          "content": "e14a8ae521a0ece5dd48427952604952ce0fc9606440d8a84b716d21eec7bc84"
        },
        {
          "alg": "MD5",
          "content": "a1de9641186785170933fa635eaf3e1e"
        }
      ]
    },
    {
      "bom-ref": "1c1ce797-3bc6-44a9-8284-3ef2bcd64fb9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13OEI",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64b0f325966dc1683a5297419c5b45ced98a81f0"
        },
        {
          "alg": "SHA-256",
          "content": "c0ea88293f757cbb682a79de38f4802d178b3b2b27884b749772a90212872bd6"
        },
        {
          "alg": "MD5",
          "content": "b5d3de396428bab56886566aee6b5af4"
        }
      ]
    },
    {
      "bom-ref": "1c2f6260-bd1f-4062-9b2d-456bf64d4483",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cmp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1c308700-3aab-4d49-a900-48bc200e10d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcElementCapabilitiesProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b61a9de4c41005f3942768e5dd2db4f10010460e"
        },
        {
          "alg": "SHA-256",
          "content": "2ddfafb5f10694b6cfe8e42418d00b8b10116dc2f7600b8616455270d44d578c"
        },
        {
          "alg": "MD5",
          "content": "a1927b2ae8be3277f2a0aeabb217e2cb"
        }
      ]
    },
    {
      "bom-ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nbd-client",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1c5fdae2-ad23-4278-9f3d-aaedf2675468",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ipneigh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1c687902-814f-4446-b558-8479c52d4f36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/coreui-docs.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3bd3e252358116380993577d7b6fa8026f6370c8"
        },
        {
          "alg": "SHA-256",
          "content": "bf3904f51d8bcaaddd69991a5eb5fcc3df5a05175f3e2f0b97b4c5de43b7bab1"
        },
        {
          "alg": "MD5",
          "content": "d915d12d2e781d42287ec8ba001d68f4"
        }
      ]
    },
    {
      "bom-ref": "1c7ad17c-9bfe-494e-bacd-d4adc249bf33",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/modules",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "685a2dfa3233cd408ccbbc8f31445fcdb468aca2"
        },
        {
          "alg": "SHA-256",
          "content": "53663174e9de4f028cf23ab5e4b594b5c7f41fae2e7840cf8f831ded1bf4947f"
        },
        {
          "alg": "MD5",
          "content": "f4c017bf89571588412a53bb779eb383"
        }
      ]
    },
    {
      "bom-ref": "1c887d5b-0c13-485f-9f50-3fbf77df76bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiodcxx.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3b559ef12bda17bbe11367997ba030661aeb8a6"
        },
        {
          "alg": "SHA-256",
          "content": "3ae45b870156c88fd6ec59c63df0a75e41586868360e43c0d65efc0614903910"
        },
        {
          "alg": "MD5",
          "content": "b4f9310935b1458a945d70dd017adbb9"
        }
      ]
    },
    {
      "bom-ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/swapoff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1c9cf951-0e85-4dbb-94fc-76b8a5d5df03",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2a66597e0300ee5ad53589f3cff592a8286fd08f"
        },
        {
          "alg": "SHA-256",
          "content": "5e77177ec94c47243bdb48e14e0ed8f811b448c602d9000ec10b62c8ab636d35"
        },
        {
          "alg": "MD5",
          "content": "5686875e63a55adf9fb6d9e583a1ab25"
        }
      ]
    },
    {
      "bom-ref": "1ca77146-c9de-4ed8-aaeb-63ebdcd51200",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libdbus-1.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bac7ed38fea3d91578bf6355d7dcc4cd9e6e631"
        },
        {
          "alg": "SHA-256",
          "content": "f5ef71790a57c5ddfbe1838a0f16d30c4073fcd580a63538ec09e93ab4035793"
        },
        {
          "alg": "MD5",
          "content": "2c67e8ff3d831bed06186c4373e44389"
        }
      ]
    },
    {
      "bom-ref": "1cad8c7b-7ff9-4b8f-8770-3965efff8771",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcb9707fcba3f76df17b212aa327117ba68e1bb8"
        },
        {
          "alg": "SHA-256",
          "content": "58b56da77d5ff22a2a39b91b08b8ab93dd716fd450253708d553ed4e8ace3ee4"
        },
        {
          "alg": "MD5",
          "content": "c57bb203293511210facaafe6c4c84a8"
        }
      ]
    },
    {
      "bom-ref": "1cb1dfd4-85d4-4c9c-b777-b7492521b0a3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1cb38870-1b5c-4368-8392-a8c72b93e495",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/groups",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1cd0eda4-7281-478d-8bd8-020fd3de3fe6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEM_F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "967aa61b173fbdd707256d52c8d2011148160bc5"
        },
        {
          "alg": "SHA-256",
          "content": "0280b1aea81c3e91bea4fdde626c1b8dc2e0525dc7b039b35e647978076db991"
        },
        {
          "alg": "MD5",
          "content": "34d46e8622421490439cd2e77e9eb894"
        }
      ]
    },
    {
      "bom-ref": "1cdf64ba-29f7-4ae4-ab0e-13aa13226805",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/warning4word.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "daa128f91f93d8fcc95e54a809453f41cd70a441"
        },
        {
          "alg": "SHA-256",
          "content": "3efba709297ca40102fd31c73a60aa00623ae84529c6be65409fe8e2c84e9b4b"
        },
        {
          "alg": "MD5",
          "content": "961012e3a557c42c84c0c0300fa80c33"
        }
      ]
    },
    {
      "bom-ref": "1cf963df-9477-43b5-a717-523fd88d5d3d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/login_disable.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c25b9a0500596f85fd009b761b69a674d1b9e434"
        },
        {
          "alg": "SHA-256",
          "content": "0fb8aa930ac961d9f7d686bb5273dc915db44fabe8a72e407016ffea3c43bbfe"
        },
        {
          "alg": "MD5",
          "content": "581628f382c56d926066f36539b1b0ca"
        }
      ]
    },
    {
      "bom-ref": "1d046eca-39bc-4a9b-a8ac-e957f330b2c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rtl8367c_mdio_read.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12ed80056c9486c76637ed647fd4c3caa55d2352"
        },
        {
          "alg": "SHA-256",
          "content": "5d97a37553fecc4b2e221eec5fb029b64fff2b1921ba6ccc7765b22301f4d7ca"
        },
        {
          "alg": "MD5",
          "content": "68a92c01bfbdad4258a2f3f9b537125b"
        }
      ]
    },
    {
      "bom-ref": "1d1568df-3b5a-4939-92df-0111aecec67b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ff5494ef4533aae5608d7db0c969dbb99276102"
        },
        {
          "alg": "SHA-256",
          "content": "072e9d2f6ad3bed0b873ebab8e5302a727fe9fadd18834e7c6e47b1ede5f1229"
        },
        {
          "alg": "MD5",
          "content": "01c9e84f3a217493f4e3703ef96e89dd"
        }
      ]
    },
    {
      "bom-ref": "1d227f04-bdc0-4992-9044-24fb9540c876",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libext2fs.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6f633db55bab7e9346d6f2f7d3595af7af624527"
        },
        {
          "alg": "SHA-256",
          "content": "8c827d1ecb848098501ede3dba670f9eebf8f1988653f423fa1730bac51757db"
        },
        {
          "alg": "MD5",
          "content": "7c2f8715505b6aa46bd929243d43ee4c"
        }
      ]
    },
    {
      "bom-ref": "1d5757b8-07ae-4ec1-83a9-3ec352582392",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1d72197c-f1b1-4a69-8af1-20363877edab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network_ssdp.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cba11d9d9aedbf3305363e7f5129c08cbbd4e119"
        },
        {
          "alg": "SHA-256",
          "content": "40d39a0a72f6bc9d0186ca4da1dc13d49b2c8a4f4163db7ac8f8ef84acdce8c2"
        },
        {
          "alg": "MD5",
          "content": "bca0002809cc13d3f34571b9a9a69d46"
        }
      ]
    },
    {
      "bom-ref": "1d72d35e-b0f1-437c-ae18-e826abaaca93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logical_broadcom.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "44098ee8eea7c0be74bdca0420286d5e58c8ac56"
        },
        {
          "alg": "SHA-256",
          "content": "0ce0eabb0af033fe9f5e339b71e53d6cb3d446e33989923ec982fd4c6dea3147"
        },
        {
          "alg": "MD5",
          "content": "7a294d24bf8862a10d34517aa1e0853b"
        }
      ]
    },
    {
      "bom-ref": "1d744141-ecbb-4ce0-ab44-750b0412c8df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libudev.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ff1e2b43955dc5c42fd606f8dda9790ca480ee7"
        },
        {
          "alg": "SHA-256",
          "content": "b20b16b8f14376bbd4b9f8f999c13b276e7d6d26a299d86a72e1475e51f2875b"
        },
        {
          "alg": "MD5",
          "content": "c990c4007218b2af20439fe051fd72d0"
        }
      ]
    },
    {
      "bom-ref": "1d8bcd9c-993d-4f03-892a-a095d225f0bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libk5crypto.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03f4a1baf19a790665a56a5c3f632731f2e9ef27"
        },
        {
          "alg": "SHA-256",
          "content": "1ea442a82eb199e83be393e7e45baf0502804d21bf88583fcbbb4046b4cfb253"
        },
        {
          "alg": "MD5",
          "content": "f471a8188dfced52b6aca88c5b9c903a"
        }
      ]
    },
    {
      "bom-ref": "1da872c6-3d54-457c-b6cb-b2155e56b39d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/disconnect_default.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1daf61cd8e99b676cce8a7b643a521d025f480e9"
        },
        {
          "alg": "SHA-256",
          "content": "c9e2cc643edd38f3ec0e0c0a27d724285ac73d7502affad778b2ba58b1343b34"
        },
        {
          "alg": "MD5",
          "content": "611dc1cc6a66b32b3d4f28ba39c3f9d7"
        }
      ]
    },
    {
      "bom-ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/openssl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a81067d24bab21b3973b44cc071d61389806dca"
        },
        {
          "alg": "SHA-256",
          "content": "2e038573a72f224e7d868dd1f15d2b9cf0d6c1479363b29e3a58c90508b4cd42"
        },
        {
          "alg": "MD5",
          "content": "5ead6dbff08e4136fda658511a5addf5"
        }
      ]
    },
    {
      "bom-ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubirename",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/loadkmap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1e084026-084f-4841-af83-6fb073351946",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/MemoryHealthComp_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e44e69613c5d79af225231cbc0a25e9f9fbaf0eb"
        },
        {
          "alg": "SHA-256",
          "content": "ec47fac3f8179a7b0dea16fe92a5266cd1cacffc80495668411ba1fed5311671"
        },
        {
          "alg": "MD5",
          "content": "c778a83cf24fa2da74e8ae227537bb7d"
        }
      ]
    },
    {
      "bom-ref": "1e23a243-f2bd-4335-8054-6e11f3aca326",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fgconsole",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1e3dbe99-320e-4158-939e-0aba5f8681bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/PrivilegeMap.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "470252d542ccc3d656759eebcb899836d8363629"
        },
        {
          "alg": "SHA-256",
          "content": "6ac204a6f38e8d3a1359ef66064c551bf1fcd6041be47612abde8c2c00ccfe95"
        },
        {
          "alg": "MD5",
          "content": "0b944a3276578ace91c474861bdd8e1b"
        }
      ]
    },
    {
      "bom-ref": "1e45113e-09f3-40a8-a024-c2451cfcc978",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libbsd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98db6640f9107bb5a25c9333c0f7652581a24642"
        },
        {
          "alg": "SHA-256",
          "content": "b9d368c0f7c3befbe4113bd7ecf8d80c2a42288f22467f675f1da2d27ffb485e"
        },
        {
          "alg": "MD5",
          "content": "47934cc3b7257a5bfd1f37d9ef59ee61"
        }
      ]
    },
    {
      "bom-ref": "1e4593d1-897f-45d3-873a-7215ee881ce0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ipcs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1e4f7e99-6314-4fd1-b486-fd202acf61ec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamDirect.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b279f004389e1387096d5640eddbc763103b1ca3"
        },
        {
          "alg": "SHA-256",
          "content": "7f586d4fef4bccce5a6570e6b5fdd70a8491b5a84c7d0de6f28d3a2c3b89bb9c"
        },
        {
          "alg": "MD5",
          "content": "21316229f5ac895f1c78a37f6fdc2e52"
        }
      ]
    },
    {
      "bom-ref": "1e550475-92a7-45d8-a360-c619bcdd6bfb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.G2DMH_B",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "94e84767587028b99e19df365386f6ded0402b90"
        },
        {
          "alg": "SHA-256",
          "content": "c26a84428d243a6738b8d7ae53ded5d23f10a868345686c268f8defcd6bf01a1"
        },
        {
          "alg": "MD5",
          "content": "9a21865890e4d24c6ddcf18be19f3cf6"
        }
      ]
    },
    {
      "bom-ref": "1e59488c-71c6-496a-a617-25aab01d364d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/powertop",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1e7710a0-a948-45b2-97bf-c05f5b3778b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_iostreams.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4de27a3756eb38ea169fc7761f09ad31a0485148"
        },
        {
          "alg": "SHA-256",
          "content": "b433b1777df34004074cd7ee1cc4e3e39aa6d08e7770b580e238443eb6fbed5e"
        },
        {
          "alg": "MD5",
          "content": "71d5618e1624d72cc6dee898aa11cfc3"
        }
      ]
    },
    {
      "bom-ref": "1e9955f9-d678-49ae-aeb0-c72f101cb0c1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelibit.so.07.2100.0200.0000",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8aa1c84c0a933199644edbb3888723acff374333"
        },
        {
          "alg": "SHA-256",
          "content": "2afd30b75566f50cc478e13caf314b176d80ab10df83b18d482df0d95ed08f53"
        },
        {
          "alg": "MD5",
          "content": "1c4d5e2e456285c1b2def2d59f4309e3"
        }
      ]
    },
    {
      "bom-ref": "1ed52b31-11a3-46f1-a9b3-ccc223eaf7b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xzcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uniq",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1ef94ce1-7963-4ff3-8554-2bad622cb6d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ln",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1f077ae7-18dc-4020-adfb-4e958e90ed6b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/pfr_maint.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a342e8e802f78e2880676a1b9de89c8b3d6cc530"
        },
        {
          "alg": "SHA-256",
          "content": "aef2b26c0c8d926221f4d5d8e0aeed09ddd0990c2ec3582ab85d499d4a0d8c31"
        },
        {
          "alg": "MD5",
          "content": "138a9454fc16acd00e00dc03d1f2224f"
        }
      ]
    },
    {
      "bom-ref": "1f1faa64-dabf-467e-a29a-58438d9b227b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamHbm.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "043f80db549e86db92f7386bcaa03bed04211926"
        },
        {
          "alg": "SHA-256",
          "content": "540c9bf38882ebd02cfe4b463ba3570824ff84861de15b2b04be97031e3699e1"
        },
        {
          "alg": "MD5",
          "content": "d920a1858b4c4da902b4f6d54a89e368"
        }
      ]
    },
    {
      "bom-ref": "1f29862e-de1f-45ef-9084-e969ed4e8fe7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/deletemethod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64b1c01ccff531809ef14c24d0c1b106acb8f9c4"
        },
        {
          "alg": "SHA-256",
          "content": "7743f04c5648cf41a934af7646cf22e079bf7a7f1d49be93dea2015e067962af"
        },
        {
          "alg": "MD5",
          "content": "a099ab765059b7fd79ff7cbd1e430f60"
        }
      ]
    },
    {
      "bom-ref": "1f2b0fd9-ffd6-4ed9-8924-b89e40c714e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libtinfo.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6d28156aa6dcf0aa29748fb825c7c7f39381e484"
        },
        {
          "alg": "SHA-256",
          "content": "70c9700091303f9d1e359b0aa9b807af79463e1252d72ace63747d8073a5635c"
        },
        {
          "alg": "MD5",
          "content": "360d82c0567c6a41a30706ac270dedca"
        }
      ]
    },
    {
      "bom-ref": "1f390a51-ea22-45b7-9aec-a004695fed7a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/sbin/lighttpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c964cef3463804fad7c4e000e256f3d0fd0b53f8"
        },
        {
          "alg": "SHA-256",
          "content": "8e51558a82ffd2295f6482165dc8462975f89d064f8a1f88cf43a0d5dda9115e"
        },
        {
          "alg": "MD5",
          "content": "6669cbab0e07692affcdf6271ae90a54"
        }
      ]
    },
    {
      "bom-ref": "1f409787-ba44-48cc-975d-7a884e502673",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcQualifierProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "724548ad015d21c2408c76e27bc8ed613f632601"
        },
        {
          "alg": "SHA-256",
          "content": "d3ea02544fec8d6bf3e313f8abc8c5a2e76c8166275657272d7597b243729a63"
        },
        {
          "alg": "MD5",
          "content": "70ad7ca4f4899f02772af2f61ce66978"
        }
      ]
    },
    {
      "bom-ref": "1f531a36-9c8d-4178-91bd-4297edc61d70",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBrokerCore.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "779c0cd06ea905815ea879d895b34b8b3eb36b62"
        },
        {
          "alg": "SHA-256",
          "content": "2cf252b6b66b821b81da98e8530af76c4f02fd48181d6a634c31074cbe6b536d"
        },
        {
          "alg": "MD5",
          "content": "e8f026ed88817f637bce55587cf7b327"
        }
      ]
    },
    {
      "bom-ref": "1f541f33-2afe-4974-8261-e8414636154f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NodeManager.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d19c342b5d232bf8791eb4d027fdd48df57681c"
        },
        {
          "alg": "SHA-256",
          "content": "54530940e07abbdb9b7596ef4f12f9a2acfec57c7544033f07282178f1e390a5"
        },
        {
          "alg": "MD5",
          "content": "7c2773d406b7af53326cab0219f4e3ac"
        }
      ]
    },
    {
      "bom-ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/sysctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1f644a0b-6ede-45d1-848c-270c79432824",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/cpld_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "669edb1ae1037abe749747ac312f3555720613e3"
        },
        {
          "alg": "SHA-256",
          "content": "5db3ed88391779da7899ef3823c12f7d390e3b00d83db2572df274cf1799bf7d"
        },
        {
          "alg": "MD5",
          "content": "0768cab7aba9b573de67d26ec68654ac"
        }
      ]
    },
    {
      "bom-ref": "1f65ac8b-e15f-49aa-b1bb-569a24bbeb08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libext2fs.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6f633db55bab7e9346d6f2f7d3595af7af624527"
        },
        {
          "alg": "SHA-256",
          "content": "8c827d1ecb848098501ede3dba670f9eebf8f1988653f423fa1730bac51757db"
        },
        {
          "alg": "MD5",
          "content": "7c2f8715505b6aa46bd929243d43ee4c"
        }
      ]
    },
    {
      "bom-ref": "1f746526-a126-42f0-b155-f213496600c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/jquery.dataTables.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "00a16f03d81cf8bb1a988f28bc8e1e444a8c0506"
        },
        {
          "alg": "SHA-256",
          "content": "cbd1da4bcc9bbb467b0c096e10ef78e94f6aa579184d9c7d9122a08b0b1367bd"
        },
        {
          "alg": "MD5",
          "content": "71f7d183d85933cd7193dcdc0492605c"
        }
      ]
    },
    {
      "bom-ref": "1f781cd3-6714-44a2-8c33-35ff55832204",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "604ac783657692e197efe82964dafea4a05b9d94"
        },
        {
          "alg": "SHA-256",
          "content": "624dc5602293fea2876edf7fed64abea04b162bd4e478c785338706a921dc65a"
        },
        {
          "alg": "MD5",
          "content": "9ac922bd28cdf5347678c100744dcffd"
        }
      ]
    },
    {
      "bom-ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/patch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1f8cc7a6-51c1-4c4a-9f38-da21d1d3b68c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCertificateAuthentication.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64f619082e9cfd6078c495df4d8891d9deb45e1e"
        },
        {
          "alg": "SHA-256",
          "content": "99f13f1c597f53167d043b5d183c44cad366e1fc41c4770cdceb86d9e8e29413"
        },
        {
          "alg": "MD5",
          "content": "2a98c029aeae7b2fd15b1b96905c5559"
        }
      ]
    },
    {
      "bom-ref": "1fb4ef3d-372c-4bf7-b074-0a814211c07b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/proc_mgr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b7d1b78d085fb3a53e7cf17e2dbd54577264cbb"
        },
        {
          "alg": "SHA-256",
          "content": "8758ab2b456e95bbe9c14d48b02f935210d0399cbbf8858a9bd9266bc3acf431"
        },
        {
          "alg": "MD5",
          "content": "3c2aefe0cb6af2fba8be18a54d004cd0"
        }
      ]
    },
    {
      "bom-ref": "1fe2639b-6072-47fc-94d7-22dfbce7a9d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/diskErase2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "546e590fb21491c53e339eb113ce68108d98bed1"
        },
        {
          "alg": "SHA-256",
          "content": "01eab4cae869a9c2f615f9115fc03eef3a7d32e905d44744206b7d35dafb44c2"
        },
        {
          "alg": "MD5",
          "content": "bd72d50b1046e3697ca1c2fd3544ebf2"
        }
      ]
    },
    {
      "bom-ref": "1fe7e060-79e8-4859-a7db-55b328e6003c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_lan.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0cb4dc53aed79e25309dc85a5b6801fa3fefff3a"
        },
        {
          "alg": "SHA-256",
          "content": "c34e7096b00366bf3016b43a8cecc19a7dfeb53c4aa093588af019d78dd8e6f0"
        },
        {
          "alg": "MD5",
          "content": "896ad606a591e9c8362e966364569657"
        }
      ]
    },
    {
      "bom-ref": "1ff1f602-113d-4e2f-8b5e-db9d7e55497b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/object/menuObj.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47e5d52dbae812457fb2103c780289238c616b83"
        },
        {
          "alg": "SHA-256",
          "content": "2d9b7dfd7f1feb7259f97f781484da60d06993650746c4b66e36a6a453c2c3d1"
        },
        {
          "alg": "MD5",
          "content": "9ec199f3b3d1e1d4870d13948f6c65b3"
        }
      ]
    },
    {
      "bom-ref": "200e2926-fa7e-4459-85c1-4d0f9db53cbf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamHbm.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e341a884879290d113c26baead52ae469844f4a9"
        },
        {
          "alg": "SHA-256",
          "content": "ac318d01601f300897fbd003df24dc79fe7185f08ccbceb01e4394bd95d16b47"
        },
        {
          "alg": "MD5",
          "content": "fe84472b6909a984d31987f5b3dac1c1"
        }
      ]
    },
    {
      "bom-ref": "204a0582-9c3e-4f10-8a36-bd496b68403c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f239b190c9ab4af5e811710b39619ad9d6274083"
        },
        {
          "alg": "SHA-256",
          "content": "2b81de20e92489b50432d2598da0f1e18a54b900ca668e1592afa9534591ca28"
        },
        {
          "alg": "MD5",
          "content": "193ccff7b8be46708c4e51bd57f2d252"
        }
      ]
    },
    {
      "bom-ref": "208150af-f387-444a-a905-65060365fae6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/physical_nvme.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "27cc6eeb31ba112a12478db7b629328b38df2cd1"
        },
        {
          "alg": "SHA-256",
          "content": "15c166ead9d73df016a91ec5d24bff52d400c4ec55e43001baf7ca567416e585"
        },
        {
          "alg": "MD5",
          "content": "ff283f1d20cb23d7fa3aefddfd08fff5"
        }
      ]
    },
    {
      "bom-ref": "209be16a-878b-41b6-8ef2-d5be0ab9cec6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xargs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "20a0188a-b608-42a4-8c9e-90d88b84f970",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86ed64d0829e3c86af6bcc19bca10419618cf046"
        },
        {
          "alg": "SHA-256",
          "content": "f283c1acd9a237ecbfeac228c035e18b47eaf171a0655c74d3b06102332f799c"
        },
        {
          "alg": "MD5",
          "content": "10d02142393483bff965c2d2f63e0b51"
        }
      ]
    },
    {
      "bom-ref": "20a12227-6079-417b-9827-5face6f82b59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fgconsole",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "20b80792-a595-488e-a8ff-5335fbd84079",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLogServiceExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2fa32749dc2251d14ddca4aba0c9bb687647684b"
        },
        {
          "alg": "SHA-256",
          "content": "33d5ef10aff80f4f266bc31e4c30e0ef51bdc4040beb005b80bee4c4685c22ab"
        },
        {
          "alg": "MD5",
          "content": "239a28636b5cf6b2a6e020ddbc9c2ad5"
        }
      ]
    },
    {
      "bom-ref": "20b9992a-3fd7-44fb-bd53-f8e6f44024b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6675226558bd5f7c565506cf3ae607de4bac6474"
        },
        {
          "alg": "SHA-256",
          "content": "eca9d5aa9b15bb0057dafaedf3d7f19402b230e13ed28c898ce4cfb6b6a58a21"
        },
        {
          "alg": "MD5",
          "content": "c3986922a259bf9bdc34ce27962d8b28"
        }
      ]
    },
    {
      "bom-ref": "20d3c49a-ad09-4568-9551-87598e1be72e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha512sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "20e5752d-1aff-4488-b8aa-8ed61bc19376",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/uidLEDOn.gif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "730f660c42fbb75e1a72a62a50be07f368a1d8e9"
        },
        {
          "alg": "SHA-256",
          "content": "ce1463fc8da1e1f93ea1e63c0cb28f7dd9d4f308ad1ee4b3cede2a2c6b9ba5d6"
        },
        {
          "alg": "MD5",
          "content": "8deba42af4819566b0f81cd70c396407"
        }
      ]
    },
    {
      "bom-ref": "20ecfc2e-1584-4505-83bc-048063c0a71c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/dhcp6c.conf-stateless-temp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86f3b104f31b0232fe0c22c09e5aff987518058c"
        },
        {
          "alg": "SHA-256",
          "content": "6a1b204eba6cfc8bba5bc68380ec6872c13c230fc3cb5455863bba4a572c45ff"
        },
        {
          "alg": "MD5",
          "content": "bd91097b6c2297aa5e51e9f7d2859e51"
        }
      ]
    },
    {
      "bom-ref": "20fd4df2-2974-47ff-b555-68cee2d8e7b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmd.so.0.0.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "215d123c2f34b6680a15c85ee69674c6f66476bb"
        },
        {
          "alg": "SHA-256",
          "content": "47e48e0c844bcb84156d8ad015431036cd4ce05758b8012ff398e6c23d81edfe"
        },
        {
          "alg": "MD5",
          "content": "d4a6e9aa2615ef4d3d3366fed35639f8"
        }
      ]
    },
    {
      "bom-ref": "210d7542-9c26-4c1f-afd0-f71b2a8ec3f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/sum_toggle_ctrl.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c151b734aa5d69beffd301f8d8aaaddd39cbf9a2"
        },
        {
          "alg": "SHA-256",
          "content": "847768a24211f7aeffc0d2da65451d9b8b31968cef499ca2f425f5a82444a5f6"
        },
        {
          "alg": "MD5",
          "content": "cd41f273fca2ccd6400559312fe14c97"
        }
      ]
    },
    {
      "bom-ref": "21120b49-bbf1-413c-af0a-870b58ce5b54",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxtables.so.10",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f577a10a10b85df6e4036e1bf248a306f361a092"
        },
        {
          "alg": "SHA-256",
          "content": "da2593460f7623d27ec31d44fac5c17e64d06c607ae98f71aad3b9f6e0bfc4d1"
        },
        {
          "alg": "MD5",
          "content": "a332c49f74cbe1d7a553910a49da2de6"
        }
      ]
    },
    {
      "bom-ref": "21190c19-f600-4856-ba32-67df8f7b64e5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/share/crashdump/input/crashdump_input_spr.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64ac020fad5009b1c80b76141b7546eacb06e75d"
        },
        {
          "alg": "SHA-256",
          "content": "42b08edee74964706b01e6cec80b9aaa53d8b701747638f02d60618928c80f68"
        },
        {
          "alg": "MD5",
          "content": "213d6422322bcba40a6f32444d53f409"
        }
      ]
    },
    {
      "bom-ref": "2128e7c9-cc06-431b-8e58-b2de4422a481",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/runsv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2138fb91-5142-46cd-a5fe-8fa9fb68902e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgs2.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e508a2150d7392b137f75f248109c07208929e47"
        },
        {
          "alg": "SHA-256",
          "content": "ef6e841167f46aca60a20d6162fc0e1bb7e16545cbe45a3368c9218e80883f5f"
        },
        {
          "alg": "MD5",
          "content": "ac8abc1e79d6a6b7a9e8e4aa7df92282"
        }
      ]
    },
    {
      "bom-ref": "215433f0-d8bd-43b7-9c10-f0a8d62092bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_chrono.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e8a8fc922078f47a9e30401e7c44637b43b0443e"
        },
        {
          "alg": "SHA-256",
          "content": "47a283ef1644de938d4f41888fbab80e9759dc1974e376e0975f7f119b66e34b"
        },
        {
          "alg": "MD5",
          "content": "14c865699735bf917a3bf81b677befb6"
        }
      ]
    },
    {
      "bom-ref": "215dffff-26d6-4241-a532-4d5330df589b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fold",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "21ac4d95-330d-4ff7-ab23-db1d581e5b3e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/VirtualMediaConfig_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d18447c0f2e41225bcb8f4fa40f1d190861e87e"
        },
        {
          "alg": "SHA-256",
          "content": "4a917f1c7fab045b1f7c2fac4ec81f7355667cd21aa7a9d31efeca702401eaec"
        },
        {
          "alg": "MD5",
          "content": "462b1a141b473c5382f6e68886e2792d"
        }
      ]
    },
    {
      "bom-ref": "21afb4aa-5054-4cd1-8f56-20c9e3039140",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/prev.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3064c16b3347123b3f3cdf3e4d74eff13a3f3d04"
        },
        {
          "alg": "SHA-256",
          "content": "43c8cbf83d10ea3f7f8752103404ab128340e836991eb774153ef55104eff88c"
        },
        {
          "alg": "MD5",
          "content": "bff835fe14e5a6a9984f8c56bbab8312"
        }
      ]
    },
    {
      "bom-ref": "21bc2dca-9760-4754-82be-066b219e8fba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiod.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5461f101552bc82bd1abc1192dfaed3383d88fa"
        },
        {
          "alg": "SHA-256",
          "content": "4444abdc7bb7172e3bd39dae7e2f4d06233be60b90678b1eecfa5e96fe2e85f5"
        },
        {
          "alg": "MD5",
          "content": "368a3e6159b8205c22d2f5d2ee43eed3"
        }
      ]
    },
    {
      "bom-ref": "21d9a376-ebe6-426f-9f10-e153d16c4342",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ping",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "21dca9d7-3ac8-4282-aa79-a62f8d92c1fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NTP.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3004e642b102051a5073ae0969a7282a8345ae37"
        },
        {
          "alg": "SHA-256",
          "content": "01f51a1b6e37ee52c252d4a3633e05dcb53409106551fbb022e30b4b50dd4686"
        },
        {
          "alg": "MD5",
          "content": "4a3f36b79138510734db642a6d521159"
        }
      ]
    },
    {
      "bom-ref": "21e7913d-556b-41d1-9c7c-2b7589ff5089",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lighttpd_sslredirect.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "40a908ea3a73edde49041e950774e0c2bc4cc674"
        },
        {
          "alg": "SHA-256",
          "content": "b6c50312c971e76b60591b4ec349747126206447ee66998bccbc5877c89ff71b"
        },
        {
          "alg": "MD5",
          "content": "25d66d25715bf139d434f7586b989c6b"
        }
      ]
    },
    {
      "bom-ref": "2201e099-7447-4c74-801c-5d86b30c07a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/deluser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "22285efb-a123-44c9-a6d9-cb6b2b70f673",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_SoftwareIdentityProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52ff9c90f6d075f98340b80e2833a272233ce794"
        },
        {
          "alg": "SHA-256",
          "content": "f07e5df88c0195d756213dd8cdd4b254e679b871debe678da5b8ba74d3dfdd41"
        },
        {
          "alg": "MD5",
          "content": "5e8316a714a9aefa5d985d4f36ed026b"
        }
      ]
    },
    {
      "bom-ref": "222a4b72-486c-484b-ad4f-5b2c125bf0eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/envuidgid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "223872dd-ad8d-40d7-95ea-79528540093c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ipaddr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "22392810-6b3a-4247-a84a-9f0fbcca141f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcmpisfcc.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e08b27a10f7f43b186730dbd727dc38f2201d15"
        },
        {
          "alg": "SHA-256",
          "content": "2398ac01dda9642b8038dfcc35c9529ddbe0b651ede553d413d5c94579de4485"
        },
        {
          "alg": "MD5",
          "content": "d23f6606632402f0deef01a0d4b99181"
        }
      ]
    },
    {
      "bom-ref": "224c8c96-05a8-44bb-91d2-832915173642",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/sfcb_registeredprofile",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "353f20d34b27930a7dbadf6b3e63b04483b18081"
        },
        {
          "alg": "SHA-256",
          "content": "9aa71c87d54d05e9e23da61ab8a326f86c36112ff136e36ee8b962229a1cd04c"
        },
        {
          "alg": "MD5",
          "content": "31e1ff2d21f4fdeb93e2bc9a40734483"
        }
      ]
    },
    {
      "bom-ref": "22682aba-f5fd-4c03-a962-4f82151881ff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libutil-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f81b6ad73305817a415df49aafba05fb34220"
        },
        {
          "alg": "SHA-256",
          "content": "6f18e17681d9552f22ba068931da166ad384bac02070bb087d0d9281851b2bc5"
        },
        {
          "alg": "MD5",
          "content": "ac561df85727c0ad73bf2f72359785d9"
        }
      ]
    },
    {
      "bom-ref": "226f67ac-9c71-4731-91e2-d540e8bb1555",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/save.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7ad8517dd887e7191953bbabc726f869a8893b83"
        },
        {
          "alg": "SHA-256",
          "content": "54abbd1aeae170c0e764284975fc2cc5f06a5901205638b556edcfdef561b2d0"
        },
        {
          "alg": "MD5",
          "content": "12a904d70bc7cd0313a17318dc0fc3ac"
        }
      ]
    },
    {
      "bom-ref": "22718682-e67f-42e1-a309-931e0f717591",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "26a61c80a532861d6a3c78d6cab4ccf1f9223000"
        },
        {
          "alg": "SHA-256",
          "content": "c3e8b33c087a8fcef20a71ddddeabb2602251d03e500b48cd15b3a0d8cd33911"
        },
        {
          "alg": "MD5",
          "content": "a559db5acc8b8b15ff8d48e409899426"
        }
      ]
    },
    {
      "bom-ref": "22791198-f7c7-4e4b-a85d-0c9fd7e952d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/false",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2284da3a-b5b3-4a04-bbee-f03aadae5dd6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/psu_flash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ccff943dfc30d124a319f3196dba00e3bffc15f9"
        },
        {
          "alg": "SHA-256",
          "content": "70959ad293f76b0dba99d0854946f0af8ddb3a4c931e24e4605a7e8e29e93f53"
        },
        {
          "alg": "MD5",
          "content": "a34e600bfa517a18298a280ad49d8016"
        }
      ]
    },
    {
      "bom-ref": "228b8754-4f10-41ac-81f6-4480df2d9909",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/g_vm.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d2605e1cec726c781c48da192da0e1e8fd96675a"
        },
        {
          "alg": "SHA-256",
          "content": "4217e43d41faf42b5095360055323ed9c9216b0634b68344c9541f37963f938a"
        },
        {
          "alg": "MD5",
          "content": "e72a1a987841975b10705fd8ffe58f18"
        }
      ]
    },
    {
      "bom-ref": "22ba1ed8-0841-472c-9581-852a897b0fe0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/log_cmd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f8bc620c27f386800082a592da1a798a9e34183"
        },
        {
          "alg": "SHA-256",
          "content": "11a4f26446f9cd4ec6f567cce0ff5f768f81f20597c30453a2433890bc91d2a0"
        },
        {
          "alg": "MD5",
          "content": "3d7ff4dab47d3fb79fd399785ea0f2da"
        }
      ]
    },
    {
      "bom-ref": "22c769de-6385-471d-9be8-604934fc46fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/nic_port_2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6c3f575b8accb73865e257818dd98631b9f91a0"
        },
        {
          "alg": "SHA-256",
          "content": "d17d5a2123bf55fa7310b5c772911d9eac1f6b9f840c514a6277f1c1c3390651"
        },
        {
          "alg": "MD5",
          "content": "0b93b93c479d0141a37471ade765ce85"
        }
      ]
    },
    {
      "bom-ref": "22d36550-5f9b-4d4c-9446-a6a9f919b743",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamFreq.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f3514d57ce3f5b616e735fe187c54485699ff94"
        },
        {
          "alg": "SHA-256",
          "content": "06a499bc3cd6544be73b91f454826fa3b667d8e2ed1f32cab0a4e570f7bddcb2"
        },
        {
          "alg": "MD5",
          "content": "02a257238edfa807323bec7e208df1b0"
        }
      ]
    },
    {
      "bom-ref": "22d3ad5e-4e67-40a6-bc8c-5d1458c0630c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/rcS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bf50fdda03ff25db3d15fb1b1b9d880abcfb34ce"
        },
        {
          "alg": "SHA-256",
          "content": "6fe490ef340d068c4bcf935b5600fbdf505348d3aae9b5d9efb6c2f4ce683c4d"
        },
        {
          "alg": "MD5",
          "content": "fd7037f7aea11df3a41016e44f40066f"
        }
      ]
    },
    {
      "bom-ref": "22d84e91-0e00-43ac-9634-819a345c23b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_fullScreen.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "40043bd451cd8eb482d94a9a5f7354115e0babd8"
        },
        {
          "alg": "SHA-256",
          "content": "3732c2a10e0b6593b82869d170086f82affb1d9a0261eb753c57071b5c31f84f"
        },
        {
          "alg": "MD5",
          "content": "9f043a11ff01bf16c7c568498d233f36"
        }
      ]
    },
    {
      "bom-ref": "22fed80a-b839-4723-afcc-0c27a3dc9083",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pgrep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lpq",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/crond",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "231aafeb-a991-473e-91ed-b91df1b0adb6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip6tc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cc7c53291fd1d41a869ff7eb322bb21179d3dad"
        },
        {
          "alg": "SHA-256",
          "content": "afc2309636826a891d1373b061f26872a2d44421949e266a447a1f62887cf0df"
        },
        {
          "alg": "MD5",
          "content": "eda98f670b06862f81dce603bb73173a"
        }
      ]
    },
    {
      "bom-ref": "232a4b6b-3f0c-4fde-9509-78bdceef8256",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpci.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2894b1d445cb15e0bad928f3470ee336729bb018"
        },
        {
          "alg": "SHA-256",
          "content": "6e9e180e4a5c1d7bba7fb6d4accec8ec461192e5c5aae65adf11781d4a1ab0a8"
        },
        {
          "alg": "MD5",
          "content": "de2e637be4e1979d33cbbd140a9e8b4b"
        }
      ]
    },
    {
      "bom-ref": "23397719-5cae-44a6-a388-604be4e32101",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_17_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65854d10927c2169a3b9406c29e52f438927e059"
        },
        {
          "alg": "SHA-256",
          "content": "27fb6b55946697a5dc80c4eb8fa885e511c74573a65083931ab0f71a8360b071"
        },
        {
          "alg": "MD5",
          "content": "58eebc830afc1715513305c866c3c64a"
        }
      ]
    },
    {
      "bom-ref": "233ef88e-4c48-442a-8dab-77003dfeae76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/find",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2342da43-58c5-4203-839e-9a4e2a934efb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libext2fs.so.2.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6f633db55bab7e9346d6f2f7d3595af7af624527"
        },
        {
          "alg": "SHA-256",
          "content": "8c827d1ecb848098501ede3dba670f9eebf8f1988653f423fa1730bac51757db"
        },
        {
          "alg": "MD5",
          "content": "7c2f8715505b6aa46bd929243d43ee4c"
        }
      ]
    },
    {
      "bom-ref": "a70a90f0-c667-40e4-9396-b38481d26d93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/FilterRuleCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f31f354bd505c25d5a37c15985fc67b63c8cf22"
        },
        {
          "alg": "SHA-256",
          "content": "d3055da0ce7dd9a135c842544a6d7a602808079e43af69efe77c842b0a7a97a3"
        },
        {
          "alg": "MD5",
          "content": "d0bdfb96e7cb34bda9b91be7f97ba07a"
        }
      ]
    },
    {
      "bom-ref": "a74e74ad-b230-4806-a83e-f4dfa7846efd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/edit.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5957d332fb7fcc9398f3a22d8642eaf2f73a4db6"
        },
        {
          "alg": "SHA-256",
          "content": "0217245f355ae0cd00c6533e5b35ec2a1b74e16d3dc2a422077d15b33ac164c1"
        },
        {
          "alg": "MD5",
          "content": "3c6c2791535f8ebbc30a69f18f8d5a80"
        }
      ]
    },
    {
      "bom-ref": "c769f00b-982e-442a-97a1-08de103eecab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_remote_session.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c9e54a1db336703ba083b1e8194c89fb6ce4a34a"
        },
        {
          "alg": "SHA-256",
          "content": "172d422576aaec15b7e8dd6f15a21ddaa13507e7085dcd5c8ea4ced2c2144a33"
        },
        {
          "alg": "MD5",
          "content": "cb448d159ad67f334b3464d3a36ee132"
        }
      ]
    },
    {
      "bom-ref": "c78089c9-64c0-4f73-af9b-03825107ac5f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_alert_syslog.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e04e943d7a87877a5cb19d371cfe0e910cc68b40"
        },
        {
          "alg": "SHA-256",
          "content": "b51573e5618f517aaecd673cba2b6bf6ab9d56a48e8a906fa9d5d1a1c9da17d1"
        },
        {
          "alg": "MD5",
          "content": "d5e97a04e676fe7c16247366754392ec"
        }
      ]
    },
    {
      "bom-ref": "c783635d-2b9c-4318-8107-e050b3d2f3d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/rmmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c79d2616-170d-4095-a10c-8024c0f6b6b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/delgroup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c7c5f82a-c1d8-480d-aa73-f729a77a311d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_LogRecordProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "23be148658866d8809b13581e59f9c4fc58f00e6"
        },
        {
          "alg": "SHA-256",
          "content": "2ed5485f96bd7a80faaf4ed1f31438d02234654f6226e75ad2f8c4dee6e435d7"
        },
        {
          "alg": "MD5",
          "content": "ab5293739a08d795dbf5121d3e817ac9"
        }
      ]
    },
    {
      "bom-ref": "c7c785c3-d749-40aa-a6eb-7af5613a0cf6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgs2.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e508a2150d7392b137f75f248109c07208929e47"
        },
        {
          "alg": "SHA-256",
          "content": "ef6e841167f46aca60a20d6162fc0e1bb7e16545cbe45a3368c9218e80883f5f"
        },
        {
          "alg": "MD5",
          "content": "ac8abc1e79d6a6b7a9e8e4aa7df92282"
        }
      ]
    },
    {
      "bom-ref": "c7ca1d22-f139-4031-8655-98aaa3ca6327",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mkdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c808f02c-1116-4964-ad8d-b7ddcceb2f36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bunzip2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c82f3679-002f-4c66-9073-ca336e59349f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4464f03754a467d54f983ca9e9a6b97fd976199"
        },
        {
          "alg": "SHA-256",
          "content": "c5ad4fc9556f28179976f3855dd6a86afa96bdc6e0b7668e01bc8397ff621cbb"
        },
        {
          "alg": "MD5",
          "content": "0a41aefbb26bfbdb00b0ff34c450223b"
        }
      ]
    },
    {
      "bom-ref": "23661591-1876-4cb3-b926-830d01a78b14",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/sfcb_registeredprofile.idx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9bcef0cab95051d9aab85c05e126188f1fc6d6a7"
        },
        {
          "alg": "SHA-256",
          "content": "11f410a5be4f01b5e4be2f4efe59349e6742a65c4c377f65576cd8da50d095c3"
        },
        {
          "alg": "MD5",
          "content": "706ed2952d5480079cc2e7ee7adcd776"
        }
      ]
    },
    {
      "bom-ref": "2374476b-9521-4ae5-bb51-5be4e15d3c3d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_19_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "18a5b3249803b2775d4dcb17a44ee56ad4244c84"
        },
        {
          "alg": "SHA-256",
          "content": "c3bf4911d83b919a63af03b33b540cabc018bf24b0a16d0e4d7e400d9defd34e"
        },
        {
          "alg": "MD5",
          "content": "9a92377bf5bd06c63a56a11d76bc90e1"
        }
      ]
    },
    {
      "bom-ref": "2377267d-8033-4d0f-8896-3634822211f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcChassisExtensions.v1_0_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1053d02ba22fae09d2eaf94d211d2fae30ef662e"
        },
        {
          "alg": "SHA-256",
          "content": "8cd5db557ea06111ec38ff56b36fb985b21cf179656e42ef785d412385ae546c"
        },
        {
          "alg": "MD5",
          "content": "812eebf984a8172a4735d24dde644edc"
        }
      ]
    },
    {
      "bom-ref": "239f1579-7449-4282-94f1-ce31cd4c68ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea4e1d8dd5cbd506f07ca5d62dc0e18041f10adc"
        },
        {
          "alg": "SHA-256",
          "content": "75f9bddec8d88a47e3a3db21bb905a6e20597675f556ba2aaa5cb8dd2734d854"
        },
        {
          "alg": "MD5",
          "content": "96136786c2520483647af2725c92d779"
        }
      ]
    },
    {
      "bom-ref": "239f5bc0-363a-4552-8d0a-e0800011d745",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30473d1266647c3821b02c1292dd182da7368baa"
        },
        {
          "alg": "SHA-256",
          "content": "3da8c8b211d0ee92f4d78bfde3f3ebc3c19e66996a577bafcc61e50c40fe5223"
        },
        {
          "alg": "MD5",
          "content": "f72ddf0baecedf1ef495546bd6d63f7b"
        }
      ]
    },
    {
      "bom-ref": "c8a3df0b-7172-487b-800b-d97fb0324f09",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcChassisNVMESSDExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "17e93b4daa732de2ad8838d8a6aeae143ff15a62"
        },
        {
          "alg": "SHA-256",
          "content": "b1be587a6d6bd1d11a3d228bdedc5af001ad48f679e40d93e730d8057684a165"
        },
        {
          "alg": "MD5",
          "content": "c1c651bd8d149470c346f9641daf8639"
        }
      ]
    },
    {
      "bom-ref": "c8b2e402-da43-4e9f-985e-7aca44a2540c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/task/task.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e73e9384006c9fe1b76b5931845ade875dd09815"
        },
        {
          "alg": "SHA-256",
          "content": "fff33d0de1c47397ee81f1eb7ba54173b878358c8d0f61bd0dd67d5860313707"
        },
        {
          "alg": "MD5",
          "content": "a37987a998b26e566a33c1701a237329"
        }
      ]
    },
    {
      "bom-ref": "c8dae5cf-5af0-45ce-bb4a-93e913b2de04",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libzstd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f49b92e2d483a59646a741a5b9340d63e93ee1f"
        },
        {
          "alg": "SHA-256",
          "content": "c495d603579c6a203727a66bf4f2af4789ee8815d4635c22bfb2e2e68ad68142"
        },
        {
          "alg": "MD5",
          "content": "4302560a4ea0a94a90150adf74e25e49"
        }
      ]
    },
    {
      "bom-ref": "c913a3d7-d016-4463-b95c-91266511e1b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mctp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0552f1bd842859f9cdd86b79d4a5ed217f545672"
        },
        {
          "alg": "SHA-256",
          "content": "5253e6d1d4f4a837e41588434df67d110553d02781ea9e82e95bd792273381f2"
        },
        {
          "alg": "MD5",
          "content": "895f91094bdc12dd262ed519579c2e00"
        }
      ]
    },
    {
      "bom-ref": "c926f709-09a4-42ac-b936-5ddd9b0f99e6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libiptc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2baf805c793e28600f0d0ebb9e903dd83c98c9a0"
        },
        {
          "alg": "SHA-256",
          "content": "7d439bf191c1a7ad0c18d9ba4906d5d1dc4df8d21811f15ee44df0333a372566"
        },
        {
          "alg": "MD5",
          "content": "341fd6be8b899d63656c014dc0ca9ac4"
        }
      ]
    },
    {
      "bom-ref": "c92a9a6c-fe67-4bd9-9af9-8506ef592df2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libatomic.so.1.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48b910a8ccf63d5be6b85d1db031b227fee4bec4"
        },
        {
          "alg": "SHA-256",
          "content": "992bac30241c4cff67f8fcfc7801e9bab1143369da17edb7d88a42e90f8813a8"
        },
        {
          "alg": "MD5",
          "content": "fd500dcbda526b31367f53737dc428f8"
        }
      ]
    },
    {
      "bom-ref": "c942e209-7d13-4321-8eef-e8a336bce351",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamAlert.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66838b9009dfe6c6b3511addc07de2e5da5c70e3"
        },
        {
          "alg": "SHA-256",
          "content": "d87407c2686d9107b3fa4449d68d7d59e797a7bd08d04a14547fb09d76ab21a7"
        },
        {
          "alg": "MD5",
          "content": "893d9f68d1107bf4b2fb42d98d667bac"
        }
      ]
    },
    {
      "bom-ref": "c94668ee-abae-4c85-a864-4b6292c30597",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/loading_center.gif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5647f7834f310eaf10fa1210e828ffc3a97b00e2"
        },
        {
          "alg": "SHA-256",
          "content": "c3ede61a2ec26ce0a3cf66dd91f4fe0bda64a90531e337e731100efbc2b2e1b1"
        },
        {
          "alg": "MD5",
          "content": "bd72dde32e02048026f50306cb4f7aa7"
        }
      ]
    },
    {
      "bom-ref": "c98a2f59-1aac-48d7-9327-a2ab90f4da38",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/LicenseManager_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c77b43bde8cda388c2a606332f30672c9da81614"
        },
        {
          "alg": "SHA-256",
          "content": "140e4671dd6996ac14ac73d3402e7d226c4fdfbc603ebddc61bbaca8884f219f"
        },
        {
          "alg": "MD5",
          "content": "81739d91407fc37419262622ea8b3dc7"
        }
      ]
    },
    {
      "bom-ref": "c995bf59-e198-44f2-84c3-02d3a99ab18b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamInfo_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "450c08604c575191ffdb1c483cd3b63ee4370736"
        },
        {
          "alg": "SHA-256",
          "content": "eb1d7c2c10da43dc58724529d5e097df3ed9de01e63f03cbced2fb9c95bdc729"
        },
        {
          "alg": "MD5",
          "content": "f8a54f288f54f2930b736397f6cf1b90"
        }
      ]
    },
    {
      "bom-ref": "c9a14a9a-a4f8-436a-b870-9c99d1849641",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblzma.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ef77d699dba364df0bc91a98228e2fb6e6d4a95d"
        },
        {
          "alg": "SHA-256",
          "content": "89c182e6d9172516dcb2e497f7bec8428d5d2395b23e4646df1bade8177beaf9"
        },
        {
          "alg": "MD5",
          "content": "e0fc14c034c2c291e4db5c2084263f57"
        }
      ]
    },
    {
      "bom-ref": "c9a2f36b-1367-4c12-bd29-ad2d000c3916",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcElementCapabilitiesProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b61a9de4c41005f3942768e5dd2db4f10010460e"
        },
        {
          "alg": "SHA-256",
          "content": "2ddfafb5f10694b6cfe8e42418d00b8b10116dc2f7600b8616455270d44d578c"
        },
        {
          "alg": "MD5",
          "content": "a1927b2ae8be3277f2a0aeabb217e2cb"
        }
      ]
    },
    {
      "bom-ref": "c9a63b90-b88a-405a-95a3-94ac90a8efc7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/xtables-multi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "c9be8d69-4105-4f4f-8d60-ef5a2105ad35",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/arp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c9e78aec-4a62-4642-9e0a-f4c5882c3d68",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb3ecc8bb787ecd713282009c206b9113601c15a"
        },
        {
          "alg": "SHA-256",
          "content": "8834399a06dd25165ea5997753dc731ecf010c7e4564ab82525b8c078125be05"
        },
        {
          "alg": "MD5",
          "content": "83df5a365458a0e7148ef9f31cab0364"
        }
      ]
    },
    {
      "bom-ref": "c9fe9d9b-b53c-44fa-80e8-7ab0a1d7fb60",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBT_FAP",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e8dc0693e379203d0d1aebb2c898263167f16552"
        },
        {
          "alg": "SHA-256",
          "content": "a2a69d90e1d587754d130f4e69828eb23a95cc050cdc1928f0c5f771d320e37e"
        },
        {
          "alg": "MD5",
          "content": "8b87834f31ea321153828727235e44a2"
        }
      ]
    },
    {
      "bom-ref": "ca03d7ce-e9bb-4855-8be1-76f480b1f870",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/logout_alert.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "882b1274a3bc14178561f386bb1aa79cf0cfb4f2"
        },
        {
          "alg": "SHA-256",
          "content": "a2bfcdd63f43122ac083c9eac58bbdb29610c2cfc84838fe5d50115a2b739465"
        },
        {
          "alg": "MD5",
          "content": "d318ac7b68feefe94681320ab42089ed"
        }
      ]
    },
    {
      "bom-ref": "ca0e01e7-804d-4c8b-8730-2c21f9f1d765",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/LanNotifier",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "da352e4a4e1a61279046ad6e1009ee783ced8cae"
        },
        {
          "alg": "SHA-256",
          "content": "00a129d7a35727f36626b121b81ac74c612415b501df64bce763be2109fd97b1"
        },
        {
          "alg": "MD5",
          "content": "4a262cce24bb1d81bb5f2bd783d39421"
        }
      ]
    },
    {
      "bom-ref": "ca1e57c9-1acb-455a-85a9-79f8ad15c3e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DEM_6FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "38004a283e724d6fe5d91373e62f6bc938290f3a"
        },
        {
          "alg": "SHA-256",
          "content": "4427c4b7ff8233c132fda4e4cae124eea1eb6355cadd6ed66c4cd5274ef6c133"
        },
        {
          "alg": "MD5",
          "content": "a966f644d4129f4993d6865d9b79d8ab"
        }
      ]
    },
    {
      "bom-ref": "ca667591-9081-4d00-add7-390ecda13bef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libcimcClientSfcbLocal.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f82286127ecb8964115de88cab6ca9673731d"
        },
        {
          "alg": "SHA-256",
          "content": "19378c0b68daf27eb1566ce78c6598ba7214a554ea354c8e6ee6d960d7912ebf"
        },
        {
          "alg": "MD5",
          "content": "86c95df95a995dd22b523f9a26f56b3b"
        }
      ]
    },
    {
      "bom-ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/showkey",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ca9d3e65-ab76-4afd-9f43-7a794b4fda29",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/plugins/jqplot.pointLabels.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e00a78305921bb754e926d1dc0599eb6708b1af9"
        },
        {
          "alg": "SHA-256",
          "content": "4b6f11190199176312af9ae875d66b59b2b4cb0dae58e16296c5b76fb8c20207"
        },
        {
          "alg": "MD5",
          "content": "d0672194fef6b21adb67292dd8e3f753"
        }
      ]
    },
    {
      "bom-ref": "caa85e99-559c-4241-bb15-1c2bb23e39e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libncurses.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "71a2659eeca7bd4b288c126d1bc0155bae885a48"
        },
        {
          "alg": "SHA-256",
          "content": "65779b09e017c10c0b45e9626781c5cf7a79cbd55934ec3987354e0d0cf9b7da"
        },
        {
          "alg": "MD5",
          "content": "8381fa455fe7ce6260a2a878a8a343f8"
        }
      ]
    },
    {
      "bom-ref": "cac12798-1157-4ad6-81bf-050d786eea34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cac1b734-f923-46fa-ad23-61763d0cfb17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power_p4.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2bc3a028aa48de2e28099722878c914db667fbc1"
        },
        {
          "alg": "SHA-256",
          "content": "aa0bf444a8899a25b39c75901a87e0b3ed52f8075fcf192e1cb149137354b16f"
        },
        {
          "alg": "MD5",
          "content": "baba4150a1bb3b7d30689ab2de7b1fff"
        }
      ]
    },
    {
      "bom-ref": "cac6a419-8fb0-4a83-85fc-d619733ae68d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Node_Link.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6fdd92e0c61f6fbf10ae6736bf7884e378c0fc10"
        },
        {
          "alg": "SHA-256",
          "content": "6805a49d49d90a3cf42c3fc81f18def33b7be57f925d3d314814037461dc9d0e"
        },
        {
          "alg": "MD5",
          "content": "a11ca0f127e1d6ac0c6d9d75ff5077f2"
        }
      ]
    },
    {
      "bom-ref": "cac9f7a0-c559-4a50-bfbf-1ad665315d02",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libtirpc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83e14166b7c5b716ee6475d17a5eafb47b2b32b5"
        },
        {
          "alg": "SHA-256",
          "content": "d32cc17d6bfd8be45f5eb07a01ca9d839350927f254cad04891f344ab735f31b"
        },
        {
          "alg": "MD5",
          "content": "2e6133cfef677681c4fc9e3792e173ea"
        }
      ]
    },
    {
      "bom-ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lsof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cb2e8093-9430-49dc-82b5-a77388890c73",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/envdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cb3b83ef-7100-4c5f-9822-45d293562233",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/truncate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cb43a31e-64f1-4d70-8864-aef889b546c4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_grey_small.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fefc8889675cce8941c97ef56afeee16504b6ee4"
        },
        {
          "alg": "SHA-256",
          "content": "4a257f62db998c5d1fc7a3f7a8d5583be5da3d4fb8f21c9b9313a6e9d72f9e3c"
        },
        {
          "alg": "MD5",
          "content": "7e124934981832385047a247e1047609"
        }
      ]
    },
    {
      "bom-ref": "cb64ec51-e909-445f-b72e-8a3a6defd036",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/slider.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9e94300396e6f1987c25132889048ae2495d01e4"
        },
        {
          "alg": "SHA-256",
          "content": "22c132e95fba1027425045202c579cbe71a29b4799a68d96ff0476e9b4079dac"
        },
        {
          "alg": "MD5",
          "content": "585747c22af38e315843559a798b87d4"
        }
      ]
    },
    {
      "bom-ref": "cb6804a5-5e21-4a7e-9478-d1290662de52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_setenv.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "674cb050afe14905e0f7cba4f5af17fa3d03c313"
        },
        {
          "alg": "SHA-256",
          "content": "4563ceea43d6f2fecb4450bf7e4cbe5b48975304b5c93af0339cf2e846d721f2"
        },
        {
          "alg": "MD5",
          "content": "daf888f63c4fbaeb18e74a77ce0b2095"
        }
      ]
    },
    {
      "bom-ref": "cb7fe145-617b-4715-bfc4-d44392dd2f13",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/CapturePreview.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "93825f04f44c611abdd5db72111e4a62f46705d5"
        },
        {
          "alg": "SHA-256",
          "content": "50aa18993c4fb6068735df0e62e728cfdb10c1d3b06c7a03c9f2dc1d17dfe11e"
        },
        {
          "alg": "MD5",
          "content": "9035b036ac42dbb4e89c9da03fc47512"
        }
      ]
    },
    {
      "bom-ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/users",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cb889de2-2b15-4f0c-ab79-44ff3fff7099",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/VolumeCollection_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "daa7171e1d314892c1d081584579a14fd137c955"
        },
        {
          "alg": "SHA-256",
          "content": "6a24d6751bfa8ef237dee58ec348a7e09c6648a699a4474a52ce2d6e25fe8461"
        },
        {
          "alg": "MD5",
          "content": "738c8613017078e59e95a188292c5854"
        }
      ]
    },
    {
      "bom-ref": "cb8fe4bf-b9c5-4f3f-81f2-da26d47ffccc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBG_LC",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34c34d2a1c55d0274742565da2c3d81f2bf1ed69"
        },
        {
          "alg": "SHA-256",
          "content": "0ce443007f0d26ff4ccc6fc5ca1ef3afb3be58630b409b502aad962fd9f6c91c"
        },
        {
          "alg": "MD5",
          "content": "f4164b78629da4d29141ad3f1cca3678"
        }
      ]
    },
    {
      "bom-ref": "cb9c4f66-9b45-4c70-9294-43bf8f496885",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cbb1bdab-a4eb-4cd9-a1ba-958795f86045",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkfs.ext2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/crc32",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cbb9ead8-0b2e-47f8-881b-ec9101eaf290",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/uidLEDOff.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "425c0351d8870c61e8a09a1e55eba4775a15e870"
        },
        {
          "alg": "SHA-256",
          "content": "8246d1207eb4c80c8488756bb21e38383906eaad9754b8d449fb5baf7b6c2ea6"
        },
        {
          "alg": "MD5",
          "content": "0597ca6845287db342df2acd61a3e02c"
        }
      ]
    },
    {
      "bom-ref": "cbc66627-7c55-44ec-89f8-c5fb42a8d2fb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrack.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21b8b72195068be5bd3989d08ae6b217cf97a0aa"
        },
        {
          "alg": "SHA-256",
          "content": "cc1ab4c1737899d07a259590f14a83fbe7217cc3147c3c56f63af014aea58ad8"
        },
        {
          "alg": "MD5",
          "content": "74381dfd63028781d4c750ddeedf2484"
        }
      ]
    },
    {
      "bom-ref": "cbca2402-ce70-478d-a11f-f831b2b4e402",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/lsattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cbdba35b-a848-44d4-839e-4dcb3dba6df2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamPower_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "134564b27c85de1a6c6fecbc1a71be255fb90cc4"
        },
        {
          "alg": "SHA-256",
          "content": "3a5deaf9b3c6ad6e05a42cbc4d41c54f445cb491779322a97a92814aff64416e"
        },
        {
          "alg": "MD5",
          "content": "561e9a7c6e848b295e29bdd2c6e043ab"
        }
      ]
    },
    {
      "bom-ref": "cbfd10af-5c6d-4e2e-a8f5-2946ff2cbfca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxtables.so.10",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f577a10a10b85df6e4036e1bf248a306f361a092"
        },
        {
          "alg": "SHA-256",
          "content": "da2593460f7623d27ec31d44fac5c17e64d06c607ae98f71aad3b9f6e0bfc4d1"
        },
        {
          "alg": "MD5",
          "content": "a332c49f74cbe1d7a553910a49da2de6"
        }
      ]
    },
    {
      "bom-ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gzip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cc1c84bd-0e03-430e-bd01-f03703884f9f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/html5boxplayer_volume.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2f6507a5702a855cd58ce91da2e6cc67636fc593"
        },
        {
          "alg": "SHA-256",
          "content": "28d2b6370572fe61845895ab2f0376f9047dc0b2630fadc172a7d0ecd3cc88d6"
        },
        {
          "alg": "MD5",
          "content": "add7d2664553f143869ac9eafa8bfce3"
        }
      ]
    },
    {
      "bom-ref": "cc372503-067b-49e6-8be5-c1b368c0ec9f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c5ae26d8ba96d6c5da89dac5097116ca3ce7003c"
        },
        {
          "alg": "SHA-256",
          "content": "9a7c54559341bfe0212886687226fa6a87b2eaa3287a082d699ae42941993ad7"
        },
        {
          "alg": "MD5",
          "content": "13b91b95ac835096125acc66d8445c67"
        }
      ]
    },
    {
      "bom-ref": "cc589195-a635-407d-9b54-a4e518df10f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSH_TI036",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "460f69be7bcb32953eef15d9f276995f7694bf33"
        },
        {
          "alg": "SHA-256",
          "content": "e9a936f83b536651556bf75128a34d48acdc23f6057ea3e75a7f09706c27605e"
        },
        {
          "alg": "MD5",
          "content": "a68aa12136f4a10e1392b81c05fc3933"
        }
      ]
    },
    {
      "bom-ref": "cc71e7d6-4d84-41fa-949a-dcdaaa6cf7bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFixedBootOrder.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4c3925efebf68c752e3102b10fc1a115c60d9222"
        },
        {
          "alg": "SHA-256",
          "content": "aa9688a339c58e44367fb626900f6f837bca4f8c7d5d1b9c2039f000e35614bd"
        },
        {
          "alg": "MD5",
          "content": "4f781b11045644178753272618cb32a1"
        }
      ]
    },
    {
      "bom-ref": "cc98098c-c20a-4095-a8fc-0a977a1f7a1f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblldpctl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5b27957703d8a92ce28a70eaf3e516b9049b19c"
        },
        {
          "alg": "SHA-256",
          "content": "5cefc8e2c67312af4c7360e88a08f83e7208bd33eb744b203b00c2cb72d84250"
        },
        {
          "alg": "MD5",
          "content": "697bac27a7769941bf6ba742252b098a"
        }
      ]
    },
    {
      "bom-ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/udhcpc6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ccc03edf-4c7f-4ab1-a8f6-751e88e9b6c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/11reset.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4ef4989a2dd5996a8747acf0c82430ab5c3a6a17"
        },
        {
          "alg": "SHA-256",
          "content": "caf92420216d41100ff385543063041e1c7c5f7bcaea9ef22e50ee3af009dd11"
        },
        {
          "alg": "MD5",
          "content": "2019c1bb368924d952607bcce44ed6eb"
        }
      ]
    },
    {
      "bom-ref": "ccd000f8-3dee-49e2-ab46-ac7ab7f61b87",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/power.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "859540a1556b8f3d5525f05f4cb3d7e73a040623"
        },
        {
          "alg": "SHA-256",
          "content": "97e461ec75c84fa3a368aed85920f0646c864781f1de28e78d0ec524a5996d8d"
        },
        {
          "alg": "MD5",
          "content": "a7b24439b4c31936ac8dd16ae161f9ed"
        }
      ]
    },
    {
      "bom-ref": "cce10140-1070-454e-addd-912aeb038694",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5support.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6323368eeadb6cf6e72ba885cb3ee700a379c538"
        },
        {
          "alg": "SHA-256",
          "content": "3c8cd3d5721a6ea6ef421edbc1c34c9ec390901bcc9c1d37ddc9ed9cbc56332d"
        },
        {
          "alg": "MD5",
          "content": "dfb7f207ed9135f82c251060b260783f"
        }
      ]
    },
    {
      "bom-ref": "cce1b203-496e-4080-9292-bf8eb6d8058f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/last",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cce286bc-29e8-448c-92de-3dff3438c0ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_context.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "163687e70159453081459b5f37eb5de5b12c40c3"
        },
        {
          "alg": "SHA-256",
          "content": "6bdc58a66f26af8c143a01ef722aa196be8d37c4e1e1519cb3bd5678f377a8b2"
        },
        {
          "alg": "MD5",
          "content": "ba098dfe02f6ad84a3f22156fa5fc083"
        }
      ]
    },
    {
      "bom-ref": "cce77498-1422-40c6-806e-2bf7d8e88cf4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libiptc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2baf805c793e28600f0d0ebb9e903dd83c98c9a0"
        },
        {
          "alg": "SHA-256",
          "content": "7d439bf191c1a7ad0c18d9ba4906d5d1dc4df8d21811f15ee44df0333a372566"
        },
        {
          "alg": "MD5",
          "content": "341fd6be8b899d63656c014dc0ca9ac4"
        }
      ]
    },
    {
      "bom-ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/chrt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cd028e4e-108e-4eb5-a382-4b489b3c62b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fbset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cd34a26d-76d3-4149-9275-4c116baac74d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/FanMode_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2c5f6c1c45c3040520ff51b6539c6e420ab2f416"
        },
        {
          "alg": "SHA-256",
          "content": "df9e73d7edb35cb14d07a998d3d93ca36d33e63ea3a21bc7832c44ac3b6e50bd"
        },
        {
          "alg": "MD5",
          "content": "153968029bbd2b269f88f378ff1e8dd0"
        }
      ]
    },
    {
      "bom-ref": "cd3929a2-ea29-41a7-9ed4-f1e26e25c9e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_cmmInfo.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2a3b84fbadeeff3d5ce370ce35a576b53fb55fe5"
        },
        {
          "alg": "SHA-256",
          "content": "50ff04f83f4cb063d527bbe2aa39b68f3466938bf3a1aa225d213960a6395ad8"
        },
        {
          "alg": "MD5",
          "content": "9b2cd72b1a971b005c50b4230c8ac20d"
        }
      ]
    },
    {
      "bom-ref": "cd3ac4c3-7ff7-41e4-973a-b838b7449c38",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libdl.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a681b98e2358fe4e64f5d311a5425563dd52bde"
        },
        {
          "alg": "SHA-256",
          "content": "d8bf9201ed1cd88e6c830fd20e34dd1ba0c313c8105b0f1645a9a8cd621e99e4"
        },
        {
          "alg": "MD5",
          "content": "12e5894175bcfe681ce74e0e3e12fed1"
        }
      ]
    },
    {
      "bom-ref": "cd4e833c-33dd-4ead-84e6-7283ffda6750",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/no_data.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e9710e33a8745a1269f3be4de3a4b130b2c27df"
        },
        {
          "alg": "SHA-256",
          "content": "9bedba5ec0767a4e1bfe801b4fc4119ecd7fa12168712e28c6553378b8f1fd3c"
        },
        {
          "alg": "MD5",
          "content": "1301ee8098efd4956781039c6bf3a713"
        }
      ]
    },
    {
      "bom-ref": "cd62721a-64d3-43e3-90f4-e5bec52be027",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5238577cad3f9038da4e3459cf6ec1b353bf399d"
        },
        {
          "alg": "SHA-256",
          "content": "da76e9e74ed33bb756cbf9275a735306d746b46ab9614831c42fe66c9ff4ae9b"
        },
        {
          "alg": "MD5",
          "content": "e9a8d2f6b08b6d153d771a6a3d7b3736"
        }
      ]
    },
    {
      "bom-ref": "cd771914-9210-401b-9522-43f62d29c63b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "942406d28628623c618c5e8e410b4b3b39c7545b"
        },
        {
          "alg": "SHA-256",
          "content": "62818c15e8e6943feda459a76e558995e0f17fceb64b16c7f5516b401ae20140"
        },
        {
          "alg": "MD5",
          "content": "841cf40a1faf4d3477ad614b16dce18c"
        }
      ]
    },
    {
      "bom-ref": "cd7acea7-231a-4728-af9a-548a94e64cde",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/split",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cd7eb25e-10ea-450f-b326-a17181f24480",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so.2.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e997ef2fe3e70cf09bff164b27f77e85bdf494fa"
        },
        {
          "alg": "SHA-256",
          "content": "83be203ba1d903ea64595e13cb1a2c13deedc6e05927507d1c008543df4710f4"
        },
        {
          "alg": "MD5",
          "content": "ef7db7887916338673ad165d85478bdc"
        }
      ]
    },
    {
      "bom-ref": "cd916b90-5f89-453a-be47-4ac31caf6502",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/time",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/mim",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/flock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cda699c6-bc0e-425e-aaf7-474b4edde402",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/basename",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cdb635fe-c7a6-4bfb-bd30-e6c57979a149",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/tree",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cc106fcbdd65c3000949435558f52f0eb73c7841"
        },
        {
          "alg": "SHA-256",
          "content": "2c97cd824418658a96fba23a8c0d123ebb9c9596d7855cf405d46eed37120891"
        },
        {
          "alg": "MD5",
          "content": "f2e924f6619beec1b286605c4c97ff60"
        }
      ]
    },
    {
      "bom-ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypto.so.1.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fc7b4cefb586a10e62363f262f53b45b650efa44"
        },
        {
          "alg": "SHA-256",
          "content": "6d66245a347c1379bf9da1ef39a33beeaaf7b9d0c481f9c5183f89e44395aaff"
        },
        {
          "alg": "MD5",
          "content": "c28e6fb0457533f45352e7d7c81c4c86"
        }
      ]
    },
    {
      "bom-ref": "cde83a23-8e7e-4f00-a2af-0ef2a3c420df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/Storage_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7fb7bb7028300aa1bd50c6da5977720d5029c6a8"
        },
        {
          "alg": "SHA-256",
          "content": "5d59cd0373ee5ad881ce514f6004502222c94f155b01eae45e3e479f9f0bf5af"
        },
        {
          "alg": "MD5",
          "content": "3c1db921becfbc673831159ea9f0dd97"
        }
      ]
    },
    {
      "bom-ref": "cdfecd8a-ff92-40bb-86d1-bfc898f80a47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "caad41f46de48d3124896e05834fe5db7d6317c4"
        },
        {
          "alg": "SHA-256",
          "content": "81e92cc66e644e2b1a479fb2f35ca1ded4c0619ee3db8a71175fdc39f47d7b90"
        },
        {
          "alg": "MD5",
          "content": "43c47bb6de772c80cc7110c8fcc81c76"
        }
      ]
    },
    {
      "bom-ref": "ce007e2c-6e66-459f-a7c7-4d8278d32677",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/systemd/libsystemd-shared-251.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "32b49f1dd19435f29f4c9c35afc4dff178e656bf"
        },
        {
          "alg": "SHA-256",
          "content": "5a58b0d8b27376b300d736b6a272092095d1cdac52db97446bce92d0695eca97"
        },
        {
          "alg": "MD5",
          "content": "43b5af16804662de2d9a4c5e0ee7ecd0"
        }
      ]
    },
    {
      "bom-ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iplink",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ce24fdfb-7fad-4dfa-a3fe-5192f4a0f49c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "edb12ef241b26a3595c652d90543beaed6defd4d"
        },
        {
          "alg": "SHA-256",
          "content": "2e509fea8db8cbd6cc88d6ca60ac5dfb8130e58408042129a73ff728c2565705"
        },
        {
          "alg": "MD5",
          "content": "978bd34e70d3fe7aadc10d660d340683"
        }
      ]
    },
    {
      "bom-ref": "ce350abe-2ada-41c5-9125-5c74f4caf219",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrad.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1dcc8c63a1f81dd8fb505472dd2c7aaaeada2886"
        },
        {
          "alg": "SHA-256",
          "content": "b150eb70d34605ad251d5b6b307178f52e5439dc9bc7aad1dc687ddb17fb3bbc"
        },
        {
          "alg": "MD5",
          "content": "e8b634787c3c43c7dc95acdea592e88b"
        }
      ]
    },
    {
      "bom-ref": "ce7b2454-e780-48c8-8220-bf483c988a5e",
      "type": "file",
      "name": "./1982632-5274408.image",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcb9707fcba3f76df17b212aa327117ba68e1bb8"
        },
        {
          "alg": "SHA-256",
          "content": "58b56da77d5ff22a2a39b91b08b8ab93dd716fd450253708d553ed4e8ace3ee4"
        },
        {
          "alg": "MD5",
          "content": "c57bb203293511210facaafe6c4c84a8"
        }
      ]
    },
    {
      "bom-ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xxd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ceaacced-5895-48e4-a2f6-ad55a57c7aad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "02e15f73197c8805dcaae77f8ba3ddc342c65ae2"
        },
        {
          "alg": "SHA-256",
          "content": "b245ebf9ee7b5ed0e394fdb877ae54215d2cbcf167cd38a08267547bffbebda7"
        },
        {
          "alg": "MD5",
          "content": "6585939dd8599dd2f81aef493b4b8f42"
        }
      ]
    },
    {
      "bom-ref": "ceb41795-29d2-4487-b27f-d30d4320447a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/bootstrap.web.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d"
        },
        {
          "alg": "SHA-256",
          "content": "7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b"
        },
        {
          "alg": "MD5",
          "content": "abe91756d18b7cd60871a2f47c1e8192"
        }
      ]
    },
    {
      "bom-ref": "ced777c4-f097-4a21-a50c-0e43c277f84e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_files-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adf742914dcdf3bb930adbc058262b7d3438a9d4"
        },
        {
          "alg": "SHA-256",
          "content": "e97ba39e3a6912094197078b9d7b8e7015143a6b91a76b983af03b2f9e499fb3"
        },
        {
          "alg": "MD5",
          "content": "ae17094aabbcafa684e75583f9a2b834"
        }
      ]
    },
    {
      "bom-ref": "cef14346-674f-4275-a10d-c293409c1464",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/get_eject.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4d7d45a883098a3cac1400ef6320e62d7793044f"
        },
        {
          "alg": "SHA-256",
          "content": "b83dab90413c576697c13c36e364c3596e407ed9c76ad6e61507e8ca15e2103f"
        },
        {
          "alg": "MD5",
          "content": "7ecfaa499cd1a65825e8c668e64c908a"
        }
      ]
    },
    {
      "bom-ref": "cf147b35-a4fd-4a47-a2ce-f55356d44ce6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/favicon.ico",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "15d894e1df59a97729721ff909aec2551c368b47"
        },
        {
          "alg": "SHA-256",
          "content": "b9553ca1ff5e70d2ca3f5dee94f8c817f445ab6b7677ff7b9b984b46202e3e1f"
        },
        {
          "alg": "MD5",
          "content": "93a83db08efaeda86a6e28d6fb34700c"
        }
      ]
    },
    {
      "bom-ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/busybox",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cf4781d7-59dc-4318-bf18-01278d234cf8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SSLCert.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8e283cbc7e1376b01bb549359706cb1977912c08"
        },
        {
          "alg": "SHA-256",
          "content": "0ec3c9ff22c9dde411ea627c4eac53e4a01e71a10801314abd8771dfb0cb4ecd"
        },
        {
          "alg": "MD5",
          "content": "4d34c507dd33e773d965a94aaa0ee9bc"
        }
      ]
    },
    {
      "bom-ref": "cf625bc3-961e-49fe-8010-ec3dcf2d4f05",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsVolt.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d7314fc38ef9efeea7a79bdbd0d4803b741c43a"
        },
        {
          "alg": "SHA-256",
          "content": "9f71c5046ef438acc02b589351f37cb8305fff7183a210afbf3204230ca8eb6e"
        },
        {
          "alg": "MD5",
          "content": "f238bf61f4d871f3d130230dcd87d9bd"
        }
      ]
    },
    {
      "bom-ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/svok",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cf950ca1-5240-4b19-8482-b11bbed98c95",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/uevent",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cf9baf96-236e-47d1-a0c8-1b8274c9f1b0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/taskset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/brctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cfdc8540-39b8-4bdc-a2d7-a41ad87bca00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/librot20.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "09cf6c98a1ede704f0661e16f1f5761835dae612"
        },
        {
          "alg": "SHA-256",
          "content": "69c3575c9f263b4cb2d6bc5ca8fd5c1f8211d6ad00cfd702d3311ec8518b3738"
        },
        {
          "alg": "MD5",
          "content": "3e0aec8fbc5f97525d89c62cfe30daa0"
        }
      ]
    },
    {
      "bom-ref": "cfdc91f7-ed90-4bbf-99a5-8a0e5b127388",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcObjectImplSwapI32toP32.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "022d33b2039d9c6eb446acdf2a82f8959f108428"
        },
        {
          "alg": "SHA-256",
          "content": "fd6608d364e3eeaf5386a95dd17982db9e2732998bd387c1be50ff313f47fa48"
        },
        {
          "alg": "MD5",
          "content": "00ce69808b70439147ab6428472f2d87"
        }
      ]
    },
    {
      "bom-ref": "cfe36b89-8125-476b-90d0-f4ca5a817cc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6e974b28b0134d2cdd58bd69819c6fe9a4b7e3fb"
        },
        {
          "alg": "SHA-256",
          "content": "3d1d1860192efe6d66e5a351447cadde445b9e745917b1c3370c2d8ac5183de4"
        },
        {
          "alg": "MD5",
          "content": "74499961c79f35ae6df8d22364b77ff2"
        }
      ]
    },
    {
      "bom-ref": "cfea1f86-2d91-431f-8fa6-606337b71e2d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/umount",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "cff79766-958e-4a4e-9136-76c662857964",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgs2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e508a2150d7392b137f75f248109c07208929e47"
        },
        {
          "alg": "SHA-256",
          "content": "ef6e841167f46aca60a20d6162fc0e1bb7e16545cbe45a3368c9218e80883f5f"
        },
        {
          "alg": "MD5",
          "content": "ac8abc1e79d6a6b7a9e8e4aa7df92282"
        }
      ]
    },
    {
      "bom-ref": "d0316326-9baf-4e81-b52f-84d5b7248031",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ionice",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/grep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d0332767-0bcb-4f96-befd-00010c816091",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libatomic.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48b910a8ccf63d5be6b85d1db031b227fee4bec4"
        },
        {
          "alg": "SHA-256",
          "content": "992bac30241c4cff67f8fcfc7801e9bab1143369da17edb7d88a42e90f8813a8"
        },
        {
          "alg": "MD5",
          "content": "fd500dcbda526b31367f53737dc428f8"
        }
      ]
    },
    {
      "bom-ref": "d036d426-ebb7-4c8c-a23c-656e116dcf54",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/keymacros.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5539af60c2af6bd5dfd1fae78b6332aa4cd1bf1"
        },
        {
          "alg": "SHA-256",
          "content": "578ed087c9f63f93f848db8d56e8bdb567b49c95ae4ea8ef02b1bf2b4e466357"
        },
        {
          "alg": "MD5",
          "content": "da05abd48aa1081c26f99a85a5cbb11f"
        }
      ]
    },
    {
      "bom-ref": "d0380940-f84e-45de-901e-2c33b401d277",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/ast2600-i3c-global.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcba204eb3a6f7a56c35ec0491e720b5e46a2bd0"
        },
        {
          "alg": "SHA-256",
          "content": "272b9386589797799bd47ca91a7fc6a5162c7c06c048a082d13e13e9c7280c2c"
        },
        {
          "alg": "MD5",
          "content": "2d8cd1996df3b5695f32ec952a97b6c8"
        }
      ]
    },
    {
      "bom-ref": "d038cc43-67bf-4f84-a755-ff747950221c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ManagerConfig.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d3cfece651ae6ec6db96b07c4f0df04c90b55b3"
        },
        {
          "alg": "SHA-256",
          "content": "5a0b72e4e5232c974fad3bb102ca5b59927e2293fa87c2a39efa61a6c3fee9df"
        },
        {
          "alg": "MD5",
          "content": "125a0fcb3429ff1c3a7e5b87ace742cd"
        }
      ]
    },
    {
      "bom-ref": "d058c055-7833-4282-9a7a-546d10d02d3a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4464f03754a467d54f983ca9e9a6b97fd976199"
        },
        {
          "alg": "SHA-256",
          "content": "c5ad4fc9556f28179976f3855dd6a86afa96bdc6e0b7668e01bc8397ff621cbb"
        },
        {
          "alg": "MD5",
          "content": "0a41aefbb26bfbdb00b0ff34c450223b"
        }
      ]
    },
    {
      "bom-ref": "d058f3a0-96ab-46cd-8acb-0cf80d081722",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_regex.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e252dd6a22c1bc9f30fc706bcda0f4250a6d2d1f"
        },
        {
          "alg": "SHA-256",
          "content": "4fe94816b558ed536e5a4c987f05072318d7ca605787bc89fa1046fb9584370c"
        },
        {
          "alg": "MD5",
          "content": "d22d5040638b5037711f219775e86243"
        }
      ]
    },
    {
      "bom-ref": "d07e65ec-4509-45fc-9f4f-15bbc4050e98",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_redirect.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "807a37a1d12cc567119800b0557a79b40e71fc8d"
        },
        {
          "alg": "SHA-256",
          "content": "255ed2212b0dc7ff1ab0b56f04a83b67cd2c2fb5fc510c50ad15d5864618f327"
        },
        {
          "alg": "MD5",
          "content": "294e61b16865300ae38dac8ea2d76450"
        }
      ]
    },
    {
      "bom-ref": "d098b5a9-87b1-4dce-8940-29aaa70e071f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/msmtp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8e885db142f980ef2c7fb11314a53d51edec4863"
        },
        {
          "alg": "SHA-256",
          "content": "1eefde4be0f9e2e80d20366182c0eb1f9a15de209f84f984ebdde58531a512d3"
        },
        {
          "alg": "MD5",
          "content": "2492384059d8e2b49afada1b8911c097"
        }
      ]
    },
    {
      "bom-ref": "d09bd394-13fd-4724-b42d-0000cfba7e20",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/rdev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d0a2412c-c202-4700-937a-fffb85503952",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcQualifierProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f2cdca51272b218dc2ab93f730f300fa86bfc8f"
        },
        {
          "alg": "SHA-256",
          "content": "79283d74e2ba0c80c72d77d3246c44d557ea51d793272ab8171ca91418c44eca"
        },
        {
          "alg": "MD5",
          "content": "ab7199ef8ccb013a7bb2d55512ca7a5d"
        }
      ]
    },
    {
      "bom-ref": "d0a32d66-ca9c-4131-b7c2-ed9f27e76d0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/rearm_chassis.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f5727ab06854bafe6259dd76470cf72de0fa39c"
        },
        {
          "alg": "SHA-256",
          "content": "3424fe2cbe7200c5653639dae859a87560fedcee1d29ce9744854396472a78c6"
        },
        {
          "alg": "MD5",
          "content": "d7a143e71d714e81d3deb9122d4b59dd"
        }
      ]
    },
    {
      "bom-ref": "d0af0bca-2949-48ef-bace-7cfe48b48cb2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_event.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6b4bdad2ff65116f591029a942f9bf268a95eef1"
        },
        {
          "alg": "SHA-256",
          "content": "9d5f0a9109f65bee484de18711408de387f7aab172247b613c142318c6514d3e"
        },
        {
          "alg": "MD5",
          "content": "7cb8372536ef8ce13bee9ad67dfb1d70"
        }
      ]
    },
    {
      "bom-ref": "d0b5cd13-07a6-48ce-a904-b0ef52f2e4d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcChassisExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "da0eaf64a5d896e455cbfa5d9f433ed653882135"
        },
        {
          "alg": "SHA-256",
          "content": "82973475f13b1748eb75c3421c81881727ec28e096b492343c4e844c95874aea"
        },
        {
          "alg": "MD5",
          "content": "d9cc0ff497872e5e6d51b21d3ae5ba39"
        }
      ]
    },
    {
      "bom-ref": "d0be729d-07a3-40ba-a9bd-e4cb7ec428ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpldm1.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "11d90ffe7dd1517e6fa529ca4713003f7f89e08e"
        },
        {
          "alg": "SHA-256",
          "content": "8bfdd6e35288d5c1aa6ccd854f5c708f7e442e58747b253e8f30ca2aa72ca9df"
        },
        {
          "alg": "MD5",
          "content": "ff6b551f9fe91881d8d82fc1b78e07b1"
        }
      ]
    },
    {
      "bom-ref": "d0de2005-8745-43c8-9a65-2c999b6dcd6b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/whois",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d0fcb7bb-a5ad-4f8d-bce7-78bb8a4c5eaa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssapi_krb5.so.2.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b57a3c32db8ba424f5612e0a912e12303d197cb5"
        },
        {
          "alg": "SHA-256",
          "content": "101d2bbfa691e8a3c4fe0b9e6a8b3100318fd6e69dcc049b4cbbf558c95a25bb"
        },
        {
          "alg": "MD5",
          "content": "f7411491c74b7bb379688337fcbed1fa"
        }
      ]
    },
    {
      "bom-ref": "d1074694-6d81-4cb6-bbdf-e0c51d507604",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5bc9d3c0e679414897dc762d9d03fca2e3ce3ce"
        },
        {
          "alg": "SHA-256",
          "content": "b4bb841f5655e986d2ba9e76c437a6cbf6ad828694f4b3514fc7caaf46371f52"
        },
        {
          "alg": "MD5",
          "content": "ea31f74de910af7741dd7f1ba83b1e49"
        }
      ]
    },
    {
      "bom-ref": "d12c99c4-9bc5-4a08-973a-81f1a81673af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ikvmserver",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "473f3e95e9a7acc214285aca79c5b0a6ba7f995e"
        },
        {
          "alg": "SHA-256",
          "content": "8ede9175db42a518440c90af3b71e69fb5e5a203dc1ebc364b7296a841c588d9"
        },
        {
          "alg": "MD5",
          "content": "5cb9faa17a29a99dc942ea883258f362"
        }
      ]
    },
    {
      "bom-ref": "d158a875-d6dc-46c8-98c9-ce5b4b56b18b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcurl.so.4.8.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5391b0de4f5e16c38aab0a4c2fe42e63bad6f793"
        },
        {
          "alg": "SHA-256",
          "content": "c7d93c5b1438dc33772c8d8a613894cc2989fdb9b000502aa7be63af5d9c2ec2"
        },
        {
          "alg": "MD5",
          "content": "7e05260d95e70cf6f392ef74a8f72eab"
        }
      ]
    },
    {
      "bom-ref": "d16a17fd-a7f1-48b1-82a3-4de85fae0e64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_regex.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e252dd6a22c1bc9f30fc706bcda0f4250a6d2d1f"
        },
        {
          "alg": "SHA-256",
          "content": "4fe94816b558ed536e5a4c987f05072318d7ca605787bc89fa1046fb9584370c"
        },
        {
          "alg": "MD5",
          "content": "d22d5040638b5037711f219775e86243"
        }
      ]
    },
    {
      "bom-ref": "d198402e-9b02-4322-84a3-8cf5f8a768f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/setfont",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d1b5f4ff-e2b3-4d86-a408-4c7ff9e32e6b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b0df37e4a366ad1df9d398f6438c26208b58b26b"
        },
        {
          "alg": "SHA-256",
          "content": "e3c473179cf48dd25152339623fcc7bc3cf80433c909954034cda7bdf581d4f2"
        },
        {
          "alg": "MD5",
          "content": "8f81922ec06563f4085b2fb76574ba76"
        }
      ]
    },
    {
      "bom-ref": "d1db76c2-8678-42af-a8ab-c8a3e4e323fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mdev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d1f29803-6f28-43c4-b875-17f45b4364d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_fan.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4dd02c29a25a4048b6b461460586e8e80011ea7e"
        },
        {
          "alg": "SHA-256",
          "content": "82fa7da902892c8c4225bc1a77bf7ab9055385ed9ae323eaa2f92f80573b8c19"
        },
        {
          "alg": "MD5",
          "content": "073b417b17b708a59fc63b99a4ba66b7"
        }
      ]
    },
    {
      "bom-ref": "d220c64f-e38c-4249-8264-4c6b723ee3cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/RADIUS_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed7f296dc7f7c00d3aeb0958fe0bc8d043e53ef2"
        },
        {
          "alg": "SHA-256",
          "content": "efc4b4d4125f599a14f5ba7dc561053a6a360e704a2dc07cadc20603d61bb304"
        },
        {
          "alg": "MD5",
          "content": "2d53bc0139e782cc1b974f8e9b10bee3"
        }
      ]
    },
    {
      "bom-ref": "d22d7094-04da-4cfd-b407-ca72d411e93e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ps",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d238525f-3ce2-40bd-bfdd-dce0a6e6e5d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/BMCInfo.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf73d91725d8bc85a24afa4ea8d9c1b2041ebf6f"
        },
        {
          "alg": "SHA-256",
          "content": "20c4a9f1832f7c9703ec20ee256926f1ba22d8711d5e6c4dbcd3bbf58137f916"
        },
        {
          "alg": "MD5",
          "content": "fbb2044d64e6229bcbc579d70c4394c7"
        }
      ]
    },
    {
      "bom-ref": "d2389205-cbbc-4a96-bee9-8c335e8a7a50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e997ef2fe3e70cf09bff164b27f77e85bdf494fa"
        },
        {
          "alg": "SHA-256",
          "content": "83be203ba1d903ea64595e13cb1a2c13deedc6e05927507d1c008543df4710f4"
        },
        {
          "alg": "MD5",
          "content": "ef7db7887916338673ad165d85478bdc"
        }
      ]
    },
    {
      "bom-ref": "d23fd5e3-aa8a-4aea-9b15-6aaa0d0255ee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ssh-keygen",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5a232990894e810706f68c2d14727ab9844fe0a0"
        },
        {
          "alg": "SHA-256",
          "content": "30bbb7135787f184bab7f4bae5487f6b2d7d6400439bd5fcaab1fc02fcad1d28"
        },
        {
          "alg": "MD5",
          "content": "e5506a3889278442163756683e216af4"
        }
      ]
    },
    {
      "bom-ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/kill",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d2413045-6327-4651-ace0-c9c199ba736f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcurl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5391b0de4f5e16c38aab0a4c2fe42e63bad6f793"
        },
        {
          "alg": "SHA-256",
          "content": "c7d93c5b1438dc33772c8d8a613894cc2989fdb9b000502aa7be63af5d9c2ec2"
        },
        {
          "alg": "MD5",
          "content": "7e05260d95e70cf6f392ef74a8f72eab"
        }
      ]
    },
    {
      "bom-ref": "d2707557-0490-4b5e-9044-ca0287125a73",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/user_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d4a11cc523f011675471c5202a89a3a7b214b27"
        },
        {
          "alg": "SHA-256",
          "content": "2d1a6ed2e22accd3bd4be2e081670098c698f4929064f6298d4be45e6118bca6"
        },
        {
          "alg": "MD5",
          "content": "2fcfaa0e39d5ce6bb655aa7521f558c5"
        }
      ]
    },
    {
      "bom-ref": "d279cdc1-dbd3-4184-a8a2-7d75aea5e557",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_coroutine.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5425e5134484dbd593bcbc359999d333ef48b3f7"
        },
        {
          "alg": "SHA-256",
          "content": "a255272c6c134ea90dca95d160528d9a91ff709419dd050db2755055edd092e0"
        },
        {
          "alg": "MD5",
          "content": "1f20ff54bd20c2894edd0d0d0b7f2075"
        }
      ]
    },
    {
      "bom-ref": "d28f9790-0647-47ce-956b-1a17e298d2c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcPowerExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3cb82e5eae9e2f02a50eaeea4f93a58a64171271"
        },
        {
          "alg": "SHA-256",
          "content": "58da490065d6f6d0294fff12d56f635ab18992a60c46cada0fd1d116afc95818"
        },
        {
          "alg": "MD5",
          "content": "4becc444199e7e3b46b75a63c5a25e40"
        }
      ]
    },
    {
      "bom-ref": "d2a1ed32-cd1f-4f5f-b95e-dbcde6b4f263",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/login_user_not_exist.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e65fca6ca0c1eab1acfaefbbc1bfcdf8e7564600"
        },
        {
          "alg": "SHA-256",
          "content": "f40350e572b1c02f39ed94df6efa2482d575542c49c57a853afe0aec097f26e3"
        },
        {
          "alg": "MD5",
          "content": "2b6f76a08d5a33b99ff0114360fc8726"
        }
      ]
    },
    {
      "bom-ref": "d2c7bee5-7ef9-4188-a8a0-679cf36a4ce3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/slit_bmc_pcie.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d974874ee56773b5805d7a3615266eb73a8a8547"
        },
        {
          "alg": "SHA-256",
          "content": "aa46c44e10644e7b6fed99197b060ada1c66c0f8801ded152b20b456c5330a03"
        },
        {
          "alg": "MD5",
          "content": "1121cb92504c8a9a252c17f38e1b24ea"
        }
      ]
    },
    {
      "bom-ref": "d2cea02b-5355-448f-b578-51428ff0c860",
      "type": "file",
      "name": "./48136192-49020928.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b2e8a4272b17a105ba1a3952bfe460bdafd25d54"
        },
        {
          "alg": "SHA-256",
          "content": "95f36dc13d21953d4d17513d7871f84dcd34dffa1c8d7336f48208633ad80121"
        },
        {
          "alg": "MD5",
          "content": "cdee1925cbf39f2d54595ae02d847f54"
        }
      ]
    },
    {
      "bom-ref": "d2cfb273-326b-48af-8434-c4dc79659376",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/lldpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c37b9a1375c73bbf446ee142e3d737589dedf36a"
        },
        {
          "alg": "SHA-256",
          "content": "d380723bb9151e4d85dbdf45b63a8aefc8a9d5367e5e44be85394d74a892a4c7"
        },
        {
          "alg": "MD5",
          "content": "3d24a8f967a0d32ad7314e5dd3ac21a1"
        }
      ]
    },
    {
      "bom-ref": "d2da9aca-516d-4426-88b5-a40571916cee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsasl2.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98519f0656494efe5eae5558e34f34c960dcbdaf"
        },
        {
          "alg": "SHA-256",
          "content": "698b328988afcf64d05ae6856408861ea5e0c7c35df0164785e05103995cb6f6"
        },
        {
          "alg": "MD5",
          "content": "bd3add5bcadd302345c35f0febd82bac"
        }
      ]
    },
    {
      "bom-ref": "d32a4901-813f-448c-8fc7-5a6d35fcfe1f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/Syslog_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97b71c837d7e9988262705ace2cebc0d6f164cf4"
        },
        {
          "alg": "SHA-256",
          "content": "30f03187e6f8638265d89fda248f0543acde2dfbcefd6690caac9b448ad5d9ae"
        },
        {
          "alg": "MD5",
          "content": "a755a78ca8751f4269b8d75af0857b01"
        }
      ]
    },
    {
      "bom-ref": "d341cabf-9b8d-458f-a2e1-7f5d57978769",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/syslog.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c5fc005bcbed8c2c788d306fcba1bcfbea31e0be"
        },
        {
          "alg": "SHA-256",
          "content": "848fd4bda41fad14aaca41d42ab16f46bff136e52d8befec5b5041a006ab753e"
        },
        {
          "alg": "MD5",
          "content": "bc116faba6b7df947eecc16784200308"
        }
      ]
    },
    {
      "bom-ref": "d34ab30e-ab9d-444a-9f0b-b72b0e472a41",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_rewrite.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30b6b639383a97e7212d04040c6f2719ef17c336"
        },
        {
          "alg": "SHA-256",
          "content": "0142769a7d25b1f716c4b646e625bd11e53b21ab9cd9bf8ad7bbd4cecd97929e"
        },
        {
          "alg": "MD5",
          "content": "2301f884bab9526d6d0575f79c9b3bed"
        }
      ]
    },
    {
      "bom-ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/comm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d3656cbb-40ca-4b91-90fc-26bc2774d5a3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/platform_jbod.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1c2b382ebcee1f07f16dde14b6de1d1d1dfbe88e"
        },
        {
          "alg": "SHA-256",
          "content": "e75b47729cd4c5f449d43785c1e5056f00e156ecd817bd3eb24801ed9ca0c9ad"
        },
        {
          "alg": "MD5",
          "content": "2262b29793d2132b9e22baa3bc42db5c"
        }
      ]
    },
    {
      "bom-ref": "d366c2ce-f424-4724-b915-668c404e6234",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/shuf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d36e9c82-1356-4dfb-a21c-0010945ed760",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/setfont",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d3711f3c-bc02-4df8-8080-78e7e117c9cd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip4tc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d37ba5aeb35646ffa7efb0718c774ab7ca9903b"
        },
        {
          "alg": "SHA-256",
          "content": "92e7ccf64c5b3bee23c7034202a4d9b0eaca78e2f98b9bebb596f53d892f59bd"
        },
        {
          "alg": "MD5",
          "content": "6d3ab2b03ea9d69453f318bee6b262ad"
        }
      ]
    },
    {
      "bom-ref": "d38e3989-6d6c-471c-81ad-ca84861b2cab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpagent.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6a582838225a6278c725c17458f947fded16131"
        },
        {
          "alg": "SHA-256",
          "content": "f688485946d8e52da04495c2d0f76bfada58ff0491d40000d1d101bfec03850a"
        },
        {
          "alg": "MD5",
          "content": "f74367d541834ca01c5cceb1fa27e063"
        }
      ]
    },
    {
      "bom-ref": "d39c9279-a2e2-4958-9e98-8dde0d3ce886",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logo-firefox.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b823145f23a95355ff12d4319b831e013e0e8cd3"
        },
        {
          "alg": "SHA-256",
          "content": "8c2721d8dc6572753d195fee10d4b192b29e9536be643653ca3ad89f6906f715"
        },
        {
          "alg": "MD5",
          "content": "b8de11cc7910f0b2fa379344ddeec6b1"
        }
      ]
    },
    {
      "bom-ref": "d3a3d64f-ff3f-4a0f-8cd9-5d3fa354b35a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "919b703cf604d996d2946e223027dbe66dc8eaa2"
        },
        {
          "alg": "SHA-256",
          "content": "26b8a939900eb6a38481265697c4734ba5229d3909c61f5fe08e9f679831a971"
        },
        {
          "alg": "MD5",
          "content": "5990551555f447137d7b5a884d713b6e"
        }
      ]
    },
    {
      "bom-ref": "d3b6b4f7-25e7-49b0-90b1-78e765bdd1bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/logout.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc3703e067ed13c719e93e3d9ab3bea6a0c80666"
        },
        {
          "alg": "SHA-256",
          "content": "b1d108e65b4c94867721a02bfda2e6a30a622d544f8513aea6ccb44b1d08f942"
        },
        {
          "alg": "MD5",
          "content": "f3ab7e6662f4a0390ba97b008a9466a4"
        }
      ]
    },
    {
      "bom-ref": "d3bfe37c-ea10-446a-9564-115a84479a6e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/warning.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cda65e9b4b76a5220dbcbf4e4d9097d572d56c15"
        },
        {
          "alg": "SHA-256",
          "content": "81d6c30ec8d5b000568d9f89b564617e0164f2bfadca6bf0ca976f616ad30ae2"
        },
        {
          "alg": "MD5",
          "content": "497eb25e97e7f456b348a17c5bc738f8"
        }
      ]
    },
    {
      "bom-ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/linux64",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d3f735b8-5a7f-4393-9366-f7ea98d4295c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea4e1d8dd5cbd506f07ca5d62dc0e18041f10adc"
        },
        {
          "alg": "SHA-256",
          "content": "75f9bddec8d88a47e3a3db21bb905a6e20597675f556ba2aaa5cb8dd2734d854"
        },
        {
          "alg": "MD5",
          "content": "96136786c2520483647af2725c92d779"
        }
      ]
    },
    {
      "bom-ref": "d3f85aed-275e-4c2e-a2c7-13cfb423b5d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/smtpnotifier",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a9d72cc46fd0e010a41f8216338d77777120e769"
        },
        {
          "alg": "SHA-256",
          "content": "60f70f548231af5f7d034bfce4e1238aa940a6af7961820ab36c6ef462513932"
        },
        {
          "alg": "MD5",
          "content": "763133f0a907735722915372697bd579"
        }
      ]
    },
    {
      "bom-ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cpio",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d407cb54-515e-419f-b2d8-a0a00d4cddd6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libthread_db.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "96dae3a511463cdbef4c6724e6456023357504c4"
        },
        {
          "alg": "SHA-256",
          "content": "63c1705f97925202b5b32d2ff232aa9941527591259a8ab2fff6108ad66d643b"
        },
        {
          "alg": "MD5",
          "content": "caa3987a593c137e167addc24360aa21"
        }
      ]
    },
    {
      "bom-ref": "d407e95f-a07f-4110-bbab-77495f27ae95",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_16_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "80688c30788cb8f40b28e335b80e2b6bbb4ba76b"
        },
        {
          "alg": "SHA-256",
          "content": "ac53d5c1e5bc3ae42b35ed08ac081363bd42c9d1a88df1d954376e367599482f"
        },
        {
          "alg": "MD5",
          "content": "7ec3dee311a1c13e999f62c997d5c9c7"
        }
      ]
    },
    {
      "bom-ref": "d42b2c25-7e89-4ee5-9fc8-3d69df53ee85",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libscram.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05846d6ce7b0adf863cf226acf203a14a0f46fae"
        },
        {
          "alg": "SHA-256",
          "content": "0a60aa782cbc7b4a26bbc0884b7660f2430844608e3f356c99aa20e4193683da"
        },
        {
          "alg": "MD5",
          "content": "0357e1497a56fc4a7fbbcc9bf9f5ae2d"
        }
      ]
    },
    {
      "bom-ref": "d438ffb7-2a32-4019-a78a-73128da4e7d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5d543a99e5763d69a9e08f143027103ca864d348"
        },
        {
          "alg": "SHA-256",
          "content": "4a785dd828268e2c32bdc29461793255991bdcf4f12c3e4bc80f1dad8fe256c0"
        },
        {
          "alg": "MD5",
          "content": "8bcfa033ec5bd630153973229eec7d79"
        }
      ]
    },
    {
      "bom-ref": "d442402e-cab3-4a37-a713-733d7344a48f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/smemcap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d444afab-76a6-4424-b12f-d441babbacd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/rx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d44d7ee4-d115-48b7-8bad-790ec9ae7f4b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libzstd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f49b92e2d483a59646a741a5b9340d63e93ee1f"
        },
        {
          "alg": "SHA-256",
          "content": "c495d603579c6a203727a66bf4f2af4789ee8815d4635c22bfb2e2e68ad68142"
        },
        {
          "alg": "MD5",
          "content": "4302560a4ea0a94a90150adf74e25e49"
        }
      ]
    },
    {
      "bom-ref": "d455f6f6-7d86-4a38-9434-09cd10598a18",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c9ea012e2c9846020dc165c40ddd38404bfb88f2"
        },
        {
          "alg": "SHA-256",
          "content": "11caed4c45df99c85aafa649131154353cc746fa682e1bb96f8514c9e0b35e8a"
        },
        {
          "alg": "MD5",
          "content": "6f7b63e38ad92e2ee3ab8064206b65f7"
        }
      ]
    },
    {
      "bom-ref": "d4615f4a-f6c7-4f34-8196-664559ce590b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnl-3.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e6a207c7138d771357a991e8d9fbc0a93fefc80"
        },
        {
          "alg": "SHA-256",
          "content": "cc88216cd17a65c6ca6721817f6ac6130ee194eec0d2da45bac902e7eb5f2e04"
        },
        {
          "alg": "MD5",
          "content": "d86be3332539ffe888e994e49ea65c28"
        }
      ]
    },
    {
      "bom-ref": "d46367b2-d1e4-4dfa-bb0f-5973e8d76095",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_systemd.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4cecd204caa35a5d325c4d4f65abf5ee2181bdd7"
        },
        {
          "alg": "SHA-256",
          "content": "4411632275ae52af3aed1cef24a500c75908804d04de96a10cfa73059905a8ed"
        },
        {
          "alg": "MD5",
          "content": "a57ada3f3f9e11a66d2687a6b44b447f"
        }
      ]
    },
    {
      "bom-ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/chpst",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d472c908-051c-4abf-a733-e07417c40176",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libverto.so.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c67a272c7c6d06a90e27160a6a3815e802a5492"
        },
        {
          "alg": "SHA-256",
          "content": "fbf81609dc68852e0493bf6ec058670bdeaded13e5aa4f5a1e2a6dd3f9c90009"
        },
        {
          "alg": "MD5",
          "content": "f5c51d1a2457511280b3148ebf476115"
        }
      ]
    },
    {
      "bom-ref": "d4766063-0e62-4c2b-8e99-b3a119d99a80",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_vm.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f557265380475a794c0261d0eac467568cd7a185"
        },
        {
          "alg": "SHA-256",
          "content": "1a1f75281acef62040484cd5d374599b7f324c3bb6b68d3e9789c534e80d9cdf"
        },
        {
          "alg": "MD5",
          "content": "5ebdb5a9f808d9555ac79965c6ea5e1a"
        }
      ]
    },
    {
      "bom-ref": "d47c3ab7-b310-4bf7-b4c4-2036a27b80e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/config.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e262764cca8f2ebadaaf10e51d8b8fc4430deef4"
        },
        {
          "alg": "SHA-256",
          "content": "e96c5d520cb5e7cd76a0b43a9010c0309bb6c95a019698cc3d8deb392eb24446"
        },
        {
          "alg": "MD5",
          "content": "2d9a0bdb8d6ddfcab3d96f089063adc4"
        }
      ]
    },
    {
      "bom-ref": "d49cc88b-8ec3-4ce4-a0ec-582e744fd17c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt_mit.so.12.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "d4b04c49-a9c0-4adf-b86b-64e2d33dab75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcAccountService.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0202fedc3f2c1701a2e70f7c3cadbf2906079c7b"
        },
        {
          "alg": "SHA-256",
          "content": "b18edc64bf60067e6fded03748a90f8a3e8f6e092e7b2e9f8df7dd98a9299652"
        },
        {
          "alg": "MD5",
          "content": "f1401111f7eab4210f804ce3932ab4c3"
        }
      ]
    },
    {
      "bom-ref": "d4b64176-d822-4664-beee-357c092940a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IPAccessControl.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ac24460c38884683691cc35ad3a4b8c8cc852efb"
        },
        {
          "alg": "SHA-256",
          "content": "baa9a1a8901e3d916937e8f61ecd065ba4bf90cc397496c73ce8d84788a80381"
        },
        {
          "alg": "MD5",
          "content": "b181c757bab48f4c53c6f3c10da554dc"
        }
      ]
    },
    {
      "bom-ref": "151116e8-287e-49b9-99aa-e2285c18a15b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20f24b5ef2ba3cf659393193017b344912b03179"
        },
        {
          "alg": "SHA-256",
          "content": "e2e436d433bcc4064e4ee26e324cdcb79953d0c65fdc566f34598f211ed18301"
        },
        {
          "alg": "MD5",
          "content": "a80a652fbacab7f3b3517fb2c5a99361"
        }
      ]
    },
    {
      "bom-ref": "1524a564-329c-4678-8eff-48d104fd67d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderSf.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7a8c62882145da1620f2ded1c36bfae118fc3f12"
        },
        {
          "alg": "SHA-256",
          "content": "a49bf7572a9ae2d30dea803c7cda7f1f6c92a6cefe606d1969cf7728976d6a40"
        },
        {
          "alg": "MD5",
          "content": "57573c0659db821be97dead1f691ce46"
        }
      ]
    },
    {
      "bom-ref": "152d4b35-3a2c-4587-9b32-8e45db51f504",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_system.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "988f530915c7aa8c39cf7b15afd139e6b4f7bfb1"
        },
        {
          "alg": "SHA-256",
          "content": "2f15c977073fe3df053cbe4cc5a59bc9dd0602069e86c1a1a536a233c9370eff"
        },
        {
          "alg": "MD5",
          "content": "ae6068c994b40c16d70780fd4ffcfe2d"
        }
      ]
    },
    {
      "bom-ref": "15316ca3-6a6a-43c6-83cb-bae57f8bb775",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/lang/dictionary.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "776366145dece9002e2b095c178fe032db789b51"
        },
        {
          "alg": "SHA-256",
          "content": "c5858051b2b820c18e949cb9a8b401b7c019af4632a14ca04f307b0cba75b9aa"
        },
        {
          "alg": "MD5",
          "content": "468c9ed0b61d10a60973fcf3bc1b48a6"
        }
      ]
    },
    {
      "bom-ref": "155fdb98-729b-4f7e-8614-eeeb475953d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit-bmc.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8aa1c84c0a933199644edbb3888723acff374333"
        },
        {
          "alg": "SHA-256",
          "content": "2afd30b75566f50cc478e13caf314b176d80ab10df83b18d482df0d95ed08f53"
        },
        {
          "alg": "MD5",
          "content": "1c4d5e2e456285c1b2def2d59f4309e3"
        }
      ]
    },
    {
      "bom-ref": "1578a136-d18f-4a04-b403-cbcebaab1510",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_multinode.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fb5eb64c68d64bc39d54cefa7e89fbd7261e7439"
        },
        {
          "alg": "SHA-256",
          "content": "4df129ff4b0c09bab81589c0577b42bd11f0b340d9b822a9f8eda88ed957c9ce"
        },
        {
          "alg": "MD5",
          "content": "ae0f241033c4986c157e16d522436b42"
        }
      ]
    },
    {
      "bom-ref": "15b97194-a760-4f08-97b0-1f57bfb36d27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/factor",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "15caa398-a6d1-4cd2-ac49-58672f0cafd4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/power.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47571872db0cf8b457c19b09d1bf8d843dd59dea"
        },
        {
          "alg": "SHA-256",
          "content": "1e3505a00aee51a4b5ed9ba7a08017e32dc51ad7ff23c8cd98c1b5144dc08d1c"
        },
        {
          "alg": "MD5",
          "content": "7c0891f166372a33f986830f497da181"
        }
      ]
    },
    {
      "bom-ref": "15cfe643-7aa0-49fc-a27e-3e8a1f7d736c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lzcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "15d725bf-6d9a-493d-9f47-2fdf3d2260c6",
      "type": "file",
      "name": "./5274341-6488064.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "29e31acf50aedf18b53bfe8c068fa7a8b630e847"
        },
        {
          "alg": "SHA-256",
          "content": "4da457dd2c71a29051a1abd068d224603cf4289fec99ac63c2f0ebdfd4db32f2"
        },
        {
          "alg": "MD5",
          "content": "210a6ade98b317d9044e786a87c31f01"
        }
      ]
    },
    {
      "bom-ref": "15dc11de-be51-4f38-84ee-a6ea15f14443",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/loading.gif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd7458985d6aa0bbfd7b3477069e1bc1ce5904a7"
        },
        {
          "alg": "SHA-256",
          "content": "8bb791028002dfaf70c8f9727e5a5149ece8c11f787e4af5d7b242300913e6a8"
        },
        {
          "alg": "MD5",
          "content": "982ff09e90781d250d12d54842709661"
        }
      ]
    },
    {
      "bom-ref": "16005a53-267e-4dd2-9785-2553fb756387",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha512sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "160bd697-a285-498c-a5bb-5a22c784b734",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt_mit.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "161383aa-dbe6-4d47-bfe6-f0e9f51cdec8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/commonStyle.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e197d3727e6efdea241c9d5a966faac99537fab"
        },
        {
          "alg": "SHA-256",
          "content": "246c4101f575b996ccfc75326b75ff06911fca2c52551c659fe03a548b68846d"
        },
        {
          "alg": "MD5",
          "content": "98039a8390cdeebc5f7e9b0f2511203c"
        }
      ]
    },
    {
      "bom-ref": "161faece-43d7-46da-9bf0-aa09ebf89912",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "92157c6121c6ec70b9a51aa7b71c96dcf1df7a85"
        },
        {
          "alg": "SHA-256",
          "content": "dc1eaea23bc2b6d20ca2564cdd9b11f6326d4b111b94c058ea881a61d4222eaa"
        },
        {
          "alg": "MD5",
          "content": "dd94d7ea161b6a7cd0f12d42b0299717"
        }
      ]
    },
    {
      "bom-ref": "0d820543-237d-4819-a9d5-828987a295c4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ec_flash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "29a54c446d29ff003cd02b03dd2570e8c59ca065"
        },
        {
          "alg": "SHA-256",
          "content": "612d67df39daa8cdf5b2b6797e43bb76592e42a19da5cc47e9503dc21d2b53d0"
        },
        {
          "alg": "MD5",
          "content": "ad3b0eec775b2885a52a2f58e4259df9"
        }
      ]
    },
    {
      "bom-ref": "16205d88-af71-4c4f-94ab-c4b66d9a6b40",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dpkg-deb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0d915fe9-2915-46a2-82f5-a093ee8169b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcPowerExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f0cb2b7ba9086127a5772a22cd6705f5a397ee40"
        },
        {
          "alg": "SHA-256",
          "content": "473f5f9297a8835a4a74e43861dff80bec97ef8553e37aef1360585cb945466c"
        },
        {
          "alg": "MD5",
          "content": "d53eb1eea25c9091be93ac8e050c7d92"
        }
      ]
    },
    {
      "bom-ref": "0db82a39-1450-4c86-9fe5-9bef20f41e30",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SupermicroBMCConfig.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ad1ea172802c07fd86eaa92099dcad5cc938354"
        },
        {
          "alg": "SHA-256",
          "content": "5cd029e259465454a29127e3bd1f4834fabe825a8d8c3def441a40e196f5bc08"
        },
        {
          "alg": "MD5",
          "content": "488df27248e3d80754ee72156e89b79e"
        }
      ]
    },
    {
      "bom-ref": "0dbdd267-7ed2-48fc-9037-e92473cf950d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1050689bfbb199eb594e9faaa963da50484eea87"
        },
        {
          "alg": "SHA-256",
          "content": "0c7c37d926035f41f5c83adb7e5aea073746047ba055d77bf12796495fe20d88"
        },
        {
          "alg": "MD5",
          "content": "bb96b4b384b60a62e53b66ebe4caf6d2"
        }
      ]
    },
    {
      "bom-ref": "0de9d288-2ce0-47b1-bd2e-c3637a72a4ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/closeEye.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5063c8fbf42715f1f9fbbf4b1f742bb0cd6a3d12"
        },
        {
          "alg": "SHA-256",
          "content": "e40dfaa6acabf9fff63de47f60ce21596026f33843d417c659662460d1c9bb9f"
        },
        {
          "alg": "MD5",
          "content": "3321cc6cd0c12a633f5c8cfbd852baf9"
        }
      ]
    },
    {
      "bom-ref": "0e29126d-2009-43c1-890b-63813c0c23f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/mesg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0e42a0c4-d8ce-4efa-a6d7-c61a2bb5eb08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/10fw_env.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbbe9db906fee4dd82ba55c4903b19edcf6d63dc"
        },
        {
          "alg": "SHA-256",
          "content": "de9749e19f40060454d3e725a9c7953a94c5faad6b396dd38c5dca136cf0fa2d"
        },
        {
          "alg": "MD5",
          "content": "272170703a6a5d455fea86383272f974"
        }
      ]
    },
    {
      "bom-ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dmesg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0e7a4ace-cc77-48ce-8fc0-890e8865c1e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/define_var.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "595eae5b6035720fa93ae5a341dd7592e0784500"
        },
        {
          "alg": "SHA-256",
          "content": "62cc64056f0e712ec38790cc1cc317eff230d2118bd489130986d9246bd1202d"
        },
        {
          "alg": "MD5",
          "content": "fd0c45ee2adf996e6327674b0c2d2ba8"
        }
      ]
    },
    {
      "bom-ref": "0e9329b0-2ddd-46af-aaa4-13b2aab2a256",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IPMIConfig.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d3991f82d611713927a0e5cc9b88b9732c9042fc"
        },
        {
          "alg": "SHA-256",
          "content": "abc32b038a14881dbbbc0bbbb454b048cf8036e6eb7fd077a141b4236a306a98"
        },
        {
          "alg": "MD5",
          "content": "d976a104bac997392116795ca29f4f6b"
        }
      ]
    },
    {
      "bom-ref": "0ed55727-0b9b-4e8a-99e7-26c5d5eccb79",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/openEye.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "818df7f23d7a29dc7b033ddc838092d019501ac1"
        },
        {
          "alg": "SHA-256",
          "content": "2acecf335caee655088725ccbd0e73e899ee70212ac97ff0464e1e33fce70a81"
        },
        {
          "alg": "MD5",
          "content": "dda2ba7b1140cc42a0e6624c0e47c8a9"
        }
      ]
    },
    {
      "bom-ref": "0edc95e9-7f23-41f4-963a-a29841196e71",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/findfs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/rdate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0eec4d33-294a-43df-a39c-01015be40ee3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/ResourceEvent.1.3.0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "15f00d21f8b4e5c6e76121793d70377b0818d022"
        },
        {
          "alg": "SHA-256",
          "content": "8e4564de5ce04626664bb7851b09bfe5a80a10a281ea32b9955e9909c3693cc4"
        },
        {
          "alg": "MD5",
          "content": "460791ab65f1d9dd0acebce53d7d07fb"
        }
      ]
    },
    {
      "bom-ref": "0eefd799-0d3e-45a3-bb51-ec1f15cf14bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcElementCapabilitiesProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b61a9de4c41005f3942768e5dd2db4f10010460e"
        },
        {
          "alg": "SHA-256",
          "content": "2ddfafb5f10694b6cfe8e42418d00b8b10116dc2f7600b8616455270d44d578c"
        },
        {
          "alg": "MD5",
          "content": "a1927b2ae8be3277f2a0aeabb217e2cb"
        }
      ]
    },
    {
      "bom-ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/envuidgid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0f1cf6f8-9ab8-4bea-9ef9-f4bb1f9d4766",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_ihdt.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3ab8c7e007ef2fad07626e800869011aec0aadd0"
        },
        {
          "alg": "SHA-256",
          "content": "ecfe738681c118f0355a5b7fcd1ed9bda323817596ca55980b4ec0b953b90f52"
        },
        {
          "alg": "MD5",
          "content": "4dc6ebd3d79baf9adb0124d4e1462c1e"
        }
      ]
    },
    {
      "bom-ref": "0f281d86-cc41-40a6-9a0d-34a739079a33",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/modprobe",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0f2a3a5b-05af-4b9c-bd41-e8c006cb8316",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmTriggerCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "601fadfcfad40c2c9763a6b42a69c3da8ee0f22a"
        },
        {
          "alg": "SHA-256",
          "content": "bcd1464c9fa1273a567eb5a887942cc01d8419a62f679e1dea4de5b22c448d9d"
        },
        {
          "alg": "MD5",
          "content": "f70cc6a646e9132bd506dec70bddfa19"
        }
      ]
    },
    {
      "bom-ref": "0f2a4338-61af-473a-89d6-90d1f9578d6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/on.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a01bf4b7a4e23cfb09384f874490a1f1e8a036a3"
        },
        {
          "alg": "SHA-256",
          "content": "97e861334d96bd0e3090d49b84628232668bb266ea44d3fde2d11d5114f22d99"
        },
        {
          "alg": "MD5",
          "content": "53bb6d8c203fbc4745dd915a3aed0cdd"
        }
      ]
    },
    {
      "bom-ref": "0f35e693-fcb8-4217-b82c-eeac53641dfc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/gconv/gconv-modules",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e9555b9ead05fa633fd7adefcde5ec9985059500"
        },
        {
          "alg": "SHA-256",
          "content": "166f7c79412e72c0fe2e713fcabc66eda5ea47b35d006d06a77cc6ebc5d4cac1"
        },
        {
          "alg": "MD5",
          "content": "2db64225cd37499aff9839e9f5f11a00"
        }
      ]
    },
    {
      "bom-ref": "0f374874-7ac6-45f3-8435-50a7c39e5e2d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcTaskExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7887f2d0bf66e6d97318092d509ec05fcb860c32"
        },
        {
          "alg": "SHA-256",
          "content": "9b7cf22531f0723f1fd06e43d41b35616668d9a4c6b1c3bfc59fdfeaaccc70bb"
        },
        {
          "alg": "MD5",
          "content": "fcc3923f080050669d3f789ce3734701"
        }
      ]
    },
    {
      "bom-ref": "0f4cc1da-b0aa-4fcc-8cdb-0a025eb06323",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/CupsService.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a31883df925a9ba70c3e5b0e92261d28a6e0823"
        },
        {
          "alg": "SHA-256",
          "content": "c1d8e8047414c2fc220eec3a8af316324dfb4451622a3ac785d19cbf70051a15"
        },
        {
          "alg": "MD5",
          "content": "6108bc33dae887c87f7d70bffe69463c"
        }
      ]
    },
    {
      "bom-ref": "0f5e089b-d298-4189-8394-b63c218c55af",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed_extract/0-8372640.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7600aa82753dcecf6d2d1d1872e686a0d3eafcd0"
        },
        {
          "alg": "SHA-256",
          "content": "86a4e0e42c525eb3e7953f4eb6ccc3839281b9824d7a1cdc6877b969efd652af"
        },
        {
          "alg": "MD5",
          "content": "c5bfc55af36e204e75836a17c1c3fef5"
        }
      ]
    },
    {
      "bom-ref": "0f624251-14df-45c1-afae-ab1ded7fecb1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv_mit.so.12.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "0f9837e1-982e-4c50-b54a-4a1246e96893",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_alert_smtp.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8866bd5b3007035bcacdd025cfb3d30f823bef8a"
        },
        {
          "alg": "SHA-256",
          "content": "7661bba585c3d1a10c87ea7b6a1437f1406b88e632174069863493045822a287"
        },
        {
          "alg": "MD5",
          "content": "b1b28e71e356c7e17df2ae2707ad0b36"
        }
      ]
    },
    {
      "bom-ref": "0f9b3731-296e-4f62-ac8a-27b4a4125eca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/bios_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "064c678ed183f83acc53c8c6878277850b5181a4"
        },
        {
          "alg": "SHA-256",
          "content": "0f9401c9d6188c810b1b60ee737d28a1655fdc9ed60f335d9b47c15e078372f5"
        },
        {
          "alg": "MD5",
          "content": "a166db9fcc51234962c0313c9d7dd22e"
        }
      ]
    },
    {
      "bom-ref": "0fa15fd4-a7a2-4e13-9df0-0453ce024ca7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/ikvmHelpPage.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "418e4afc40567d336844b808a98c5af7a4329306"
        },
        {
          "alg": "SHA-256",
          "content": "e495546478ef257de5bbcdc532f763ebdddff6502613c68189ca8743edde9274"
        },
        {
          "alg": "MD5",
          "content": "e20e1d7c5c5ad21751755d8734a5468a"
        }
      ]
    },
    {
      "bom-ref": "100bd2cf-7812-4f60-b79d-ed9b1a4c2a08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_16_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65fb6ad80b985ca1921ed7089eeac9df74f24038"
        },
        {
          "alg": "SHA-256",
          "content": "fa76bcb95cf58dd101308a1eb21b8ab3fa758fa8e0e008cbf51c1d49970665d8"
        },
        {
          "alg": "MD5",
          "content": "ecc2ad87892c497f5c44f0a8b0418854"
        }
      ]
    },
    {
      "bom-ref": "101b42fd-f86c-4c4a-bf9a-35764b06d7a1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0069134f35742fe806c6851c952f3719ff55cbb"
        },
        {
          "alg": "SHA-256",
          "content": "79454442804c90493f9c873dbed4369c0410d6b376ccedc445359db2048ad7b1"
        },
        {
          "alg": "MD5",
          "content": "275a5d1da1b97840e5e9b2315e5090b5"
        }
      ]
    },
    {
      "bom-ref": "1061aebb-69e2-4b52-8626-80596afa48da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubiupdatevol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "106b5736-663c-4853-89db-8002f8b37960",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_random.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b10500da2dbd3dff7290e17766db58b9466a02d"
        },
        {
          "alg": "SHA-256",
          "content": "83151a8e89bdcf402e56659ea468c314eceb5a1ae61ae54d7233ac19544f6ad9"
        },
        {
          "alg": "MD5",
          "content": "2ad8ce483050cbc070a18805a0306e0a"
        }
      ]
    },
    {
      "bom-ref": "107871fc-5966-4531-a9b2-19d77cd8c2b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dbus-1/system.d/smc.ipmi.vroc.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b896b8dc8d58a3c3631367a862817ae4790dee28"
        },
        {
          "alg": "SHA-256",
          "content": "4b638299259ffd5487b68149568e3b08c462dba0dde06e3e3fe97a36704ad484"
        },
        {
          "alg": "MD5",
          "content": "01221ea51adf35c057fd61f28babe41b"
        }
      ]
    },
    {
      "bom-ref": "10848abe-a997-4819-afee-3cbaf3ea95dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamStatus_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "addf0c7ce4f12e21bbf094e335eedd3d247ce5a0"
        },
        {
          "alg": "SHA-256",
          "content": "45302d210c4deb17368387dc1b404c1c3da0f996607897556ca06f74901bb594"
        },
        {
          "alg": "MD5",
          "content": "ac1e332cf8280fd80b55be7ca3c2a2b1"
        }
      ]
    },
    {
      "bom-ref": "1089922b-52a7-40f9-aef0-10656549eb35",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubidetach",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "108cae1e-21a4-40e7-937d-32ef8e944da0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcAttributeRegistry.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "71575b681d36cb3c20831684b89bc9dd1b91fb84"
        },
        {
          "alg": "SHA-256",
          "content": "f62c5ace8b4868a58b8d6e44d4da62393c42438f52e30f52cb170346542e9954"
        },
        {
          "alg": "MD5",
          "content": "fc611b39bb71f7e9323e5ca4dc8efde0"
        }
      ]
    },
    {
      "bom-ref": "10b5deed-eca9-4544-a2b3-7fbe2a5717a4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/iod-config.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e45802f346d958a6a44701306c851e165bca10c5"
        },
        {
          "alg": "SHA-256",
          "content": "c268c932117f48599a8d4eb957cbc9fa7ee58982ff7b56f6b9eacc8ca6f4c24a"
        },
        {
          "alg": "MD5",
          "content": "5d476c9273524e96dda6cf627e032c78"
        }
      ]
    },
    {
      "bom-ref": "10bb5c62-4bbd-40c4-a238-9ab1d0a7cbdd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/getty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "10cfd216-044d-46b9-a46f-2408dc1d372d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/screenShot.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fdfe8b5d1ad9c1fd5ff395a772490b12abe66a8e"
        },
        {
          "alg": "SHA-256",
          "content": "54671b218ca21644132482ad6af16d7d3905c75147a2b52c3f831bad33e69dc5"
        },
        {
          "alg": "MD5",
          "content": "7db71863d62423ebfc218cff24a0e856"
        }
      ]
    },
    {
      "bom-ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lzma",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "10f4e6bb-5755-412e-acba-cfb942048f77",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea75a0aad0a60b0b5e53bd43cd73311b27982608"
        },
        {
          "alg": "SHA-256",
          "content": "c52bb517e517e2552d2cfc5901dcc583d300fa0d15ec66f654514f87eea19901"
        },
        {
          "alg": "MD5",
          "content": "ce1a1cb1ec6902d14de4e147ddd14b75"
        }
      ]
    },
    {
      "bom-ref": "112612e3-1bb7-4090-8679-006ae766d5fb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/dhcp6c.conf-stateful",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "be7f4bcfce595adfcbebc1ad6372d71507652640"
        },
        {
          "alg": "SHA-256",
          "content": "07cbb444cdab5c009ed3f5bab844abfed36b51e20a793a73476eaef07d608ad2"
        },
        {
          "alg": "MD5",
          "content": "a5fca307106a0f65b94a2727d1b78be5"
        }
      ]
    },
    {
      "bom-ref": "11440931-f52f-467b-86e2-212971f77666",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/QueryLicense.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7c3c952531917961c1dd7a8ec5ede98740e8cf7d"
        },
        {
          "alg": "SHA-256",
          "content": "743e279b98811f294fd4f54ae43dfa518e86d1f2e55110f4fb98e91d3f4dcea8"
        },
        {
          "alg": "MD5",
          "content": "9a19b6ee6fd266deb4df8dacbd403752"
        }
      ]
    },
    {
      "bom-ref": "1183d77a-6f93-4762-8367-07b7d9722cd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_power.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd03cbc622ce1ed469b60b44751e73bcaec83974"
        },
        {
          "alg": "SHA-256",
          "content": "94390dbe1711217e984ed24c561c25b6c725469c2e778e60a84b42a484371df3"
        },
        {
          "alg": "MD5",
          "content": "abd244b758f8d5f3b0dccc1c7a16a6e6"
        }
      ]
    },
    {
      "bom-ref": "1197c366-c040-4524-b51e-c716a3aa2c72",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libotp.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b23a5b832c38984bbc76bdaa1483047f3eab1bdf"
        },
        {
          "alg": "SHA-256",
          "content": "7333c376e846c9199905c87ac6b73d9895165b61b3de6250109e757e67affaf1"
        },
        {
          "alg": "MD5",
          "content": "9233b1234133ddf29bcb35634e47765e"
        }
      ]
    },
    {
      "bom-ref": "11a33ae5-2b41-4445-b47d-3c1416ed9970",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49d07437c6215a698d327584571ae3aef8ef6a22"
        },
        {
          "alg": "SHA-256",
          "content": "12696e0f6d9a6cfbd5385c166ab9511144b4fbc689d559d3c7df090f76c0d50d"
        },
        {
          "alg": "MD5",
          "content": "f932c4522d5e266c501c7c43cd904370"
        }
      ]
    },
    {
      "bom-ref": "11ae8d90-8933-4083-a8e5-bbb655940623",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libanonymous.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e87edeff86ecac9c26aa2e69142bd56479ce1746"
        },
        {
          "alg": "SHA-256",
          "content": "065c03eeec61dc3cd382e2f2fc28dafdc973e224a98ff2beff8c2e718c56067e"
        },
        {
          "alg": "MD5",
          "content": "57a46a72ebd132436179f961ced8faec"
        }
      ]
    },
    {
      "bom-ref": "0a1559a2-7bd9-4114-8e4d-923553830a6c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SupermicroLeakDetectorExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ff4569b3fcc82715d6d1ce77995b2a894d55fce"
        },
        {
          "alg": "SHA-256",
          "content": "fff11e944a8627d88c5344601aa9acafefcfdbb30428a09f5fda1136f8b11012"
        },
        {
          "alg": "MD5",
          "content": "062165c3f639f625ec0ff1c8bc4f777c"
        }
      ]
    },
    {
      "bom-ref": "11b8c085-6b73-4753-8ac9-c74dadaa3bf9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fw_setenv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "50683d8dba4e1b89e4f6e1b573358dce943af59c"
        },
        {
          "alg": "SHA-256",
          "content": "a07bcbdeca3bb3e7a6e1164d112f003dff9445cabf32442c7c2193e9e17bef91"
        },
        {
          "alg": "MD5",
          "content": "1a49f85bec84e5af03f40620735fff5c"
        }
      ]
    },
    {
      "bom-ref": "11d5e58b-0ab6-4ba0-8d40-5275dda83858",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/macro.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "878451f567d2e0f0fe3088a2c1945b7d1258fd36"
        },
        {
          "alg": "SHA-256",
          "content": "7da8012bdb594ad037845e1e063f0efdd81fd4b8206d928fdad7fa9c00c18a49"
        },
        {
          "alg": "MD5",
          "content": "59a90d9b33ff80e53b0334aaa5a31619"
        }
      ]
    },
    {
      "bom-ref": "11dd1f33-deee-4927-9877-e2576ff5a734",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rtl8367c_mdio_write.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5f523fef6e6b00c7fb50917e3948febcd9be4412"
        },
        {
          "alg": "SHA-256",
          "content": "34bc9faeda3da436cff030e5c5d74d5d19460426bafb34fd05a2a58d0d197417"
        },
        {
          "alg": "MD5",
          "content": "b0729cf275f58d5c95e0761b508d41fd"
        }
      ]
    },
    {
      "bom-ref": "11e5249a-a425-4223-a684-e137276b7231",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Syslog.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f96b2b3c16228410653b3c54001a90c9c7c71b14"
        },
        {
          "alg": "SHA-256",
          "content": "c64ae5e57fdd71b30c5a6c9161809a6cd22ec3bc83e52389fff0858066caac60"
        },
        {
          "alg": "MD5",
          "content": "8b622047b1571d82069aaf13c2249c10"
        }
      ]
    },
    {
      "bom-ref": "11ee7e9f-ce1e-4da6-b707-1411208b099e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpldm.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b9efe2e8c03adec143e29793c83e4f2e269eb213"
        },
        {
          "alg": "SHA-256",
          "content": "171fae92da6d3a5559ed49ec3ef8d9b3f2e5de70435455bf188dceb05340b765"
        },
        {
          "alg": "MD5",
          "content": "dd50e998dcd8f94e1ee50d7858671d2c"
        }
      ]
    },
    {
      "bom-ref": "12014eb9-b74d-4452-8038-9d882c2eeadb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/uploads/uploads.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "56e2b26ce5c46b2f30097d6cd572dc1d3aa1c2ad"
        },
        {
          "alg": "SHA-256",
          "content": "bc302c2a26010fbad90efd1d845db5044fc3a82a92e5bc24c1b4506341d2f03f"
        },
        {
          "alg": "MD5",
          "content": "07b3b250f9c8277da09b63700bb982b9"
        }
      ]
    },
    {
      "bom-ref": "121975b4-797c-4344-9a7f-1d363a2f2308",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ascii",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1246a945-58f6-4b14-97e0-d6ecad348d89",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcEthernetInterfaceExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7485b6291e97b06a8a888df7d9bbf762168703ee"
        },
        {
          "alg": "SHA-256",
          "content": "cd1e43f51029c4b975f1d3480f90989f908c60b31362049e130159aa8640c4a1"
        },
        {
          "alg": "MD5",
          "content": "daa8668d25061c3cad2e70ce8376079d"
        }
      ]
    },
    {
      "bom-ref": "12538338-c990-4e93-8ca9-d5819a2f3214",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libc.so.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbae0235fb64a2369f2bddcee8cb962526de88dc"
        },
        {
          "alg": "SHA-256",
          "content": "c67d5eb747b323a199c3035024d9bc93779d3a47a9cbd286fa476e6d6f001dcd"
        },
        {
          "alg": "MD5",
          "content": "c73c76b05317d4761a2babcf15d3b74f"
        }
      ]
    },
    {
      "bom-ref": "12585be2-bb5d-4be2-bdc9-cc53ee94a2de",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/web-socket-js/web_socket.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c01ddecdb1dc735e8c1c9733f4f2d4b927ada563"
        },
        {
          "alg": "SHA-256",
          "content": "1ee8627070e5965f132d5771eeb70b8f8da8b3d5761537c23ddfb6686b149cf1"
        },
        {
          "alg": "MD5",
          "content": "4e42a681980602a8e897cf4206d80bdf"
        }
      ]
    },
    {
      "bom-ref": "126114f1-89ef-4082-b301-0a7467c11464",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcChassisNVMESSDExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "876f600119717212e4cee7369cf282276f197182"
        },
        {
          "alg": "SHA-256",
          "content": "6b39f22212b8dafa8a3d333c300b504db68f673dfef26b12f899269cb5db5167"
        },
        {
          "alg": "MD5",
          "content": "22a164f345db839628429168f754ef0e"
        }
      ]
    },
    {
      "bom-ref": "126b287a-d0c2-4d09-a335-1cadec48d729",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/imahandler.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e780c46a01ed196c6cda6f36155a33676ecc716"
        },
        {
          "alg": "SHA-256",
          "content": "443a952724fd705f4114a1c5698e03796be9a3fed89c540c8fee1b8feb6bf41d"
        },
        {
          "alg": "MD5",
          "content": "ba5011d3ef169b2b3b140ab9c1782106"
        }
      ]
    },
    {
      "bom-ref": "126c99b1-f887-4e7d-92cd-f3dbd2120bf8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCimXmlCodec.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b00e6e042a4370f57608ff1584580406cb08a62a"
        },
        {
          "alg": "SHA-256",
          "content": "8f4768c91b03820dad813a60af5ea22e717238f1da7799304a6b3ebe9163fd98"
        },
        {
          "alg": "MD5",
          "content": "c1eff99b7348a6401bc91e39c593c991"
        }
      ]
    },
    {
      "bom-ref": "127d2afd-3117-471e-8727-8f9f2b227846",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/qualifiers",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "798aa5244b91f6b49bc6539df5fe2272b6409f17"
        },
        {
          "alg": "SHA-256",
          "content": "5ee20e8a202dbc7dc4aaf523e44533f6356c094da87f210b3ce49637de013322"
        },
        {
          "alg": "MD5",
          "content": "8b90fe9623fe8de66182d8a24ecd14f9"
        }
      ]
    },
    {
      "bom-ref": "1289202d-c451-42b5-b46f-8b90aa7a5596",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pipe_progress",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "12d46231-fcef-4b56-a1aa-5961f51231ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/0-12670.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dffa0c72034092f1e4f62e6708cbf7d15d9f7f9c"
        },
        {
          "alg": "SHA-256",
          "content": "19cb38ba77704f49cf936db328c9fead1f7ed3db83a4e1d39c6ac00a0afc3a24"
        },
        {
          "alg": "MD5",
          "content": "d3527529a9958c1110dcb3dd5eb6af07"
        }
      ]
    },
    {
      "bom-ref": "12d67cb5-d3ff-4abc-ad22-dd3cf52de507",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/imghandler.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "385f271daf608b914b6e87a2f841c0da9b2b3c20"
        },
        {
          "alg": "SHA-256",
          "content": "ea78f51ad526f698b76c668c6a84e9f8d8990c6d6416170383e786d06daddffd"
        },
        {
          "alg": "MD5",
          "content": "78b8e6d028b06ce1377e058a36a7e4c2"
        }
      ]
    },
    {
      "bom-ref": "12e650d3-033c-4cb3-b948-77664e288e7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/filters.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd6bc59afa4ad20b3da8b5fb30d36690a7777892"
        },
        {
          "alg": "SHA-256",
          "content": "85d1d08fb341dd914c7cf4b60f9488c6826e4eff28653b1cd74ddd54bf08ddc9"
        },
        {
          "alg": "MD5",
          "content": "fb6fa1a5c92fef6a8d08b0bcae8acb4b"
        }
      ]
    },
    {
      "bom-ref": "12ecfc4d-560c-4faa-93bb-b491ceec8678",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/favicon.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5a0ddd392732502dbe454019f29bd72a4782478a"
        },
        {
          "alg": "SHA-256",
          "content": "f16e5d504071f0aa3d31f5529a54d4009953e3de3035b84c015e8ef02a13f509"
        },
        {
          "alg": "MD5",
          "content": "e126058465cf703d153b0eb977b94f3c"
        }
      ]
    },
    {
      "bom-ref": "12f80869-b280-411f-9871-effec560eb44",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/user.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8c10d674a64d4dde96f30ee4f8c2162722cec67"
        },
        {
          "alg": "SHA-256",
          "content": "d4900c0399d59e0f00f86ec70dfa9d6c573c7e023993cd15795c5698173c6a6f"
        },
        {
          "alg": "MD5",
          "content": "1cdc1f1ad926caa85669909207202886"
        }
      ]
    },
    {
      "bom-ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bzip2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1337cdd1-1fcc-4fc5-ac2e-a65d5124fd60",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrack.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21b8b72195068be5bd3989d08ae6b217cf97a0aa"
        },
        {
          "alg": "SHA-256",
          "content": "cc1ab4c1737899d07a259590f14a83fbe7217cc3147c3c56f63af014aea58ad8"
        },
        {
          "alg": "MD5",
          "content": "74381dfd63028781d4c750ddeedf2484"
        }
      ]
    },
    {
      "bom-ref": "13770122-13f7-4624-be7c-7bfa7a9f9e83",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/ipaddr.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a61b4c7a80c75bffba0e4c7fb77b32a1c745a14a"
        },
        {
          "alg": "SHA-256",
          "content": "f0eab325f51ac14a4b11ff9dace99091fe88c9d1c6f22c162f8dee0c00105de6"
        },
        {
          "alg": "MD5",
          "content": "8e3fae38877a3ce1084338366d280994"
        }
      ]
    },
    {
      "bom-ref": "137a2d6d-62fc-408f-b51b-0db1ada5db17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcQualifierProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f2cdca51272b218dc2ab93f730f300fa86bfc8f"
        },
        {
          "alg": "SHA-256",
          "content": "79283d74e2ba0c80c72d77d3246c44d557ea51d793272ab8171ca91418c44eca"
        },
        {
          "alg": "MD5",
          "content": "ab7199ef8ccb013a7bb2d55512ca7a5d"
        }
      ]
    },
    {
      "bom-ref": "138632f4-91a9-455e-8743-4443191feee6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/login_lock.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d04a934398c1ca325570751f574c0135b39e1f94"
        },
        {
          "alg": "SHA-256",
          "content": "3f3368d8ea112a90be6c080d6ab326c69c3f860e53290ea3dbc04cae22ca9e07"
        },
        {
          "alg": "MD5",
          "content": "2786381a0a8addfc730ccd7f58190c03"
        }
      ]
    },
    {
      "bom-ref": "1398ff19-d3c1-4f1d-a7e2-571dc66a19d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/slavetask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "864963e4626d71b0d01ea7bbcc625f9e28e9e7e1"
        },
        {
          "alg": "SHA-256",
          "content": "074e4f588b98656dd08ffe35ada8fde979f27f16eb47a58c244568b1f2585a59"
        },
        {
          "alg": "MD5",
          "content": "b73940e0c42ea2176f9b058e8bed4e38"
        }
      ]
    },
    {
      "bom-ref": "13a6926d-1eb7-441d-95ed-e40f48720d8f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/collapse.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ded7452137c2ce7c49ecd3fc0fb1bcabd273db7a"
        },
        {
          "alg": "SHA-256",
          "content": "e29dec4addd16a22f37a3e1c5d8743abc65d6c8bfbdce531b720cd8aa577627c"
        },
        {
          "alg": "MD5",
          "content": "d5f7f002289c4b9c92b04c2570cc7383"
        }
      ]
    },
    {
      "bom-ref": "13b5347b-4235-4bc8-a58f-86be2a7816e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/indication.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a53fff7ec4d878d6ac35b3a66bb9d80897619eec"
        },
        {
          "alg": "SHA-256",
          "content": "54493643bbd4e81bbcd4eb23db5b2f22dc6a31d8b74a7bdb54311eb552375736"
        },
        {
          "alg": "MD5",
          "content": "79184245198dccaf7271bdc32f83c4ee"
        }
      ]
    },
    {
      "bom-ref": "13c7e308-ddd0-4e16-af99-ca79e65ae142",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmptrapd.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6dfd0fa8c33f4dc4ecc941a315e7171e597d8829"
        },
        {
          "alg": "SHA-256",
          "content": "148329f9d341476e2ba4e1e4b961958d75c91e00b0f1cf72cf714fc990a57104"
        },
        {
          "alg": "MD5",
          "content": "e8cf3f5545c33649ff13723e0fd0facc"
        }
      ]
    },
    {
      "bom-ref": "13e2d288-58c0-41b0-8b25-9c1a493063e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a94f0aa0556513afd583a32f29e783863f5eeb9f"
        },
        {
          "alg": "SHA-256",
          "content": "ca56bfd345fb4cfae0454c357993e1c1e81cc9420dd21a975349f297346c8982"
        },
        {
          "alg": "MD5",
          "content": "c401143a455497d7b8dbeb2333b4afb3"
        }
      ]
    },
    {
      "bom-ref": "1407aa03-0765-4709-a18a-7211088adbb1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/linux32",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "141febc8-b59a-4a56-8ff6-a0a7193045b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/run-init",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0a162311-dc40-4252-ae96-6edcf7911528",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/savefromPS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db92b5adc78e6dbfc61c9e2aa3991ea30a0ee8fd"
        },
        {
          "alg": "SHA-256",
          "content": "3592c588dcbe6f29017e55f7662af5b1a5c833437dfd11df3ba1e032954729f4"
        },
        {
          "alg": "MD5",
          "content": "90dc3f5c5e20cc80d2e9b28f81253b5c"
        }
      ]
    },
    {
      "bom-ref": "0a281466-8705-4055-bf04-35d55241c8b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrad.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1dcc8c63a1f81dd8fb505472dd2c7aaaeada2886"
        },
        {
          "alg": "SHA-256",
          "content": "b150eb70d34605ad251d5b6b307178f52e5439dc9bc7aad1dc687ddb17fb3bbc"
        },
        {
          "alg": "MD5",
          "content": "e8b634787c3c43c7dc95acdea592e88b"
        }
      ]
    },
    {
      "bom-ref": "0a2d69ea-dc29-4cc5-9919-08f7effc47f0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/remote_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8fd25a1dcae371b3efdab210f993560168a15c4"
        },
        {
          "alg": "SHA-256",
          "content": "f1cece839194b431831f95a5e4a6280ef32f7c110f7933816ac72e79a26981ec"
        },
        {
          "alg": "MD5",
          "content": "1827c4e943c69ecdfc82f3f33108ef00"
        }
      ]
    },
    {
      "bom-ref": "1446b1b9-729f-4d2c-a81f-fa0a21e00194",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/help.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f84462b7ea02fa4bbc98636dd9d7134a02337c87"
        },
        {
          "alg": "SHA-256",
          "content": "e52fbd823e4675c32ac269ca8541ad9e04bd5c49285b14df6a25fa6d13c5de85"
        },
        {
          "alg": "MD5",
          "content": "3a90ec4b0cc205e3f58a203d36f667e6"
        }
      ]
    },
    {
      "bom-ref": "144a1de4-c0da-4d8f-9bcc-b371a4716743",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ee21a7c50e20aceb8d5c9f6e56d289bacc90580"
        },
        {
          "alg": "SHA-256",
          "content": "d74f706ef312f86cbf9ca4c6f4da53df9de9538bd94dda0a062b3b0db12f8294"
        },
        {
          "alg": "MD5",
          "content": "f94a922696e4fcecf05113345136d32e"
        }
      ]
    },
    {
      "bom-ref": "14581f4d-50d5-4651-9c7c-6dd4e4444070",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "14607e4c-4bbf-4f8f-b0f2-c0afcaedbf95",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0a3d8da3-4ce9-4342-91e8-62da6270598e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi++.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e23ff920af42f30e4bbabdb292a51b2759553885"
        },
        {
          "alg": "SHA-256",
          "content": "b65622ddef67a12193187317c574d318ed1b793e7880ddb40dfc99ec85726ab7"
        },
        {
          "alg": "MD5",
          "content": "c60b67a5e33aab8cce10a28fb81cac3c"
        }
      ]
    },
    {
      "bom-ref": "0a4bcbd7-8961-4dfa-b5ce-51893b57100c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamAlert.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3bc9423e2c3525d517dafa38ca9be65fbf8dd8c"
        },
        {
          "alg": "SHA-256",
          "content": "b4aa8aeb4fd1c5723f98bdb0d140f4887f708440b4d73adbe7a7194f497c8d18"
        },
        {
          "alg": "MD5",
          "content": "025fdbe8ba232ee22670bad16fe52e07"
        }
      ]
    },
    {
      "bom-ref": "0a5adc57-5995-44e8-93a2-b87bfd6766bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfuse.so.2.9.9",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd14575ff1d42b6f6821f6b227ada95dc435a3cd"
        },
        {
          "alg": "SHA-256",
          "content": "5f05c0d27c4c697920def19f3108a3c8634eceaf13565bcf017c5933ff30457a"
        },
        {
          "alg": "MD5",
          "content": "cb7d57930c79fa5537837e65f93596f9"
        }
      ]
    },
    {
      "bom-ref": "0a5b9723-b18e-46da-93e9-729af14d80b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderGz.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98246ead6ea0523cfee7255cd1ff4547c2f32d07"
        },
        {
          "alg": "SHA-256",
          "content": "68823945b5139c37a0feb400212744bb4bc60e9c0a91976bd218faf131e51aff"
        },
        {
          "alg": "MD5",
          "content": "815f5aff38077c8ce308006b08124b81"
        }
      ]
    },
    {
      "bom-ref": "0a899e06-0b2d-42e2-adcd-939ac699b30c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/libwin_x86_64__V1.0.5.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73fddee9fe234a8e2fb059217baf49ea1c3a73b4"
        },
        {
          "alg": "SHA-256",
          "content": "328b18c8b7bb0cc560c9bb23b4ee1634eadba12a0f6c1557298af4d6c477899e"
        },
        {
          "alg": "MD5",
          "content": "846405ec6be5603e052bce32ab37421b"
        }
      ]
    },
    {
      "bom-ref": "0a99d336-d43e-4f90-b795-332af6c41ee4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libss.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ece57d671200533225fff4cd9d1ad98a2d4ba33"
        },
        {
          "alg": "SHA-256",
          "content": "b7ecb09c3fa8062f7c369f6ffb84441848f0a553decc7b5cfcf3c3d1eeb58f2a"
        },
        {
          "alg": "MD5",
          "content": "ce411b37a1a14dca95b15b4fae018a19"
        }
      ]
    },
    {
      "bom-ref": "0ac3dcb5-fb9d-4a58-8e57-58c474cdeeb7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/frutool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c22ba74f3e52e49b26eb1eecee0e65c94cb88c9"
        },
        {
          "alg": "SHA-256",
          "content": "ed6fed0e66a56088e1755feb2f622102eae535a5fe7cf48d029fe935617e80a3"
        },
        {
          "alg": "MD5",
          "content": "f0be432c83b49f205965e4d61647c55d"
        }
      ]
    },
    {
      "bom-ref": "0adec78c-f181-49b2-b259-912204acfd7e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ee21a7c50e20aceb8d5c9f6e56d289bacc90580"
        },
        {
          "alg": "SHA-256",
          "content": "d74f706ef312f86cbf9ca4c6f4da53df9de9538bd94dda0a062b3b0db12f8294"
        },
        {
          "alg": "MD5",
          "content": "f94a922696e4fcecf05113345136d32e"
        }
      ]
    },
    {
      "bom-ref": "0ae96900-86a6-4498-90ac-9451740aa3b0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/network_edit.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e2f1a21bf2861892db5241372d5d7a32d2f056f"
        },
        {
          "alg": "SHA-256",
          "content": "9f1e31938de1e1e50889424ac49bd47d92a5383d9e4af8aef7eaf9f2406c5df8"
        },
        {
          "alg": "MD5",
          "content": "47a7ac70a826a140c6f444d1877168d0"
        }
      ]
    },
    {
      "bom-ref": "0b543350-1095-47aa-a8e2-d25362f82e21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pwd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0b671a7c-c5a2-43a9-90cc-71308b8fc159",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "94bc0128776297edd4c0e0fa1255b857786ccbb0"
        },
        {
          "alg": "SHA-256",
          "content": "2092665388c8581e9df061e1423bbb0f5db7fd153df0c843e3384ec958038c1c"
        },
        {
          "alg": "MD5",
          "content": "1bb7bb4e32292dedb2ea91db71b176fd"
        }
      ]
    },
    {
      "bom-ref": "0b6fd3f4-3071-4891-852b-9f3cd7949524",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fac292b349bc34b086ae933202565f3c5e1a881c"
        },
        {
          "alg": "SHA-256",
          "content": "a89952746d19a58adbde0096063a777769261209e85adb6654ed637916213bc9"
        },
        {
          "alg": "MD5",
          "content": "494ee2d442d44d5deee28ca18caa338c"
        }
      ]
    },
    {
      "bom-ref": "0b896d8f-b1fa-4e8b-9074-667646bfcf96",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamPCIeInfo.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "02402470c2bab6fb45e12982daea7b350d723be7"
        },
        {
          "alg": "SHA-256",
          "content": "f3753ceb753055048a45f7c48e0a0b56ab488066f05866c27e5b889a0b41b63e"
        },
        {
          "alg": "MD5",
          "content": "39c3e29dbb871708c1a10e43a3d1a086"
        }
      ]
    },
    {
      "bom-ref": "0bb4cbeb-a110-48ea-9ac9-e5d24178711b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpamc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad4352eb29219fedb534c5879fc90ae24f9bc2cb"
        },
        {
          "alg": "SHA-256",
          "content": "0165cc729d0cb47999017bb17131920ee3c0f8f167a23015360b382ecac2d53d"
        },
        {
          "alg": "MD5",
          "content": "ff01a26dafa4053f19d90e5af314abb6"
        }
      ]
    },
    {
      "bom-ref": "0bc9864b-202b-4b30-9130-e4acebee9805",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/pwd.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65b064220b5fe45a96ea45112622364378608ffc"
        },
        {
          "alg": "SHA-256",
          "content": "9d2086e59292201cc770e3d068d39e935861af14a486766d9e50560a2e877753"
        },
        {
          "alg": "MD5",
          "content": "3297695b26487cc0431ff2f5c1ca9751"
        }
      ]
    },
    {
      "bom-ref": "0be007c8-3b74-462e-b995-305bad1858e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13DSG_OM",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "faf9d15311cdcef0fb9aab051c01fab5f1567173"
        },
        {
          "alg": "SHA-256",
          "content": "ffc9a1f88882997241a2bff341aaa0d4d64a145663a3a19792115e59ef7e4cc9"
        },
        {
          "alg": "MD5",
          "content": "9f7e1972bfa36af571b1510040c835e0"
        }
      ]
    },
    {
      "bom-ref": "0be98a53-7c36-4f06-b48c-549aa6742f4b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/sysctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0beb2035-6a6c-4dd1-914a-cec60a5eb4b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubirename",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkdosfs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/time",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0c07be20-ce5d-4c7b-99b5-e5c6c91e4be8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmPolicy_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3ac9972a445c211d0ce8365197ca7be3d5f1f6ec"
        },
        {
          "alg": "SHA-256",
          "content": "cf9ff8f65c30c32197f807b90e3c415d9f24dfd1825c9de493eae0b1850228a2"
        },
        {
          "alg": "MD5",
          "content": "36dad660cffd6ff5fe0527ba77a7d8c6"
        }
      ]
    },
    {
      "bom-ref": "0c1cebbb-504e-4d61-8dce-42c941af1c11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mctp-demux-daemon-ep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0049d574341cdf8f01b50564f6b35de013a6752c"
        },
        {
          "alg": "SHA-256",
          "content": "95d9f833eadf96485607b4ff89bfcce379cf582db5b615263252a280cc11e1c6"
        },
        {
          "alg": "MD5",
          "content": "2e391eec2c2a4fba7ba170c415f823b8"
        }
      ]
    },
    {
      "bom-ref": "0c1f400e-2e0c-4d27-9283-a0fa4df5de9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unshare",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0c23b1d9-6d99-4eaa-ab01-59a205fc34f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e7e417707eb8ef136f9a7e84797cf02df454e5f"
        },
        {
          "alg": "SHA-256",
          "content": "b4a906e73f205751ee076df6cfa8067d5057a05df1b2604d643324e16688a757"
        },
        {
          "alg": "MD5",
          "content": "3d5ddf217eaff2daadc558fb1561dbfb"
        }
      ]
    },
    {
      "bom-ref": "0c274dfb-8230-4dad-94e2-c4fdc0ec2435",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libtirpc.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83e14166b7c5b716ee6475d17a5eafb47b2b32b5"
        },
        {
          "alg": "SHA-256",
          "content": "d32cc17d6bfd8be45f5eb07a01ca9d839350927f254cad04891f344ab735f31b"
        },
        {
          "alg": "MD5",
          "content": "2e6133cfef677681c4fc9e3792e173ea"
        }
      ]
    },
    {
      "bom-ref": "0c29aff9-ce97-418c-9992-bb2a98cf586e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/populate_fs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "13c59f00655eb0fab1d727d93f3012e250e52015"
        },
        {
          "alg": "SHA-256",
          "content": "01bcff4580db2180afb21bb5a69ff38235dea6d8d6482a2775d29d33a6b7f474"
        },
        {
          "alg": "MD5",
          "content": "afffa2fd7a79dc9df94831073c840679"
        }
      ]
    },
    {
      "bom-ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkswap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0c3821e0-5444-4efa-9e76-19b6443e96ee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_ssif.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0c9a346515e959e6a08dddcfbfaca5c47bc22f1"
        },
        {
          "alg": "SHA-256",
          "content": "945b59a8a3b9ab7d7aa03c5656c7f577a658ee48df64f2e31224e99b095235fd"
        },
        {
          "alg": "MD5",
          "content": "4fa94220ef25a3f4500f081a4f7bb076"
        }
      ]
    },
    {
      "bom-ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/chroot",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0c61ed58-9136-4b81-b9e1-8a53be691350",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "0ca2d423-6101-480e-8dcd-1b5ee1ff7e23",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/loading.gif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "07c176795323c4d5284761914068820a867c8a79"
        },
        {
          "alg": "SHA-256",
          "content": "ee361c4d4063bcf7bf405141287e6c8fe50326f7a5982a2125932a7b0b45d0ca"
        },
        {
          "alg": "MD5",
          "content": "7b0935b69a5d4f04400080ada2939ce4"
        }
      ]
    },
    {
      "bom-ref": "0cc8ebca-6d76-458a-8694-19b60b7910bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/KCSInterface.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "774a0d2ad79549c0a54e12311d74bf342aca6a21"
        },
        {
          "alg": "SHA-256",
          "content": "ddd287200ad41c33373144aedb5d84d1f445594effd28d31168e6fb1b70391f2"
        },
        {
          "alg": "MD5",
          "content": "fe48632b8b13e784dc0218127faf6b65"
        }
      ]
    },
    {
      "bom-ref": "14958aa9-b489-4410-8e3b-32bbda41f387",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcAccountService.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fe6409468740cf16c151ea5b53ffeb82a12b9b4a"
        },
        {
          "alg": "SHA-256",
          "content": "fc6512f12654d851bd27e998cd6503f4bb70dfc955e1229e7557286acc1d56f1"
        },
        {
          "alg": "MD5",
          "content": "3d6c47202475ff6869269a61d74b3b15"
        }
      ]
    },
    {
      "bom-ref": "14a28903-c2cb-4aad-9d12-dec72c0e9e45",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/lldpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "76c909e8718afc95dd26a32426086410a8093977"
        },
        {
          "alg": "SHA-256",
          "content": "68a8c08249248bd13dba687a391334c344566c14e5a5ab623550acdc1d85021f"
        },
        {
          "alg": "MD5",
          "content": "40fbf10aa62bb225b3cff3c430669d05"
        }
      ]
    },
    {
      "bom-ref": "0ccb94a9-081f-4f35-9b3a-9e0a2fe18f2f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/restoreOEMPS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a8ee2c6705803575ab6a8287950035d5acb5366"
        },
        {
          "alg": "SHA-256",
          "content": "d3be50059d036889c3ca9cc4175b00f81fe4d5b90435ffbd068ccafa6b3f2115"
        },
        {
          "alg": "MD5",
          "content": "20a63a3bdbd8fdd5a7b2130aa99d0d33"
        }
      ]
    },
    {
      "bom-ref": "0d0219b0-8430-4157-a916-8f8477c022b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iprule",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0d05cabd-08de-45e7-a8fa-e691efe8cc07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/du",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "0d201246-42af-49e4-b6ee-700c08ded68d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/webfonts/fa-solid-900.svg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55a9f6dd285c88c6c9847fee0d5ce127c4c61c52"
        },
        {
          "alg": "SHA-256",
          "content": "86c7d89d0f0d29d85c6684db2d8da9aac514c81bcabf41ea0af726e29de20a47"
        },
        {
          "alg": "MD5",
          "content": "c2801fb415f03c7b170934769d7b5397"
        }
      ]
    },
    {
      "bom-ref": "0d281f5c-8167-4b16-8bc7-7303a380c2a1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/system.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ef5bf90ce15dc9cd17f0e7902d709b95654f0c1"
        },
        {
          "alg": "SHA-256",
          "content": "7c72400ccdfb4584e89f8a2ddca968fc1e0e0e927f2d9ce8b50105d46d53c449"
        },
        {
          "alg": "MD5",
          "content": "4a2297b545495695c8e01cc9bb1a6a09"
        }
      ]
    },
    {
      "bom-ref": "0d609960-7bc9-47f3-8e70-06aabfad5600",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomain.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a1ea4e91bd1bb5af84829b824c122c041a39d085"
        },
        {
          "alg": "SHA-256",
          "content": "ff18e8a8ea30fcd819cbcdd1290eb4967d53550ea06e927b5c2a5f93c21aa590"
        },
        {
          "alg": "MD5",
          "content": "ef646f608cdbacd5cb9a314151380a2b"
        }
      ]
    },
    {
      "bom-ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/softlimit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "14a2a114-ed24-4114-ba52-08f9ecdbeb68",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4fdd23d735f1d9002b15220de16aa6497e92e74b"
        },
        {
          "alg": "SHA-256",
          "content": "0b36e6bbe0d3caf5de9d0820397fb92fc04b4a920b46c260edfe3911f5c329a4"
        },
        {
          "alg": "MD5",
          "content": "3fc04b4a179e2bdeb67c86407bdf9afc"
        }
      ]
    },
    {
      "bom-ref": "14b209fc-ad3c-47be-b0e3-a6afd280f096",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_indexfile.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8547275fd236f9a775c371e7a582a38db53bf305"
        },
        {
          "alg": "SHA-256",
          "content": "e2bb3da3fcd09e9a963df6c07ec21625d67f77ab777514a5b50c6d348796a7e9"
        },
        {
          "alg": "MD5",
          "content": "25a1e6aa938dc188fc4c20aeb78a863b"
        }
      ]
    },
    {
      "bom-ref": "14e8f1ad-324d-4a1f-a324-149a4fa43adf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_db.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "add577b2bee7006c056bfb9dd9098cd77a9424aa"
        },
        {
          "alg": "SHA-256",
          "content": "830ac71c89c765dac83ab04c6b7a31c93c9b35aaa272ff2b510925f58ad7bc2d"
        },
        {
          "alg": "MD5",
          "content": "a0061de53278a6c53438966b253cab74"
        }
      ]
    },
    {
      "bom-ref": "150f2450-b967-4ab9-82ce-9b1bcc5d9bce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_event",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a3335acbeb6dec4457943770dbf5a34c8552337"
        },
        {
          "alg": "SHA-256",
          "content": "d48916d7788693df61f56e2504f0e4531bc7759c0372a74b4fd3a7421583582d"
        },
        {
          "alg": "MD5",
          "content": "3662680050462e0df664858b27f5c7b7"
        }
      ]
    },
    {
      "bom-ref": "24519a84-b67c-414c-9bbd-4e7b640d9000",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcVolumeExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f4ba2847c1ccb83a285e214385cf18a16b7b42c2"
        },
        {
          "alg": "SHA-256",
          "content": "bbc7c8f3f5c57146156b45fdf2a03b8bb73d2d15d0fb1d01c07f8975c733bb9f"
        },
        {
          "alg": "MD5",
          "content": "6a9a969105837874447114ce06848c81"
        }
      ]
    },
    {
      "bom-ref": "24622dc0-83c3-4c15-9d2e-1d18bbc47bd0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/video_load",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc80f0ae5723d4509cd8eda20a51af6ad3d4c925"
        },
        {
          "alg": "SHA-256",
          "content": "fb1fc4d5e55c542bd2a23503a09680b79b2e29eca2c6f8f8cfa3b5a51ec6c404"
        },
        {
          "alg": "MD5",
          "content": "c32dea6c9a3292322df07e383caad609"
        }
      ]
    },
    {
      "bom-ref": "246ff87e-87b2-4bdc-933f-c97e59816b91",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tee",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "248df14c-4480-48f1-98c1-9c0a1e34c4ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsafec.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f7a4e329a10076bfe3de2df9dcfc243772dcafe9"
        },
        {
          "alg": "SHA-256",
          "content": "49a1a5345396a01a83af287b697b2314822374f2714c35f813d0aa9eb9935bce"
        },
        {
          "alg": "MD5",
          "content": "4cf60247d115e7f59b00133f237ca0d2"
        }
      ]
    },
    {
      "bom-ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ipcrm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "249805fb-2579-485d-b35d-bd3c4ac6b551",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/getGPU.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a4d222b6be9bd41d6f4b1ed2f70ab45e3aa584d"
        },
        {
          "alg": "SHA-256",
          "content": "5efcf173ade6efa9b11e4206917a67650126b62684260e73d40905505281c103"
        },
        {
          "alg": "MD5",
          "content": "7cd3a4ef42fec6a70fb0141384fd2a92"
        }
      ]
    },
    {
      "bom-ref": "24a1dc8e-2d39-4f7a-ab71-6de5361dcc71",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec1b938eec9ca93c9df5b5090561b38fc35711e"
        },
        {
          "alg": "SHA-256",
          "content": "6d341c1f8918d9c275777540cdd9f9e133dd135e618b86a38cd9e0c0c2d600c3"
        },
        {
          "alg": "MD5",
          "content": "539b8f25aceda0d7b49599ced2d48b93"
        }
      ]
    },
    {
      "bom-ref": "24a2e681-7476-4de9-990d-552c1774ba28",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/start-stop-daemon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "24a79dec-acaa-4af0-8949-62b5ebe5744e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcQualifierProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f2cdca51272b218dc2ab93f730f300fa86bfc8f"
        },
        {
          "alg": "SHA-256",
          "content": "79283d74e2ba0c80c72d77d3246c44d557ea51d793272ab8171ca91418c44eca"
        },
        {
          "alg": "MD5",
          "content": "ab7199ef8ccb013a7bb2d55512ca7a5d"
        }
      ]
    },
    {
      "bom-ref": "24ed1f77-0688-4d28-81fb-75339f77bc8c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/index.fcgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1630d9e50f0aeeba12d375befbcd4c4d77d8ab16"
        },
        {
          "alg": "SHA-256",
          "content": "28a8335fb3d853b37bb9f55f1505321f20993831490d3a3fe5c196cc909aeefc"
        },
        {
          "alg": "MD5",
          "content": "ad3c7252df2ea8077c9309d7c3016e42"
        }
      ]
    },
    {
      "bom-ref": "24f3189c-82dd-45d3-b6b5-f5cc1b3f433e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libteec.so.1.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d65a897459d157245644efb77d73af76e1932ace"
        },
        {
          "alg": "SHA-256",
          "content": "2999ed74e38914ee21c76a1dde37ada773f02d581fbe1ef2153bd449b1ee6332"
        },
        {
          "alg": "MD5",
          "content": "d3375bd317e5cf5321a19c4f92ba2152"
        }
      ]
    },
    {
      "bom-ref": "24f4dd95-0a5e-4d41-a445-b2ff04194831",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_cgi.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2aa92d28fed61603e0a395a775636f3b532a17c2"
        },
        {
          "alg": "SHA-256",
          "content": "3814129bd00c797611744b987e0fb44bf7618c906e8f3663534390baed605cfe"
        },
        {
          "alg": "MD5",
          "content": "a6f47cff4cee6d6f25c6b750d1fffdac"
        }
      ]
    },
    {
      "bom-ref": "25047410-c0d8-4182-8c41-cc17515514c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SMCRAKP.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e7bacea23884f3c945194a59e1885d5942c7905d"
        },
        {
          "alg": "SHA-256",
          "content": "a8746c10fdfc8a76c2a12c739e515822b306dafc8225ab822cb8a3959a0ef4f7"
        },
        {
          "alg": "MD5",
          "content": "43d87bb260e1b52e0de042e0cdf25c3b"
        }
      ]
    },
    {
      "bom-ref": "254db88f-a182-4aea-bffe-2080c4f6703d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libphosphor_dbus.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb145fd3b2cad5ece16eb0314d0afa2315ed9551"
        },
        {
          "alg": "SHA-256",
          "content": "a8cba2a615ab81d61aa2e75e5699c2ce8e5d4644a8284b8afedd890dba4f0dbb"
        },
        {
          "alg": "MD5",
          "content": "48704cbe291d9b2bd55afc8fd8dad708"
        }
      ]
    },
    {
      "bom-ref": "254dcf4f-9547-4ed7-9e13-3a4e95e0ce38",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a89ca2bc6e310c81333cfbae0805d31959c2b8ea"
        },
        {
          "alg": "SHA-256",
          "content": "09d0e6c689169ce82f0e99c3b8ffccaadf0ad1d51788ee4b24decb79dedcbeb8"
        },
        {
          "alg": "MD5",
          "content": "f077e0b8a587ad8411215eef2f331068"
        }
      ]
    },
    {
      "bom-ref": "25668e70-bb24-4561-a762-681e9418a96f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86_64__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/0-12672.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "08961831ed13d40218180471120c09d47c68a134"
        },
        {
          "alg": "SHA-256",
          "content": "6fe0c70cdd40be01f02a22cf8472d037b0d83f5adaff558a7db4262dd674ae6f"
        },
        {
          "alg": "MD5",
          "content": "b931e2b1e1bbf6056d1d09033e90d22b"
        }
      ]
    },
    {
      "bom-ref": "25744fde-a647-435e-aa20-6a2f8baa8dd9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/exec_notify",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e4a867062be773fcfd1556065328a9b94fa03ec"
        },
        {
          "alg": "SHA-256",
          "content": "05e1c8032f0de137ac3037fdb7bab3a44ce8a27536fe91d46cbc8f8ee55b4fbf"
        },
        {
          "alg": "MD5",
          "content": "2843f34d61d24f6401a54db86c238f6e"
        }
      ]
    },
    {
      "bom-ref": "25b2804d-e222-4318-a3c0-4e3c1ed93541",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/etc/ntp/ntp.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "62c9379a68851b55d308850f3758335103eea52e"
        },
        {
          "alg": "SHA-256",
          "content": "bc712e689e7f83b2c00e58b250bf5a943c406c1a77d90e4966a2701b0ad32650"
        },
        {
          "alg": "MD5",
          "content": "947058a213cd4873d24338833efea956"
        }
      ]
    },
    {
      "bom-ref": "25f956f5-15ac-4ed4-bc6a-5ad1388c0c4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderSf.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ebbd3799bcd41911fa0b956b49169f473ce0cf1e"
        },
        {
          "alg": "SHA-256",
          "content": "f2ac326b4b01425c58cffecb4134a9515516cba2010ed2e976a020bf12496471"
        },
        {
          "alg": "MD5",
          "content": "314169122ba78ca7729a739240627c23"
        }
      ]
    },
    {
      "bom-ref": "2601ea13-20b8-4cff-983f-035dec52ed79",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libkmod.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6f45a68931ea375908a18f457def4b0770bea50"
        },
        {
          "alg": "SHA-256",
          "content": "c7b098c5e5b8ff6cfcdca806164c1e0d292c8ccafc5cb36a355106020fa6d523"
        },
        {
          "alg": "MD5",
          "content": "be69052287f9e07633f385c59a28957f"
        }
      ]
    },
    {
      "bom-ref": "261bdba7-329e-4263-9cd5-b79442ea5c80",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_16_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "88ab4df6c50828318e7c2d0a1c4d12aa1685e8d6"
        },
        {
          "alg": "SHA-256",
          "content": "54a88f5d6d435f600af8666ff976f27c9aae3b85e41412a27bd2af40800cb20d"
        },
        {
          "alg": "MD5",
          "content": "43dc14de9f64d8fd950c770f26f2871d"
        }
      ]
    },
    {
      "bom-ref": "261f1e0e-ca4c-4bc0-95cb-f5e03fbb5dd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_JBOD.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ca15a53eb814f269ccc53efc821d58d07bf9d7f2"
        },
        {
          "alg": "SHA-256",
          "content": "9cbcf81e1edbedf6196d75356e732dca3d6541ee9ad1441643b2a1f25b600b0a"
        },
        {
          "alg": "MD5",
          "content": "eca10c2ebbdbdb367db496fbed388b6c"
        }
      ]
    },
    {
      "bom-ref": "261f83e7-8795-4a4e-b514-fc4622695007",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_mdns_minimal.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b110acd9b7fc2dd71d74bb369fdc70f95f374ea"
        },
        {
          "alg": "SHA-256",
          "content": "d445a12b231ad3da39874b4b85d57ce30707cbeb187cc9748f43518d3d82968c"
        },
        {
          "alg": "MD5",
          "content": "5d3badf968e097ad01e63fdada5bdd03"
        }
      ]
    },
    {
      "bom-ref": "263109c7-90d0-4d37-8536-b8657317163a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/SNMP.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f870ddb1895dd0fd58f5bb2e8676127503ac9b9"
        },
        {
          "alg": "SHA-256",
          "content": "a451194e10ea591bdc73bf85673bacd1f79340d64e782ec9ee3dee23893ea3c4"
        },
        {
          "alg": "MD5",
          "content": "6af580fadf6c23cc097ada89bf774c62"
        }
      ]
    },
    {
      "bom-ref": "264ae821-4457-4e5a-84bd-8fe25ceeca46",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/link",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "266a2216-565e-4a0b-a600-17b5d1e9f559",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_system.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12ee418534f5c8f651442abce39909b22a974957"
        },
        {
          "alg": "SHA-256",
          "content": "12e857d7e88441bd8ccc905307092f8b3c8279b7d60d2046e177accd46ce7f9b"
        },
        {
          "alg": "MD5",
          "content": "c65d4536eed70407f3e3ec49334b87eb"
        }
      ]
    },
    {
      "bom-ref": "266f501c-5ce8-498d-b1b8-3437acfef023",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi++.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e23ff920af42f30e4bbabdb292a51b2759553885"
        },
        {
          "alg": "SHA-256",
          "content": "b65622ddef67a12193187317c574d318ed1b793e7880ddb40dfc99ec85726ab7"
        },
        {
          "alg": "MD5",
          "content": "c60b67a5e33aab8cce10a28fb81cac3c"
        }
      ]
    },
    {
      "bom-ref": "26a4e309-a1bb-46db-9ef7-ceda8faf0e0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/egrep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "26becd45-5529-44b3-8f72-967cba36d8e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_context.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "163687e70159453081459b5f37eb5de5b12c40c3"
        },
        {
          "alg": "SHA-256",
          "content": "6bdc58a66f26af8c143a01ef722aa196be8d37c4e1e1519cb3bd5678f377a8b2"
        },
        {
          "alg": "MD5",
          "content": "ba098dfe02f6ad84a3f22156fa5fc083"
        }
      ]
    },
    {
      "bom-ref": "26c0abd3-ea38-48bf-81a4-ab0b5c22acd0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/ssd_dislocate.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b6e69cbe7e036c5354bffb134f52917fdd88280d"
        },
        {
          "alg": "SHA-256",
          "content": "ec2731f15c4e0e98fb02fe32b895754ce2d4b44802f0fee4b4579cf4fd97a1d0"
        },
        {
          "alg": "MD5",
          "content": "4a4581d24ce9577c5ade7b52298b9160"
        }
      ]
    },
    {
      "bom-ref": "1631d335-4e18-42de-9f8f-e4408789e416",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/restoretoPS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74c123a448ad94a342e43357caa989a46f02d3a3"
        },
        {
          "alg": "SHA-256",
          "content": "9b9fd87d96a76df83b0f20a2b9362be612247ded5548b578ba376371271cefec"
        },
        {
          "alg": "MD5",
          "content": "255f1bda42e1909f0859a8f0d7cee4b1"
        }
      ]
    },
    {
      "bom-ref": "163f9b25-799d-4851-9488-a854a7985428",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/crypto_load",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6b980da24ddcbbea9510a2f34da2887f381f87c3"
        },
        {
          "alg": "SHA-256",
          "content": "deb32ce2df89a2302faa883f8728a0772a1d4b477d3c1446509da33ae5dda92b"
        },
        {
          "alg": "MD5",
          "content": "e56400d40c0585fb8eb8552f2edfce5f"
        }
      ]
    },
    {
      "bom-ref": "1678ff77-c12a-43c9-a4e9-d6a0ea274ee0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/atom_hdd_ctrl.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c56cb0b71b957bee4e828c74ba1930cecd60c8e9"
        },
        {
          "alg": "SHA-256",
          "content": "ad222a07389dfb68a753d0546fabb7d02fd2b716bf9e4f8bbe01e2a98c86cfa6"
        },
        {
          "alg": "MD5",
          "content": "182d249f0525b43a28f01ef152de8243"
        }
      ]
    },
    {
      "bom-ref": "167d6c40-df0c-4747-aecf-3de6f8eb505c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_FULL.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "100c1c8a3c01bd300a8ab40c29cb77bfe1d5dab1"
        },
        {
          "alg": "SHA-256",
          "content": "1eaeb97c2d0bbd2422bb37004ba0cf8d80981c5a29683edc8f0648b0720dcee4"
        },
        {
          "alg": "MD5",
          "content": "49f00e6c901f426cc0db7f98948b6ef3"
        }
      ]
    },
    {
      "bom-ref": "1680b215-a706-46e6-8392-09555fbadc49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/IKVM_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "162e079466d977f8c8a191bd5b93adda327bc78d"
        },
        {
          "alg": "SHA-256",
          "content": "18e7123a4c95cfb7b5f668c4f7bd6ec531bdcd9606bb3ceaf4da49d5797733e7"
        },
        {
          "alg": "MD5",
          "content": "1d5f4e6bacbe791457d514cfa5dc6285"
        }
      ]
    },
    {
      "bom-ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nslookup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "16a4bfc0-d56a-4aac-865f-588bb0d4ade5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73fc069ea306f6a3ad6a048839d1a6d960557970"
        },
        {
          "alg": "SHA-256",
          "content": "cd4dfbb081e97085aa78e7660c673bda087bdbdd0e4e3fb781867755f42efc97"
        },
        {
          "alg": "MD5",
          "content": "96f55da847dfee66696ac8b039986187"
        }
      ]
    },
    {
      "bom-ref": "16b46c3c-7f75-4200-abd6-65c39a578038",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_19_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f440121c2a3187df2d460c02bd21147b0e5b2d9"
        },
        {
          "alg": "SHA-256",
          "content": "f260dbba5f5912d136dda14ae23d1c7f08dd472ffd12dcc09929691fe5566a18"
        },
        {
          "alg": "MD5",
          "content": "9babc80cf09a05e5f64299c819a98ece"
        }
      ]
    },
    {
      "bom-ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/crontab",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "16eae172-07df-4ffa-9080-eef6feb89ab6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_security.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "959b5606ab9b041b638b6e46f3b5831b996e7a92"
        },
        {
          "alg": "SHA-256",
          "content": "6983616015e0e9cd2abf966d2b6270cacf41992191945a3d633b1bdd8c8c83e6"
        },
        {
          "alg": "MD5",
          "content": "15dab12cf58f1a2a51780c1fff2d0543"
        }
      ]
    },
    {
      "bom-ref": "16f3a79c-e535-47b8-8394-85e082442a77",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IKVM.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "93a67bafbb42e06a415b4c6ccef2f00784cb5aa5"
        },
        {
          "alg": "SHA-256",
          "content": "183b0972c4e7b31fca85c017a6d3eea16fd6453644142dacda14da76a8e543de"
        },
        {
          "alg": "MD5",
          "content": "ed6200c9759388ac3f4feba2ccb6a602"
        }
      ]
    },
    {
      "bom-ref": "170201c8-a79b-4817-b2d6-a6dfefb0879c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DEH",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "858e8b5d8bf30b5cff22f380f51819a7ce53499d"
        },
        {
          "alg": "SHA-256",
          "content": "78efbf9699b706cec6c40da20c61750ed8dcbcd633c2d9cdb2f9dd2332d7a5fb"
        },
        {
          "alg": "MD5",
          "content": "cb03b049ecdad54a50786af918d13bdf"
        }
      ]
    },
    {
      "bom-ref": "1703420e-565f-44a3-92c0-04f67677058c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEDW_F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f217c11c484239cfaba3b73ed064130cfc21128"
        },
        {
          "alg": "SHA-256",
          "content": "0d23dfe368f266d9be43b8c6f35c3fe53de539cf5be98ffd832b457ef6ab836e"
        },
        {
          "alg": "MD5",
          "content": "e0d35cd98b8e11a4f33f718031c8057a"
        }
      ]
    },
    {
      "bom-ref": "1707178d-8b0e-448c-b12e-08c1ad39c301",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmphelpers.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49d62cdda243fadbec3137e026ddd2d482ccd737"
        },
        {
          "alg": "SHA-256",
          "content": "c741126818136030140883ea22b587536fd7e14ab72b66561a481afab7a8de1d"
        },
        {
          "alg": "MD5",
          "content": "61b0bca771c41ada0a3c659f0a0851d5"
        }
      ]
    },
    {
      "bom-ref": "17085d5a-731f-47fb-8949-ef5511fc5dca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcmpisfcc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e08b27a10f7f43b186730dbd727dc38f2201d15"
        },
        {
          "alg": "SHA-256",
          "content": "2398ac01dda9642b8038dfcc35c9529ddbe0b651ede553d413d5c94579de4485"
        },
        {
          "alg": "MD5",
          "content": "d23f6606632402f0deef01a0d4b99181"
        }
      ]
    },
    {
      "bom-ref": "1716f8d4-0a9a-459c-95a5-a846e5dc5c52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkswap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "17208586-7e43-40ee-82a1-ecd052448176",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipcalc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1727730c-9ba7-4aab-8b44-2eb28386fc55",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "39accb0de5c7d037199ca776b9b922e78917a701"
        },
        {
          "alg": "SHA-256",
          "content": "86f197f6d5caa7e04880ec394210715f1e0c65d2541ee15c2cb7158a7d5472d0"
        },
        {
          "alg": "MD5",
          "content": "914a1164784c1a181c33a44b12353dec"
        }
      ]
    },
    {
      "bom-ref": "172a610d-b336-45a8-8713-b9e01d6b485e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifdown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "177b4ceb-b88f-46b9-93e3-7dd8be5a147d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f06b6d350e7e4625a0011c83f5f4548305d33f81"
        },
        {
          "alg": "SHA-256",
          "content": "e37c3380f2a1ef64980a6e1d792c716bff3d52fcacb0b6efa4e67468ff0824e1"
        },
        {
          "alg": "MD5",
          "content": "ec726b22bdcf79f044ae71e1468795c9"
        }
      ]
    },
    {
      "bom-ref": "178b9e94-06e4-4494-8356-44de72bd4f85",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_atomic.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e541b78eda09e704aa81839f4fc97a42efa6fc7b"
        },
        {
          "alg": "SHA-256",
          "content": "bd6bb274402121e16cf454472f8989b00151bef23efa776f8df5c7990cbdd5f3"
        },
        {
          "alg": "MD5",
          "content": "eccf56d6d9937268c8842595c3fee1a9"
        }
      ]
    },
    {
      "bom-ref": "17959634-e267-4d26-9ad0-b1cc415227a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBasicAuthentication.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90d888803b2a7da3e9ce7fe26d528ba49e250829"
        },
        {
          "alg": "SHA-256",
          "content": "912563dd582d975b6f26b0d7997de9d6237ac7e12a567daf2d04b464e18ef07d"
        },
        {
          "alg": "MD5",
          "content": "51e9e8d91802c3df2a6d29e745f80215"
        }
      ]
    },
    {
      "bom-ref": "17b96540-dfc5-4920-9420-92d63f95336e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamSRAM_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "744a9de6f29d8a013593298dff8536dc0fe7fef7"
        },
        {
          "alg": "SHA-256",
          "content": "43fbc7ac931049f334ce6ae22598a3e48308c841ca0ede88d3d7ab22474a915a"
        },
        {
          "alg": "MD5",
          "content": "c855326bbd9eaa1350cb040c9ef2ab0f"
        }
      ]
    },
    {
      "bom-ref": "17cad429-2da5-42ad-8146-c841433fba88",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/adduser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "17cf9bfe-aa5b-4c02-9505-bea6e020874c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcmpisfcc.so.1.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e08b27a10f7f43b186730dbd727dc38f2201d15"
        },
        {
          "alg": "SHA-256",
          "content": "2398ac01dda9642b8038dfcc35c9529ddbe0b651ede553d413d5c94579de4485"
        },
        {
          "alg": "MD5",
          "content": "d23f6606632402f0deef01a0d4b99181"
        }
      ]
    },
    {
      "bom-ref": "17d0ef31-cc74-4a84-9324-200d34dec3c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pldm_healthy_monitor",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd65c798519952a4c1d87b651d300b14b322ea53"
        },
        {
          "alg": "SHA-256",
          "content": "7951fb561ae90be3d9f29ad9741b75a239a39e7dfaef296daef26c3e292a744d"
        },
        {
          "alg": "MD5",
          "content": "522b5064892a6bc8591556f63ada01c5"
        }
      ]
    },
    {
      "bom-ref": "17efe53d-7b13-4cc4-b495-94ab4975a6bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libkmod.so.2.4.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6f45a68931ea375908a18f457def4b0770bea50"
        },
        {
          "alg": "SHA-256",
          "content": "c7b098c5e5b8ff6cfcdca806164c1e0d292c8ccafc5cb36a355106020fa6d523"
        },
        {
          "alg": "MD5",
          "content": "be69052287f9e07633f385c59a28957f"
        }
      ]
    },
    {
      "bom-ref": "184180d9-dada-49f2-bd3d-e979a470422e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/lightSPDM_help.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f2452e75a7bdfa1be0c59a618ebf2061acfc23a"
        },
        {
          "alg": "SHA-256",
          "content": "f34983ecc4379de215d8a07135718890ed8f0723ccd24e35b95c802a3e079859"
        },
        {
          "alg": "MD5",
          "content": "d04b1d3c417ee26a50ac6998faafe409"
        }
      ]
    },
    {
      "bom-ref": "18832609-580f-45b4-9d85-a7328e0f5309",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ResetIP.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0a617342e5e043f09686f1d0088726c9061f02d"
        },
        {
          "alg": "SHA-256",
          "content": "51b96c28041059f899e9ffb903b03beb608c09b73581a476aea3efc947fee9d3"
        },
        {
          "alg": "MD5",
          "content": "1a86b80ea36fdbebd5ee0f6430872ae5"
        }
      ]
    },
    {
      "bom-ref": "1886da4b-9c22-4da5-b574-0d002210eb6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_FULL.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "100c1c8a3c01bd300a8ab40c29cb77bfe1d5dab1"
        },
        {
          "alg": "SHA-256",
          "content": "1eaeb97c2d0bbd2422bb37004ba0cf8d80981c5a29683edc8f0648b0720dcee4"
        },
        {
          "alg": "MD5",
          "content": "49f00e6c901f426cc0db7f98948b6ef3"
        }
      ]
    },
    {
      "bom-ref": "188da172-db60-4250-a9f0-7a719755a31c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/iKVM__V1.69.23.0x0.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "06b49d4eae5fd59d62567ae01e71c811cd0507a7"
        },
        {
          "alg": "SHA-256",
          "content": "ef1d54065e81a81389c140f8ccd995ee5d375e17863b9acfaf8b224d1612938c"
        },
        {
          "alg": "MD5",
          "content": "10f9b86a31e090f030c171c699b72160"
        }
      ]
    },
    {
      "bom-ref": "188e1002-c127-43fc-9679-7f007a237a95",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fsck.minix",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "18af2599-3194-48c8-b757-de1ec8ffd9db",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "18b9a9c9-eae5-4c19-8394-648a47db91a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ee21a7c50e20aceb8d5c9f6e56d289bacc90580"
        },
        {
          "alg": "SHA-256",
          "content": "d74f706ef312f86cbf9ca4c6f4da53df9de9538bd94dda0a062b3b0db12f8294"
        },
        {
          "alg": "MD5",
          "content": "f94a922696e4fcecf05113345136d32e"
        }
      ]
    },
    {
      "bom-ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cryptpw",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "18da7bdc-27aa-4366-8e36-329c020d6240",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/ast2600-i3c-master.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f9d2e02b9eaf78ed46127bd11a6afb86ebff3c46"
        },
        {
          "alg": "SHA-256",
          "content": "1eeb298693806b27e67636cef07486106ce94eb9b62e84016c843be0a2505216"
        },
        {
          "alg": "MD5",
          "content": "70313066d2b35c7d552492ff83c8f813"
        }
      ]
    },
    {
      "bom-ref": "18e8b57d-e4ab-4495-8975-d029aef54997",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_15_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b693f0f0eccc408c67207d914791a13bfa4ee9e"
        },
        {
          "alg": "SHA-256",
          "content": "f627c389e66309e2c4c4a3a923f65bb69e9924e85483d8cc1e241a438a2dd86f"
        },
        {
          "alg": "MD5",
          "content": "82c3ad15164e6dccf4538539a0c998e3"
        }
      ]
    },
    {
      "bom-ref": "18ee2327-ad56-4d9a-8256-fd812be59e28",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/providerRegister",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ab66f9fd732f0ad1b2273e770fb41ac594ebcaa"
        },
        {
          "alg": "SHA-256",
          "content": "68722630d546a4dc03f174093afff447d707e641dcd4552b64ef3cf97469512d"
        },
        {
          "alg": "MD5",
          "content": "247ad8f9556c305fffd66a8e0d26c277"
        }
      ]
    },
    {
      "bom-ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "19724f73-ac6c-44fc-a540-64a51d4f3fe8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/diff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "197df624-5e76-4ffb-b244-67136a0f5434",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/DumpService.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b567c92d3390dda961a050748725f9e8ff70e099"
        },
        {
          "alg": "SHA-256",
          "content": "d187eb8cea9b7cefb7b8b7f0bd68a91247ed618f90435ea270992fc7c67355a3"
        },
        {
          "alg": "MD5",
          "content": "e71cea3cf437d540f50104a9c80565e0"
        }
      ]
    },
    {
      "bom-ref": "197fd069-07b1-4c10-aaea-5841ce4a7c65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea75a0aad0a60b0b5e53bd43cd73311b27982608"
        },
        {
          "alg": "SHA-256",
          "content": "c52bb517e517e2552d2cfc5901dcc583d300fa0d15ec66f654514f87eea19901"
        },
        {
          "alg": "MD5",
          "content": "ce1a1cb1ec6902d14de4e147ddd14b75"
        }
      ]
    },
    {
      "bom-ref": "19862c91-5e7a-43e7-b289-eb011232fd44",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_15_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "28daa3cca0200b8b90e1ac23ab070143f4a892ad"
        },
        {
          "alg": "SHA-256",
          "content": "dd737a2c6cf1cce6926cbfeaa7d42002f9ff5578e9675eb2e252425ef4be2ab6"
        },
        {
          "alg": "MD5",
          "content": "70b712b44e619e9e4c78102e2f5a2165"
        }
      ]
    },
    {
      "bom-ref": "19999c9d-4ad4-4c7b-9278-5d9ba533e1ce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip6tc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cc7c53291fd1d41a869ff7eb322bb21179d3dad"
        },
        {
          "alg": "SHA-256",
          "content": "afc2309636826a891d1373b061f26872a2d44421949e266a447a1f62887cf0df"
        },
        {
          "alg": "MD5",
          "content": "eda98f670b06862f81dce603bb73173a"
        }
      ]
    },
    {
      "bom-ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/openvt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "19b1e81a-bcbf-44d4-90f1-e67f396362e6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/restore_file.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66d6635b7b3a82f174e114dd72e38ca0e01150de"
        },
        {
          "alg": "SHA-256",
          "content": "0103eeaf594704c3282ebc305f87ec033f453914c12b513f951fb8c99108ca73"
        },
        {
          "alg": "MD5",
          "content": "491ec33307f36e91af194c6c6dddae2c"
        }
      ]
    },
    {
      "bom-ref": "19c513bc-9363-46a7-b4ec-e4aacf1ce0d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcIndCIMXMLHandler.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cb0840e5388a9b8292e6ac8fd6a1e0d7a48c46c8"
        },
        {
          "alg": "SHA-256",
          "content": "e9c7a8e315c20e88884ec2ec66711efab8b9127b5c27e318f9598529adab103c"
        },
        {
          "alg": "MD5",
          "content": "b8e2e3615f2eb3ca07ea1f433cf25678"
        }
      ]
    },
    {
      "bom-ref": "26ed1e27-9ef8-436c-bb16-f3bc48556a12",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_uart",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "717ef6f49d6fef27d6c9021a5765328850f6ef19"
        },
        {
          "alg": "SHA-256",
          "content": "2c71c46f0c588f8e96fb3f6244009a41baaff703b24c3c13e7ac3b9a54ab399c"
        },
        {
          "alg": "MD5",
          "content": "360d33b4a879370a5c81fa1ef14ad448"
        }
      ]
    },
    {
      "bom-ref": "26f3286c-fbb6-4c4a-95cf-de6099be8582",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/slir3_bmc_i2c.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "da2762286266a5714992b074d93048a755624201"
        },
        {
          "alg": "SHA-256",
          "content": "1884a2e7b01ecad8d6f9476aa20feac12f03a24936d66510d14f01185b0d961a"
        },
        {
          "alg": "MD5",
          "content": "c3b398ccc1080ba6fbba2571a1ae173b"
        }
      ]
    },
    {
      "bom-ref": "26fe0198-aa14-47d5-9691-0ed865c755ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv_mit.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "27087611-9828-49ec-abf3-995e62dbb580",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/loadfont",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2740de94-784a-403c-a698-fc8af5d01b34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.G1SMH_G",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eac308d3f164bf1345bd6068a419d640d06b2b6a"
        },
        {
          "alg": "SHA-256",
          "content": "8fdc14105649770066cde983f66ee756f15c0f63b59b54ff283de8aef3ee9224"
        },
        {
          "alg": "MD5",
          "content": "1b8ddbcc75c363194b8fb76f087d3eca"
        }
      ]
    },
    {
      "bom-ref": "2756902c-0871-4682-a101-c7024d8ca67d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/net-snmpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5d19589e201befea6d94e378fb978dea7e3d4406"
        },
        {
          "alg": "SHA-256",
          "content": "79e3033bccc1dc1c7a6231ac6b70468bcdfdf311bbf601405204cef8696c15e6"
        },
        {
          "alg": "MD5",
          "content": "367b00830d8872313e2f35f4121cbab9"
        }
      ]
    },
    {
      "bom-ref": "27664969-90a0-4d1a-8d81-d57b68ceaae1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit3combo-bmc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61422649e3e26f3b6d6fe708c8059e5db14a7cc9"
        },
        {
          "alg": "SHA-256",
          "content": "bc41f5677851f54dffc8a42af4d168ec0dd543ae47874384cff457891bea5846"
        },
        {
          "alg": "MD5",
          "content": "fe9452d41858f2f423b8509ce638967d"
        }
      ]
    },
    {
      "bom-ref": "2773e2d3-11b4-460b-9ca3-ffd4160af271",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unix2dos",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "27b6f530-345b-46de-b3dd-9dedce2e4716",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropServerProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af2ea750468e8bb7017ecb49c8069b250387b4bc"
        },
        {
          "alg": "SHA-256",
          "content": "b36c57073b7a92a867fe9e1b4fc4c52355d414ba0d775af5df852f032766a0a7"
        },
        {
          "alg": "MD5",
          "content": "68df59e96f42071d650f645fdbff92fa"
        }
      ]
    },
    {
      "bom-ref": "27b8dc41-090c-4541-8ca0-501c1e913963",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/send_test_alert.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c51a4c8c1495ac11c71f7fe67eeb6a7f938f0b45"
        },
        {
          "alg": "SHA-256",
          "content": "cb52844c7a3a7f0b0fe07a447c099afefb10723164874e8d674df5ea6c3b00dd"
        },
        {
          "alg": "MD5",
          "content": "2e5e0ae7aa807cced53ae378dd63e2b7"
        }
      ]
    },
    {
      "bom-ref": "27c87110-acda-4223-b0e2-41003cf928ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/12670-138782.elf32_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "efac3506d36ec6a6138f725438b664febfb6a53e"
        },
        {
          "alg": "SHA-256",
          "content": "930d76ad14481df13fcc3bae767184b061e25aea986b955913b6e7f7f3e66ae3"
        },
        {
          "alg": "MD5",
          "content": "4796d6f349b3ebf57f0501e0219514ed"
        }
      ]
    },
    {
      "bom-ref": "27d802a3-e328-48ee-8a29-f072c9285b2b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65346e920c15b10b98b19db6c0a43ab6ab3e5636"
        },
        {
          "alg": "SHA-256",
          "content": "947ef52f1c25da5b0a1959b94dd4bb743b114b1486ac5deb6d4c0118299d2ba5"
        },
        {
          "alg": "MD5",
          "content": "900d1a5bf82539d8559099a96c5c110b"
        }
      ]
    },
    {
      "bom-ref": "27e7382a-47df-4e07-9507-8961f58d0fd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14QBH_PLUS_2U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e03b02db76338ce5bd46d9b44774d90d83b6b58a"
        },
        {
          "alg": "SHA-256",
          "content": "94ae8c901589209597b228a10229960e3dfec84363f341e7026270520faaba41"
        },
        {
          "alg": "MD5",
          "content": "b5efcefc4de1b8c7bd1a6dc6e4d720f4"
        }
      ]
    },
    {
      "bom-ref": "27ef2646-9ca0-4a01-8850-86fcb6c67007",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/configfs.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5dcbe97bc9341d6b5223920a813550b30105efaf"
        },
        {
          "alg": "SHA-256",
          "content": "5f4e2e94fa95a1277169f267cc014d51c0447af2884df2e7944ebbcccaedcead"
        },
        {
          "alg": "MD5",
          "content": "a6d35a9dca71945653c1d4ed431ac5d7"
        }
      ]
    },
    {
      "bom-ref": "27f40211-203d-4a56-920d-8cba32026bfc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ftpget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "27f7b90a-49ed-4a44-9544-f245ab4d2dfc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.userevents.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "60cce382835f862df71eca8588ab4dbc915cd0d8"
        },
        {
          "alg": "SHA-256",
          "content": "9f418b0a0e14356c7a0b5c04137fa18d3a2fd0bd7dfe3be1afeab500b1d92135"
        },
        {
          "alg": "MD5",
          "content": "2bd1c7461536c06410f73c763a3790be"
        }
      ]
    },
    {
      "bom-ref": "27ff6ba7-7f83-4123-bcc9-152412a30841",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap.so.2.27",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5aca88007e1a19f5070563540f4ca7cf7b520e31"
        },
        {
          "alg": "SHA-256",
          "content": "5015e9c038f83a6353b42a2117561d90e86871e1264fd1540a25880aa0aa94a0"
        },
        {
          "alg": "MD5",
          "content": "594271196d391be87977c3ab38209db3"
        }
      ]
    },
    {
      "bom-ref": "2824b1ec-df63-424c-9c78-ccac8a36136a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_type_erasure.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb2cf3b1e236bfd3f326e87220196185df60d742"
        },
        {
          "alg": "SHA-256",
          "content": "781cd33e987ec1dcf8f557dad3bf1a1f93f13419d775976c74ecf082619e6e2f"
        },
        {
          "alg": "MD5",
          "content": "d1c868e78a8d81cee15d17279ee7eb83"
        }
      ]
    },
    {
      "bom-ref": "283e4638-bf3c-49f6-95ab-b29a6b015493",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/loader.gif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b44c838f26bee812f88a7f03a875ad25c6c348b"
        },
        {
          "alg": "SHA-256",
          "content": "fdde182a355066ac032d5c58803950d0edc49b2d0cb5154659e3a872cc13f06c"
        },
        {
          "alg": "MD5",
          "content": "9d28b37105d3cf7f12bba323eb1f0898"
        }
      ]
    },
    {
      "bom-ref": "288453e0-b0e0-43d9-811b-a2f9b2df6d1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_mouse.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b6c8f1f087aa07e0d579c74ec842d63abfef070"
        },
        {
          "alg": "SHA-256",
          "content": "3eeb5274025125a3580f3fecae709bc659debf573cb5903b92824b08fe40ca5c"
        },
        {
          "alg": "MD5",
          "content": "2a6f78c73d2cda992e1a9c7a66c599b3"
        }
      ]
    },
    {
      "bom-ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ps",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "28995edb-a3e1-4ead-975f-9aeb0743f1ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib8.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "805af848bbc5e9e340b9865ed15fd9c315d4f731"
        },
        {
          "alg": "SHA-256",
          "content": "6ceaa9dfb18357cdbf52de3eb6ce786147ad74c8487d150cc286f2579b9e9114"
        },
        {
          "alg": "MD5",
          "content": "bc0820dc26f5d3dc091333238ec81651"
        }
      ]
    },
    {
      "bom-ref": "28a3a773-a24a-4889-b65d-7078d7edc378",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/vmd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8823aae540e0dff13bd8216cfcbe81b6bd85b478"
        },
        {
          "alg": "SHA-256",
          "content": "c7e5e0fd9e3495eda725378624f90f95fe9a60b5699a89e4493417d3ef3484c1"
        },
        {
          "alg": "MD5",
          "content": "7e08a1263c9428c307bc31a6ff0b5833"
        }
      ]
    },
    {
      "bom-ref": "28b1c794-9ac5-49c8-911c-411eab898a24",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmp.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af128c687767e91205934d52bd0f3126581e8763"
        },
        {
          "alg": "SHA-256",
          "content": "20a32d184cdcb4de2d74f130b5750e1a8059fd68f5c3427a9b7d300b48f6f2b7"
        },
        {
          "alg": "MD5",
          "content": "6833957a5759de319074a609c9be4c72"
        }
      ]
    },
    {
      "bom-ref": "28d39d70-62af-41ec-bb3d-a061af3e9807",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/lsattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "28f7ae44-73a4-4a5b-bd24-28bdc2ac0879",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_blue.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "18a6c8b5713610132088456eae5d4307684237ca"
        },
        {
          "alg": "SHA-256",
          "content": "76870032a9bcb1053578626d5d719be0493ca5f3b76626dca4e6cdd17ce1e825"
        },
        {
          "alg": "MD5",
          "content": "1b59a5ca2af1055ea90a9c2eb9e8e0ae"
        }
      ]
    },
    {
      "bom-ref": "23a99b03-dc18-4691-9413-0de4713965df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcFirmwareInventoryCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adcb51c0494d05dcd2dd3e157c028aeb0fc6ddc6"
        },
        {
          "alg": "SHA-256",
          "content": "72ad4237971964ce74aa8790ebee769f7662c4b5ed689144948b720adb1fce1c"
        },
        {
          "alg": "MD5",
          "content": "839c52725e6071091b67177be61ad3bd"
        }
      ]
    },
    {
      "bom-ref": "23ade486-3794-4c12-9a6a-bb4a645110ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fuser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "23b19a78-969d-401d-bee5-b31877e46c17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ssl_client",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "242773e6-0ea8-42a1-95f5-2dba6c8b0b76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_b.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "887e87bc0c7dea46da04653315237f3d87917ca9"
        },
        {
          "alg": "SHA-256",
          "content": "45a9459138fbb0c248136c6c92ce8b545027a4534243c6a643de3cf2b33101dd"
        },
        {
          "alg": "MD5",
          "content": "14156c01b15e6663be6b66160be1faa9"
        }
      ]
    },
    {
      "bom-ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pkill",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2436ae64-62e8-449f-bc9d-a0294b30c548",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "735cf681761b8867c21e1c7a8ee874585eef4c17"
        },
        {
          "alg": "SHA-256",
          "content": "8e953f4120e4b19eba5dedc3ed0a1611fcb502ef0852420c71c46375d9952d60"
        },
        {
          "alg": "MD5",
          "content": "ae92237db216ac142276af05624eb619"
        }
      ]
    },
    {
      "bom-ref": "243783fe-d8a1-44f2-9257-1f5eab6f67ad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/lightBulb.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ba3e9979d631926c7a71b5a348287bbfba8ca42d"
        },
        {
          "alg": "SHA-256",
          "content": "0e18c6e5f59b26ca93aad067bec8ba3635bed7b80b374c13b3b0a0e434757201"
        },
        {
          "alg": "MD5",
          "content": "57795e40d1569ed567686f369dace8cb"
        }
      ]
    },
    {
      "bom-ref": "4956ce24-ff71-42f2-bcf4-c7c122ac5de1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pldm_nic_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7b0a986ad9bf1243c3c7555fab8a154b9f85fe38"
        },
        {
          "alg": "SHA-256",
          "content": "cdf31ea13688aca13a4ae8065ca951546fa15eeaf031347a2c0462f2f8f82f44"
        },
        {
          "alg": "MD5",
          "content": "047d4240c71c2c69f24105e8e7fb2b06"
        }
      ]
    },
    {
      "bom-ref": "496e6955-3c18-4bf8-8bdb-b274d0015d2c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "371b33f10984809d79fd528d892aef9251c87dc0"
        },
        {
          "alg": "SHA-256",
          "content": "5cf3e0e975d54d2e6939bf789a954354d3f7500aad967028114c66c76bcd6ce8"
        },
        {
          "alg": "MD5",
          "content": "5736557c1d79e4fe9b749f1d4328ee02"
        }
      ]
    },
    {
      "bom-ref": "4974b59a-8578-4c2d-a4ec-a76ef427b75b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_15.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3e78807c451a1ce4f06ac5292c8f856609b706b"
        },
        {
          "alg": "SHA-256",
          "content": "d075b716c617c84c5dbd47ea5afb5de893f29f6b96dae3a2abeb40a7fbb5b53b"
        },
        {
          "alg": "MD5",
          "content": "0b954073b384c2cbbe1b2e3a9b5cadf4"
        }
      ]
    },
    {
      "bom-ref": "498a256a-5858-4312-b1f7-1c115488e24e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4d65435dab6a2831a6db586b6d402fd0b143032a"
        },
        {
          "alg": "SHA-256",
          "content": "f322f32a57ecad7d9af97432137ce85c307a68b07173cf07d7ede4a1012f7658"
        },
        {
          "alg": "MD5",
          "content": "91cd85e3a473ba7055d8745c887c9e24"
        }
      ]
    },
    {
      "bom-ref": "49b93dc0-1247-487d-b9c5-23555d58f29e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcObjectImplSwapI32toP32.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47ed41c128c0fcc38aab701db2ff658e2f40e2c7"
        },
        {
          "alg": "SHA-256",
          "content": "d4fc58739780efa7e3860be1c4c78e8fb97ad5eff109617da73edad28670d43a"
        },
        {
          "alg": "MD5",
          "content": "ba08e06e90fc7951a6f8e1b85ed52a9b"
        }
      ]
    },
    {
      "bom-ref": "49c1d847-32ff-4a14-a82f-ed655ed74603",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/msh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eaec822cc494594651aa552023bcd744296be97a"
        },
        {
          "alg": "SHA-256",
          "content": "6269136d9123fc72be0fe5912a0487c570176b958d6fe54f2f1b0e101f8afcfd"
        },
        {
          "alg": "MD5",
          "content": "d7aba87562b058805c621bd6b27f57b3"
        }
      ]
    },
    {
      "bom-ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/yes",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4a3afd91-e09f-4daf-800d-b40312f9873d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4adb5f90f49fc769311be2d0a902d5f625559138"
        },
        {
          "alg": "SHA-256",
          "content": "beee3e38658607f049d8975ce1fbff7178253711cf3d963d8497c8f0b211cbd2"
        },
        {
          "alg": "MD5",
          "content": "00fec03ff614ae9896ed6691b262cd0d"
        }
      ]
    },
    {
      "bom-ref": "2918a24f-745a-4712-a425-6b06e6cf1e47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcTemperatureExtensions.v1_4_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "17adb22ee884e00470ecd69eafd52c72876c4921"
        },
        {
          "alg": "SHA-256",
          "content": "e36460bf431f1fbcb99c72e5a3fd34bafa639d2eddf160da63ea60095bddfcf6"
        },
        {
          "alg": "MD5",
          "content": "3a4564e727133190b0bbc00cd1a6656d"
        }
      ]
    },
    {
      "bom-ref": "292f212b-7947-4d3d-aa18-ce757fb6ecf5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "043a4c98e3066a7946df844bf701b64173dd92ba"
        },
        {
          "alg": "SHA-256",
          "content": "a15998f457e0132cf140ef2cbc2386bfa760096292fd90ec535d05c04a4ba23d"
        },
        {
          "alg": "MD5",
          "content": "7ab656d009c31209ed59aa09cfa65baf"
        }
      ]
    },
    {
      "bom-ref": "294b82ef-52b1-458f-a414-c48dfd2184e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/iKVM__V1.69.23.0x0.jar.pack.gz_extract/gzip.uncompressed_extract/0-2314606.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "510e8b8708064328209c7abae66cc68c8eab61dc"
        },
        {
          "alg": "SHA-256",
          "content": "04770c95e9d9126a4b36ec3c34802be7c8f1e10c280db9153dc7e73764095161"
        },
        {
          "alg": "MD5",
          "content": "3cd6138332eca829cfac63aa2f1b200a"
        }
      ]
    },
    {
      "bom-ref": "298247ca-27c4-4731-9e83-a1b1efd88e65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/modinfo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "298ab732-814c-4b02-ba87-ccfd2518a8dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/bootstrap.web.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f094f010bfb0c022a51b62778d4361d1cad3fd6"
        },
        {
          "alg": "SHA-256",
          "content": "5c36e28c9a7bd864b673e223db7e1934923227536ffbdf871f58b6f09b9ac8c9"
        },
        {
          "alg": "MD5",
          "content": "a08792f518b51f0f1422b5c96df9eb8a"
        }
      ]
    },
    {
      "bom-ref": "29ac9de6-e8f8-4986-a09e-e71f08d01d98",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha256sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "29ae83df-1f25-40f3-8b3a-d9134542ea40",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrad.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1dcc8c63a1f81dd8fb505472dd2c7aaaeada2886"
        },
        {
          "alg": "SHA-256",
          "content": "b150eb70d34605ad251d5b6b307178f52e5439dc9bc7aad1dc687ddb17fb3bbc"
        },
        {
          "alg": "MD5",
          "content": "e8b634787c3c43c7dc95acdea592e88b"
        }
      ]
    },
    {
      "bom-ref": "29e311f9-5c82-4e2c-8475-b7de60d1adb3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/adduser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "29fbc12b-0207-4838-8454-7ff56b58f406",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/showkey",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2a150611-cb7d-41e8-8c99-0a582fdf848a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libphosphor_dbus.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb145fd3b2cad5ece16eb0314d0afa2315ed9551"
        },
        {
          "alg": "SHA-256",
          "content": "a8cba2a615ab81d61aa2e75e5699c2ce8e5d4644a8284b8afedd890dba4f0dbb"
        },
        {
          "alg": "MD5",
          "content": "48704cbe291d9b2bd55afc8fd8dad708"
        }
      ]
    },
    {
      "bom-ref": "2a1e3a81-2c99-4c20-950f-8968fbb06534",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit-bmc.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8aa1c84c0a933199644edbb3888723acff374333"
        },
        {
          "alg": "SHA-256",
          "content": "2afd30b75566f50cc478e13caf314b176d80ab10df83b18d482df0d95ed08f53"
        },
        {
          "alg": "MD5",
          "content": "1c4d5e2e456285c1b2def2d59f4309e3"
        }
      ]
    },
    {
      "bom-ref": "2a2201f3-201a-4bfb-bde2-03806fac0d59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_conf.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "27eaa4a7cb5106d388ae29aaf33723e640aeb1a9"
        },
        {
          "alg": "SHA-256",
          "content": "387ab80851337bb67a2fb6c641014dc501bf83feb7d8c21478a1e35a1bd75e30"
        },
        {
          "alg": "MD5",
          "content": "c88322181f051c91e7821cecaa82b376"
        }
      ]
    },
    {
      "bom-ref": "2a26ad27-f204-4b29-9ba7-dd0433208289",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/usb_f_ecm.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fa5f029e3283585a75669c179e691ab21d87a7e0"
        },
        {
          "alg": "SHA-256",
          "content": "c33bbe8bc3f268e5ec0326f47b435f9a9b4998b5648ef150a9d9cf5d7b8bb7db"
        },
        {
          "alg": "MD5",
          "content": "5bcb345242dcfb2384f62a367c18b685"
        }
      ]
    },
    {
      "bom-ref": "2a2805a4-5486-4715-b472-460b58dd0f3f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unlzma",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2a29f838-ee62-4604-981e-a89866061698",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/slit3combo_bmc_conf.ini",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e649500a149f922fc417cf0791a5d46b79cbb962"
        },
        {
          "alg": "SHA-256",
          "content": "d7a58da2a8fbe955ca7f61c9c92fec8313e0112181a2fe57b4a716df0961d7ab"
        },
        {
          "alg": "MD5",
          "content": "ab9f631f45e062281ce248fae64cea8c"
        }
      ]
    },
    {
      "bom-ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unxz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2a36a303-d635-4de1-8dc4-f794c40958c8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmThrottlingStatus.v1_1_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f57a7c1c36d3016dc0e73dd7f47098c17b16529"
        },
        {
          "alg": "SHA-256",
          "content": "43411c00479f6f4d2db5dbcae28c2c3efe2d44d66075e65f61b04c700252af73"
        },
        {
          "alg": "MD5",
          "content": "cc5ca2d14626ef3880dfc5b638e3dd44"
        }
      ]
    },
    {
      "bom-ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/login",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2a4cc5de-288b-4c3b-83ef-4d64b63e0d68",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/prev.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab23e3db54504d185bb92f6be7e02ca9027942ae"
        },
        {
          "alg": "SHA-256",
          "content": "142173f72d266bcde860517999463fb416671346a0f35ef1314993d8f55318f0"
        },
        {
          "alg": "MD5",
          "content": "e998687c9b51db05bdad5d3b7a1b7d71"
        }
      ]
    },
    {
      "bom-ref": "2a52e25a-16f5-44a1-b9e8-cb035123864f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/hwclock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2a5b62c1-279e-4e81-9310-4dcd34cb1ad1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SNMPv3_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57b863344fd7ac67f70cbe26d7b13e72737916bd"
        },
        {
          "alg": "SHA-256",
          "content": "58db18ded4b8650a9c261ec275937a56c4e4709cd81f0f7508d7e11aa14db316"
        },
        {
          "alg": "MD5",
          "content": "e9ee3685fbaa8a12d5cfb0636cd2483a"
        }
      ]
    },
    {
      "bom-ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cmp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2ab0db81-b144-4638-8754-76d62ebd37e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamFreq.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3431d35cd287397e9ff390ddf5859fd63b2815f4"
        },
        {
          "alg": "SHA-256",
          "content": "6889592454499031fb18ba8e8a1d9ccf8ef77861b87922163905c5ee296a3c2d"
        },
        {
          "alg": "MD5",
          "content": "080b49f3da742e8fbf1ad7cdfd244842"
        }
      ]
    },
    {
      "bom-ref": "2abeb926-9e38-4871-bc41-994b402bc64b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/utils.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1dd8cf410449c1f074903d2bb1b075e746ae3c49"
        },
        {
          "alg": "SHA-256",
          "content": "0bd52acf01a726ae63dc36034814093e94d5eacbc7f4a296d69b53ff88e2af15"
        },
        {
          "alg": "MD5",
          "content": "8b9b6696a6a3fd628dddf2a320300be6"
        }
      ]
    },
    {
      "bom-ref": "2b036b18-6658-47ac-a258-ff8b2bd08327",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4d8c2c37dbdcf83d1a34e55c5d4b940d0906e86"
        },
        {
          "alg": "SHA-256",
          "content": "f1c8067ef065418452fd1bfec94082185f2fbeb714df18a3eba5626d23a4e82d"
        },
        {
          "alg": "MD5",
          "content": "ed9c6a46061df3eb6bd1cfbfd8184084"
        }
      ]
    },
    {
      "bom-ref": "2b0eaec2-8448-4743-8e24-3f5ba16db09f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLogEntryExtensions.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d515cac33c6db74ac1ffc6c4c1cd229b3e7fa99c"
        },
        {
          "alg": "SHA-256",
          "content": "edbc7f2881d7bbdfb4a0d210ec11d3c24dd37f1fba0718dd0872ebaba8b3ddbe"
        },
        {
          "alg": "MD5",
          "content": "e64efe4b5e5dfc90c9864cf836b91aab"
        }
      ]
    },
    {
      "bom-ref": "2b222773-bd8e-4491-a803-b4ab6e0e2cea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_chrono.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e8a8fc922078f47a9e30401e7c44637b43b0443e"
        },
        {
          "alg": "SHA-256",
          "content": "47a283ef1644de938d4f41888fbab80e9759dc1974e376e0975f7f119b66e34b"
        },
        {
          "alg": "MD5",
          "content": "14c865699735bf917a3bf81b677befb6"
        }
      ]
    },
    {
      "bom-ref": "2b242495-1106-4f57-8660-a0f475969daf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af7ac33ec911f324f52c412ab027271e5a82803b"
        },
        {
          "alg": "SHA-256",
          "content": "b3451b523cc7f763fd33a3516314c985a66381935a453486e11e9d226d476bfa"
        },
        {
          "alg": "MD5",
          "content": "fd47a4a7b97ff03a044434467a9e8b85"
        }
      ]
    },
    {
      "bom-ref": "2b2b5048-5d70-423e-82ea-b2180d2d6a95",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/md5sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dpkg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2b5e7652-4309-494f-ba21-779ccc189097",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/ActivateLicense_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbed3d0615c2661a24acedf1f54952f32a091fd1"
        },
        {
          "alg": "SHA-256",
          "content": "4f03e4782dcd3577ca811bfc33e204a493a849a62a51dc09fa117566c8308bf3"
        },
        {
          "alg": "MD5",
          "content": "6f28d41f0873b531283442807d6be15a"
        }
      ]
    },
    {
      "bom-ref": "2b72a4e1-2d47-4e11-98d5-d80443a61183",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInternalProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "193e06cd6f150a382fa4ee18092169da64280d82"
        },
        {
          "alg": "SHA-256",
          "content": "8cd4f983d78cb9b3d5ae38c729738685e960030221c60be2bc7f6c3fc0350cb2"
        },
        {
          "alg": "MD5",
          "content": "15816d6cee8e8ef0ced6ef426e13d452"
        }
      ]
    },
    {
      "bom-ref": "2b7391d6-4a01-4e33-bbf4-697d69a83344",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iplink",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2b8249e4-5483-4d58-b509-576d5781cd8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libblkid.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6924e36b26d4a18ad85ff5efc8b2599126bc5d27"
        },
        {
          "alg": "SHA-256",
          "content": "70e7d7361cf32604ebe40438d15c7ac8afcfc94bbdf8b6a4431efdbf7e072afe"
        },
        {
          "alg": "MD5",
          "content": "22be4e7ec1ee523348903a02d5911b6c"
        }
      ]
    },
    {
      "bom-ref": "2b86fad9-d9bc-43da-8b3d-ac2605f68d76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libncursesw.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55b66ccd8da167daf41d414d744a00c955521a98"
        },
        {
          "alg": "SHA-256",
          "content": "754754d03109b9f4b9d75f0b3747407950438ff8e8ccb273c4ad259c6790ca0a"
        },
        {
          "alg": "MD5",
          "content": "413eedfb568f275881c8918c4c02726f"
        }
      ]
    },
    {
      "bom-ref": "2b95e539-4ad4-4df8-8989-b98779d1d8fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42232c50d44c8b12249cbf77691c2df4fe0b3988"
        },
        {
          "alg": "SHA-256",
          "content": "90ad9e55e7be5dff41fb57896da04cc9f9fc5b0535745d26a661fff69b02796b"
        },
        {
          "alg": "MD5",
          "content": "899f08bb4d634b961349bcf0da0607aa"
        }
      ]
    },
    {
      "bom-ref": "2b9d4229-f277-471f-a4e2-32025a3aa623",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmphelpers.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49d62cdda243fadbec3137e026ddd2d482ccd737"
        },
        {
          "alg": "SHA-256",
          "content": "c741126818136030140883ea22b587536fd7e14ab72b66561a481afab7a8de1d"
        },
        {
          "alg": "MD5",
          "content": "61b0bca771c41ada0a3c659f0a0851d5"
        }
      ]
    },
    {
      "bom-ref": "2b9eacda-1527-4912-a280-f562935d7078",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCertificateAuthentication.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64f619082e9cfd6078c495df4d8891d9deb45e1e"
        },
        {
          "alg": "SHA-256",
          "content": "99f13f1c597f53167d043b5d183c44cad366e1fc41c4770cdceb86d9e8e29413"
        },
        {
          "alg": "MD5",
          "content": "2a98c029aeae7b2fd15b1b96905c5559"
        }
      ]
    },
    {
      "bom-ref": "2ba0a19d-0af5-4f2f-9d63-8c8575120fdc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ntpdate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c1a3d0e0109d3894bc527379bde1497dc5359c14"
        },
        {
          "alg": "SHA-256",
          "content": "f9e8add01c3b37d450e2440bb1e427af1ec08088be2194092f5b5b1619ff0890"
        },
        {
          "alg": "MD5",
          "content": "0a1c96b68347bc4a6d39eb8e2dbaff29"
        }
      ]
    },
    {
      "bom-ref": "2ba5326e-4db3-4687-bf74-1f7151b41e18",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_openssl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f631fc2a59f12507fb576e3e7054ec163872efc0"
        },
        {
          "alg": "SHA-256",
          "content": "c4b6e370e64cce84bb5bdd5470b6922837615b5e889e554ccdbb24726f3ff96b"
        },
        {
          "alg": "MD5",
          "content": "16919b70dfd4da9fef82aa243b3a824f"
        }
      ]
    },
    {
      "bom-ref": "487879c6-5ce2-4761-8c1d-8e3c01f84087",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "587818005f84e80d113ba562f88ad7a138bb36c4"
        },
        {
          "alg": "SHA-256",
          "content": "d8cc5479a6baeee84899b4249bde0444c74018d3ea995c6f07e4604d76132bd5"
        },
        {
          "alg": "MD5",
          "content": "7436507e6d00732e757975290d412d83"
        }
      ]
    },
    {
      "bom-ref": "488422ee-ad5a-4941-b934-ae855ab1054e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/insmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "48b7b1ac-09d1-4b6c-babe-f9be1d6ab88a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcGPUExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "46578ead5cb07e1fb841547218bbf1757d406ae7"
        },
        {
          "alg": "SHA-256",
          "content": "e04270440804caf59dba34e3715869d2b5af78b8fbf3205b16f8f19379646f06"
        },
        {
          "alg": "MD5",
          "content": "008e0bdb597451f3f6de64a7c98d1402"
        }
      ]
    },
    {
      "bom-ref": "48cf91df-34d4-48dd-bcad-785bbcf37559",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/route",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/true",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "48dbba5d-577d-44d9-8320-87c77dff7aa5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/KCSInterface.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3278a0b847615f030e6b87f9cb71616b96bf4a3"
        },
        {
          "alg": "SHA-256",
          "content": "ce3ffeb84688002ef8e9b666f68279868ee813d2a49b15485128ab22657e8869"
        },
        {
          "alg": "MD5",
          "content": "58abcf0861881fee4d4bb6d2f99a4074"
        }
      ]
    },
    {
      "bom-ref": "48f36d50-c9d2-47e5-bcad-10b45d09dde8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/eject_insert.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d98b77030b50d6a87cfeee8aee44b7278a478d37"
        },
        {
          "alg": "SHA-256",
          "content": "92b1bac4c75a71c98bd3d9f3786d05354077e8a6606356111901cfd27d13669c"
        },
        {
          "alg": "MD5",
          "content": "2692061a5d21a089b0f91d13f82bfed2"
        }
      ]
    },
    {
      "bom-ref": "49035b95-bef4-4a71-86de-25ab8c2b0fd5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/PCIeSSDTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "774534b7001d0d1a5c4f2d2a605aa5e493ac9201"
        },
        {
          "alg": "SHA-256",
          "content": "eb38ba5a37e4f871bc5ef2187a8625dac6aa224469eb142331b353e9e4480f7b"
        },
        {
          "alg": "MD5",
          "content": "c2b0fefee88ef5a6ef002fea91fb54c0"
        }
      ]
    },
    {
      "bom-ref": "490f9bec-0105-4a8c-a42e-afa88a77159a",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed_extract/10014720-10017492.elf32_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2684b5b45abdfed5901e654ebc17ed1b64566821"
        },
        {
          "alg": "SHA-256",
          "content": "a805c57079b14d572e1b6ee3622c8a334801f3681715c122c7efeb4ec1519797"
        },
        {
          "alg": "MD5",
          "content": "816b85ebaf7daad323a1ef52b23ebe9d"
        }
      ]
    },
    {
      "bom-ref": "4926f177-0c71-4869-8f8c-261617b81c22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/arch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4a513490-9b4f-4fd5-ada5-698590cf995f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/spdm_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "befd03b5d4445d732d82ecb43c180e16cdd4feb7"
        },
        {
          "alg": "SHA-256",
          "content": "72431e453c3095058741134b6c254f0efaa74ff73fd2c946815b40f2b20cc9d6"
        },
        {
          "alg": "MD5",
          "content": "6c5e2498d80a7cb240b6c853a856f841"
        }
      ]
    },
    {
      "bom-ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4ab5d118-4285-40ac-a844-c7cd6d1d5762",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/tab.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90fbf8a9a9218256693f06250a24d4f8662372db"
        },
        {
          "alg": "SHA-256",
          "content": "3fe6253b41d639e26d6d2eff3ad6ae330da7497252802d32fe9bc888371ef70f"
        },
        {
          "alg": "MD5",
          "content": "7ab8f5ef9e397264257aeab766aefae3"
        }
      ]
    },
    {
      "bom-ref": "4ac46406-f7e0-4b90-aad3-df380e92f3da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/CupsService.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbf83340b45a1216f68817d8e1b67c6e4a82fb2f"
        },
        {
          "alg": "SHA-256",
          "content": "d30dc5374c19244ad944e302807fe7eb1ff6327b2b5d4d967b3871f4dbc49304"
        },
        {
          "alg": "MD5",
          "content": "79b826cd382b5cb8f0070cb225110701"
        }
      ]
    },
    {
      "bom-ref": "4ae519fe-1707-429d-96b6-74b7eaa75329",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "08c09d3b7ff326ef93383c6b769d977d6b95823b"
        },
        {
          "alg": "SHA-256",
          "content": "9cb0ff677cd6c72cd9187f344b1d86bdcea0255443a1e15cb3c9dc2a35df0bc2"
        },
        {
          "alg": "MD5",
          "content": "bd09b4ab338871e505f90ed70cf70f0e"
        }
      ]
    },
    {
      "bom-ref": "4aefedb0-4e17-49a9-9c10-203bd7cb84fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmptrapd.so.40.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6dfd0fa8c33f4dc4ecc941a315e7171e597d8829"
        },
        {
          "alg": "SHA-256",
          "content": "148329f9d341476e2ba4e1e4b961958d75c91e00b0f1cf72cf714fc990a57104"
        },
        {
          "alg": "MD5",
          "content": "e8cf3f5545c33649ff13723e0fd0facc"
        }
      ]
    },
    {
      "bom-ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/base32",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4b037be0-4aca-44ef-811e-1c1f677de0a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tail",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4b25316a-7efc-4e44-ac67-8d747bdd3c6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/alt.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ced85343a93c6b28d2d1ff5ab160397a1c975ca"
        },
        {
          "alg": "SHA-256",
          "content": "2d30469f43f699c1788d0994ed2a42a7a4c0ac8facd6379e4e783b5623771ee9"
        },
        {
          "alg": "MD5",
          "content": "103f2b6c5a45155e692aaf2852b4fa28"
        }
      ]
    },
    {
      "bom-ref": "4b260d72-219a-4fdb-af04-5a42658e2aa8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3055b670eba5b0d3549b42e7a1fbb37472bc59f5"
        },
        {
          "alg": "SHA-256",
          "content": "9d0b09f58e0c7eea2d344b14b87100a10ac6bba892477c2074f70d07088d556e"
        },
        {
          "alg": "MD5",
          "content": "ef2ed8ed0f10211a6bf7e720c7ae0517"
        }
      ]
    },
    {
      "bom-ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dbus-uuidgen",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e8e944ad8315edf7c8b245d0d31c2684268cf604"
        },
        {
          "alg": "SHA-256",
          "content": "f57e237b79a757cc135bf1b74c4d6e2012529b956b2d1837d77bb220097598f0"
        },
        {
          "alg": "MD5",
          "content": "3ab358235d34af28abf6aa4552112b2d"
        }
      ]
    },
    {
      "bom-ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ether-wake",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4b51c6a6-330d-484b-80fb-457239059428",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/[",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4b53b9f1-4dff-40b4-9286-a9523ecff1f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcjson.so.1.7.15",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c5a68db031971bfcbed5ccc90093e7025003ed9"
        },
        {
          "alg": "SHA-256",
          "content": "02f960883b401869eb7c690256ae7849bce7ae91a4e85f1252a9054b3cf7297f"
        },
        {
          "alg": "MD5",
          "content": "c2ab5fb4e45119a52538b1877458f239"
        }
      ]
    },
    {
      "bom-ref": "4b53ea67-5590-4e90-b393-1ddfe1d634e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamCtemp.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5efaba65ca574569c37e10188f34b079e48d77ab"
        },
        {
          "alg": "SHA-256",
          "content": "911b74582219ed631836b7b2f55d435d16a7fee65eb1891226da6b62cee57f81"
        },
        {
          "alg": "MD5",
          "content": "ee5f33139f0ddbafd19a123803ba2540"
        }
      ]
    },
    {
      "bom-ref": "4b795b18-7bd1-43ce-9e50-cd947ef1f6fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_16.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb4db55b8b25ecf2f3f3f016af4e9048ff2cf66e"
        },
        {
          "alg": "SHA-256",
          "content": "ada5163549cff9874195be313fb215613b8dcf38bb421356e1cb703b58114258"
        },
        {
          "alg": "MD5",
          "content": "32fd103d79fc49ad23ef2e27cecb193f"
        }
      ]
    },
    {
      "bom-ref": "4b927001-482c-4235-945c-9ec20e660056",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpthread.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "915ac7e151ca64d9e4b58e55665b128cd5154b64"
        },
        {
          "alg": "SHA-256",
          "content": "d6619e6cf1e137845d8ffbdbba45ae72454a8af4f530d32d669efd9c2101d446"
        },
        {
          "alg": "MD5",
          "content": "8799d69e5c55a5c407a80a1118b62464"
        }
      ]
    },
    {
      "bom-ref": "4ba2a7b7-4098-4f12-abfd-60d52aa52e11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/clipboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c61527ce1960ee1ef06718e3f309acb07aa5459"
        },
        {
          "alg": "SHA-256",
          "content": "d3a4542b8f8bac628159b8c8ac99389148fc2d63fa127cf9ecce69f5d38a6997"
        },
        {
          "alg": "MD5",
          "content": "6f8349914d649bcd6da6071f149b399f"
        }
      ]
    },
    {
      "bom-ref": "4bcbacda-6ca3-47a4-9a5b-bd767d49cb5a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libotp.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b23a5b832c38984bbc76bdaa1483047f3eab1bdf"
        },
        {
          "alg": "SHA-256",
          "content": "7333c376e846c9199905c87ac6b73d9895165b61b3de6250109e757e67affaf1"
        },
        {
          "alg": "MD5",
          "content": "9233b1234133ddf29bcb35634e47765e"
        }
      ]
    },
    {
      "bom-ref": "4bd1d2e2-7fe9-4659-a181-3b607b8b0561",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/route",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4bdac274-9fff-40e9-ad52-c75d8127488e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/reset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7b002a11dbb2c94323600fabd394fe884839057"
        },
        {
          "alg": "SHA-256",
          "content": "3800e7bb7536bf05532a400d971bcc261222009a4fcbaef9b465930a0278e265"
        },
        {
          "alg": "MD5",
          "content": "32cc215eaa6aa5b8f6b9cf86f6a907e5"
        }
      ]
    },
    {
      "bom-ref": "4bdb24a2-22e7-4261-9808-9da9b5d3d8a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "345ce50a84209d507de24d6937ca467b43cf9b60"
        },
        {
          "alg": "SHA-256",
          "content": "3a645d4965f8e73b37949514aa3c14ec0a2bff62a65cb392e927d8973e09c277"
        },
        {
          "alg": "MD5",
          "content": "0e79df4890f4368effea69ebef86e67c"
        }
      ]
    },
    {
      "bom-ref": "4bfc69be-2cca-48bd-9356-2989585debf8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/getSmartNic.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec0f7c7cb9c32c4130caf0dfd06fe1f64602cb5"
        },
        {
          "alg": "SHA-256",
          "content": "2a31f700f2816389d36b78c5f92cb04f35bbf7e16997cba02a3fecc38e2f8f4b"
        },
        {
          "alg": "MD5",
          "content": "4e0ce772d9ffe41cadf1bce2dddfaec2"
        }
      ]
    },
    {
      "bom-ref": "4c2f80e1-f0b1-4f90-981e-45fee2f412bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/svlogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4c3a46e0-5a68-49d5-9fb1-a27a56ae77ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libseccomp.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b8f9675b28eee5b9209016202e99521b8dbee63"
        },
        {
          "alg": "SHA-256",
          "content": "c7d486f08fbc0bc83a84c832782046efd36404e79d0ff0fd07ead998fad2e9b7"
        },
        {
          "alg": "MD5",
          "content": "ace8e2060e80f8e16b24ac6603c8d7af"
        }
      ]
    },
    {
      "bom-ref": "4c41e368-b432-4b6a-a733-16f6eb832a0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_fiber.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1adc0a110e6606ccf6e07304102a4213932dce2c"
        },
        {
          "alg": "SHA-256",
          "content": "c17f036de610684d0f4c11ff8314da143d8fb8d585d1d97b19ad9a28d5595071"
        },
        {
          "alg": "MD5",
          "content": "27ca482dddceed8e574c492c9864e5af"
        }
      ]
    },
    {
      "bom-ref": "4c426a46-dbdc-404c-94de-444bbbaed7e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderGz.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "187df00a5e28837d94f3750d248faa7930ed8f85"
        },
        {
          "alg": "SHA-256",
          "content": "63fd072e3c310548b79af8b45de527918107e76a5d05f21ca5075b914d643a42"
        },
        {
          "alg": "MD5",
          "content": "8d83ea6baa58afdfd3349c95691adac7"
        }
      ]
    },
    {
      "bom-ref": "4c68c19f-521a-4971-82e5-c910ae65a166",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/group",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5bffc5a4154f7d0a9216c0dfb105b1bdd98db426"
        },
        {
          "alg": "SHA-256",
          "content": "f0f23c1a5d13be3936ef4de198ea11c2e8effcfb1e9facf40e49b4c93664e63d"
        },
        {
          "alg": "MD5",
          "content": "958b54a7fbaed6c06f5625cbf24c1f7d"
        }
      ]
    },
    {
      "bom-ref": "4c706c35-94de-41e0-b593-ed33930f61d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_crash.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7e23cf6ae3790b2b9035e9b983018e55ff2cfb3c"
        },
        {
          "alg": "SHA-256",
          "content": "a6afbf6645a783edc2be83a18239b15c03358da0cf4a5e4b2146884ed377572f"
        },
        {
          "alg": "MD5",
          "content": "44ce760d5ce2e608559a27b9de7d391a"
        }
      ]
    },
    {
      "bom-ref": "4d041a58-f47d-400e-9419-f514b926b7bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/Threshold_Sensor.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "19158405eacd6e4adf10fb2376361652fc16296e"
        },
        {
          "alg": "SHA-256",
          "content": "f3ed6098403fb64d26b6f72beb3920a0a5dec47dcb8a4d4a77f603e20a25e811"
        },
        {
          "alg": "MD5",
          "content": "0344010502b74c61cb1ee9b701f4443a"
        }
      ]
    },
    {
      "bom-ref": "4d06a0b7-5b8a-467a-8943-75a729864023",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/reformime",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4d2a5794-afcd-4a82-b379-3729e7cecc4c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_lan",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "251d5ac159524cf58bae0e89c23f2ef0797d1c63"
        },
        {
          "alg": "SHA-256",
          "content": "e56c3458540ed3254a4ee6ac6e930acab1c0dfddaf0e346242c4d8887fda60f4"
        },
        {
          "alg": "MD5",
          "content": "55ab3da6b2cca40bea95a4adf88284f7"
        }
      ]
    },
    {
      "bom-ref": "4d518faa-22fe-4a3f-9d0c-9150c2f0a429",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/user_dropdown.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "04574360b7956a4d397d9cbc3afa554d57fedb73"
        },
        {
          "alg": "SHA-256",
          "content": "326ada2699dc943552ef27699a9867563fa85c13b785639e72734d16240e1997"
        },
        {
          "alg": "MD5",
          "content": "feefaf161a57fff253b74dbc56fbbf18"
        }
      ]
    },
    {
      "bom-ref": "4d5c7067-7b01-4ac0-abc9-33a715d6c8c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power_p5.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6f88bb881bbf6ae9815ee99b2f66151796cf26e"
        },
        {
          "alg": "SHA-256",
          "content": "ec015406d83fbf20aa77c67332b8125c35cc83e956e3315cf336ede5dac781c7"
        },
        {
          "alg": "MD5",
          "content": "a44400c749e9dfc9b31434331d337e43"
        }
      ]
    },
    {
      "bom-ref": "4d726a57-23d4-403c-9b3b-7fc6e84d0293",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5aca88007e1a19f5070563540f4ca7cf7b520e31"
        },
        {
          "alg": "SHA-256",
          "content": "5015e9c038f83a6353b42a2117561d90e86871e1264fd1540a25880aa0aa94a0"
        },
        {
          "alg": "MD5",
          "content": "594271196d391be87977c3ab38209db3"
        }
      ]
    },
    {
      "bom-ref": "4d9b1855-a8de-4fd6-b5af-9fd0969eadc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logout_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6db468d8197533a99df515277cb5f2aa8e9e9427"
        },
        {
          "alg": "SHA-256",
          "content": "1492224ae898f7da9bb4c2ccb986929cb724fc282e5c67b2d9507e37a3e0b9f6"
        },
        {
          "alg": "MD5",
          "content": "90df554e7a19fe96affa66f5bae9475c"
        }
      ]
    },
    {
      "bom-ref": "4d9f2895-f208-4718-a088-9a739285e1ff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/alert_edit.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5957d332fb7fcc9398f3a22d8642eaf2f73a4db6"
        },
        {
          "alg": "SHA-256",
          "content": "0217245f355ae0cd00c6533e5b35ec2a1b74e16d3dc2a422077d15b33ac164c1"
        },
        {
          "alg": "MD5",
          "content": "3c6c2791535f8ebbc30a69f18f8d5a80"
        }
      ]
    },
    {
      "bom-ref": "4da5400d-d250-43f2-ac20-7a44fd8ffb27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamVoltage.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e5979da978ba1014abe6a26d129a5bcb9ef68f1d"
        },
        {
          "alg": "SHA-256",
          "content": "b0d27def645869019cba69df5bfca1d9978726b110b24ee6ee81d659527c784d"
        },
        {
          "alg": "MD5",
          "content": "55e1c52999da7dfb7c9fcd74fc4a8bdb"
        }
      ]
    },
    {
      "bom-ref": "4db1e9b5-ae99-4a7a-91f0-bea84bf5c280",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fsync",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chgrp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4ddb5a7d-bc6c-48b3-8370-0722a29ed008",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt_mit.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "4de2153f-d017-4943-bf58-5c9aa3ca9f8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/annotation.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "94c99e14a653f4c9fcb5a27d2f4370ea6d665ef3"
        },
        {
          "alg": "SHA-256",
          "content": "66f412e284ac270abe7179a863c849a72273637833037d3521fba7d34b326c41"
        },
        {
          "alg": "MD5",
          "content": "2a09d642dd5ba64e82eebaf65b894611"
        }
      ]
    },
    {
      "bom-ref": "4df94226-f9a5-4621-b6d1-3863c4bc60e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmPolicyCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e8dce99bf0b2b9142e9e1d8e4abf27429aabc72"
        },
        {
          "alg": "SHA-256",
          "content": "c795cd7837a29b1313aace8a4d3dacf552f2a2d2a65710edd31254653b9c13b6"
        },
        {
          "alg": "MD5",
          "content": "5fa5fc06d83d5d067f09ee4015ce7721"
        }
      ]
    },
    {
      "bom-ref": "4e52c62f-321b-4f33-82fd-6e712a90d172",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_access.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "649f5d32fe22002565c57f7a146976c6a8760e87"
        },
        {
          "alg": "SHA-256",
          "content": "f186412aa3640fbc7fceae3498138f6dd4d87c2896558f9ef3a4a4738357dd0a"
        },
        {
          "alg": "MD5",
          "content": "7e2ac56eb296abb14dab1af0419c2edf"
        }
      ]
    },
    {
      "bom-ref": "4e5403fa-c568-40f0-8185-188e9e1de442",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_SoftwareIdentityProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52ff9c90f6d075f98340b80e2833a272233ce794"
        },
        {
          "alg": "SHA-256",
          "content": "f07e5df88c0195d756213dd8cdd4b254e679b871debe678da5b8ba74d3dfdd41"
        },
        {
          "alg": "MD5",
          "content": "5e8316a714a9aefa5d985d4f36ed026b"
        }
      ]
    },
    {
      "bom-ref": "4e6b6558-37e3-4c48-8dfa-5f330dcb3a54",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCertificateAuthentication.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64f619082e9cfd6078c495df4d8891d9deb45e1e"
        },
        {
          "alg": "SHA-256",
          "content": "99f13f1c597f53167d043b5d183c44cad366e1fc41c4770cdceb86d9e8e29413"
        },
        {
          "alg": "MD5",
          "content": "2a98c029aeae7b2fd15b1b96905c5559"
        }
      ]
    },
    {
      "bom-ref": "4e8751cd-10e0-4e03-bf00-1e0735e6dde5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_url.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a99aac8fa96f2af054bc5197d82d7d80fd2c1c5b"
        },
        {
          "alg": "SHA-256",
          "content": "8b78ca66e41ffede8c4f7acc54d4f07a304d3d64609d18558762d7efdbd40c98"
        },
        {
          "alg": "MD5",
          "content": "154555e8ceb090e5ab49b391e8e35a85"
        }
      ]
    },
    {
      "bom-ref": "4e973590-af2f-493e-84fa-44a5030ac36e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/lightbox_pause.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d4a2bbe6a3ddf1c6a2d409f1ac71564bfdab909e"
        },
        {
          "alg": "SHA-256",
          "content": "b39364b51151dff2192087f5e6891cf79a8d421ed207f7c7aeda91e03eceaf8c"
        },
        {
          "alg": "MD5",
          "content": "24adaaf885f1f66254f008a6dd4ba909"
        }
      ]
    },
    {
      "bom-ref": "4e99a9cf-91c0-48a2-8228-bc48a76a308d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_staticfile.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "130b6223b5b213f06783550428d7e0e9005e6869"
        },
        {
          "alg": "SHA-256",
          "content": "6c9ab6b5600b50d891ffacbe51517cabf554136ab65901dd34c8c023e0f0211d"
        },
        {
          "alg": "MD5",
          "content": "2ad72bc28446ede53fbbf99c794b7412"
        }
      ]
    },
    {
      "bom-ref": "4eb6612a-dea5-4289-856e-dccf7187a97d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/side_pause.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97a118699ba97a4e5091523383391d3ea54f51bb"
        },
        {
          "alg": "SHA-256",
          "content": "07f3ccf448c8eba42f472d559d69626aa715c83703fe6ae53a70d362f2bf4b2e"
        },
        {
          "alg": "MD5",
          "content": "4b915c0d6bfd3eae0658a01f3f3cb590"
        }
      ]
    },
    {
      "bom-ref": "4eca0355-2c07-4674-aa93-4c683bc56192",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libSFCC_API.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4ea24ea703fa91785076d513cee6cdbca2cc2e0"
        },
        {
          "alg": "SHA-256",
          "content": "816db77d35c5ab7237f62e6809314735ba5a1f1b917090afa3802cb42e6413fe"
        },
        {
          "alg": "MD5",
          "content": "030c88c0a41e6a45128e8b505c999999"
        }
      ]
    },
    {
      "bom-ref": "4ed555ad-3f5b-4fc2-a221-89654b41b558",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4eddb031-308d-40f7-b374-d821b9c28425",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libspdm1.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "789bcf982bd3520700875ec8f64bced03a728c2a"
        },
        {
          "alg": "SHA-256",
          "content": "7ca7f276f5b2141983a8998e7c8f84975215274519e18f62ee6732bc5a4ee5eb"
        },
        {
          "alg": "MD5",
          "content": "58b4efe2f6ab23a7852c00cddabb1a80"
        }
      ]
    },
    {
      "bom-ref": "4ee1c5ee-20e0-4611-bfed-a9bbf84f10ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpiodetect",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ecf2665321b93d7dae71f6c0476603603a6ee980"
        },
        {
          "alg": "SHA-256",
          "content": "75b37d0e20fcf044ebfc2d0cf98a23db7d6fd6210fbbeada72e6fdbf939c41fd"
        },
        {
          "alg": "MD5",
          "content": "a41bd8d53be9b0a029afa5867ea3513c"
        }
      ]
    },
    {
      "bom-ref": "4eed2588-ae8f-4890-b89c-76f5881ae792",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3019e7f0ff40df99c86c87d12efba315ec97cace"
        },
        {
          "alg": "SHA-256",
          "content": "8480d20fcf2b91198e55a4713927e61be4042fba1f9041538927902b41e79076"
        },
        {
          "alg": "MD5",
          "content": "a459a1531a5e727fca55b9ccb1967f31"
        }
      ]
    },
    {
      "bom-ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nologin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4f018da6-7fd3-4493-8d12-65eb75d258bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/dashboard/consolePreview.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "366b00c9b6d0b6c118a3b496e2fb6353c8a497f4"
        },
        {
          "alg": "SHA-256",
          "content": "715365076a28a10d7ddd7935cbd5fe46e9911c27d3f511fde187737f4beca99c"
        },
        {
          "alg": "MD5",
          "content": "c88651c8180344dce74aa6c83e46ce21"
        }
      ]
    },
    {
      "bom-ref": "4f01c2c8-c9cc-4fb9-b13c-52a9fb647390",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_19_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c63e8533cc192ab74dd8a478ed879624d9ee013c"
        },
        {
          "alg": "SHA-256",
          "content": "a8348d3fa2185830d0ff36b3c17f1957b909f84f9a5952aa178654c0d62ed2fd"
        },
        {
          "alg": "MD5",
          "content": "47d771440b9f449b1efed833e5beeaf3"
        }
      ]
    },
    {
      "bom-ref": "4f161b93-49e3-4e9f-b90d-ca43a0c3e196",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_17_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "065eb43fda4223f818a493904e46e67fda3b6f22"
        },
        {
          "alg": "SHA-256",
          "content": "f52e3bf71e4bc390f5fdf876be5c992ceaddf2e906deb625798d0693dc0f7a07"
        },
        {
          "alg": "MD5",
          "content": "4cf10e6f0d21c43641a43513c37b6120"
        }
      ]
    },
    {
      "bom-ref": "4f186a8d-19a4-4e95-ba41-e25c8399b2b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/video_unload",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9829b605175e9df01f1a5f8383b3bcee92c5a678"
        },
        {
          "alg": "SHA-256",
          "content": "082284441e4677b5081959305aa7f7fae68022a1573aff1ee86716cc84636cf7"
        },
        {
          "alg": "MD5",
          "content": "83f1dedf2463befcee49bb62b5d8ef5a"
        }
      ]
    },
    {
      "bom-ref": "4f34862a-4dda-451c-955f-c52129458850",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSecurity.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c40603acac62715c8cd8a4818a8cf12e102b517"
        },
        {
          "alg": "SHA-256",
          "content": "2c3e3865158dd471889fd759f0ccd602ab601b714028aeef791dacf87a9b71e5"
        },
        {
          "alg": "MD5",
          "content": "fea64331266edcc1fc8ba231711c6389"
        }
      ]
    },
    {
      "bom-ref": "4f3dec22-1769-4c12-a9f4-f7e12b7306b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.color.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2fe7254401140c7a16c68220445724e261d83cdf"
        },
        {
          "alg": "SHA-256",
          "content": "e590f2724a17d62299eeb1fdac7887b6c758f52a0898e2fb60a9e1833974f4bc"
        },
        {
          "alg": "MD5",
          "content": "6b42d8482173fb0c06e9ff8a119a0d0f"
        }
      ]
    },
    {
      "bom-ref": "4f4ed2b1-22aa-4b61-b3e0-9906fc3f03c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/BIOS.1.0.0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b1693380d1c7d9cecffcf46ff1bc0d86f90d6e77"
        },
        {
          "alg": "SHA-256",
          "content": "755287a3e15209967854df272ebcc8df06739d46154f7cee11dbbfbd059dbed8"
        },
        {
          "alg": "MD5",
          "content": "49f64f17c39a5eb921111835ba1fc075"
        }
      ]
    },
    {
      "bom-ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ionice",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4f5b1419-f1c3-4a61-bfd2-0d5f6cae7965",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fuser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4f81f90a-762c-4b6c-ab27-fb549b23bb7e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcVolumeExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "120d073a3351a6bc47514879ce748b260638cede"
        },
        {
          "alg": "SHA-256",
          "content": "c5bc0e49bf92056f92956dae3e5a8aad11d9116db7bbb40c2224d373ab11245d"
        },
        {
          "alg": "MD5",
          "content": "91c21d293ddbd03b80c42d48129729ab"
        }
      ]
    },
    {
      "bom-ref": "4f8380a1-5423-4cf2-bad2-1d791bdf0e9b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea75a0aad0a60b0b5e53bd43cd73311b27982608"
        },
        {
          "alg": "SHA-256",
          "content": "c52bb517e517e2552d2cfc5901dcc583d300fa0d15ec66f654514f87eea19901"
        },
        {
          "alg": "MD5",
          "content": "ce1a1cb1ec6902d14de4e147ddd14b75"
        }
      ]
    },
    {
      "bom-ref": "4fb83286-6b5b-4627-97ae-232b372bcd57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b552f040d0f3a2605815c4ed0cb4bfe49869fb7"
        },
        {
          "alg": "SHA-256",
          "content": "d8b28094e851b99ff9427f483a765c13163b65411690ed8ace3cfebd6019e8a5"
        },
        {
          "alg": "MD5",
          "content": "71c0086a35e2dbbdeff5826eff9c42fa"
        }
      ]
    },
    {
      "bom-ref": "4fc39793-5fbf-4866-8bd6-61531e925647",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/record.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6134b4cda898dac563c1eb861c56d567d18aabca"
        },
        {
          "alg": "SHA-256",
          "content": "d57882df21d689b17c21907b18d59c1cde15a6d25b32e5af4d5e996b72104196"
        },
        {
          "alg": "MD5",
          "content": "bf1ac641147228c744e5813c0cb36eb3"
        }
      ]
    },
    {
      "bom-ref": "4fd027f0-ac4d-4d12-982f-6eef7d443c21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7defc326473d7761e043e0f2aa269d7f21b0387e"
        },
        {
          "alg": "SHA-256",
          "content": "b0884f1807d7270b17b0d534afb7c070752af77422ec5c48f4609a757710a57d"
        },
        {
          "alg": "MD5",
          "content": "9a64b02c73553ee5f3e608f39df371ae"
        }
      ]
    },
    {
      "bom-ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nproc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4fff1796-4634-454f-801e-a3d687f140f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/dashboard_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a8dbaa19c43ff6cc03b30287414e94e274f1f0d4"
        },
        {
          "alg": "SHA-256",
          "content": "48a0aca9627b9f4d7be2bce5f75d13a31cfd912657a21c6677534b5ae1455e97"
        },
        {
          "alg": "MD5",
          "content": "bc66e009d065646235766eefa9ee7338"
        }
      ]
    },
    {
      "bom-ref": "504d0ff6-9c12-4e2f-9a7a-bed1a6351849",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/cimv2/qualifiers",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "95c34f6e99e698a1d6b9304f93da3c0eab89d271"
        },
        {
          "alg": "SHA-256",
          "content": "8b2f64e08065b5184792177b10ac1cfaad1f7fb45470bd011c6651992ac7946e"
        },
        {
          "alg": "MD5",
          "content": "6d395a7157dcf623f2eafc7efc0f4d26"
        }
      ]
    },
    {
      "bom-ref": "50567481-5ef2-48c3-8c66-2da2f43c1d4f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/uevent",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "506be2f3-248e-4914-bd99-d3259ff4b68b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.dataviz.themes.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f37845d7876860bb6c50034bc80b8ae12316224a"
        },
        {
          "alg": "SHA-256",
          "content": "621b28ccd5639de1e7065142c7b059daad5a6c436043a8f0e2fb6bfb6311fc32"
        },
        {
          "alg": "MD5",
          "content": "516bf99b0acd049bd2c0ca02f9dd79e6"
        }
      ]
    },
    {
      "bom-ref": "5097b52d-190c-4b67-87d1-621e6cc3d41c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/etc/openldap/ldap.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c576e496a005fc901727a012b23e9241905162d1"
        },
        {
          "alg": "SHA-256",
          "content": "4b1acb813f9a33ba01bc84e8f6d4f7e0c43ef664700cd27de09beb685e802a50"
        },
        {
          "alg": "MD5",
          "content": "8b35e4e37a0c07b288195bc9223145c1"
        }
      ]
    },
    {
      "bom-ref": "50980852-705d-40cb-a25f-781f7f3c7f47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/svok",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "50a803c6-863f-45e0-95d7-b01d3099450b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha1sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "50b481cf-70c8-4db5-935d-3c58174ea93e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmp.so.40.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a0e640d61736325b877fae9046b4b358cc6381e"
        },
        {
          "alg": "SHA-256",
          "content": "29998f992af5d5c062fe9cf7cef2015dd1e5b383f861abd6f445ec3d8e1df649"
        },
        {
          "alg": "MD5",
          "content": "c83f72accc1292482f87ef7b24f5332d"
        }
      ]
    },
    {
      "bom-ref": "50b9ecaf-aee0-4ead-a382-77218247fd1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/factor",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "50bda125-8c23-4a30-a95b-8f915b61a1ec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_RecordLogProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "44224f8dffa500bcdeff8ea1ff801ba90bc73d16"
        },
        {
          "alg": "SHA-256",
          "content": "07cd3ace7e791c5f8b9c403f2adac78d2b5b131bbdeefda798da7eb90b08a9fe"
        },
        {
          "alg": "MD5",
          "content": "7999eb46b27ea72f116d18d5dd1bd0d1"
        }
      ]
    },
    {
      "bom-ref": "50cf33f4-cc7d-4627-8485-5cfdf4777bb1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ConvertDevicePathData_extract/0-30596.elf32_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d8704e0a1a4113b0bdcfeab26f303801947058a"
        },
        {
          "alg": "SHA-256",
          "content": "78fc466a3eba4e67effc746da5cec16e86d320bcacb3c5fe8baded943e114fab"
        },
        {
          "alg": "MD5",
          "content": "9c92e462f15b74e586ed00308c6670db"
        }
      ]
    },
    {
      "bom-ref": "50dd6d66-18b2-45c9-b62b-6432cf66058f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/advanced.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5f25e9a782483fec71a8f1fb836324bf3db8eeec"
        },
        {
          "alg": "SHA-256",
          "content": "b114ddf7a1f4b9b06a5a59e3bdff4d3584d51cd7066c2bf8d169db860ed46993"
        },
        {
          "alg": "MD5",
          "content": "7d5cdf43cbd6f4f9680be09aba88e583"
        }
      ]
    },
    {
      "bom-ref": "50f42a59-59a3-4532-91a5-f0e2bd4057e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip4tc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d37ba5aeb35646ffa7efb0718c774ab7ca9903b"
        },
        {
          "alg": "SHA-256",
          "content": "92e7ccf64c5b3bee23c7034202a4d9b0eaca78e2f98b9bebb596f53d892f59bd"
        },
        {
          "alg": "MD5",
          "content": "6d3ab2b03ea9d69453f318bee6b262ad"
        }
      ]
    },
    {
      "bom-ref": "50f9a64b-e484-45f0-9116-3e2cd5144b7e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Node_LightGray.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ac0c46fef18df774abf56b9313447f8cb4b5d55"
        },
        {
          "alg": "SHA-256",
          "content": "19386596881b0127b5c5517ebbba9b7110293574b858e4ec401c9bf2f6262b61"
        },
        {
          "alg": "MD5",
          "content": "1da8b76acb1660414cc852a90c750f4e"
        }
      ]
    },
    {
      "bom-ref": "511ad0b1-1f33-4239-980b-7f4fcd2c1f67",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ExtendVirtualMediaCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30d52e8a08045a9ecfdc97cacf341660ef128c7a"
        },
        {
          "alg": "SHA-256",
          "content": "16b03a9c81a2d3c0485786649a9122f27cfbe78c4a2098f92fb498270257d2aa"
        },
        {
          "alg": "MD5",
          "content": "ccb3f28d41ec52a123b4c904385b4f95"
        }
      ]
    },
    {
      "bom-ref": "517a24c2-a53a-4d7a-9fbe-d4c85389e0df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sbtool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a229707f7a793f4f425a85877f059821f786ad31"
        },
        {
          "alg": "SHA-256",
          "content": "3bc3778090191c6d4424396afc2332a6b0d8f8a3ad748149c7c2dafdbe1bc6bc"
        },
        {
          "alg": "MD5",
          "content": "9356704852b449af8fb5109300c37b02"
        }
      ]
    },
    {
      "bom-ref": "5180a509-e080-439a-bec4-ff8c171f2062",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubimkvol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "51905219-d221-4808-be96-38fb2e471941",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rpm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "519f0dc6-2384-4a23-8018-2370c897ac2c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmphelpers.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49d62cdda243fadbec3137e026ddd2d482ccd737"
        },
        {
          "alg": "SHA-256",
          "content": "c741126818136030140883ea22b587536fd7e14ab72b66561a481afab7a8de1d"
        },
        {
          "alg": "MD5",
          "content": "61b0bca771c41ada0a3c659f0a0851d5"
        }
      ]
    },
    {
      "bom-ref": "51bfe0d3-2207-466a-8694-7b03fe174042",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_lock.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c8416f2ee686b278fb999999ce83430102a478b0"
        },
        {
          "alg": "SHA-256",
          "content": "2505313d12bdcad8e4dba24fa617b2852a7eceea7f674229cd4d0bc6a9a0d5bb"
        },
        {
          "alg": "MD5",
          "content": "96d1eee3d6f299b3697bd55ab7199d79"
        }
      ]
    },
    {
      "bom-ref": "51cf6d72-2596-4280-8e0a-5b50930cd720",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "855dee2092df02800962350f5b91ac18ccd01ac1"
        },
        {
          "alg": "SHA-256",
          "content": "95c6aaec5a94a789124fb35accd00aa9b059ed158d3b0577ded2747fde2602f9"
        },
        {
          "alg": "MD5",
          "content": "3ae64e012dbd570900d2446833de1dd9"
        }
      ]
    },
    {
      "bom-ref": "51d5ecc9-f7cc-4d46-9566-b8f3bdce5a50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/LDAP.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0143099c84b82a30516e760cb4d01ef6ba9628aa"
        },
        {
          "alg": "SHA-256",
          "content": "4a38b134eff5e976345d3d8e885521cdf00997eafd76960a62d911d1b18fb175"
        },
        {
          "alg": "MD5",
          "content": "2fe765c4dc919fea52ba0016edc4b786"
        }
      ]
    },
    {
      "bom-ref": "51de363b-fb94-4182-a96b-1f560605c78f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/sensor.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4508a2e4c5bbe9a2a0d56ede107a8fb4147cbed4"
        },
        {
          "alg": "SHA-256",
          "content": "9a5c6de827e0cc4d43521cee01270dc8ea7c216c94ba38a5e7cf108712fde9c5"
        },
        {
          "alg": "MD5",
          "content": "3e1d311cc3649b85a203a3c85a18ae30"
        }
      ]
    },
    {
      "bom-ref": "520528a6-c80a-4ef0-8a66-bbfc329293b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/uploads/uploads.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74d74735a4cd860ad3ac1977a7ee9ff20024fa8a"
        },
        {
          "alg": "SHA-256",
          "content": "46d004364e2bd8d139a34d21e60ceec795a00740eb5e14a84622e27506581972"
        },
        {
          "alg": "MD5",
          "content": "244e8b0c67c6a1c91dfb1fbe5a153bd7"
        }
      ]
    },
    {
      "bom-ref": "52067b4c-dd9d-419b-a4bb-d6a3c141937b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthInfo.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0e1308b848059d9cac6beabe4c6eab9394addc92"
        },
        {
          "alg": "SHA-256",
          "content": "bf487cdf0d28f75780926dcca38dc8042a505cdd072aec9efcdda8ca7d3f6526"
        },
        {
          "alg": "MD5",
          "content": "ec836a7c84f74baeea3fe8d9f4a18e1b"
        }
      ]
    },
    {
      "bom-ref": "5215aa52-36f2-4337-8585-d844795072ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBH_AP",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0869af3e68854d61e29a4ebc9b9e76d045154e9"
        },
        {
          "alg": "SHA-256",
          "content": "b68c8a6f196c71e59776eea83c14e9062358b7c08c478adff3f77d86a710f4b6"
        },
        {
          "alg": "MD5",
          "content": "8fe3eb0eb5902b6cfbde9d1a20f4fde3"
        }
      ]
    },
    {
      "bom-ref": "5231b42c-f1b6-4882-82a9-88b7e05abdba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpagent.so.40.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6a582838225a6278c725c17458f947fded16131"
        },
        {
          "alg": "SHA-256",
          "content": "f688485946d8e52da04495c2d0f76bfada58ff0491d40000d1d101bfec03850a"
        },
        {
          "alg": "MD5",
          "content": "f74367d541834ca01c5cceb1fa27e063"
        }
      ]
    },
    {
      "bom-ref": "523d0562-2ab0-407a-8b6e-8a56b69f91c7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage_physical.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42b9a148226c90dc85831f22ec5f1bf5b1bce475"
        },
        {
          "alg": "SHA-256",
          "content": "cb35748277eebd25807c249308699e4bd2e379e9b832ab81056b309851138c37"
        },
        {
          "alg": "MD5",
          "content": "203d2d645e78f1f925bed9ec61d87b37"
        }
      ]
    },
    {
      "bom-ref": "524073a7-7ac3-490f-bd13-c7d9d1d0fdad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcClientXML.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d8ad38f778259f9b926210f752e6d64bc567971"
        },
        {
          "alg": "SHA-256",
          "content": "5c45ae6f06e8404983f059da2d7066a4a940f58b47c2b441bbc2b5dcc4444806"
        },
        {
          "alg": "MD5",
          "content": "78a89895bc64aff235f1c709d2b686ef"
        }
      ]
    },
    {
      "bom-ref": "5244b9c8-d42b-4e95-b48d-65e4a445a1be",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "09e6a7f1788b5122e11451685e56c028d8271343"
        },
        {
          "alg": "SHA-256",
          "content": "aa2926dd5c90e6fc87e617c32802a40f21343ede40af1f472b6d6e2846c5a471"
        },
        {
          "alg": "MD5",
          "content": "81ac932b24eb57945d4baefa990cd66a"
        }
      ]
    },
    {
      "bom-ref": "5246aca5-88e9-4347-a2b6-53a1933225e6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "905bc0c905e6a2a6a61ff8642fe1778df7590a60"
        },
        {
          "alg": "SHA-256",
          "content": "6453ee8d56135820435b9237718c58cd0d4ae29ee44ba4f87b9a7bfaaceaa7af"
        },
        {
          "alg": "MD5",
          "content": "a9966c9ad82ef00a8da07b0eb0faaa8d"
        }
      ]
    },
    {
      "bom-ref": "5258bd4d-dacb-4e1b-974f-e5061b84ae60",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCertificateAuthentication.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64f619082e9cfd6078c495df4d8891d9deb45e1e"
        },
        {
          "alg": "SHA-256",
          "content": "99f13f1c597f53167d043b5d183c44cad366e1fc41c4770cdceb86d9e8e29413"
        },
        {
          "alg": "MD5",
          "content": "2a98c029aeae7b2fd15b1b96905c5559"
        }
      ]
    },
    {
      "bom-ref": "528ca0f8-d3db-4f0a-bb5a-ddf8abf735e1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/virtualkeyboard.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ee3505c6ace4b8f863bb39744dd407e704cafa21"
        },
        {
          "alg": "SHA-256",
          "content": "384a7974242df3505bb19e2d6dd6b15f7141fd1ca640bc4ca047487b697af286"
        },
        {
          "alg": "MD5",
          "content": "6440702a364d834aaaf11d960a4f1605"
        }
      ]
    },
    {
      "bom-ref": "52c04fca-0a25-45e2-bee4-009f55a52830",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcStorageExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d2614feabe3753bf0fb8fac22c1ddd1f2894e2dc"
        },
        {
          "alg": "SHA-256",
          "content": "d5953df27e02e3e8cc88bb0b6fb671a424c02ff27a986655193a67d7ec0e9f2f"
        },
        {
          "alg": "MD5",
          "content": "88692076bce21af4282bb496ed26424f"
        }
      ]
    },
    {
      "bom-ref": "52c10567-df42-4559-8a0f-f5be31e58806",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamFreq.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc4c1474a49b50ce64390b57a480ffaf52918148"
        },
        {
          "alg": "SHA-256",
          "content": "c382a2f9e1a13eaf72d3b3f0a0c53c971224e426bb6ddfc0f8b137c8cc16a2d8"
        },
        {
          "alg": "MD5",
          "content": "f0e6f36a8aecdd34fe1ecafd5342e43e"
        }
      ]
    },
    {
      "bom-ref": "52ced4c2-a704-4fc3-a5b1-3e74df8cd433",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/strings",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "52f012ab-49d6-436f-8994-5e4733575be7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/scriptreplay",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "53010d9c-75c4-424b-8638-69869fad53f0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_regex.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e252dd6a22c1bc9f30fc706bcda0f4250a6d2d1f"
        },
        {
          "alg": "SHA-256",
          "content": "4fe94816b558ed536e5a4c987f05072318d7ca605787bc89fa1046fb9584370c"
        },
        {
          "alg": "MD5",
          "content": "d22d5040638b5037711f219775e86243"
        }
      ]
    },
    {
      "bom-ref": "53116a8c-0f2e-4bec-8be3-a98a6c4c61c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamPower.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "075b10292f622adcdf8c9581872c014c475520e0"
        },
        {
          "alg": "SHA-256",
          "content": "99acc85027f0649d33714a476a8be039a668fdf1691fdbe7b7f8c607bab22e89"
        },
        {
          "alg": "MD5",
          "content": "a8cafa203dd0f6d0fa222dd9e1c389c1"
        }
      ]
    },
    {
      "bom-ref": "5324e68c-be91-4145-820c-a1c25c43b426",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libteec.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d65a897459d157245644efb77d73af76e1932ace"
        },
        {
          "alg": "SHA-256",
          "content": "2999ed74e38914ee21c76a1dde37ada773f02d581fbe1ef2153bd449b1ee6332"
        },
        {
          "alg": "MD5",
          "content": "d3375bd317e5cf5321a19c4f92ba2152"
        }
      ]
    },
    {
      "bom-ref": "53328b4a-1f74-4cac-81c1-2c31561624af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libudev.so.1.7.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ff1e2b43955dc5c42fd606f8dda9790ca480ee7"
        },
        {
          "alg": "SHA-256",
          "content": "b20b16b8f14376bbd4b9f8f999c13b276e7d6d26a299d86a72e1475e51f2875b"
        },
        {
          "alg": "MD5",
          "content": "c990c4007218b2af20439fe051fd72d0"
        }
      ]
    },
    {
      "bom-ref": "53336d29-5ca2-48d3-8e2e-4c76d7a8356c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libanonymous.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e87edeff86ecac9c26aa2e69142bd56479ce1746"
        },
        {
          "alg": "SHA-256",
          "content": "065c03eeec61dc3cd382e2f2fc28dafdc973e224a98ff2beff8c2e718c56067e"
        },
        {
          "alg": "MD5",
          "content": "57a46a72ebd132436179f961ced8faec"
        }
      ]
    },
    {
      "bom-ref": "533613ea-870a-40e7-80e3-4d9f16aa52c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libncursesw.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55b66ccd8da167daf41d414d744a00c955521a98"
        },
        {
          "alg": "SHA-256",
          "content": "754754d03109b9f4b9d75f0b3747407950438ff8e8ccb273c4ad259c6790ca0a"
        },
        {
          "alg": "MD5",
          "content": "413eedfb568f275881c8918c4c02726f"
        }
      ]
    },
    {
      "bom-ref": "535899ec-ee66-4606-bff4-66d3cf45f543",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_fw_inventory.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0da5163f164bf00b4e48b9aa285dd03a22bcbda3"
        },
        {
          "alg": "SHA-256",
          "content": "0404ed562a73d127939f87b08d5fc74ab88570fe8f28c0853939e42edb18c929"
        },
        {
          "alg": "MD5",
          "content": "61bba1249e1749c0039aa3c4b26201e6"
        }
      ]
    },
    {
      "bom-ref": "5381a14f-f782-49a4-9c2b-f49ca15f6612",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/save_IPMI_config.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e461a9d6976d7c6b574911794ad7a0a778b6c586"
        },
        {
          "alg": "SHA-256",
          "content": "02c92c88e7fabafe5cc7d911d0d6c220ed3caeffaa4d7b9f8dcb2815d9a2886f"
        },
        {
          "alg": "MD5",
          "content": "d98bfc0e20a3f66d5e343475ecec52a7"
        }
      ]
    },
    {
      "bom-ref": "538cd735-4f4e-4aec-9625-70939a8646b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/LldpService.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bdbbf2ea9a150f0b14d9e6dcdde909c4c2f86fa4"
        },
        {
          "alg": "SHA-256",
          "content": "39e93b193528525031f516af4387cdf28699fe4a08cce175a018b63267906dc6"
        },
        {
          "alg": "MD5",
          "content": "407a5b6524b3be3b36d238d6d38843a1"
        }
      ]
    },
    {
      "bom-ref": "53a3bf59-9c4e-40d4-9d39-fa99fa7f8ab3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bcc97da7b11552667a6b520f28e6cb0e90acdea4"
        },
        {
          "alg": "SHA-256",
          "content": "6a7f0e65d3828c46df91e6311afbd6842c29e8cab7c6b227f521052f9d254c80"
        },
        {
          "alg": "MD5",
          "content": "40311c28c9a0ff725854d6b9cb0665ec"
        }
      ]
    },
    {
      "bom-ref": "53b29503-319a-453b-bb02-4239c494ef2f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_16.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "175944dbd2d342bb96af7cd153b4cf677efcaa81"
        },
        {
          "alg": "SHA-256",
          "content": "1261b30f960e188be9747f1cfc7494d6cad23ded5cdf1aa5fd7fcc481f7f70f5"
        },
        {
          "alg": "MD5",
          "content": "a279dcbade8241cea40e98ed198364f9"
        }
      ]
    },
    {
      "bom-ref": "53c0d457-924f-4879-89c5-55e547852257",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptables-save",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "53e6a0ee-b3d6-430f-b421-76672523c510",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SDV",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "973da0b44fbfb95b3cfa2b4e327b8e7a5f9b7dd6"
        },
        {
          "alg": "SHA-256",
          "content": "4e42951b0ad6b793f07ff00148c212d64508835e3337370326a09d04eeb61b5b"
        },
        {
          "alg": "MD5",
          "content": "18241f59fc849bc9281f6f0d7a7998cf"
        }
      ]
    },
    {
      "bom-ref": "53edfe54-a14b-4674-8f78-fc8b9ae07c5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f7a6efb8ca46ecdea608fcacc5bd93f0b4252df"
        },
        {
          "alg": "SHA-256",
          "content": "92db50de63808e63254363fc57928c3f585344a4ddd97e7b3ef44d295befd246"
        },
        {
          "alg": "MD5",
          "content": "7cb7ad5926bdd6279774f6657f865e58"
        }
      ]
    },
    {
      "bom-ref": "5405a809-8d71-4e23-b866-bf219cd0971d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pmap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "542da220-7e50-4ba0-8b03-ab76edafe252",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libmount.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b9240192537dd5df45a3c2a1b79e1e551f50bee8"
        },
        {
          "alg": "SHA-256",
          "content": "5505cf3c987f962b424d08edbf9ac7111635edd8b176835b1f525c2090d9ced6"
        },
        {
          "alg": "MD5",
          "content": "bbf9df27d07a6173db55f81d47b3492d"
        }
      ]
    },
    {
      "bom-ref": "54357e30-887d-4e2f-b4b7-42009ee787e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmPolicy.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f82706ef5b9465f69d381131ba676aedc1e77b9c"
        },
        {
          "alg": "SHA-256",
          "content": "450781a7860135750d149a58dfcf21cdf3f3e2fba3e4cb96e809ddedf0e12559"
        },
        {
          "alg": "MD5",
          "content": "18bdac7f3d278369fdf90413078a2bce"
        }
      ]
    },
    {
      "bom-ref": "54520091-6f97-4c6f-a3f3-b2ceaa8e9a86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthStatus.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fe2b1b8a8b1ef7149bceac257b53c57e26412565"
        },
        {
          "alg": "SHA-256",
          "content": "d162b468b4b4883729020d939bbb30b3378a710681a60aad1c3ea2e4526fdd53"
        },
        {
          "alg": "MD5",
          "content": "3e0ce46cc2bb3fa48f61f57562190072"
        }
      ]
    },
    {
      "bom-ref": "54561f46-70a8-4d71-a94d-721b4813fddd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/Dump_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1154685c08aa7b74e10464319aa2668ca3b1c181"
        },
        {
          "alg": "SHA-256",
          "content": "81dc2ab710b6cd585d414a03d434ddea9e1d350f24fcfb2e2c8b1103c7cd844b"
        },
        {
          "alg": "MD5",
          "content": "a35d7e57e6ee89637f76aba1bfdfcddd"
        }
      ]
    },
    {
      "bom-ref": "54638666-6110-44a7-8a9b-e297f1d6492e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamTemp.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c2b33f3fca2cf07178ac1775ff0c603bf1bd358"
        },
        {
          "alg": "SHA-256",
          "content": "8c7e7b91db2e70f882cf221b4f8bbeda8aba2a970b7cdddd086a5f3dacfac63c"
        },
        {
          "alg": "MD5",
          "content": "847c17f96497c551dc2c2bb8f405e221"
        }
      ]
    },
    {
      "bom-ref": "54819d64-1874-471d-a826-bd04661eab68",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/diskErase.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af748239bbf4d05863898ec7aed2fe3e4c9079fd"
        },
        {
          "alg": "SHA-256",
          "content": "5a8d8ee52ee059f1fb78682486eb8220b9b8619c21e50262f7a98d465c742979"
        },
        {
          "alg": "MD5",
          "content": "7a4db0e5c77fc5dd2bff9e4a53510ecf"
        }
      ]
    },
    {
      "bom-ref": "4c797086-6591-4e50-9559-68c1bf62663b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/restoretoPS_OOB",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ae65c7456125cb6b07d12227ca19f67c92377dac"
        },
        {
          "alg": "SHA-256",
          "content": "00a9d88152a8fec41719cd3d3dcbf2b29aa9d9d60e1495a0022e88bedfbf85be"
        },
        {
          "alg": "MD5",
          "content": "72baf1d2512798a1d827ce991dca7c9a"
        }
      ]
    },
    {
      "bom-ref": "4c806047-c736-4a09-8d94-7e1fcba827ad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NTP.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "44dbc65aa03a4b8790c3a1d59ab36531810fd6bc"
        },
        {
          "alg": "SHA-256",
          "content": "6d5ccf64d615013a79b49d04f8ebba5d1c744e042629863bf379e3a0eb465800"
        },
        {
          "alg": "MD5",
          "content": "a12ef607fdaade30d4cc16575b308400"
        }
      ]
    },
    {
      "bom-ref": "4c89845f-4e4d-4893-8094-9926408ec707",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libseccomp.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b8f9675b28eee5b9209016202e99521b8dbee63"
        },
        {
          "alg": "SHA-256",
          "content": "c7d486f08fbc0bc83a84c832782046efd36404e79d0ff0fd07ead998fad2e9b7"
        },
        {
          "alg": "MD5",
          "content": "ace8e2060e80f8e16b24ac6603c8d7af"
        }
      ]
    },
    {
      "bom-ref": "4caa45a8-604f-47b0-a4f4-f88a9e322b2e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libplain.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d790d2c17d12fa79d8ba0de21f37a2a65bc496d"
        },
        {
          "alg": "SHA-256",
          "content": "2e153c5f71bd55f24701c39d2d7343b97c680214b7209aae3c8dbc2f1e9322ac"
        },
        {
          "alg": "MD5",
          "content": "ca710a742c73d4d91fad7860fb565fc6"
        }
      ]
    },
    {
      "bom-ref": "4caa5597-f61b-4c7a-bf34-4b9c714dfde4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgcc_s.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "397dbe76fc246a86de802125e389bea4fedd6db1"
        },
        {
          "alg": "SHA-256",
          "content": "69a56a9993b7729b29b274e65016031c81f2397f176ed5ad44d59bd50425e0bd"
        },
        {
          "alg": "MD5",
          "content": "e90f13d2c5b8c878ee56fb1bf00004be"
        }
      ]
    },
    {
      "bom-ref": "4cc73820-09a0-433d-83b8-35508b35c05a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_22_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cb510361de9fa832b159a6faf69d52c8b1acacb6"
        },
        {
          "alg": "SHA-256",
          "content": "a72cc460199b0121ee3563ce14eba212b4f43cf838259feca80ab79432aea274"
        },
        {
          "alg": "MD5",
          "content": "8414f3c9837cfecb5a05c1023dc3b3db"
        }
      ]
    },
    {
      "bom-ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cdetect",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "54ce6812-d431-4699-9b08-405519d17ce0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/vstorage.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "531a941d9609a84a0f8f651c56b105c21ab4d7f3"
        },
        {
          "alg": "SHA-256",
          "content": "5f5285c52514b225886afd85bc620c559dcb1e29d49fae3d4e562315a2c1c556"
        },
        {
          "alg": "MD5",
          "content": "eb461c861cf74831bc9b3e2f7b3c9236"
        }
      ]
    },
    {
      "bom-ref": "5927bfe2-d4bd-405a-8bc5-1000abac66dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamHbm_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aa2a7f0085be1354b70b490dd06c731668ea0064"
        },
        {
          "alg": "SHA-256",
          "content": "78d6ae3067d79e91bb1b419da12e328f58e0097b7251a769d9be95b9af0fd801"
        },
        {
          "alg": "MD5",
          "content": "d86fdcf1ce15fa6a3b7fe3dafb9db253"
        }
      ]
    },
    {
      "bom-ref": "5945efe8-5909-4f2b-baa6-fba1bbfa3c1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLogEntryExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cfd9a0aa5b5a914a80c183927bf1c8151dc3c281"
        },
        {
          "alg": "SHA-256",
          "content": "6936aa887e1d3ee54f2ce17794b4b74776a6dd489396d9a1c2e242b3aba2013f"
        },
        {
          "alg": "MD5",
          "content": "7b0e871ebb44e9726bbd29f75455a40b"
        }
      ]
    },
    {
      "bom-ref": "5956d40b-f66d-4a8c-bf51-e657fdbf2638",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/rtcwake",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "595f3b05-bf98-4e79-bb10-be8202c3e90a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/chroot",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "59786dbe-9ddf-4a36-9839-06dd7dc8010f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logo-safari.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d952bd8aae66fc0b2fd38bf7a345485a1511569b"
        },
        {
          "alg": "SHA-256",
          "content": "27afb4bdccb72a531352e19e8263ab3fcebc5a59b9dde6fc6e5a1f7e0b7c8d44"
        },
        {
          "alg": "MD5",
          "content": "5f90e78f687206b2c2dddcded926d5ba"
        }
      ]
    },
    {
      "bom-ref": "59be737b-9a97-4a55-b14f-2a28c5dafae7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/bash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "59bf90e7-aeea-4668-afa4-9ece823c2565",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/netstat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xargs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "59dcc66e-67e1-48a4-beb5-c49194efdbc5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libbsd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98db6640f9107bb5a25c9333c0f7652581a24642"
        },
        {
          "alg": "SHA-256",
          "content": "b9d368c0f7c3befbe4113bd7ecf8d80c2a42288f22467f675f1da2d27ffb485e"
        },
        {
          "alg": "MD5",
          "content": "47934cc3b7257a5bfd1f37d9ef59ee61"
        }
      ]
    },
    {
      "bom-ref": "59fdac62-85d4-4311-a8f9-86d29e5eab9c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_bp.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e29098f511ace5a9e0445df3339f31b7e000b717"
        },
        {
          "alg": "SHA-256",
          "content": "ec2589dc8bd6e9529d66119c25cad2e5576ac50ac9a2667a9b735e38da2818c0"
        },
        {
          "alg": "MD5",
          "content": "7ff6be4c250896bfb5ef9473af6ab59c"
        }
      ]
    },
    {
      "bom-ref": "54e1ed44-7ecd-4086-8d72-bc24ae6932cc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/prelanconf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab44e98d06739c2f69c7845a50cd4ce4f7a4ab5a"
        },
        {
          "alg": "SHA-256",
          "content": "3d21fa758d8f36c516c296c7d34a385323ceb0cce32205754f5e02b66f0a5d20"
        },
        {
          "alg": "MD5",
          "content": "6842a9e853874d454efc92126532d48a"
        }
      ]
    },
    {
      "bom-ref": "54f0060b-c39c-4d0b-a68f-67d2b1e44466",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/ld-2.31.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3636a7eba387bb5e1ccf7ce671e7266831373069"
        },
        {
          "alg": "SHA-256",
          "content": "17ca988d6dfc4686b54da143476d0f13fab9a374bb61883e0172645a4a222369"
        },
        {
          "alg": "MD5",
          "content": "e623f9f83ab0e413b6f79cc08d8d4bba"
        }
      ]
    },
    {
      "bom-ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cdump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "553f3efc-3702-442a-89ad-d66b8ac18a01",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/i3ctransfer",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "846ed90ebcd49286cf2b44df8c356a636243256b"
        },
        {
          "alg": "SHA-256",
          "content": "1054fb261386d5d0ce6276cf24aed112d4d782da6b7f6d7809cf129a6e426795"
        },
        {
          "alg": "MD5",
          "content": "816ba4e7b5218b803df82c3fa301583d"
        }
      ]
    },
    {
      "bom-ref": "5541d43b-d125-4130-b0d6-5c72198a97f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/popmaildir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "555a5727-8371-403a-819c-9c9ef15b9bc7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_user.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d79e1feab89d66baa8766fb59350720cad5b21a"
        },
        {
          "alg": "SHA-256",
          "content": "0597d64187716293f8add4bf82f25af2efcb89b5d7a1af5ed470ead8f265387f"
        },
        {
          "alg": "MD5",
          "content": "3e4b56e5e189b7cc10e134a21b88649f"
        }
      ]
    },
    {
      "bom-ref": "555e5783-b23b-45d6-9f13-23256e013b91",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/StorageControllerCollection_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "614bf3916a4d9d28a2ba426e2999cbc6a0922b86"
        },
        {
          "alg": "SHA-256",
          "content": "98b6742a093a77ddb810a17207bd12449bcc4c9f4850e622ae7b2a81f3f8c8b5"
        },
        {
          "alg": "MD5",
          "content": "948d5760e4813a74d690c62a021d4070"
        }
      ]
    },
    {
      "bom-ref": "55640ced-f955-477c-a1ec-d4d62a05da07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssapi_krb5.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b57a3c32db8ba424f5612e0a912e12303d197cb5"
        },
        {
          "alg": "SHA-256",
          "content": "101d2bbfa691e8a3c4fe0b9e6a8b3100318fd6e69dcc049b4cbbf558c95a25bb"
        },
        {
          "alg": "MD5",
          "content": "f7411491c74b7bb379688337fcbed1fa"
        }
      ]
    },
    {
      "bom-ref": "55647101-77db-4189-a8a1-101ed0b76c33",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcObjectImplSwapI32toP32.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "022d33b2039d9c6eb446acdf2a82f8959f108428"
        },
        {
          "alg": "SHA-256",
          "content": "fd6608d364e3eeaf5386a95dd17982db9e2732998bd387c1be50ff313f47fa48"
        },
        {
          "alg": "MD5",
          "content": "00ce69808b70439147ab6428472f2d87"
        }
      ]
    },
    {
      "bom-ref": "55748a60-a552-4266-856c-624b1c1664b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "419507c1fb4622b2603a126ef4e1c4d2d8004479"
        },
        {
          "alg": "SHA-256",
          "content": "af8e1bdd8ea6e49c4f75a1b45e8f89d428525680b85d5566850ac6161da31757"
        },
        {
          "alg": "MD5",
          "content": "c523aca1b31a65f10af8fc3f3d5d0c57"
        }
      ]
    },
    {
      "bom-ref": "5577e910-c742-4163-b07b-285c20307e49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libjson-c.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3e0d34bb90aa096f35f13d55d8738aeb474ce12"
        },
        {
          "alg": "SHA-256",
          "content": "60a730320d8a26662e85bbc89dcdd967bfe66d5c9c379b25c0d36dcb8eb120b1"
        },
        {
          "alg": "MD5",
          "content": "665cfefe257e53f7e4774989888b2204"
        }
      ]
    },
    {
      "bom-ref": "5592cf14-86f7-47cc-87b0-4aeea6e000c6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/connect.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b354a982fb75846fd719f9314f021ad09a5fc579"
        },
        {
          "alg": "SHA-256",
          "content": "503e685cae36cd1e022f0886278a7e9f4cc49959ef89a10e78a773e71d60421e"
        },
        {
          "alg": "MD5",
          "content": "9b426698292bedc3ff87c0ed9a9d4d68"
        }
      ]
    },
    {
      "bom-ref": "55b12daf-797b-48e2-bc7f-d0cc8a264132",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SNMP.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "38aaa0c0171c156e3e880b2cc5666b3a2d1e3e5b"
        },
        {
          "alg": "SHA-256",
          "content": "8c66ceacc0be9ed9658a288d0efd79085dbdf2ef1e5429704d3330480c7d2a88"
        },
        {
          "alg": "MD5",
          "content": "e972f91e9e477835477498039b4b298e"
        }
      ]
    },
    {
      "bom-ref": "55b3ac70-7fcc-46b9-9f3d-2bfe6e0b1a0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/IPAccessControl_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4302c7d3229853921f0c7feb558d838cf223d3c2"
        },
        {
          "alg": "SHA-256",
          "content": "32952821d3e0cc2a970cb1c664be0e5343e09de5d71c12c58e3f9ae098104764"
        },
        {
          "alg": "MD5",
          "content": "d99856b291a96fcca25f43147e907367"
        }
      ]
    },
    {
      "bom-ref": "55b689d0-366f-4265-a980-2e99a7165c2c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13QSH",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3cf1723b943be7c43820f9a5c386f55098565ed9"
        },
        {
          "alg": "SHA-256",
          "content": "86b857aab0cf6f587991957eaf319b5ed3bb83829cc17225ef85c8e3ed0c89b0"
        },
        {
          "alg": "MD5",
          "content": "6a57212667c7c898134eceb759eb23b6"
        }
      ]
    },
    {
      "bom-ref": "55b6c29d-c17e-420c-bd83-23613bb382ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/HARAIDController_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0cf9462d7cc49da4ef88fb01a0ed0eb0e38dd096"
        },
        {
          "alg": "SHA-256",
          "content": "b1e88d3e33f6c9ac842b5c10b10d7cd64392b981ba279ae65e2402be84ab5856"
        },
        {
          "alg": "MD5",
          "content": "59d5aad83f5df52ff99c4f18aa6d0878"
        }
      ]
    },
    {
      "bom-ref": "55d84635-4ad0-4cf9-9425-4ab32f7eab97",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/screenShot.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e140febce5d6d16b01c7880c6d527eebb4e871c"
        },
        {
          "alg": "SHA-256",
          "content": "abf249072c5d93824aa0db90057076d319f4153785ab3e84a880e3b2259a251d"
        },
        {
          "alg": "MD5",
          "content": "c9196bd91ee8339f2f64c06770091d74"
        }
      ]
    },
    {
      "bom-ref": "55dbeb8d-a7ef-4453-bab5-553717c69afe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e0dfbc22f7c1bff9c6ba1798c250a3cd87e39e68"
        },
        {
          "alg": "SHA-256",
          "content": "856c8a34b67a2047cd74d5cc6ba484905c43d83931cde131df3ba830f5b1ea93"
        },
        {
          "alg": "MD5",
          "content": "5c50a1e0656d648e63f7c90fc0a4e01d"
        }
      ]
    },
    {
      "bom-ref": "55f4a805-0e10-444c-847a-cc6e43ac19ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libseccomp.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b8f9675b28eee5b9209016202e99521b8dbee63"
        },
        {
          "alg": "SHA-256",
          "content": "c7d486f08fbc0bc83a84c832782046efd36404e79d0ff0fd07ead998fad2e9b7"
        },
        {
          "alg": "MD5",
          "content": "ace8e2060e80f8e16b24ac6603c8d7af"
        }
      ]
    },
    {
      "bom-ref": "55f6db31-a787-42f4-844b-8c1e18058cb4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSecurity.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "26c77b8f53c7e797718ba0d913132910bf6779bb"
        },
        {
          "alg": "SHA-256",
          "content": "43e6d51ca2c1daaba11dd1f0a20611ca5d630abfee16a47c12d8aa0c52a76fcd"
        },
        {
          "alg": "MD5",
          "content": "be52f6cf8effaf4a0eeea07e1cd6852e"
        }
      ]
    },
    {
      "bom-ref": "55f70b02-b718-4111-a329-d4b14717efe9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/banner_status_red.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ee1ea86a73c83aa2e68fb9b47e6f89b7df56a766"
        },
        {
          "alg": "SHA-256",
          "content": "e06cc7fd89e9aee14dcd2839f4d8d3d2ac0ec396dcf58d8a4e1dc0cb3519066b"
        },
        {
          "alg": "MD5",
          "content": "3143c5175f5f36e75e1ae246aaeef2ae"
        }
      ]
    },
    {
      "bom-ref": "560a9887-c367-4707-8db2-d53e751d5249",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fdflush",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "563140d2-7b45-4fef-8256-9f64ff90d808",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/seq",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "563c8f5e-c1c0-4b94-ab5e-b03394b03eba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSensorExtensions.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e3a722af11e3152f6ea4927653e83522b9fa32e"
        },
        {
          "alg": "SHA-256",
          "content": "c60402679d066ec85de2e73ffdee6ba15c63a3495f15672c69ee83063042726f"
        },
        {
          "alg": "MD5",
          "content": "a0c8ad32768b71754c68093b8b569222"
        }
      ]
    },
    {
      "bom-ref": "563deeb9-566c-473e-a801-137b599eba13",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_LogRecordProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "23be148658866d8809b13581e59f9c4fc58f00e6"
        },
        {
          "alg": "SHA-256",
          "content": "2ed5485f96bd7a80faaf4ed1f31438d02234654f6226e75ad2f8c4dee6e435d7"
        },
        {
          "alg": "MD5",
          "content": "ab5293739a08d795dbf5121d3e817ac9"
        }
      ]
    },
    {
      "bom-ref": "56527af8-fa31-4bd8-b0d4-876c26f80f0b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/restore",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74c123a448ad94a342e43357caa989a46f02d3a3"
        },
        {
          "alg": "SHA-256",
          "content": "9b9fd87d96a76df83b0f20a2b9362be612247ded5548b578ba376371271cefec"
        },
        {
          "alg": "MD5",
          "content": "255f1bda42e1909f0859a8f0d7cee4b1"
        }
      ]
    },
    {
      "bom-ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/dnsd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "566bc5fa-94ca-41cf-96c9-3654cab23c0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_SoftwareInstallationServiceProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72fb724a52804e447a3fd2027683fd71d2c999bf"
        },
        {
          "alg": "SHA-256",
          "content": "970771402f4c190961a47590b7dbefe93e11ec49a5b05f11102c3ff7a72dae29"
        },
        {
          "alg": "MD5",
          "content": "29229359f388145246338c31f2ccd4ef"
        }
      ]
    },
    {
      "bom-ref": "5671e4e6-1591-4536-8760-c25c213b2d05",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ether-wake",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "56787d14-da1c-4a85-8097-8d6a56fb1465",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBM_AP_8FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "664c8507057a9ec7f1224ee7eba5a61f34dc1cb4"
        },
        {
          "alg": "SHA-256",
          "content": "b2edd427cc7dafae87dde50854b1d375b2df2788c5b00f66442225182714ddb5"
        },
        {
          "alg": "MD5",
          "content": "171aa6ad55da296307bda842bf8be3e1"
        }
      ]
    },
    {
      "bom-ref": "5681e502-a3db-4269-a9cc-af9627cf5a7e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_RecordLogProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "44224f8dffa500bcdeff8ea1ff801ba90bc73d16"
        },
        {
          "alg": "SHA-256",
          "content": "07cd3ace7e791c5f8b9c403f2adac78d2b5b131bbdeefda798da7eb90b08a9fe"
        },
        {
          "alg": "MD5",
          "content": "7999eb46b27ea72f116d18d5dd1bd0d1"
        }
      ]
    },
    {
      "bom-ref": "568df591-5fe2-47a5-aff0-3691ff31aa2e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nslookup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "568f2395-87d2-4ef2-943b-bb63035eeab5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/pivot_root",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "569c1828-7763-4162-95a7-9b797018e98a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcManagerExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2048a519c58c98199225798746df2b16db6007e9"
        },
        {
          "alg": "SHA-256",
          "content": "11f8da8e16d6e09249910acf0a1c0de3f590779155bb910e70d9f058d16bb755"
        },
        {
          "alg": "MD5",
          "content": "2ddfdbae6c3a0367df01c686900e75c0"
        }
      ]
    },
    {
      "bom-ref": "569e2af4-8cd2-4535-bb5e-d55d1ebcb650",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/default.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ba186cb07df6156d65752d6e1a9d0f1499bd4a0"
        },
        {
          "alg": "SHA-256",
          "content": "cc68dc7b12c457986c15aa85b88942e6e02188e3e2a230da126e966d7138516f"
        },
        {
          "alg": "MD5",
          "content": "4eebe7e80f9b55296e069aa7920c37d4"
        }
      ]
    },
    {
      "bom-ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/printenv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "56ecbf9b-0fa1-4848-a911-d53054931fb0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/help.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a76b05757111ec9170d2244c3fbf1563812a266d"
        },
        {
          "alg": "SHA-256",
          "content": "df66c0b4d86fb880beb994a8a351c89afef9c1efec826d7146efe9f51578273a"
        },
        {
          "alg": "MD5",
          "content": "2423fe23d2609611f783f1a87db469d6"
        }
      ]
    },
    {
      "bom-ref": "56f2095e-dd92-460d-9152-9699725b735f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/down.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d65b12a77cefcc625b74397ff047a7d6c601943e"
        },
        {
          "alg": "SHA-256",
          "content": "c6de48d261bde0a68c894fee54ef110660cd2cfe31b0e6624cbfa56c5d7c8f77"
        },
        {
          "alg": "MD5",
          "content": "89c66f6699dea7840e565ab3a2b58e0c"
        }
      ]
    },
    {
      "bom-ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/linux32",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "574a6230-d6e6-4674-84c5-7e532a0ec44b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/aspeed-vhub.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "534a73357965e2c347fce9fd425e465295728f00"
        },
        {
          "alg": "SHA-256",
          "content": "d2b6bc0cf2544b2f35b65a5af1123bc6cff1ed8e49642144f174a626afeea80b"
        },
        {
          "alg": "MD5",
          "content": "f7fbe486bf1a17d181711dc6e061ed8a"
        }
      ]
    },
    {
      "bom-ref": "5763423f-81db-4068-95df-9b32e1869a34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLogService.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d6595425fc890a0acb2f9d11b257a0b8bbaa173"
        },
        {
          "alg": "SHA-256",
          "content": "b1e75e17a9a0c819a85dafb6674f4e679a8fbd2cae65df5b9e89635fc1fc3fd9"
        },
        {
          "alg": "MD5",
          "content": "2e90de4c1dbab22c60bff55c059ff449"
        }
      ]
    },
    {
      "bom-ref": "577ad76f-1495-4e7a-af7a-879a6d351d48",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.dataviz.chart.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b56594d0246e47deaf7e55b06f4b169deb9e317c"
        },
        {
          "alg": "SHA-256",
          "content": "b87b5bd38ff49259f253fc227602d1349e6b69fbdb4d37f9569f53b556aac7c6"
        },
        {
          "alg": "MD5",
          "content": "8d217219d0d44e83407fce6a4acac61a"
        }
      ]
    },
    {
      "bom-ref": "5791e738-a30d-48a2-9b86-03474ec2c92b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/blkdiscard",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "57c91f59-2368-4728-a7f2-b949a363d5ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/info-icon.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4aec07bf30e8dc57c45b2f6f77089b94954438f9"
        },
        {
          "alg": "SHA-256",
          "content": "35311b436f071d6fde794f03b9a52aa26dd4473f056e9d9b45eab93e058c3745"
        },
        {
          "alg": "MD5",
          "content": "5cd0777fb1fa0797a45d9da76bae10fd"
        }
      ]
    },
    {
      "bom-ref": "57faec3d-b5d9-4a69-b538-3fbea64b910a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/save",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db92b5adc78e6dbfc61c9e2aa3991ea30a0ee8fd"
        },
        {
          "alg": "SHA-256",
          "content": "3592c588dcbe6f29017e55f7662af5b1a5c833437dfd11df3ba1e032954729f4"
        },
        {
          "alg": "MD5",
          "content": "90dc3f5c5e20cc80d2e9b28f81253b5c"
        }
      ]
    },
    {
      "bom-ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/poweroff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "580da860-81e0-464f-b577-807e8bfd81c6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/FanMode.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed78a4b00b9164caa84474a8350a9cf6c3df1f9f"
        },
        {
          "alg": "SHA-256",
          "content": "6fae60b96093ef709e2f53ea3ee67c190bd73e199bcec372ff1faf534bfe3c80"
        },
        {
          "alg": "MD5",
          "content": "16d841c3298f73f9a34245c1c284f06e"
        }
      ]
    },
    {
      "bom-ref": "583551c9-1851-4bcf-9d8e-8025184e5c1c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCimXmlCodec.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b00e6e042a4370f57608ff1584580406cb08a62a"
        },
        {
          "alg": "SHA-256",
          "content": "8f4768c91b03820dad813a60af5ea22e717238f1da7799304a6b3ebe9163fd98"
        },
        {
          "alg": "MD5",
          "content": "c1eff99b7348a6401bc91e39c593c991"
        }
      ]
    },
    {
      "bom-ref": "58645350-32db-48b3-a582-f145aec556a3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/broadcom_stor_ctrl_upload.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b8fa6e19897a83eca5fd695db1fd97c40329ef9"
        },
        {
          "alg": "SHA-256",
          "content": "a79d8d1e4767e9e55a15d1cb24ff30ca52ae41ad718d1f9d5317279ac1b8a2af"
        },
        {
          "alg": "MD5",
          "content": "a77f9c05243954272e0753d143155110"
        }
      ]
    },
    {
      "bom-ref": "587c076e-8763-4f1b-a514-ff354a95336f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/mmcCommand.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5413cfce57c5d67232619cf982407a6c0c3d0b82"
        },
        {
          "alg": "SHA-256",
          "content": "7532f3c6454dbd30f170b6a4f5b1b1e1a659d751f7c4dc44763642d6d11ce4ab"
        },
        {
          "alg": "MD5",
          "content": "3959edae770208aac25a3f9cfc3bab2c"
        }
      ]
    },
    {
      "bom-ref": "587c77c5-0284-4fcb-ac12-941b451f0839",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/spdm.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea7e24a24545e5fd18ca25e5668eef55c06754a1"
        },
        {
          "alg": "SHA-256",
          "content": "cd9909bb67611fabecb28d9f009bab58e2a273a8cdc766d74c0145b5682c42ce"
        },
        {
          "alg": "MD5",
          "content": "00a9a6f3232efe63c5a2c3d03d8cbe56"
        }
      ]
    },
    {
      "bom-ref": "588885e3-e20f-4cf3-80f0-a1eea4612984",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/add-shell",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "58b40f4e-68b4-4fc8-a200-68e77bb8edc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv_mit.so.12",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "58c946d3-1cb3-4c7c-9ac8-851a0a06d2b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/force_enable.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "88e6d5d9b7e3fe3254668fb1307468db138631e5"
        },
        {
          "alg": "SHA-256",
          "content": "9c0bda4aa7b391638317ff5d380d4f0ebe0b0fc12568e3de7aa4fc5f70d31ef5"
        },
        {
          "alg": "MD5",
          "content": "697173c74edad521980a6306ea001b09"
        }
      ]
    },
    {
      "bom-ref": "58cda575-4932-48ad-868e-3a0e8485ba52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/VolumeConfig.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b682e36bea1ba4bfc48ddc5ddced70be68cf8ce"
        },
        {
          "alg": "SHA-256",
          "content": "fdd7606f7074f6cf98afcd26aab5c47ff618b5f62c2ae448462e2bba717128c2"
        },
        {
          "alg": "MD5",
          "content": "2c6bbe6aadcc77ef594f9b1e4427ffd9"
        }
      ]
    },
    {
      "bom-ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "58dd5786-9350-4694-9c8c-0fc087a8e4dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cdump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "58f7e4d7-170e-471f-a717-3ea4b2272731",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/fan.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed9514414671ce5e4488b935d3451a90082726f6"
        },
        {
          "alg": "SHA-256",
          "content": "7d77c7aae9e6f64389aa36701a0ca148a05e023a6f5c654960da9ff87b36f5ba"
        },
        {
          "alg": "MD5",
          "content": "48f1d1b4e3c7f889258e52485dfb0ef5"
        }
      ]
    },
    {
      "bom-ref": "58fa9094-a3f2-4d04-803c-b746f85190aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/lightbox_close.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e1cd1c2e0188c67f98f136483e0aa7da09a74c25"
        },
        {
          "alg": "SHA-256",
          "content": "0a7f204307f7db5171cdc82798173202690580603926ce2fe26915c6f5926823"
        },
        {
          "alg": "MD5",
          "content": "39b3e9744a26e944cbd38e0b4399915c"
        }
      ]
    },
    {
      "bom-ref": "591147f0-8315-435f-83e5-84fd4fef1fde",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/dashboard_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e28b8644f840860b1e3d9d7f10fca58888eb9d09"
        },
        {
          "alg": "SHA-256",
          "content": "955469a4f3dea8f8e89425bd30ebada7a6e64a654abe4201630bed4f55bea4df"
        },
        {
          "alg": "MD5",
          "content": "18869a7cb34d8b1a15b29c0498a06f3e"
        }
      ]
    },
    {
      "bom-ref": "5913e667-6834-4a1c-9324-316ba191e163",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage_logical.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "78c401f6885f57f0374c8c91c53734fcaa7c5ab0"
        },
        {
          "alg": "SHA-256",
          "content": "e78f23b4645a96c02ec9b8ca215e3752d21e39c9578b38ee94ccf0073905ee6d"
        },
        {
          "alg": "MD5",
          "content": "cf1f698bce9d0d9a204df9b34a72afdc"
        }
      ]
    },
    {
      "bom-ref": "5914d3ef-0847-42da-848b-5cd776c93d22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/language.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4371f87c5c38782e66d9a912ac578f19f34b72b"
        },
        {
          "alg": "SHA-256",
          "content": "600afd04875d75b78316b6576b2d81d7e0f13311893978d6a52a66c423b9c505"
        },
        {
          "alg": "MD5",
          "content": "fc06ac108f93cd9b88705c8f261349c3"
        }
      ]
    },
    {
      "bom-ref": "54920cd8-739e-4968-97fb-cf828a4c7331",
      "type": "file",
      "name": "./1982632-5274408.zimage",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b758c46d2a26342146d2f3b7f17e2fc9cbdc33db"
        },
        {
          "alg": "SHA-256",
          "content": "d75010b554179a388211a82c6064adcf1552d8718ab75b12373dcd4f799e5c2f"
        },
        {
          "alg": "MD5",
          "content": "a373e61752a61afbed5be1f11541f8df"
        }
      ]
    },
    {
      "bom-ref": "5498e92a-5ce7-45e7-a0a4-ced152438ad9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/iKVM__V1.69.23.0x0.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bdb1eb25c7888652fb1eec258944fc93773912ed"
        },
        {
          "alg": "SHA-256",
          "content": "bd76f9207bf213fd22b93579bdc364971893b12ece29d94a7d1882329f705929"
        },
        {
          "alg": "MD5",
          "content": "57b1bee653e818389b1cd916bfd27b71"
        }
      ]
    },
    {
      "bom-ref": "7b716383-449e-4e64-9fce-14bc87a022e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcGPUExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f5f49d3522d7abd3a549d3541ea55fcfcbaed6fb"
        },
        {
          "alg": "SHA-256",
          "content": "78c2c5b8268100187136911d5f2a7ed429c4c77d7bcd18bac6696220913eacad"
        },
        {
          "alg": "MD5",
          "content": "754ba7e36f002abdd2f110ec007ec984"
        }
      ]
    },
    {
      "bom-ref": "7b7424b8-08cc-4005-b89c-7e39e26381c3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libk5crypto.so.3.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03f4a1baf19a790665a56a5c3f632731f2e9ef27"
        },
        {
          "alg": "SHA-256",
          "content": "1ea442a82eb199e83be393e7e45baf0502804d21bf88583fcbbb4046b4cfb253"
        },
        {
          "alg": "MD5",
          "content": "f471a8188dfced52b6aca88c5b9c903a"
        }
      ]
    },
    {
      "bom-ref": "7b958777-fc99-4d6e-8a7d-6eed7c5e10b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/uiso",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "de0620d0b42f705f26844a133abbc11c98f5404e"
        },
        {
          "alg": "SHA-256",
          "content": "4ef6c16098a606e6446af1a16348baf2be5cad2c8da32178e564b4c143556cef"
        },
        {
          "alg": "MD5",
          "content": "a8c7278dd44b20fe1401afb11005b7bc"
        }
      ]
    },
    {
      "bom-ref": "7b9b6a6c-1e79-489e-8a53-67d189edf14a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery-3.5.1.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c8e1c8b386dc5b7a9184c763c88d19a346eb3342"
        },
        {
          "alg": "SHA-256",
          "content": "f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d"
        },
        {
          "alg": "MD5",
          "content": "dc5e7f18c8d36ac1d3d4753a87c98d0a"
        }
      ]
    },
    {
      "bom-ref": "7ba55d2e-654a-4d89-a88b-df354228cfc1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/stunneld",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61b943bcc47784c7ba3f65d7f2f8c5fe08724520"
        },
        {
          "alg": "SHA-256",
          "content": "bc8656ad3874ccb80f603635ec6ebee12b9280ff548c7ac1436b985cdca949a1"
        },
        {
          "alg": "MD5",
          "content": "8c850d6f85fc552fb33b7cbdb61f7be1"
        }
      ]
    },
    {
      "bom-ref": "7bda2b0e-faf7-40f0-8a45-68c8bf0e822b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmThrottlingStatus.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0c105dee5786e5f0a9dbaa285c1988c317eb2d5b"
        },
        {
          "alg": "SHA-256",
          "content": "9f333b59b9ee1b93ffbd8758803bace416b4dc3cf8080ac0dd2965ee97284c2e"
        },
        {
          "alg": "MD5",
          "content": "ec7c74ad892a32bde2a73f093a19e89d"
        }
      ]
    },
    {
      "bom-ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fsck.minix",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7c0abbb2-5593-4810-a5c5-31265130fb8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/cimv2/classSchemas",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "022c266d2bdcbabac183c3f75c6c6173a52cce17"
        },
        {
          "alg": "SHA-256",
          "content": "06b8c67b1ccef42bbe3fd24b34436b785567ea70708be8689bde535a40bc9523"
        },
        {
          "alg": "MD5",
          "content": "fadbd60c7657c496686b0ce300fbfce5"
        }
      ]
    },
    {
      "bom-ref": "7c0ebb26-324a-4ad9-8b3a-d04086f80f50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e0695b213c6e84e9e17aaf8ff07998aef87793d6"
        },
        {
          "alg": "SHA-256",
          "content": "bf070087b029aff3506eca918bf58594b04eddf35742ee2a9971f699d4e8cc9c"
        },
        {
          "alg": "MD5",
          "content": "6883864aa54cdd61f3cad9f05def4a03"
        }
      ]
    },
    {
      "bom-ref": "7c0fca56-56fd-42b2-8e2c-85a4bfd3e81e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libweb.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0da97f38abf8c94a03fdfcd56e395e8080e5463e"
        },
        {
          "alg": "SHA-256",
          "content": "66c1ebb957bd2ede2d8c2a029073aefa08d21665afbf4e7957f0664e98839824"
        },
        {
          "alg": "MD5",
          "content": "12e205f14d8c348d5b559cb204d5932b"
        }
      ]
    },
    {
      "bom-ref": "7c51f638-65c2-4353-837a-afdb29fdb1fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/00partition_check.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "91247b5c5ee958538189f827ca4646c61a38c903"
        },
        {
          "alg": "SHA-256",
          "content": "214f3ef920b758f879dcf4796e364393034a29b975961c80a30b65cc1ecfc9bc"
        },
        {
          "alg": "MD5",
          "content": "20cba22376654b3e85833a40329768f4"
        }
      ]
    },
    {
      "bom-ref": "7c757f99-962b-4e82-8df3-26dc54e5c022",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/system_event_log.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6adcc6118ac20315c03ad9dd28b7027b5fb1629"
        },
        {
          "alg": "SHA-256",
          "content": "33e560309a0902890afe2ae1b62bbdcc614296f8f36399a011ddf9cbe94f2b27"
        },
        {
          "alg": "MD5",
          "content": "c79d7474d5ebb90669a34af88d11bc70"
        }
      ]
    },
    {
      "bom-ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/groups",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7cc79a6c-a725-4f20-9177-ddf6b2ddbb93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/banner_link.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "afc4e1d91ce098ae256d5593551b040998c20d72"
        },
        {
          "alg": "SHA-256",
          "content": "0ad424c865be6bdcb2e1f016e775cb6f771876adcfa79d986bb7e46727dae69c"
        },
        {
          "alg": "MD5",
          "content": "9d883290e387bdafde50928f82d7e51c"
        }
      ]
    },
    {
      "bom-ref": "7cd1f88c-97be-4ae2-86ab-1b09b9942f94",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/hmnt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74de67f3a4c1235991ad8a4509534326347a032a"
        },
        {
          "alg": "SHA-256",
          "content": "65dedfdceeea5ef23421c2fdd14c63a9c7e939daacff2ba5c95a28383cf43de7"
        },
        {
          "alg": "MD5",
          "content": "859cd91c0e25b4a86447b13c526b68ac"
        }
      ]
    },
    {
      "bom-ref": "7cd8d145-14ed-4646-ac26-5075e65f66dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5support.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6323368eeadb6cf6e72ba885cb3ee700a379c538"
        },
        {
          "alg": "SHA-256",
          "content": "3c8cd3d5721a6ea6ef421edbc1c34c9ec390901bcc9c1d37ddc9ed9cbc56332d"
        },
        {
          "alg": "MD5",
          "content": "dfb7f207ed9135f82c251060b260783f"
        }
      ]
    },
    {
      "bom-ref": "7cf5ee5e-1b98-40a4-a4bc-a0ad3670b3fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/zcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7d03b96d-9d8a-4e91-962c-229144d39da6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.pager.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2fe436595db20a0c7045e88eb2ab54e1adfd9a47"
        },
        {
          "alg": "SHA-256",
          "content": "482e3845beba354a876fb453ac1b5c0c05aed8bedda54ede63c1bcf36120a89a"
        },
        {
          "alg": "MD5",
          "content": "aa43b8f4d99b1db5c43c3d774ee9a76b"
        }
      ]
    },
    {
      "bom-ref": "7d0b0517-61c9-415a-a94d-38d4dd7f85d0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_PowerManagementServiceProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c38b3c09e620f751e1ebcbaf2b802ee5133e9c8"
        },
        {
          "alg": "SHA-256",
          "content": "6c76985c1d593d0f6dd75a363de2ba9fc4ee5bdd59f64874d3960949a1ca3d06"
        },
        {
          "alg": "MD5",
          "content": "ef4848c27cae1ab7f6155213833a4c79"
        }
      ]
    },
    {
      "bom-ref": "7d1958e3-b6fc-4141-aad5-d70d1fba324a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/libwin_x86_64__V1.0.5.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c037aaf37896d82223405a1b9947098cb58ad490"
        },
        {
          "alg": "SHA-256",
          "content": "984b0fa0340e5cec03b523a8661a70871187e55feed30fce86d7ad17f18713a6"
        },
        {
          "alg": "MD5",
          "content": "0a6032981c9d12322213385c925e0aa5"
        }
      ]
    },
    {
      "bom-ref": "7d2a3158-36e4-4b89-9460-9a619a0aef93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/blink2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3269e0583b41c0d6d19ee5e9d9df2572369ff8dc"
        },
        {
          "alg": "SHA-256",
          "content": "c07e26e39d1e307351755aab2a6002527943223a895b804f4e2e644ab78a2150"
        },
        {
          "alg": "MD5",
          "content": "7999cb6aa919d30cea2939de5d0c93f8"
        }
      ]
    },
    {
      "bom-ref": "7d3718a0-d6d3-49bf-b002-006f400865e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dbus-1/system.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "506b33756193a1c6c380b2eb840d8eb45c3a4ea1"
        },
        {
          "alg": "SHA-256",
          "content": "a6f50dc70ef082a110dcdb164579cd2af221b90226c5e0aca237edcad98a1c26"
        },
        {
          "alg": "MD5",
          "content": "ba0df1208e214a87771671053c29dbe7"
        }
      ]
    },
    {
      "bom-ref": "7d5381a4-a535-45f2-ba39-bf2f128801e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBH",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ae7692befda90176a269c7544af657ed1b90e49"
        },
        {
          "alg": "SHA-256",
          "content": "8002066e53ce0d107e4418b1e048b5a2d980f67719e41e99dc00ca9ab559d38d"
        },
        {
          "alg": "MD5",
          "content": "8801bc921f7a56393b8769b4526f5567"
        }
      ]
    },
    {
      "bom-ref": "7d5d556c-a297-4f36-8fc1-6c4bb0c2054f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/true",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7d685412-2983-4cfe-8fe1-12224a7bae12",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libss.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ece57d671200533225fff4cd9d1ad98a2d4ba33"
        },
        {
          "alg": "SHA-256",
          "content": "b7ecb09c3fa8062f7c369f6ffb84441848f0a553decc7b5cfcf3c3d1eeb58f2a"
        },
        {
          "alg": "MD5",
          "content": "ce411b37a1a14dca95b15b4fae018a19"
        }
      ]
    },
    {
      "bom-ref": "7d85bf07-a678-4be8-95d3-c58e67e7430f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/login_logo.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30e0f20dcfbee31ee7eda2f07ff48c5278a1a621"
        },
        {
          "alg": "SHA-256",
          "content": "cdc8276f6f21febcdf9c50913d458324164ecfe122d2923789178893da5f1122"
        },
        {
          "alg": "MD5",
          "content": "5144ea456b456d151f0796ec7bc6dfd9"
        }
      ]
    },
    {
      "bom-ref": "7d905aa2-5186-4a04-9779-653181a75c8f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "049d4637d5785d89051ee715885458ab12cf284b"
        },
        {
          "alg": "SHA-256",
          "content": "936010e18a48c0edb2d2b1ec652d5940c3c04c16e6827a1093b65f6f8b9ef78f"
        },
        {
          "alg": "MD5",
          "content": "c4d4cee9ca89c3414c1ffbb2128fb68f"
        }
      ]
    },
    {
      "bom-ref": "7d99d2d7-9936-4b6e-af3f-30a51291fd80",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthInfo.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5a5045c99631b92a189817ea854005df6ccf2ef0"
        },
        {
          "alg": "SHA-256",
          "content": "c7b49b4d14f5c6c94e61da38d02fadd5a7f36ddc6aa609566cbb268303f93f14"
        },
        {
          "alg": "MD5",
          "content": "f94bd758cda1cfe42678d38ba35d9153"
        }
      ]
    },
    {
      "bom-ref": "7da17858-d364-463d-914a-9461263d7f75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libverto.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c67a272c7c6d06a90e27160a6a3815e802a5492"
        },
        {
          "alg": "SHA-256",
          "content": "fbf81609dc68852e0493bf6ec058670bdeaded13e5aa4f5a1e2a6dd3f9c90009"
        },
        {
          "alg": "MD5",
          "content": "f5c51d1a2457511280b3148ebf476115"
        }
      ]
    },
    {
      "bom-ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7dac57e4-46b5-4b14-a7b2-150037cc5461",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstdc++.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49004bc15d6c235b175b6efeabe98d4622753b22"
        },
        {
          "alg": "SHA-256",
          "content": "4a9467ac3a877bd6a36a60f117ce25852b38739ff05137b26912dcc40e0358f8"
        },
        {
          "alg": "MD5",
          "content": "47b6a3c30ddca174e47cd0d9791d3fda"
        }
      ]
    },
    {
      "bom-ref": "7daf0a39-9f93-4bda-81ad-e20aed84e861",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam_misc.so.0.82.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f7070eaa4b489e6f76c6bddaa0b5bcd57f0d3da"
        },
        {
          "alg": "SHA-256",
          "content": "00c1efd1a7673edc66771060c55713d71c76b9a28e5895556a07da506185a94a"
        },
        {
          "alg": "MD5",
          "content": "ee5f5e4e0702d9b4255d053300f869f5"
        }
      ]
    },
    {
      "bom-ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptunnel",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7dda97d8-497d-466b-b2ef-6280badfe291",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sort",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/date",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7de9e55b-c147-4841-b6e4-03de92cacd47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/lockdown.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df65e904d67d180e806cbb27b3f962d43c335874"
        },
        {
          "alg": "SHA-256",
          "content": "7914197671c23511a33ac90c69076bafe492787e3ccaa97db85d4d9b9695d134"
        },
        {
          "alg": "MD5",
          "content": "2d5d567c832222fbc366ed0c4377414c"
        }
      ]
    },
    {
      "bom-ref": "7dea5445-ba99-4a75-a06d-7c46714e2547",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8cdd7580da6ee9758d1d7ba96c2bced8de77ecb6"
        },
        {
          "alg": "SHA-256",
          "content": "efd85528b5e17db71cb28119a27f71a398a48c568134c93b2d4cec9482bcd1fe"
        },
        {
          "alg": "MD5",
          "content": "f431b3af79c7c5a4193f62a7a0edadb3"
        }
      ]
    },
    {
      "bom-ref": "7defca8e-e197-4db0-816e-71a4493a23b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7e015bc5-f427-4868-86bd-153f6ec450b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "7e072abb-f899-4944-b088-69272d7c908c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b9564c2e65f78cd86074c1a6fdf224ddc4f7e64"
        },
        {
          "alg": "SHA-256",
          "content": "8bbd61a07cc4f4ed2daabd9af5f18385d46f5721068848f7fde639a92957d275"
        },
        {
          "alg": "MD5",
          "content": "3db2a536cd5aa4c902b101f22df6c3fe"
        }
      ]
    },
    {
      "bom-ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/curl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5f8aebb208cdf495f38638670eeae75b3a09962"
        },
        {
          "alg": "SHA-256",
          "content": "426cff80cda6bab2ef790a8d2966e9e266baf45f0564771b3f884a602150a707"
        },
        {
          "alg": "MD5",
          "content": "009ef970ac8fb057766011305080bdd8"
        }
      ]
    },
    {
      "bom-ref": "7e2439e6-25fc-4f28-b254-b487493c7d6c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/video_capture",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "51dc443903bbd6dc13fccc2cbe1c87d52e021a76"
        },
        {
          "alg": "SHA-256",
          "content": "d7f4348da0cf01c265d59e7b064cc07307ec98510d8703bbe824d476b3ab0389"
        },
        {
          "alg": "MD5",
          "content": "57fb736981588bccd24fbc5a423beeee"
        }
      ]
    },
    {
      "bom-ref": "7e2cc1d4-6514-468b-a205-ce48381e4959",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/telnetd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7e3b2725-1a1e-4fba-be4f-42486d048d49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmPolicy.v1_2_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8bbbd89733fd3aeebf0290b04387e655ba54df9"
        },
        {
          "alg": "SHA-256",
          "content": "4fd6030a899ba07511d47e8934f38f30af4824bc004cf81f22dac1b0cf3cfa4b"
        },
        {
          "alg": "MD5",
          "content": "d262a576466fc8b30acfbd287398679c"
        }
      ]
    },
    {
      "bom-ref": "7e3f09c1-0f76-40ba-9593-3d95965c3678",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpio_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "339bfa12dd2fa3048ffcda87017f164ee637cbdf"
        },
        {
          "alg": "SHA-256",
          "content": "e4987114fabbd2959f164c49ab9829928b00c9f75cc382d46f8f5d6f599585ac"
        },
        {
          "alg": "MD5",
          "content": "291485ef0e63a086346aca32e1e1ddf8"
        }
      ]
    },
    {
      "bom-ref": "7e46fce4-da1e-4ba9-b57e-ec280d0f9dac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/readlink",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7e57baaf-2ccb-4ca7-abdd-41bb0da0aae9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderSf.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ebbd3799bcd41911fa0b956b49169f473ce0cf1e"
        },
        {
          "alg": "SHA-256",
          "content": "f2ac326b4b01425c58cffecb4134a9515516cba2010ed2e976a020bf12496471"
        },
        {
          "alg": "MD5",
          "content": "314169122ba78ca7729a739240627c23"
        }
      ]
    },
    {
      "bom-ref": "7e60d0b4-4e2a-4a67-ac01-f5ed598961cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/jtag_load",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f9c69b3ed057687ec21e8f5f84ad45acefbcb8c"
        },
        {
          "alg": "SHA-256",
          "content": "a210a14e635cf68014626aab801be47971dc26202d13de9dbf7ad73c217d5e25"
        },
        {
          "alg": "MD5",
          "content": "b416158ea4a63734852e7b631fa07f11"
        }
      ]
    },
    {
      "bom-ref": "7e81413c-ae9b-4e7a-a6f9-7288ecb2e92e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/config/port.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8617cbd3a5f6149f29e59c56857974807b310747"
        },
        {
          "alg": "SHA-256",
          "content": "2c4858c4c5b1b7ab30e89556034e3202fab4ff829248a027c4a326d744b5dbce"
        },
        {
          "alg": "MD5",
          "content": "6fd29e684d9e29afe8e13329c2a96634"
        }
      ]
    },
    {
      "bom-ref": "7eae09d9-7eb9-4310-a48f-cfaa375f0cd3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libk5crypto.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03f4a1baf19a790665a56a5c3f632731f2e9ef27"
        },
        {
          "alg": "SHA-256",
          "content": "1ea442a82eb199e83be393e7e45baf0502804d21bf88583fcbbb4046b4cfb253"
        },
        {
          "alg": "MD5",
          "content": "f471a8188dfced52b6aca88c5b9c903a"
        }
      ]
    },
    {
      "bom-ref": "7ec5f6d6-46a1-4d8e-a0aa-a8db9a25b114",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7ee0f868-38cd-41d2-84a9-0b2f4783eacc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pluginviewer",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cd4d5651a9ea8fab0327cd037287e446babcaffb"
        },
        {
          "alg": "SHA-256",
          "content": "b58afb698f760d71b752450ab398461979a5199e90c348c1d5ed9af0c9743b6d"
        },
        {
          "alg": "MD5",
          "content": "99f8e92dc0a272312510a0f3ba56d7e7"
        }
      ]
    },
    {
      "bom-ref": "7eed6dc3-61eb-4c15-8967-77a178230a43",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/populate_storage_fs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "40e29af40f82243349605754906105537819eaf6"
        },
        {
          "alg": "SHA-256",
          "content": "e6a32540038f13129ea9eb5a80e804eef20b5b8376cacecf1c6e904134e37b03"
        },
        {
          "alg": "MD5",
          "content": "5faee235f3031f04ac762f123423bcd6"
        }
      ]
    },
    {
      "bom-ref": "7f12032c-a56a-46ee-88bc-2de3c55f7b85",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/Discrete_Sensor.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6a1364f2a125d49f766f0b0e368bfd4c7884d833"
        },
        {
          "alg": "SHA-256",
          "content": "18b46a2fc22ccca1f7be43d94a1561fa41c25295c530ea2ae6bddc9eda2bc3da"
        },
        {
          "alg": "MD5",
          "content": "a4028c35dec37978921df00a92a43f60"
        }
      ]
    },
    {
      "bom-ref": "7f43f0de-e1bd-471e-a57f-9c63c60e71a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power_off_snapshot.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9f8db3515acd6b059b304425cc72ac68e8ccd2f7"
        },
        {
          "alg": "SHA-256",
          "content": "a94a2d4c501a42f5f5409be38d49f154e6a8fc49dc857ae21d6b4d0b4674202f"
        },
        {
          "alg": "MD5",
          "content": "29cff235684bf5a01c451fd1ab192542"
        }
      ]
    },
    {
      "bom-ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/halt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7f783198-1232-40f3-99e9-a704114f04b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_off.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "886560b78bdb97464d97f11cc85b0e2b85c7963c"
        },
        {
          "alg": "SHA-256",
          "content": "1a36aab7aa4573ef27d9ef1bf497d6019cfaec47997b80b4465b27b42e15da8a"
        },
        {
          "alg": "MD5",
          "content": "a13e7e0290e1e64ae3f901a8bb929870"
        }
      ]
    },
    {
      "bom-ref": "7f8da2b8-a073-4f87-8b70-c574c635c8dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderMem.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57b8c2ff13b620aa6e30613ccff65c4593b1c84d"
        },
        {
          "alg": "SHA-256",
          "content": "e8a328d27275f7987516db4256dc965a24e99e70b41f448d7cdd077676423cea"
        },
        {
          "alg": "MD5",
          "content": "e9c831be3a193556b63c9ae44567b6d2"
        }
      ]
    },
    {
      "bom-ref": "7f948334-0946-476c-ad95-99136f2f72a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/volname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7f969ea6-b248-449c-aa8d-2f8513a70f23",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/ufiCommand.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "308cec693c72e66c6ad8b3ca445df0fa9f8f3884"
        },
        {
          "alg": "SHA-256",
          "content": "27076eb2c2ebd7c6a65d1c85503c862b0f6aab16bf12f04eeea2aaa4c9a02736"
        },
        {
          "alg": "MD5",
          "content": "315042f48998519ff0960496fdf435b4"
        }
      ]
    },
    {
      "bom-ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fallocate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7ffc02a7-dc0f-444a-ba4e-ad7094421d73",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthStatusCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ee3fbe934e7b732f63606aa5d8c5ebe7c2e842b"
        },
        {
          "alg": "SHA-256",
          "content": "8a057913770ca13d76d47b2e7b6d3bbc2538efcc9d9bb041e9ef341d0ec57fb1"
        },
        {
          "alg": "MD5",
          "content": "b539c78e0a6eac01af5d6c6a33b55515"
        }
      ]
    },
    {
      "bom-ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dnsdomainname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "800f0195-4b4a-417a-8762-278789badf8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/network/netconfig.default",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b9e94bcc295051b31f203ef33bc139feb302ee3"
        },
        {
          "alg": "SHA-256",
          "content": "25316b68dd16bceab9cd45a2ddac88599d80e6352eac4fcbe5d88a2247dee684"
        },
        {
          "alg": "MD5",
          "content": "c7510335ccd108dd3ba055d6a4f5c700"
        }
      ]
    },
    {
      "bom-ref": "8022a7f1-9191-4326-a08a-5165c75d90c1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/critical.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbea1d74b98cedac53909c556e87c81001628411"
        },
        {
          "alg": "SHA-256",
          "content": "8cff6a6b1af161cb968e80cbd86d9f6b62040da6f213a9b882b954d74433c582"
        },
        {
          "alg": "MD5",
          "content": "1be9ef1ec829def4a3b4c0a74a9b3109"
        }
      ]
    },
    {
      "bom-ref": "803ebae1-65ba-4079-b13f-2acecc905c54",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_14_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "013c6c69e9d5de66e75beb5c07d5761cda857dae"
        },
        {
          "alg": "SHA-256",
          "content": "b9bc33e5204bc46dc636cd6251d0fdded6d6fcdf1ecc02ec12f9a3916e2952fd"
        },
        {
          "alg": "MD5",
          "content": "731ba3d97f718349610ec0b38e19772c"
        }
      ]
    },
    {
      "bom-ref": "80615f39-4916-4762-a97c-c240c4ed5468",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.selectable.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "13b0d7403b6d453a242fb7e760a68355c43fa681"
        },
        {
          "alg": "SHA-256",
          "content": "b15b324d7a83daee25ba5e40800dff1b827c2fd2ef670c130ea74f4555735cce"
        },
        {
          "alg": "MD5",
          "content": "e76d60973b6507dd84130914986f54d8"
        }
      ]
    },
    {
      "bom-ref": "8061b0da-5cbb-4931-8c69-bf8bb864242a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_compat-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d96f3079932f7eea9b312c9d9cc4f35f4b916bc2"
        },
        {
          "alg": "SHA-256",
          "content": "07e54b12bfe49788e02b246ad6cb5779eb5ad8d987f94663759011117adfd400"
        },
        {
          "alg": "MD5",
          "content": "ea0a208c0464cb133a708a1776c75b38"
        }
      ]
    },
    {
      "bom-ref": "80664cc9-c05a-4be0-9130-282aa66affa9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/sfcb_indicationservicecapabilities",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6603d2c9217e35b56bd78493eee984d5e6477480"
        },
        {
          "alg": "SHA-256",
          "content": "bc2e2481f7047934f38cb3efd5931126809f6a4b93715cb1a94b4fbe66c316da"
        },
        {
          "alg": "MD5",
          "content": "f2f7f57c788583ae8d5cdb2464b9d951"
        }
      ]
    },
    {
      "bom-ref": "80693fb2-ed5c-4817-bd4a-ee976b3b4d14",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/librt.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b728c38d3e6d36827c4da6eb4f6b087c8aa865d0"
        },
        {
          "alg": "SHA-256",
          "content": "dd1abbbaeeed4e8f3b08fda7769e8547eb955a0f1b70d71449af81c6b2451479"
        },
        {
          "alg": "MD5",
          "content": "a54420a8a2aa3bd497cabf575ae1a2d3"
        }
      ]
    },
    {
      "bom-ref": "80815d31-2f2f-487d-bc7a-2d9ee9bb06da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcStorageExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e0bbe25a0e2fbbda6c06c4fe2ea644cba1872242"
        },
        {
          "alg": "SHA-256",
          "content": "4dbf4838e784b2f11545c6db08da653628aa208c7ceb1b91837ab3ac910d4c4e"
        },
        {
          "alg": "MD5",
          "content": "45d72a1d6b50e16eb981077c7e2282c7"
        }
      ]
    },
    {
      "bom-ref": "808994bb-0c1c-4ac7-bedb-134448854884",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/obcl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f442eb47c500e7d0a21bf9e58dd1b49f7e1f4327"
        },
        {
          "alg": "SHA-256",
          "content": "6392920392e7606727c85ce1019d6b8d30ee52310fe863f3f2babfb3820f7194"
        },
        {
          "alg": "MD5",
          "content": "9931b37b4605244d9e847c669e485937"
        }
      ]
    },
    {
      "bom-ref": "809adc1e-a0a4-4eea-887d-e4ddc9aa5a65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcObjectImplSwapI32toP32.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "022d33b2039d9c6eb446acdf2a82f8959f108428"
        },
        {
          "alg": "SHA-256",
          "content": "fd6608d364e3eeaf5386a95dd17982db9e2732998bd387c1be50ff313f47fa48"
        },
        {
          "alg": "MD5",
          "content": "00ce69808b70439147ab6428472f2d87"
        }
      ]
    },
    {
      "bom-ref": "80ca859f-b688-42b9-9d23-14db43d2e9ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/brctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "80d1a811-8623-461b-a633-9e721bebd27f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/jquery.jqplot.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bdf24f741397b40153c3c2b82b4ed70823eacd9e"
        },
        {
          "alg": "SHA-256",
          "content": "8737c4cb9d5621d151432d87bb4365e5e5936f34f82ade084986012f25267dd7"
        },
        {
          "alg": "MD5",
          "content": "831414b83f81dd33ec69c23df6f2c88b"
        }
      ]
    },
    {
      "bom-ref": "80dad638-de8f-4409-b2a4-cc87b965d6fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/Event.1.0.10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9b027e96f398408ce744ec9e492bef62f97a5e8a"
        },
        {
          "alg": "SHA-256",
          "content": "0b4e2731786d934fa5faa68e3b3e77795bb9321f5ac5652d318822c42ff6c4bd"
        },
        {
          "alg": "MD5",
          "content": "f9d1eae75153ba548e5783ce3375a86f"
        }
      ]
    },
    {
      "bom-ref": "80fa22c6-b071-4bd8-abae-953c3c3cf900",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libattr.so.1.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0dc02667c1451329e26879d97c53bcae6a8d914"
        },
        {
          "alg": "SHA-256",
          "content": "7f50f91cc02a8bf12119b5d4ce81273c69e1fadd9be499bde0f43c47d0026e07"
        },
        {
          "alg": "MD5",
          "content": "e8feb6b8ac215b468839e2ac31a2f90b"
        }
      ]
    },
    {
      "bom-ref": "8103e1bd-bbdf-475b-a87d-eaa08100a211",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfdisk.so.1.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d82d57a3eba6800a248a928572145f40d24ee25"
        },
        {
          "alg": "SHA-256",
          "content": "914424526ca34a84af8e7bb31fff0b627e96b467fc1d42760abf2f6e650c010e"
        },
        {
          "alg": "MD5",
          "content": "a3a004513f3fb7f45514799e1bd0ec06"
        }
      ]
    },
    {
      "bom-ref": "811a5467-8fa0-46f0-a1b4-9f28c1d3640d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "81256973-92b5-44f1-96e8-826860be431c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/flock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ConvertDevicePathData",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6253f6472dfa9a70fb69a0165b18a1deb665bcc"
        },
        {
          "alg": "SHA-256",
          "content": "36a63b8827d6eb557486ac89da4695ca0a3a39b07178243fbad53e0e5f3056e3"
        },
        {
          "alg": "MD5",
          "content": "43f1be3d63f7529bccec66dcbbabfc4b"
        }
      ]
    },
    {
      "bom-ref": "8146c997-29a5-4db5-a7ac-7bb3a61243f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.columnsorter.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "731fe1d3468a5610419831e9b88b85ad0b0fda58"
        },
        {
          "alg": "SHA-256",
          "content": "754c989a047a111fcb9f08faad576dcd0b8c734a6eb1056e674327b647976165"
        },
        {
          "alg": "MD5",
          "content": "18fdc67535a99b2343beae44f60e3245"
        }
      ]
    },
    {
      "bom-ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/dhcprelay",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/truncate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8193a07e-028c-4c81-bca7-18c6d43df608",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/makedevs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "81a35abe-e605-43a6-aa12-0ec3de52f177",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiodcxx.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3b559ef12bda17bbe11367997ba030661aeb8a6"
        },
        {
          "alg": "SHA-256",
          "content": "3ae45b870156c88fd6ec59c63df0a75e41586868360e43c0d65efc0614903910"
        },
        {
          "alg": "MD5",
          "content": "b4f9310935b1458a945d70dd017adbb9"
        }
      ]
    },
    {
      "bom-ref": "81a7eb0b-c5c2-43f8-b5ec-ad3dc856af0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcurl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5391b0de4f5e16c38aab0a4c2fe42e63bad6f793"
        },
        {
          "alg": "SHA-256",
          "content": "c7d93c5b1438dc33772c8d8a613894cc2989fdb9b000502aa7be63af5d9c2ec2"
        },
        {
          "alg": "MD5",
          "content": "7e05260d95e70cf6f392ef74a8f72eab"
        }
      ]
    },
    {
      "bom-ref": "81b5bb7f-030d-4cda-8b94-36e749336b6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libe2p.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b5d34c603dad67131876a198ee5acb6bb94b0fa"
        },
        {
          "alg": "SHA-256",
          "content": "3ebb8f58cd41f3ae8ffe22939e2307dd72068263926b463e813462b1077b5ecf"
        },
        {
          "alg": "MD5",
          "content": "827a4409c74b5dfcc049e1e84dcc687c"
        }
      ]
    },
    {
      "bom-ref": "81b7b82c-6649-424f-a184-b073f745f292",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/passwd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "81befa31-1238-44e7-b42b-0333669f29c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptables",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "81d1422d-1452-48af-9ac5-9769e2ca905d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3c316cc92f4760a09753d1c6a3204ffa10772d7a"
        },
        {
          "alg": "SHA-256",
          "content": "6fa9eb9e59716c7d9a4b4bde75db1157a1dbf9c3dc939d5ce6956d90570c4f64"
        },
        {
          "alg": "MD5",
          "content": "bae5ff6106affee6fd415be6e95e2556"
        }
      ]
    },
    {
      "bom-ref": "81d2da44-38bc-495b-9aef-d57b50a8fc23",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/printenv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "81e41371-2f3b-440c-8119-ae8b8842632c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "81ee7048-c647-477a-ac11-ad8d547799cd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/RemoteConsole.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5533628d62dba2005b2d78f703d7d2973beb277"
        },
        {
          "alg": "SHA-256",
          "content": "a5373e7a34b45b52dd230d5a8250ae01e4872f279728c4bdad617bba80bdd955"
        },
        {
          "alg": "MD5",
          "content": "2c0e1ad8ab1a231f679f861536c821b6"
        }
      ]
    },
    {
      "bom-ref": "81f0ad90-83b3-4681-b141-d72e431ebc4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery.qrcode.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f424bd339870510d1160d1c5da5d698aedbb452e"
        },
        {
          "alg": "SHA-256",
          "content": "f4ccf02b69092819ac24575c717a080c3b6c6d6161f1b8d82bf0bb523075032d"
        },
        {
          "alg": "MD5",
          "content": "05f0b1d7d4b9b0b4975870606d650e3c"
        }
      ]
    },
    {
      "bom-ref": "81f83158-4ffa-4e50-9b99-145fbee35a07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dmesg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "820a995d-9ce5-4501-9244-e8918210c808",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/clear",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "82471bb0-9046-4440-a8dc-37890ca0c50e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/138782-138818.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bfc6e86173a69abf4350ef9612416b89f3d664eb"
        },
        {
          "alg": "SHA-256",
          "content": "33a826be71a0beee47ab6beb02a53f49766a640005db19b83eb471d1954e6cec"
        },
        {
          "alg": "MD5",
          "content": "9697d5ff9f7ae8bef8309d344d35854f"
        }
      ]
    },
    {
      "bom-ref": "824c81c4-50dc-4703-84d4-104cd9579397",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05671467d862148ae5a1adf5ce60b911f6e995c3"
        },
        {
          "alg": "SHA-256",
          "content": "72bb5d1d7e584f2f93e488a578277da51ced1de437218bc3d3d1b647d2e7d833"
        },
        {
          "alg": "MD5",
          "content": "7bf7a67d68e3e5048e2786c2dda82cf2"
        }
      ]
    },
    {
      "bom-ref": "82553659-a2f1-40ac-bc98-be995101306e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/klogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8261c903-4bf3-46ed-8f79-7f88f7551fb6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libtirpc.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83e14166b7c5b716ee6475d17a5eafb47b2b32b5"
        },
        {
          "alg": "SHA-256",
          "content": "d32cc17d6bfd8be45f5eb07a01ca9d839350927f254cad04891f344ab735f31b"
        },
        {
          "alg": "MD5",
          "content": "2e6133cfef677681c4fc9e3792e173ea"
        }
      ]
    },
    {
      "bom-ref": "8264ff87-571f-43d0-9caa-a89f1e83dae2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/hotKey.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5f91fc522a62da04a32a13f894dbac334e86786e"
        },
        {
          "alg": "SHA-256",
          "content": "08f4dd39cd21666996e29f93b4b02be81c593f0bffac851f0d682586fb445744"
        },
        {
          "alg": "MD5",
          "content": "51a0f8c1f94ce00c5a2f3b74b82e3381"
        }
      ]
    },
    {
      "bom-ref": "828839f4-453a-4b8b-ba79-7b56f7497573",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fatattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "828fce15-6771-4003-8b81-5a027c4db552",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiDiscrete_SensorProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52028d2590e6c00aaba67816c2a939b295ed5e3c"
        },
        {
          "alg": "SHA-256",
          "content": "4dca2527ceed5549003edaff9e1ff777f0f05689cd783e1e1ef27b77b743f522"
        },
        {
          "alg": "MD5",
          "content": "0fa351821b8a3f1a425cf7a6c26c32c5"
        }
      ]
    },
    {
      "bom-ref": "8294193c-a4d3-4d22-b485-3e82a845eb9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/iperf3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "32670a82d191ccb060e3e1668fb750892f0a429b"
        },
        {
          "alg": "SHA-256",
          "content": "5c303bf225ec7a2851e28697e4f799a43b3039997710230790ca3eb96ce28bb9"
        },
        {
          "alg": "MD5",
          "content": "6c03e785599f11e21a6d93caf6e5a27f"
        }
      ]
    },
    {
      "bom-ref": "829ebdc8-c42b-4ec5-b479-77759f48bc0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/bond0_dhcp6c.conf-stateful",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59e8f45d7de2170622f8c564057c64f16c570568"
        },
        {
          "alg": "SHA-256",
          "content": "6ac13b9fc461e782286e052b41302425630093c4fec6476a51f1f335e80b3077"
        },
        {
          "alg": "MD5",
          "content": "bb8abe45c7f5f846302b03e7cdac7c8d"
        }
      ]
    },
    {
      "bom-ref": "82bcc744-04ff-43bb-b6bb-d975d0a7aa3a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/display.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1bf34afca0d005d9d154771a5aaa78964450c2eb"
        },
        {
          "alg": "SHA-256",
          "content": "67dd6eab7d30120fedd6d3deffd1cba2ca76d13c8634adb1698d54474aa17c84"
        },
        {
          "alg": "MD5",
          "content": "910062db9c17406208edd1e94c8fd3b7"
        }
      ]
    },
    {
      "bom-ref": "82ca60f5-e4a1-4884-8c30-1e36eadf5894",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcUpdateServiceExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aaab4a5dead63d355be940bcf7e8c1f0e41a17b1"
        },
        {
          "alg": "SHA-256",
          "content": "4fa5fe6d5b4c280418ae860fdc336c4e5d0ecae2cd243107f2bd2ba71d6fdb7f"
        },
        {
          "alg": "MD5",
          "content": "7db4a2e6e12c7401e96795626b40385c"
        }
      ]
    },
    {
      "bom-ref": "82ca70bc-ead7-47d0-9fdf-5272e6fbc4eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/storelibconfit.ini",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aea491731d8cd5ff202efb188c188af3349110aa"
        },
        {
          "alg": "SHA-256",
          "content": "3edc94c632fc15ba0e4a95c39c2f1842d939021be9cd1f5889db490a3fc58ded"
        },
        {
          "alg": "MD5",
          "content": "ed201c2996719ae78d16a0745fc67703"
        }
      ]
    },
    {
      "bom-ref": "82eaa627-93ec-43f1-af73-c6a3a08c4f2f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "26f5b258e68accdd82ec5d9ef10468a30c8ea604"
        },
        {
          "alg": "SHA-256",
          "content": "4184e126fd0f2d2aca2c7c9f751bf04856fd7a691e610e9ed1225e2bdfa6f19c"
        },
        {
          "alg": "MD5",
          "content": "0a59ec3310a68bbdc5337422e76df855"
        }
      ]
    },
    {
      "bom-ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/setserial",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "82f0fbf8-a97b-47e9-a03e-50086fa27ceb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsVolt.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6aef20d6e3920310cad952684a47b57a68f6ce8c"
        },
        {
          "alg": "SHA-256",
          "content": "1588ca5af8e5a261c3cadd582029b604907f22c9aac5291e7e21ec28ab74d870"
        },
        {
          "alg": "MD5",
          "content": "f409519c2200087fd07b155d2626249f"
        }
      ]
    },
    {
      "bom-ref": "8341a3c5-ab4d-4022-8717-f8dedb7da553",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/eject.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74cfaa7faf224d02c4b7ec64939b9382d868288c"
        },
        {
          "alg": "SHA-256",
          "content": "0efd6c35f6c8f5ef877e692208638590f653f9261e28d2dca5150b5a8bded9a7"
        },
        {
          "alg": "MD5",
          "content": "96ec3eb5e91bec21d351a9296f5697b5"
        }
      ]
    },
    {
      "bom-ref": "83851c99-d7e7-434e-a3d6-20649dcd8c1c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcAttributeRegistry.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d26d7402fdab5a175a1720897c9fbd6da262a0af"
        },
        {
          "alg": "SHA-256",
          "content": "0f606405ef076891f5b81f90ef29da7cc8d6adb58fc195ab6d7ebe229fbae48f"
        },
        {
          "alg": "MD5",
          "content": "b856830464dd77e47ae6cb7162036274"
        }
      ]
    },
    {
      "bom-ref": "83947ba5-9878-4f54-9941-1279aa91f062",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/MARVTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "daf18c1bff62931f467021c2a60e7bc9b39f5c73"
        },
        {
          "alg": "SHA-256",
          "content": "5de43a7222ec1057f645d4d42f3dbf09fa9360f1ccd19ea709db74538cc96391"
        },
        {
          "alg": "MD5",
          "content": "08ef90d98bdb2c595d1fb286c2092737"
        }
      ]
    },
    {
      "bom-ref": "83bd870b-2735-4ee8-8b4a-544f2875ef01",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/fw_env.config",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "10f2bfddaeb4a2c102f8e52b12a8dc68eb63bfba"
        },
        {
          "alg": "SHA-256",
          "content": "6428fbe9245a820bc4ce19d62777174525a16343de9614c448736eb410770adc"
        },
        {
          "alg": "MD5",
          "content": "a3fa7f42cc6b22006c387cbb7546668a"
        }
      ]
    },
    {
      "bom-ref": "83e8332b-bb2c-4d5b-9515-755ea894b71c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/eth1_dhcp6c.conf-stateful",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "82e3df456b4b348be5a1bb942bb8c2842744b98e"
        },
        {
          "alg": "SHA-256",
          "content": "7e28a0e8af69f8f88cc981e47a25f4809ef8b0b6761ff957f4af3094dbe18c73"
        },
        {
          "alg": "MD5",
          "content": "3a1d1fde5a27cfae8068b75ddd12c26a"
        }
      ]
    },
    {
      "bom-ref": "83f3cb6d-ec81-40dd-9b99-45cc7ed0c615",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcLogServiceExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1eccadc8477e645d8279476e414196fca1a4fbf7"
        },
        {
          "alg": "SHA-256",
          "content": "4ccf5b8408c40842f4106350e33ce79f21d6d7393c0170a02f81fe254d442124"
        },
        {
          "alg": "MD5",
          "content": "318e41a27167a88897d92d23c1914025"
        }
      ]
    },
    {
      "bom-ref": "840d3707-b701-4b2d-b436-40928b79b769",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libkmod.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6f45a68931ea375908a18f457def4b0770bea50"
        },
        {
          "alg": "SHA-256",
          "content": "c7b098c5e5b8ff6cfcdca806164c1e0d292c8ccafc5cb36a355106020fa6d523"
        },
        {
          "alg": "MD5",
          "content": "be69052287f9e07633f385c59a28957f"
        }
      ]
    },
    {
      "bom-ref": "84155b1a-690e-4ec8-850b-4b669c05de00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libblkid.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6924e36b26d4a18ad85ff5efc8b2599126bc5d27"
        },
        {
          "alg": "SHA-256",
          "content": "70e7d7361cf32604ebe40438d15c7ac8afcfc94bbdf8b6a4431efdbf7e072afe"
        },
        {
          "alg": "MD5",
          "content": "22be4e7ec1ee523348903a02d5911b6c"
        }
      ]
    },
    {
      "bom-ref": "842fee5c-1e26-49f2-b3ad-b7e78af8db4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssrpc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0a6a213bf8792d422cb5cc595f84f6382b79caf"
        },
        {
          "alg": "SHA-256",
          "content": "ae155407a2acb36182c2e4e1ba9edb2ca90a1c28b058f85f58274827132b4426"
        },
        {
          "alg": "MD5",
          "content": "9539707b9fc975731157e4979335f9ec"
        }
      ]
    },
    {
      "bom-ref": "8434d954-9882-472c-bd22-fe985107f75f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1b5c97650eeb1aacad689f43a8c70e8c90084443"
        },
        {
          "alg": "SHA-256",
          "content": "3bb695a5a704d9e84a5773ec21166ab02039d315d3fa7f4b7cc17297e132e63e"
        },
        {
          "alg": "MD5",
          "content": "c567c44a6ba2e5c621eecbc2ba9062ae"
        }
      ]
    },
    {
      "bom-ref": "843bdf9e-45fa-40cc-9c6f-8eaedf0d6a76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/hotspare.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c45d8b1ac190876f2386ec0ab9264bfbad41d56c"
        },
        {
          "alg": "SHA-256",
          "content": "0bc0b0ed4e77815e6d283ecd2f18dd642a226a90c0f5d28497b058fe41ba350d"
        },
        {
          "alg": "MD5",
          "content": "0edb73e087efbf15cc833479edaf2fc4"
        }
      ]
    },
    {
      "bom-ref": "845e159f-4f2b-4fd2-b320-7ab54e7424da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam_misc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f7070eaa4b489e6f76c6bddaa0b5bcd57f0d3da"
        },
        {
          "alg": "SHA-256",
          "content": "00c1efd1a7673edc66771060c55713d71c76b9a28e5895556a07da506185a94a"
        },
        {
          "alg": "MD5",
          "content": "ee5f5e4e0702d9b4255d053300f869f5"
        }
      ]
    },
    {
      "bom-ref": "8470f6f6-73bb-4a72-9f31-ec66aee3a802",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_B11.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "376bd81f1432d17a4a37e0bb3028d1b9bfb00ef5"
        },
        {
          "alg": "SHA-256",
          "content": "6aff02fcad1109af723951d5ea7c4f3f61ec7e2e3ba3947845da98314c22a771"
        },
        {
          "alg": "MD5",
          "content": "3ec3cacf292f0f5738e0ebf7648dd119"
        }
      ]
    },
    {
      "bom-ref": "847dc334-3b46-4640-8813-a8e18f87e905",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4055cbea6e652a5ce83f13919bd078dfcb3a3e31"
        },
        {
          "alg": "SHA-256",
          "content": "4d52e3557e9b4a82ba0492e47a1af232a028a29f994bd097d4135e601eae8828"
        },
        {
          "alg": "MD5",
          "content": "3a8f63736756da542cd42016866d2df5"
        }
      ]
    },
    {
      "bom-ref": "84a8fb43-f833-444f-9cb3-364b27f16cf9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/configuration.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9f4167688285f8f713610636ec2ad47b57d3685d"
        },
        {
          "alg": "SHA-256",
          "content": "dfe614ab3787e96f97778ac44875dea405f85c596fc2ec79f0657a0182fc5961"
        },
        {
          "alg": "MD5",
          "content": "ebce23005ea6d252a0f3d037221a9637"
        }
      ]
    },
    {
      "bom-ref": "84b803ee-6787-4b08-a193-f66c2fd6017e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_grey.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c92f362113a034ed25005015ede4a7585b306095"
        },
        {
          "alg": "SHA-256",
          "content": "99152bcd20c45b888f9f2206a0b5929023d78ff3c0fa40b64e73526443d676f4"
        },
        {
          "alg": "MD5",
          "content": "f2e6d0aa6097b38c3c98662fd40082d0"
        }
      ]
    },
    {
      "bom-ref": "84c0dfef-722c-41ba-bcfe-5f474116f429",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgcc_s.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73e706420ba6cd42c7c46081f711cbb6ef060457"
        },
        {
          "alg": "SHA-256",
          "content": "e7a1e6edccdd69fa1f485b56998c3562ca13fa99f7903492fc3abf92d008b035"
        },
        {
          "alg": "MD5",
          "content": "b47c310f90099e06d410c756c19713d4"
        }
      ]
    },
    {
      "bom-ref": "84d825ad-abf2-4a39-9b3e-d6ac88a92d7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/HDDTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b01e5e7b84048d9e7f46cd7642b0848a160384b5"
        },
        {
          "alg": "SHA-256",
          "content": "8ac6692f89bbb0f80253677976ad23bd9dcc972f2a44a18df3b92fb51fab2009"
        },
        {
          "alg": "MD5",
          "content": "827596759381e8f402dc99d93b9a26a7"
        }
      ]
    },
    {
      "bom-ref": "8501305b-7353-4327-a857-75c46dcafada",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_hesiod-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c93d3ebff914ce1afe6fe9693cbe3dad38e4ece2"
        },
        {
          "alg": "SHA-256",
          "content": "2a1d13ca184e6e52a8b9598407f101fd670071ba3da8d7e35ba56ffd92737026"
        },
        {
          "alg": "MD5",
          "content": "f6e6d6f43a82e628f1a4d9f3d11bd853"
        }
      ]
    },
    {
      "bom-ref": "852d10b4-67c4-4176-a084-b53f32263af6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/99misc.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5183480a2ec2e4ee34d44a173f6a3fed260a4e2b"
        },
        {
          "alg": "SHA-256",
          "content": "7f7544612d0718a8c7b70bc57f38f669f95c4158eaef2c96e54e9c704299a952"
        },
        {
          "alg": "MD5",
          "content": "fc609ac3bf7db9223c27c53a0820f36b"
        }
      ]
    },
    {
      "bom-ref": "854860a4-f015-4823-ad39-2443cc46f989",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_network.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b55a44b483fe7bcd33ec93131a3e63af6f275754"
        },
        {
          "alg": "SHA-256",
          "content": "cf17cae1cacb30daca55c53177490d16ed432c1dd9e47349dc91b145a95f28de"
        },
        {
          "alg": "MD5",
          "content": "bcd41e41e08d32d1abab3ff421c34b7a"
        }
      ]
    },
    {
      "bom-ref": "854d95d7-bd1a-4270-a7b7-104005ba715f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ConvertDevicePathData_extract/30596-30651.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5bc3a91bf5dedceb3831f3d24fe6e6aef67e3cb8"
        },
        {
          "alg": "SHA-256",
          "content": "57520a3c032c7a0abaa7e8ebaa47b1304dcea8b5deb1f4ab0d5415db8367958c"
        },
        {
          "alg": "MD5",
          "content": "0095f3b068edd892f86f18056cb18131"
        }
      ]
    },
    {
      "bom-ref": "8565cac2-391e-40ec-ba7f-cb4ffd4424b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_18_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e652be1ed027af59d74e5f20e780689f52f0f537"
        },
        {
          "alg": "SHA-256",
          "content": "5d4e4c405e912d7d04b2b205462dd0ad4f538d71cb34f8cd4e3dbb23bb351a36"
        },
        {
          "alg": "MD5",
          "content": "de325269b74e3951cbecaf46a7e31e88"
        }
      ]
    },
    {
      "bom-ref": "85b716b5-46e1-4491-a4b9-666bdcb3fd2d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/kinit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db5ae20b28df35dad4bd48d8b6b04ac0cc99d087"
        },
        {
          "alg": "SHA-256",
          "content": "d5ed4cea7b6afa11b6eb7d032101aecbe3dd0386bbc1d5589ffbf2f14cc74b42"
        },
        {
          "alg": "MD5",
          "content": "932f8873a05b145ad8e225118fd8dc87"
        }
      ]
    },
    {
      "bom-ref": "85b9dd90-4479-4f2d-8f80-753902a67fdb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/ssd_locate.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "54e981c275d4870000c00925ea3005af4c985402"
        },
        {
          "alg": "SHA-256",
          "content": "838cccff2d2bc79a240c7e2331e15f287b3e5000cc49b6e8cc7f6b53587a3a31"
        },
        {
          "alg": "MD5",
          "content": "87107e9a45541e37e5ef9032ba292061"
        }
      ]
    },
    {
      "bom-ref": "85ba459f-d919-41ee-a7a9-18433198a07b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSoftwareInventoryExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6d1c13b7421f3a2f3a7bf29c04ecd94ebb7e1aa"
        },
        {
          "alg": "SHA-256",
          "content": "a476d64086a2b4da6bf898340aebc403ca9dab0e0b471bcb56a791aa58deb2d1"
        },
        {
          "alg": "MD5",
          "content": "4a6fee80ec1f35d358869f7fecf7b848"
        }
      ]
    },
    {
      "bom-ref": "85dd9f4d-0cbc-4541-acb2-d3b9b44e0972",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fsck.ext4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a28bb1610986ad06bae9d4c4a4fbee104847871b"
        },
        {
          "alg": "SHA-256",
          "content": "8da703169fb2de8391d162bd18ad3d7409611347ef6898d54d6df192f13f9105"
        },
        {
          "alg": "MD5",
          "content": "f86c15cd7e8199d17359fb19da54f3b9"
        }
      ]
    },
    {
      "bom-ref": "85e01f5e-7893-450c-839a-a96a1813bbe4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/webutil.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e7de7e76d6dc5cb14a30d0bbec7a74757ba54b20"
        },
        {
          "alg": "SHA-256",
          "content": "6c7f8cddc766c9999733fb6fa3f7d3fd3aa2291fd19cd685c0688d5ab0a7da9e"
        },
        {
          "alg": "MD5",
          "content": "1bb208ed502caabb845ab62ce85f7d8f"
        }
      ]
    },
    {
      "bom-ref": "8606edbc-87de-4c60-a4d0-9e63981b4040",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_sensor.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f7c9c426042065d405e6803f6151ce8ff89bb51"
        },
        {
          "alg": "SHA-256",
          "content": "c9a878a34ef8ec4605160f5093bda0dd78094caa0d6b3e49524417c332d0b488"
        },
        {
          "alg": "MD5",
          "content": "a86eb474e296fe72e102867c439c859a"
        }
      ]
    },
    {
      "bom-ref": "860d14d1-9b1b-4d57-b30e-07c528229729",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_user.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e334eb6a23ce7f00ec0125dbfec1e096dbf8c18"
        },
        {
          "alg": "SHA-256",
          "content": "f8fb549c69469e27534cd72d985d7e440728e17464c964e62cf6743a34b27394"
        },
        {
          "alg": "MD5",
          "content": "349b97f8ff04957add82e3784bce42f4"
        }
      ]
    },
    {
      "bom-ref": "860d5bb7-2ee3-4c89-81f8-7c2e6aa307ec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/ast2100.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "15f34a934b814633c10c3d69bb3d51415d9c70ad"
        },
        {
          "alg": "SHA-256",
          "content": "29b8d1edf7bcd9415caf4427661fa5679ca8bbc2e0813d3cbff54d66588950c5"
        },
        {
          "alg": "MD5",
          "content": "90155c54ee97edbe21aebbe7df24cd47"
        }
      ]
    },
    {
      "bom-ref": "8623f0a9-b348-4e3b-89cd-b3851a380e0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/LicenseManager.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1555e97a0e9f549755adff044af095665a10d287"
        },
        {
          "alg": "SHA-256",
          "content": "f1240ceb5465fe2b59a6e9cecd362763820c124e8e97a55be8ff6f2b4f886927"
        },
        {
          "alg": "MD5",
          "content": "f253a1876658ae449e6ec43365270487"
        }
      ]
    },
    {
      "bom-ref": "86346026-80d6-4d5d-a62d-c79581392911",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4dec86ff755cbcec7ee53b422349c07805249d5d"
        },
        {
          "alg": "SHA-256",
          "content": "c4957395bbb1b6ab83a41e8d388135228190cea69c3fa7e6284dc57cf1c09d71"
        },
        {
          "alg": "MD5",
          "content": "48a4127b9608b2dacb2a73172aff0ad4"
        }
      ]
    },
    {
      "bom-ref": "86568eb5-1690-44e7-8b39-329d77e9223e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/LDAP_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "970c99b8e1fdca50820b9a9584af709fc4bb0cc0"
        },
        {
          "alg": "SHA-256",
          "content": "ed8e1969273b3e2b36a0871d364a7da8cdb3f1b5598d13f326ed015550d89ed8"
        },
        {
          "alg": "MD5",
          "content": "c2be643446a32a96efb997fd7d442b4c"
        }
      ]
    },
    {
      "bom-ref": "86596e0a-cc5c-4c2f-b11e-28f00f759f8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/scripts/service",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e125dc0bc8b956acbadd08061acf8f1cfeeef8f9"
        },
        {
          "alg": "SHA-256",
          "content": "f0d2e1d0f62fe1961b5a7e8dbf2af0942cccd8c4c928f962e3581cfe0997d5b7"
        },
        {
          "alg": "MD5",
          "content": "a7ba554ef1c0c9224d7ea62bdd5f1950"
        }
      ]
    },
    {
      "bom-ref": "866da63e-428d-4970-9792-a820d4e257cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInternalProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e6eb336f12792e6da7abcca5ac2755c178ef5a7e"
        },
        {
          "alg": "SHA-256",
          "content": "c5f519c5e3611a37741b8b79a36e5b94c81a8b683b1af6bfc860e935b47aa0e1"
        },
        {
          "alg": "MD5",
          "content": "5ebdb9c22b2ab8ba61299cf892727146"
        }
      ]
    },
    {
      "bom-ref": "86879e61-73b4-403f-84c5-310a91f84cae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libcrammd5.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a2c93e2fef7fed59b95b71ab2c2961b03c6e41d3"
        },
        {
          "alg": "SHA-256",
          "content": "b84e7acb656385ac3cb9f9827081163873d0bd5f7231d5757152b3675b62b567"
        },
        {
          "alg": "MD5",
          "content": "52c4c3decbb577c1b3580b0c6939c671"
        }
      ]
    },
    {
      "bom-ref": "86924018-7f22-4748-8180-b61a2cdfc2a4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2ctransfer",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "86af3958-2c1f-412a-ac76-6745d0595db6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/macro.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "09deb293c0a743691a129f3a2358a3b843be9eef"
        },
        {
          "alg": "SHA-256",
          "content": "5cf0aac89187fc612682d9fdf58ee1191d8d1369d4d8e500a5ad02d9b7ce5272"
        },
        {
          "alg": "MD5",
          "content": "958ef755c7830ce446d9c9c025c109de"
        }
      ]
    },
    {
      "bom-ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/whois",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "86ec9671-8b26-4627-a019-16c9b0f017f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dhcp6c",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2941e9724b5ef1db0941d55bbb99df30c2f2ec5f"
        },
        {
          "alg": "SHA-256",
          "content": "00a44c180c7be9cb06dbe0f128c112b020b9c302e95b135a6fcbe2613fd7f7fe"
        },
        {
          "alg": "MD5",
          "content": "7f84064f4fb7ff6d26e079e6ea132977"
        }
      ]
    },
    {
      "bom-ref": "86ed8269-5ab0-4871-8c9d-b6a3a0b6bd20",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBrokerCore.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "522c1a62ad69cb6e50e67018045c1ee5ca0f4fc5"
        },
        {
          "alg": "SHA-256",
          "content": "1a6dce2122edd536e49251b590658f60f09e6f8ee2342f3e45022f143c27dff5"
        },
        {
          "alg": "MD5",
          "content": "07d19a67e0ec66aad41dfa5eab9be169"
        }
      ]
    },
    {
      "bom-ref": "86f4f90b-f617-4fb7-81e3-d9f66d1e1703",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiod.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5461f101552bc82bd1abc1192dfaed3383d88fa"
        },
        {
          "alg": "SHA-256",
          "content": "4444abdc7bb7172e3bd39dae7e2f4d06233be60b90678b1eecfa5e96fe2e85f5"
        },
        {
          "alg": "MD5",
          "content": "368a3e6159b8205c22d2f5d2ee43eed3"
        }
      ]
    },
    {
      "bom-ref": "86fd562e-1f31-4a00-94ba-44353bfaee3d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsdbusplus.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "99f3636ad63abeb7c24ee3add86328dd261b04c5"
        },
        {
          "alg": "SHA-256",
          "content": "3d3e729cb8f91041aaa3827a50531afd5f116819c75a604ac9799e0cb9d210d1"
        },
        {
          "alg": "MD5",
          "content": "a1b09526f50bd2dfb0380426d832cc0a"
        }
      ]
    },
    {
      "bom-ref": "8703a7af-7ed5-40ef-a588-f3528d476d8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/lightbox_play.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "621700cbf7ac6e53bacbf63ff1756c6507298200"
        },
        {
          "alg": "SHA-256",
          "content": "ae22b03b8b50ef0d7c02b01d1d604c4580bc5ce19321162be21ad67ad9c477dd"
        },
        {
          "alg": "MD5",
          "content": "689e01d67ed1d11d532f701eed5d9185"
        }
      ]
    },
    {
      "bom-ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fdisk",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "871adafd-8c53-4427-83be-43aacd45bb10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/blkid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "872e7573-23b0-4ec0-8823-cb29770f134c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblzma.so.5.2.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ef77d699dba364df0bc91a98228e2fb6e6d4a95d"
        },
        {
          "alg": "SHA-256",
          "content": "89c182e6d9172516dcb2e497f7bec8428d5d2395b23e4646df1bade8177beaf9"
        },
        {
          "alg": "MD5",
          "content": "e0fc14c034c2c291e4db5c2084263f57"
        }
      ]
    },
    {
      "bom-ref": "874b78d2-0be0-4d30-a064-9483f7c98c09",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.popup.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e1403dbb4912161be768c42b4c927a9fbfd88d5d"
        },
        {
          "alg": "SHA-256",
          "content": "40ab556d309b2d7aad03b4cad0b5c9c4dac486b70c80a23487613ce8eae46100"
        },
        {
          "alg": "MD5",
          "content": "912505cf8c3c118b43e30c8a9c405ff3"
        }
      ]
    },
    {
      "bom-ref": "874c3ee5-7f36-43bd-8558-51ffd9bbbeef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamTemp_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1addc45c083ec18f0c4a19128ca79045061e1afb"
        },
        {
          "alg": "SHA-256",
          "content": "9be470a0efe436d1f0c364b735534a749a0995645aec6a8c4c9dd0b96cb3c6f9"
        },
        {
          "alg": "MD5",
          "content": "ad1cf5a0cd91eae701389ec500cd5fda"
        }
      ]
    },
    {
      "bom-ref": "87529254-1e12-4645-934c-4d800d5b0e62",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libmount.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b9240192537dd5df45a3c2a1b79e1e551f50bee8"
        },
        {
          "alg": "SHA-256",
          "content": "5505cf3c987f962b424d08edbf9ac7111635edd8b176835b1f525c2090d9ced6"
        },
        {
          "alg": "MD5",
          "content": "bbf9df27d07a6173db55f81d47b3492d"
        }
      ]
    },
    {
      "bom-ref": "8768cfea-b589-4d7b-a112-da578f5cbe52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_fw_update.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7cda9917a7cab7a4040acf8c51145fed4ae6192d"
        },
        {
          "alg": "SHA-256",
          "content": "bffaaf95d70882e633a6e3d06d27d922b34d0bb497836d89c1ec6b483a98b071"
        },
        {
          "alg": "MD5",
          "content": "8c8f82fa90a2e54179b84ae6e14a3273"
        }
      ]
    },
    {
      "bom-ref": "7b21ba3a-8b14-41d2-9094-dd30eac9583b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsCurrent.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "25456fa1bc342258ce57bdfc9027aa50eea845ba"
        },
        {
          "alg": "SHA-256",
          "content": "04ec0f779fc3f7f8c9df141ba3075ed4776600e348d7980454f29da3bffb7280"
        },
        {
          "alg": "MD5",
          "content": "669570cc337e310186c7109f4c17f116"
        }
      ]
    },
    {
      "bom-ref": "7b63c3ff-a6e8-4662-b601-2007b8b996d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_pef",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e88b486223876e3e2fe6f38b51ebef52157dd4b5"
        },
        {
          "alg": "SHA-256",
          "content": "b477ad101972c42aea3bc247539a6bb94bfd4545a2b8d269b7053b61e2314918"
        },
        {
          "alg": "MD5",
          "content": "e17574fa74e2d3bd9bf2944724c1f833"
        }
      ]
    },
    {
      "bom-ref": "7b6e9221-3fc8-4462-bbb2-6c50229a2dd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hotplug.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "85a9ac1b5ebb230304a844e2e6b8d8f89209f4a7"
        },
        {
          "alg": "SHA-256",
          "content": "b5bf0170ea6a6c721cbe92c677689cd958f9e18ff5de996d50acab37dde12c8e"
        },
        {
          "alg": "MD5",
          "content": "b46139704c978fbbf214d91f595c96e8"
        }
      ]
    },
    {
      "bom-ref": "8856febb-99e4-4cdb-8645-8cbf121ef898",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/prepare_json_schemas.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61cec9f3c625eb61b7609f2be6417a4514d8eba0"
        },
        {
          "alg": "SHA-256",
          "content": "f7e5e0583329947c2fd5a953b6d7026493401daad3f92ece88e6fea9aa91769f"
        },
        {
          "alg": "MD5",
          "content": "3b8865db132989061895991b62f1d9b9"
        }
      ]
    },
    {
      "bom-ref": "887e3ec0-60c3-4ffd-ac93-5b12337bf591",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/eject",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8886ce2c-8516-4896-a7ab-0068713bfe0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/maintain_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "19e3ee4053f74ec3226490e14f278f0bf5b328dc"
        },
        {
          "alg": "SHA-256",
          "content": "6450e7f67858deaf4b6dfa1a9482f54ce08f03b9a0ba9249bf44beb8c3c9a1f7"
        },
        {
          "alg": "MD5",
          "content": "a8e5a15aba27288b737c1278cd0f37e3"
        }
      ]
    },
    {
      "bom-ref": "88b4ca8e-6f7b-43fa-b814-ae0226069fd3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libtirpc.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83e14166b7c5b716ee6475d17a5eafb47b2b32b5"
        },
        {
          "alg": "SHA-256",
          "content": "d32cc17d6bfd8be45f5eb07a01ca9d839350927f254cad04891f344ab735f31b"
        },
        {
          "alg": "MD5",
          "content": "2e6133cfef677681c4fc9e3792e173ea"
        }
      ]
    },
    {
      "bom-ref": "876f892e-c766-4bf7-9684-13cd41f9c040",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcServiceRootExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b9cbcd452283b009d92485e19ff68c3211a087d"
        },
        {
          "alg": "SHA-256",
          "content": "eb2d98b7a428f2216a25a0623938e8090d8530000e8ea3e3c31615059ae4f025"
        },
        {
          "alg": "MD5",
          "content": "e663f27cbe060353bccc9ddbb35f86b0"
        }
      ]
    },
    {
      "bom-ref": "876fe42e-7762-440a-99c6-364250ad16db",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libplain.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d790d2c17d12fa79d8ba0de21f37a2a65bc496d"
        },
        {
          "alg": "SHA-256",
          "content": "2e153c5f71bd55f24701c39d2d7343b97c680214b7209aae3c8dbc2f1e9322ac"
        },
        {
          "alg": "MD5",
          "content": "ca710a742c73d4d91fad7860fb565fc6"
        }
      ]
    },
    {
      "bom-ref": "87719abf-1d76-468e-bfbe-4d5e5d7cb631",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/factory_shareOnly.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4ae756134cbfa5e7372d31e38a6c569cc5537a3f"
        },
        {
          "alg": "SHA-256",
          "content": "71e5767401aba1cdb702eb8f08db683526462807af11ce940e29b88ce3a86950"
        },
        {
          "alg": "MD5",
          "content": "b77279fe77aab3976e5ed1eb9d0ef275"
        }
      ]
    },
    {
      "bom-ref": "877f6ab9-ccf0-42ac-9f05-44275b72e031",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c592135c19384418fc3fed390eedeaab10ef5b4f"
        },
        {
          "alg": "SHA-256",
          "content": "7daf1079012acb8a6e3061c61a680241d7a8d9951c1d2b85514580f01f6b9512"
        },
        {
          "alg": "MD5",
          "content": "616b385656a3f70509d85fd0629a1db4"
        }
      ]
    },
    {
      "bom-ref": "877ff2fa-3188-40bb-868b-a1f88c820384",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9b3bbdf4a76b4ccf84d709e2dd21c590a49d1204"
        },
        {
          "alg": "SHA-256",
          "content": "6e8ddf93a4184eb3a4882cd787f6e799b75d120eef35777137f9d4fb2a1a4fc1"
        },
        {
          "alg": "MD5",
          "content": "ae1a78850cdad4276d897bc5ee15399d"
        }
      ]
    },
    {
      "bom-ref": "8784f25b-a4fe-49c0-aec3-2ab4ba363899",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libcimcClientSfcbLocal.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f82286127ecb8964115de88cab6ca9673731d"
        },
        {
          "alg": "SHA-256",
          "content": "19378c0b68daf27eb1566ce78c6598ba7214a554ea354c8e6ee6d960d7912ebf"
        },
        {
          "alg": "MD5",
          "content": "86c95df95a995dd22b523f9a26f56b3b"
        }
      ]
    },
    {
      "bom-ref": "87883146-ad4d-4f03-a68c-6bcb62e5ac33",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DSF_A",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd2d0988f22d7aa89efb1a810f0e8642afbcbc10"
        },
        {
          "alg": "SHA-256",
          "content": "94f9ef88e6458d0d4df02809d999c083b59f064eeb871995d23a8dbb8d86ebd6"
        },
        {
          "alg": "MD5",
          "content": "4e5217e95c4698bd592a4267490e6a64"
        }
      ]
    },
    {
      "bom-ref": "879302f7-417e-4e7e-b442-da6e5031a28e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcHARAIDController.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7f3ff39959999f9281ee30b8f422a600bc88e4a"
        },
        {
          "alg": "SHA-256",
          "content": "fa93c5f37699c3aa18767e3ad4a353a6a251c0404ce20e6acbfaf978a0fe9707"
        },
        {
          "alg": "MD5",
          "content": "95e2197fb46c4e27df5222da11d9d0d5"
        }
      ]
    },
    {
      "bom-ref": "87bdab38-a87f-47a7-95fb-289236d7213d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuv.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d310b90b6f13aabaac71d1c11b2b0e0debee4666"
        },
        {
          "alg": "SHA-256",
          "content": "fbd9ec76d59f8f40f5aa4364e711e2cb62ad8ad74de5b99330b97816093a5e3f"
        },
        {
          "alg": "MD5",
          "content": "e96203676da186cd9642a68b37045b88"
        }
      ]
    },
    {
      "bom-ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "87ca8729-28aa-4277-ae38-37bbfac40107",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/devmem",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "87edd959-f5ee-4510-984a-de5e94b7f17a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/uisopin.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ea26241b2a359fbe2d21c3e374cd59ea5c2ebba"
        },
        {
          "alg": "SHA-256",
          "content": "b1016e801b757d05bb756d4572785c005a98ba3d324d496bd69480542546e65b"
        },
        {
          "alg": "MD5",
          "content": "6fe5903063dc8b052a9098d3b9f4f081"
        }
      ]
    },
    {
      "bom-ref": "87fd8291-894a-482f-924f-ecf380a6b168",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_db-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "add577b2bee7006c056bfb9dd9098cd77a9424aa"
        },
        {
          "alg": "SHA-256",
          "content": "830ac71c89c765dac83ab04c6b7a31c93c9b35aaa272ff2b510925f58ad7bc2d"
        },
        {
          "alg": "MD5",
          "content": "a0061de53278a6c53438966b253cab74"
        }
      ]
    },
    {
      "bom-ref": "88016bc4-32d8-4255-b8fd-47a3fb335888",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamInfo.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a07b388e3366427c8395cd2f2a7040693aea1c14"
        },
        {
          "alg": "SHA-256",
          "content": "cb7f109432890b5ae0197b976453027d387d11f84789b8e2c53c5531d5e9b423"
        },
        {
          "alg": "MD5",
          "content": "ec18e013ef3193997fc9c13d8e05b2a9"
        }
      ]
    },
    {
      "bom-ref": "880850ad-6944-49b3-b9f9-f1797354040b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/udhcpd.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "733b2dfbe321898ce4e7a4d590c368c4f26e8045"
        },
        {
          "alg": "SHA-256",
          "content": "e9b53336552a84ed911b9665512ae6751d54e4159e5015168ffc08f8ccfcee6f"
        },
        {
          "alg": "MD5",
          "content": "0071eba5c3763e2a213ab4c2b06a3f86"
        }
      ]
    },
    {
      "bom-ref": "8815eaaf-e979-480d-94a0-a80a835675f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/shred",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "884f91be-f505-4295-9bfc-be2712272a13",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/redfish_launch_ikvm.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "113724b9628338ce5956f8f069b4d1346b8fa048"
        },
        {
          "alg": "SHA-256",
          "content": "afdc011934210d2ecd73d89d15b0b2836f60925d92ed3417ff2c5db43b86649a"
        },
        {
          "alg": "MD5",
          "content": "f4a6941004520a0ab079b3afe12fc090"
        }
      ]
    },
    {
      "bom-ref": "a3be6c3a-ca38-4798-b242-d5855b2d093b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/dashboard/systemInfo.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "37268501f09ea30242848e93f134f928529002a9"
        },
        {
          "alg": "SHA-256",
          "content": "eedb78dcc568a429780d36e3d9f1b47524fea6c4fe4b411dc90809dca4441014"
        },
        {
          "alg": "MD5",
          "content": "200aab6ce7f4f00209fcc0a3cdef4bd4"
        }
      ]
    },
    {
      "bom-ref": "a3c0e66c-006e-49f3-a08f-99a6588946bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/maintenance.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a30c3168dbb5767b305b5176934b4078cfcfe914"
        },
        {
          "alg": "SHA-256",
          "content": "aa38fa364e6806a7961b44ad1920bb48061f6ea176e4814612353d20f9f6f33a"
        },
        {
          "alg": "MD5",
          "content": "64cd111a81883e1dcaf050c5a7524121"
        }
      ]
    },
    {
      "bom-ref": "a4117bae-9a8e-42e2-bfe6-ffb838d4166d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypt.so.2.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "856c779beac13008d0e69665dcfaea2f47502c1c"
        },
        {
          "alg": "SHA-256",
          "content": "44f1f3a07fa4fb9e5e750f29e0c96fa4b9e907257603f33a7aafaad97edbd9c3"
        },
        {
          "alg": "MD5",
          "content": "bd311838d9a1f9fab7943feb837a31b0"
        }
      ]
    },
    {
      "bom-ref": "a4217b21-31dd-4c10-8ac7-90bd25fa1c01",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libssl.so.1.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "594871c48f22d331838911db7aec6e843f665382"
        },
        {
          "alg": "SHA-256",
          "content": "3bcf0d5b64eade33f3fbcbd600867cf4e8b32b2845e5095a45ddd89dc09ef41d"
        },
        {
          "alg": "MD5",
          "content": "53d34e537bb10640b23bfbd236170a0a"
        }
      ]
    },
    {
      "bom-ref": "a427f127-8fb8-488a-8f54-7e0dee36a8c1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmphelpers.so.40.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49d62cdda243fadbec3137e026ddd2d482ccd737"
        },
        {
          "alg": "SHA-256",
          "content": "c741126818136030140883ea22b587536fd7e14ab72b66561a481afab7a8de1d"
        },
        {
          "alg": "MD5",
          "content": "61b0bca771c41ada0a3c659f0a0851d5"
        }
      ]
    },
    {
      "bom-ref": "a450f635-9d7e-4b4b-8917-c7503eb90fe6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "19e05dca-9d37-4756-95ce-36e42f3fab8a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi++.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e23ff920af42f30e4bbabdb292a51b2759553885"
        },
        {
          "alg": "SHA-256",
          "content": "b65622ddef67a12193187317c574d318ed1b793e7880ddb40dfc99ec85726ab7"
        },
        {
          "alg": "MD5",
          "content": "c60b67a5e33aab8cce10a28fb81cac3c"
        }
      ]
    },
    {
      "bom-ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/tftpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "1a5b9a1d-1d42-49dc-8e7c-7eaf93744fc2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libe2p.so.2.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b5d34c603dad67131876a198ee5acb6bb94b0fa"
        },
        {
          "alg": "SHA-256",
          "content": "3ebb8f58cd41f3ae8ffe22939e2307dd72068263926b463e813462b1077b5ecf"
        },
        {
          "alg": "MD5",
          "content": "827a4409c74b5dfcc049e1e84dcc687c"
        }
      ]
    },
    {
      "bom-ref": "2baec49c-7411-49f7-8a70-418c5d125fb9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SupermicroLeakDetectorExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8a53a0b9f9af15dc000774d92a70c841a14e486c"
        },
        {
          "alg": "SHA-256",
          "content": "f359c547979a1c53fee96c622efc99af8750a0068aa6a1c040f4f4485aa1d454"
        },
        {
          "alg": "MD5",
          "content": "4e5bb7778e7e28047bb1f1e200a3474d"
        }
      ]
    },
    {
      "bom-ref": "2be1721d-38ec-4754-a797-74a00ff28ff1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f5e229767603b08db1c8cdede77b2b572254e4a7"
        },
        {
          "alg": "SHA-256",
          "content": "ee4661370792390c8f80b6d3ed35a4aec98cbb8d38980046218ed5beac4a95e6"
        },
        {
          "alg": "MD5",
          "content": "e0c5d0909d6c31943b4b56ac293d9a17"
        }
      ]
    },
    {
      "bom-ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tftp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2c2c2aae-0ca5-46d9-9288-d9b5d2327e76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSensorExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "24f2ea6ff7d4d8ad9e1422769c7c746a2286a01e"
        },
        {
          "alg": "SHA-256",
          "content": "43f3442d20fa3425bab3a9134cba382ef36ab2b6e8ea94a49cc91984d2f3427b"
        },
        {
          "alg": "MD5",
          "content": "af6a97846f48cf80ab489203be5a4afe"
        }
      ]
    },
    {
      "bom-ref": "2c2cb467-901e-47cd-ad1d-a6f874e84caa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/websock.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5434286d5b9cef2e1632505aeff3978de7adacd5"
        },
        {
          "alg": "SHA-256",
          "content": "def7557fecd33c25f702630c254912cbb6b1c0c4cc3664c66efa1f54b29f2f8f"
        },
        {
          "alg": "MD5",
          "content": "aa0d363efb4f1aac65494af508b404d7"
        }
      ]
    },
    {
      "bom-ref": "2c4048b6-0bc4-48b4-83d5-32b645f2cd75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcStorageExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "906880024e3834a0d29f70ca1f4e4cdbce9a69a5"
        },
        {
          "alg": "SHA-256",
          "content": "d27bf061a121e9260a2c5bb5922cbc52433cf5f5a2f046f83fad730077fcc98c"
        },
        {
          "alg": "MD5",
          "content": "8f370ba023ab261cb6ef1c871f9ceb5a"
        }
      ]
    },
    {
      "bom-ref": "2c485856-f5cd-4b31-82ef-7ae3a0faa6fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/network_edit_checked.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9400bb826599f5be0c7252f986d4ead8e5edc14c"
        },
        {
          "alg": "SHA-256",
          "content": "3e4fbb6bc2eebb5ed1a894e5feb599503223e6ffa3d82a2ecc8c613424c169bc"
        },
        {
          "alg": "MD5",
          "content": "b0b3ef8cb35a0e7655c6577ef0e6a4bf"
        }
      ]
    },
    {
      "bom-ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/resume",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2c98aeb2-9981-4525-97a8-b9ba288753a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpamc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad4352eb29219fedb534c5879fc90ae24f9bc2cb"
        },
        {
          "alg": "SHA-256",
          "content": "0165cc729d0cb47999017bb17131920ee3c0f8f167a23015360b382ecac2d53d"
        },
        {
          "alg": "MD5",
          "content": "ff01a26dafa4053f19d90e5af314abb6"
        }
      ]
    },
    {
      "bom-ref": "2cc6d78a-9db7-4e1f-b9e7-3885675ce14a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLeakDetectionExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6903e3d55addf4f9dd9eac792fefd7ec9f057205"
        },
        {
          "alg": "SHA-256",
          "content": "368b8f2147c04ec6ad4b53e3c15f842e40383b9822a68f0f433dcc175f51ef5a"
        },
        {
          "alg": "MD5",
          "content": "0d36fbedc534a77a3241d0d84a07da7f"
        }
      ]
    },
    {
      "bom-ref": "2ccdb0fd-0afe-4f81-ade2-e29f48754a96",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e997ef2fe3e70cf09bff164b27f77e85bdf494fa"
        },
        {
          "alg": "SHA-256",
          "content": "83be203ba1d903ea64595e13cb1a2c13deedc6e05927507d1c008543df4710f4"
        },
        {
          "alg": "MD5",
          "content": "ef7db7887916338673ad165d85478bdc"
        }
      ]
    },
    {
      "bom-ref": "2cedcb74-3d55-411d-b2e8-2ef8f715b2fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/inetd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2d0a95cf-2756-4a4e-95ab-c9daaf940289",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcNodeManager.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5236f9b1c8759cd21d5f20ae7f47963b03d03564"
        },
        {
          "alg": "SHA-256",
          "content": "c6405a0e859fe95ac706b486b9738e35afeebad5db908a4b9ff8c364d2d69a68"
        },
        {
          "alg": "MD5",
          "content": "3642384761cfb88dac3e398f421045c0"
        }
      ]
    },
    {
      "bom-ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3019e7f0ff40df99c86c87d12efba315ec97cace"
        },
        {
          "alg": "SHA-256",
          "content": "8480d20fcf2b91198e55a4713927e61be4042fba1f9041538927902b41e79076"
        },
        {
          "alg": "MD5",
          "content": "a459a1531a5e727fca55b9ccb1967f31"
        }
      ]
    },
    {
      "bom-ref": "2d1841f2-fdf4-4221-98ca-2e0296cd62c8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/dhcp6c-script",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed52f6f9b63a8f7a512f041295145e12466fcb3a"
        },
        {
          "alg": "SHA-256",
          "content": "022aa612b4fa08c2bc623354ac4609a1c31eb8dc7192fb7b1b680d7c8a75f899"
        },
        {
          "alg": "MD5",
          "content": "0a2fe2cf66e286aa0f73f12d85ef5a7b"
        }
      ]
    },
    {
      "bom-ref": "2d23a221-ed87-4386-be0e-9d2b7c2b40d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSoftwareInventoryExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d4c83b8c342cb25861de0c3897ccead6c08766f"
        },
        {
          "alg": "SHA-256",
          "content": "50cf2250c8ff5afd794ea865570f9de778915971a47517a2e232ac4d5a522a8c"
        },
        {
          "alg": "MD5",
          "content": "1f0f7962ef10ef901601c7cf2f839fc9"
        }
      ]
    },
    {
      "bom-ref": "2d32f1c7-0660-48f2-8aae-b70b112cd232",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tac",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2d7d8566-f4f8-4e85-9b38-227346f01e00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/load_IPMI_factory_config.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34ddefaf30ba8753a2e7f6a248ca5e6351750c1f"
        },
        {
          "alg": "SHA-256",
          "content": "d36e50d693b023377b6406fbef429a18d94132539fca8acf71950f99e8afb3a2"
        },
        {
          "alg": "MD5",
          "content": "1f16e9b8bcf9b9c9357fb7ddf74ddd27"
        }
      ]
    },
    {
      "bom-ref": "2d7e0be1-e6a3-44c6-91c6-d164ef4d2361",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5support.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6323368eeadb6cf6e72ba885cb3ee700a379c538"
        },
        {
          "alg": "SHA-256",
          "content": "3c8cd3d5721a6ea6ef421edbc1c34c9ec390901bcc9c1d37ddc9ed9cbc56332d"
        },
        {
          "alg": "MD5",
          "content": "dfb7f207ed9135f82c251060b260783f"
        }
      ]
    },
    {
      "bom-ref": "2db00b7e-ca70-427f-bef0-6df2b08f15bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/pkgconfig/netsnmp.pc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bc7b3872414481a47518b3c1bdfae12378bcbda0"
        },
        {
          "alg": "SHA-256",
          "content": "201a3452a778ab827d8ac40affcff7d4577b0233a380c13bbc30bea7b59b986c"
        },
        {
          "alg": "MD5",
          "content": "41a6318ecbd5512b61e77072e513d920"
        }
      ]
    },
    {
      "bom-ref": "2db01ec5-f4da-4e5d-a302-83e9520fc3c8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_PowerManagementServiceProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c38b3c09e620f751e1ebcbaf2b802ee5133e9c8"
        },
        {
          "alg": "SHA-256",
          "content": "6c76985c1d593d0f6dd75a363de2ba9fc4ee5bdd59f64874d3960949a1ca3d06"
        },
        {
          "alg": "MD5",
          "content": "ef4848c27cae1ab7f6155213833a4c79"
        }
      ]
    },
    {
      "bom-ref": "2dbda06a-1e79-45a3-8484-eb0848b14dbd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "87671d6ade5bf7ef453f026df041cbc8337766f4"
        },
        {
          "alg": "SHA-256",
          "content": "c6b5ac8531eaa90fb262ce0eae4cefda2bbba48e51403302d998569a31a0b6b9"
        },
        {
          "alg": "MD5",
          "content": "dfee950cbc7940546ba12a17444e7804"
        }
      ]
    },
    {
      "bom-ref": "48329e94-0548-4475-9626-c61048289e1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/microcom",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2dc2d608-e5ba-481e-aa33-7a633b77b68a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcAccountService.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61dd5b86c4859bcbcd9ed5d294a1d9f7fc1e75f2"
        },
        {
          "alg": "SHA-256",
          "content": "799ef578873e25fbe0b648a8aac09ac6cbb7b080a10cea69a6c14559fafc79a8"
        },
        {
          "alg": "MD5",
          "content": "e59ab0f15ea1ea06acd2ca8e8fefc516"
        }
      ]
    },
    {
      "bom-ref": "2dd70b37-da0c-430b-9c46-76f04401801a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/play.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5cbdd200b5dbe064a32744130420e77fc8b161c2"
        },
        {
          "alg": "SHA-256",
          "content": "64a3b62e1c28cbc8981e0007cbd9c697b515c9ecee318af7b42071ad6a766d01"
        },
        {
          "alg": "MD5",
          "content": "a41d1dce61a79483e13f6f33a7dd3efd"
        }
      ]
    },
    {
      "bom-ref": "2dfc54df-b84a-43a8-9e2a-867b1ffe1c64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/spdm_smci_rootCA.pem",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6a25f87c43c676eeef8050c5b8f70c25766c4b03"
        },
        {
          "alg": "SHA-256",
          "content": "91453a85c914081a33b943bffd3f314cf5f925bc397b3d23ecd48180f0c4235f"
        },
        {
          "alg": "MD5",
          "content": "0a74e1cfbbcfa384d96e90b37d6e59cc"
        }
      ]
    },
    {
      "bom-ref": "2e2d8bf6-4a73-4639-964b-c9d87954ce78",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.data.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5a554e2bb82b7d0cccccf1ae8cdfc50b2e294ddd"
        },
        {
          "alg": "SHA-256",
          "content": "bf5cd60aaec1c442992281f7b30bfb8cda3f098e3bac533a9ac19861059e83f2"
        },
        {
          "alg": "MD5",
          "content": "83d7753f17553c7360db457ab93da804"
        }
      ]
    },
    {
      "bom-ref": "2e324721-9240-4849-bf53-109c02c29de0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libz.so.1.2.11",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ceb65b531fe1dda0eeaf2cabbb1b280d69c0554"
        },
        {
          "alg": "SHA-256",
          "content": "9c28915c75552190c20ea2466bd06536e1b6a09768bc73b4ed3e0043e903c21c"
        },
        {
          "alg": "MD5",
          "content": "52904b92629275f8fd329925ba5524fd"
        }
      ]
    },
    {
      "bom-ref": "2e360864-663f-4d23-b14c-a77433dec78a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/top",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2e4badcd-6548-4c56-a9df-57ec4ce1da91",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/dhcp6c.conf-stateful-temp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "865d9a50e1a866dd48af23268e72536090f69b13"
        },
        {
          "alg": "SHA-256",
          "content": "fdf4de1d180702d349c8c62a92797e926e10f61f0ba8af5df46e1273d89b93a8"
        },
        {
          "alg": "MD5",
          "content": "9e6a7dd26c4ddbcfd66befdc82465736"
        }
      ]
    },
    {
      "bom-ref": "2e6823f5-bd0a-4e08-8cfb-a7b929c2d918",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery-ui.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8b7a32df053a6b24e568f20908e47a90e9a3c852"
        },
        {
          "alg": "SHA-256",
          "content": "0254e2768f39b973e54b2c9a64db23257782b34ede4afdebe3793209573c0a12"
        },
        {
          "alg": "MD5",
          "content": "12c28b31a1369383b3549abf958b01fe"
        }
      ]
    },
    {
      "bom-ref": "2e699bbc-813e-450b-b662-34f5053cea91",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/physical_broadcom.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "80ba82c4654fa9e8a3ad888618558d302610175b"
        },
        {
          "alg": "SHA-256",
          "content": "37a302514049c2b36d92db56a5114fd2babde2c41f82f1381ead01a4fbbbe3fa"
        },
        {
          "alg": "MD5",
          "content": "7431f3e2457107f046f617b50cd2230f"
        }
      ]
    },
    {
      "bom-ref": "2e6eae5e-186f-4c97-af60-099a379b0dda",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ssh/sshd_config",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3c9d96fd3d441875e078ef9bc1d7ad6fa6081519"
        },
        {
          "alg": "SHA-256",
          "content": "7015882263e24f2537075cdf017c171d0dc3ac0e4eb27ca5307c357f450c36b0"
        },
        {
          "alg": "MD5",
          "content": "f3206377e6359b73c423e5eda62b7e07"
        }
      ]
    },
    {
      "bom-ref": "2e6f7c76-6585-4bbc-a83f-6e19eea06b13",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/g_hid.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3792cc6f995f74eeb0290f16499d9cbab85c850f"
        },
        {
          "alg": "SHA-256",
          "content": "bcbc38069bfaeb570c190ff8eeb6394ff173ab806da890d1f9c69356bedef4bf"
        },
        {
          "alg": "MD5",
          "content": "903fa326ef9081c3e52fc07df64f8a2d"
        }
      ]
    },
    {
      "bom-ref": "2ea749b7-b527-46ee-8a50-c7db1928909b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_alert.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "524936ae4d968bf747421411e2aa24fc351d0a19"
        },
        {
          "alg": "SHA-256",
          "content": "38e240c1844ff129cd5b51939dc4f964466b96cccec4905ed9d6f992f46add9c"
        },
        {
          "alg": "MD5",
          "content": "a667ffa29742c86d020ec9d15fe3678b"
        }
      ]
    },
    {
      "bom-ref": "2ec59c68-6eb2-4abb-8823-c19072ab0303",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Power_On.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bff8c7b9689316c5dbc57906ca3d49b3050c0977"
        },
        {
          "alg": "SHA-256",
          "content": "f8f95a0880ac047f0d616b25539c45be75cf3f54073ad331a98012cdab365ed2"
        },
        {
          "alg": "MD5",
          "content": "5c84359188aeae650c9bedd7a354620c"
        }
      ]
    },
    {
      "bom-ref": "2ec90d5c-8935-4253-8afa-94c20a3843eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_TextRedirectionServiceProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74b665505090c7d18eb33af9e6a01b4091796fb6"
        },
        {
          "alg": "SHA-256",
          "content": "3c53a295c586f1739aeaa24d338635eb97b2cbf4592ba21bc6f75aafaec449dc"
        },
        {
          "alg": "MD5",
          "content": "8eed36efa945f87bbabd2372d8f6051d"
        }
      ]
    },
    {
      "bom-ref": "2eefb93f-1c88-4271-8d6c-a66490c9e5cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libattr.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0dc02667c1451329e26879d97c53bcae6a8d914"
        },
        {
          "alg": "SHA-256",
          "content": "7f50f91cc02a8bf12119b5d4ce81273c69e1fadd9be499bde0f43c47d0026e07"
        },
        {
          "alg": "MD5",
          "content": "e8feb6b8ac215b468839e2ac31a2f90b"
        }
      ]
    },
    {
      "bom-ref": "2f053662-74fc-42ef-b3a3-2fa73ac1b3fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2f10b443-2ec4-4cee-ae0c-0ca0ff58764d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/VoltageProtection",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a164db27b1dcdc78a44cd1708db5bf6f6be9a8a4"
        },
        {
          "alg": "SHA-256",
          "content": "8243f717a0fdad0cfc839b1221f5da77d4b6996bf13c4cae8044f7459bea0611"
        },
        {
          "alg": "MD5",
          "content": "612c1613dbc8b27eb9db0d7b20eef605"
        }
      ]
    },
    {
      "bom-ref": "2f1818a8-ca61-4dd3-bb27-72aa92b76bc9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/VolumeConfig.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "efb6fae9720fa921c6437457c3596ed69ebc7b70"
        },
        {
          "alg": "SHA-256",
          "content": "5a5a0d706891580ae009bacb89c89b3a06aa709adeb2283142ed68b050457677"
        },
        {
          "alg": "MD5",
          "content": "4425a0e6382ed82eb1a19e2c0d270877"
        }
      ]
    },
    {
      "bom-ref": "2f19340f-ecdc-43ba-aef2-711d205c4637",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network_accessCtrl.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d1d0568d6d7104092018cbf8f782feab1226dc1c"
        },
        {
          "alg": "SHA-256",
          "content": "d92ace87eed7eb11b46e91b18c4897ffcfefd1b97259385be885051ed6c89f17"
        },
        {
          "alg": "MD5",
          "content": "2b896c97f80906d083843d4bea501cc6"
        }
      ]
    },
    {
      "bom-ref": "2f3f685f-316b-4c18-b5fd-b89c9222cc21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_alert_notification.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f59935c2483663df1192bf5de9ff7b0c2b166e4"
        },
        {
          "alg": "SHA-256",
          "content": "b0cbcb8a469ecebc061445ad33ace515814db31cd99b5a1a02cf3f763c0ae1ea"
        },
        {
          "alg": "MD5",
          "content": "83cdc4782ce861257b82699a9167035d"
        }
      ]
    },
    {
      "bom-ref": "2f5a8c76-dcd5-4378-8f8a-d67f06a0740a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/kohandler",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "13959a35dc20ddfb2db6adee06532775e33fd1ae"
        },
        {
          "alg": "SHA-256",
          "content": "6e769c87fd09c2e2a5a7b0b5f5fd5f846b536bde278c63b3271bb5702f1c5e4a"
        },
        {
          "alg": "MD5",
          "content": "34f97bafec427d0716edf030862a5396"
        }
      ]
    },
    {
      "bom-ref": "2f5b8b89-94a3-4628-a30b-960343a362ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/icon_edit_blue.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49a817b6bbd5f9c2bb690a544fd9efc6f3468984"
        },
        {
          "alg": "SHA-256",
          "content": "b184588e509981797e67d0a95ba9bc39a2cf45b315802905a53b551cf76c5815"
        },
        {
          "alg": "MD5",
          "content": "7e249b7501b50ecc9317d9efdad7979d"
        }
      ]
    },
    {
      "bom-ref": "2f70eb1b-7ab9-41ec-86e5-edb25faee6a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_bmc.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e29098f511ace5a9e0445df3339f31b7e000b717"
        },
        {
          "alg": "SHA-256",
          "content": "ec2589dc8bd6e9529d66119c25cad2e5576ac50ac9a2667a9b735e38da2818c0"
        },
        {
          "alg": "MD5",
          "content": "7ff6be4c250896bfb5ef9473af6ab59c"
        }
      ]
    },
    {
      "bom-ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/vconfig",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2fa04fa3-0656-4684-984b-01c9ad0221bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/login",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2fa65e0e-0d5a-476a-b2d7-cfff196b2212",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_TextRedirectionService.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2c4356a42741c96743385929f1d3f6f68e8700ce"
        },
        {
          "alg": "SHA-256",
          "content": "2780ca63608a8fcd6ffd1ea6de789b78c9f3380e1318d532bd5d1f8853f96c2e"
        },
        {
          "alg": "MD5",
          "content": "08f74bcb5bf251a18860221bdae896fd"
        }
      ]
    },
    {
      "bom-ref": "2fc381b5-8010-4b70-830f-f35b70727829",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fbsplash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2fc3cab1-5eeb-4122-9009-f42e7e74741a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnl-3.so.200",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e6a207c7138d771357a991e8d9fbc0a93fefc80"
        },
        {
          "alg": "SHA-256",
          "content": "cc88216cd17a65c6ca6721817f6ac6130ee194eec0d2da45bac902e7eb5f2e04"
        },
        {
          "alg": "MD5",
          "content": "d86be3332539ffe888e994e49ea65c28"
        }
      ]
    },
    {
      "bom-ref": "2fceaa49-b145-4635-bdb2-5a78a1be861d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/chvt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "2fe01a8a-4459-4e37-a8e7-cc66c2f0cfe3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d3e15453311aff42cb7873747145ff97a5d55e8"
        },
        {
          "alg": "SHA-256",
          "content": "83883d668add3c0f9a23d4e4f4ec79e6d02fcb9ded354522362deee206f755e8"
        },
        {
          "alg": "MD5",
          "content": "17f3e1049800a593a6ac0c284b8d308f"
        }
      ]
    },
    {
      "bom-ref": "2fefcab0-54c8-458a-82a3-aefdbd914f77",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/menu_close_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "95c7bce3bb6152ed59567169bb193cbfd7769cb9"
        },
        {
          "alg": "SHA-256",
          "content": "4be95196090946a140188b5f577a95f79d0bf84f5ac8aa385faf0384ff613901"
        },
        {
          "alg": "MD5",
          "content": "3b1ba82c08059a83e4b21eaa6ff8f18d"
        }
      ]
    },
    {
      "bom-ref": "3029968c-872f-4c3c-92d5-9d2366098294",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsasl2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98519f0656494efe5eae5558e34f34c960dcbdaf"
        },
        {
          "alg": "SHA-256",
          "content": "698b328988afcf64d05ae6856408861ea5e0c7c35df0164785e05103995cb6f6"
        },
        {
          "alg": "MD5",
          "content": "bd3add5bcadd302345c35f0febd82bac"
        }
      ]
    },
    {
      "bom-ref": "3033da9a-8ae9-4c29-9bc6-c14d1ab7a55c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrack.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21b8b72195068be5bd3989d08ae6b217cf97a0aa"
        },
        {
          "alg": "SHA-256",
          "content": "cc1ab4c1737899d07a259590f14a83fbe7217cc3147c3c56f63af014aea58ad8"
        },
        {
          "alg": "MD5",
          "content": "74381dfd63028781d4c750ddeedf2484"
        }
      ]
    },
    {
      "bom-ref": "304024b3-fb62-4d07-b19e-a188371d4595",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkfs.ext2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "30468716-a260-4170-86bd-60bc0833ed00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/getSchema.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af07aa891d1aa8a1c24e108cfb219322444c2847"
        },
        {
          "alg": "SHA-256",
          "content": "249993290b10e5d43627ca0ee7154b4e240677c8b1f9e3b3fbcbbe99172b7e8b"
        },
        {
          "alg": "MD5",
          "content": "0531a0c8030cad63ef3f68d91c95b988"
        }
      ]
    },
    {
      "bom-ref": "304a9bc5-049e-4268-8016-11f8069a7db9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcMemoryExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b65e066b39b700f0676db6a860c45a905540f847"
        },
        {
          "alg": "SHA-256",
          "content": "a935ff729c90f9df829992d23072d191006faa1bc48742d5c50a20c10d4623d0"
        },
        {
          "alg": "MD5",
          "content": "1249c56eb77099773b8221bfb95302d4"
        }
      ]
    },
    {
      "bom-ref": "3055c50c-7479-4414-b174-dd3e02e1e3ee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power_p2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0037a03f0614cef8d04a7188f9b72621511eacd2"
        },
        {
          "alg": "SHA-256",
          "content": "30bd8fa1d358e51ba676c21b3458878623ef0769dffc297b4f87f7d1b6c9fad0"
        },
        {
          "alg": "MD5",
          "content": "12b3613cb1a66bb3854319bdcd1db27f"
        }
      ]
    },
    {
      "bom-ref": "307faec9-f4e3-4079-98ec-137064ae3b78",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a9d8a6819e33bd598a3398c1d1e07238f152a7f7"
        },
        {
          "alg": "SHA-256",
          "content": "be6b11e1ec84e34531d6a7bee2b3e6d6a3c8fb52111f74202b69f8bf426d19fa"
        },
        {
          "alg": "MD5",
          "content": "8bfb98780891ed0f47d45b58aa1a8358"
        }
      ]
    },
    {
      "bom-ref": "30a1748d-75a7-484b-b8d6-13501cbb2813",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCimXmlCodec.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b00e6e042a4370f57608ff1584580406cb08a62a"
        },
        {
          "alg": "SHA-256",
          "content": "8f4768c91b03820dad813a60af5ea22e717238f1da7799304a6b3ebe9163fd98"
        },
        {
          "alg": "MD5",
          "content": "c1eff99b7348a6401bc91e39c593c991"
        }
      ]
    },
    {
      "bom-ref": "30a70c8e-8eef-480a-9446-240fc7c2b247",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logo-chrome.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b70f7f33ef2aecae4d9fa4660161dce5b2a5589d"
        },
        {
          "alg": "SHA-256",
          "content": "66434a61b803eed4ec556cb1ed148b6a7eca63eae6f0bea13352f6c08e93897c"
        },
        {
          "alg": "MD5",
          "content": "3505b424ca342a686a0289c5b2861f9d"
        }
      ]
    },
    {
      "bom-ref": "30af3494-869b-4724-aebc-fe68f4ba22d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcObjectImplSwapI32toP32.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "022d33b2039d9c6eb446acdf2a82f8959f108428"
        },
        {
          "alg": "SHA-256",
          "content": "fd6608d364e3eeaf5386a95dd17982db9e2732998bd387c1be50ff313f47fa48"
        },
        {
          "alg": "MD5",
          "content": "00ce69808b70439147ab6428472f2d87"
        }
      ]
    },
    {
      "bom-ref": "30bea5cd-d921-44ea-ac0c-a5f1f144ff77",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/blink.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5833d82a6d19e191e109ae6f0bd071dd7637182a"
        },
        {
          "alg": "SHA-256",
          "content": "8545cbe6f9bdf30ce0250bc6e2221682e71e68865974da1befe08a738f3e6058"
        },
        {
          "alg": "MD5",
          "content": "39442e37be5db4ef7717fabb29436cdf"
        }
      ]
    },
    {
      "bom-ref": "30d6c52a-5c92-4505-8abd-bf6e97806177",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/w",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "30d9e97b-9e0f-44b8-83d0-86c0738030db",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/ipmiAgentPluginObject.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "761edf5d83a5ae3b0620ba29e739d88e95e0ba2c"
        },
        {
          "alg": "SHA-256",
          "content": "104ff0982559a2f8bdc051014fae93f5419745cd0233a93d678de625be655d27"
        },
        {
          "alg": "MD5",
          "content": "ebd365b9b9ad35f1458fdac420b1fae1"
        }
      ]
    },
    {
      "bom-ref": "30da3ea4-fff3-41bd-8456-2029089a03b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/account_edit.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0bf143ebb205f529848016a3447ccd3f71ed332"
        },
        {
          "alg": "SHA-256",
          "content": "76dbdc4cb4b444f4552066367466a01b14a52b50b99b56ac7ce5087b9139ca5f"
        },
        {
          "alg": "MD5",
          "content": "65cc6d469ab0920b72b477d1aaf1e065"
        }
      ]
    },
    {
      "bom-ref": "30dccd46-a9d6-42fe-818e-296ed1adac7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SCW_F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bbc9404072b7eaed45651671004521206875ef24"
        },
        {
          "alg": "SHA-256",
          "content": "f36f10d706b77fd0853e4c17c6e458ce171410be51c7c3a162bc3bf6b986c6d0"
        },
        {
          "alg": "MD5",
          "content": "3c2442e277bf19f5b530d7edd989cb0c"
        }
      ]
    },
    {
      "bom-ref": "30decfaf-23a6-467a-b00c-5503fdd5773a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcurl.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5391b0de4f5e16c38aab0a4c2fe42e63bad6f793"
        },
        {
          "alg": "SHA-256",
          "content": "c7d93c5b1438dc33772c8d8a613894cc2989fdb9b000502aa7be63af5d9c2ec2"
        },
        {
          "alg": "MD5",
          "content": "7e05260d95e70cf6f392ef74a8f72eab"
        }
      ]
    },
    {
      "bom-ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ifplugd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "30fa38fa-5bf3-4fc1-a6b4-8a6e9dd37f40",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/arping",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "31230b62-1148-43ec-a8d2-7620c2e1bf7e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/IPMIdevicedesc_sample.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8688da38b9ff298732bf5002f68ce13cd749dde2"
        },
        {
          "alg": "SHA-256",
          "content": "1f9f1dc08e01f9e8540678cb6ac59ea66e743d994bce5d88347943c5d0de0aae"
        },
        {
          "alg": "MD5",
          "content": "c6f8da72cfbad16bc763b7e0851c60ca"
        }
      ]
    },
    {
      "bom-ref": "31304c63-7d9b-485e-8f45-b9a73aae1499",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lpq",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "313a9f2e-227a-478f-9ea4-cd9683a98970",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_LogRecordProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "23be148658866d8809b13581e59f9c4fc58f00e6"
        },
        {
          "alg": "SHA-256",
          "content": "2ed5485f96bd7a80faaf4ed1f31438d02234654f6226e75ad2f8c4dee6e435d7"
        },
        {
          "alg": "MD5",
          "content": "ab5293739a08d795dbf5121d3e817ac9"
        }
      ]
    },
    {
      "bom-ref": "314e09d6-38e7-47ab-a389-a780a4d6b945",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBGM_6FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1df1bc68aa4f606d4bfb36bf9cf535360f4e699b"
        },
        {
          "alg": "SHA-256",
          "content": "a9c96baea63e915613f64c206b85cda2a082c0f3dcadbbddbcbc92d76dd20058"
        },
        {
          "alg": "MD5",
          "content": "afb4f95250445623ccd2447d4ed6472c"
        }
      ]
    },
    {
      "bom-ref": "3160e550-5866-4012-b6f3-f31dff5fd007",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/version.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e62a0bb9871452b499a854041f90ba08f51a8216"
        },
        {
          "alg": "SHA-256",
          "content": "d8826e53446215f93294eee12099cc52a572a959e353d6f23429862ff79af9f0"
        },
        {
          "alg": "MD5",
          "content": "a9299870c5e86856ca4b3a7f8207ca7f"
        }
      ]
    },
    {
      "bom-ref": "3189298a-a97e-432a-84f4-398c6ccc2c72",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSystemExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2656c2b53e8b2d60551c765c6b6dd6f61b715434"
        },
        {
          "alg": "SHA-256",
          "content": "a1953183d71e225df165980dbb29a7b5d9f45bc007d3450fd370cd9ce4c7f520"
        },
        {
          "alg": "MD5",
          "content": "be8910435e234d6342da26e70c4865bb"
        }
      ]
    },
    {
      "bom-ref": "319f4a0d-2d34-4f22-bbfc-58424dcb1603",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/net-snmp-config",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "01bc28426a40d7be3706a8ed9cb3d0eb353db225"
        },
        {
          "alg": "SHA-256",
          "content": "2c70b421928faf675f62dd89e08ff43635d2f956519f8f30ca1eb858be447bce"
        },
        {
          "alg": "MD5",
          "content": "dca25c8ca5c78b7441d78714b2e99b40"
        }
      ]
    },
    {
      "bom-ref": "31a6fc8e-7bda-496e-83dd-46b603fd4088",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcIPMIConfig.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e725654bb6bf57f4e0f286108d23f8bb0235988b"
        },
        {
          "alg": "SHA-256",
          "content": "ea94ca6b21fb0e175d71537c6c3dfe37f85015b75ee1368c68845a7970f609b2"
        },
        {
          "alg": "MD5",
          "content": "6ff1b7fc9dabdf1a7c6a620c5cb3d75f"
        }
      ]
    },
    {
      "bom-ref": "31b6a99a-c24d-4a9e-b3ae-a75f34c11393",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpamc.so.0.82.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad4352eb29219fedb534c5879fc90ae24f9bc2cb"
        },
        {
          "alg": "SHA-256",
          "content": "0165cc729d0cb47999017bb17131920ee3c0f8f167a23015360b382ecac2d53d"
        },
        {
          "alg": "MD5",
          "content": "ff01a26dafa4053f19d90e5af314abb6"
        }
      ]
    },
    {
      "bom-ref": "31b78323-dab0-4afa-a052-b59c8f2061de",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/keysymdef.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "614c290691de88ba4432acdff1fc81768d98d6a6"
        },
        {
          "alg": "SHA-256",
          "content": "200297272eae8758cdedace9bc43d3845863b2f0f52c8c65daae4ab3a2ed1924"
        },
        {
          "alg": "MD5",
          "content": "94495d45fbcdaf102c07f5d2d7b7bbd1"
        }
      ]
    },
    {
      "bom-ref": "31ba2612-b0b3-4e51-9243-f09c1fbbe023",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamSensorsCurrent_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b0bc6fe344507396c8d178cbc96b24157de77a9"
        },
        {
          "alg": "SHA-256",
          "content": "42b37631ba19afc01fcff3b7038bd9480ff74d092e59fe8cadf5a3eb84e07a1f"
        },
        {
          "alg": "MD5",
          "content": "5e88d5c8a85a632bc1e564a2ec5d5dff"
        }
      ]
    },
    {
      "bom-ref": "31cccb39-94e0-4c04-81d9-ef76961da93a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/screen_320x460.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d08bb73aaa583ec8d765d28391262a197f2cae94"
        },
        {
          "alg": "SHA-256",
          "content": "2210591a132c286a6d21daeaf4ef8d07f9d79a658fcb301eba7b753f17f94750"
        },
        {
          "alg": "MD5",
          "content": "be6fd424c2eff6ecaa3e08702a9e97c2"
        }
      ]
    },
    {
      "bom-ref": "31d60c89-7214-4947-844a-b38135d996e5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea75a0aad0a60b0b5e53bd43cd73311b27982608"
        },
        {
          "alg": "SHA-256",
          "content": "c52bb517e517e2552d2cfc5901dcc583d300fa0d15ec66f654514f87eea19901"
        },
        {
          "alg": "MD5",
          "content": "ce1a1cb1ec6902d14de4e147ddd14b75"
        }
      ]
    },
    {
      "bom-ref": "31d61675-d604-4840-afdc-d65cce68bd86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e7150148517da7843d6f76bace9acdd7839cd43c"
        },
        {
          "alg": "SHA-256",
          "content": "84cbdfa53a25ef2cd2e47397bc64676fd4706a3f3dbb33832bdb0a3dad14de9d"
        },
        {
          "alg": "MD5",
          "content": "fed0753a07b8d61213bc3b2f1652a4ec"
        }
      ]
    },
    {
      "bom-ref": "31e6ae8b-ea82-45bc-8316-0ff879a7bcd6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcServiceRootExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a412517c57cad94fa0ed9c1f9dc22cda36d6735"
        },
        {
          "alg": "SHA-256",
          "content": "bd5abca1310d77cd430abd3afcfb2495cd312f77ce903e1d38f68a28a585ab5e"
        },
        {
          "alg": "MD5",
          "content": "e7b9b04d21c1307fd14cce9cd880cb4d"
        }
      ]
    },
    {
      "bom-ref": "32140fe2-0589-40ad-94d3-98d52c3b24f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/jtag_unload",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fb90224823f60651086c858cfd638d70a25cf2d6"
        },
        {
          "alg": "SHA-256",
          "content": "f1f795d8c08e8164976a0cd222c0577423ab68210f00ba2a179b51f67d962561"
        },
        {
          "alg": "MD5",
          "content": "c058f7c47edf11cf88f63758d68776ab"
        }
      ]
    },
    {
      "bom-ref": "48375426-e110-455d-860c-e2953c760f9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiod.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5461f101552bc82bd1abc1192dfaed3383d88fa"
        },
        {
          "alg": "SHA-256",
          "content": "4444abdc7bb7172e3bd39dae7e2f4d06233be60b90678b1eecfa5e96fe2e85f5"
        },
        {
          "alg": "MD5",
          "content": "368a3e6159b8205c22d2f5d2ee43eed3"
        }
      ]
    },
    {
      "bom-ref": "3217f544-c69d-48f8-bdef-c97871addd16",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/stageschema.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55dba76309f6dd4442d685be3671a2bf58e2e49c"
        },
        {
          "alg": "SHA-256",
          "content": "6a3c9c7a90b16a91e0867c3e94eed2897d0cc2ac414da32ffd2e99f6032e4a64"
        },
        {
          "alg": "MD5",
          "content": "77728806403e49db1a38f39af0611f44"
        }
      ]
    },
    {
      "bom-ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/makemime",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "32317cd2-8780-41e6-a8e7-cbdda65ac13e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b9564c2e65f78cd86074c1a6fdf224ddc4f7e64"
        },
        {
          "alg": "SHA-256",
          "content": "8bbd61a07cc4f4ed2daabd9af5f18385d46f5721068848f7fde639a92957d275"
        },
        {
          "alg": "MD5",
          "content": "3db2a536cd5aa4c902b101f22df6c3fe"
        }
      ]
    },
    {
      "bom-ref": "324daaff-49e3-41bb-ac3b-bf17d27e38e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e8c3ce29fca627b42c620873876458d29ce8563d"
        },
        {
          "alg": "SHA-256",
          "content": "695f5a61321bda406fc9c8ea36e75a3a02d79040f971f9e2455924683a5aba96"
        },
        {
          "alg": "MD5",
          "content": "92862f65b27f5b651ce4c54a8dd5c98b"
        }
      ]
    },
    {
      "bom-ref": "327b1b17-bbfb-4aa7-a452-f7ba31c2d957",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_ldap.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "665b28606e096867be594d2e1044990f2c0aee25"
        },
        {
          "alg": "SHA-256",
          "content": "f8ae05996faa7a8264fb27bec3b694d392b14d9767cd9951d73b1a31ef52f920"
        },
        {
          "alg": "MD5",
          "content": "9375bc2ce1bd8b7288ec699139e288b4"
        }
      ]
    },
    {
      "bom-ref": "3297b825-fc9d-4b6e-af9e-7d0569721292",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_system.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12ee418534f5c8f651442abce39909b22a974957"
        },
        {
          "alg": "SHA-256",
          "content": "12e857d7e88441bd8ccc905307092f8b3c8279b7d60d2046e177accd46ce7f9b"
        },
        {
          "alg": "MD5",
          "content": "c65d4536eed70407f3e3ec49334b87eb"
        }
      ]
    },
    {
      "bom-ref": "32a54828-0e81-43b4-922b-711af83a593d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libjson-c.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3e0d34bb90aa096f35f13d55d8738aeb474ce12"
        },
        {
          "alg": "SHA-256",
          "content": "60a730320d8a26662e85bbc89dcdd967bfe66d5c9c379b25c0d36dcb8eb120b1"
        },
        {
          "alg": "MD5",
          "content": "665cfefe257e53f7e4774989888b2204"
        }
      ]
    },
    {
      "bom-ref": "32c9a8ea-f212-440c-9c5a-8e4086228b43",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamSensorsVolt_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b7fb076784efb4dad8a218a6a3b6715991425d3"
        },
        {
          "alg": "SHA-256",
          "content": "bdef64ca536b32f06fb8ce6e6ae97ea1a0d087ccc6d7fd180785732f4bc48f8d"
        },
        {
          "alg": "MD5",
          "content": "65a548bdeb957d146c048c090a44c186"
        }
      ]
    },
    {
      "bom-ref": "32d3f124-05f4-4774-ab5b-83132b946ceb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/pcie_switch.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d4db7246b28d07910c349f27d0d88487463dc2d"
        },
        {
          "alg": "SHA-256",
          "content": "554311988c343624ce2a14d6ad7d76ba844c0d27742ea27bfdf937791bdc6151"
        },
        {
          "alg": "MD5",
          "content": "37a8f555f6c0c914776f2534d259ccf3"
        }
      ]
    },
    {
      "bom-ref": "32d88c53-4176-4ff6-a585-a95caf89022b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/head",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "32e0d84c-2789-46f4-9ca4-129498c87caf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sync",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "32edeae2-11e5-49e9-bdc7-92aef1fb3ceb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34eeb9fe7080ea123f3c530c3e81886875c18fdd"
        },
        {
          "alg": "SHA-256",
          "content": "0f68e07adc20581d02272efe4cb48621c31dd6174fce14c5107bcbcdd7d4a590"
        },
        {
          "alg": "MD5",
          "content": "1813c3a8fb71468544dc387adf3dcf88"
        }
      ]
    },
    {
      "bom-ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/wall",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "336a9f4a-4b69-4be1-bbe7-100b13b71fba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblzma.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ef77d699dba364df0bc91a98228e2fb6e6d4a95d"
        },
        {
          "alg": "SHA-256",
          "content": "89c182e6d9172516dcb2e497f7bec8428d5d2395b23e4646df1bade8177beaf9"
        },
        {
          "alg": "MD5",
          "content": "e0fc14c034c2c291e4db5c2084263f57"
        }
      ]
    },
    {
      "bom-ref": "336dfe5e-dec6-48c2-b21a-6b5c68b52fff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcFanExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86940c820d52ef3ddd57f56c4ca1100c9db22625"
        },
        {
          "alg": "SHA-256",
          "content": "077f3fd4288397b1429b7836f1f0fc705ee08c54cc9f417498518bdf07051023"
        },
        {
          "alg": "MD5",
          "content": "5a7f51d49434a41fe50288d1a174832e"
        }
      ]
    },
    {
      "bom-ref": "339b58f0-37e2-4844-96a4-6327616759d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderMem.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57b8c2ff13b620aa6e30613ccff65c4593b1c84d"
        },
        {
          "alg": "SHA-256",
          "content": "e8a328d27275f7987516db4256dc965a24e99e70b41f448d7cdd077676423cea"
        },
        {
          "alg": "MD5",
          "content": "e9c831be3a193556b63c9ae44567b6d2"
        }
      ]
    },
    {
      "bom-ref": "33c28134-c1a6-4883-a2c3-6d720255eea4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSRAM.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "635b5d2ee4511670a65857dc8c0fe68c4bf4c230"
        },
        {
          "alg": "SHA-256",
          "content": "38d84cf0b926aaf0484eefa00681e410e3aab4cc3765284ab164dff2c4a11981"
        },
        {
          "alg": "MD5",
          "content": "91ed009de0f2a288331267ba2dda7979"
        }
      ]
    },
    {
      "bom-ref": "33da3c59-94f1-472a-899e-8addc0652355",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/next.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "51015e5640c71e9ccaf649958e3944113cad7036"
        },
        {
          "alg": "SHA-256",
          "content": "0b536442311a63bbf2fefd642aaaf48e8a3a9b539eef27a89aa1c6616c47f3cd"
        },
        {
          "alg": "MD5",
          "content": "7f785de9f8f184f1e3f5884c1add11a4"
        }
      ]
    },
    {
      "bom-ref": "33fe8d66-c7e7-4fef-b9ef-32b57ebee408",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6308b4cb57a7f4271591d7fc227e0ce8c5db54e0"
        },
        {
          "alg": "SHA-256",
          "content": "5b406cf5d2f75ab398e097d77646375e2c38d481a94c83db0f4f37a8a2be49e9"
        },
        {
          "alg": "MD5",
          "content": "e46840ff9c77fcbf1a6bf2506932f6a6"
        }
      ]
    },
    {
      "bom-ref": "3407c654-35af-423b-8cfd-4140bf3f8285",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblzma.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ef77d699dba364df0bc91a98228e2fb6e6d4a95d"
        },
        {
          "alg": "SHA-256",
          "content": "89c182e6d9172516dcb2e497f7bec8428d5d2395b23e4646df1bade8177beaf9"
        },
        {
          "alg": "MD5",
          "content": "e0fc14c034c2c291e4db5c2084263f57"
        }
      ]
    },
    {
      "bom-ref": "347d0bf9-1df2-48d1-9107-fa5670313175",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgssapiv2.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c541b111d357841919d2d1bd64336b57303a24f6"
        },
        {
          "alg": "SHA-256",
          "content": "7a362fe229fb410f24aea2b1bdc86276e036258f2fe8ceead61179d71cd54d49"
        },
        {
          "alg": "MD5",
          "content": "f7d2d1f089e9a4353f9dd66b825731d9"
        }
      ]
    },
    {
      "bom-ref": "34ab818d-3348-460b-8bf3-4255fcccf7e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ftpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "34bb618c-e523-4612-b636-29309f2c46e4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmount.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b9240192537dd5df45a3c2a1b79e1e551f50bee8"
        },
        {
          "alg": "SHA-256",
          "content": "5505cf3c987f962b424d08edbf9ac7111635edd8b176835b1f525c2090d9ced6"
        },
        {
          "alg": "MD5",
          "content": "bbf9df27d07a6173db55f81d47b3492d"
        }
      ]
    },
    {
      "bom-ref": "34d69ff8-6563-4039-a7e7-4e6d174190a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcFileRepository.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0e0bcd46c921a7cfe3f17f148c34aca498b77fbf"
        },
        {
          "alg": "SHA-256",
          "content": "01b6ea43433942c8dc9936c4e29036113e2266dfe4385b89a4a69c91a2b52e29"
        },
        {
          "alg": "MD5",
          "content": "f593cc63cb653af53f213a2169888f74"
        }
      ]
    },
    {
      "bom-ref": "34e6110d-a1fa-4c19-9a80-8e240469d760",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/ClearLicense_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1cf86db6487bc3f98fc359de5cd25d6f2fb91511"
        },
        {
          "alg": "SHA-256",
          "content": "13f894d9bedd4077406bc5ff740f3cd0a3f9821fadae401e47ca17420e67a020"
        },
        {
          "alg": "MD5",
          "content": "af0a950168387d40016ebec6f89c3f9d"
        }
      ]
    },
    {
      "bom-ref": "34f79dec-e483-46ab-b558-33107bdc5092",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/slogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d2632052bbae3e0db069f3dba6d90175a69de98"
        },
        {
          "alg": "SHA-256",
          "content": "f7803a037c6cbea73b887e4a4934d71ec8f5e00bf9d72d48e604fa34245e2c1a"
        },
        {
          "alg": "MD5",
          "content": "7553aa31b7c13230b85e5e54d72e799a"
        }
      ]
    },
    {
      "bom-ref": "34fdeb55-3a3a-4adf-99b3-2a845fdbba50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/storage_warning.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "daa128f91f93d8fcc95e54a809453f41cd70a441"
        },
        {
          "alg": "SHA-256",
          "content": "3efba709297ca40102fd31c73a60aa00623ae84529c6be65409fe8e2c84e9b4b"
        },
        {
          "alg": "MD5",
          "content": "961012e3a557c42c84c0c0300fa80c33"
        }
      ]
    },
    {
      "bom-ref": "350a0574-10a3-43f0-a03f-dc8afc06dd19",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/BiosFile.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03cc5da74e87f61534fe05d74c3045c92954fbd9"
        },
        {
          "alg": "SHA-256",
          "content": "aa8a1cc515d37e37721942cad05e29754f3abe7346339cbb6e6cf69b57d5caf0"
        },
        {
          "alg": "MD5",
          "content": "7dabfbbc960905cc5702875db03399db"
        }
      ]
    },
    {
      "bom-ref": "351b43e9-c53f-409c-8aaf-50fa46cfdcec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SMTP.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "def9389bd74724780fcfcac492c63babca6da47b"
        },
        {
          "alg": "SHA-256",
          "content": "b8cd3d7c5724752f3b10df5f72622114621dea93c9fa30e62880088a95f482e0"
        },
        {
          "alg": "MD5",
          "content": "5a710e7a9647ef172f54490a90683a64"
        }
      ]
    },
    {
      "bom-ref": "4853f410-66f0-44f6-bdc3-f1dfe4c5ac1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/ftgmac.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e056b630e75373125e3837884b5fc392b58fa679"
        },
        {
          "alg": "SHA-256",
          "content": "65949fde92ef91775ec098922afebe5eceb11d6804834dd7c600d5d8fd818b7a"
        },
        {
          "alg": "MD5",
          "content": "fad88ee8fbe8a5c2f2054bb33a7e71e1"
        }
      ]
    },
    {
      "bom-ref": "351d3885-9b80-4c39-8f3b-3fd6c71db84d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/object/redfishSearch.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "854d0d25ac314aed90dfab423cefe1c3ef059567"
        },
        {
          "alg": "SHA-256",
          "content": "adeb0e2130f814ea50a0c3a625b8923aa8c090f4e50ecd816829643b41aaad39"
        },
        {
          "alg": "MD5",
          "content": "1c7e4cb870ef5d86534c67df9660cc7e"
        }
      ]
    },
    {
      "bom-ref": "352009de-affe-4229-a504-8bec9789a5e1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/link",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "352e2f5f-79f8-4792-b11c-2ced156f06b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/BMCInfo.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "be315178c0801468a51331f5a150fad9d4654900"
        },
        {
          "alg": "SHA-256",
          "content": "8e39507e40a8a81f7952f1e34dfe7a85a5fa9d5d2d3ade24ca6a94a72c073006"
        },
        {
          "alg": "MD5",
          "content": "f2cec03bb63f9f3a0514f5b1ca0688fe"
        }
      ]
    },
    {
      "bom-ref": "35654fc3-59cc-4cdc-bb23-76133e6643bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/factory.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5472f29b8434f7d2a9f2b3ad179b24c411e5da51"
        },
        {
          "alg": "SHA-256",
          "content": "7bbffd44be8fe850c240546e0256b2c9d67836a5ac3db440408fb336e1f5e0c1"
        },
        {
          "alg": "MD5",
          "content": "0b8146599c1bfcadf806648b10f11df7"
        }
      ]
    },
    {
      "bom-ref": "3570cba7-a168-48f9-9704-abf54f4c26ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpamc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad4352eb29219fedb534c5879fc90ae24f9bc2cb"
        },
        {
          "alg": "SHA-256",
          "content": "0165cc729d0cb47999017bb17131920ee3c0f8f167a23015360b382ecac2d53d"
        },
        {
          "alg": "MD5",
          "content": "ff01a26dafa4053f19d90e5af314abb6"
        }
      ]
    },
    {
      "bom-ref": "35985de6-b284-42e2-a9ee-439159acd05c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/x11up_sys_trouble_shooting.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7fd53a81978d4e1cc443b6b9ca5fe318a216a3c8"
        },
        {
          "alg": "SHA-256",
          "content": "fa14ce22d44905b3ec0ece34a20b1a888c79c5119cffb86b3e7c711e4b754270"
        },
        {
          "alg": "MD5",
          "content": "529dcc98c1dce0c31003b2f9e4ebf454"
        }
      ]
    },
    {
      "bom-ref": "35a014bd-5f4b-4f2a-9128-5ccf6b8e4aaf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/lsmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "35b54b87-657f-4622-80de-729fc9498f19",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hexdump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/lsmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "35c1ff16-98d2-4e9f-98a6-e84fc51c9405",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/op.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2bd38d1ed9529af2253be0a539da8fc32ede3ac0"
        },
        {
          "alg": "SHA-256",
          "content": "3ad03d9b60cabe444ecf62fadbd8b597c12c3f47d732b664dfba6e0e89cef9a6"
        },
        {
          "alg": "MD5",
          "content": "919488e69e817f7e6b0deebb209d8d66"
        }
      ]
    },
    {
      "bom-ref": "35ced6c3-3884-44f6-802d-a9a84a8eee6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ping6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "35f7eca2-ccce-4611-a29a-fec82b985260",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcHttpAdapter.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16f0f7ddeb0d3565eb00ba9f7c78a16b909d8f2e"
        },
        {
          "alg": "SHA-256",
          "content": "b419d08ef6de4c00780de544d283e3f0935547529643fb24b153e082e52ace06"
        },
        {
          "alg": "MD5",
          "content": "8bc2a1bb518674242859c6078ce6e545"
        }
      ]
    },
    {
      "bom-ref": "3602626e-d793-4371-9d01-4bea16003ee2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/conspy",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "361a90b9-ca28-4e7d-a95d-33d56c997ff3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/account_delete.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3fc309a99a0eda826f3f170b4711af094c24660a"
        },
        {
          "alg": "SHA-256",
          "content": "0a24b12f9c59f9aa66ffed523791a8141d4bcf8a9f56c68536a81b27cdfc1c29"
        },
        {
          "alg": "MD5",
          "content": "42d71f1bf30ef5c56721b1da99ae6a67"
        }
      ]
    },
    {
      "bom-ref": "362cadb9-754d-41ee-8f72-7850237e25e1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsafec.so.3.0.8",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f7a4e329a10076bfe3de2df9dcfc243772dcafe9"
        },
        {
          "alg": "SHA-256",
          "content": "49a1a5345396a01a83af287b697b2314822374f2714c35f813d0aa9eb9935bce"
        },
        {
          "alg": "MD5",
          "content": "4cf60247d115e7f59b00133f237ca0d2"
        }
      ]
    },
    {
      "bom-ref": "3637ad68-a7a9-4734-acb9-7bcd7c26d37a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxtables.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f577a10a10b85df6e4036e1bf248a306f361a092"
        },
        {
          "alg": "SHA-256",
          "content": "da2593460f7623d27ec31d44fac5c17e64d06c607ae98f71aad3b9f6e0bfc4d1"
        },
        {
          "alg": "MD5",
          "content": "a332c49f74cbe1d7a553910a49da2de6"
        }
      ]
    },
    {
      "bom-ref": "3638a378-7a3b-4f56-8766-979250c5192f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrad.so.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1dcc8c63a1f81dd8fb505472dd2c7aaaeada2886"
        },
        {
          "alg": "SHA-256",
          "content": "b150eb70d34605ad251d5b6b307178f52e5439dc9bc7aad1dc687ddb17fb3bbc"
        },
        {
          "alg": "MD5",
          "content": "e8b634787c3c43c7dc95acdea592e88b"
        }
      ]
    },
    {
      "bom-ref": "365bb562-ff08-4696-bf4e-da38441f6256",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssapi_krb5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b57a3c32db8ba424f5612e0a912e12303d197cb5"
        },
        {
          "alg": "SHA-256",
          "content": "101d2bbfa691e8a3c4fe0b9e6a8b3100318fd6e69dcc049b4cbbf558c95a25bb"
        },
        {
          "alg": "MD5",
          "content": "f7411491c74b7bb379688337fcbed1fa"
        }
      ]
    },
    {
      "bom-ref": "367891b2-f226-4261-868d-23f471eed1d7",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed_extract/8396707-10014720.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc106732792fe931c8e53444fc4b07860ff37a7c"
        },
        {
          "alg": "SHA-256",
          "content": "f77224421e1c48b2bf827bb44955b573ffa734ad7030eb728181db689294d3e4"
        },
        {
          "alg": "MD5",
          "content": "39fb8f4c3e4a415e147773e67ae301be"
        }
      ]
    },
    {
      "bom-ref": "3692ed62-82cb-42b5-8620-7975d1e50dff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ethtool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4edb596e72a345200eb29737384c9d470c7aabd0"
        },
        {
          "alg": "SHA-256",
          "content": "f8ea49ab6bd75e667716485b39dde1104442363a6a2c4e6259ce7c33a52bb9ed"
        },
        {
          "alg": "MD5",
          "content": "c5d7d8e90f1643615ffc7f8c0c10b201"
        }
      ]
    },
    {
      "bom-ref": "369ea41f-c334-48eb-90d5-8544803c68d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_resetBios.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "868d2897d6266785625767f4749b615dc4954435"
        },
        {
          "alg": "SHA-256",
          "content": "be1d100f41b7cdbc1f9869f370f26fdc3981a0ab7356dbe91229473443d7ef32"
        },
        {
          "alg": "MD5",
          "content": "b9e924555e0c4d8f2783b6a1299e62b6"
        }
      ]
    },
    {
      "bom-ref": "36a00551-6e7c-4384-a7df-db0906b7ec17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip6tables-restore",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "36c42851-a1d8-40c5-b3d8-7b6bacba4fbd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gzip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "36c46d40-d57b-4daf-b06d-9fc087da666d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libdbus-1.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bac7ed38fea3d91578bf6355d7dcc4cd9e6e631"
        },
        {
          "alg": "SHA-256",
          "content": "f5ef71790a57c5ddfbe1838a0f16d30c4073fcd580a63538ec09e93ab4035793"
        },
        {
          "alg": "MD5",
          "content": "2c67e8ff3d831bed06186c4373e44389"
        }
      ]
    },
    {
      "bom-ref": "36db62f9-f0f6-4d56-aa76-97272aa32889",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptables-restore",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "36ecce89-1d99-4293-acdc-afc4b16c1f74",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ncsitool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a6384b3434200fe15b306b420117513a848e8cab"
        },
        {
          "alg": "SHA-256",
          "content": "068fd0f5231e841c63a876959c1a63f70ee77dc4ac402a906c7c7c65c5230b16"
        },
        {
          "alg": "MD5",
          "content": "7bdb929297a83adf6a7eae36c9bc6f8c"
        }
      ]
    },
    {
      "bom-ref": "36f6b08c-7a59-4011-bc93-ac608f4b304f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/sendmail",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "36fd20ee-c6d9-40a4-8a1c-12c08af90df9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcClientXML.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d8ad38f778259f9b926210f752e6d64bc567971"
        },
        {
          "alg": "SHA-256",
          "content": "5c45ae6f06e8404983f059da2d7066a4a940f58b47c2b441bbc2b5dcc4444806"
        },
        {
          "alg": "MD5",
          "content": "78a89895bc64aff235f1c709d2b686ef"
        }
      ]
    },
    {
      "bom-ref": "37074295-0e8a-4c59-a420-a56876f2ab0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery.translate.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3aea35783865382d278a17e747197a2e1c3cd533"
        },
        {
          "alg": "SHA-256",
          "content": "112bec08967ef252be6ee3b57129484acb82dc9b3e253ff3081643f536a35cec"
        },
        {
          "alg": "MD5",
          "content": "b4d356ead7db4cf435f9dd650eba2164"
        }
      ]
    },
    {
      "bom-ref": "37240b83-aaae-4410-9141-615310ce7ba8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCimXmlCodec.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a243a238cab3e508bddea0648e36237962916316"
        },
        {
          "alg": "SHA-256",
          "content": "c1380ccb36415c52f0797e1400ac882e24288f8cc8c4e4f359d9bf4b120e3a6e"
        },
        {
          "alg": "MD5",
          "content": "06e3a3cef297d625250ba6662d4e7250"
        }
      ]
    },
    {
      "bom-ref": "372641b0-28cc-4e3e-a1ce-2ac692061528",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_vm_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72d3daf100a8f9bacf2b36430c3eca282eef6c7b"
        },
        {
          "alg": "SHA-256",
          "content": "e71f8b7a112b5172e9c9758ac431750082a1bd9f6664a92c9ede02ff650dd41f"
        },
        {
          "alg": "MD5",
          "content": "50546cb229f5457c1415cab69f07c38c"
        }
      ]
    },
    {
      "bom-ref": "37330a26-b35a-44ca-9fb0-03e51cbc7045",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkdb5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adfd60fecd3221a987ff21090e377ec40f929d56"
        },
        {
          "alg": "SHA-256",
          "content": "4ecdceb0baf3964c1941fab95f45fe3c2697d2bba9af30a2fcd3732adad68e33"
        },
        {
          "alg": "MD5",
          "content": "869143339ba07ddeaa68b2a3a69e9cdc"
        }
      ]
    },
    {
      "bom-ref": "375b6a7f-35a8-4df6-9204-f3c28f296166",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1fd865c59fbb0a10805c1c28d7c893f55230375e"
        },
        {
          "alg": "SHA-256",
          "content": "3eaa67a974b194c204be74b9bfa672c1e49492f26a0985406e852d56cadeaef3"
        },
        {
          "alg": "MD5",
          "content": "38f8a87c8ed61fc311efd2e44c3037f0"
        }
      ]
    },
    {
      "bom-ref": "37665345-af4f-4243-b58a-d7f045290c8d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/install",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3766b074-a022-45e1-ab93-aaa91d8aa953",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Node_DarkGray.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0761bd5f40ae07ac5545c7eb67b522e10e4c59f"
        },
        {
          "alg": "SHA-256",
          "content": "351e6253e87e46a8ac2e23536be40c128f03128eea58da497f779ce118bcb59b"
        },
        {
          "alg": "MD5",
          "content": "503049d08d1d57b9b91b55e95235f8a6"
        }
      ]
    },
    {
      "bom-ref": "3768d45a-b444-4b01-9b0e-11b6551a3316",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropServerProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af2ea750468e8bb7017ecb49c8069b250387b4bc"
        },
        {
          "alg": "SHA-256",
          "content": "b36c57073b7a92a867fe9e1b4fc4c52355d414ba0d775af5df852f032766a0a7"
        },
        {
          "alg": "MD5",
          "content": "68df59e96f42071d650f645fdbff92fa"
        }
      ]
    },
    {
      "bom-ref": "37797edd-9c21-405d-b633-078a1f7d3d34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/systemd/system/dbus.service",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0672d2ee3c1a43865037645bfd9582a4cc104d52"
        },
        {
          "alg": "SHA-256",
          "content": "7d9d706cc9966c2b6dfebcd64ef460010522194f5b3cb92bc119566b5c8c7864"
        },
        {
          "alg": "MD5",
          "content": "77aaee2ab76d91a510b4d7a01c79176b"
        }
      ]
    },
    {
      "bom-ref": "378436b1-a54f-4654-a0a9-2f3b7b9064f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/usb_f_rndis.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7dd161a2134d70ab71a6cab1dcd37fa5dedefc39"
        },
        {
          "alg": "SHA-256",
          "content": "8b534d3019e6ab543c308697be1b3a46d896c5cc00e52a2b12eacdb9fa8acea7"
        },
        {
          "alg": "MD5",
          "content": "ce6e5a7a23ed078c88fdc6a061e53cff"
        }
      ]
    },
    {
      "bom-ref": "3786dbfa-945c-46c8-9cab-d5f011158c27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3bc394c74376cf162604f50646f3009c8d588ab4"
        },
        {
          "alg": "SHA-256",
          "content": "95688180a33e56cd2cc0706741cc09596ce749283a89ce135d1dd6f452bab1ec"
        },
        {
          "alg": "MD5",
          "content": "ee91ec8ca7c71e56026866284867c5ea"
        }
      ]
    },
    {
      "bom-ref": "379bd734-dc85-4e0c-b682-da7d4cb5a31c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/man_ikvm_html5_bootstrap_x13.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b973736771f03eb9a0e04239a62dbfb43b8b8ce"
        },
        {
          "alg": "SHA-256",
          "content": "da74df48c159c537802a18eba9b6321d711d9de9bc7504d92a005a84d79a1816"
        },
        {
          "alg": "MD5",
          "content": "ac1afb15798fb5cbec2d616e7405781a"
        }
      ]
    },
    {
      "bom-ref": "37c34d6f-7f62-4530-9d96-94d629384a9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/remote.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f1d81837507c25279c016c672a2331a61ef7a1ca"
        },
        {
          "alg": "SHA-256",
          "content": "c8851d91569824b7de60be4a6b157d008a07bc05d015407b0c5fd0057e18b38b"
        },
        {
          "alg": "MD5",
          "content": "b7b77bc06dce301e617cd3bdc1c995be"
        }
      ]
    },
    {
      "bom-ref": "37de1f95-97fb-447b-a806-8b895414a4d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/MemoryPFA.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65355e5442de6a8d9f1c3a35c416013f99b3bc17"
        },
        {
          "alg": "SHA-256",
          "content": "246fd320e39c8c0d30a3be0bf55eb72209fc29547d260618c7f4e7b93c392647"
        },
        {
          "alg": "MD5",
          "content": "7e6c8403962c06f5c9b7da9b2f324ca1"
        }
      ]
    },
    {
      "bom-ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/losetup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4854042e-a70e-44c6-ae47-5f7ea33bc11e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBGM_10FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5485a092bfda7f3f99d83765fc2d0dd5dbd2228c"
        },
        {
          "alg": "SHA-256",
          "content": "7aa193338dcc60fab65ad2ea339b0c4b421221d24a0df41c5eb5cf10306efa1d"
        },
        {
          "alg": "MD5",
          "content": "1c2d3603173423afefa2c784fa0a1059"
        }
      ]
    },
    {
      "bom-ref": "37e31a0d-7e32-4cfa-ad51-f314b861bb58",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcProcessorsExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d54ce0eae06fe0287d833c36e1b28f8e712bf3e8"
        },
        {
          "alg": "SHA-256",
          "content": "ae06ea220973114e28ccd2bdc020386be4c918e9c1a06ff716ecc59ebb818e8c"
        },
        {
          "alg": "MD5",
          "content": "45d18d4f96909b52c3b2ac4070bb3e74"
        }
      ]
    },
    {
      "bom-ref": "38065d2b-00ef-4414-863c-d02ec5a0f5bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/libcomposite.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f982131223fb035d53bbc4c0e515a9d9a4f1a253"
        },
        {
          "alg": "SHA-256",
          "content": "1af37e94d87f3fefdb8f79ab6e8399008b7069da68410fd95285b7aae6291588"
        },
        {
          "alg": "MD5",
          "content": "0f55a90e33fc2ebf9c0f73a422a4b5d2"
        }
      ]
    },
    {
      "bom-ref": "38274df5-5837-4462-8c6d-6aade6e3ddae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/details_open.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c745b6b96c2611e7fa5716e6ea83be771fa4735"
        },
        {
          "alg": "SHA-256",
          "content": "c374a68a37bc9955991d3e65afda39ee4f908f357a4c0d5a05dda7d03c8d7e29"
        },
        {
          "alg": "MD5",
          "content": "ed1324976fd1dcb0d747a7ca5fc3ccc7"
        }
      ]
    },
    {
      "bom-ref": "3870a109-2465-4305-9040-dad1eb17457a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libncursesw.so.5.9",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55b66ccd8da167daf41d414d744a00c955521a98"
        },
        {
          "alg": "SHA-256",
          "content": "754754d03109b9f4b9d75f0b3747407950438ff8e8ccb273c4ad259c6790ca0a"
        },
        {
          "alg": "MD5",
          "content": "413eedfb568f275881c8918c4c02726f"
        }
      ]
    },
    {
      "bom-ref": "3875c4d5-69d6-4611-8fde-d5b3eca2d481",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86__V1.0.5.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4e27f78320cc41becbe5004ae4b62b0ed25cd204"
        },
        {
          "alg": "SHA-256",
          "content": "2c9d067fda985c3b3c88f8e42bc2a5e640895a67a5af76876f482c5f8fd7ffa7"
        },
        {
          "alg": "MD5",
          "content": "22edf804fc1065e9ce3a3924c5a36ea0"
        }
      ]
    },
    {
      "bom-ref": "38994767-2a3b-4549-ab7c-599b8344c871",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha1sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "38ad4bcd-44fc-42b9-a35a-a11200b872e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSG_OM_10U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b19a9517ece7e0881459c3a9978bc180c6122b8"
        },
        {
          "alg": "SHA-256",
          "content": "e6aa65c42eb82a98c6d423634f5c0f425144c10cf92e8636747d86d2a760432e"
        },
        {
          "alg": "MD5",
          "content": "74a458afc15ff931972d54dc0a165f47"
        }
      ]
    },
    {
      "bom-ref": "38bb154b-3c7e-4bcd-b8c0-15e9f7da7553",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/login_input.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fb843f2045624e7276097c89831844e14174def6"
        },
        {
          "alg": "SHA-256",
          "content": "49259c8030765ecc2eb541175775e12a9856d96bc9b4b1f6a69f8dcb7e889557"
        },
        {
          "alg": "MD5",
          "content": "098827c3a1f1bdcd2090b09b76c70076"
        }
      ]
    },
    {
      "bom-ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libexpat.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcdad264d19e601bbc20bb57e3899923779ee582"
        },
        {
          "alg": "SHA-256",
          "content": "5307c084b5953b62880b733282f786a154b747f72f090299cb7acba5a6564ccf"
        },
        {
          "alg": "MD5",
          "content": "96a361b044c3427a184ce648d88f9ad8"
        }
      ]
    },
    {
      "bom-ref": "38cac964-8e21-4207-8b71-d7ad6beab383",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_14_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "81f6d6565d904f0379a509f841bce88f476f6a07"
        },
        {
          "alg": "SHA-256",
          "content": "30228e08f8a07f4c0c0b685e575aaf11e12dab771b6aeb85c6d8ca21a33bb256"
        },
        {
          "alg": "MD5",
          "content": "e87a9deff0b5f512ed95349b03f077a8"
        }
      ]
    },
    {
      "bom-ref": "38cd7ba2-28a7-4d5d-b1da-fad57afd89cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/runlevel",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "38ce1f0a-d1e3-415e-ab6e-5d01baa6925d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/MemoryHealthComp.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "507d283de9d5039f11ef90c09a9d3c631ba0af17"
        },
        {
          "alg": "SHA-256",
          "content": "103f63b8d87e472c444091b5d215fe776e8dc2220904fa9eabd5a7dd689d2e85"
        },
        {
          "alg": "MD5",
          "content": "0bdf3ab379560f739802dfe3f739d9a1"
        }
      ]
    },
    {
      "bom-ref": "38d8f7db-255e-4aed-8868-c042f71986ec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ipmi_device_desc.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "640fac702ef953bc67146a50467c566be44f2808"
        },
        {
          "alg": "SHA-256",
          "content": "4bec8b908273cd9bbd38d2bd6671da15c89fc2e54246b1de4ed916940346d573"
        },
        {
          "alg": "MD5",
          "content": "f2fb076965456671902ba423f81e546f"
        }
      ]
    },
    {
      "bom-ref": "38ddf8bd-6853-4022-87af-c79ca21bf862",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "17f717ecf6a214b9d91a5ac2af83427495d190ad"
        },
        {
          "alg": "SHA-256",
          "content": "e007124c73254f3dce57feb76b8739fec43380b394480c14deab62883ebc2824"
        },
        {
          "alg": "MD5",
          "content": "46d33641af9cb4b0643c0f0fc250745a"
        }
      ]
    },
    {
      "bom-ref": "38e4cda0-a94a-48e6-8e7f-d8a0cd9c34fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libseccomp.so.2.5.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b8f9675b28eee5b9209016202e99521b8dbee63"
        },
        {
          "alg": "SHA-256",
          "content": "c7d486f08fbc0bc83a84c832782046efd36404e79d0ff0fd07ead998fad2e9b7"
        },
        {
          "alg": "MD5",
          "content": "ace8e2060e80f8e16b24ac6603c8d7af"
        }
      ]
    },
    {
      "bom-ref": "39145d9f-9c43-491b-a61b-d76ef3bc9630",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libbsd.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98db6640f9107bb5a25c9333c0f7652581a24642"
        },
        {
          "alg": "SHA-256",
          "content": "b9d368c0f7c3befbe4113bd7ecf8d80c2a42288f22467f675f1da2d27ffb485e"
        },
        {
          "alg": "MD5",
          "content": "47934cc3b7257a5bfd1f37d9ef59ee61"
        }
      ]
    },
    {
      "bom-ref": "3924e696-111f-4c13-a24c-af4325a0b3a1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/Snooping_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cbd9e1970ca87697b1d5be4bc2c01f302d905c08"
        },
        {
          "alg": "SHA-256",
          "content": "379e23220bafba7f7439725b12d50a4604b80b083f7773fb946408bb71993911"
        },
        {
          "alg": "MD5",
          "content": "91fe06d6cfe3978f12a78dd8fe0e50c1"
        }
      ]
    },
    {
      "bom-ref": "392814e2-ab6b-422c-8458-9808c4a23524",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_fastcgi.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3ae97a247809d594e6cd11d36f8c8d8000c1244"
        },
        {
          "alg": "SHA-256",
          "content": "747d142a413175c68caab9efd9246e075f5151b3d7f18027513d112534be90e7"
        },
        {
          "alg": "MD5",
          "content": "0e91755e6a289b7194118b2990a83a0a"
        }
      ]
    },
    {
      "bom-ref": "392e7090-acde-4040-83af-77c68023a7d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_icon.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6b0d9911a1f66c18844d867844dfc88ac445e243"
        },
        {
          "alg": "SHA-256",
          "content": "a5dc849423fb78faf97872377afa96a9893e9caa31686023b37504e76810ca67"
        },
        {
          "alg": "MD5",
          "content": "f4e860b03a87975315705dddeea3b326"
        }
      ]
    },
    {
      "bom-ref": "393b0146-18dc-4a40-ab4b-8bd52afe294b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcAttributeRegistry_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20bfa3e19f2e26cdf4725c9148df8402c6d17b26"
        },
        {
          "alg": "SHA-256",
          "content": "5bd52790fecc01d928be9cd7577e7209562f6d61deec0440cb363b89cfb0c9bf"
        },
        {
          "alg": "MD5",
          "content": "6fe4569087f93679eed967201ac9c74c"
        }
      ]
    },
    {
      "bom-ref": "393e63a6-c5fd-454b-b548-1b15eb0f2233",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/psu.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "45f2e600d9a2cf5369bd3f3886f7298842371c0a"
        },
        {
          "alg": "SHA-256",
          "content": "bd7ce92fdc947b5514919eff48a8ab089433cfa9eaad350f742d19721f5795d6"
        },
        {
          "alg": "MD5",
          "content": "bd5f19021150e5bd767d84dea62a6f15"
        }
      ]
    },
    {
      "bom-ref": "394dead1-88b9-4d51-a5e7-39d4d110278f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/jbof_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ece47a2d7ae0535e3846aa559feb9ac3d3f1ca7"
        },
        {
          "alg": "SHA-256",
          "content": "009a103a2d33802c1afebda4ea2e43d221e21e81e7dd11fbe1730d46cf782fa5"
        },
        {
          "alg": "MD5",
          "content": "194a7a447738711e6626d422ba3e94c0"
        }
      ]
    },
    {
      "bom-ref": "39635f6a-e38e-4e31-9438-2b240e2ef8e1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/block_green.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "270230070a58272ef9928855076d8b58f0b9d8fd"
        },
        {
          "alg": "SHA-256",
          "content": "0ea000feb1faa32c79321a91ab4a622003e546f6c6fbf0d15244c69ccee7c7af"
        },
        {
          "alg": "MD5",
          "content": "0aa079f4011282e60e719dc3479954ff"
        }
      ]
    },
    {
      "bom-ref": "398206b8-76cb-44c1-862b-f088ffa9436a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mke2fs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "398672ef-0081-42c2-baf1-8e2bea5b4378",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/su",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "39914e89-ca73-482d-98a5-48df1ee15164",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/deluser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "399a5f26-52dd-42f4-b4c9-94ed8af90136",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.G2DMH_G",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "94e84767587028b99e19df365386f6ded0402b90"
        },
        {
          "alg": "SHA-256",
          "content": "c26a84428d243a6738b8d7ae53ded5d23f10a868345686c268f8defcd6bf01a1"
        },
        {
          "alg": "MD5",
          "content": "9a21865890e4d24c6ddcf18be19f3cf6"
        }
      ]
    },
    {
      "bom-ref": "39a7237e-66dd-4d40-befa-a317ad3815ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/vi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "39a9a7f5-ca26-432e-90bb-5335966d170a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/clear",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "39c203c1-e2c8-4db1-b9d4-eada9841d254",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "905bc0c905e6a2a6a61ff8642fe1778df7590a60"
        },
        {
          "alg": "SHA-256",
          "content": "6453ee8d56135820435b9237718c58cd0d4ae29ee44ba4f87b9a7bfaaceaa7af"
        },
        {
          "alg": "MD5",
          "content": "a9966c9ad82ef00a8da07b0eb0faaa8d"
        }
      ]
    },
    {
      "bom-ref": "39c64e7a-4075-4cc2-a526-2adb86e19274",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmd.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "215d123c2f34b6680a15c85ee69674c6f66476bb"
        },
        {
          "alg": "SHA-256",
          "content": "47e48e0c844bcb84156d8ad015431036cd4ce05758b8012ff398e6c23d81edfe"
        },
        {
          "alg": "MD5",
          "content": "d4a6e9aa2615ef4d3d3366fed35639f8"
        }
      ]
    },
    {
      "bom-ref": "39e12322-ccfb-4f41-8c25-bd4fd478af00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03ca37f2cdc1566b47ddbeeb2c5797bb8b2e7932"
        },
        {
          "alg": "SHA-256",
          "content": "7c6549f36c6ce089074e926d0545e79a81e78ad13ba31aec6c7d337679b8ea80"
        },
        {
          "alg": "MD5",
          "content": "43a498eb9c2fc0f20add29e319388098"
        }
      ]
    },
    {
      "bom-ref": "39eaefb2-5695-4868-b246-1d81766a35d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pldm_gpu_update",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "93c353e26bc47e98f8246148106484ead69cc969"
        },
        {
          "alg": "SHA-256",
          "content": "d1e129be95d6180869737a8ac10c042b6a4dd6a7ee50b8afb2d654b57b7412f2"
        },
        {
          "alg": "MD5",
          "content": "b1da182f5ae7ec12ba8ad40f76bbe096"
        }
      ]
    },
    {
      "bom-ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unlzma",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3a10d783-5d15-489f-9c54-fa16fbcf525f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/parse_negotiate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e7315fce6ac536f523dd2d476a6260d1e463e099"
        },
        {
          "alg": "SHA-256",
          "content": "3559b2cc2113234f196b48d6611e3ec6d08c816c01c980823e5030e7a2089d23"
        },
        {
          "alg": "MD5",
          "content": "6a62000a37ff6c6877707c85ec59fa25"
        }
      ]
    },
    {
      "bom-ref": "3a190b27-e968-4393-a29a-faeffd7e1b39",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/lan_bypass_ctrl.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "33338a2c7bb87c6df4a1f76083bc2eb97609db28"
        },
        {
          "alg": "SHA-256",
          "content": "f22dfa1a0fda1b791e197436fc7c19214ec8aebb2a53d0713cb6d0333716e928"
        },
        {
          "alg": "MD5",
          "content": "9a4c36293920fe4c20d006a72f3f0fba"
        }
      ]
    },
    {
      "bom-ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mke2fs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3a4a8295-e04c-4272-9cde-601de631890e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/split",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3a4b50ef-ee7e-400e-ba26-5468d633c1d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/uid_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14e09d5fb15e984c0baee1d49588aeff8bb4e46b"
        },
        {
          "alg": "SHA-256",
          "content": "fac71a3731d887998939cd9a25bd60eac016f68d063132fbc96113bdbd57b06e"
        },
        {
          "alg": "MD5",
          "content": "3af386e712475d81d3f8c0e47f7fd0ee"
        }
      ]
    },
    {
      "bom-ref": "3a4dffc9-a835-4796-87cc-c5328404fb50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ssl/CA.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58bd9f4c909224b093b60662dec66d0ec498d16f"
        },
        {
          "alg": "SHA-256",
          "content": "26bea00e56aede0cbbea47211290954cc1802bb51b7ba17d5d1325cb8edaf847"
        },
        {
          "alg": "MD5",
          "content": "c12833df2306020e45233830e60337f8"
        }
      ]
    },
    {
      "bom-ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cksum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3a5a2066-287b-4dfe-a0e9-bfc6c5172ee0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/mfapi.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0da0428d9474c9a4813ec7f3e1d04083f27c10f6"
        },
        {
          "alg": "SHA-256",
          "content": "e202733feee5167b455759e0f55e29d77967a2f8ca88b99cd5bcfa0b09833764"
        },
        {
          "alg": "MD5",
          "content": "92574042380f0b77a8010a7dd6786ec8"
        }
      ]
    },
    {
      "bom-ref": "3a627350-d649-4f1d-a19b-c8cfebc01f59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libcimcClientSfcbLocal.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f82286127ecb8964115de88cab6ca9673731d"
        },
        {
          "alg": "SHA-256",
          "content": "19378c0b68daf27eb1566ce78c6598ba7214a554ea354c8e6ee6d960d7912ebf"
        },
        {
          "alg": "MD5",
          "content": "86c95df95a995dd22b523f9a26f56b3b"
        }
      ]
    },
    {
      "bom-ref": "3a74e3ec-bc06-4227-98a2-6a545a300847",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/physical_intel_vroc.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf2ffc4f81206b06ffc6b435a679aac0c0a881fc"
        },
        {
          "alg": "SHA-256",
          "content": "1a25aa5f013a7b52d2e718c11716b34f8ed9d22f5050d5a853f0d0ca8fdf10b7"
        },
        {
          "alg": "MD5",
          "content": "8cecc714478a2efa480f0ba7421c001c"
        }
      ]
    },
    {
      "bom-ref": "3a76b358-595f-423e-89ac-16db48781661",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "080b74d771b09be9e4ea5226c3220559750d0541"
        },
        {
          "alg": "SHA-256",
          "content": "8984d3dbb294c97fe53ea2da836a694167245b2ee00894f686a250edad578dcb"
        },
        {
          "alg": "MD5",
          "content": "a18b8f82a8c9348f4296e0aab2f3aa04"
        }
      ]
    },
    {
      "bom-ref": "3a896bad-2370-445e-ac32-cde9b1921b88",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_yellow.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6c43281dc8831357715036d57a33732acd555a8"
        },
        {
          "alg": "SHA-256",
          "content": "d7ba35ca6ed3c9fffd105cfe972d6746517c050ec167140559c5013c9b0f1b81"
        },
        {
          "alg": "MD5",
          "content": "d71f26448542969be94d7fbb39410d2f"
        }
      ]
    },
    {
      "bom-ref": "3a8d01fd-d78b-48fc-8c69-346588d5de7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgssapiv2.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c541b111d357841919d2d1bd64336b57303a24f6"
        },
        {
          "alg": "SHA-256",
          "content": "7a362fe229fb410f24aea2b1bdc86276e036258f2fe8ceead61179d71cd54d49"
        },
        {
          "alg": "MD5",
          "content": "f7d2d1f089e9a4353f9dd66b825731d9"
        }
      ]
    },
    {
      "bom-ref": "485fe0f2-bad7-41b7-88ae-841af641fbdf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libBrokenLocale.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bb13ed877fd8f132fd27aeabf10ffba52bb78fb"
        },
        {
          "alg": "SHA-256",
          "content": "d9d3910d28e68c6a3175396b148b112d860ba4e13c4747d149ec25c63daaeebc"
        },
        {
          "alg": "MD5",
          "content": "0721f2748e73d246ec7100a0708ab977"
        }
      ]
    },
    {
      "bom-ref": "3a9d4254-c67e-487d-8ae5-7225a22b1f41",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SysLockdown.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbcf2ad8565446f20e6c01454ee044ae8ea32021"
        },
        {
          "alg": "SHA-256",
          "content": "dae5b24ad8683e1cd2e70289ce1a14ea4405e8679c7b156f46979fa4c01766b2"
        },
        {
          "alg": "MD5",
          "content": "57db15c0aba2edfe2d7fe89da48ec276"
        }
      ]
    },
    {
      "bom-ref": "3aa1b645-0789-4626-8c97-1f550c542284",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/carousel_left.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0eed6448fb54f4c590d1698c0d0671a757bf9e23"
        },
        {
          "alg": "SHA-256",
          "content": "fb1f7c184553c944a6dc2dff45c269216cbba8074aefcf8c2d91948cae2742ac"
        },
        {
          "alg": "MD5",
          "content": "06efe6a20a062f2a003228cd25dc1a5e"
        }
      ]
    },
    {
      "bom-ref": "3aa752bf-b130-4409-bbe2-4671835d48bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/twin_pro_mcu_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "24d03dded9286550d1253acb426972076321485a"
        },
        {
          "alg": "SHA-256",
          "content": "214abe124b5bec93a1842cefc0ce0dd7738791b88f38e09d648f899d18185b8b"
        },
        {
          "alg": "MD5",
          "content": "2f788732bcee4f2095c49dc31298dc46"
        }
      ]
    },
    {
      "bom-ref": "3ac120fa-faa0-45a2-88ba-09516bd69d83",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/status-500.html",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7cbda413ab0553f2aa99e7c38c9603b40fe746d"
        },
        {
          "alg": "SHA-256",
          "content": "0c512bfbb819f17052e5f1df35ff378ca25df3478e99829898ecf2528efb50f9"
        },
        {
          "alg": "MD5",
          "content": "58bc185cf376d67ad0e32529662b6365"
        }
      ]
    },
    {
      "bom-ref": "3b396ea3-b7a2-4173-8e1c-67ca341b47ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pwdx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3b466ea3-8f30-4112-ac0b-5d142a612895",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv_mit.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "3b4ff086-7118-4f90-9311-c44c18aabd68",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcurl.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5391b0de4f5e16c38aab0a4c2fe42e63bad6f793"
        },
        {
          "alg": "SHA-256",
          "content": "c7d93c5b1438dc33772c8d8a613894cc2989fdb9b000502aa7be63af5d9c2ec2"
        },
        {
          "alg": "MD5",
          "content": "7e05260d95e70cf6f392ef74a8f72eab"
        }
      ]
    },
    {
      "bom-ref": "3b5a5f8a-9292-4c30-ad09-23146d7c9310",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpagent.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6a582838225a6278c725c17458f947fded16131"
        },
        {
          "alg": "SHA-256",
          "content": "f688485946d8e52da04495c2d0f76bfada58ff0491d40000d1d101bfec03850a"
        },
        {
          "alg": "MD5",
          "content": "f74367d541834ca01c5cceb1fa27e063"
        }
      ]
    },
    {
      "bom-ref": "3b745d30-8f6d-48e2-9d99-f13518b5f53a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/vi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3b79f797-8fff-46fd-b322-e7e1a0458a1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxtables.so.10.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f577a10a10b85df6e4036e1bf248a306f361a092"
        },
        {
          "alg": "SHA-256",
          "content": "da2593460f7623d27ec31d44fac5c17e64d06c607ae98f71aad3b9f6e0bfc4d1"
        },
        {
          "alg": "MD5",
          "content": "a332c49f74cbe1d7a553910a49da2de6"
        }
      ]
    },
    {
      "bom-ref": "3b937216-560d-4252-ba9a-eba98a218e06",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcEventDestinationExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d71a1c5ac25ba580f589e6f4c649ea0e08455fb"
        },
        {
          "alg": "SHA-256",
          "content": "6d8f0e45c5c4a6b09a246edeb5b5699fdf861e86af8b5f7b359afa2154d73a0d"
        },
        {
          "alg": "MD5",
          "content": "963878cf8a27c438aac0b90f012bda5a"
        }
      ]
    },
    {
      "bom-ref": "3ba022dd-3e45-4df4-a3a8-a8e69ea32934",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_wstunnel.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58ab70e8a0a14d6085c82beeacc16a66658cf3aa"
        },
        {
          "alg": "SHA-256",
          "content": "05ef52e4f154114938a4320a744573fb20e9d8b293e4a0c0a23dbad059c61964"
        },
        {
          "alg": "MD5",
          "content": "dfdd0fa0a98ff55654aa4b707f4c179f"
        }
      ]
    },
    {
      "bom-ref": "3ba826c4-5e60-40fc-8fdd-c805a95cbbcb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_filesystem.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a867b6f1b19607afef24799c8952d49a209708cf"
        },
        {
          "alg": "SHA-256",
          "content": "156c7b08b188242ae3691f71f170cc61ec7ecddbc764188a9264f947da6aabc1"
        },
        {
          "alg": "MD5",
          "content": "611d6aac9e9f8068e189bcf6f6c79c1d"
        }
      ]
    },
    {
      "bom-ref": "3baed10a-9696-4362-8a33-5bf366181e6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/sign-check-icon2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b0c0216c80d1d41a54b07b3dd963231cc80bd8a"
        },
        {
          "alg": "SHA-256",
          "content": "1329c683a3c9e5cc9383f900c37054344d76b74f2a4b79280fe160a202e8b9ad"
        },
        {
          "alg": "MD5",
          "content": "9917c898ff80c4f3fda41f753d969bba"
        }
      ]
    },
    {
      "bom-ref": "3bb5f6fe-a8eb-4607-8fb0-a8f38b6d01a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/start-stop-daemon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3bbe87d2-7f9c-4362-977a-f9b2228bc388",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/icon_image.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e524a43cdfdd1edc3de31212467dcd23fa5aa019"
        },
        {
          "alg": "SHA-256",
          "content": "05ad59c6e90f47732f43de12ea6f6f39086d2390940855552c120be575f7e2ec"
        },
        {
          "alg": "MD5",
          "content": "dd33e4a0a7ef5b306e6a2fd2f3bc106a"
        }
      ]
    },
    {
      "bom-ref": "3bcd0e0f-e27a-4a4c-9dcb-832d349bb6e6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libanl.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6391c9a9e34187de331cef017715fdd70e7ae113"
        },
        {
          "alg": "SHA-256",
          "content": "3906d8dd43c80f8b93ce20bf8607f6ba98c97902ace113dd2593b08db8bc4f74"
        },
        {
          "alg": "MD5",
          "content": "3326856c7732bc373b438ef19761631f"
        }
      ]
    },
    {
      "bom-ref": "3c0a2c98-ffd9-47ba-9160-70231990d56f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcElementCapabilitiesProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b61a9de4c41005f3942768e5dd2db4f10010460e"
        },
        {
          "alg": "SHA-256",
          "content": "2ddfafb5f10694b6cfe8e42418d00b8b10116dc2f7600b8616455270d44d578c"
        },
        {
          "alg": "MD5",
          "content": "a1927b2ae8be3277f2a0aeabb217e2cb"
        }
      ]
    },
    {
      "bom-ref": "3c3e31ae-073f-4d88-93d2-d7766f0b2b5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptunnel",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3c4d0d6f-bbad-4f19-9743-a23057a40d03",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/55ipmi.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ae5a7598ae7f2ceddc26ff5ec42374489970a15"
        },
        {
          "alg": "SHA-256",
          "content": "9b62bdf2b028460c92c098be5ea8920f159acaa10a91667e8f00b36b1bc1d811"
        },
        {
          "alg": "MD5",
          "content": "7b042bfd44eabefae5a5663101f61e85"
        }
      ]
    },
    {
      "bom-ref": "3c55ccb6-454b-40a0-b670-4ccabfa7f956",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.dataviz.diagram.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a4c8a4ba2ff99bb9326c8255f8fc923fab5a092"
        },
        {
          "alg": "SHA-256",
          "content": "c89feefef0b21e89eaf850e2205ec2d0e290d0cd28350b64c53a1a31f416a409"
        },
        {
          "alg": "MD5",
          "content": "bcbb4c3da26523e2b52cfcad3ef84944"
        }
      ]
    },
    {
      "bom-ref": "3c7fbd8b-2ccf-49d1-80da-495164b9e28a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_thread.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bbe32ed9f892506a6c10f2176ccd830fa12446e"
        },
        {
          "alg": "SHA-256",
          "content": "0e3a4f14fdcaa353a011f93397eebf37fb569a445926ecbc63cf76887518e19a"
        },
        {
          "alg": "MD5",
          "content": "11b1783d7bc76d205a92d88df0fdc020"
        }
      ]
    },
    {
      "bom-ref": "3c8cafe0-a307-4210-aaa5-486400336de9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libphosphor_dbus.so.1.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb145fd3b2cad5ece16eb0314d0afa2315ed9551"
        },
        {
          "alg": "SHA-256",
          "content": "a8cba2a615ab81d61aa2e75e5699c2ce8e5d4644a8284b8afedd890dba4f0dbb"
        },
        {
          "alg": "MD5",
          "content": "48704cbe291d9b2bd55afc8fd8dad708"
        }
      ]
    },
    {
      "bom-ref": "3c9140e0-cff2-462d-959d-356cd29c72b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/mouse_right.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd5b766ce0951108b65f5c17545e16508ad30636"
        },
        {
          "alg": "SHA-256",
          "content": "45b03aeb66b32b8b27d858386fc529cd733f6e3a8892e49c13224308014efe8c"
        },
        {
          "alg": "MD5",
          "content": "de82b5b61e83a6457e59fa97381d1e8c"
        }
      ]
    },
    {
      "bom-ref": "3c9ccfa2-f47f-4094-9a82-3f2836f41b47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/basic.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "69f4d5d3bd499c216e60b921b80ef9a8024686f1"
        },
        {
          "alg": "SHA-256",
          "content": "d9a867a842bda5d5bb8e37e954cf0bab7ca69e384375bb5ba229ffa93ae6fda6"
        },
        {
          "alg": "MD5",
          "content": "435ef8ec690e29ceb4d88b46b0c4d491"
        }
      ]
    },
    {
      "bom-ref": "3ca24a24-40fc-4996-a082-750294bea03a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip6tc.so.0.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cc7c53291fd1d41a869ff7eb322bb21179d3dad"
        },
        {
          "alg": "SHA-256",
          "content": "afc2309636826a891d1373b061f26872a2d44421949e266a447a1f62887cf0df"
        },
        {
          "alg": "MD5",
          "content": "eda98f670b06862f81dce603bb73173a"
        }
      ]
    },
    {
      "bom-ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/runlevel",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3d012200-628c-4e20-b64d-4676db69c066",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IPAccessControl.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8543981e44e0078432627e682c5c2884636dc9bf"
        },
        {
          "alg": "SHA-256",
          "content": "cb5d13624ce28d00b0ac4ef30660c83dac2524cbfd0c68fdff1a19137e038018"
        },
        {
          "alg": "MD5",
          "content": "6ebfc38adce1caf2c946415e42bca247"
        }
      ]
    },
    {
      "bom-ref": "3d12438f-6237-4934-84dd-55793664fa08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/alert_delete.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "612bf484db9a1106c05e484bb7eeb41c99bc1fd1"
        },
        {
          "alg": "SHA-256",
          "content": "0e44772d13cabbaac58d826c244f8a4967e8e959c17be3b0cee603b5a59b2103"
        },
        {
          "alg": "MD5",
          "content": "bf136f871a9318b9d7d1b1778efa19bb"
        }
      ]
    },
    {
      "bom-ref": "3d2203c9-122a-49e9-9bb5-61077c5ea0c4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cfgd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ba5375dda5c5aef1b969d4fd99c4be0cc89da1f3"
        },
        {
          "alg": "SHA-256",
          "content": "0abd216e4e742a218269a8c3ba270d22394123e0f4c9e888d007c7b91c516f8e"
        },
        {
          "alg": "MD5",
          "content": "0627417e7c09702f597970c9c2f8d276"
        }
      ]
    },
    {
      "bom-ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fdflush",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ln",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3d678463-5201-4317-86b3-d2e1fbd816bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13SRH",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "860151f58192ceebce9d296138e0058d634b29f0"
        },
        {
          "alg": "SHA-256",
          "content": "8b4c7487adb52f3ccc17a8ec3687df49134fa1f06a05ccfef194b2d7e95f9c11"
        },
        {
          "alg": "MD5",
          "content": "4de774db3afb9e8248b59e99e415bf7d"
        }
      ]
    },
    {
      "bom-ref": "3d854d81-cb96-4fa0-9608-93b76177a223",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libudev.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ff1e2b43955dc5c42fd606f8dda9790ca480ee7"
        },
        {
          "alg": "SHA-256",
          "content": "b20b16b8f14376bbd4b9f8f999c13b276e7d6d26a299d86a72e1475e51f2875b"
        },
        {
          "alg": "MD5",
          "content": "c990c4007218b2af20439fe051fd72d0"
        }
      ]
    },
    {
      "bom-ref": "3d9dda7f-bd95-4453-9d38-5f8b36a2b20d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_bios.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ec19452d2a58b55c4f1df2314e6eec7530432fb7"
        },
        {
          "alg": "SHA-256",
          "content": "c98e1d7ff2ea87385c522b0ba903e71c82688689a094a8e2a8241619ac8d8565"
        },
        {
          "alg": "MD5",
          "content": "f14139e4a308a6fab98c7f8e6ea28f26"
        }
      ]
    },
    {
      "bom-ref": "3dc3a86a-afa3-4862-b38b-d6c794a848dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_18_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2f1153003ecef0f4d845d6e7ba1b7fb95ba09be6"
        },
        {
          "alg": "SHA-256",
          "content": "7eb090d1b405e416ba3bdc7a5b1564158b599074e39886ac45c5a12162a17e94"
        },
        {
          "alg": "MD5",
          "content": "46e1a0e3c12538caa93770d9230cbf1e"
        }
      ]
    },
    {
      "bom-ref": "3ddf563d-eb86-42cd-8912-b29ca5e2c7e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libexpat.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcdad264d19e601bbc20bb57e3899923779ee582"
        },
        {
          "alg": "SHA-256",
          "content": "5307c084b5953b62880b733282f786a154b747f72f090299cb7acba5a6564ccf"
        },
        {
          "alg": "MD5",
          "content": "96a361b044c3427a184ce648d88f9ad8"
        }
      ]
    },
    {
      "bom-ref": "3de5594f-6a9f-4559-8639-5df90e2324e1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libns-9.18.24.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7ae0d7465c7af37dff1ff44fe0aed24fb8e22a4f"
        },
        {
          "alg": "SHA-256",
          "content": "b27d3fba0fef926d5c49fc5fe493afb8d9bff06f38b5bdf31c9b4b81b8a53f95"
        },
        {
          "alg": "MD5",
          "content": "6703fbd2176b354a38c84fa99cd08a44"
        }
      ]
    },
    {
      "bom-ref": "3dea594c-cb8c-4b30-8435-db26f3a1057e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libthread_db.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "96dae3a511463cdbef4c6724e6456023357504c4"
        },
        {
          "alg": "SHA-256",
          "content": "63c1705f97925202b5b32d2ff232aa9941527591259a8ab2fff6108ad66d643b"
        },
        {
          "alg": "MD5",
          "content": "caa3987a593c137e167addc24360aa21"
        }
      ]
    },
    {
      "bom-ref": "3e165136-677c-400a-87ac-e32aeb41a24b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/virtualkeyboard_x13.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8fe3768cb8f4ee5cea44ee7ca3246ec592979dce"
        },
        {
          "alg": "SHA-256",
          "content": "2085f491457430d124e9ef182d6c993e5a975eee76503eb4dca8f94605644329"
        },
        {
          "alg": "MD5",
          "content": "7a2c1d470064be56491e809fd5114678"
        }
      ]
    },
    {
      "bom-ref": "3e2b3ea8-b1bf-42dc-9784-451ec896c81f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypt.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "856c779beac13008d0e69665dcfaea2f47502c1c"
        },
        {
          "alg": "SHA-256",
          "content": "44f1f3a07fa4fb9e5e750f29e0c96fa4b9e907257603f33a7aafaad97edbd9c3"
        },
        {
          "alg": "MD5",
          "content": "bd311838d9a1f9fab7943feb837a31b0"
        }
      ]
    },
    {
      "bom-ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/od",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3e661179-3ba9-4e42-bbf8-b0a1b53140fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderGz.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "187df00a5e28837d94f3750d248faa7930ed8f85"
        },
        {
          "alg": "SHA-256",
          "content": "63fd072e3c310548b79af8b45de527918107e76a5d05f21ca5075b914d643a42"
        },
        {
          "alg": "MD5",
          "content": "8d83ea6baa58afdfd3349c95691adac7"
        }
      ]
    },
    {
      "bom-ref": "3e7ccf79-6fba-4ea6-95d2-727904376958",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ec4d7677eae7a5cf772184468fc2897f80b3d47"
        },
        {
          "alg": "SHA-256",
          "content": "aca88bdbc79d9d516c9e1dd371ffd90243e603b47751921daf873e1f5d075b35"
        },
        {
          "alg": "MD5",
          "content": "eac6541a2d9ddf78e15642d3d3547a07"
        }
      ]
    },
    {
      "bom-ref": "3e7d98ba-0f03-4395-aeed-686f7bc4a404",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/eth0_dhcp6c.conf-stateful",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a270c866bd668e818187e51367d85e8d5f2e472"
        },
        {
          "alg": "SHA-256",
          "content": "a916f409aec311c4ba2f2547a0fdec76f90d56e7f4dfb5ee06b1b58bd94a557b"
        },
        {
          "alg": "MD5",
          "content": "c3a2e3d2e040efdd57c57339db1d3453"
        }
      ]
    },
    {
      "bom-ref": "3e9e0e87-0c99-4c18-9a6e-66831358cf8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/Event_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "56df376851d6699cfa8cdb73b7a5e88a7309d6f0"
        },
        {
          "alg": "SHA-256",
          "content": "356bed1b09d7ac4839ee5acf1469ff206066d70cc024d54a92fb8d1b847a3b6f"
        },
        {
          "alg": "MD5",
          "content": "2af0e3535f0464501bbd1aaab95d8c38"
        }
      ]
    },
    {
      "bom-ref": "3ebc340b-f096-4902-9678-6e0d72315f15",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/sfcbd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ac8c28f382f2e690d53ef72f8492f94500e8f00"
        },
        {
          "alg": "SHA-256",
          "content": "31eed179523d9f1e696e736ec6bb43b5d0b8fc6acaa9bc1b34889ee58e84fc07"
        },
        {
          "alg": "MD5",
          "content": "d7e18f7299111a5e89bb451cf1ac0b77"
        }
      ]
    },
    {
      "bom-ref": "3ec689ef-9298-42ef-aa0b-eaf996832259",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stunnel3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e23ce4c44d8e43a95efcd7ca8fb6cb35b5bcb439"
        },
        {
          "alg": "SHA-256",
          "content": "e8cc11b3940bdf4d1a5251dfe9c3a0e6f8356f4a9ffdb83b65025df0d70c6441"
        },
        {
          "alg": "MD5",
          "content": "5eb6e795b2639749915967a00f3e3997"
        }
      ]
    },
    {
      "bom-ref": "3efe38a8-ac01-4da3-b572-fa80d8c7727a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5aca88007e1a19f5070563540f4ca7cf7b520e31"
        },
        {
          "alg": "SHA-256",
          "content": "5015e9c038f83a6353b42a2117561d90e86871e1264fd1540a25880aa0aa94a0"
        },
        {
          "alg": "MD5",
          "content": "594271196d391be87977c3ab38209db3"
        }
      ]
    },
    {
      "bom-ref": "3f14baa3-d28a-41b7-b836-ea74ce65439f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libphosphor_dbus.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb145fd3b2cad5ece16eb0314d0afa2315ed9551"
        },
        {
          "alg": "SHA-256",
          "content": "a8cba2a615ab81d61aa2e75e5699c2ce8e5d4644a8284b8afedd890dba4f0dbb"
        },
        {
          "alg": "MD5",
          "content": "48704cbe291d9b2bd55afc8fd8dad708"
        }
      ]
    },
    {
      "bom-ref": "3f37ec59-fa5a-4f0d-9512-552d29f5820a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SMTP.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "347b09f3dd9b1830f74dfa313dc1151a3e25e9f0"
        },
        {
          "alg": "SHA-256",
          "content": "4492db91395fd2e84b36df0d416d896f82166722f5b845333f89622d5eabb898"
        },
        {
          "alg": "MD5",
          "content": "cba05ccaadfe99bdcacd1e13f5b185ae"
        }
      ]
    },
    {
      "bom-ref": "3f4baac7-1030-467d-8e20-f2189a7f8156",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderMem.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57b8c2ff13b620aa6e30613ccff65c4593b1c84d"
        },
        {
          "alg": "SHA-256",
          "content": "e8a328d27275f7987516db4256dc965a24e99e70b41f448d7cdd077676423cea"
        },
        {
          "alg": "MD5",
          "content": "e9c831be3a193556b63c9ae44567b6d2"
        }
      ]
    },
    {
      "bom-ref": "3f4db854-9960-4349-8711-50fda4c46b00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pidof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3f60380e-8904-4304-9027-364d6c877976",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setuidgid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3f91edf3-934a-49a7-be55-f2ab56faf05b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/pkgconfig/netsnmp-agent.pc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9e8ebdb9660363e5051a94bdff801cf20d29a344"
        },
        {
          "alg": "SHA-256",
          "content": "a857367e66e117f7e7f911b927a808f0e66f1c3b082bf70da6eada97ea31ea37"
        },
        {
          "alg": "MD5",
          "content": "f9167e64f43075926e3a1b7fff14743c"
        }
      ]
    },
    {
      "bom-ref": "3fc91083-e27e-449b-ab6f-0b311062a726",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/clear_log.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9b98685d82e3da90286677c685cb778d8ffc2f31"
        },
        {
          "alg": "SHA-256",
          "content": "48c02aabb2dbbb92a5f19c0caf137ef807d81afbad739ba0e2c6eb3cb2ba0852"
        },
        {
          "alg": "MD5",
          "content": "9386273196243922b10b1708656ea153"
        }
      ]
    },
    {
      "bom-ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ipcs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3ff2ef28-59d4-4174-b5c0-fac5aab6e5aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/hii_cfgd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ded0ed78d306af5cb26caa44caeb84f721f2d1d"
        },
        {
          "alg": "SHA-256",
          "content": "51a726a27901e5b9d319ffa4d35c91135e5b75fe1a224e7993ad84b9f7d44a90"
        },
        {
          "alg": "MD5",
          "content": "a01ebb6d48eca29a52d11a011fe830fc"
        }
      ]
    },
    {
      "bom-ref": "3ffb8d3d-f06e-42dd-b5ce-fe0cfeba3106",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fdisk",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "3fff1413-d994-4755-ac94-5fd10b5742ff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pecitool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "afc1461264e7381f26a905d690b644f1985dee8c"
        },
        {
          "alg": "SHA-256",
          "content": "01ba977e543456bc82353010e8a2c82d4ad8789ffadc5a63da1b6394b43a868d"
        },
        {
          "alg": "MD5",
          "content": "4cf13c305f07a5dc8b50264242a4cea1"
        }
      ]
    },
    {
      "bom-ref": "40061d93-6774-4a7b-85f5-b39ade1c4d57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/bond1_dhcp6c.conf-stateful",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "414e036e7517001a59b2e5fb8b5140bedf820ede"
        },
        {
          "alg": "SHA-256",
          "content": "0a451598936ad81fd1d83eb0ca249f0fb2de19b2917c49e15640769f7b31da71"
        },
        {
          "alg": "MD5",
          "content": "21aca76239a4b96c8f5faa95f01fcb2e"
        }
      ]
    },
    {
      "bom-ref": "4013a270-6320-4bc7-87df-0271db7d862a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcHttpAdapter.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d88469b8651102b2c06485a9eade991dd7cd624a"
        },
        {
          "alg": "SHA-256",
          "content": "ad72da52a9a01e4b81c3133b24a06e27894c706d4f72599d747a9cdd84832286"
        },
        {
          "alg": "MD5",
          "content": "eb789f02de533ce94f059238940d1d61"
        }
      ]
    },
    {
      "bom-ref": "402f5699-f98a-4269-b40c-eeb7cae91f60",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOam.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "71909efdd94fb1155802f3d0d28b7009eb4973ea"
        },
        {
          "alg": "SHA-256",
          "content": "817a47639050ca983476de5955b4d23e770fa601880e524c267ae1d80a0db082"
        },
        {
          "alg": "MD5",
          "content": "d9864b1ae92db2981334c55601c03298"
        }
      ]
    },
    {
      "bom-ref": "4043a625-e7df-426b-bf5f-673024334d65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/less",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4058ca5b-aca6-4db6-b5b7-bc9695e6449d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.numerictextbox.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "11c69d4f7bf76d33716fed608818ef21b87a46c1"
        },
        {
          "alg": "SHA-256",
          "content": "5ac06727bff168baaa24b852d16fb8cb610e6eb659401a6370b060c2b80c8778"
        },
        {
          "alg": "MD5",
          "content": "f7b24beefb1a63973e426ee34079655a"
        }
      ]
    },
    {
      "bom-ref": "405a7083-9ce6-4407-a49a-bcee27a9d8fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9827f303d597c6ea058c9e0f6063b1de243f2df0"
        },
        {
          "alg": "SHA-256",
          "content": "ff2590c36a4c92a9a02654fda8ab54d0d873739654b2ebb867f1ed365a2debdd"
        },
        {
          "alg": "MD5",
          "content": "10b5ab6d2f8359934ca49f7f4747ad6d"
        }
      ]
    },
    {
      "bom-ref": "40855a63-7302-4a22-ae16-6ea08c5cb38b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_TextRedirectionServiceProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74b665505090c7d18eb33af9e6a01b4091796fb6"
        },
        {
          "alg": "SHA-256",
          "content": "3c53a295c586f1739aeaa24d338635eb97b2cbf4592ba21bc6f75aafaec449dc"
        },
        {
          "alg": "MD5",
          "content": "8eed36efa945f87bbabd2372d8f6051d"
        }
      ]
    },
    {
      "bom-ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cut",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4087f86a-e003-4028-93db-09398778ede1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifenslave",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "40b8a4d2-806f-4b83-ae23-619c71a66ed7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLogEntryExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a8f82826e1a730be83d3f625a218449f448ab639"
        },
        {
          "alg": "SHA-256",
          "content": "0df3e94197408e78898d03973c7472a23132025effdc1799e8ae0be5520c4628"
        },
        {
          "alg": "MD5",
          "content": "762372a79ca5705858be0a405bec6c5e"
        }
      ]
    },
    {
      "bom-ref": "40e08399-7e6f-434b-821c-c65d17d22796",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Snooping.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3725a0329fdb1a65bec06312a54d2e4744029709"
        },
        {
          "alg": "SHA-256",
          "content": "b601c230693b83a451c78a9f391e1a4f33df6f5259ea23b0fb0ee260ef6f8d48"
        },
        {
          "alg": "MD5",
          "content": "8c2b74609163c563acb78767c684d652"
        }
      ]
    },
    {
      "bom-ref": "40e87b13-e9be-48b3-ad8e-21e644d8edf5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uudecode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "40efea2f-217a-452b-8bd2-7a1051cc9581",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mount",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "40fe7659-bb54-4643-b728-10b81d767a0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0dfc97a2571f68ac12063363f7c71bf849ebd4db"
        },
        {
          "alg": "SHA-256",
          "content": "192f160addb06a5d11ccb6a1dcee76de7997d6c415df55e48e76a48b03a66d75"
        },
        {
          "alg": "MD5",
          "content": "78a8341c9a5d5392b5ba4ee9596c1c4c"
        }
      ]
    },
    {
      "bom-ref": "4104bf7f-f764-423e-88d5-c3cf14eead7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/setconsole",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "41079c4f-ca22-4850-96b7-c77080de7ee8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcFileRepository.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64efa4bbb1111b4255f6b924d1ae5c549ef40fa8"
        },
        {
          "alg": "SHA-256",
          "content": "d440914639cd70b97dd11d037ef7f623252492f4efa4f9761142b9ee9b5f7e06"
        },
        {
          "alg": "MD5",
          "content": "e6201b393f6c99c6bde694a7d0220fac"
        }
      ]
    },
    {
      "bom-ref": "415e0ff8-2289-4554-8c39-fff6b849ba09",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib.so.07.2103.0100.0000",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3019e7f0ff40df99c86c87d12efba315ec97cace"
        },
        {
          "alg": "SHA-256",
          "content": "8480d20fcf2b91198e55a4713927e61be4042fba1f9041538927902b41e79076"
        },
        {
          "alg": "MD5",
          "content": "a459a1531a5e727fca55b9ccb1967f31"
        }
      ]
    },
    {
      "bom-ref": "416ea5b9-f904-4ecc-a5c3-98f44b9f142a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86_64__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/298472-496072.elf64_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab1471a1680146616d64701a454f6d2df7c51112"
        },
        {
          "alg": "SHA-256",
          "content": "cc1b981ca0e20c08c86a7784a381178c5f6c784b91d91ce2c759077803f9cac0"
        },
        {
          "alg": "MD5",
          "content": "ecaec37086f6d83ee0f9659bcb86282d"
        }
      ]
    },
    {
      "bom-ref": "41711761-8d14-4e28-901d-f461c29f3aa0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/ipfw",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3dc7f388d28713eebaa5a577765d3bdf2be951c8"
        },
        {
          "alg": "SHA-256",
          "content": "b8e47c101fde64d64d53a845106c29f94bd34a374440959559e20370eab3f13e"
        },
        {
          "alg": "MD5",
          "content": "501a2541fb2bcba90990c9ceff7a1c24"
        }
      ]
    },
    {
      "bom-ref": "41765e8d-a07c-4dfc-9fd9-1b6d5a757c32",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cpio",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "41862ab9-cc31-44ad-b9b2-4ae22b532bb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/nav_ui.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ee636c75abc68b7e327c822b64c7d1e4f1a0812"
        },
        {
          "alg": "SHA-256",
          "content": "064b916f869fabd15c8cb55239ca6d2bf5be87f8d59ef307f706ca15d7ba3eff"
        },
        {
          "alg": "MD5",
          "content": "bca2f266bf8fe6b9b4c039c00f76333c"
        }
      ]
    },
    {
      "bom-ref": "41879027-50df-40bc-9407-681a8bf126d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libexpat.so.1.6.11",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcdad264d19e601bbc20bb57e3899923779ee582"
        },
        {
          "alg": "SHA-256",
          "content": "5307c084b5953b62880b733282f786a154b747f72f090299cb7acba5a6564ccf"
        },
        {
          "alg": "MD5",
          "content": "96a361b044c3427a184ce648d88f9ad8"
        }
      ]
    },
    {
      "bom-ref": "4190e007-e92e-43b8-827c-c372fcc461b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/modhelper",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "199317a621c56c22f270f9058ea787b07084d1ae"
        },
        {
          "alg": "SHA-256",
          "content": "4d4dff016f55239b043dbb5ccd06048b6ea2168c11c8eeaee96a6f9d662028be"
        },
        {
          "alg": "MD5",
          "content": "64e87536928b848814140484ee3e98dd"
        }
      ]
    },
    {
      "bom-ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/vlock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/umount",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "41f2523e-b9a8-4cdd-9ce0-06f5126880cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSRAM.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f758aef38ca21bebdd3edca2ebbc8c6301d4a888"
        },
        {
          "alg": "SHA-256",
          "content": "9552213b43c3626bb3d72519bb33b15472c1ed2601ddb37b89ef1a96874d0330"
        },
        {
          "alg": "MD5",
          "content": "102f2aee41901fd7716af965eb645647"
        }
      ]
    },
    {
      "bom-ref": "4204bdaf-2f98-47d3-a5ea-934ba2b7121f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_ipmb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "487d1a57955ca36818e0cc417dcd802c0f33cf7a"
        },
        {
          "alg": "SHA-256",
          "content": "dff6c8002c54419b8cbb86b9cbdf5db9618c02c19838eb33864cce1218730d4b"
        },
        {
          "alg": "MD5",
          "content": "258f20f9a76a10da92420e136aa1b213"
        }
      ]
    },
    {
      "bom-ref": "42495f05-f540-441e-ac6c-43fd89748be1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/addgroup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "425874c7-c24e-4ab5-9364-a9ecf7b3b18a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libzstd.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f49b92e2d483a59646a741a5b9340d63e93ee1f"
        },
        {
          "alg": "SHA-256",
          "content": "c495d603579c6a203727a66bf4f2af4789ee8815d4635c22bfb2e2e68ad68142"
        },
        {
          "alg": "MD5",
          "content": "4302560a4ea0a94a90150adf74e25e49"
        }
      ]
    },
    {
      "bom-ref": "425c2696-464a-43a3-abc3-6d66414f9cdd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hostid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4273cc83-8d0d-4c06-a1e7-d0a2ae493168",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_PUE2.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "631f1c3b242a3e926dde841e77ec44d750e317ae"
        },
        {
          "alg": "SHA-256",
          "content": "1075f8c1a71ab28ed3576ddd74376a73544906b5e78b5a0efc461651bb266965"
        },
        {
          "alg": "MD5",
          "content": "b2b644cb14325edb4db32b62e5871781"
        }
      ]
    },
    {
      "bom-ref": "4279b2da-ff1e-43a9-88ab-cb77e2cf99a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/reload_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "abf5bb4880334aa13366e32b3c4c2d3cdbed5fc7"
        },
        {
          "alg": "SHA-256",
          "content": "acf738f72b9678bfe11fcd4ca38729b464f0484a7f75249d5210dd730d6b6ed3"
        },
        {
          "alg": "MD5",
          "content": "7eca4744c0461bfb53bf555ccf46f30b"
        }
      ]
    },
    {
      "bom-ref": "42aacc43-ad1d-4bf8-b34b-7b07d745b15c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_mdns6_minimal.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ccb7530e531964ba3ec89b38ddd1ccc02df8062b"
        },
        {
          "alg": "SHA-256",
          "content": "7881f0182dc4492c557a73821bf5f7805f6d9a07c2fdf3ceed7fd4a9ad230170"
        },
        {
          "alg": "MD5",
          "content": "01e74af1d57ba0e5fd7c664b477ac414"
        }
      ]
    },
    {
      "bom-ref": "42d12144-13d0-42e5-86b0-f3f0994efa31",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/makemime",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "42d12fed-f379-43a6-adb3-95a054f50a9d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "363bdab7798538fcd0b19925debbfe59ac074dc5"
        },
        {
          "alg": "SHA-256",
          "content": "e0f56eef414ad4af6456b8f2a4f4b05480e4bbf9940dc04080054df61e4fca2c"
        },
        {
          "alg": "MD5",
          "content": "f264a10c8b7a42eaf9cbd8180a3dbd4c"
        }
      ]
    },
    {
      "bom-ref": "42e41f4d-6779-43d1-8ec5-364c205b8ca2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/vroc_discovery",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61e5144beba7fea09f3c8c17e572ef5f59618469"
        },
        {
          "alg": "SHA-256",
          "content": "8d20248ceacc6bbd5404fee4fd32e26e308002cf5ee2ed13aa0921ded6c3945c"
        },
        {
          "alg": "MD5",
          "content": "1c30416381f7806102b0c6ee1bed91f5"
        }
      ]
    },
    {
      "bom-ref": "42f37526-a806-4105-be92-ea6d72cd0af2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha3sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4340c3de-5e8a-46a8-b105-e91b8cf73f46",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEM_TF",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "885e3eed66f8b9a80d45c1c25046f0c9e38a3c1f"
        },
        {
          "alg": "SHA-256",
          "content": "fec90d13565f6c14760ea95c4a16931457fd9aff5d0890a32ba97d5fdf80aa8d"
        },
        {
          "alg": "MD5",
          "content": "e456751f389dca682d38ccb7d76aab23"
        }
      ]
    },
    {
      "bom-ref": "434b9b49-0acf-433d-bfb5-cb233b42f1f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamVoltage_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d1e50c939d5dafbad0bc8bbcfc8077483d643513"
        },
        {
          "alg": "SHA-256",
          "content": "c6fc141635e4474895d7f622209a8b7b8c2bf5aaac10fa9f08139fc6c6204e42"
        },
        {
          "alg": "MD5",
          "content": "71c0c5f97b24f464b0c4d580a4df595f"
        }
      ]
    },
    {
      "bom-ref": "434e7e2f-1882-4871-bb3e-467461bd16f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/testCrashdump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ac33a74a4027f99ccdede8e28fee4a4c70491c3b"
        },
        {
          "alg": "SHA-256",
          "content": "8ec43168bcd79dc4e356bb697e8536599d8e74e2a1004821eb8805ad449e7d2a"
        },
        {
          "alg": "MD5",
          "content": "881a96f87deac7e491c539ce80a88e5c"
        }
      ]
    },
    {
      "bom-ref": "435121a1-e638-470a-a496-0d1eb40a47a4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_locale.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "91e7d62682ef51cec92de0b50edc66487315bc79"
        },
        {
          "alg": "SHA-256",
          "content": "a1c48a37bff9b8fb767178ea00e4dadf00281a63d83e7cb8c1fe4b67cf169c35"
        },
        {
          "alg": "MD5",
          "content": "2aeb499a0c37a5eb53ebbe258f490c4d"
        }
      ]
    },
    {
      "bom-ref": "437984dc-4e07-48aa-b957-db6b0d0a04da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "042df610fa7e289c13b1dec1828e0a487cd91949"
        },
        {
          "alg": "SHA-256",
          "content": "1ef863db97e5ba913a731196a0b15918856d502a8cb1985df66bfb27be5613d6"
        },
        {
          "alg": "MD5",
          "content": "7721686d1a187c82535eba396f83e863"
        }
      ]
    },
    {
      "bom-ref": "437c97a7-98dc-4372-b742-e8f0e4967134",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "41d828f8262da492b26f6db40ed34a651b089e7b"
        },
        {
          "alg": "SHA-256",
          "content": "b8feeb696502019df787e84a2bc403dd4fd05e6e26d08bdf9cb0bf449e019679"
        },
        {
          "alg": "MD5",
          "content": "7159dc6889c416875de57d46e5863254"
        }
      ]
    },
    {
      "bom-ref": "438597b8-16d5-4571-aab6-0c0b3defc399",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libreadline.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fae65cb41be48fac26d04260ae347cbfb5c63051"
        },
        {
          "alg": "SHA-256",
          "content": "b848d76b290ce6400e5de30a91d47744df9bcb1bb15fbc4f7c73ba744a8afa28"
        },
        {
          "alg": "MD5",
          "content": "5a82c15583df416e04508dc0343f2fe3"
        }
      ]
    },
    {
      "bom-ref": "43923a94-716c-4137-9886-ec795514ac77",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logout.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "82d2dac8f9e8b1e0029d1f3df790c68336ed4ff0"
        },
        {
          "alg": "SHA-256",
          "content": "dd285ddcc505104bfbd547670dd60bc7211ae069c79745deec1f009e8c7c4311"
        },
        {
          "alg": "MD5",
          "content": "1b831d30592910dcc3e473898158f2fa"
        }
      ]
    },
    {
      "bom-ref": "439a3816-0877-4aca-87fe-8c33108b4421",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBM_SP_8FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e351666f5c5c4dc8f599e14183f3f3e77886bd90"
        },
        {
          "alg": "SHA-256",
          "content": "0205190de80497366287678c34715b2f09ae354b3f04d466f157fcd58ec615c5"
        },
        {
          "alg": "MD5",
          "content": "b1e99652b9c8c42a0c76962c9fc68063"
        }
      ]
    },
    {
      "bom-ref": "439a6857-3ea0-4536-840d-2de9c4e1c89f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_smartpower.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a7442a005f19eb46f9f8ab68cf1d9d3e43799c6"
        },
        {
          "alg": "SHA-256",
          "content": "6f9f06217bf60eee06d4c7236be039dbc75e5d06e7118eaeb483658865321af0"
        },
        {
          "alg": "MD5",
          "content": "3f252e766d44a3d9d81543c75c28f06f"
        }
      ]
    },
    {
      "bom-ref": "439cb71a-6dc7-4552-aaf8-92605d81d2e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/oob_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72bcabf1e397242c0acc2617986dba1f91e2fbbc"
        },
        {
          "alg": "SHA-256",
          "content": "c21ea541895b67a4a1a3e593d64cfc0596f28d25c566cf8f4218a6a4eb760f14"
        },
        {
          "alg": "MD5",
          "content": "5cae0500b495c7701118f818e40ec78e"
        }
      ]
    },
    {
      "bom-ref": "43a2bec0-8675-458e-8a52-118966f8e24e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libreadline.so.5.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fae65cb41be48fac26d04260ae347cbfb5c63051"
        },
        {
          "alg": "SHA-256",
          "content": "b848d76b290ce6400e5de30a91d47744df9bcb1bb15fbc4f7c73ba744a8afa28"
        },
        {
          "alg": "MD5",
          "content": "5a82c15583df416e04508dc0343f2fe3"
        }
      ]
    },
    {
      "bom-ref": "43b104e8-3747-4963-8e92-3ba1000be220",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/plugins/jqplot.donutRenderer.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b77f671bc2564b835453b0f6e3724f3a7cb58c6f"
        },
        {
          "alg": "SHA-256",
          "content": "818ebf37bb404c43e16005ccb5160c1ebab14dbf26b19e0b3ce090dabb9c4ea4"
        },
        {
          "alg": "MD5",
          "content": "60f47095b21ad5b20831c10df1a59ccb"
        }
      ]
    },
    {
      "bom-ref": "43c6b62b-2cbe-46c8-9bc7-bf15ea6d866a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8cdd7580da6ee9758d1d7ba96c2bced8de77ecb6"
        },
        {
          "alg": "SHA-256",
          "content": "efd85528b5e17db71cb28119a27f71a398a48c568134c93b2d4cec9482bcd1fe"
        },
        {
          "alg": "MD5",
          "content": "f431b3af79c7c5a4193f62a7a0edadb3"
        }
      ]
    },
    {
      "bom-ref": "43ebdb0c-f3e1-4105-a4db-b2e00b15cfc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libcimcClientSfcbLocal.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0230ce3dde65a28e40dafd060c3c3b0af593b677"
        },
        {
          "alg": "SHA-256",
          "content": "6af9afca3f200c8bdfacc69f16ad861f2ded1d3299951177185908afa8fe8e13"
        },
        {
          "alg": "MD5",
          "content": "a33d1d62ae1e3225ee0816561a1f782f"
        }
      ]
    },
    {
      "bom-ref": "4401785d-bb18-4728-93d4-01e236e1861b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcPortsExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4debad16d1a2c150eb0c68892a2af42727035543"
        },
        {
          "alg": "SHA-256",
          "content": "8af405b4db4fc63eb4bef8dddd8277a482cc51ba7db521fd7e38e455a86af659"
        },
        {
          "alg": "MD5",
          "content": "5714d58e8c44eefdafb47d924d1c730d"
        }
      ]
    },
    {
      "bom-ref": "440c58e6-9dbc-4783-985e-02888035106b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/LldpService_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83646390529ad3e200731394ef9a8b9cc6452053"
        },
        {
          "alg": "SHA-256",
          "content": "bc635f97ca0e14958d83cec7e7a32229922f6e625d651cecaeeb6fe49b3ca2b6"
        },
        {
          "alg": "MD5",
          "content": "5f79f93012b636bf5f6a234775283dbd"
        }
      ]
    },
    {
      "bom-ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/uname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "441ef7ff-2764-4faf-8d9f-d567404eae6c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/stunnel/libstunnel.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c9e2dafef2ada138ba773630b5b0299367ebb57a"
        },
        {
          "alg": "SHA-256",
          "content": "71ef45bb1c25212cd1bf17410b1a5f73506d8e604f1b60e0d68d585c4fc4954f"
        },
        {
          "alg": "MD5",
          "content": "8c7b08e92147d99278e5573acae0768e"
        }
      ]
    },
    {
      "bom-ref": "443c42cf-60de-46e2-b9bf-5ac59a9c6996",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnl-3.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e6a207c7138d771357a991e8d9fbc0a93fefc80"
        },
        {
          "alg": "SHA-256",
          "content": "cc88216cd17a65c6ca6721817f6ac6130ee194eec0d2da45bac902e7eb5f2e04"
        },
        {
          "alg": "MD5",
          "content": "d86be3332539ffe888e994e49ea65c28"
        }
      ]
    },
    {
      "bom-ref": "444724af-5277-4f06-9dca-0bd5f26d6880",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/Roboto-Regular.ttf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "096c9245b6a192d1403a82848e104a65f578a8ec"
        },
        {
          "alg": "SHA-256",
          "content": "017c0be9aaa6d0359737e1fa762ad304c0e0107927faff5a6c1f415c7f5244ed"
        },
        {
          "alg": "MD5",
          "content": "11eabca2251325cfc5589c9c6fb57b46"
        }
      ]
    },
    {
      "bom-ref": "44546e8a-104d-477d-ab63-86d8d84d323f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/traceroute6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "445cebdf-d2d7-4d0e-9328-6b7f8f9e69b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_t.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc0105346385d94c24c44947bd659fda5b3de467"
        },
        {
          "alg": "SHA-256",
          "content": "bc86a4d48b1d6460a0d76ededee7b86f1b35a74d69dcf3e5a97fa2c3717e19d7"
        },
        {
          "alg": "MD5",
          "content": "cb4c5f0499e1d1bb856906da2ccd7377"
        }
      ]
    },
    {
      "bom-ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "448d530d-494c-458a-b790-5eacec889a53",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/record.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e26818abfb1b39e9a9107ea68f62e71346be103e"
        },
        {
          "alg": "SHA-256",
          "content": "2e9a9e6e364e600e0ea77bb75e0fda9db8cf887a3c2c35b2113cb4699a7eea2f"
        },
        {
          "alg": "MD5",
          "content": "4014b546f227f2b4ad06d0b8d872188f"
        }
      ]
    },
    {
      "bom-ref": "44a00f2e-1ee8-4ae3-95f4-073555ef25bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/loadkmap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "44ad704b-73be-49f4-b28c-b59c3be3e3e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/[[",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "44b38d74-0886-4a61-b449-e5bb40d66e0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8e9f35eb2c934a58bb1be2fd8e753b5fc510919f"
        },
        {
          "alg": "SHA-256",
          "content": "80438e2d8c95658d85274b081fd74b0cef3b32608e1ad955d0485ae270fb2238"
        },
        {
          "alg": "MD5",
          "content": "88733f2862b41d4bac15699e53794538"
        }
      ]
    },
    {
      "bom-ref": "44b4f8f3-9f42-46e3-ae0d-f14aa33aea4f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cdetect",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7ae2b238-ad9e-46d2-90b0-21b8498d0693",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/ikvmStyle.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6a8771c04f23e70d5e53999b95c3ffd24c437c7"
        },
        {
          "alg": "SHA-256",
          "content": "d50f72e7cb5ebd5a9afbaa1427d9e99e1b91a52a1cbc5d557640f1e15ca3a6e3"
        },
        {
          "alg": "MD5",
          "content": "6b0156e58cff9ad76b7724a41746cff1"
        }
      ]
    },
    {
      "bom-ref": "44b6d5e2-2514-40f1-a41a-413f0f3ae9d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcEthernetInterfaceExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d83e9aec9899d45946cc62a55df6788a06296beb"
        },
        {
          "alg": "SHA-256",
          "content": "74ec8694c2ffcfc0eff865f43c74393ad2d4c33a531986fb183c65999686b182"
        },
        {
          "alg": "MD5",
          "content": "cb8e0fafcc1def0929871cb3f9c2d67b"
        }
      ]
    },
    {
      "bom-ref": "44c1685a-eed1-496e-baec-646f586920ad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/ResetIP.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b50f9289b0ca9f77acdf07336191ae07e34a406"
        },
        {
          "alg": "SHA-256",
          "content": "8fc97d044d54e8b77ec8d5d962fc0902b1183ddb9cb0f6e72fd0089d7f5d2bce"
        },
        {
          "alg": "MD5",
          "content": "d6f2030df7dc8519e9666d5c1f9f2d11"
        }
      ]
    },
    {
      "bom-ref": "44ca53af-de56-4138-9746-9cd2cecb700b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/html5boxplayer_playpause.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "705d9d9ff370701558614590127d40cfab6eae4e"
        },
        {
          "alg": "SHA-256",
          "content": "e03e4b7c6617cae8fd950c34e556c573442ebad1ab3d994584d56ecbf556c30c"
        },
        {
          "alg": "MD5",
          "content": "fc31c3e87642d4e765595092e844f3ce"
        }
      ]
    },
    {
      "bom-ref": "44db6921-d544-4d03-b0c9-0a086d989194",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInternalProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "193e06cd6f150a382fa4ee18092169da64280d82"
        },
        {
          "alg": "SHA-256",
          "content": "8cd4f983d78cb9b3d5ae38c729738685e960030221c60be2bc7f6c3fc0350cb2"
        },
        {
          "alg": "MD5",
          "content": "15816d6cee8e8ef0ced6ef426e13d452"
        }
      ]
    },
    {
      "bom-ref": "450c00db-04b1-440e-9a8c-a2c5a0538b51",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_cxl.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2f5e96690cea844bab26db243aaf6fc23eb95826"
        },
        {
          "alg": "SHA-256",
          "content": "0978e9a86701a18951640895f83ce6797647ad1315325bea7f0ba4a68be2061a"
        },
        {
          "alg": "MD5",
          "content": "e7f53100883fa20271c8ad4731060da7"
        }
      ]
    },
    {
      "bom-ref": "7afc8477-b5d1-4c01-9858-bc070bd86319",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ee21a7c50e20aceb8d5c9f6e56d289bacc90580"
        },
        {
          "alg": "SHA-256",
          "content": "d74f706ef312f86cbf9ca4c6f4da53df9de9538bd94dda0a062b3b0db12f8294"
        },
        {
          "alg": "MD5",
          "content": "f94a922696e4fcecf05113345136d32e"
        }
      ]
    },
    {
      "bom-ref": "450eddab-fe1e-4308-9d71-842bc023c44f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_pcieAoc.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6d782f89dd3bcaa38ee933d534475cce6caccf9"
        },
        {
          "alg": "SHA-256",
          "content": "d3f64a4881dce69704ecfc65fc567bc469f62e5bf8e7e02a9f44eb46662b9397"
        },
        {
          "alg": "MD5",
          "content": "81507205c22ae4feef01a8ac49930602"
        }
      ]
    },
    {
      "bom-ref": "4513bb30-7232-4791-b6f5-14db554d7415",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/slattach",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "454a0f1b-08b4-45f5-9e99-98c5c6933459",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/stunnel/libstunnel.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d21e0cf5449dbf0011fd93e6a2d53102cd03d2af"
        },
        {
          "alg": "SHA-256",
          "content": "d510acad78ea3c8ca3d795ce3a5f29660fe9ba668e3602157680a0cf9ac7b601"
        },
        {
          "alg": "MD5",
          "content": "1e2239e80e0763a3e4829a5cc5ffbb26"
        }
      ]
    },
    {
      "bom-ref": "454de516-cfe1-4889-b795-fa274eebeafc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxml2.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a73a39bdd1f2ad3b670b4d0213422c85700dc3f1"
        },
        {
          "alg": "SHA-256",
          "content": "a1d7bfbee817afe0e96658ed80e1b9d413bba27a6256ce4cc5c1d3463225f44a"
        },
        {
          "alg": "MD5",
          "content": "94232484ab3a997649e5a2fbd593e72e"
        }
      ]
    },
    {
      "bom-ref": "454fd965-ce45-4917-9017-a9442c3b07b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/S30dbus",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5118753c0fd7613c27a1509efaaf5c320954f29"
        },
        {
          "alg": "SHA-256",
          "content": "eff80c69295ab7483cef5c5cbf8fa35ebc4aba9cf94952168bff8745be2aecc0"
        },
        {
          "alg": "MD5",
          "content": "95eb6e55ab22a985585d543f415278cd"
        }
      ]
    },
    {
      "bom-ref": "455285d7-64b5-47ae-9d0f-22a5d603a166",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcUpdateServiceExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "449581970f79ec2b4d7ff4a848cd5b8647636e87"
        },
        {
          "alg": "SHA-256",
          "content": "544e7c8bab5dc95a9fba7aa2064c34e5a600b87456dc604a3cdf5bad70b6859c"
        },
        {
          "alg": "MD5",
          "content": "eacc34138f602e12eeab8be7056bd93e"
        }
      ]
    },
    {
      "bom-ref": "4573dc90-3f02-4312-9bf3-e723897c9adc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/prev_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9cf8daadb64b981fd6c01509042cf2c3d565be2c"
        },
        {
          "alg": "SHA-256",
          "content": "aa47f3272ecbd86777cdac4adb7925b51656ddd82a9886637a921373cd01d0d4"
        },
        {
          "alg": "MD5",
          "content": "784541f507e5e824cae91b51e3f3a3bc"
        }
      ]
    },
    {
      "bom-ref": "4585e883-24b3-4bcf-9e66-afe652c35dce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubiattach",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4594494c-0f5a-4f64-a684-8f650d22e0b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamPCIeInfo.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58715349830a1572c95d36e088b3c66dd6373da7"
        },
        {
          "alg": "SHA-256",
          "content": "17f4f46ad731976301da29b7ba73c8eed6e01d54b07e03f755504dbb7cd7b2f9"
        },
        {
          "alg": "MD5",
          "content": "f0ef8048fca49894978eaf63d7ce4482"
        }
      ]
    },
    {
      "bom-ref": "459958f9-ccad-439c-a76d-ea593587f63c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/fontawesome.min.5.11.2.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aa6d2a5da4266bb2256fd5fad911af7713f6917e"
        },
        {
          "alg": "SHA-256",
          "content": "8b4b3c17032aaa287222cd7f7b3f29d2651bbc6e35f9081bc7d1bc46695ba465"
        },
        {
          "alg": "MD5",
          "content": "8bef6369de1eea0bc96a8daf3a1720ba"
        }
      ]
    },
    {
      "bom-ref": "45a54cb2-e6f1-4c57-ace2-84f25be5a7d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.G1SMP",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9326921c59573c23096f23b06f137ed6bec44af6"
        },
        {
          "alg": "SHA-256",
          "content": "ce5d8ee4e8d22bfef4cbcb5a5972b58feebf57a7ebbb0aafdee3caa4dee57547"
        },
        {
          "alg": "MD5",
          "content": "d53b281879338ab84c5264a74500ed5b"
        }
      ]
    },
    {
      "bom-ref": "45dcae77-6c5c-4526-b131-28e4d5f32b4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SSLCert_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7ad964c9df7f456af2c1d944e17be91c53c386b0"
        },
        {
          "alg": "SHA-256",
          "content": "24d381f597e858177bd2d16f3ae5dfc872e2e70fe1fdba8d84b21a36d93c1fa7"
        },
        {
          "alg": "MD5",
          "content": "c2ae1e9600df20b74f2b3451efcc69e6"
        }
      ]
    },
    {
      "bom-ref": "45def12d-6f13-474e-be2c-f3dbb98283e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_contract.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66adea2ef92f14748d4d6800243d5a9edaf5ebd2"
        },
        {
          "alg": "SHA-256",
          "content": "30e9570640314eedf4512aed63bbe426fb8edd6673873933a8a2e7a84f301f91"
        },
        {
          "alg": "MD5",
          "content": "afd4be5004dec08528a6356ed33520b4"
        }
      ]
    },
    {
      "bom-ref": "45e19610-fcd2-4cf9-b84f-1207b7a5bbac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBasicAuthentication.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90d888803b2a7da3e9ce7fe26d528ba49e250829"
        },
        {
          "alg": "SHA-256",
          "content": "912563dd582d975b6f26b0d7997de9d6237ac7e12a567daf2d04b464e18ef07d"
        },
        {
          "alg": "MD5",
          "content": "51e9e8d91802c3df2a6d29e745f80215"
        }
      ]
    },
    {
      "bom-ref": "45f0b742-b3de-4b17-8772-2fddb8252ff4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomain.v1_2_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "78614894901a0b806ca9bf4bd479ff5f3963e619"
        },
        {
          "alg": "SHA-256",
          "content": "11192462bec1a0a2716e1ee38145664cd84f06e5e2a69f8e5aaef2bf77d27ed8"
        },
        {
          "alg": "MD5",
          "content": "4f10c68d1eb9b1f30ccfdae0aeee8ce9"
        }
      ]
    },
    {
      "bom-ref": "45f8e92e-bed9-4c99-82d2-e41abc222335",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/sign-error-icon2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b1810bfee7dec40eb79597edcaf75b5f92c3a7b6"
        },
        {
          "alg": "SHA-256",
          "content": "d070dc4f6a0dad8c1cd2e65db1d045529c59e140670e1a1a289bf7c8ebff7242"
        },
        {
          "alg": "MD5",
          "content": "18183764cb07ccd2db649d703bd3a991"
        }
      ]
    },
    {
      "bom-ref": "460aa8a8-0712-44d1-b19a-97486f2b3dc8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lspci",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "464eb908-1834-4ea0-8c66-0cfb4249505a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libncurses.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "71a2659eeca7bd4b288c126d1bc0155bae885a48"
        },
        {
          "alg": "SHA-256",
          "content": "65779b09e017c10c0b45e9626781c5cf7a79cbd55934ec3987354e0d0cf9b7da"
        },
        {
          "alg": "MD5",
          "content": "8381fa455fe7ce6260a2a878a8a343f8"
        }
      ]
    },
    {
      "bom-ref": "466c80ef-6537-4a12-b2a3-db33c72381b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCimXmlCodec.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b00e6e042a4370f57608ff1584580406cb08a62a"
        },
        {
          "alg": "SHA-256",
          "content": "8f4768c91b03820dad813a60af5ea22e717238f1da7799304a6b3ebe9163fd98"
        },
        {
          "alg": "MD5",
          "content": "c1eff99b7348a6401bc91e39c593c991"
        }
      ]
    },
    {
      "bom-ref": "467b7807-388b-472c-8890-169fb36e2aa4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/flash_erase",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "937c972d6c8146ee1e39dd78dae0497bbd9ad46b"
        },
        {
          "alg": "SHA-256",
          "content": "11a6b38d05692dea7c936dd8ce5fca8e8aed675082d66dc32fa5abf6bb79c6cb"
        },
        {
          "alg": "MD5",
          "content": "4f9d557763cc4ef6ef4052afe8cf250a"
        }
      ]
    },
    {
      "bom-ref": "4685d60b-de6a-44f1-b43d-073d5276e20b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpioset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb940d515f16191962379a4032e78eb8f5e075f6"
        },
        {
          "alg": "SHA-256",
          "content": "0b5b7a3781bad4413449496d2ae32d12179ac00dbfd6f105824c774c73024014"
        },
        {
          "alg": "MD5",
          "content": "f1adf7d78e3becc08c561c28df930374"
        }
      ]
    },
    {
      "bom-ref": "469192d0-ccfe-4894-a23d-0f4a00eb43c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmartPower.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b4a8d383cc4fa8a9542160caad14fb5131a4cf49"
        },
        {
          "alg": "SHA-256",
          "content": "06ef170433959f018a76d6de5da1da471e5590cc4357c91b5df37a97685edc11"
        },
        {
          "alg": "MD5",
          "content": "0f09682620ff9d7acd8a78110a38a2ac"
        }
      ]
    },
    {
      "bom-ref": "46a86fc3-e294-4953-8376-86d36b032f64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/remove-shell",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "46bf9d36-260f-4d1c-a4ec-a015eacbe1f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/lpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "46c94d49-c012-465b-8d73-e32cbca1f5c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lpr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "46d706e8-5430-4e0f-832d-6545a0cc22b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/killKVMSession.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6eb29c187e4d066e61e16018d8fbce878971900f"
        },
        {
          "alg": "SHA-256",
          "content": "87a1871e33e3ebe6dd68aa83169bb05923b0c4815e9da921e807356eed6c5ee2"
        },
        {
          "alg": "MD5",
          "content": "3fb4b69f875d3acbfe93448cdba2ed74"
        }
      ]
    },
    {
      "bom-ref": "46ee1adc-330f-4898-95f3-5a3145278ca0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/MouseMode_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5c359a629ab3d708d39e594b020248f200c92cb"
        },
        {
          "alg": "SHA-256",
          "content": "2c49920b602d754963fabb5e9e1f85aaa9a5f6268f5e274a2a817d763bde84c9"
        },
        {
          "alg": "MD5",
          "content": "bf7abb8219ff0c0852df88aa6638e769"
        }
      ]
    },
    {
      "bom-ref": "46ffe31f-ef74-43f1-9ec1-e7d37ac70a07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/swapon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4714eb1c-e4ba-497a-83ad-2e703b93287a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcIndCIMXMLHandler.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2ecc7af651f3c2ad4f3c5433bc454f75a39e44fe"
        },
        {
          "alg": "SHA-256",
          "content": "39ad01728695585176fe94651167e16f28e9d6469ff1c3a93a28ed87b413eb8f"
        },
        {
          "alg": "MD5",
          "content": "47a06931a44c5be3b419be64e31b252f"
        }
      ]
    },
    {
      "bom-ref": "473165a7-6172-4fff-9758-572947765259",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCertificateAuthentication.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5cff5979dbb581b0582971e4acb1e3a17fdfcd7e"
        },
        {
          "alg": "SHA-256",
          "content": "1533b042bd24f71bfd68365b9e5f534216faeef2e02a2d47645ac28d716eb1aa"
        },
        {
          "alg": "MD5",
          "content": "540b23cb8dfeecbf0781f62c4ef595c9"
        }
      ]
    },
    {
      "bom-ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fsck",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "474525a9-7cad-4467-9812-cb18ffe80a0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_factorydefault.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2fcd34b16b250189e3652e303271a6f60ff43bd0"
        },
        {
          "alg": "SHA-256",
          "content": "534fdaca80879e1d0d127285d3d66a02487d78349642a47ca4483fc4ec6fb790"
        },
        {
          "alg": "MD5",
          "content": "42851df3b5ca7c8357d3646f037606d2"
        }
      ]
    },
    {
      "bom-ref": "47467983-a44a-4b1a-8956-19051a996111",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4746a1ce-01e3-4d44-b1a4-050a27056baf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_iostreams.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4de27a3756eb38ea169fc7761f09ad31a0485148"
        },
        {
          "alg": "SHA-256",
          "content": "b433b1777df34004074cd7ee1cc4e3e39aa6d08e7770b580e238443eb6fbed5e"
        },
        {
          "alg": "MD5",
          "content": "71d5618e1624d72cc6dee898aa11cfc3"
        }
      ]
    },
    {
      "bom-ref": "47576937-4e6c-473e-96b5-61b96494dacb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mknod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4785b28a-0f60-40bd-9dc4-697647b84dbb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/rpm2cpio",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "47944f22-d774-4e0d-bf5c-207882640002",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uptime",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "479b798d-8103-4bbe-a74b-8db0fdfc0225",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86_64__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/12672-298472.elf64_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16ec4c24c930575f9beabbb50ac3ad8148f8acad"
        },
        {
          "alg": "SHA-256",
          "content": "8147c1f45b9f55f02405c5071b10c33e811a146174bf65576471cc7112382e40"
        },
        {
          "alg": "MD5",
          "content": "7669806298f3cd09fc97a9557bf66d2f"
        }
      ]
    },
    {
      "bom-ref": "47a7ad2f-f575-4736-b77d-937b342ad328",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/run-parts",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "47c0bec3-735f-4aaa-8fc2-40af49a72b0a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86_64__V1.0.5.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3ba5783e333fe128301b16d9b968a5ea300ff60a"
        },
        {
          "alg": "SHA-256",
          "content": "74e79e714a6106cd3c293d305f044349697b669bd01c1367ba1e94ec4a7a985f"
        },
        {
          "alg": "MD5",
          "content": "adca95da8f48c567bf53cb03ce3f6cc6"
        }
      ]
    },
    {
      "bom-ref": "47cb61d4-fc0b-48c0-b3ba-a9dc3d7aacff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bzip2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "47d093b0-b683-4075-860b-4e9a4401baed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/telnet",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "480cecbb-cdef-4bd1-b462-bcd2b4c04f4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/deallocvt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "4812716c-2d19-45ad-aaec-a0a206e17043",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInternalProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "193e06cd6f150a382fa4ee18092169da64280d82"
        },
        {
          "alg": "SHA-256",
          "content": "8cd4f983d78cb9b3d5ae38c729738685e960030221c60be2bc7f6c3fc0350cb2"
        },
        {
          "alg": "MD5",
          "content": "15816d6cee8e8ef0ced6ef426e13d452"
        }
      ]
    },
    {
      "bom-ref": "482604d2-b02c-4367-a3b7-eefee89464d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcclient.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97c9839af0e3f24b87bd275ecba935093ee188b0"
        },
        {
          "alg": "SHA-256",
          "content": "682f65552ec84ff84d3cc9667ccfa52712b40b711d4a65937e5c34e3e4b00f76"
        },
        {
          "alg": "MD5",
          "content": "8fac9537ef369e82d113a8c0a0e9a94a"
        }
      ]
    },
    {
      "bom-ref": "5a141b3c-0b09-42fa-b6cb-ea6ebcfa4268",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi++.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e23ff920af42f30e4bbabdb292a51b2759553885"
        },
        {
          "alg": "SHA-256",
          "content": "b65622ddef67a12193187317c574d318ed1b793e7880ddb40dfc99ec85726ab7"
        },
        {
          "alg": "MD5",
          "content": "c60b67a5e33aab8cce10a28fb81cac3c"
        }
      ]
    },
    {
      "bom-ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/switch_root",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5a3b96bc-8bfc-4345-ba6a-3e904abeda0b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamInfo.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e81e50f8e4919aa3cd64179015595161e111df8"
        },
        {
          "alg": "SHA-256",
          "content": "a745f7a4818e85941198c6bfc444fe210028f21ea50de7eb385660848bbd7333"
        },
        {
          "alg": "MD5",
          "content": "a96147392b2a1300c917240ebfc873e0"
        }
      ]
    },
    {
      "bom-ref": "5a445047-9c4d-44b5-9487-ca3f119564e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuv.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d310b90b6f13aabaac71d1c11b2b0e0debee4666"
        },
        {
          "alg": "SHA-256",
          "content": "fbd9ec76d59f8f40f5aa4364e711e2cb62ad8ad74de5b99330b97816093a5e3f"
        },
        {
          "alg": "MD5",
          "content": "e96203676da186cd9642a68b37045b88"
        }
      ]
    },
    {
      "bom-ref": "5a490cb9-7db4-49d2-add5-1a715c1be95e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_UserAccount.registration",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f119995840f8d5224c6c9b6d1866982d2ea6163a"
        },
        {
          "alg": "SHA-256",
          "content": "6f0f097ba68b914d0eb7b0aae68426d0222543742d443255609988821fb49628"
        },
        {
          "alg": "MD5",
          "content": "ff104fd683f8cfea2e046679ed210034"
        }
      ]
    },
    {
      "bom-ref": "5a6d6ef0-3d65-4f9e-8077-49e2d15a47bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5a73800b-d74c-43b4-98ab-aeeea714e676",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_PUE3.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "631f1c3b242a3e926dde841e77ec44d750e317ae"
        },
        {
          "alg": "SHA-256",
          "content": "1075f8c1a71ab28ed3576ddd74376a73544906b5e78b5a0efc461651bb266965"
        },
        {
          "alg": "MD5",
          "content": "b2b644cb14325edb4db32b62e5871781"
        }
      ]
    },
    {
      "bom-ref": "5a8171fd-dfd4-4884-ad1e-fb7a6eb9b05a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3c774c051e2059082239c4229ec2596605d90cfe"
        },
        {
          "alg": "SHA-256",
          "content": "40ab7087f1962740e9fda90a170195f10ca91337c2b8a78bc21897da0c0d2981"
        },
        {
          "alg": "MD5",
          "content": "3866a8468409485a8ea20ea11278d6f2"
        }
      ]
    },
    {
      "bom-ref": "5a89c04b-a846-45de-bbf8-a15ae3be6fc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/mesg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5a8c645d-c803-4526-b91c-a1027f39baeb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/echo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5a9b7f71-2f8e-4799-841e-098e6660f3e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/sfcb/sfcb.cfg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4cc25db86e232dafb397ed7e2ee565847d1dba88"
        },
        {
          "alg": "SHA-256",
          "content": "7c4d6cba40d8498758ff2581edd46190cab35f026b11c090843f2bdcdea5562c"
        },
        {
          "alg": "MD5",
          "content": "9bd336c69d020a1cda848d6e3f88e81c"
        }
      ]
    },
    {
      "bom-ref": "5aa965dc-6f23-4f63-9316-2ab4c5a4084b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiod.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5461f101552bc82bd1abc1192dfaed3383d88fa"
        },
        {
          "alg": "SHA-256",
          "content": "4444abdc7bb7172e3bd39dae7e2f4d06233be60b90678b1eecfa5e96fe2e85f5"
        },
        {
          "alg": "MD5",
          "content": "368a3e6159b8205c22d2f5d2ee43eed3"
        }
      ]
    },
    {
      "bom-ref": "5ac253db-431d-4fc1-ad29-dc7ae9ba586c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomain.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12f092509b616a33adcd8ed996504b99b7c89e58"
        },
        {
          "alg": "SHA-256",
          "content": "56a5a82cd15544f52b72f0eb7fb67a6dab45bd969e294947c752bc5b34e9fb61"
        },
        {
          "alg": "MD5",
          "content": "d19e08fdd7d7b7c06276bddc0253b50b"
        }
      ]
    },
    {
      "bom-ref": "5ac86764-3775-4e19-96a8-c87cb1b561b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcUtil.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd2bad991e3ec21e29d761cff15df94152a8a82f"
        },
        {
          "alg": "SHA-256",
          "content": "7d4367bec76360c7db93d6eb01bba49547ea380107f6306e961ff8e4deceffd3"
        },
        {
          "alg": "MD5",
          "content": "3699b0eb231fe372d9776ca25587e7dd"
        }
      ]
    },
    {
      "bom-ref": "5ad6ce85-3ea3-45bb-b471-2ce307525dfe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxml2.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a73a39bdd1f2ad3b670b4d0213422c85700dc3f1"
        },
        {
          "alg": "SHA-256",
          "content": "a1d7bfbee817afe0e96658ed80e1b9d413bba27a6256ce4cc5c1d3463225f44a"
        },
        {
          "alg": "MD5",
          "content": "94232484ab3a997649e5a2fbd593e72e"
        }
      ]
    },
    {
      "bom-ref": "5b15b7b5-d35e-4263-bdf7-ff9aa3ef6707",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_filesystem.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a867b6f1b19607afef24799c8952d49a209708cf"
        },
        {
          "alg": "SHA-256",
          "content": "156c7b08b188242ae3691f71f170cc61ec7ecddbc764188a9264f947da6aabc1"
        },
        {
          "alg": "MD5",
          "content": "611d6aac9e9f8068e189bcf6f6c79c1d"
        }
      ]
    },
    {
      "bom-ref": "5b272f40-ca77-44d4-8085-7fb936f68626",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libxml2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a73a39bdd1f2ad3b670b4d0213422c85700dc3f1"
        },
        {
          "alg": "SHA-256",
          "content": "a1d7bfbee817afe0e96658ed80e1b9d413bba27a6256ce4cc5c1d3463225f44a"
        },
        {
          "alg": "MD5",
          "content": "94232484ab3a997649e5a2fbd593e72e"
        }
      ]
    },
    {
      "bom-ref": "5b3c2fb9-1ab2-44da-a429-ee56d7b96628",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/SMC.1.0.0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f48d3005e6616c4b774b7b3b496d79e5a5c4f096"
        },
        {
          "alg": "SHA-256",
          "content": "2f8030e1d360e6fb6b9764750df26bcb73576eaa84719ff1354f2cde99baec99"
        },
        {
          "alg": "MD5",
          "content": "492555ed97c28526be15e40c1b60d6fc"
        }
      ]
    },
    {
      "bom-ref": "5b56e97e-b8c4-470f-80ed-6aeb1ecb61f1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptables",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/blkid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5b5d391d-4e5e-45d9-8fa0-b9b5a2ac8f4f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libverto.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c67a272c7c6d06a90e27160a6a3815e802a5492"
        },
        {
          "alg": "SHA-256",
          "content": "fbf81609dc68852e0493bf6ec058670bdeaded13e5aa4f5a1e2a6dd3f9c90009"
        },
        {
          "alg": "MD5",
          "content": "f5c51d1a2457511280b3148ebf476115"
        }
      ]
    },
    {
      "bom-ref": "5b903692-e48c-4e4f-94ab-7cd14517888c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/sshd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1efa43565aae402347be3517b63c14c99f802f48"
        },
        {
          "alg": "SHA-256",
          "content": "7eb5e794ba7fe6c4b07086622269564b24a01af713441ede4f30dc923ab31ca3"
        },
        {
          "alg": "MD5",
          "content": "9587ef1428ff4a22db8f25b49893e041"
        }
      ]
    },
    {
      "bom-ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dumpkmap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5bd44bf2-9da6-4a5a-9eee-98d94415d2b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/df",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5be40131-d4f1-4f5e-8907-a920ae2bfbc1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypt.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "856c779beac13008d0e69665dcfaea2f47502c1c"
        },
        {
          "alg": "SHA-256",
          "content": "44f1f3a07fa4fb9e5e750f29e0c96fa4b9e907257603f33a7aafaad97edbd9c3"
        },
        {
          "alg": "MD5",
          "content": "bd311838d9a1f9fab7943feb837a31b0"
        }
      ]
    },
    {
      "bom-ref": "5bf64b68-2e13-46fb-8229-310d74e137cc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsVoltMon.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d197073da97bb67edc0d6c6c73af9303726994ff"
        },
        {
          "alg": "SHA-256",
          "content": "f955c4588963441958edf60619152ca6ab98bff10d87aa8f6a5b00ae78c5173a"
        },
        {
          "alg": "MD5",
          "content": "053cd0a5ba563cdf80779aebb5db1e56"
        }
      ]
    },
    {
      "bom-ref": "5c0d894f-facc-4962-838c-b9c5228866b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/login.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb0d631fc70ac89f61219ff262ca6f5ea91a09fe"
        },
        {
          "alg": "SHA-256",
          "content": "ecd515fb3423cc5d128854b3d5ac7791e84d8f3cb8b476ca12d0966d446f55f0"
        },
        {
          "alg": "MD5",
          "content": "9005be3333a9b7cfe76e510c67504ca4"
        }
      ]
    },
    {
      "bom-ref": "5c577b17-21b3-4f7d-a5fd-6c774c0f8f56",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_kcs.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a599f8a71eb9deff598cb241fc46c36b97afb171"
        },
        {
          "alg": "SHA-256",
          "content": "521657367def125546bf0f8ad802448d9c56fc704ab7a94f3c86c7e5e5d723ed"
        },
        {
          "alg": "MD5",
          "content": "7be4cf8c58fe4f10ccf2c30c63cb9640"
        }
      ]
    },
    {
      "bom-ref": "5c6d814b-1a3d-4c13-902d-5d02ac94050a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/web-socket-js/swfobject.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5847ed101f55d51c53538a7078971e7de8fb6762"
        },
        {
          "alg": "SHA-256",
          "content": "8677971b119ccdb82af697ff0e08f218490d15116f221d44301f1cc8797e67d4"
        },
        {
          "alg": "MD5",
          "content": "892a543f3abb54e8ec1ada55be3b0649"
        }
      ]
    },
    {
      "bom-ref": "5c757857-f6dd-4860-ba7b-0f4063e344c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/MouseMode.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fea77f0f4e4bd04b83e968a3c86d5a89c3d8dd9e"
        },
        {
          "alg": "SHA-256",
          "content": "e4143c013f827b8fb67980fc933292d1bc3b8e3d8fae2951c604648c9d075594"
        },
        {
          "alg": "MD5",
          "content": "add807a66abf3ebc177c663b26b8c5be"
        }
      ]
    },
    {
      "bom-ref": "5c79d3fc-c219-4625-8300-507a9fa83179",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5c7d135a-376a-43c7-b991-a0bca6087192",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "beb912a5580d0d2d4116e9c2c02cf19408edfb4f"
        },
        {
          "alg": "SHA-256",
          "content": "9b5e3e9b748eaf3f19b7a93186c14c5cd241c18111a91b48cf5d9856977ea827"
        },
        {
          "alg": "MD5",
          "content": "98ded854a1110f67545b2e983e0a3335"
        }
      ]
    },
    {
      "bom-ref": "5c8e3405-4e28-4232-b60a-407bd1c4352b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_alert_snmp.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db98f81df53c57d6fbe0f5c1949937bbbe1185b4"
        },
        {
          "alg": "SHA-256",
          "content": "9a7c1f3756b67542193df13d0c32a8f9b76a688ae8aeb9085d24c4de19e4793d"
        },
        {
          "alg": "MD5",
          "content": "52a080557649aa04825c11b48830d1bd"
        }
      ]
    },
    {
      "bom-ref": "5cd0da5e-0231-44bc-a3b1-689feac6047f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLeakDetectionExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bc4bf903e4ae0e14a5a0fa5231f2c1a39144f0b6"
        },
        {
          "alg": "SHA-256",
          "content": "382aac36a2eb23c4df7293ba0525793605c1e3e186476c56d12d0511993bd8ed"
        },
        {
          "alg": "MD5",
          "content": "f53f92bab1dcd7cf9198d666a4e8afc0"
        }
      ]
    },
    {
      "bom-ref": "5cd318c9-8f7a-429e-87ba-228f59666965",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsysfs.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7acb9e0975bc5c9d23451a82097cf6ba06707781"
        },
        {
          "alg": "SHA-256",
          "content": "861502a695210d94f17c3851a82a1519834a251d112f72f23a32f57a7d2408b8"
        },
        {
          "alg": "MD5",
          "content": "d5eefa4af0589c444d6fd4c934ca0b26"
        }
      ]
    },
    {
      "bom-ref": "5cf9e671-4dba-48d7-b437-cf9f6ecbfcea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_license_bmc.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cad5020056dbf6c3c368d8b6822892c7a793cd3"
        },
        {
          "alg": "SHA-256",
          "content": "53b7e1eef6a45fda8af2c49e70515710b1b3d3696e9a345736a7c577e3c4a75a"
        },
        {
          "alg": "MD5",
          "content": "5f37712141f6650b42bf24407f17e23e"
        }
      ]
    },
    {
      "bom-ref": "5cfdf60c-7ad7-48dc-9d88-605aaa69aa1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/ikvmHelpPage.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e5bacc187d72cc545dd38b5d639d4cc66df153a1"
        },
        {
          "alg": "SHA-256",
          "content": "887bc2cddb703e426bdc2c4b8321520932b87550947f903a973e9a517bc9157a"
        },
        {
          "alg": "MD5",
          "content": "b4b2cdff7b6164a685cbd510fd401db1"
        }
      ]
    },
    {
      "bom-ref": "5d1d969b-868f-449f-9220-f3f76b0a303b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/etc/krb5Config",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a34efb2843e6aab97aca882e9d0167bb378a520"
        },
        {
          "alg": "SHA-256",
          "content": "ab00b3892b70db8ddfed07309bb9b078f9ea8715db89f1cd95b8c5d51fb8086f"
        },
        {
          "alg": "MD5",
          "content": "1d329d4c596b2930881898c7d05af8fc"
        }
      ]
    },
    {
      "bom-ref": "5d2db798-fcb7-4900-a2d4-2618fb17c1b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74d1df5932c3f74e10468a87532bfb32876f7879"
        },
        {
          "alg": "SHA-256",
          "content": "34210593bb7d3b50fc2cde4300d83142d67be8d3741ae0f33b1166be9a92187f"
        },
        {
          "alg": "MD5",
          "content": "115792072172e55cc2b8ccb32f994fc7"
        }
      ]
    },
    {
      "bom-ref": "5d7ab366-9f60-4c89-a999-0f3a32d2851f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cmd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ce3a8c87f1ebe883ac429c6c5beeede112033acf"
        },
        {
          "alg": "SHA-256",
          "content": "08c660dac95d2192b45f76c394eef5020750c5de365b93b2982a09e4d293de1c"
        },
        {
          "alg": "MD5",
          "content": "8470d8b31dd3b7b4bf52de8d2d400d07"
        }
      ]
    },
    {
      "bom-ref": "5d7d0fd8-a652-4080-b59d-632416eff550",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/url_redirect.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "789f2ef36b4e0c49f4b346df0c862a792f93327b"
        },
        {
          "alg": "SHA-256",
          "content": "5a102b49e0eb1780785989cc660dcf80c1b3982c9f928b37003d3eccd7293f9d"
        },
        {
          "alg": "MD5",
          "content": "fc4c385b9344e360dd055dda75505437"
        }
      ]
    },
    {
      "bom-ref": "5d915ddf-f8b2-46bf-a85f-fba4f6891dd4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_diagnostics.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "79a10a0e3ec54401c0b57137e48a331a2dcd94ee"
        },
        {
          "alg": "SHA-256",
          "content": "1ae376b065a4e40e47868b0a88b16a1fdc08679e3f5fbaecd0c800681f4042bc"
        },
        {
          "alg": "MD5",
          "content": "293b489a33dc54d9a500a5e8b9223a44"
        }
      ]
    },
    {
      "bom-ref": "5da1dc2a-1e37-4e25-90c2-d4d6eb8f97a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/jquery-ui.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f253fda704529f50329b500abad6b502296c588"
        },
        {
          "alg": "SHA-256",
          "content": "4e39d596cd6ff9b992bae84f3559de089b16c60eefd559bbeeac905b062aeec9"
        },
        {
          "alg": "MD5",
          "content": "a03dd35ddd34e6c6c91648f8f70a43d6"
        }
      ]
    },
    {
      "bom-ref": "5dc6096f-ab92-41aa-b6be-b8911682d3e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_psu.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "de9bc80056aeb47394e05f630aef33c9b86e5dc1"
        },
        {
          "alg": "SHA-256",
          "content": "b625ba6eb4a4a0d8381a3fc324c00553c29a9bb1715a47b0f198a6dc69897b34"
        },
        {
          "alg": "MD5",
          "content": "500dcd2f792260a95b2791650cab47cb"
        }
      ]
    },
    {
      "bom-ref": "5e00dac1-06bc-4f19-923b-007aa7e22d7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropServerProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af2ea750468e8bb7017ecb49c8069b250387b4bc"
        },
        {
          "alg": "SHA-256",
          "content": "b36c57073b7a92a867fe9e1b4fc4c52355d414ba0d775af5df852f032766a0a7"
        },
        {
          "alg": "MD5",
          "content": "68df59e96f42071d650f645fdbff92fa"
        }
      ]
    },
    {
      "bom-ref": "5e01ede2-400e-447e-84e0-d544078a55b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/dashboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd68eefbe48bf878eeca6a1f5d7abfcb0790dc4b"
        },
        {
          "alg": "SHA-256",
          "content": "c9f03895218b32cb95f88bb3370450791de5420358743aef26c2935fc7339362"
        },
        {
          "alg": "MD5",
          "content": "ee34181d0697120864e5f61eed6f67c8"
        }
      ]
    },
    {
      "bom-ref": "5e163271-0b6e-48ba-aa6e-2239054d8ba2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fakeidentd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5e19be9b-751f-4077-b1e1-9e48da2f31c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/softlimit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5e232522-53a1-4dbb-a698-9734370df233",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fstrim",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5e27bafa-6d93-4add-b298-2d552672cf2a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcTemperatureExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0477e79996bd2ea1bc4edb136bbd1ac63bf361a0"
        },
        {
          "alg": "SHA-256",
          "content": "2a9ec90bea13edbbe5a25fe43c8fb3552778b584583c2787b5e7603b0c037487"
        },
        {
          "alg": "MD5",
          "content": "88249e86d6250ea8262595b4b47b92a5"
        }
      ]
    },
    {
      "bom-ref": "5e75404b-66c8-4489-b8d7-8c840bde33f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/ExtendStorage_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "638ca8edfed525f6d9805fe95bc603e020b84c17"
        },
        {
          "alg": "SHA-256",
          "content": "bb2892b90f927152c72be00e53f3b90aab70778eb94e863cbcc1e0a6ebb250fb"
        },
        {
          "alg": "MD5",
          "content": "078ba98d8b9e72119cc39b0c2ef62c97"
        }
      ]
    },
    {
      "bom-ref": "5e7618e5-1aa0-4952-b7c6-6baec8599928",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ee21a7c50e20aceb8d5c9f6e56d289bacc90580"
        },
        {
          "alg": "SHA-256",
          "content": "d74f706ef312f86cbf9ca4c6f4da53df9de9538bd94dda0a062b3b0db12f8294"
        },
        {
          "alg": "MD5",
          "content": "f94a922696e4fcecf05113345136d32e"
        }
      ]
    },
    {
      "bom-ref": "5e7c6af4-0f6a-4497-acb1-00296604b646",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_17_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0ce3ae87ddc8743e3f7701f8cd709910380f0c8"
        },
        {
          "alg": "SHA-256",
          "content": "85c7650fa5f1658572c0567919eb204118f7df7ba50509b213e6b48e832f3c2f"
        },
        {
          "alg": "MD5",
          "content": "1ffc91695a211c9a6c343400dd097700"
        }
      ]
    },
    {
      "bom-ref": "5e8cfe68-b499-4dc4-961a-4152b7b50d8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.upload.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6792867914cd342b0a4e5428a299a410e9b989e5"
        },
        {
          "alg": "SHA-256",
          "content": "6c256f211e60585d0ce33e1cc9d0d6b309fda7e3c2548c29c379855bd8e14354"
        },
        {
          "alg": "MD5",
          "content": "a095e2935b270cc5abafbd391dce58fd"
        }
      ]
    },
    {
      "bom-ref": "5eb0bf71-f59f-4097-a5b2-9125f9c800a2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/off.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "265c895a5c863687d95c30fe9b8c0b4c4dc11553"
        },
        {
          "alg": "SHA-256",
          "content": "6932365b14692c90254a60da1cbd9f9139b97bbf58efa6bb656b5474318801da"
        },
        {
          "alg": "MD5",
          "content": "5395d748a0deee1504bd50a4d0f90d98"
        }
      ]
    },
    {
      "bom-ref": "5ebc5682-305d-41ad-869d-5f047dc02840",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RADIUS.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "535a711c08fdddfdd55c5133fd6d831aff97c7ff"
        },
        {
          "alg": "SHA-256",
          "content": "44c3629ecd700693199bdbad37c38e0a33fbf2523242f2ee4dc53f97bba1129d"
        },
        {
          "alg": "MD5",
          "content": "b2c596863c807f048e83d964072910d1"
        }
      ]
    },
    {
      "bom-ref": "5f16fcc0-e2cf-4562-9627-4d0c152d1e95",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/bootchartd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5f20a312-2b4d-4818-8313-23331d36684f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip6tc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cc7c53291fd1d41a869ff7eb322bb21179d3dad"
        },
        {
          "alg": "SHA-256",
          "content": "afc2309636826a891d1373b061f26872a2d44421949e266a447a1f62887cf0df"
        },
        {
          "alg": "MD5",
          "content": "eda98f670b06862f81dce603bb73173a"
        }
      ]
    },
    {
      "bom-ref": "5f29c679-4535-443b-89b4-97a670be92ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mknod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "5f658446-c686-403e-9335-20dd715c8087",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libverto.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c67a272c7c6d06a90e27160a6a3815e802a5492"
        },
        {
          "alg": "SHA-256",
          "content": "fbf81609dc68852e0493bf6ec058670bdeaded13e5aa4f5a1e2a6dd3f9c90009"
        },
        {
          "alg": "MD5",
          "content": "f5c51d1a2457511280b3148ebf476115"
        }
      ]
    },
    {
      "bom-ref": "5f673520-c0b4-47b0-b1cb-9893502cdd35",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/main.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ffcb3245b3b8c836adb07adfafff79e65a49f016"
        },
        {
          "alg": "SHA-256",
          "content": "eb34dfc9000a37d28d1d9835b0a41995cd4fdb9fb48fd7b28b404090f1dab1c0"
        },
        {
          "alg": "MD5",
          "content": "dd3195e031eb52d3b766d15630c09d0a"
        }
      ]
    },
    {
      "bom-ref": "5f7c80bb-0f91-49c8-9fcb-d2ca728b4e18",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamCtemp_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2d620b7e16f6dcb104241eb75c164c1cad926728"
        },
        {
          "alg": "SHA-256",
          "content": "daf421932b3589b1cacf1546ec9afa2bc2873483a5f2af52ae4f50f672362ae1"
        },
        {
          "alg": "MD5",
          "content": "0dfea39880d042b7a6016c7b88783caa"
        }
      ]
    },
    {
      "bom-ref": "5f84ff25-4fd6-4589-bf82-a4c6f22f3a28",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/usb_f_ecm_subset.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ee9dda6b5571002b6b267bc7d90630db9235941"
        },
        {
          "alg": "SHA-256",
          "content": "0c39e39c8cfb19f865bd32071040e73b11d5a12ca8917665c7e1456a590a3ebb"
        },
        {
          "alg": "MD5",
          "content": "c2fb7bf171df08511f11b003c4de5b14"
        }
      ]
    },
    {
      "bom-ref": "5f919e69-4ceb-4a5c-b958-2ea26db58c86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/IPv6_RAflags_update",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "87032878de65d27e6fb1752ec987fd5fa8e7266a"
        },
        {
          "alg": "SHA-256",
          "content": "b8c8fa7650f71e86042b764b8532ce75263a4fa18e48cef30eed845ba9fc5db3"
        },
        {
          "alg": "MD5",
          "content": "fa1939fc3b0d8d2a897080e2be43fec2"
        }
      ]
    },
    {
      "bom-ref": "5f91e8fc-a1f1-498d-a410-36bae9803141",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SupermicroBMCConfig_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "56f23bf475d74bde0af1bee173752d7cd0321261"
        },
        {
          "alg": "SHA-256",
          "content": "75874ce8e78c3f38ee4202c0df7e8e67d2e9ad2f1207d8483abd425734a16cdd"
        },
        {
          "alg": "MD5",
          "content": "b1a80f7a6a9fd87389b2a431149e47bd"
        }
      ]
    },
    {
      "bom-ref": "5f9e2400-3f92-4233-81cd-e7d14c60d0b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42b96597ebe4bd702d1e6596bb89d8ebc56eef46"
        },
        {
          "alg": "SHA-256",
          "content": "2132ac331940e47e561064b0ed5ffb296294d1d77155c2de9de11f7299bff7b6"
        },
        {
          "alg": "MD5",
          "content": "433231ca58fa09788970b4767558f317"
        }
      ]
    },
    {
      "bom-ref": "5f9f7fd1-54ae-402b-a84b-059db05c8163",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libiptc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2baf805c793e28600f0d0ebb9e903dd83c98c9a0"
        },
        {
          "alg": "SHA-256",
          "content": "7d439bf191c1a7ad0c18d9ba4906d5d1dc4df8d21811f15ee44df0333a372566"
        },
        {
          "alg": "MD5",
          "content": "341fd6be8b899d63656c014dc0ca9ac4"
        }
      ]
    },
    {
      "bom-ref": "5fb9319e-d168-4d05-9956-f56776d283dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/udevadm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b0742eb8f099bac6578ba37948b72282edd76c76"
        },
        {
          "alg": "SHA-256",
          "content": "8b3b0502e53414b5aaeb9374a28eb693248031a391bf170b825d1f479db7cc41"
        },
        {
          "alg": "MD5",
          "content": "e4b3be15cdbfacd9d46589c0b67bfd48"
        }
      ]
    },
    {
      "bom-ref": "5fca1e2c-a6db-4850-9b60-712f95a41f03",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.switch.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f90910ec32ecb154ddab1dd993238c0e29b5c21"
        },
        {
          "alg": "SHA-256",
          "content": "e2d7ccd3d6c3eec64517a7963cbfca4713b98372447c83055cabbb2670102f87"
        },
        {
          "alg": "MD5",
          "content": "cc0e8c33e86021872a46ed4209d9a616"
        }
      ]
    },
    {
      "bom-ref": "c5c9b6af-7a18-4a17-bb0e-841b0c3ee002",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/html5gallery.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97675ed41d715127431e4efafefa29648735c873"
        },
        {
          "alg": "SHA-256",
          "content": "818ac0f7fb01145f2af15c1ec6b6e013cfbe8207e9d45156a9831a695b4b76e2"
        },
        {
          "alg": "MD5",
          "content": "9fc269767f55c46a60bc38901143b9af"
        }
      ]
    },
    {
      "bom-ref": "5ff48c6b-0434-48ad-ab52-5f2443ea5e5f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcFirmwareInventory_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a0950d8ba515a68e732b534691abfdd3c2c5f9a"
        },
        {
          "alg": "SHA-256",
          "content": "951ded35a77b705d59451c01664d581598211421fd1253507c675c39cc60003d"
        },
        {
          "alg": "MD5",
          "content": "97bcae105115ebb3ca8f2964939c1ab0"
        }
      ]
    },
    {
      "bom-ref": "600e854e-8913-4545-9159-796b809b43a2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4464f03754a467d54f983ca9e9a6b97fd976199"
        },
        {
          "alg": "SHA-256",
          "content": "c5ad4fc9556f28179976f3855dd6a86afa96bdc6e0b7668e01bc8397ff621cbb"
        },
        {
          "alg": "MD5",
          "content": "0a41aefbb26bfbdb00b0ff34c450223b"
        }
      ]
    },
    {
      "bom-ref": "60146c8a-7a27-4ec7-bbf4-bf4471836356",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_SoftwareIdentity.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e0fa3f66826c2e1e406a101b83c679fa51418ab"
        },
        {
          "alg": "SHA-256",
          "content": "fc18790f3ff5f246baa367ce7f513e6f38820f6c7b50c2d9c48d38d6a27d8e2f"
        },
        {
          "alg": "MD5",
          "content": "ab5d92379146b44a57a6112a294574d8"
        }
      ]
    },
    {
      "bom-ref": "601774ea-ff9a-4f3f-8129-ef395e84e38b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "601d138c-bc65-452d-a892-ed0799c70f60",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libcimcClientSfcbLocal.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f82286127ecb8964115de88cab6ca9673731d"
        },
        {
          "alg": "SHA-256",
          "content": "19378c0b68daf27eb1566ce78c6598ba7214a554ea354c8e6ee6d960d7912ebf"
        },
        {
          "alg": "MD5",
          "content": "86c95df95a995dd22b523f9a26f56b3b"
        }
      ]
    },
    {
      "bom-ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rmdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6054f576-b62a-400f-b3f1-9ac42fc9eb0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_memory.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7431144c469e2f39f34f2c0099eaebf1ff68c728"
        },
        {
          "alg": "SHA-256",
          "content": "8b39f3fe8d9b29145a3ff994bd7de3093d106c83cd944c1dc74be2e9192e5cba"
        },
        {
          "alg": "MD5",
          "content": "93bba0bffc485911815a20b17a60ee14"
        }
      ]
    },
    {
      "bom-ref": "60827204-8c28-497d-b6b8-52a3d81be9c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "99257e151acec5b62749fd5418065b509957d519"
        },
        {
          "alg": "SHA-256",
          "content": "0196114f30c7f8462387bb7d46e758c4e20de3213eaccf0c6642a94a130b4161"
        },
        {
          "alg": "MD5",
          "content": "5c7c9ceedb71afaa02149f6c116b2d47"
        }
      ]
    },
    {
      "bom-ref": "60917a88-7d03-4086-a4d3-50848aefb4de",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/therm_mgr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb500d8e677b16f3f477be8539d4b49d5fe86a5a"
        },
        {
          "alg": "SHA-256",
          "content": "7fecef38f0d20d6a5998c675f4e120ad4c6fa04e3e35299681c1fae43798e556"
        },
        {
          "alg": "MD5",
          "content": "c70d82b8e66ca4f4dd5bd322f35f0fec"
        }
      ]
    },
    {
      "bom-ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dirname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "609d869d-8b5e-4f04-ba2e-e9338895b57c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_smartPower.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4030ab3631b53db14cd41aa98d311178dabe16f8"
        },
        {
          "alg": "SHA-256",
          "content": "97f3ed84b66a8a6db38b959201fbd1cd31ce9b021533ec81fbc4f1c151c50407"
        },
        {
          "alg": "MD5",
          "content": "494f717793ec803ed89e050cee60263e"
        }
      ]
    },
    {
      "bom-ref": "60cfe26a-8fe6-495d-8bcf-a310f98e79b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libc_malloc_debug.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "17d70986d986dc7907dc57eeda1cedfce5ed5e22"
        },
        {
          "alg": "SHA-256",
          "content": "4957606c33a4827852ab5c14719d21fe510365b29755b7c335ead68371b2f129"
        },
        {
          "alg": "MD5",
          "content": "4db6a7ec4d56a3a5656dd2ac6cabac06"
        }
      ]
    },
    {
      "bom-ref": "60f70a68-0137-43d5-9894-5e016396a36c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/populate_aoc_fs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7c249313d8c5ed26c4d0513ddcf468d6066985b3"
        },
        {
          "alg": "SHA-256",
          "content": "71ec090fea56f8f3289c35fc7f4f09c959fb620c8966242ac810631924a1a7d8"
        },
        {
          "alg": "MD5",
          "content": "2fe3eb9aca81f55c1796c5dc767f804c"
        }
      ]
    },
    {
      "bom-ref": "6123f157-9705-425d-929d-1a5e0a94fcfd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mkfs.ext4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bc4b3b4d52e8ab668fc8ee63a297aefc56289499"
        },
        {
          "alg": "SHA-256",
          "content": "0b856553f267209317d9e81cbb8d874110bb0bd8e20fae8c9146bd6fcef5373b"
        },
        {
          "alg": "MD5",
          "content": "f833aa73ca7ba917372877ef3aebca38"
        }
      ]
    },
    {
      "bom-ref": "612734cf-d240-45d6-a755-f21b06529a79",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/top",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6133422c-dd61-40b0-b7b4-eede2dd5aa5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamPCIeInfo.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b337cb9ecb2fab079139cb9457daaf12c32a11e8"
        },
        {
          "alg": "SHA-256",
          "content": "bdaef39d44a117ce4dd8860407e8e699ff71bfa42c27e6ddd3672edf887a60de"
        },
        {
          "alg": "MD5",
          "content": "5305a4a4cb761f4b2c949e4074113baf"
        }
      ]
    },
    {
      "bom-ref": "614b2fdb-8088-40b4-94ee-ee567f8a326a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1fccd26f9b58fc9e01240aca2c7cd9bb690cd337"
        },
        {
          "alg": "SHA-256",
          "content": "f4c03f56b1cc1f6c95932e5053f2f9bb7cdd7bca64f7dddf820c4f536727a20d"
        },
        {
          "alg": "MD5",
          "content": "92cb08d0c97ecb0f74dea5fb60e44187"
        }
      ]
    },
    {
      "bom-ref": "6156cdf4-bbe4-4ec3-ba64-3f2740560145",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libisc-9.18.24.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b08401566a1e4664988480b6573e622d994fdbaf"
        },
        {
          "alg": "SHA-256",
          "content": "c6aa95fc175946f3bc45c5a9a7a85cb4017c685e7ca82bf47163448ac6c15c5d"
        },
        {
          "alg": "MD5",
          "content": "00fca0ca3de876b94e095f76ecc1cf18"
        }
      ]
    },
    {
      "bom-ref": "617430ff-f425-4897-9718-57fe5536324b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setkeycodes",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "61b70de6-c703-4c8e-8544-6b238bb9cab3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcTemperatureExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d1931be60a1da653f1bad15cd3b1738ecd16fdc1"
        },
        {
          "alg": "SHA-256",
          "content": "f8b07da66f56f010447a330b34f1bde0f5927bf6392a530c64748002a4316d3c"
        },
        {
          "alg": "MD5",
          "content": "1313a9d5502af333c5f43ba9b05b2533"
        }
      ]
    },
    {
      "bom-ref": "61b83895-e38f-446c-9932-8efbbbf4e899",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/web-socket-js/WebSocketMain.swf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af9d7d0a2838538e8854e9df41eea44f2484bdd6"
        },
        {
          "alg": "SHA-256",
          "content": "22733d693d0ce58b4e1e6457b6465a8b7a9dabc8a82180a93e8a5184b041b967"
        },
        {
          "alg": "MD5",
          "content": "fb36a5d304c899046a777e9b6eb55ae3"
        }
      ]
    },
    {
      "bom-ref": "61d70c14-333a-4441-8190-c768a6ace8e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/oemEventLog",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b2cc2ed10d51f2cb15dd9c846e4f056fd286159"
        },
        {
          "alg": "SHA-256",
          "content": "bb1e83bd7d15e96539067a298632fa4fb88e5da5946d248909ba01f4ce7a081b"
        },
        {
          "alg": "MD5",
          "content": "992df74a175e2e3731da7bb6133cb42d"
        }
      ]
    },
    {
      "bom-ref": "61eb18f1-b67a-42eb-8e52-cb52c00f4a07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcMultiNodeCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af6cb413f9c166f20eb597c47ea3a03c89cd60f4"
        },
        {
          "alg": "SHA-256",
          "content": "60fc9e23b65a24bc6621bb249b46345cc4a7cbca69ca2db5716a50ef7719d17d"
        },
        {
          "alg": "MD5",
          "content": "fc7814082cfa97188d40bcbe0d89a4ce"
        }
      ]
    },
    {
      "bom-ref": "62002d65-6d31-4279-b792-2c52386dd762",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbba64613f32f04751169e6f5563671f43aef760"
        },
        {
          "alg": "SHA-256",
          "content": "614710c5e425f8a857add26bf97772325586c9f7ae8aed2d9bcb0c0b5ed636ca"
        },
        {
          "alg": "MD5",
          "content": "6d3cbda42c54b8404e515f888cb6c1bf"
        }
      ]
    },
    {
      "bom-ref": "6248985f-6b67-4dce-8382-272829a13929",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubirsvol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "626ae4df-38bc-44e6-87fa-36c08435bf89",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/DumpCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52894501763e8c465548a5ee96b7323ff2eb8932"
        },
        {
          "alg": "SHA-256",
          "content": "5a3da3e2f76f6f13b3adaed438432dc2c815a3de6e43697fb372f28f0abe6ff3"
        },
        {
          "alg": "MD5",
          "content": "bf915c876817801a468c8ca03d482e9d"
        }
      ]
    },
    {
      "bom-ref": "62957373-1517-4609-b4a3-243d15d8417b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/linuxrc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c5f5bbc0-1415-4b4a-ab10-b08c29811ea2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/getNIC.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "76135ed1cf5c446d8610d73d9bc791ccf26e21b9"
        },
        {
          "alg": "SHA-256",
          "content": "c8e07197c784466b93c89f5f0336f29fd4bc42b2ec8e5af8724451763da33cf7"
        },
        {
          "alg": "MD5",
          "content": "ccf604ce43c284c4db00968151e25f92"
        }
      ]
    },
    {
      "bom-ref": "62995564-5ff8-4153-ab02-3d01f26c0abb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_cooling.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bff077fb4f493c917244ae51ad04cc56b758fb89"
        },
        {
          "alg": "SHA-256",
          "content": "548894cd657e6671496c479fd43e4d6aa8cb5e14fa841cae0522fc4379fb8bfa"
        },
        {
          "alg": "MD5",
          "content": "e7c07cee721811a44e55cef99bb8c798"
        }
      ]
    },
    {
      "bom-ref": "62a79987-a91e-405c-86e6-94845eb64ce6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/lib/libdpm.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fe014b871418103e08d237ca581ab6fd6b2a2b0e"
        },
        {
          "alg": "SHA-256",
          "content": "560f26de2bf0ee28d96eec14d24db97bb74f0b7e7f37094907302537cfc390bc"
        },
        {
          "alg": "MD5",
          "content": "4b2901659848407232e7ff0dde8c9e84"
        }
      ]
    },
    {
      "bom-ref": "62ad2eee-7c72-42ff-89ac-83f3416fd210",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/profile",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbe59ecac74c89984165f541fa52b73dc821e786"
        },
        {
          "alg": "SHA-256",
          "content": "aa2020dbfe00fa85bc4acc337b37b6fdffb4239b43c09d9f94d8b461d6099ed7"
        },
        {
          "alg": "MD5",
          "content": "4c7ace6ffef79b7717eafaa93551cbec"
        }
      ]
    },
    {
      "bom-ref": "62d7ae93-4bcf-4a30-b684-965e678e9eb3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/BiosFile.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c73942c55abe25a70e60d78047ffafb9940fba23"
        },
        {
          "alg": "SHA-256",
          "content": "8cb1a6c8db893f8dee765480fc1f701dba7b2b1325973546056b6fb89a7d4132"
        },
        {
          "alg": "MD5",
          "content": "ff7f4bc58554a8b0d1e39e210f0aa010"
        }
      ]
    },
    {
      "bom-ref": "63186a1e-92be-41a6-a808-59fa657c86ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/env",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "631897bc-86f4-4d91-82ec-3fcf06ce8750",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/Discrete_Sensor.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a08fd0737dd7ed665704edebef11ef5e2cec690"
        },
        {
          "alg": "SHA-256",
          "content": "fc2123e6153e3f0ee9be4c3a69d5922cd0ff0cb4431f8335cedd81cdf444d633"
        },
        {
          "alg": "MD5",
          "content": "3729e45ff5a5057e17ea0070bfd65f7e"
        }
      ]
    },
    {
      "bom-ref": "6325a7bd-9b3e-44ba-a1ef-31c2f628ec7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libldap_client.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f95602e959d68dc02da4a9e50bd119c9680ee912"
        },
        {
          "alg": "SHA-256",
          "content": "d2bcc92211f1b821a4de093c7248062e4e0d998ee298594fc1bf3e8427419ea6"
        },
        {
          "alg": "MD5",
          "content": "0a206d17f06971528689c425f322e583"
        }
      ]
    },
    {
      "bom-ref": "632d501e-337a-4984-88fc-8b99c67ee2bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/reformime",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6341c9f8-656d-4b39-aeb9-75c6f021a873",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBasicAuthentication.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90d888803b2a7da3e9ce7fe26d528ba49e250829"
        },
        {
          "alg": "SHA-256",
          "content": "912563dd582d975b6f26b0d7997de9d6237ac7e12a567daf2d04b464e18ef07d"
        },
        {
          "alg": "MD5",
          "content": "51e9e8d91802c3df2a6d29e745f80215"
        }
      ]
    },
    {
      "bom-ref": "63609d94-8fa6-49ec-88f5-b8f2dbfc8610",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/connect_default.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e24899121f5128e6673dc8d4ba95e2a8bb073b68"
        },
        {
          "alg": "SHA-256",
          "content": "44df910e3031447e0c2183b90171918e0f3fa4145deca7bfc3eac8e42fa1ea56"
        },
        {
          "alg": "MD5",
          "content": "81b9bc869971cfb6b3a0d51acec98b2d"
        }
      ]
    },
    {
      "bom-ref": "637812a5-479a-4c56-990f-1e9cca378733",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_20_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5dbbbb6c2c65e15bf47977cc42ee361d49249ddf"
        },
        {
          "alg": "SHA-256",
          "content": "03f66e69d87a3734bb63175d4bc4a0cbed6a1ff2f4f5cdf968fe9c490f81e0b8"
        },
        {
          "alg": "MD5",
          "content": "4677fa720caf045eb2471abd1e6cb3c9"
        }
      ]
    },
    {
      "bom-ref": "639480b6-854f-48b2-9411-8fc7efccaf75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_prefer.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "80a03b67299303555e8fe74e27a390f88ba2a3aa"
        },
        {
          "alg": "SHA-256",
          "content": "94eb46bf54d936755d674393b33fd9dbedfbffa5f23ed5bdf8528773872468cf"
        },
        {
          "alg": "MD5",
          "content": "0eea72523f0ae7722810250216290a0b"
        }
      ]
    },
    {
      "bom-ref": "63a8ad17-448f-431c-bf1b-1895792119bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcNodeManager.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e240c463264c2606372999906feb0ed276faa476"
        },
        {
          "alg": "SHA-256",
          "content": "d3562bb3f7c79a12c1f7842664dd86ecbbe227402a03ee2818563b026635a3fa"
        },
        {
          "alg": "MD5",
          "content": "ea728bd855cbfb6bd4a570f04dce00f2"
        }
      ]
    },
    {
      "bom-ref": "63b4e4c9-7a63-4501-a222-99e57ebb91d0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsysfs.so.2.0.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7acb9e0975bc5c9d23451a82097cf6ba06707781"
        },
        {
          "alg": "SHA-256",
          "content": "861502a695210d94f17c3851a82a1519834a251d112f72f23a32f57a7d2408b8"
        },
        {
          "alg": "MD5",
          "content": "d5eefa4af0589c444d6fd4c934ca0b26"
        }
      ]
    },
    {
      "bom-ref": "63be6d4f-13bc-4a70-9618-d53348db43d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/error-icon.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b1dca870a3c67fc75b364256d47067ea7dd0a8c"
        },
        {
          "alg": "SHA-256",
          "content": "af4e3ed84fa7cd53be43b5d2ff19b2d3365c200b477b373d5396f97add5bb7db"
        },
        {
          "alg": "MD5",
          "content": "09686116567dfd3a6646fe719a6fdfd8"
        }
      ]
    },
    {
      "bom-ref": "63d1a447-4137-4612-a825-47edcc98b9b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/side_next.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e6e6a55a23018abc4673c4e4f0422271bc6a50ca"
        },
        {
          "alg": "SHA-256",
          "content": "5f32ecde435438d1dfa65237e15f3bb6eb0445c6e1c4ad8e71fea2d98ebf888f"
        },
        {
          "alg": "MD5",
          "content": "29cb0d09abba938888feb40ffb2b03fe"
        }
      ]
    },
    {
      "bom-ref": "63d303c2-4f4e-4366-a497-0ee89702912b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/isohandler.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "859a21fdd6541f36da26e64614ca5ea1213b068e"
        },
        {
          "alg": "SHA-256",
          "content": "5b216457602e2cd8701178300333975631169d3ea3cc068a058037306b47967a"
        },
        {
          "alg": "MD5",
          "content": "7749e73ea2ec393c40720b5192fa865c"
        }
      ]
    },
    {
      "bom-ref": "63d7c2fd-c9a1-412e-9c75-720772da641c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamAlert.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2d296d52ec2f4c17d7993993afc2a495ac8d2c08"
        },
        {
          "alg": "SHA-256",
          "content": "42d5466a54f03b30416908f775626658dd0c5964d4112cebf356d0d96e64845a"
        },
        {
          "alg": "MD5",
          "content": "e7057c15794534034c6cf13e06c6bc6e"
        }
      ]
    },
    {
      "bom-ref": "63e603f0-447b-4d1e-a4aa-4904d3f44b9e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstdc++.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49004bc15d6c235b175b6efeabe98d4622753b22"
        },
        {
          "alg": "SHA-256",
          "content": "4a9467ac3a877bd6a36a60f117ce25852b38739ff05137b26912dcc40e0358f8"
        },
        {
          "alg": "MD5",
          "content": "47b6a3c30ddca174e47cd0d9791d3fda"
        }
      ]
    },
    {
      "bom-ref": "63f94d3a-741b-4ed0-84b6-939d9917906b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cal",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "64076eba-8447-4e5d-be70-f0da11af429d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/VirtualMedia.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "92f61d2890bd59dda9f7606f26094e8bb7732dec"
        },
        {
          "alg": "SHA-256",
          "content": "a9e549298f66a8947e342cd9c546e465f2eff966f45231a40226818a43c38993"
        },
        {
          "alg": "MD5",
          "content": "3afe4ed702515b106ac2e101c406dfe6"
        }
      ]
    },
    {
      "bom-ref": "64326591-f16c-4e8b-aabd-e572dd630c2e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/indication.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a53fff7ec4d878d6ac35b3a66bb9d80897619eec"
        },
        {
          "alg": "SHA-256",
          "content": "54493643bbd4e81bbcd4eb23db5b2f22dc6a31d8b74a7bdb54311eb552375736"
        },
        {
          "alg": "MD5",
          "content": "79184245198dccaf7271bdc32f83c4ee"
        }
      ]
    },
    {
      "bom-ref": "647c04a2-8264-4fc0-82c8-5650f48477f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/bmc_trouble_shooting.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3741983d8f84df858e6dec3bc6b731c99f3b1d6e"
        },
        {
          "alg": "SHA-256",
          "content": "cb8d6ccd8daed64a8b62b719b6694bc4fbdfbdb3257c63ffce5bc83b0a453886"
        },
        {
          "alg": "MD5",
          "content": "a37faecb7b49b33e622078a504380267"
        }
      ]
    },
    {
      "bom-ref": "649b45ad-b849-4d7e-ab45-979c16f2df76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_container.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f510a3bb700cd8a500ba7a569f665ee8e02d243"
        },
        {
          "alg": "SHA-256",
          "content": "92d7e1cc9d3f57b95b3284c19df2d56eaa1172fe7c2fe029a4b87472d2687d9b"
        },
        {
          "alg": "MD5",
          "content": "b9413a97161db9ae40bff7f60a051c4f"
        }
      ]
    },
    {
      "bom-ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/loadfont",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "64b8e66e-41d0-4a56-9d97-21d5a5a0d06a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_contract.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66adea2ef92f14748d4d6800243d5a9edaf5ebd2"
        },
        {
          "alg": "SHA-256",
          "content": "30e9570640314eedf4512aed63bbe426fb8edd6673873933a8a2e7a84f301f91"
        },
        {
          "alg": "MD5",
          "content": "afd4be5004dec08528a6356ed33520b4"
        }
      ]
    },
    {
      "bom-ref": "64d5799d-ffef-4242-b348-553a875a3b1a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip6tables-restore",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "64dbf207-8664-4885-9270-098ad1025b13",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_redfish.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8dc8063144c917d048319b72a5a9374616a411f1"
        },
        {
          "alg": "SHA-256",
          "content": "8120e0dc53620fed4348361688deb4b51c59c78cb6c55042842bdc53f39d9934"
        },
        {
          "alg": "MD5",
          "content": "87f78987aa4f4740b3fef180b8a95a9a"
        }
      ]
    },
    {
      "bom-ref": "64dda20f-46be-4e1b-8695-188426679a08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/sensor.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9895b25e92a0966a65613b62b3f16a51dfb5549b"
        },
        {
          "alg": "SHA-256",
          "content": "9cdae620b41e284c5233cf327c12dd67c9af7ff3e337dd2202842fd1da5848b3"
        },
        {
          "alg": "MD5",
          "content": "816de8d6a096c3c73f7fc637c516b500"
        }
      ]
    },
    {
      "bom-ref": "652d7f1c-7c51-41d1-8dd5-143d1c28364c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sol.jnlp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bb8e5775c1f1b6fcd041e6f8127b3486f45a07f"
        },
        {
          "alg": "SHA-256",
          "content": "b3dd27aca3031f955881c982140520f8fc4e93589eb5e8e13333ccf50f8a5ce7"
        },
        {
          "alg": "MD5",
          "content": "1fbaed460eba955d92aebdecb8e03955"
        }
      ]
    },
    {
      "bom-ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha256sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "65353dee-5391-45a3-9dfb-cd5e72784447",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SNMP.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "135cd0de6589851b27192f6562e5b5f7c37de63f"
        },
        {
          "alg": "SHA-256",
          "content": "ef78be949bab5f1c36ed99f8c8a9179593191db0d5136d157fde8c487d5e7eb2"
        },
        {
          "alg": "MD5",
          "content": "dd61123b9909ab9bcefe7a46e5309157"
        }
      ]
    },
    {
      "bom-ref": "653ab36a-638d-4d2a-af0c-c35f086a4a04",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/aspeed-espi-ctrl.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0c26d26eb6ff6b0673af4ff77cdcf7691fd23ca6"
        },
        {
          "alg": "SHA-256",
          "content": "fb789a4f16a6fd5ceed445c0f2017d5c8e63296f2058c4efb79a6e0139a5cde7"
        },
        {
          "alg": "MD5",
          "content": "494ba5719111161b5951269b4ff6bb4e"
        }
      ]
    },
    {
      "bom-ref": "657a1b2e-98a5-4835-a8f7-df50785de852",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/plugins/jqplot.pieRenderer.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2c7e7d66065d28988d1e99a5480ee8a2249d8477"
        },
        {
          "alg": "SHA-256",
          "content": "c3ec2fb10d01054bec762ab2634f563511108a8b480d490245d3dc3fc574f42c"
        },
        {
          "alg": "MD5",
          "content": "6c7e22ebfdaba80eb72eb9a86755c8f6"
        }
      ]
    },
    {
      "bom-ref": "657d7f52-a267-4ad0-b213-0dffecac1e18",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/rom_update.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cee2cc2daa99d79f176721e4a4992bf2c94929c8"
        },
        {
          "alg": "SHA-256",
          "content": "517941a0d4b158ad6432afd29cb6da4bbb61df0e4a4acf16a0999ac4c6e967ed"
        },
        {
          "alg": "MD5",
          "content": "7fde8411da8ed2337c8d362ec9549a8b"
        }
      ]
    },
    {
      "bom-ref": "65aa5bca-8a98-4d91-b3b6-aa51f919d671",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/x11up_cd.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "84bb7f30cde3349aa69f8c8d89f598dddd076bab"
        },
        {
          "alg": "SHA-256",
          "content": "027fc46ea44615c1152c7dfc4b7955ed321f6e9127229cf921d59b83e94631d2"
        },
        {
          "alg": "MD5",
          "content": "c3b864d67dbe169a1cc937ef9f4c2a25"
        }
      ]
    },
    {
      "bom-ref": "65b52ca1-2b49-49eb-9d7e-6f940db877c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/led_off.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a506caacd5f37f2d8f44056c52d2be9590a995a4"
        },
        {
          "alg": "SHA-256",
          "content": "5b922fe1756f6c29882613f650f44de147dde8c968ce4e26f59414d6ba11b1fc"
        },
        {
          "alg": "MD5",
          "content": "5faeea2f52afb17dc66a28cc18b83af8"
        }
      ]
    },
    {
      "bom-ref": "65c1d0c8-f11b-4736-9401-69f25cfa2e8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_SoftwareIdentityProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52ff9c90f6d075f98340b80e2833a272233ce794"
        },
        {
          "alg": "SHA-256",
          "content": "f07e5df88c0195d756213dd8cdd4b254e679b871debe678da5b8ba74d3dfdd41"
        },
        {
          "alg": "MD5",
          "content": "5e8316a714a9aefa5d985d4f36ed026b"
        }
      ]
    },
    {
      "bom-ref": "65c56968-8889-44c8-8edb-93d63b660d7a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_aoc.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c49462dae5a4f840bc6b1029ec044d6ddc1c1c3"
        },
        {
          "alg": "SHA-256",
          "content": "a6ed88748950e791bfae82c4d65753d81103bd0676328c806a9b0ae10d4f6d2e"
        },
        {
          "alg": "MD5",
          "content": "9cd76c694109dab9028a4d097566e78d"
        }
      ]
    },
    {
      "bom-ref": "65f0db1d-1bfc-4bca-aea1-37777e298578",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/udhcpc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6608b864-7b75-415b-8cec-c9e423b9afc5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libseccomp.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4b8f9675b28eee5b9209016202e99521b8dbee63"
        },
        {
          "alg": "SHA-256",
          "content": "c7d486f08fbc0bc83a84c832782046efd36404e79d0ff0fd07ead998fad2e9b7"
        },
        {
          "alg": "MD5",
          "content": "ace8e2060e80f8e16b24ac6603c8d7af"
        }
      ]
    },
    {
      "bom-ref": "663e045b-b93d-4cce-b7ae-f9f3ae65a2f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgs2.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e508a2150d7392b137f75f248109c07208929e47"
        },
        {
          "alg": "SHA-256",
          "content": "ef6e841167f46aca60a20d6162fc0e1bb7e16545cbe45a3368c9218e80883f5f"
        },
        {
          "alg": "MD5",
          "content": "ac8abc1e79d6a6b7a9e8e4aa7df92282"
        }
      ]
    },
    {
      "bom-ref": "665b0e52-b264-4ffb-8636-03dd05c89217",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libipmi.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f390448cbf696872a1375fa553a41f419f75a666"
        },
        {
          "alg": "SHA-256",
          "content": "db7ac0d0a0f5288b9bd6e4f00d163a9a65c446fe4eb11f73fa779b1af1543249"
        },
        {
          "alg": "MD5",
          "content": "7d23ece906718972deefbf747bae1a0f"
        }
      ]
    },
    {
      "bom-ref": "665c9b8f-9634-429a-abcb-53355fee2a26",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SNMPv3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f51309cd2a3413f67a8d685f1ae1737ab31ec1c7"
        },
        {
          "alg": "SHA-256",
          "content": "6cfef5b014592f5ea5960f5e9b5cd0b57e13e213fb8971f1055cd91e14458955"
        },
        {
          "alg": "MD5",
          "content": "811864e8611c9e32f8de3a7a4dfeff67"
        }
      ]
    },
    {
      "bom-ref": "6668e411-8add-4b76-95a5-34e69d7cfd53",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/bootchartd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "66b063cf-7a75-402f-8b42-4581dbddcc34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/init",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "66b4de79-be74-4fc7-b282-ee6b5c0e6692",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libatomic.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48b910a8ccf63d5be6b85d1db031b227fee4bec4"
        },
        {
          "alg": "SHA-256",
          "content": "992bac30241c4cff67f8fcfc7801e9bab1143369da17edb7d88a42e90f8813a8"
        },
        {
          "alg": "MD5",
          "content": "fd500dcbda526b31367f53737dc428f8"
        }
      ]
    },
    {
      "bom-ref": "66c10d4b-2a4b-470a-9b17-7698dd7ea4da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "66c40eae-7ccb-444c-94e7-db8d0760de52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_SoftwareInstallationService.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6367accbee836f57ea4b44362a88793e79d3df56"
        },
        {
          "alg": "SHA-256",
          "content": "56a9486b40fcff62b6371ac348e2fb97b359dc78ce2580210267620cda465356"
        },
        {
          "alg": "MD5",
          "content": "ceb36f738cebf8286e66caf364c2d940"
        }
      ]
    },
    {
      "bom-ref": "66d13dbc-3602-4b2d-bc2a-1c62cd019b0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/bootstrap.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d"
        },
        {
          "alg": "SHA-256",
          "content": "7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b"
        },
        {
          "alg": "MD5",
          "content": "abe91756d18b7cd60871a2f47c1e8192"
        }
      ]
    },
    {
      "bom-ref": "66fe55a7-120f-48f2-944b-34172ad9dc7a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libresolv-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "231d30d0a85822ddc05589530bc5513b07071abb"
        },
        {
          "alg": "SHA-256",
          "content": "8f05150c4c730aa4924b3146e1406e816de4cfd2c10d6fab543047e7806496df"
        },
        {
          "alg": "MD5",
          "content": "e0fa9a1db79ec23054dadd9177899d43"
        }
      ]
    },
    {
      "bom-ref": "6714ce38-099a-4020-b69e-4a774436e7fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ncsi_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c79a0953011c682858ebe81c220c3d73bee07b4c"
        },
        {
          "alg": "SHA-256",
          "content": "326cb530c8a841a06695324202ab4b3b70c4032ba64960585bd3b160e73ae360"
        },
        {
          "alg": "MD5",
          "content": "218ec593ce5b794375aea920a17b8846"
        }
      ]
    },
    {
      "bom-ref": "671a6d88-39c1-4c04-9559-d9f19d376abb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libss.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ece57d671200533225fff4cd9d1ad98a2d4ba33"
        },
        {
          "alg": "SHA-256",
          "content": "b7ecb09c3fa8062f7c369f6ffb84441848f0a553decc7b5cfcf3c3d1eeb58f2a"
        },
        {
          "alg": "MD5",
          "content": "ce411b37a1a14dca95b15b4fae018a19"
        }
      ]
    },
    {
      "bom-ref": "67278b74-b007-4525-ab95-dba8c68bb561",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/bej",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0476a6902f76f71d4c4f92824c93258e53bda531"
        },
        {
          "alg": "SHA-256",
          "content": "6b0ca3daef16e01eaa5a8f9290e5cc1cab3686c4124513b33fbb9ab26f1c8ff9"
        },
        {
          "alg": "MD5",
          "content": "4dcaa2e1d0a931112d1f5328f927343a"
        }
      ]
    },
    {
      "bom-ref": "67489109-5c20-4d0f-9161-faf983ebd7bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/FanMode.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ffbb1be1a0392bd833ab346008667176e03236ff"
        },
        {
          "alg": "SHA-256",
          "content": "41877e933800d3e17d7307cd908f386cea42322edf23f00140990a25dae498e7"
        },
        {
          "alg": "MD5",
          "content": "01ae24763f0a844558d46df1993c8d75"
        }
      ]
    },
    {
      "bom-ref": "67574344-37c7-4672-8436-41028125f7f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/scripts/check_web_conf.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f0f21344a98ee209c73bfa9a5836484e468dd5b9"
        },
        {
          "alg": "SHA-256",
          "content": "029fb2f4d6e1018707c7aa030315a8317050117aceb375cc3d8a02c62a854522"
        },
        {
          "alg": "MD5",
          "content": "c8ad9f510948fac480524a1aa9f0aef5"
        }
      ]
    },
    {
      "bom-ref": "677da80d-0f8e-4363-abf3-0bb67ac24558",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iproute",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6790eaac-c8b4-47b4-a3f6-7d01c05d36ad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcjson.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c5a68db031971bfcbed5ccc90093e7025003ed9"
        },
        {
          "alg": "SHA-256",
          "content": "02f960883b401869eb7c690256ae7849bce7ae91a4e85f1252a9054b3cf7297f"
        },
        {
          "alg": "MD5",
          "content": "c2ab5fb4e45119a52538b1877458f239"
        }
      ]
    },
    {
      "bom-ref": "67a720f1-9711-4427-9a55-c540b256c343",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libotp.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b23a5b832c38984bbc76bdaa1483047f3eab1bdf"
        },
        {
          "alg": "SHA-256",
          "content": "7333c376e846c9199905c87ac6b73d9895165b61b3de6250109e757e67affaf1"
        },
        {
          "alg": "MD5",
          "content": "9233b1234133ddf29bcb35634e47765e"
        }
      ]
    },
    {
      "bom-ref": "67ab3f68-9915-4255-b0f8-d2723a290ba5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/index_sidebar.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b5c8a6ab6183890185ee6e13d5781a66bbb455e"
        },
        {
          "alg": "SHA-256",
          "content": "00b36d1e48e5fe2545aa81521172f57df4955025a1be408c7514365727f4974b"
        },
        {
          "alg": "MD5",
          "content": "5d7faac46ab6c5bf9fefbf950c372fcc"
        }
      ]
    },
    {
      "bom-ref": "67c14469-bac1-4032-b159-610e11bf272e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6f394fb4f7148bbad63a30bea688d78b72d6608"
        },
        {
          "alg": "SHA-256",
          "content": "7525b5e8ca19fdf94e95e2b56b06b7515f9f27fa9f8e6f10a228c5240de2f538"
        },
        {
          "alg": "MD5",
          "content": "60476fd21acf1c13abadc601cd59f973"
        }
      ]
    },
    {
      "bom-ref": "67c4ff6a-2f79-4df8-8a3b-1a1428ef12c6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/MouseMode.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e18582041e5742791d181f526eef8c1c9b18f83"
        },
        {
          "alg": "SHA-256",
          "content": "e0145c8d27114095c70a12989ef7445d2f60f2c6f3abba219530b5f959af1378"
        },
        {
          "alg": "MD5",
          "content": "bcd5c41b574ef436e1b06132fcb9c965"
        }
      ]
    },
    {
      "bom-ref": "67d10056-e5b3-46a1-be6e-d3e0d37f6dbd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/jpegtoavi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6b607e7e1d18e40ec2e07aedfee812b7dae697b8"
        },
        {
          "alg": "SHA-256",
          "content": "f69be34324aa2bee79f8d4c53a638a25de1d9535263a1c7a247b8f8a98524d27"
        },
        {
          "alg": "MD5",
          "content": "f284f5771d4273a35e0b6221b17c9562"
        }
      ]
    },
    {
      "bom-ref": "68264d0a-d3a0-4468-b74e-b300ea141d22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mount",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "682bd4e6-1ad4-4ec1-8e48-a2ce39fb9e49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/bonding.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "016fc756a44734aa3dc3887d4ece6fb36f908fc0"
        },
        {
          "alg": "SHA-256",
          "content": "4d5a6f524b27855a03884143e095aab2fc8ecbe9f0e0fbb1161f36efb0a9dc41"
        },
        {
          "alg": "MD5",
          "content": "0f600d538b942a64922ccbbe2b67ab93"
        }
      ]
    },
    {
      "bom-ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "683d33f2-9753-4356-8f26-651b99d9743a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13DSG_OM_4U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5a57900ec8361497cd38c2cde5ceaff00f4cc95"
        },
        {
          "alg": "SHA-256",
          "content": "1d4c1a254cdb1fc8ab04c753eb4dd13c7ecab3632ae151de3f3c9d13d46867ad"
        },
        {
          "alg": "MD5",
          "content": "6133e6ef71300fb203c8239ef30cdaf6"
        }
      ]
    },
    {
      "bom-ref": "685a48ac-53c7-4a0e-bd12-4725dce721c6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/esc.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ec41e1f5f8fd05d4f0dd234135d8ced934b14829"
        },
        {
          "alg": "SHA-256",
          "content": "cefd98db8dd23d4fd570ad1f578f47f1f365b9efdf70507320aa31574df97dee"
        },
        {
          "alg": "MD5",
          "content": "0fee1b6949237809c963d3ba6cb63946"
        }
      ]
    },
    {
      "bom-ref": "687637ac-4932-41d8-bc2b-c5b0522c3486",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/logout.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "23a1b7133df0f523241dedfb49f238855087faaf"
        },
        {
          "alg": "SHA-256",
          "content": "6be6f4c55be57da7206b4691abc90e444b83002c1b4b2734cfb894d173228341"
        },
        {
          "alg": "MD5",
          "content": "4f773c7f995563f89ff98cd096e20b72"
        }
      ]
    },
    {
      "bom-ref": "68a5bffe-e060-4e54-a4c0-5de011172777",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_nowide.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30cba0b28d4437e608b7746bcc66d9e84e03125c"
        },
        {
          "alg": "SHA-256",
          "content": "cf008dd5b3d3655ec89b0cc179c363f72aa245c3f80a761c9f44e1f6dbf997b1"
        },
        {
          "alg": "MD5",
          "content": "13c59e9fa4cbc5db3d56d1173d84a6fe"
        }
      ]
    },
    {
      "bom-ref": "68b32112-8ad2-474e-bb45-7f7914f3be60",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/mbcpld_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f63839f526e7c6b3649e3887dd5430cfe75c7d56"
        },
        {
          "alg": "SHA-256",
          "content": "f56bd286250199ef5266c969b017efcc1238e8a8cc817d0a126117d81e973c8a"
        },
        {
          "alg": "MD5",
          "content": "ead9557b2e6f9d0b9a90c2c57505d8df"
        }
      ]
    },
    {
      "bom-ref": "68c0a52d-3b19-4657-b2d8-800e40706895",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so.3.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b9564c2e65f78cd86074c1a6fdf224ddc4f7e64"
        },
        {
          "alg": "SHA-256",
          "content": "8bbd61a07cc4f4ed2daabd9af5f18385d46f5721068848f7fde639a92957d275"
        },
        {
          "alg": "MD5",
          "content": "3db2a536cd5aa4c902b101f22df6c3fe"
        }
      ]
    },
    {
      "bom-ref": "68d6fddf-468f-4974-940b-4ba48bd7dcf9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/SOL__V0.5.11.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8918b7b70f70e223415f1067d2122caa8183eaf2"
        },
        {
          "alg": "SHA-256",
          "content": "9377b7f38ae5faefd410ba324d743819b18b2cbf77298f5f1b34610ffe6d4f58"
        },
        {
          "alg": "MD5",
          "content": "663722f102b92e99762605659436aa76"
        }
      ]
    },
    {
      "bom-ref": "c62deee6-9e15-478f-86d6-153a3982407d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_c.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a350dcdda05bbef41cb27772028920feccfd4d61"
        },
        {
          "alg": "SHA-256",
          "content": "c27aa9df9f54330946dd9a06e94a6e454c95f3311386449d498b88cb4230fe9a"
        },
        {
          "alg": "MD5",
          "content": "24be50df6fd0b1fc0e3d4356413065b6"
        }
      ]
    },
    {
      "bom-ref": "68e3d8d2-9e88-4737-a50b-0605a3d67fc2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/lang_kvm.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c2e754885cc7f92e00598c33b77e11b3a3920984"
        },
        {
          "alg": "SHA-256",
          "content": "431c3206cc055af40781df9eab0947111f182d828db871ad69c5254d455168a4"
        },
        {
          "alg": "MD5",
          "content": "df2abf26dcd80f953acbee642f3e797e"
        }
      ]
    },
    {
      "bom-ref": "68f4aef2-eac1-4e2c-a79c-c54b099822e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5d25ef766032d5748891cf0022a1ce2153cdc689"
        },
        {
          "alg": "SHA-256",
          "content": "0f6bfbf8bee2010eeca151c0a35298f9478e83f2fa7ce4ce8eac044a046ca8cc"
        },
        {
          "alg": "MD5",
          "content": "89312452e05b8a1430eb05e90a694d16"
        }
      ]
    },
    {
      "bom-ref": "69278867-7010-47d7-ade2-37798d31b94a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libss.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ece57d671200533225fff4cd9d1ad98a2d4ba33"
        },
        {
          "alg": "SHA-256",
          "content": "b7ecb09c3fa8062f7c369f6ffb84441848f0a553decc7b5cfcf3c3d1eeb58f2a"
        },
        {
          "alg": "MD5",
          "content": "ce411b37a1a14dca95b15b4fae018a19"
        }
      ]
    },
    {
      "bom-ref": "692fe51e-cf05-48f8-835e-d493444aaf1b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/keyboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1a9dd6e15883d8a8518e42d53b6f7f0005ed3576"
        },
        {
          "alg": "SHA-256",
          "content": "c6bfcadce7890e598ade3681e93bb762a9cbc067c1d25eb4f1de5f81fbddc0dd"
        },
        {
          "alg": "MD5",
          "content": "3a9099c89301acbc6be222f975466dad"
        }
      ]
    },
    {
      "bom-ref": "6946cb66-b62a-4abf-8e16-0939b53ae7f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "834cb9b8a24b51b17600537dc5d3d4a3b8286cdf"
        },
        {
          "alg": "SHA-256",
          "content": "961c8fbb66d1a4744ffa5e2b6812ebe0086580a888b80b4fd9d01d6ae81b2686"
        },
        {
          "alg": "MD5",
          "content": "06060d3533b9346353f2e0609a991ec0"
        }
      ]
    },
    {
      "bom-ref": "69974318-715f-4807-ae77-772b4416aa9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/reboot",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "69ad7d07-9053-47fd-9185-669c67e2055a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cttyhack",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "69c3df91-a1ba-4d48-8d2d-cd76b7462b11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/tar",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "69e9d354-0b84-4cd0-96b6-5e66d52a3dda",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fw_update",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "88041acfbbc2c014fed2dc1d3cb43d3bb72f408d"
        },
        {
          "alg": "SHA-256",
          "content": "0243b9d94f41ef3fa9d200b02a1c4c7efa38658d102a4acf7e8fdc02eedb30ea"
        },
        {
          "alg": "MD5",
          "content": "6fae2f2d55fefa154e45b0127ecfa07d"
        }
      ]
    },
    {
      "bom-ref": "69fc3a1f-c964-47a2-8369-2db1d14e4fb5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/x11dp_sys_trouble_shooting.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14faafad34995ce0fc21f0d15f9f8de7626713c3"
        },
        {
          "alg": "SHA-256",
          "content": "35cbc028a3b48537f3eca89ec8f22a40bee8a260896447e23d9a349014d0cdc5"
        },
        {
          "alg": "MD5",
          "content": "95fe564bb35059a1f311aa1efc916172"
        }
      ]
    },
    {
      "bom-ref": "6aa38a78-ffb3-40bc-9c5f-18df3382d502",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_session_timeout.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4e996dd6551372d7daf100bab8d0ca9eb90df2e5"
        },
        {
          "alg": "SHA-256",
          "content": "ad6a4ffc8c5ff50452aa29f9f7f44abdff69a0813eacf623cd7444a40783467c"
        },
        {
          "alg": "MD5",
          "content": "654418556176c9cecfc7feee8836dafa"
        }
      ]
    },
    {
      "bom-ref": "6aa45381-9c30-4e49-b06f-8a56c903237b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_atomic.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e541b78eda09e704aa81839f4fc97a42efa6fc7b"
        },
        {
          "alg": "SHA-256",
          "content": "bd6bb274402121e16cf454472f8989b00151bef23efa776f8df5c7990cbdd5f3"
        },
        {
          "alg": "MD5",
          "content": "eccf56d6d9937268c8842595c3fee1a9"
        }
      ]
    },
    {
      "bom-ref": "6adb20cf-36c8-4ad3-8cd9-153e7be3ff4f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/good.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "63e927f197a3c6f18996e35266ac710ced85378d"
        },
        {
          "alg": "SHA-256",
          "content": "46fe9e49a3fa9775f84af2259b6dbd93949bbe7531ffb1df3129f5bad4ddf2eb"
        },
        {
          "alg": "MD5",
          "content": "61b9da29402f4d78444e6b932c741630"
        }
      ]
    },
    {
      "bom-ref": "6afe4b4a-2453-4f57-a142-766455b8b4f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/jquery-ui.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "694e8340e5d07a02a092487ce92e42e646918cb4"
        },
        {
          "alg": "SHA-256",
          "content": "9a5f949f11e677b37dc4039b2f1a6a8c477b2d2598389300e44d93cfcc1c1baf"
        },
        {
          "alg": "MD5",
          "content": "fecdd295d8df8d061dc36ded0af0a582"
        }
      ]
    },
    {
      "bom-ref": "6b16fbe3-ead3-472b-b74d-78cf2f2088b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/icon_image_dark.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a7c819dd27f53ad7a6bd9d8560c3148c81cbfde6"
        },
        {
          "alg": "SHA-256",
          "content": "56794dd7c805f4a4eaa9e54449a724212ca4265dfff58ce1bf183e2a92553b50"
        },
        {
          "alg": "MD5",
          "content": "21e73ae1643f5bcd1d5af24761241eaa"
        }
      ]
    },
    {
      "bom-ref": "6b1d3d61-0efb-4d2b-8678-e953e3dda258",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/base64",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6b23f7a6-dc17-4da6-89aa-506e5a96e588",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "566689f99ba6d0da54df16b64c8ad76bcf216bb0"
        },
        {
          "alg": "SHA-256",
          "content": "7e61e86ff983724240dfda3345dff1469cb752b8584e34a9c80851bb57463b82"
        },
        {
          "alg": "MD5",
          "content": "3bae1e7b74e511323141fc134af0af65"
        }
      ]
    },
    {
      "bom-ref": "6b4a356e-7a6b-4cab-a8af-66b31c604b46",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/keyboard.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1124ea83677a3d93040f90507fd416e1dc5851a5"
        },
        {
          "alg": "SHA-256",
          "content": "761b161a2e2fdf0cc8d68065cd01e5a8a3f9529e55b5873f6d1608e3942932fe"
        },
        {
          "alg": "MD5",
          "content": "bec30dd3fd2db8dd11382589ec472823"
        }
      ]
    },
    {
      "bom-ref": "6b4a8025-9746-48cd-a8cf-4ba2d6c71f7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6b4f073c-b020-4b59-a808-51f30565a9f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcDriveExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8385712f7e95dcec39fe22eeb7bb55d187666cde"
        },
        {
          "alg": "SHA-256",
          "content": "66d0d21eab6a2e67b81e8b2483a3ea6b1a69f19f35811405bc602cbfcbe43ed1"
        },
        {
          "alg": "MD5",
          "content": "f5be802280396920edb13ba7c4c6da16"
        }
      ]
    },
    {
      "bom-ref": "6b4f7662-3a16-4b2a-936e-58c9341666a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libSFCC_API.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4ea24ea703fa91785076d513cee6cdbca2cc2e0"
        },
        {
          "alg": "SHA-256",
          "content": "816db77d35c5ab7237f62e6809314735ba5a1f1b917090afa3802cb42e6413fe"
        },
        {
          "alg": "MD5",
          "content": "030c88c0a41e6a45128e8b505c999999"
        }
      ]
    },
    {
      "bom-ref": "6b7df4e0-e342-44ab-87a2-075d9c0d9982",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/envdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6b88120e-2dc4-4566-b6d8-41348a0b7daf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/auth_green.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9308ae91c91ca566b5ff527d85f85089be8f61ab"
        },
        {
          "alg": "SHA-256",
          "content": "9ee57dc115986b7c29203bccb53f96b7d2967fe0ce93fcbde9b49fcddda98c8f"
        },
        {
          "alg": "MD5",
          "content": "f63f290de5d190019a6bfaee0d9c8760"
        }
      ]
    },
    {
      "bom-ref": "6b925273-a7a0-4331-a309-1ef4bcc163fe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/vmlib.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "35bc0fac59ec7189542f28a75d6ebfb25487e92b"
        },
        {
          "alg": "SHA-256",
          "content": "86b8a06c8db81a023829956a6084b28c554b148943adaa3428d520f7a6c0a895"
        },
        {
          "alg": "MD5",
          "content": "3237aee3c36af29c71993f75721c2692"
        }
      ]
    },
    {
      "bom-ref": "6bc5ab44-6820-46a0-9946-2beb2389b486",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/uimapout.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4d61038af7d8b42a03983ab35886a87fd889bd5a"
        },
        {
          "alg": "SHA-256",
          "content": "ca19433203520a856bc32c541f1691209117900ecba885726933097c580e9c49"
        },
        {
          "alg": "MD5",
          "content": "b55cef697d4fc5b271df3e667725c906"
        }
      ]
    },
    {
      "bom-ref": "6bdfe3c7-2039-4800-b892-cd6d859fbcfc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/qualifiers.idx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d11c067937dea0b178c687b75283fe02b5063c5c"
        },
        {
          "alg": "SHA-256",
          "content": "aabc45a57706aaec373c5ba91f361f7091e5795b862e643cfa40f8806e445af7"
        },
        {
          "alg": "MD5",
          "content": "9996665a72c7b3a82a0ef5302f884694"
        }
      ]
    },
    {
      "bom-ref": "6bf913e6-692d-4415-9a2a-34f70114062f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/login_incorrect.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3749884422b5b807997a5d860e1b912cde80d73c"
        },
        {
          "alg": "SHA-256",
          "content": "4e6045449ffeb9f90d651add1302809b770c7b88109e92d71aefaebbacae30ed"
        },
        {
          "alg": "MD5",
          "content": "61811fad10bc69ad1712decdcec4482f"
        }
      ]
    },
    {
      "bom-ref": "6bf916b6-675b-4022-90ae-f16604ea62b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamStatus.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f0a3852b3aeeb462dc7927a82485b93e14e4d8e3"
        },
        {
          "alg": "SHA-256",
          "content": "e1a510b1b8f80c5d8bcf0b13b40b2b74c1008e61e3e33ecaa512e570b475c0cf"
        },
        {
          "alg": "MD5",
          "content": "e4a05defbac16e7ddb205282f0492c4b"
        }
      ]
    },
    {
      "bom-ref": "6c1c5999-da15-4017-b4d1-9b2cc1d5296f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SNMP_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b60b86979d675a2b7a91bd2ecb955ea2ddd0967"
        },
        {
          "alg": "SHA-256",
          "content": "d3435f1bd87a8334399b4d8a455e9f73097a87ba46318baf50434e5004c25dca"
        },
        {
          "alg": "MD5",
          "content": "d3a74cafa6b990eb82771ec3b9dbe27b"
        }
      ]
    },
    {
      "bom-ref": "6c1cc9cb-78b6-4261-83cd-5f737674580b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mctp_discovery",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e0fe0dd78c678027e0a327d7836417d2cfb9d0e0"
        },
        {
          "alg": "SHA-256",
          "content": "009d17e9a31132c903a8e0352e05e48ed0821ab4dcdc210da18642cda024250e"
        },
        {
          "alg": "MD5",
          "content": "1118b1ba158aed5bb11c6a16edafff57"
        }
      ]
    },
    {
      "bom-ref": "6c21861b-0801-4837-984e-fcdc2751634d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsysfs.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7acb9e0975bc5c9d23451a82097cf6ba06707781"
        },
        {
          "alg": "SHA-256",
          "content": "861502a695210d94f17c3851a82a1519834a251d112f72f23a32f57a7d2408b8"
        },
        {
          "alg": "MD5",
          "content": "d5eefa4af0589c444d6fd4c934ca0b26"
        }
      ]
    },
    {
      "bom-ref": "6c3c36a8-77c3-4947-a253-d353a80d5107",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_15.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c29f0cfae885cccaf8ab15b8de1552cb1a068baf"
        },
        {
          "alg": "SHA-256",
          "content": "322fd8801682a9df431abd2aa0297319f65240943c5b10f8534ad25ddfce5627"
        },
        {
          "alg": "MD5",
          "content": "3be92f353f3edc478a346f2d684ad675"
        }
      ]
    },
    {
      "bom-ref": "6c5b9333-0ff4-42d8-aa98-38731d5e3479",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypt.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "856c779beac13008d0e69665dcfaea2f47502c1c"
        },
        {
          "alg": "SHA-256",
          "content": "44f1f3a07fa4fb9e5e750f29e0c96fa4b9e907257603f33a7aafaad97edbd9c3"
        },
        {
          "alg": "MD5",
          "content": "bd311838d9a1f9fab7943feb837a31b0"
        }
      ]
    },
    {
      "bom-ref": "6c7a3c80-73bc-4071-9758-9e66bb733ec9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamAlert_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad2c70192591d1c0b21690843d324ea54086c8f5"
        },
        {
          "alg": "SHA-256",
          "content": "078edf37df7fee7a1eae4a74afcc10841b9fc79fa9648a8fa5129307dfc2aa3c"
        },
        {
          "alg": "MD5",
          "content": "ead9a19fee6a0142a57168f1a94bec60"
        }
      ]
    },
    {
      "bom-ref": "6c7f5c8b-2b51-4d29-b238-8589fbf78ec2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnl-3.so.200",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e6a207c7138d771357a991e8d9fbc0a93fefc80"
        },
        {
          "alg": "SHA-256",
          "content": "cc88216cd17a65c6ca6721817f6ac6130ee194eec0d2da45bac902e7eb5f2e04"
        },
        {
          "alg": "MD5",
          "content": "d86be3332539ffe888e994e49ea65c28"
        }
      ]
    },
    {
      "bom-ref": "6c81ff32-875d-4c1f-be45-38b395f6639f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RoleGroup.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ad82af061bc420c7444eb563cfd1a39b9d9601d"
        },
        {
          "alg": "SHA-256",
          "content": "52ff9d7c1d5608eadd37db436c3f7e4b34de576bf413c9d30b6db03580c0ba62"
        },
        {
          "alg": "MD5",
          "content": "a3b7f6268eb3b21c282b7ec7b016d786"
        }
      ]
    },
    {
      "bom-ref": "6c918336-7f93-4063-ae0f-6042419e066d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/preference.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9beaa685f187fe83db8dfbb29a7a9bab6eabb514"
        },
        {
          "alg": "SHA-256",
          "content": "3c484d0296880ac2f061b08b41fa85a7b921e039e712af6a86d861ed4cce518b"
        },
        {
          "alg": "MD5",
          "content": "b70777a820345e0e67708676b9301091"
        }
      ]
    },
    {
      "bom-ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6cbaee28-e2e3-42ce-b18b-34d1ce20cbad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmPolicy.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0001db0e804ecb2b93c12b575df5b8538f73add2"
        },
        {
          "alg": "SHA-256",
          "content": "3ed316a2d5ad7b6f7634989ded90984980bcc074d2ef4d84f191377ab0ffba5a"
        },
        {
          "alg": "MD5",
          "content": "696f6c2f7ee5295d49ee4fcbadf154b2"
        }
      ]
    },
    {
      "bom-ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fatattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6cc0fdbd-c397-4d26-892d-e8066ac6bd75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/dnsd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6d069e2a-840a-4f70-9eb5-a41b5a0a9405",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/chrome-app/tcp-client.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ba9f4c29fd82786336d4cbbca333052703da13b8"
        },
        {
          "alg": "SHA-256",
          "content": "a7706e2784714b407629bbd7cd5c4d53a96489412887f3c3df495368199c8042"
        },
        {
          "alg": "MD5",
          "content": "f1ddb2650e1a1061e37457a430e1bc4a"
        }
      ]
    },
    {
      "bom-ref": "6d0f10b2-3ccf-4c80-87e5-cd71c03737c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3c5d4dadec113b658caa5f86a3af1adc3f66ba99"
        },
        {
          "alg": "SHA-256",
          "content": "53dadbd6dda0f59903c993583117cd8d967d1e7370c8e58f5f26337748249666"
        },
        {
          "alg": "MD5",
          "content": "c87881b3dde41397b81dd7510396d12c"
        }
      ]
    },
    {
      "bom-ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/adjtimex",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6d84b148-22ea-4998-bf1f-c0145175970f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/taskset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6dcfec64-9fd4-4554-b635-ba0f9821975d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/commonUtil.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ebd1f1963d0d766c6ebe85f3a254dcecc61f063"
        },
        {
          "alg": "SHA-256",
          "content": "bce5031cad62edc16fb43755ab4261d278c4593d9471215fc497855cee85681e"
        },
        {
          "alg": "MD5",
          "content": "e33beda2d5f056cca5eed3d3ff654c08"
        }
      ]
    },
    {
      "bom-ref": "6dd7f98f-607a-47b4-b7cf-6e051da88aee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsdbusplus.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "99f3636ad63abeb7c24ee3add86328dd261b04c5"
        },
        {
          "alg": "SHA-256",
          "content": "3d3e729cb8f91041aaa3827a50531afd5f116819c75a604ac9799e0cb9d210d1"
        },
        {
          "alg": "MD5",
          "content": "a1b09526f50bd2dfb0380426d832cc0a"
        }
      ]
    },
    {
      "bom-ref": "6deee1cf-e353-4041-9b90-92ea140fd3cd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.ooxml.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "38393b1a2b57576400d886155748c0d2127750e0"
        },
        {
          "alg": "SHA-256",
          "content": "8003a4369c4dcc82533da48d6ca513e203794d97928facdedb84a69d00aa1091"
        },
        {
          "alg": "MD5",
          "content": "c16f65443e3ec3b75fecbddf3f020508"
        }
      ]
    },
    {
      "bom-ref": "6df5bdda-7c8b-40f1-a0b4-292c2e3a7047",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/dashboard/storage_status.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b86899816807463d54baac6683b9103ff521b4f8"
        },
        {
          "alg": "SHA-256",
          "content": "a55e20efdedabc1badc49f135498be974d42edc7c688f6cc5db286ff5e69f63c"
        },
        {
          "alg": "MD5",
          "content": "694d00c7a59bf26cd9f29052d548b326"
        }
      ]
    },
    {
      "bom-ref": "6e090479-3cd8-4ef3-8022-c4a0f31e6ca4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_16.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3ae010e603e32b265a0eb1284e9df4839d019846"
        },
        {
          "alg": "SHA-256",
          "content": "ba65d56a839ab8d64c4ded2ca52cdde4edda24977825aebafc40cd7e4cf655e7"
        },
        {
          "alg": "MD5",
          "content": "8a85cdfae472032203858c0ad2284a09"
        }
      ]
    },
    {
      "bom-ref": "6e1fcb8d-abfb-46ea-96a8-b09f43f0aacc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/edit_default.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1261a7c6ffdeb535b8844a4d9ecc6ee9b8970a35"
        },
        {
          "alg": "SHA-256",
          "content": "4950dba051b1008f5f2cc81a8563207107637af915e70d9442205963d1064ad8"
        },
        {
          "alg": "MD5",
          "content": "b9772ea9d9ccf9d4e9f558239b1b264e"
        }
      ]
    },
    {
      "bom-ref": "6e3144b1-0f25-45c8-9d23-0ec4262f2d59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/RestoreDefaultByGcc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7edd700b0051f175276ca13368c0befc571dcc33"
        },
        {
          "alg": "SHA-256",
          "content": "9015fe8c51a42f235570b0833fcceb0fc7314c489718a61b42c50c0e46dcbfe1"
        },
        {
          "alg": "MD5",
          "content": "ee7dd75d2c3f4ef9288f25caa00bbb85"
        }
      ]
    },
    {
      "bom-ref": "6e412dde-b806-4043-97c4-e5f7824dde81",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/free",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6e5ab6d9-5abc-417f-b54c-053c147a202e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/FRUBlock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "13ede016c3af65c727f27f79f018f6e6d35829e6"
        },
        {
          "alg": "SHA-256",
          "content": "6ef3cdff2bf867ee9a5fe918b426f6fd54077db8ef9d5229ac4b8e365347a634"
        },
        {
          "alg": "MD5",
          "content": "4a15577e85432fd911ea28057a98a7f8"
        }
      ]
    },
    {
      "bom-ref": "6e6e9027-018a-47fc-9b14-b8da676b61b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DET_B",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1c815f06892291b6ae6371c0bc0292c6ece0501a"
        },
        {
          "alg": "SHA-256",
          "content": "787ad40489e04d0687cd9889f83623718aa43593983326d9d98eea053da1bbc9"
        },
        {
          "alg": "MD5",
          "content": "515d9520e7237a93478961663adcd2a3"
        }
      ]
    },
    {
      "bom-ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/bash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6e71be23-1004-4615-9b0a-abe72d4afed1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/chpst",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6e9ba527-f7d4-45b6-afe3-6e90397e3f9b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13QSH_11FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea30ec291c19c828f51eb8fc09458d227db7941b"
        },
        {
          "alg": "SHA-256",
          "content": "d58d9e71995ef0c839d5490109f734d4b276c50e755701de77e660ffb0365fd0"
        },
        {
          "alg": "MD5",
          "content": "0771071013ceba52a1b63c79c10f01b0"
        }
      ]
    },
    {
      "bom-ref": "6e9bf08c-b65a-489d-8389-9ea336c41fa8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86_64__V1.0.5.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6801a289e8448fd10c1d27de059851570820040d"
        },
        {
          "alg": "SHA-256",
          "content": "04b992b7fe88d90016a075cd500cf9d3d843aef8cf7932299fb533f63e05e5a6"
        },
        {
          "alg": "MD5",
          "content": "bb5c1ad549fda02d03218b8f688cb6d5"
        }
      ]
    },
    {
      "bom-ref": "6ee7b6b5-5fe7-471c-8c5b-13c6c295e71c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DEH_4U10FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "727dd3bf4a459c847be3e1a712fbffc4dda916af"
        },
        {
          "alg": "SHA-256",
          "content": "3353c9a6146da610b4f6656a2dbc84a7f3ce7d1dcff341c300070a0ac5d995c4"
        },
        {
          "alg": "MD5",
          "content": "d0df1c1672e614507d44002c2695007e"
        }
      ]
    },
    {
      "bom-ref": "6ef4a29c-d7e0-47ab-a746-8e2f2c188a12",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_nowide.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30cba0b28d4437e608b7746bcc66d9e84e03125c"
        },
        {
          "alg": "SHA-256",
          "content": "cf008dd5b3d3655ec89b0cc179c363f72aa245c3f80a761c9f44e1f6dbf997b1"
        },
        {
          "alg": "MD5",
          "content": "13c59e9fa4cbc5db3d56d1173d84a6fe"
        }
      ]
    },
    {
      "bom-ref": "6efcd145-4655-44f4-a8a5-55d05ed8be72",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/thermal.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ac7615935aeec8ed21e85f6af58751b5d9dd3798"
        },
        {
          "alg": "SHA-256",
          "content": "09cb014237cd4dca7f1c7db8d19141d734976ea9b326bd9415af94411b7db924"
        },
        {
          "alg": "MD5",
          "content": "c698015d9ed9f04f91dc4ce5a2904288"
        }
      ]
    },
    {
      "bom-ref": "6f2ac99d-3a80-4273-8a9c-de72929a320e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/kbd_mode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6f2f6619-5d6b-45db-828b-b85e01f520e6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSSLCert.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5408c80d8131d2e5fc31eb35b8bf05534051ac0a"
        },
        {
          "alg": "SHA-256",
          "content": "fc09cb124508d7d436019053da1ae4418cba2cd189e57e996dd3468933baf309"
        },
        {
          "alg": "MD5",
          "content": "c667642bb95691603992edd2bc3e9ed3"
        }
      ]
    },
    {
      "bom-ref": "6f457b23-58c4-4a60-8977-c52d5625663c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ipcrm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6f620615-1f89-4b8e-ad0e-c1cc28474756",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/menu_close_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6eecbfb01ea0b4f9c648204409d4249f51c9a50d"
        },
        {
          "alg": "SHA-256",
          "content": "ebb4f71e55f7b6a165736cd24d7045a2b43f3e5b087c0555227aea186e1612f9"
        },
        {
          "alg": "MD5",
          "content": "7a847332c6240cbc9bee5ccf605441b3"
        }
      ]
    },
    {
      "bom-ref": "6f69fb37-2f9c-4c23-b9d9-a46e8f8e4518",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/addgroup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6f6a243c-861a-4daf-a438-9297775dca5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13SSF",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8326a115e4ca96087eec8ce375dc00f96590399"
        },
        {
          "alg": "SHA-256",
          "content": "a4da48ac2222d52440c7c7bf26580907603a24740b32d56632c6ab8b57ae1606"
        },
        {
          "alg": "MD5",
          "content": "21d9f1e133108f317e3e38b71896e1bd"
        }
      ]
    },
    {
      "bom-ref": "6f6f95a4-119b-4314-ab1f-c545b9bdd6d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/initialize.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d6bab048457ca02934a8e01d8c4b89da48616a1"
        },
        {
          "alg": "SHA-256",
          "content": "3865b89c2d95253167293b05b87d9c0c324d46a3c9fb990d01bf0969456c735c"
        },
        {
          "alg": "MD5",
          "content": "7507c0be9057d0bf9a44de5151656350"
        }
      ]
    },
    {
      "bom-ref": "6f714f8c-9701-4e65-896a-ce857e9f4fb7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49c583b19b58f6d2258f8fc01484e622abf976d2"
        },
        {
          "alg": "SHA-256",
          "content": "f370d046c2563bb0e8475e36ac37f48b72425bb2d3d94ad865d2d14adc88faa3"
        },
        {
          "alg": "MD5",
          "content": "67a622b9d738cbd0c7b5804ea5bd4be4"
        }
      ]
    },
    {
      "bom-ref": "6f80511b-f7c9-4690-94eb-9b2a14564123",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dirname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "6f8dcc5d-0d24-41fa-b9f2-85848cf45463",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/ec.key",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d3490a7f374c98b1a63cb03c74611b3dc2d97893"
        },
        {
          "alg": "SHA-256",
          "content": "caa46d481bcc02062f85d98f7a05ae6d63b74ece2dc3f218b9398c84e6518265"
        },
        {
          "alg": "MD5",
          "content": "843af666692835dfb31ff91db8f26d6b"
        }
      ]
    },
    {
      "bom-ref": "6f9b2222-a213-4bd1-b01a-4345b4aefa42",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/GPUDevice.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8453c52a1a5e88ef183cbe2442222c596212471e"
        },
        {
          "alg": "SHA-256",
          "content": "c92ea5cf3551bb1cd8dd5f060a39ad3b797c8b3e24cd91ecc864ca53f7ee1210"
        },
        {
          "alg": "MD5",
          "content": "a4fe98e6f79bd7d04c8f1f18e0b5ab33"
        }
      ]
    },
    {
      "bom-ref": "6fb430dc-ebab-4d15-aee0-3ee7afdc2645",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libiptc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2baf805c793e28600f0d0ebb9e903dd83c98c9a0"
        },
        {
          "alg": "SHA-256",
          "content": "7d439bf191c1a7ad0c18d9ba4906d5d1dc4df8d21811f15ee44df0333a372566"
        },
        {
          "alg": "MD5",
          "content": "341fd6be8b899d63656c014dc0ca9ac4"
        }
      ]
    },
    {
      "bom-ref": "6ff68af7-b295-48db-a1d9-badfb50e0827",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iptables-restore",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "706d8743-143b-479b-9f9a-82deb5653ca3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/lpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "70767c32-6210-4343-8ecc-71a3ca4d2822",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/factory_jbod.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cede69eda8a30c6e36734440e86752c79d0973dc"
        },
        {
          "alg": "SHA-256",
          "content": "c0ba58e5c3ac1ed18be68bedaf616fd5b45297b85c1f65035b3f56c36f843494"
        },
        {
          "alg": "MD5",
          "content": "973a99d637c704e63b8f1c7194542503"
        }
      ]
    },
    {
      "bom-ref": "70a5823d-1b61-4255-8469-efe87266975f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/block_red.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbea1d74b98cedac53909c556e87c81001628411"
        },
        {
          "alg": "SHA-256",
          "content": "8cff6a6b1af161cb968e80cbd86d9f6b62040da6f213a9b882b954d74433c582"
        },
        {
          "alg": "MD5",
          "content": "1be9ef1ec829def4a3b4c0a74a9b3109"
        }
      ]
    },
    {
      "bom-ref": "70ab7054-bfe1-4cb7-8082-759a0996c2c7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ClearLicense.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5b5e98740e531f10efed4cdeaf571cb4fc9cf9a"
        },
        {
          "alg": "SHA-256",
          "content": "0efda0528d7592b3f5ffc1af2b119e5293fe7871303d8c1fa22d5c677b99f2f5"
        },
        {
          "alg": "MD5",
          "content": "0740dbb0d766f95f5c84321ee9d75097"
        }
      ]
    },
    {
      "bom-ref": "70b2d8d1-6338-43a3-9282-ffdfb4ca80a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/droplet.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8007c60d877afb706b9c759a547fa9a5e730fd9"
        },
        {
          "alg": "SHA-256",
          "content": "1ef5814cba982f80c63ae79280460df50f2f499cabee751deb7423056f724b03"
        },
        {
          "alg": "MD5",
          "content": "5c8334c07b16d6858e6950615f3a4b87"
        }
      ]
    },
    {
      "bom-ref": "70b8e719-4bf2-4f85-8a8d-e4f11d7fec25",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/x11dp_cd.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8176a5c36c18bad6515b3025fc1f4da4f2835184"
        },
        {
          "alg": "SHA-256",
          "content": "f79781b31100070be11ef0e11893636db2cb3d1b7a3fed4cbb39e1ea97019e8c"
        },
        {
          "alg": "MD5",
          "content": "bd0555b9b78b8169a170bedb66203dc0"
        }
      ]
    },
    {
      "bom-ref": "70bd8806-7cf7-4faa-8f07-add409f3c218",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/setpriv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "70ebc9b5-bb7f-451c-9075-dcc319442aaf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip4tc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d37ba5aeb35646ffa7efb0718c774ab7ca9903b"
        },
        {
          "alg": "SHA-256",
          "content": "92e7ccf64c5b3bee23c7034202a4d9b0eaca78e2f98b9bebb596f53d892f59bd"
        },
        {
          "alg": "MD5",
          "content": "6d3ab2b03ea9d69453f318bee6b262ad"
        }
      ]
    },
    {
      "bom-ref": "711fb3f6-cdab-442b-a736-7cebe53a6bd7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/setlogcons",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7137f2e4-758e-44ba-bb48-8d09ace22d00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libanl.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6391c9a9e34187de331cef017715fdd70e7ae113"
        },
        {
          "alg": "SHA-256",
          "content": "3906d8dd43c80f8b93ce20bf8607f6ba98c97902ace113dd2593b08db8bc4f74"
        },
        {
          "alg": "MD5",
          "content": "3326856c7732bc373b438ef19761631f"
        }
      ]
    },
    {
      "bom-ref": "713bda82-ec82-4175-87c9-06cd5b49fa24",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifconfig",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "715a724e-a379-4c0a-822d-f05114e30363",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/grep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "715ca7b5-a9db-4897-9001-f7af51e13409",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bc4c50b1d97924276076c0fb45309d2459d14ee4"
        },
        {
          "alg": "SHA-256",
          "content": "c9b167d10983ddfe7d3de154e3ec9977736eb8a343dfe3f492ed538ee754b164"
        },
        {
          "alg": "MD5",
          "content": "c240d9f2858665fe03fe7815dbb0d8da"
        }
      ]
    },
    {
      "bom-ref": "7160937d-149d-41a4-b43d-d735abcdac76",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiodcxx.so.1.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3b559ef12bda17bbe11367997ba030661aeb8a6"
        },
        {
          "alg": "SHA-256",
          "content": "3ae45b870156c88fd6ec59c63df0a75e41586868360e43c0d65efc0614903910"
        },
        {
          "alg": "MD5",
          "content": "b4f9310935b1458a945d70dd017adbb9"
        }
      ]
    },
    {
      "bom-ref": "71709cc4-a543-4970-96af-5483fb59b49d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropServerProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af2ea750468e8bb7017ecb49c8069b250387b4bc"
        },
        {
          "alg": "SHA-256",
          "content": "b36c57073b7a92a867fe9e1b4fc4c52355d414ba0d775af5df852f032766a0a7"
        },
        {
          "alg": "MD5",
          "content": "68df59e96f42071d650f645fdbff92fa"
        }
      ]
    },
    {
      "bom-ref": "7173eb33-9d17-412e-a8c5-8474dcb14b33",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/install",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7188e1ee-05fd-4e19-9230-9ca11a0e9ce0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4464f03754a467d54f983ca9e9a6b97fd976199"
        },
        {
          "alg": "SHA-256",
          "content": "c5ad4fc9556f28179976f3855dd6a86afa96bdc6e0b7668e01bc8397ff621cbb"
        },
        {
          "alg": "MD5",
          "content": "0a41aefbb26bfbdb00b0ff34c450223b"
        }
      ]
    },
    {
      "bom-ref": "718b1f2e-9995-4008-884f-f35cf385e884",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hexedit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "71a79de7-7bb0-40ca-b5f8-5e51736a6ad0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEVR_SP13F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fcaf39206daf32abd8ed4b76aa5660b40ae3c4fa"
        },
        {
          "alg": "SHA-256",
          "content": "7aed0df6136889c211766d632db29929901baa5dd0abe2060e4cc9e01f476627"
        },
        {
          "alg": "MD5",
          "content": "d3145d621e6370b85007f0ad50223d07"
        }
      ]
    },
    {
      "bom-ref": "71e8ba49-be03-47a0-8528-e9bb130cf9fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmThrottlingStatus.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bc0249d1fa46c4ddd7059d55e910dcfbc13f84d2"
        },
        {
          "alg": "SHA-256",
          "content": "b3960e81646b8038c0724e70235d9b7f55082670de465d6bef151c7dbbe214f4"
        },
        {
          "alg": "MD5",
          "content": "869381bd088ab0f3ee95e2b5e14b2de2"
        }
      ]
    },
    {
      "bom-ref": "71ed03f4-859a-4610-ac5b-ed6cd999651c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/wall",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "71f05dcc-70f5-483d-a365-2c3524780ada",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_mouse_mode.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4cba7250236bfd3da0e97230205540f7857348d1"
        },
        {
          "alg": "SHA-256",
          "content": "1d7211d917456ecb9975fb53e00166ad0d425ff76eec9a2df4092bbc31a935ae"
        },
        {
          "alg": "MD5",
          "content": "7ce7b87b13541709fccc072066f14973"
        }
      ]
    },
    {
      "bom-ref": "71f5adf3-9223-40ae-a50c-dd8bc5460dc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderSf.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ebbd3799bcd41911fa0b956b49169f473ce0cf1e"
        },
        {
          "alg": "SHA-256",
          "content": "f2ac326b4b01425c58cffecb4134a9515516cba2010ed2e976a020bf12496471"
        },
        {
          "alg": "MD5",
          "content": "314169122ba78ca7729a739240627c23"
        }
      ]
    },
    {
      "bom-ref": "72074f28-5cdc-4c60-8472-e61afd12911e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_cpu.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e997c01dadb4f341465e3ef7a70fc8986d5c4b46"
        },
        {
          "alg": "SHA-256",
          "content": "96eb1804519e958469d07e6ea4ac339c2fc3576f3d212482ce4872bcb1f2696f"
        },
        {
          "alg": "MD5",
          "content": "7da8fa987558fdaf7e6330e0502804b8"
        }
      ]
    },
    {
      "bom-ref": "722934f9-4490-4bfb-8651-d050a69b7724",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lzma",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "723a4748-234f-4136-b8f6-e36bd8d91f99",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_type_erasure.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb2cf3b1e236bfd3f326e87220196185df60d742"
        },
        {
          "alg": "SHA-256",
          "content": "781cd33e987ec1dcf8f557dad3bf1a1f93f13419d775976c74ecf082619e6e2f"
        },
        {
          "alg": "MD5",
          "content": "d1c868e78a8d81cee15d17279ee7eb83"
        }
      ]
    },
    {
      "bom-ref": "723d77ab-bfc0-4502-a598-84d35dad19cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SupermicroBMCConfig.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8bc4e0a71ca01647d91076ea05677a9e1a0938cd"
        },
        {
          "alg": "SHA-256",
          "content": "65db248c5d97e6a488d26d8fcb8eb09b9a5ee1da8edc42f26cd1fb9e4f385919"
        },
        {
          "alg": "MD5",
          "content": "bd9dc95306975767af61f0bf8920f627"
        }
      ]
    },
    {
      "bom-ref": "7249156b-4688-4597-a547-f987f37bc591",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/url_redirect_logout.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42d80e2665b013b6f32b194c1eed0ce8e29fe909"
        },
        {
          "alg": "SHA-256",
          "content": "feb48fffd2bc581018f5ffd5931aba4f992a9fa996a26af561e33454a90a913d"
        },
        {
          "alg": "MD5",
          "content": "4ad994aa72afe41e4e77862865310147"
        }
      ]
    },
    {
      "bom-ref": "c6493c2c-9350-4577-b092-6af36ee0f1ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/blkdiscard",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7250e7e6-7942-4251-b7e6-574b4449aded",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "812a9528806f674774e0ff25c1b7de66d8e29ad7"
        },
        {
          "alg": "SHA-256",
          "content": "c91361b92575bcdadf7db621707a83e05081999c74f8cd97397c19914072d269"
        },
        {
          "alg": "MD5",
          "content": "3b382c20f163af8f31ef89f5cd1b6339"
        }
      ]
    },
    {
      "bom-ref": "726b6dd5-6bab-4c8f-8908-9a9032a8ee16",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomainCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "007731034c7ac84efc07166fdf1cd20984ad7dd2"
        },
        {
          "alg": "SHA-256",
          "content": "0271a0944c3ef72e53e7c6adb6b9153ed9ce334ed5ce4e3f7af0d7c609e80f7b"
        },
        {
          "alg": "MD5",
          "content": "ddd9cbd56d251461da82239a784cadfb"
        }
      ]
    },
    {
      "bom-ref": "7271e846-3b9e-42a7-ab71-b2275f16c8d1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFanExtensions.v1_5_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a11bb34964ebd40aaf0c7e101260d82b2e1f384"
        },
        {
          "alg": "SHA-256",
          "content": "aee670ed6cb2aad82125772fa235a9f40496dfb1147e1610fa1e2072dac195b4"
        },
        {
          "alg": "MD5",
          "content": "3c101e0706fce3df11cc536b404bcd7b"
        }
      ]
    },
    {
      "bom-ref": "728e48be-e56f-4bad-8972-27c10fa93782",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libutil.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f81b6ad73305817a415df49aafba05fb34220"
        },
        {
          "alg": "SHA-256",
          "content": "6f18e17681d9552f22ba068931da166ad384bac02070bb087d0d9281851b2bc5"
        },
        {
          "alg": "MD5",
          "content": "ac561df85727c0ad73bf2f72359785d9"
        }
      ]
    },
    {
      "bom-ref": "728fac92-dc0f-4bd4-a5bb-27747a2d0948",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mctp-demux-daemon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0049d574341cdf8f01b50564f6b35de013a6752c"
        },
        {
          "alg": "SHA-256",
          "content": "95d9f833eadf96485607b4ff89bfcce379cf582db5b615263252a280cc11e1c6"
        },
        {
          "alg": "MD5",
          "content": "2e391eec2c2a4fba7ba170c415f823b8"
        }
      ]
    },
    {
      "bom-ref": "7292e381-9d6f-405f-8788-7292fb77edb3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/ShowProperty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0e7e003d959afd0a7be3494a2c424e0b1c1247e1"
        },
        {
          "alg": "SHA-256",
          "content": "dad7b2ac18907370c1074534b96c93402cc66fce9629d3ac78834bb849434096"
        },
        {
          "alg": "MD5",
          "content": "edcf2c0c073896b3b7460d31b640a94b"
        }
      ]
    },
    {
      "bom-ref": "72b81246-85a5-40bf-adef-42bcb7d8b008",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lspci",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "72be0d1b-3e12-4675-9032-6b61041c26a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderMem.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57b8c2ff13b620aa6e30613ccff65c4593b1c84d"
        },
        {
          "alg": "SHA-256",
          "content": "e8a328d27275f7987516db4256dc965a24e99e70b41f448d7cdd077676423cea"
        },
        {
          "alg": "MD5",
          "content": "e9c831be3a193556b63c9ae44567b6d2"
        }
      ]
    },
    {
      "bom-ref": "72d2fef2-16a2-4ebc-983c-8a9ffca7d4f1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/test",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "72d9944a-cf83-4f5d-9205-1240e541e84f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/FilterRule.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7be17a634393ae92ceed6faf4943943832d4a34a"
        },
        {
          "alg": "SHA-256",
          "content": "b8f686328c1a5bd955e0541d1e2c32385d4eebbfff507dc9ae49f47eaee41df9"
        },
        {
          "alg": "MD5",
          "content": "6357c7b379fc7f0f9b5e2aaf68dd8e09"
        }
      ]
    },
    {
      "bom-ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hexedit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "72edc313-5a70-4812-8b5f-c809bc108d2b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/setarch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "72ef3631-04e6-49cd-86ef-024205eb57b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libbsd.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98db6640f9107bb5a25c9333c0f7652581a24642"
        },
        {
          "alg": "SHA-256",
          "content": "b9d368c0f7c3befbe4113bd7ecf8d80c2a42288f22467f675f1da2d27ffb485e"
        },
        {
          "alg": "MD5",
          "content": "47934cc3b7257a5bfd1f37d9ef59ee61"
        }
      ]
    },
    {
      "bom-ref": "73150b8f-0edc-4f38-be02-b8dd6476b5ec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "731d05d1-8dd7-4cdf-8859-bb0bd0e7e708",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fstrim",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7320f07d-a600-4c95-81f2-753b353f7b3b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libreadline.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fae65cb41be48fac26d04260ae347cbfb5c63051"
        },
        {
          "alg": "SHA-256",
          "content": "b848d76b290ce6400e5de30a91d47744df9bcb1bb15fbc4f7c73ba744a8afa28"
        },
        {
          "alg": "MD5",
          "content": "5a82c15583df416e04508dc0343f2fe3"
        }
      ]
    },
    {
      "bom-ref": "73240837-973b-45f2-a839-707503c95693",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkfs.minix",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "733176db-8ecb-4088-8522-449591f08155",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_hotplug.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8995ea33d5c651494abb65a0ae42e6ef69015405"
        },
        {
          "alg": "SHA-256",
          "content": "26552685105fde6715c32f34df01f33e136efa78a46bceda41938578f41c3669"
        },
        {
          "alg": "MD5",
          "content": "4508343f46f78c25c6a48adf861d4852"
        }
      ]
    },
    {
      "bom-ref": "73494d7f-a46c-435c-acaa-5250649c27f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/zcip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "735b7497-0eac-4e2c-a9f3-71a745d46acd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_15.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b64cd8054e8e32ff87b969b1c348a66d7ca001b4"
        },
        {
          "alg": "SHA-256",
          "content": "a49335bdefb1db18c5459133350e49600cae83d90c0c1f1c759730196d8a3d39"
        },
        {
          "alg": "MD5",
          "content": "354b443519089b490185be2b71071e6f"
        }
      ]
    },
    {
      "bom-ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7367501c-263c-4afa-8f61-aedb3f1a18bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/webfonts/fa-solid-900.eot",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "340ee70e87850176047733192ea8109dd6380082"
        },
        {
          "alg": "SHA-256",
          "content": "5ef4c7be9577dde004048607cc872221de00db893f29baa809c378b01370a370"
        },
        {
          "alg": "MD5",
          "content": "8e4a6dcc692b3887f9f542cd6894d6d4"
        }
      ]
    },
    {
      "bom-ref": "73b4a226-843b-4c0c-9ef8-3f752ff65c92",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcclient.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97c9839af0e3f24b87bd275ecba935093ee188b0"
        },
        {
          "alg": "SHA-256",
          "content": "682f65552ec84ff84d3cc9667ccfa52712b40b711d4a65937e5c34e3e4b00f76"
        },
        {
          "alg": "MD5",
          "content": "8fac9537ef369e82d113a8c0a0e9a94a"
        }
      ]
    },
    {
      "bom-ref": "73c38dba-8a87-434d-a71a-67c88a86018a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcLogEntryExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7e5a2a3eb6eeab9b7757f2b27f5e61f4c39171e2"
        },
        {
          "alg": "SHA-256",
          "content": "083bec13cca5784aa470d5ae0a278d7d2c917db2fe14f1beecdac00890eeb5fa"
        },
        {
          "alg": "MD5",
          "content": "e9f7d1f41d38696668e4ac3d84f78bd6"
        }
      ]
    },
    {
      "bom-ref": "73d4f2a2-10e6-4f19-a932-337cff8159a2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/sbin/lighttpd-angel",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "29c2d4da6a81cc04bf9232301fcd6e79ec76e3a9"
        },
        {
          "alg": "SHA-256",
          "content": "f32b4d591341dba84c6688d6166074ee865fa2a5669441ef86bb5b15637a88ab"
        },
        {
          "alg": "MD5",
          "content": "24545108b2dd5af1342e6449299d94d8"
        }
      ]
    },
    {
      "bom-ref": "73d9c2f6-f6a8-4d5d-b742-51fe62761b54",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpioinfo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42a3f2cccd550b43766561e8733c08e37d2f307a"
        },
        {
          "alg": "SHA-256",
          "content": "63a7775edba13b62ea5cbbcce7b5a9d8908db64af7990192f19b3e06af00152a"
        },
        {
          "alg": "MD5",
          "content": "4fa5ec3d7f4dfa2abce8934c48a4702c"
        }
      ]
    },
    {
      "bom-ref": "7404ab1d-48de-447f-875f-f65dcfaa1e84",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_url.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a99aac8fa96f2af054bc5197d82d7d80fd2c1c5b"
        },
        {
          "alg": "SHA-256",
          "content": "8b78ca66e41ffede8c4f7acc54d4f07a304d3d64609d18558762d7efdbd40c98"
        },
        {
          "alg": "MD5",
          "content": "154555e8ceb090e5ab49b391e8e35a85"
        }
      ]
    },
    {
      "bom-ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/readahead",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "748aeebc-028e-45f2-9bed-b059abc30e4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c304292cc4c75a8088850079e32fa908428d36c"
        },
        {
          "alg": "SHA-256",
          "content": "ab894b97055fde2b020b519f912df664201ecd43dcb74ad817b311f40536c966"
        },
        {
          "alg": "MD5",
          "content": "256addfdfc913d9457b675ce15537571"
        }
      ]
    },
    {
      "bom-ref": "748de04c-bed6-45c8-9f98-7ff28c0ac510",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/date",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "74930ff4-2ef8-4d2b-961e-af668e06eefb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NTP.v1_0_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8fa0eacc968e25a4abecf708599f6a00fbd74807"
        },
        {
          "alg": "SHA-256",
          "content": "4125dfe910e95f75a04bcb5e594cd3809fe205ead025e4f1a51aaf58cf39316d"
        },
        {
          "alg": "MD5",
          "content": "7823b7400cf927ae2e6d6ae4c858a609"
        }
      ]
    },
    {
      "bom-ref": "749582a9-56dc-4310-abf2-9aa465ac12c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libanonymous.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e87edeff86ecac9c26aa2e69142bd56479ce1746"
        },
        {
          "alg": "SHA-256",
          "content": "065c03eeec61dc3cd382e2f2fc28dafdc973e224a98ff2beff8c2e718c56067e"
        },
        {
          "alg": "MD5",
          "content": "57a46a72ebd132436179f961ced8faec"
        }
      ]
    },
    {
      "bom-ref": "749ffc4c-ebed-4eb7-bc8c-0bbf8c7f4bbb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_TextRedirectionService.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e2e9c5fbe27f34cec59451358e1fb427369e770"
        },
        {
          "alg": "SHA-256",
          "content": "c1b33b3ceeb5f726588873493d4c88c0b7a3ae2b9cf57cb667d94f6596d15029"
        },
        {
          "alg": "MD5",
          "content": "336fbbe34d4123e1bd27bde40dbc0946"
        }
      ]
    },
    {
      "bom-ref": "74a4f998-e194-442c-b9ae-d995bb331a49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logo-edge.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "46200fa94f0f08b9e019822481a18d956cd8412d"
        },
        {
          "alg": "SHA-256",
          "content": "e5c27494da900b24d149938a2f0ecd1bf1073ceebc55b2e8ac7d01135e4e311f"
        },
        {
          "alg": "MD5",
          "content": "b9abb1486d18ecadd353cb0357ebcd79"
        }
      ]
    },
    {
      "bom-ref": "74ae8737-bd0f-45be-9245-4921004291ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/iKVM__V1.69.23.0x0.jar.pack.gz_extract/gzip.uncompressed_extract/4321635-6852634.elf64_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d0e86339b62467ab3b743bada66099f30bd9cc0"
        },
        {
          "alg": "SHA-256",
          "content": "3cd1eead26771b149b9c06aeba43066392f8e75c7c73b8f76f41a1020bccabb9"
        },
        {
          "alg": "MD5",
          "content": "4717d3ca3de4f33dd3a983ab0a95df67"
        }
      ]
    },
    {
      "bom-ref": "74b61aef-638d-4d15-bfd1-d73f55309d41",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/user.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f5a5d10f86698a5117da46a659207f367137a9bc"
        },
        {
          "alg": "SHA-256",
          "content": "6217a5085d68fb16ddda87426282b59dbc5bb8f805936668d2a7d3f56af02f15"
        },
        {
          "alg": "MD5",
          "content": "c39599fd79720262aec237a077d61842"
        }
      ]
    },
    {
      "bom-ref": "74d00dc1-3619-42bd-946f-6f92ff366894",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/load",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f2f24a66aef7c60c86dd2130894f4d9535e9d2d6"
        },
        {
          "alg": "SHA-256",
          "content": "0fa049c84e8382321c45977e460d49e34315c69c3c4e0fb829b81531883da5f2"
        },
        {
          "alg": "MD5",
          "content": "87ffed7483b509eec530c0849e1ed874"
        }
      ]
    },
    {
      "bom-ref": "74d0c359-0d5f-4f2c-a793-ceb103346635",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/menu_open.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ec2ab6b6aedb5874f9f7acbced0afeae2ef7b044"
        },
        {
          "alg": "SHA-256",
          "content": "69a59d428370694e0ff835ce4026c1dbd54ccb5ff20c715dc2745ca67ea5c9cf"
        },
        {
          "alg": "MD5",
          "content": "92211a650575d222705ae1abb96dae35"
        }
      ]
    },
    {
      "bom-ref": "74ed224d-2709-4474-9df8-fa05935447eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/icon_edit.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8a66cdda7aa72003b3bf36e4b4599646dd2fda2"
        },
        {
          "alg": "SHA-256",
          "content": "56ab1f70c41d9337e5f2f72d73a959324edc2fdd09db4602a32bce986ffefde3"
        },
        {
          "alg": "MD5",
          "content": "5cd2d7e8b6688290f3a5e62d42fe7115"
        }
      ]
    },
    {
      "bom-ref": "7520e3fb-35f0-4142-9e14-870f71791614",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/Peci_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f7264ba617acf3a9812a464d7c81bb4208e24cdc"
        },
        {
          "alg": "SHA-256",
          "content": "1b82cd1535a3fdd929522c418ed54647bfdc2db18b298e690f3c785648dcb084"
        },
        {
          "alg": "MD5",
          "content": "c1a155256093f5c07c1d37483dd57b81"
        }
      ]
    },
    {
      "bom-ref": "7525ec03-30ec-4791-b3ac-eab511b6f046",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47eec65ed6508a0ddc92aae8c3c0e509e77b7062"
        },
        {
          "alg": "SHA-256",
          "content": "e8e47b30fb617bb6f08545c4bf19071995e51f39a336d601153bfa2a0f2e09b0"
        },
        {
          "alg": "MD5",
          "content": "6658d0b118c80f5cd6fe9b5606ddedc8"
        }
      ]
    },
    {
      "bom-ref": "7558efc1-8170-4492-b49f-e8a8567b55b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_fw_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d65a2492546b55e61da63d05994f4d050183019e"
        },
        {
          "alg": "SHA-256",
          "content": "d5c3a7987f8376cf3a7ec2b32d2dd0ffc9d26249b758c8778194c84f3270326e"
        },
        {
          "alg": "MD5",
          "content": "d18dc6bb1dfd0b1767076b7b9cea28b5"
        }
      ]
    },
    {
      "bom-ref": "75665cea-3457-4464-a3be-b69b54252d37",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/factory_SMC.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aecb90b414ddc0571130536ee47a70dfbc6f0902"
        },
        {
          "alg": "SHA-256",
          "content": "ab4f758847cf3d91ff54372a43c4f52fcdb157b17ac02fab9406e67267bc4735"
        },
        {
          "alg": "MD5",
          "content": "7d6ece1b6dcd0bc272ed6e89ffbcd83e"
        }
      ]
    },
    {
      "bom-ref": "75700549-472b-4445-80e7-d6f09c6c702c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/playback.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e3c9603b0abd6e6b5bb6b8eaa27d60b37a7c34d0"
        },
        {
          "alg": "SHA-256",
          "content": "ea3699ef4c412b500d632a7ec9a6433c0f28520aa9532c6e0cddacceb7adb63d"
        },
        {
          "alg": "MD5",
          "content": "73f0b9cd9a4348e2fed29ca79f6b50ce"
        }
      ]
    },
    {
      "bom-ref": "757f21f8-7714-40f4-b36b-f47c5020f0fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBT_B",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6d4ce7923ae67b3196489f1d9772115cea37893d"
        },
        {
          "alg": "SHA-256",
          "content": "ad682a9d28bd224beec6eed4410b4babbac79dd19210641940dc7f2cf0e16816"
        },
        {
          "alg": "MD5",
          "content": "110dc947d51d44b6fa04a0bb77193433"
        }
      ]
    },
    {
      "bom-ref": "75b805bd-39fe-4bc2-b26e-ffdd754bae63",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOam_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d566527ebd2363b29bb4e18928b0b9a0dfb8ab87"
        },
        {
          "alg": "SHA-256",
          "content": "e89236d838f4625dd92fcc05d44d1033be5609abcb0ab527c104108f899f68fe"
        },
        {
          "alg": "MD5",
          "content": "3dfdc0252faad970f9eac58cbc2ac07c"
        }
      ]
    },
    {
      "bom-ref": "75e5f093-c8a4-4766-b57d-31428c6ed7a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ntpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "95ae0457f886bb5b0d4560c3ee933b65c7346b90"
        },
        {
          "alg": "SHA-256",
          "content": "293ef5fcbfc21b474405c59d18e2d80b1547db02cbc285eb6b5494fac17fff00"
        },
        {
          "alg": "MD5",
          "content": "113345e7fafb97be4cc060d4c37c84ff"
        }
      ]
    },
    {
      "bom-ref": "75edc4db-62df-4b9f-a390-6ec103d9a4b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IKVM.v1_0_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fb9aa3d4cdbd5790be083c0553cc2c9893b76774"
        },
        {
          "alg": "SHA-256",
          "content": "92e50006d6a72bc5419757ed54485fca526dd73d230422b379703312ad46cc3d"
        },
        {
          "alg": "MD5",
          "content": "cd16fa41524b4791e7e4905c73cfe8b6"
        }
      ]
    },
    {
      "bom-ref": "75f16409-8527-428d-9918-29408fb1919a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SAW_TF",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d53bea32d266d78c3aa9b11b41fe4f767365a53"
        },
        {
          "alg": "SHA-256",
          "content": "853c30084ac6dd79d763e23a335a0d26808cf7674a00e809c5a25cfd7ce0d52b"
        },
        {
          "alg": "MD5",
          "content": "b09588d2ad9945a3d3d4a247de6ca1a1"
        }
      ]
    },
    {
      "bom-ref": "75f899c8-48b5-4957-b81b-2b7b057ebe37",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/ld-linux-armhf.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3636a7eba387bb5e1ccf7ce671e7266831373069"
        },
        {
          "alg": "SHA-256",
          "content": "17ca988d6dfc4686b54da143476d0f13fab9a374bb61883e0172645a4a222369"
        },
        {
          "alg": "MD5",
          "content": "e623f9f83ab0e413b6f79cc08d8d4bba"
        }
      ]
    },
    {
      "bom-ref": "763631ec-96d5-47ac-bc86-f74d67d7b7cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpmibs.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14b28105a7c561c5ec6593fc127e22f19b2cbc23"
        },
        {
          "alg": "SHA-256",
          "content": "bad72adb3f6479c37f034b828db2cc7f2410fd1d5fc5b832dbd03fe308953436"
        },
        {
          "alg": "MD5",
          "content": "b73f4eb676d243bb243cbf8833b0808e"
        }
      ]
    },
    {
      "bom-ref": "766157f8-66ca-41b6-bef7-662eb8273033",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mctp-vdm-util",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ff34062a7924461ebc8f7c4b6f8b37399f78e17a"
        },
        {
          "alg": "SHA-256",
          "content": "a46462443af4472e4bee877ce0836fd7c35e786843f667a1457a5bc7371e9824"
        },
        {
          "alg": "MD5",
          "content": "db800616923aaa8ce43f18cde44fd3a0"
        }
      ]
    },
    {
      "bom-ref": "7678832c-f6a5-45ac-9801-3075d2704364",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tftp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "767f97f4-f75f-49a8-abf7-fc012acb321d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/svc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7b0b9494-61ff-453d-a9fa-b26d509bd661",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcNodeManager_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d260c73d75383473d81113604c01158762141111"
        },
        {
          "alg": "SHA-256",
          "content": "c642e9b3dd13e422024f4f15a62e2ded97c920544a496da345c76ca85ed8635a"
        },
        {
          "alg": "MD5",
          "content": "ad5b667ab66a8d8f9d736a42f29205ac"
        }
      ]
    },
    {
      "bom-ref": "76842095-2cac-4906-9e85-23a9148e7aae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/sfcb_indicationservicecapabilities.idx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "baf20b75b9e2dcfc84be4b5385fd02c6fab6924d"
        },
        {
          "alg": "SHA-256",
          "content": "3a067080e86967f6801a99024e0552467c93eb1dc15a4bf6aa2300bf046a05ca"
        },
        {
          "alg": "MD5",
          "content": "359fe31aabbc54a77e206b0cfc9a317e"
        }
      ]
    },
    {
      "bom-ref": "769b6f86-8fe2-4248-bd3b-78f9da9d2151",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsystemd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f4b015be10d7c3db1fea9d371d135321e54c20e"
        },
        {
          "alg": "SHA-256",
          "content": "58f4e0076e815e9a418585a8d325d549beafbc07d15dd4fa845046ee477e1d4b"
        },
        {
          "alg": "MD5",
          "content": "5199c5203fbbd52dce69c6cca3d6b858"
        }
      ]
    },
    {
      "bom-ref": "76a34960-a904-4940-970d-809027aef021",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_on.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5900515549e91e0cb8dc7cb344aac5d182dde065"
        },
        {
          "alg": "SHA-256",
          "content": "1a9cb9d0b938afca2d3e0f66c52f6e94d42912da00844e671575aaa29b3fb648"
        },
        {
          "alg": "MD5",
          "content": "9dbcbec7ce3a07d2338eccc473a020a4"
        }
      ]
    },
    {
      "bom-ref": "76ad4cf8-86fe-41dc-b7d6-ac6b9925e26a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpcre.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c86814283f02c01beb1e257bbe6879818c6f87ff"
        },
        {
          "alg": "SHA-256",
          "content": "b7d0bd3e139d156347f8dbe6e7edb759fe04a6597f43e136c775f829ce9eb3eb"
        },
        {
          "alg": "MD5",
          "content": "1ca4569cf03e096b920faf07f6ed55dd"
        }
      ]
    },
    {
      "bom-ref": "76b5638f-529b-4c16-bc6b-9613d3547f3c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_14_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "15d50863f2b005cde39ac5520755c707e4949b00"
        },
        {
          "alg": "SHA-256",
          "content": "1f0248b462aaf6bbe88329cc27ed384cfe5667c8da04e82fa86817846d8f81a3"
        },
        {
          "alg": "MD5",
          "content": "8a406c30ad616e03a6baac8cb82c5ebb"
        }
      ]
    },
    {
      "bom-ref": "76bbdbc7-07ec-45d0-92df-031427128200",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sort",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "76be9559-abff-47fa-8c2c-f7c658ce05eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86__V1.0.5.jar.pack.gz_extract/gzip.uncompressed_extract/138818-315874.elf32_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7c303df724838e48a11bda32b957ba86ef31c1b8"
        },
        {
          "alg": "SHA-256",
          "content": "3a7552fc98cc49c596b25ed158d56edf73304de2ba89a186a4c43a0f1f51d953"
        },
        {
          "alg": "MD5",
          "content": "90b2b16f62ec5b6fcff521b772ad466a"
        }
      ]
    },
    {
      "bom-ref": "76c0466b-3235-42f7-af7b-fd898a286c6c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fsfreeze",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "76d3edf8-a301-4109-91c3-318f8cb409fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcLogService.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d85fbe82bef6d56a031369f9bc5d69e4dc5d606"
        },
        {
          "alg": "SHA-256",
          "content": "0bf17cd7fd152850f04b6972493e3e95954e2dd7baf245a1733c124580ec901d"
        },
        {
          "alg": "MD5",
          "content": "37c1508279cafa014ef650ac6719f794"
        }
      ]
    },
    {
      "bom-ref": "76daa96f-881b-4b19-977c-6ed680a82d80",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "55af1ec46cc20e955b9c40b3392ec22f5e28ac69"
        },
        {
          "alg": "SHA-256",
          "content": "145c6d9c62592462c45d4af130107f81a7b4c8bbc64d4412a79ba0d70991bc71"
        },
        {
          "alg": "MD5",
          "content": "40ccf031e8e4c3fe45347147569ab25c"
        }
      ]
    },
    {
      "bom-ref": "76fbd30d-8128-467e-b395-851b01dbad3c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_dns.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d9872e803b22b1532a804c0900dd4ecc773eb9e8"
        },
        {
          "alg": "SHA-256",
          "content": "9705e56719a80b219cd8dafd9cb6168462c06c090c7a79c77cb5c6a041c6c2f1"
        },
        {
          "alg": "MD5",
          "content": "709af7961678199dde2c91f519b53dd0"
        }
      ]
    },
    {
      "bom-ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pwdx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/delgroup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7765909b-bd21-4e07-8171-df0816ab90b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/wc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "77699af7-8b9d-4e77-8b90-eac4c1b3c6eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fgrep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "77754cf7-0df6-4fe9-aee3-af68579d240f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/id",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "777a2d2f-9779-44a9-9213-43eaf0a92358",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "777b43e5-3792-42c1-b526-5f55a410592a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ae2592b27cc9315caf02af5f7d242109e7183b46"
        },
        {
          "alg": "SHA-256",
          "content": "39f147756eed627b3c701c9a6f4ed32549cca71f7237dcec778f202545afde8c"
        },
        {
          "alg": "MD5",
          "content": "2a589409c19cf43ef664cb50b68164d4"
        }
      ]
    },
    {
      "bom-ref": "f2e93d0f-6365-4b87-ad27-9a94dcb9d17d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/lang/dictionary_helppage.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e1f1d905e5cf31fa05d16788ea48cb6b562fe376"
        },
        {
          "alg": "SHA-256",
          "content": "931748d217dec35d60dbb68d9890e49a40b22a059910e4764a3cc1e414c9bea1"
        },
        {
          "alg": "MD5",
          "content": "09ed1e18282735a977069e9ae5b2599c"
        }
      ]
    },
    {
      "bom-ref": "778568c9-9db8-468d-a8cc-3ef27866ec00",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_15_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "312b3df2749a85f328e64036ed84cfdcdc341f2c"
        },
        {
          "alg": "SHA-256",
          "content": "d5ee90a21559e4a283f913cff05d43251d224701541c89777347f1e71ce2628c"
        },
        {
          "alg": "MD5",
          "content": "1469b13fe1ab7460f7961c9db8f2fb30"
        }
      ]
    },
    {
      "bom-ref": "778a7e04-3901-4284-a47d-ee9c059be047",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmphelpers.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49d62cdda243fadbec3137e026ddd2d482ccd737"
        },
        {
          "alg": "SHA-256",
          "content": "c741126818136030140883ea22b587536fd7e14ab72b66561a481afab7a8de1d"
        },
        {
          "alg": "MD5",
          "content": "61b0bca771c41ada0a3c659f0a0851d5"
        }
      ]
    },
    {
      "bom-ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/acpid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "77ed3d7d-04b0-4e54-9dbf-046143413336",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifconfig",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "77f518f4-c28d-425a-a68f-9f7444f2d2a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/buildFS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "281f4b2221d9b785886016a5ee49ed2b556fb48c"
        },
        {
          "alg": "SHA-256",
          "content": "44ce3708a66d62f0c95a205e755f2ee1eafa71325df76be749eb9ace100ddab2"
        },
        {
          "alg": "MD5",
          "content": "53854955de7161de000378d79276ae9b"
        }
      ]
    },
    {
      "bom-ref": "784657f7-2cb1-486a-8ed8-94d33485055f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/hdparm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "785742f2-5dc8-455d-b824-7f41b14dee86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcEventDestinationExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2240213f0b4f44b24fe745633bc173d735adc8be"
        },
        {
          "alg": "SHA-256",
          "content": "9b403b7d74b603c221afa2190c43ab6e44347ca354892b2518634722b64b3978"
        },
        {
          "alg": "MD5",
          "content": "1ee8f3930921802bbd61b7de8de42260"
        }
      ]
    },
    {
      "bom-ref": "786ad8e6-4c4b-42f8-9ac5-5f23d35e8a20",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DEM_4FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5cf49c23dfaaea2faae834ad6b8847968fab053b"
        },
        {
          "alg": "SHA-256",
          "content": "950e20f3e1b94e668c92f7c73ef8d14cafb8563ce8e1d941ce2aaae75b9c08a3"
        },
        {
          "alg": "MD5",
          "content": "9c10f59a4f5bf8d0946d371a48f2c6aa"
        }
      ]
    },
    {
      "bom-ref": "78795279-f94e-4f8e-9d66-c28ba331524d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/mim",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7881be8d-8361-4819-8f7f-2334593e0787",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/g_vm2.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "401758b0f391c11fa3c8245a81fcf2d04418b8f1"
        },
        {
          "alg": "SHA-256",
          "content": "747133d2d91e0452acdb1ac45a8b91cb284116ec4fef62380da40907fdc6ff48"
        },
        {
          "alg": "MD5",
          "content": "0db5b64416ed08c0896378f3ff3c1812"
        }
      ]
    },
    {
      "bom-ref": "78857cd1-42e5-4737-8ee8-e4c4f3ff72c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/tee-supplicant",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05ed3d72aee3ee1d88c0426c38c124cf9df8ad05"
        },
        {
          "alg": "SHA-256",
          "content": "7b6d9456a0aee57a8e159a77105332e4f2e45a142660bb0fcc6d866333b0c30b"
        },
        {
          "alg": "MD5",
          "content": "583fef5e97aedf036be17c0d336fa15f"
        }
      ]
    },
    {
      "bom-ref": "78982085-d50b-404a-91da-31a27bd03084",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/network/network6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "28e1176df4347e82d3c65c28ad0c1a8711140f2a"
        },
        {
          "alg": "SHA-256",
          "content": "6338f34bf397153e99457284bd5d54a124605580a83b3639ae43be9b9d15f947"
        },
        {
          "alg": "MD5",
          "content": "918adee02f47f2ff8052c0c1a934cd6f"
        }
      ]
    },
    {
      "bom-ref": "78a009e7-0ffc-43a8-92b3-1c9775f5111b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/RecordRTC.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "584f9d6870c0f097fb606fa16d9464a8cc51d050"
        },
        {
          "alg": "SHA-256",
          "content": "9beb71dbfae25a224065498c08dc73deaa8ad66583d7eef732b504fac56a7899"
        },
        {
          "alg": "MD5",
          "content": "d3e6422c1b1ed06b37f7da65902e6b8e"
        }
      ]
    },
    {
      "bom-ref": "78cf63b3-8c07-4dbb-8f6d-ee737a401e5c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcProfileProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "926cffd51d7e5144f1cd8ac3da01d4abcfc9ff9c"
        },
        {
          "alg": "SHA-256",
          "content": "ee303fa16fb3389f79f2fc3ba570f72b65456da27217dd8799afb6fef770c997"
        },
        {
          "alg": "MD5",
          "content": "b081776a39cff93f024d51cdfec40731"
        }
      ]
    },
    {
      "bom-ref": "78f103e6-9ad9-4970-af50-c9da7c0f3dae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrashdump.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8177cb8f6e03a13122fcb8642480691874b709c6"
        },
        {
          "alg": "SHA-256",
          "content": "a2afe1856eac18c3de38e028aa90e84afc7b4926901f72c94ede7d675f755f8e"
        },
        {
          "alg": "MD5",
          "content": "9f6235165788a12f388ba16c04275f9f"
        }
      ]
    },
    {
      "bom-ref": "79121aa0-be21-469d-8262-3dba005b66ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/printf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "792cb097-e480-416b-9ae0-e9ff9f392f7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/powerState.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "477a5ddc1a9a544a57e3833fec409d3cdf9eb53c"
        },
        {
          "alg": "SHA-256",
          "content": "f6effab660feab52ad39f48f05a440da9867850d22053864283b488bfeec4a5c"
        },
        {
          "alg": "MD5",
          "content": "8cb2e04c3fae4fa440fe840b730d92bf"
        }
      ]
    },
    {
      "bom-ref": "79433505-999f-4a3d-9376-19fa5590e62d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/libwin_x86__V1.0.5.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "82348deb4d312d7f11f1b11a5003774a5b4f4e11"
        },
        {
          "alg": "SHA-256",
          "content": "7b5c357db6dfc1341a27c78a4fbd8fc50f003691b35fd7e1557e8d1bc30eea69"
        },
        {
          "alg": "MD5",
          "content": "f19f59b6bf4a3a1e008ccffd8bd601fa"
        }
      ]
    },
    {
      "bom-ref": "7943845c-187b-40eb-a881-62a102bfb617",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/FlexiDaemon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3c128dc97a6863447287edc2abb817837e520578"
        },
        {
          "alg": "SHA-256",
          "content": "778b4c8a43cae6fa6e9fe01bc2f40dca605cdd3caa4179e488baaed4032da8c9"
        },
        {
          "alg": "MD5",
          "content": "84756119446079cecba052acdbfdbf14"
        }
      ]
    },
    {
      "bom-ref": "794d6c36-aa4a-44f7-bbc2-2c103b8f3f3e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/overview_info.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d8e8afad1514cbd120fc8a2aa0cbb95dbb2c040"
        },
        {
          "alg": "SHA-256",
          "content": "37b5d31a6e726e4c3220a8d48b7e0ace6ad029e11fce919bf6973f20bd533998"
        },
        {
          "alg": "MD5",
          "content": "00f1405101cf15d2e462ddb515505b0e"
        }
      ]
    },
    {
      "bom-ref": "79536333-e36e-4064-b897-d09a42c95595",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage_powerctrl.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0baa1c719bd258941e2c9ad2b0d94eeebe90c5f4"
        },
        {
          "alg": "SHA-256",
          "content": "e2ce0e2f1cd14514295cac27cd056eb98db30c9ea528a96dd452c08030749a4c"
        },
        {
          "alg": "MD5",
          "content": "64357ee768326e2db8469ab3e12a8d80"
        }
      ]
    },
    {
      "bom-ref": "7967d8a7-1d52-431b-bb5c-26951ba8c263",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cc388ca666077139f3652f5e2f0cbc9614fe0ad9"
        },
        {
          "alg": "SHA-256",
          "content": "de48fee9a13b794e98e913cd541d281d4cc4fb8a9f03afe457d9be864ae77904"
        },
        {
          "alg": "MD5",
          "content": "ec259ef29e8edf73b78c2f5b04c2f58a"
        }
      ]
    },
    {
      "bom-ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nsenter",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "798a8005-eebc-4961-8e40-1c9126d3bb5c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_18_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a2a7c1279c2e70b2b7d1d22877bd36611bc83c74"
        },
        {
          "alg": "SHA-256",
          "content": "4da32fc7dfe82b18a011a2e9ba915f26a497ab50eb1094a6f10c709bf934f95f"
        },
        {
          "alg": "MD5",
          "content": "78a7bda4b65a63fd81eea67c131ae903"
        }
      ]
    },
    {
      "bom-ref": "798ed185-7725-4df3-9d8e-0704218edfeb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/QueryLicense_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "00ef8454eaa038ae34f207c22fda3f3ff17f9900"
        },
        {
          "alg": "SHA-256",
          "content": "41f4741d288d0633e6661bd6ffa19dabdb609dd6e92239568096666945b491a5"
        },
        {
          "alg": "MD5",
          "content": "7669e364cb375ccf6461034c71b05f95"
        }
      ]
    },
    {
      "bom-ref": "799087b6-a64a-4266-a576-ba517ecc96d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/svlogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/kbd_mode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7a0f4267-bc9e-4f9c-9318-bcb2d4c249b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/refresh.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ba79bd959b99e91e7f160daed94586b55b7595e4"
        },
        {
          "alg": "SHA-256",
          "content": "1606626d53a963ce0f9d2c139a5b26fdc0a661e7fac46237a64ce5ed77caad74"
        },
        {
          "alg": "MD5",
          "content": "3c0255468677fec648504df2b9ca002e"
        }
      ]
    },
    {
      "bom-ref": "7a300fc8-11db-4e95-a3e1-b267709caecb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nologin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7a511af0-10c5-452c-818b-6cf47c132a2c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpmibs.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97ee8aa01ab712da5e9f28632dd250af6be47250"
        },
        {
          "alg": "SHA-256",
          "content": "50e8b5ee4077723ed6e207ca68f337ce94f23cd81782005d944b8ecaaab33976"
        },
        {
          "alg": "MD5",
          "content": "3681d36f7f20bf43667ce3d088e31141"
        }
      ]
    },
    {
      "bom-ref": "7a5ff62d-0f74-48e8-a504-2eaba9fd0ae1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcChassisExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb30715c2a59579db5ac34fef7922c6629021fbf"
        },
        {
          "alg": "SHA-256",
          "content": "32c2891879e35fedb47b58dfbf8800018ef907e8f6ae089bd08f7dff12ea4021"
        },
        {
          "alg": "MD5",
          "content": "66c3e036ce5cad190fb4822018413eab"
        }
      ]
    },
    {
      "bom-ref": "7a937250-c3b7-4c40-8824-79ee66d1e72b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "7a9cb339-2780-4c15-897a-087683786c23",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/snmpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3045afa8835270ad8ce40b80f6b5d9e3d52cd32"
        },
        {
          "alg": "SHA-256",
          "content": "ee1a2a09d9f4e8e3a2fbdca39f52bb59de3ad4db483e79a32b7e30115de00ef2"
        },
        {
          "alg": "MD5",
          "content": "7f4e96b7ddaa5d56c6996cd0c793d998"
        }
      ]
    },
    {
      "bom-ref": "7adc10e5-ece8-4acd-b72f-a7604c8a0fde",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/vmedia.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0949a1a329253e7b1fe7cef6081e569f3f2db6c"
        },
        {
          "alg": "SHA-256",
          "content": "6cbb288e99454347600d2e66f78b5b17ffae56e2f3031b6bf1abf9b30e8e58d8"
        },
        {
          "alg": "MD5",
          "content": "761b6a84af44e68381847bc310cd99f7"
        }
      ]
    },
    {
      "bom-ref": "7ade0f69-39fb-49b5-8a90-7ad54ae682cd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ts",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "88bb13ef-0f82-4f66-b77a-13e9240c9189",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SupermicroAccountServiceExtension.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "759c9588d0eaa1bb4be26b191c51ce0d6963685e"
        },
        {
          "alg": "SHA-256",
          "content": "8fa1878ffb6af677ff6cc046ceb1177d4c73d517cb7aaee034bcc107dcc6d39f"
        },
        {
          "alg": "MD5",
          "content": "1b96bc1d497f684a4014d0ae9e9ba188"
        }
      ]
    },
    {
      "bom-ref": "88c11407-4cb3-4ed4-b535-7aad61b81d10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f09e6e5d88e04fd60c00912c4eb3724e991e5f4a"
        },
        {
          "alg": "SHA-256",
          "content": "f8c9195cde4d31ad6cc86ee76f2de62cf6a185d6fcad218fa96f26182c49f4f7"
        },
        {
          "alg": "MD5",
          "content": "3847fa8442c858a75fe7fad9413e0911"
        }
      ]
    },
    {
      "bom-ref": "88d098e5-ca7e-4e5c-8a22-87b1c8fb80ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/webfonts/fa-solid-900.ttf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "40d9789010f6137e543e4d97025b867707d2f425"
        },
        {
          "alg": "SHA-256",
          "content": "20656d1a8f2ea44e36c2b8354d15c4db21909ee5140b0224f74f92477e0899f7"
        },
        {
          "alg": "MD5",
          "content": "0bff33a5fd7ec390235476b4859747a0"
        }
      ]
    },
    {
      "bom-ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pstree",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "88ea2021-44b8-4639-baa6-1c9a786718d3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBasicAuthentication.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90d888803b2a7da3e9ce7fe26d528ba49e250829"
        },
        {
          "alg": "SHA-256",
          "content": "912563dd582d975b6f26b0d7997de9d6237ac7e12a567daf2d04b464e18ef07d"
        },
        {
          "alg": "MD5",
          "content": "51e9e8d91802c3df2a6d29e745f80215"
        }
      ]
    },
    {
      "bom-ref": "f31c7cc9-f861-4a50-b4d7-633cd22da37d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsdbusplus.so.1.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "99f3636ad63abeb7c24ee3add86328dd261b04c5"
        },
        {
          "alg": "SHA-256",
          "content": "3d3e729cb8f91041aaa3827a50531afd5f116819c75a604ac9799e0cb9d210d1"
        },
        {
          "alg": "MD5",
          "content": "a1b09526f50bd2dfb0380426d832cc0a"
        }
      ]
    },
    {
      "bom-ref": "88ed32e0-ea76-4283-ade9-7754094d98f6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/default.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ba186cb07df6156d65752d6e1a9d0f1499bd4a0"
        },
        {
          "alg": "SHA-256",
          "content": "cc68dc7b12c457986c15aa85b88942e6e02188e3e2a230da126e966d7138516f"
        },
        {
          "alg": "MD5",
          "content": "4eebe7e80f9b55296e069aa7920c37d4"
        }
      ]
    },
    {
      "bom-ref": "8925cd87-17ae-46d8-9f6a-1f0d20fb0ec1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f5858531d97f73f45811f9fcc1f4ab6c0311baef"
        },
        {
          "alg": "SHA-256",
          "content": "9bdaad1e04712e0dc466f5af708f36894abaf250e440a3e632c6c3342adee34f"
        },
        {
          "alg": "MD5",
          "content": "a73e50f2001fd5a478d4ccf93c9a1dab"
        }
      ]
    },
    {
      "bom-ref": "8932b81e-4cf8-4eef-a172-4e58fcdc8ad2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/awk",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "893db2ba-219c-4997-9ac1-30e6d0529e71",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamStatus.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fe9afacae37a148a118811aa02dafed9cc9b0796"
        },
        {
          "alg": "SHA-256",
          "content": "1cb92e7355a68d06e045016b9286362703ee6d8621544db92d248576d4f1de8a"
        },
        {
          "alg": "MD5",
          "content": "6907bcf89c9f29f13bda251aa3331377"
        }
      ]
    },
    {
      "bom-ref": "897576d9-4d84-4dc0-86d0-1aa0b309d348",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubirmvol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libbind9-9.18.24.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a27890f7ff29a545342ca1c946422f35601f4b3"
        },
        {
          "alg": "SHA-256",
          "content": "339820d420ece9aa20eefe6e4751685190625661402ae06e818d0134ef9a62c5"
        },
        {
          "alg": "MD5",
          "content": "ebca0323631d8ac2e4b33a15057e5d75"
        }
      ]
    },
    {
      "bom-ref": "89ad77b1-33c5-4dc6-a0db-34ecd951b9ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkdosfs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "89bcbc9a-1471-4d09-99e9-180251156b36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stunnel",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4d02c19fe54d555c90e4f2a07e11b05e1832b2f3"
        },
        {
          "alg": "SHA-256",
          "content": "a2f316efbedce15e16c2715ac75c0d07f70a4d5c9f6810f061d470435ee00e4e"
        },
        {
          "alg": "MD5",
          "content": "245ae952aa7be0b4c65489fddc7c83c8"
        }
      ]
    },
    {
      "bom-ref": "89bda1bc-df89-41d6-89a6-deb0c0164f6c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libotp.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b23a5b832c38984bbc76bdaa1483047f3eab1bdf"
        },
        {
          "alg": "SHA-256",
          "content": "7333c376e846c9199905c87ac6b73d9895165b61b3de6250109e757e67affaf1"
        },
        {
          "alg": "MD5",
          "content": "9233b1234133ddf29bcb35634e47765e"
        }
      ]
    },
    {
      "bom-ref": "89c83aef-b364-4e1d-97d7-8e3742dc8a21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBG_XAP",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eaf5720df044e20eb8f43d59571f58cc0bbb67ae"
        },
        {
          "alg": "SHA-256",
          "content": "9b51c11cc1e05369bceae59a3b04757a2b1c4ad0ca1d84a02dc2116b5d4cb01c"
        },
        {
          "alg": "MD5",
          "content": "17ac930b19e34d86da17193084d46262"
        }
      ]
    },
    {
      "bom-ref": "89d0513c-55c2-4809-ad99-62e59ac2ff64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_capture.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8b5e7b5ff697c8ceb57e021347cd72bfe1298726"
        },
        {
          "alg": "SHA-256",
          "content": "10433f9439159fa619e2f3f273b0cdedd91801eeb5be4e1da1db64cd64d323e0"
        },
        {
          "alg": "MD5",
          "content": "f7d73fdbe9a69811e2b1ff4889f2b2c2"
        }
      ]
    },
    {
      "bom-ref": "89ebca95-37f4-422c-933e-1472692d2d78",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3019e7f0ff40df99c86c87d12efba315ec97cace"
        },
        {
          "alg": "SHA-256",
          "content": "8480d20fcf2b91198e55a4713927e61be4042fba1f9041538927902b41e79076"
        },
        {
          "alg": "MD5",
          "content": "a459a1531a5e727fca55b9ccb1967f31"
        }
      ]
    },
    {
      "bom-ref": "f3280888-e5a2-475d-9285-af91a8df328b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea4e1d8dd5cbd506f07ca5d62dc0e18041f10adc"
        },
        {
          "alg": "SHA-256",
          "content": "75f9bddec8d88a47e3a3db21bb905a6e20597675f556ba2aaa5cb8dd2734d854"
        },
        {
          "alg": "MD5",
          "content": "96136786c2520483647af2725c92d779"
        }
      ]
    },
    {
      "bom-ref": "89f06a82-8aa0-426e-825c-b30b0fd62a66",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/oem_firmware_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d289c8477d965ed20b6646f82404714524c9abc0"
        },
        {
          "alg": "SHA-256",
          "content": "1153db9f840ba5632c3c186a2a91f09744ab5b1267c5960c46efaff133971633"
        },
        {
          "alg": "MD5",
          "content": "642932982e4fdd0b2d03ca25083e8747"
        }
      ]
    },
    {
      "bom-ref": "8a00d1f3-5795-4b06-8dbb-4cafc298c5ec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/killall5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8a5fc2d6-3172-4fe4-bbb4-42bb02d756d1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/coreui.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e64b59fea813167a6dbb6aedb2dee58c36513abf"
        },
        {
          "alg": "SHA-256",
          "content": "2365d65fd1898be590c5560bb588f0002d321ff4393589bcde48ca4f43ee27a8"
        },
        {
          "alg": "MD5",
          "content": "50713ab67219fda975b5f3eb27fe42df"
        }
      ]
    },
    {
      "bom-ref": "8a7914fc-818d-472e-88be-f1e075b464af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/microcom",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8a85326e-0fa5-406e-9780-e247b6da047f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSensorExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e7bba386010f1eba2974c753aaf86fb5812d4e51"
        },
        {
          "alg": "SHA-256",
          "content": "21cd897895de90895c4ad97a69086fc6d8adfaf2bd6b0738e0a975917cdef527"
        },
        {
          "alg": "MD5",
          "content": "8d728228857b1b1dcbfda0b046f6fafb"
        }
      ]
    },
    {
      "bom-ref": "8a89a776-55bb-4fe7-b120-fa74c2b8a787",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssrpc.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0a6a213bf8792d422cb5cc595f84f6382b79caf"
        },
        {
          "alg": "SHA-256",
          "content": "ae155407a2acb36182c2e4e1ba9edb2ca90a1c28b058f85f58274827132b4426"
        },
        {
          "alg": "MD5",
          "content": "9539707b9fc975731157e4979335f9ec"
        }
      ]
    },
    {
      "bom-ref": "8a960441-88ce-4907-a87d-fd58183a7806",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_task.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0dceb91d5dc51cdddbd9afde412f89f6099e112"
        },
        {
          "alg": "SHA-256",
          "content": "4781cd2bebda980dcac21bdcddf3c0f079232ca6c28d6bc7645b90ec47929e00"
        },
        {
          "alg": "MD5",
          "content": "dfbe9010ca6b733b07a43f9556120150"
        }
      ]
    },
    {
      "bom-ref": "8ac3a760-a251-4b2d-b0b0-d0ebad6b0697",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcHttpAdapter.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16f0f7ddeb0d3565eb00ba9f7c78a16b909d8f2e"
        },
        {
          "alg": "SHA-256",
          "content": "b419d08ef6de4c00780de544d283e3f0935547529643fb24b153e082e52ace06"
        },
        {
          "alg": "MD5",
          "content": "8bc2a1bb518674242859c6078ce6e545"
        }
      ]
    },
    {
      "bom-ref": "8ac9c30b-5cc9-41ff-9202-d95d97a6600a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/side_prev.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8023a97bff6d9ceca20b26479dc397a58cf1fd5b"
        },
        {
          "alg": "SHA-256",
          "content": "accc71943f21744fe4ecdbe6fca177268042117655d268d57aa389aecbc758f2"
        },
        {
          "alg": "MD5",
          "content": "e54e57d280f09f1e8ecef7a641c0f8b3"
        }
      ]
    },
    {
      "bom-ref": "8ad71adc-1269-4f16-8882-81a5d15e9e2a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_container.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f510a3bb700cd8a500ba7a569f665ee8e02d243"
        },
        {
          "alg": "SHA-256",
          "content": "92d7e1cc9d3f57b95b3284c19df2d56eaa1172fe7c2fe029a4b87472d2687d9b"
        },
        {
          "alg": "MD5",
          "content": "b9413a97161db9ae40bff7f60a051c4f"
        }
      ]
    },
    {
      "bom-ref": "8ada50a8-cb0f-4b11-82bf-c2abae87050c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/start",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "220419d5dc3af3cc6099f968e71e830993b696c8"
        },
        {
          "alg": "SHA-256",
          "content": "75b5703389bb2f4794490452face3f29067a9a1e39cb420cf4eead61b60b1e63"
        },
        {
          "alg": "MD5",
          "content": "c5f74e345d0598862fc5bd21e88d1ab7"
        }
      ]
    },
    {
      "bom-ref": "8adc69ef-f187-4e69-be77-2f25afab6240",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed_extract/10017492-10936204.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "570c0656199cd29b9c8ea56c0378899846c45e3d"
        },
        {
          "alg": "SHA-256",
          "content": "5274d52339c8f1968eb5ce291cf2ce961aa971ee0e3d6befdf02b5df50b92913"
        },
        {
          "alg": "MD5",
          "content": "b42eb64aef4dacc477fbaceaed8df424"
        }
      ]
    },
    {
      "bom-ref": "8ae1826b-8292-468f-b5ae-373d082ca905",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b98d7f5988879137d4fa681537cbcf240486147"
        },
        {
          "alg": "SHA-256",
          "content": "3dc547b29ac7b32db1471dcfd9df25a45dc388efb92db42bde6539692ee570a2"
        },
        {
          "alg": "MD5",
          "content": "daa83fac91811c3ad2a313c1b0fed309"
        }
      ]
    },
    {
      "bom-ref": "8afb8814-2b7c-429b-82e8-e77eb8dde0bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/librt.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b728c38d3e6d36827c4da6eb4f6b087c8aa865d0"
        },
        {
          "alg": "SHA-256",
          "content": "dd1abbbaeeed4e8f3b08fda7769e8547eb955a0f1b70d71449af81c6b2451479"
        },
        {
          "alg": "MD5",
          "content": "a54420a8a2aa3bd497cabf575ae1a2d3"
        }
      ]
    },
    {
      "bom-ref": "8b3668bf-d080-495b-aba8-4ed777531385",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/worker.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "afce4a312e6582e678e445e171b2fac306ab7408"
        },
        {
          "alg": "SHA-256",
          "content": "dce8904ff55a18576f59ec3c1ebd2384263e1f73f2a83eeeb1ce09cccf1618e0"
        },
        {
          "alg": "MD5",
          "content": "beb55b2566711a6b8293a22e3d7ddb48"
        }
      ]
    },
    {
      "bom-ref": "8b4654a6-1c0b-4aae-9617-121bb7e32501",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip4tc.so.0.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d37ba5aeb35646ffa7efb0718c774ab7ca9903b"
        },
        {
          "alg": "SHA-256",
          "content": "92e7ccf64c5b3bee23c7034202a4d9b0eaca78e2f98b9bebb596f53d892f59bd"
        },
        {
          "alg": "MD5",
          "content": "6d3ab2b03ea9d69453f318bee6b262ad"
        }
      ]
    },
    {
      "bom-ref": "8b5356bb-ed4f-46c1-a490-1b8daeeb7525",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lsscsi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8b705ae5-a34b-471c-945f-f271ea68e517",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8b765769-8ac8-4712-8556-3b8c9f479dce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamCtemp.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "78324430830440af70a90b1d9f180d1a2835a09f"
        },
        {
          "alg": "SHA-256",
          "content": "e75239d578194008c397d774d3f217f375abb5c52b17e054bde96b038ebb901e"
        },
        {
          "alg": "MD5",
          "content": "84cadfbb607681e9a74e4f04d97ba16f"
        }
      ]
    },
    {
      "bom-ref": "8b82a092-f57d-4d30-81bf-8a8697d14347",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NTP_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ad6a8c2bfd6df54953d43513891eba840fdadee"
        },
        {
          "alg": "SHA-256",
          "content": "3dd5882ca83c6f0550352d7d662bcaa5f628ee14ea1522d63b39b61e566eaca2"
        },
        {
          "alg": "MD5",
          "content": "8fd562353ec52225ad23c3ae1f1e707e"
        }
      ]
    },
    {
      "bom-ref": "8ba0622d-16ae-40be-9f7b-1e2ed64eba6e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9f16dc64b9e619e681d7078a4a03674373d8a72b"
        },
        {
          "alg": "SHA-256",
          "content": "60bd65e06c1758df50ac0c175ada409d5c1e844910c997916c72602071160b06"
        },
        {
          "alg": "MD5",
          "content": "5f6559792fb6c0ed9ddf96b75be1edff"
        }
      ]
    },
    {
      "bom-ref": "8bb3c5a5-f027-4ca5-a82f-6b6d5524d0e4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/usb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ddd8afa62136b7de03d5901321b1270eec2557f"
        },
        {
          "alg": "SHA-256",
          "content": "e593d5af23edf77e7fe2c934d9dbf80f9559e48e7a73e97f65cf08c6b7a7f71f"
        },
        {
          "alg": "MD5",
          "content": "068f2a7c92c634416506c9beca22c4a3"
        }
      ]
    },
    {
      "bom-ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/wget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8bcc3bc4-05d3-43d2-a960-e9b88a2158f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mac_tx_rx_delay_tool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf0469b3e88f0d0db710e1366b7870d6e6eac0b8"
        },
        {
          "alg": "SHA-256",
          "content": "56098c2c6c69d4bbe6668d5e9d90aeed7a74ab25167fcb0184846614f426d65e"
        },
        {
          "alg": "MD5",
          "content": "bfbcad9f97ae48ae384c44e53bb3fa7d"
        }
      ]
    },
    {
      "bom-ref": "8bf798e6-05e4-4143-a469-80ef18a9b512",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libss.so.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ece57d671200533225fff4cd9d1ad98a2d4ba33"
        },
        {
          "alg": "SHA-256",
          "content": "b7ecb09c3fa8062f7c369f6ffb84441848f0a553decc7b5cfcf3c3d1eeb58f2a"
        },
        {
          "alg": "MD5",
          "content": "ce411b37a1a14dca95b15b4fae018a19"
        }
      ]
    },
    {
      "bom-ref": "8bfc3d2a-187c-4478-90a5-6fc6db51ec6b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/interop/10_interop.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5cebaa5ef0ec1e75c0950fc561fb4aad1fdf82b4"
        },
        {
          "alg": "SHA-256",
          "content": "7e4dfb555afb3320157d74314b2ecae88d05b97f6b89bb5b138d903be92564a1"
        },
        {
          "alg": "MD5",
          "content": "423a91a8a1bd3ea1e1444a29c1c29c25"
        }
      ]
    },
    {
      "bom-ref": "8bfd2f09-bcab-4f7c-9d9d-5aea4eab8e57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/which",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8c2109cf-14e0-4692-874d-9243f1d03ef6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libutil.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "625f81b6ad73305817a415df49aafba05fb34220"
        },
        {
          "alg": "SHA-256",
          "content": "6f18e17681d9552f22ba068931da166ad384bac02070bb087d0d9281851b2bc5"
        },
        {
          "alg": "MD5",
          "content": "ac561df85727c0ad73bf2f72359785d9"
        }
      ]
    },
    {
      "bom-ref": "8c2993a8-a1dd-436d-938f-1d16c9b370df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblzma.so.5.2.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4dc8dba884067a1e8fdf225f25b5b2bb6a544ccf"
        },
        {
          "alg": "SHA-256",
          "content": "15b09e5d742bc26e0775a967d5e7c8a63f2eb10277b0aa47b71f3419b39ff194"
        },
        {
          "alg": "MD5",
          "content": "17dbddcefed76da372ae5836e60bdee5"
        }
      ]
    },
    {
      "bom-ref": "8c5824c7-4645-47b5-9e67-70e1caaef639",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/fullScreen.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6d6768e4e8cba29ef6ceb89ef64e35d76f113846"
        },
        {
          "alg": "SHA-256",
          "content": "dbc4c2f74cf920c391798c624e2a7c7fc358a8703642d5443bf5046082140735"
        },
        {
          "alg": "MD5",
          "content": "d577c5424f73cfdeaa7c0e64f5ceeb44"
        }
      ]
    },
    {
      "bom-ref": "8c68e1a2-7655-4d81-bbba-997b0e67f447",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/screen_57x57.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "25eefa383090a65ec08fbd6d2589002d0342ad17"
        },
        {
          "alg": "SHA-256",
          "content": "a45c2dea8663a85a20ed312ca2c3a061750f70acb7b73581c6518e770866e7fe"
        },
        {
          "alg": "MD5",
          "content": "2a2d3d4c9dae9b9303d86dae5f9a82c7"
        }
      ]
    },
    {
      "bom-ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/devmem",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8c822de6-7fa7-4d75-b864-de0455b8a94f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgssapiv2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c541b111d357841919d2d1bd64336b57303a24f6"
        },
        {
          "alg": "SHA-256",
          "content": "7a362fe229fb410f24aea2b1bdc86276e036258f2fe8ceead61179d71cd54d49"
        },
        {
          "alg": "MD5",
          "content": "f7d2d1f089e9a4353f9dd66b825731d9"
        }
      ]
    },
    {
      "bom-ref": "8c909917-0e5b-45c4-b27d-b12d6b595c22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_program_options.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "95eb2c73ec63f85427cbfb43b0c876a028f452d9"
        },
        {
          "alg": "SHA-256",
          "content": "4297dd39f11cd596e39e33c6ae2531eb6444a1ee6ce3b098896f57f5fdc2d947"
        },
        {
          "alg": "MD5",
          "content": "241de24c28c0f9752e14c12a5a7f55b5"
        }
      ]
    },
    {
      "bom-ref": "8ca30144-2c20-498c-ae8f-4308fc2f5edd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ce6285a9678d4ddf6771d8e9d8c1741f87dde539"
        },
        {
          "alg": "SHA-256",
          "content": "e06d1aec3ec591639c90c462303379b02105a24f1fe9341be0d4fb16789938d9"
        },
        {
          "alg": "MD5",
          "content": "50f9e4e9ee0c18beea463747bead63ac"
        }
      ]
    },
    {
      "bom-ref": "8ca7eb3e-3b7d-4dc1-82d7-1ed0b4204856",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamTemp.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dfa1126f82d9e2c8360b6e7d4b0ab9f98bae6959"
        },
        {
          "alg": "SHA-256",
          "content": "7cf58d9c862cd456db8cc9359c93180fc3336a3d20a2cc3cc9286a8847da12b1"
        },
        {
          "alg": "MD5",
          "content": "c7692e84615ae8cadb5b10d6c25aa6c0"
        }
      ]
    },
    {
      "bom-ref": "8caf4336-a54e-4907-957d-d87f6b1766b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_SoftwareInstallationServiceProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72fb724a52804e447a3fd2027683fd71d2c999bf"
        },
        {
          "alg": "SHA-256",
          "content": "970771402f4c190961a47590b7dbefe93e11ec49a5b05f11102c3ff7a72dae29"
        },
        {
          "alg": "MD5",
          "content": "29229359f388145246338c31f2ccd4ef"
        }
      ]
    },
    {
      "bom-ref": "8cb7b82a-e14f-4359-b679-64e98f1b8f8d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcDriveExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "461f38dd5155c6397aa8562bcb48a50aa79e34a4"
        },
        {
          "alg": "SHA-256",
          "content": "94e565ce287d6e32cc75d384478a4da66b1d4ba2436e5385dca8470dbd192d1b"
        },
        {
          "alg": "MD5",
          "content": "08dd4b611da73c2677b3ad407a66c865"
        }
      ]
    },
    {
      "bom-ref": "8cc1b16f-6ef1-4f56-b191-47889f2e7419",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/33host_interface.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1b616793df709be5d9613044eb89c176be69b6a7"
        },
        {
          "alg": "SHA-256",
          "content": "6cacd76dd08486d938c27bb79d3e7c3ff3ff1929b809fd691e27f3209b92b431"
        },
        {
          "alg": "MD5",
          "content": "dc1037380d3331373398ce17c593376b"
        }
      ]
    },
    {
      "bom-ref": "8cc970cf-871b-4818-a50e-2281b7cd8eca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcTaskExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d1b8341bc42c89c57bfdf9f140783972cca3c35c"
        },
        {
          "alg": "SHA-256",
          "content": "d6c8fd970853a8e320ffd2e3af7abb35a013e2654430fee5d07ecfa66ffb57fa"
        },
        {
          "alg": "MD5",
          "content": "9c022bb7f3a3090a02f7b6dfe520f8ef"
        }
      ]
    },
    {
      "bom-ref": "8ce1848d-6456-43b7-b9d9-9a4047d170a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcDriveExtensions.v1_0_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "78b3615f8c4e655567d8c9a2b0d31e7e26d3570e"
        },
        {
          "alg": "SHA-256",
          "content": "dc4d78f6b3779e34e4066b2dc1d2aeea5b7668b697e4cefe8da1aa17b3903c52"
        },
        {
          "alg": "MD5",
          "content": "f583233b7b6c35b0426eb4f5f666ca9d"
        }
      ]
    },
    {
      "bom-ref": "8ce3ee34-6bfb-40bc-9a7b-b4aa831c161e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bee7eb53262b9d07949ddf4d0f49e39d087a5221"
        },
        {
          "alg": "SHA-256",
          "content": "2c33dad8f2565283b0a4dd76ff3d97037e40d503d7b6bad0842e8af3f2056617"
        },
        {
          "alg": "MD5",
          "content": "0c59b658d4a303add9e8f91a26cab26c"
        }
      ]
    },
    {
      "bom-ref": "8ce8d94c-59b4-4c46-9d14-035ee49a1009",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/openvt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8ced118c-c19b-43a0-b8cd-1047fdf94e52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgs2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e508a2150d7392b137f75f248109c07208929e47"
        },
        {
          "alg": "SHA-256",
          "content": "ef6e841167f46aca60a20d6162fc0e1bb7e16545cbe45a3368c9218e80883f5f"
        },
        {
          "alg": "MD5",
          "content": "ac8abc1e79d6a6b7a9e8e4aa7df92282"
        }
      ]
    },
    {
      "bom-ref": "8cf2cb62-c78a-45a4-af0a-0a406942eefc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBHM",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f2ea602df93752dbe45abeba6405ea0bd6f65fcf"
        },
        {
          "alg": "SHA-256",
          "content": "4a3041d0bf39cdbc75bd587321965d79ad392f30d6af58d98cc315965f7a4941"
        },
        {
          "alg": "MD5",
          "content": "1229530e2dd46060305367a0201ec8db"
        }
      ]
    },
    {
      "bom-ref": "8d168d2f-5958-4098-b3c8-3e3476741bcc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsystemd.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f4b015be10d7c3db1fea9d371d135321e54c20e"
        },
        {
          "alg": "SHA-256",
          "content": "58f4e0076e815e9a418585a8d325d549beafbc07d15dd4fa845046ee477e1d4b"
        },
        {
          "alg": "MD5",
          "content": "5199c5203fbbd52dce69c6cca3d6b858"
        }
      ]
    },
    {
      "bom-ref": "8d385bb0-6f77-4806-9876-ef8ad346fd94",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86ed64d0829e3c86af6bcc19bca10419618cf046"
        },
        {
          "alg": "SHA-256",
          "content": "f283c1acd9a237ecbfeac228c035e18b47eaf171a0655c74d3b06102332f799c"
        },
        {
          "alg": "MD5",
          "content": "10d02142393483bff965c2d2f63e0b51"
        }
      ]
    },
    {
      "bom-ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/passwd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8d3f2bdf-4d12-4e0d-82fb-09d928ea8e64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libncurses.so.5.9",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "71a2659eeca7bd4b288c126d1bc0155bae885a48"
        },
        {
          "alg": "SHA-256",
          "content": "65779b09e017c10c0b45e9626781c5cf7a79cbd55934ec3987354e0d0cf9b7da"
        },
        {
          "alg": "MD5",
          "content": "8381fa455fe7ce6260a2a878a8a343f8"
        }
      ]
    },
    {
      "bom-ref": "8d4fd786-8726-418f-bc76-5af2f6bf1f27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcClientXML.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d8ad38f778259f9b926210f752e6d64bc567971"
        },
        {
          "alg": "SHA-256",
          "content": "5c45ae6f06e8404983f059da2d7066a4a940f58b47c2b441bbc2b5dcc4444806"
        },
        {
          "alg": "MD5",
          "content": "78a89895bc64aff235f1c709d2b686ef"
        }
      ]
    },
    {
      "bom-ref": "8d5354a5-f76c-4cf6-b628-0cbba2bf1a10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypt.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "856c779beac13008d0e69665dcfaea2f47502c1c"
        },
        {
          "alg": "SHA-256",
          "content": "44f1f3a07fa4fb9e5e750f29e0c96fa4b9e907257603f33a7aafaad97edbd9c3"
        },
        {
          "alg": "MD5",
          "content": "bd311838d9a1f9fab7943feb837a31b0"
        }
      ]
    },
    {
      "bom-ref": "8d57d6d3-bf44-4055-bad4-e7429bb39dfe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_16.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83d4032e4b68db443b11dbfc00cf2c7ca38f9401"
        },
        {
          "alg": "SHA-256",
          "content": "2a3df876505fcd06446679cd69f8ba4a994ce01f8ab01343bf268965773b2ee8"
        },
        {
          "alg": "MD5",
          "content": "39f7797eb036810d4b4051e5afcb84f7"
        }
      ]
    },
    {
      "bom-ref": "8d5a42e4-e67e-4876-9bae-37e27ca33a24",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamDirect.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "29087c01c985507f943f1cf933e8875f599719e7"
        },
        {
          "alg": "SHA-256",
          "content": "33cbf3dcead3a01eb6a4e6539c5a32c95f426a442c90f1de00febf4563cb41ef"
        },
        {
          "alg": "MD5",
          "content": "c6568f0bc5b33590a1531c22e9b11bfc"
        }
      ]
    },
    {
      "bom-ref": "8d7a07d6-8ec8-42f1-b5a1-c8ba4c6e4a98",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubiattach",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8da0d9f0-6ef2-440e-9ae9-2ad34bce7871",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libexpat.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcdad264d19e601bbc20bb57e3899923779ee582"
        },
        {
          "alg": "SHA-256",
          "content": "5307c084b5953b62880b733282f786a154b747f72f090299cb7acba5a6564ccf"
        },
        {
          "alg": "MD5",
          "content": "96a361b044c3427a184ce648d88f9ad8"
        }
      ]
    },
    {
      "bom-ref": "8dc1af7b-fb00-43d8-b8cc-542eac0df520",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mountpoint",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8ddc9388-5572-48bf-9a55-858c32ba9134",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/rom_version.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8a07df12e77b50de1854bf38f69dcae300e8867d"
        },
        {
          "alg": "SHA-256",
          "content": "07cab32c488fa8105b23ce809fbb9853e4a28dc3cb4e17cc2df0cee98f7915b1"
        },
        {
          "alg": "MD5",
          "content": "b8a470330098d96e9221b3a107e601e2"
        }
      ]
    },
    {
      "bom-ref": "8defe7d2-9f58-4bfd-a65f-574c0ae8a17a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/fstab",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "47569c791622acfaf241b8c64b73ef723a4440e2"
        },
        {
          "alg": "SHA-256",
          "content": "73d896598fa7f6865e4be1acd9ad3842a11c792e1aec1df38097a861f2040941"
        },
        {
          "alg": "MD5",
          "content": "aa3caa9582b6798252580afbf6d3b945"
        }
      ]
    },
    {
      "bom-ref": "8e302e21-5988-4bd8-b630-ef48941a6a3e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d70aad783a3ad3380b0f3eadfcb81620636d4a11"
        },
        {
          "alg": "SHA-256",
          "content": "5839dad882f4e715556c4c646b05d3189ee3853627de0b0104ee0e64169bc221"
        },
        {
          "alg": "MD5",
          "content": "78b20f3ab6b203e25beb5218ee7e6e7c"
        }
      ]
    },
    {
      "bom-ref": "8e3b0452-a4d1-4a6b-bc7b-ac59c2e6eece",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/maintain.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "82709f97ba6999b846ce73ea856f443f10e2aebd"
        },
        {
          "alg": "SHA-256",
          "content": "66e55b2dfb1de7f7c646e35094ef40a4b85a0454a89aba347572c3dce05af172"
        },
        {
          "alg": "MD5",
          "content": "c002c316c3dc62f42651e2c5541a7200"
        }
      ]
    },
    {
      "bom-ref": "8e6bc5cb-4ee9-4254-afed-7bc361a9806c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsafec.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f7a4e329a10076bfe3de2df9dcfc243772dcafe9"
        },
        {
          "alg": "SHA-256",
          "content": "49a1a5345396a01a83af287b697b2314822374f2714c35f813d0aa9eb9935bce"
        },
        {
          "alg": "MD5",
          "content": "4cf60247d115e7f59b00133f237ca0d2"
        }
      ]
    },
    {
      "bom-ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "905bc0c905e6a2a6a61ff8642fe1778df7590a60"
        },
        {
          "alg": "SHA-256",
          "content": "6453ee8d56135820435b9237718c58cd0d4ae29ee44ba4f87b9a7bfaaceaa7af"
        },
        {
          "alg": "MD5",
          "content": "a9966c9ad82ef00a8da07b0eb0faaa8d"
        }
      ]
    },
    {
      "bom-ref": "8e92afdf-c705-4ecf-9ddc-67ea6857afb5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/interop/classSchemas",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dba821fca179d7c96bd0f5ebf948f46ecc36e419"
        },
        {
          "alg": "SHA-256",
          "content": "4c239ff0ca6a9cc39c908d989ae9302932c31f929038c5f830e7b53579fc16b5"
        },
        {
          "alg": "MD5",
          "content": "ef42a71dbbf690f7f65d7cba2ccbeda1"
        }
      ]
    },
    {
      "bom-ref": "8e95288f-32d3-4ec3-8b67-61858eebf263",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libdbus-1.so.3.32.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bac7ed38fea3d91578bf6355d7dcc4cd9e6e631"
        },
        {
          "alg": "SHA-256",
          "content": "f5ef71790a57c5ddfbe1838a0f16d30c4073fcd580a63538ec09e93ab4035793"
        },
        {
          "alg": "MD5",
          "content": "2c67e8ff3d831bed06186c4373e44389"
        }
      ]
    },
    {
      "bom-ref": "8e988761-8c96-4110-a683-79fc3e3d3506",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_14_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e2d800f7f8c8e099ab2590e8a5668a526c2ce5f6"
        },
        {
          "alg": "SHA-256",
          "content": "044b78068ead9258ece181e21a5c4884db99fe629029ba36ec96a358a0050d81"
        },
        {
          "alg": "MD5",
          "content": "1e9b3ad5fb7c34546497424942c44401"
        }
      ]
    },
    {
      "bom-ref": "8ea0f778-534d-449c-b629-d62cdb4bff66",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libzstd.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f49b92e2d483a59646a741a5b9340d63e93ee1f"
        },
        {
          "alg": "SHA-256",
          "content": "c495d603579c6a203727a66bf4f2af4789ee8815d4635c22bfb2e2e68ad68142"
        },
        {
          "alg": "MD5",
          "content": "4302560a4ea0a94a90150adf74e25e49"
        }
      ]
    },
    {
      "bom-ref": "8ea772ef-c5ac-4a26-9157-cf951f32c287",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13SSH",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "02aab6854d6eebdee0ceb472f5699b95f079d6a0"
        },
        {
          "alg": "SHA-256",
          "content": "22f8dba2cf356def25bb9c93d65a4b4a4d3382095fe577ee0675137fae2f6c2e"
        },
        {
          "alg": "MD5",
          "content": "f298f972700b803818c85e757190a0f6"
        }
      ]
    },
    {
      "bom-ref": "8ed2459c-d06e-466e-9291-9173c556e0f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcFileRepository.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64efa4bbb1111b4255f6b924d1ae5c549ef40fa8"
        },
        {
          "alg": "SHA-256",
          "content": "d440914639cd70b97dd11d037ef7f623252492f4efa4f9761142b9ee9b5f7e06"
        },
        {
          "alg": "MD5",
          "content": "e6201b393f6c99c6bde694a7d0220fac"
        }
      ]
    },
    {
      "bom-ref": "8ed256b3-305e-46c5-a8c8-26092acf64fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamPower.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6f444402c91b6c930f8444727442da55618a3ea"
        },
        {
          "alg": "SHA-256",
          "content": "2b6f7d3d30bbf6a2c7d5e13a14768128d11ef4aeb7a17b8ee004ed386cbee60d"
        },
        {
          "alg": "MD5",
          "content": "7446f48cfdc10f3dbc3aa1df0888a1e3"
        }
      ]
    },
    {
      "bom-ref": "8edbeec2-bc81-4efe-865e-8f67adf67ae5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/whoami",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8ede5bc6-9ca4-422d-a4a1-6927f8b8d1b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/test.jnlp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f4c57559dbe6b4e2840f002b7a48f5ab6b6790f"
        },
        {
          "alg": "SHA-256",
          "content": "95932de240a89ac190dc37df8aae70f8736e5f57176796f55585bbbe73816a89"
        },
        {
          "alg": "MD5",
          "content": "2d9325df6d53b4ae017c168d38d33ec3"
        }
      ]
    },
    {
      "bom-ref": "8efcb0c1-9a31-4ed2-9487-58bbe4004d0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RADIUS.v1_0_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "81f9b52e46735a2aed551bdc4bb5c02909e660ee"
        },
        {
          "alg": "SHA-256",
          "content": "e86d3bc2ecc09a88c7cd21e2bf7399766e0d477f9b9269a8c70f33b43a7fba6e"
        },
        {
          "alg": "MD5",
          "content": "7c20719b7ee1f11a85f4e1db4e955118"
        }
      ]
    },
    {
      "bom-ref": "8f0a08f7-a594-407d-b592-7ee0fd5d727f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/down_ikvm.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a56bd11e6f0ab9d910bbe4ab5f1c77a7ccb4a3b6"
        },
        {
          "alg": "SHA-256",
          "content": "5f53a2f85d5f96b2abceed29ef17c003c4b3f676f8c874023f71b4f702e63c53"
        },
        {
          "alg": "MD5",
          "content": "7ce3189af7618f5cee331913c255c189"
        }
      ]
    },
    {
      "bom-ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nmeter",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ntpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8f7ca2f9-6a6a-4947-81ce-f5d7a84f56e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pkill",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8f7d4596-05ab-4cae-a0cd-bf8684865584",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/httpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "8f85807a-1c53-4468-ad63-624afba43424",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pldm_nic_update",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8bb9a13a18aeb00976c791ed9e9422240b800684"
        },
        {
          "alg": "SHA-256",
          "content": "bba360cb35817d981c9586bc681441b0c7f3c9c87ee03ce269e713985752d644"
        },
        {
          "alg": "MD5",
          "content": "6ce7dec062e1f42c650a42f44b24e6d2"
        }
      ]
    },
    {
      "bom-ref": "8f865069-db3f-40b0-90ff-77a73eba347a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/hook",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b97a9e05d3ff9147d949ca670d358288405627bd"
        },
        {
          "alg": "SHA-256",
          "content": "c0e44511e484cb90c47d30c15d824190dc02b8b82860c26ac413beeb031ba806"
        },
        {
          "alg": "MD5",
          "content": "0defb0eb9815e619ab15668841a82d34"
        }
      ]
    },
    {
      "bom-ref": "8f9ad981-2801-4064-af07-e6622a105e27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsasl2.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98519f0656494efe5eae5558e34f34c960dcbdaf"
        },
        {
          "alg": "SHA-256",
          "content": "698b328988afcf64d05ae6856408861ea5e0c7c35df0164785e05103995cb6f6"
        },
        {
          "alg": "MD5",
          "content": "bd3add5bcadd302345c35f0febd82bac"
        }
      ]
    },
    {
      "bom-ref": "8f9b5359-9eca-4f91-82c5-510e3c5f84a0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "430ed973705cce40b6d6756fa3547474c9271237"
        },
        {
          "alg": "SHA-256",
          "content": "d1ebd990bcc14fd346ecc396b8993f61c5c9f6eccab34d55d515bcdded2e0783"
        },
        {
          "alg": "MD5",
          "content": "9fdc49c85094432b75d35da281b70a3a"
        }
      ]
    },
    {
      "bom-ref": "8fb01043-6aa7-48c5-a67c-9d1fefc20472",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4e3b3409838f67529c8dbc5b5a6a14d1f708b430"
        },
        {
          "alg": "SHA-256",
          "content": "db3eef4dbc578464d322447ac9e3954d9855aaf380993aa34833cdc259ed1a4f"
        },
        {
          "alg": "MD5",
          "content": "83f74cb5454c038c3708d0e4a957659e"
        }
      ]
    },
    {
      "bom-ref": "8fc7c000-1bee-4ded-89ec-4b3f4e7fe15b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libcrammd5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a2c93e2fef7fed59b95b71ab2c2961b03c6e41d3"
        },
        {
          "alg": "SHA-256",
          "content": "b84e7acb656385ac3cb9f9827081163873d0bd5f7231d5757152b3675b62b567"
        },
        {
          "alg": "MD5",
          "content": "52c4c3decbb577c1b3580b0c6939c671"
        }
      ]
    },
    {
      "bom-ref": "8fce3014-d948-4a8a-be09-75c3504ff299",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/key_iv.enc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a60651695464886cdc4c43f35729c8d638e2544e"
        },
        {
          "alg": "SHA-256",
          "content": "a6ea7937b38432b555428afd505e62e301715687d553e8b1e06552015b0e815c"
        },
        {
          "alg": "MD5",
          "content": "bd5fd18896cb8ca7f438a3dde8a481ae"
        }
      ]
    },
    {
      "bom-ref": "8fe6a7ed-c87a-478a-9322-8dcfdb2977ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libatomic.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48b910a8ccf63d5be6b85d1db031b227fee4bec4"
        },
        {
          "alg": "SHA-256",
          "content": "992bac30241c4cff67f8fcfc7801e9bab1143369da17edb7d88a42e90f8813a8"
        },
        {
          "alg": "MD5",
          "content": "fd500dcbda526b31367f53737dc428f8"
        }
      ]
    },
    {
      "bom-ref": "9029041d-581a-4eed-a592-89e895dd8bfa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ash",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "902ad3ac-467f-4114-a7c2-ae6fbe6cbec1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libteec.so.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d65a897459d157245644efb77d73af76e1932ace"
        },
        {
          "alg": "SHA-256",
          "content": "2999ed74e38914ee21c76a1dde37ada773f02d581fbe1ef2153bd449b1ee6332"
        },
        {
          "alg": "MD5",
          "content": "d3375bd317e5cf5321a19c4f92ba2152"
        }
      ]
    },
    {
      "bom-ref": "902c990c-6292-483e-8874-a26a9fc11153",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RADIUS.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4011a072dc0439ed5dd12c991e7caff343408fb9"
        },
        {
          "alg": "SHA-256",
          "content": "c4717a6782fd251f78f1bb2eea1dd0ec2e5adf97ba0555d7c8140c1d19b7e844"
        },
        {
          "alg": "MD5",
          "content": "cd70e586ef308f208c95f8ef72c7c022"
        }
      ]
    },
    {
      "bom-ref": "902fafe9-ec88-479b-883a-ae3bb4390e39",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/makeGood.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6b1c15e5b706fc940e751e55d49e42d0e9acd7ea"
        },
        {
          "alg": "SHA-256",
          "content": "166bf9bc995c4e6b4d14008e3ed705d437f7613fa7789ada766197118333772a"
        },
        {
          "alg": "MD5",
          "content": "c64a21ed51b7976c35f852c5a2bddd06"
        }
      ]
    },
    {
      "bom-ref": "903dc195-fbc6-4805-b389-0408eac82a50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/more",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "90465a3b-fef7-4b69-9da9-3d4859033d16",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcLogService_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "22d25c049d68a6d18fb51721db95c729a0255e98"
        },
        {
          "alg": "SHA-256",
          "content": "fe5de7651493a32d0274cf143b5e20f0bce986ab6bd158d09d0a71ef03329bbf"
        },
        {
          "alg": "MD5",
          "content": "7190a3d0045d84a30685a80f63393802"
        }
      ]
    },
    {
      "bom-ref": "90896613-84af-4e3a-a994-e720669bd45e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_cmpn_gpu.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57c6e68352f1b91801abc948df358414b5ba8740"
        },
        {
          "alg": "SHA-256",
          "content": "a2cbf245dc72baf7c9524dd55d0b4e6af14c9c1212b20f84a60268200336f04e"
        },
        {
          "alg": "MD5",
          "content": "cf3db5b171fd6e9b326a5fc544363891"
        }
      ]
    },
    {
      "bom-ref": "90929fd3-b507-4e95-b91b-58d675665301",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jszip.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e1065bd34d3bfa12e44537d1fc7419315f76d240"
        },
        {
          "alg": "SHA-256",
          "content": "215fb2537b13d82daabd46e1ee59ffe4dce90abd0acb0ac5432e77071f422e9c"
        },
        {
          "alg": "MD5",
          "content": "a778df39333432bb8c5ad0f81d02d296"
        }
      ]
    },
    {
      "bom-ref": "90a7e7d0-5d4f-4aaf-b4b0-aa69a86d8131",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuv.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d310b90b6f13aabaac71d1c11b2b0e0debee4666"
        },
        {
          "alg": "SHA-256",
          "content": "fbd9ec76d59f8f40f5aa4364e711e2cb62ad8ad74de5b99330b97816093a5e3f"
        },
        {
          "alg": "MD5",
          "content": "e96203676da186cd9642a68b37045b88"
        }
      ]
    },
    {
      "bom-ref": "90a87c9d-002f-4635-a7dd-fbdb88ef8689",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/killall",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "90aa573a-0996-4e2c-802b-f847e30e4809",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/depmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "90b758b1-46c9-412d-beaf-a9bb4dfeee17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/aspeed-mctp.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1c5fdbe11ab3e75c42083749d7692efade526a06"
        },
        {
          "alg": "SHA-256",
          "content": "2e33ea3488bc984c0f719f320c352a38dce52c4198e8d50a85e566420e65c95a"
        },
        {
          "alg": "MD5",
          "content": "b3c1d4bc72ebe07a77340d4814268755"
        }
      ]
    },
    {
      "bom-ref": "90cc43f2-6e73-4f2f-aae0-7d0ab561933a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/interop/20_indication.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab674483b3b6b44d4d044b524e3d1bc7d626ead7"
        },
        {
          "alg": "SHA-256",
          "content": "b8f4b59c3dda5251d34e8ec88ce43a29cc48dbcce47b657c2ec81fdb1b472d1b"
        },
        {
          "alg": "MD5",
          "content": "6555135c681dbd776afe88d9aa9fb894"
        }
      ]
    },
    {
      "bom-ref": "90d30923-4550-467b-83ef-9c67d63bd25f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/Threshold_Sensor.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4876bd7cf0c312e4b5708f1084f13af61be71bf0"
        },
        {
          "alg": "SHA-256",
          "content": "d8b083aa0ac73750d0b34e4e4e30ee2f77b17fb95c0258f78ddeb89c2eb6f053"
        },
        {
          "alg": "MD5",
          "content": "d7f258153ec65195b5d4f0b624bb72b5"
        }
      ]
    },
    {
      "bom-ref": "91072551-6b25-4fe3-8aeb-f3de71197180",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_program_options.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "95eb2c73ec63f85427cbfb43b0c876a028f452d9"
        },
        {
          "alg": "SHA-256",
          "content": "4297dd39f11cd596e39e33c6ae2531eb6444a1ee6ce3b098896f57f5fdc2d947"
        },
        {
          "alg": "MD5",
          "content": "241de24c28c0f9752e14c12a5a7f55b5"
        }
      ]
    },
    {
      "bom-ref": "910e73de-67de-45f4-bc4d-9afef3a5dd7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/base64.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1425e0af06cbb393811f656dec08780b40f1f1f8"
        },
        {
          "alg": "SHA-256",
          "content": "c3e0ab4946ae2a80157602d9f0e54c4106e8f71eac2f3ecee8982f0fd7e04538"
        },
        {
          "alg": "MD5",
          "content": "e827cf4745944a64ae34456e4da9658b"
        }
      ]
    },
    {
      "bom-ref": "f3280e73-fa62-40d8-886f-4ec9a45a3f1c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/mctp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "43575dc1a432019e01bb381498ae632e648d7c8c"
        },
        {
          "alg": "SHA-256",
          "content": "b45cefe3de17a18400f680302caed87df97c92a41b5453accd58ccc6586a3474"
        },
        {
          "alg": "MD5",
          "content": "a0adc831470e165f56395dd940f20377"
        }
      ]
    },
    {
      "bom-ref": "911cc030-00a5-4c60-a170-a248f6cf1316",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "723966e5029c33a6d5d92340e8216636660addc5"
        },
        {
          "alg": "SHA-256",
          "content": "846a1893b26e85bc9afeeb214c8ab0769d4ee923aa6fe20ffa831f8e86b9a1b7"
        },
        {
          "alg": "MD5",
          "content": "8ff9e898e5bcdea368fd08669db9d0c5"
        }
      ]
    },
    {
      "bom-ref": "91251859-6fc3-46f4-9489-69a1e8a2c5a0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/PWSnrTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aa2c008b28782cdd978c53fefcdc5ffbc0493cc4"
        },
        {
          "alg": "SHA-256",
          "content": "4243db522c7ee483fb8b4e6be336256bb24a09a08348867c18ae50b977dbaa9e"
        },
        {
          "alg": "MD5",
          "content": "709ebbb28318cb2048adb4f6706afdc7"
        }
      ]
    },
    {
      "bom-ref": "91524c9d-ef45-4477-a83d-afa63101e220",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/select.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a526018067af38f332dc69696fbb0060b11d3986"
        },
        {
          "alg": "SHA-256",
          "content": "c71ba576a479de581cbf1c1332368337e6be4e6f5723906c0da7c38cf13a2893"
        },
        {
          "alg": "MD5",
          "content": "5017084bb075175c1ee1259525ff2021"
        }
      ]
    },
    {
      "bom-ref": "916d3a56-1b7f-470e-9f1c-e563fb242dcc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libz.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ceb65b531fe1dda0eeaf2cabbb1b280d69c0554"
        },
        {
          "alg": "SHA-256",
          "content": "9c28915c75552190c20ea2466bd06536e1b6a09768bc73b4ed3e0043e903c21c"
        },
        {
          "alg": "MD5",
          "content": "52904b92629275f8fd329925ba5524fd"
        }
      ]
    },
    {
      "bom-ref": "916df323-ca44-43a5-86a8-78dcd088a77c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/udhcpc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "918010c7-4d6b-4bcf-8a09-333dee1bb310",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/FanMode.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5936b4855a9d83aacf24f312adb607fc0f5eb709"
        },
        {
          "alg": "SHA-256",
          "content": "f56556abae57b7c9240fd1289e6f306dfa4f701f7a0c813addc4a3816d056461"
        },
        {
          "alg": "MD5",
          "content": "ac916fa1a5ba17348460f86a4aa492f1"
        }
      ]
    },
    {
      "bom-ref": "9185133a-4c5f-4737-87ae-ee764cd2b131",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.core.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d8d2cac15e4e46743e7f6d1384d52686154c2034"
        },
        {
          "alg": "SHA-256",
          "content": "d2cbdd5bf3e8c6f8c44f34b3ed9e9494f9021191f1c6a7f504818d55f50009d0"
        },
        {
          "alg": "MD5",
          "content": "0cf08e53d66abd290af2640790e73cdb"
        }
      ]
    },
    {
      "bom-ref": "91a9ef5f-99bd-4074-8bf3-d423ce485ecd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5support.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6323368eeadb6cf6e72ba885cb3ee700a379c538"
        },
        {
          "alg": "SHA-256",
          "content": "3c8cd3d5721a6ea6ef421edbc1c34c9ec390901bcc9c1d37ddc9ed9cbc56332d"
        },
        {
          "alg": "MD5",
          "content": "dfb7f207ed9135f82c251060b260783f"
        }
      ]
    },
    {
      "bom-ref": "91ad3f98-0eb1-4d13-af15-b90fdc6be320",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libm.so.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1998f4dedfa25b2dcff34096980363a07183a390"
        },
        {
          "alg": "SHA-256",
          "content": "0b02609385f6267eb86dcef99de917afb8b703f1f8262125551606456f0790b0"
        },
        {
          "alg": "MD5",
          "content": "3e3f55cb516da70a20955a4c100c86fd"
        }
      ]
    },
    {
      "bom-ref": "91b5a182-ce7a-430f-b7e0-c70fc45f30a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e676a31e4cce634aced0cc1442bcbd4a1718b58a"
        },
        {
          "alg": "SHA-256",
          "content": "57607c35bf814d0456160f203e3168c0226dd9821110488ab8bedeb87070b67a"
        },
        {
          "alg": "MD5",
          "content": "21af6449127ed17492ba18a931989c55"
        }
      ]
    },
    {
      "bom-ref": "91c6080d-cc3a-4b6a-a5af-c1e2b2ab8a26",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery-migrate-3.3.0.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "efd46675f07d823fbe7955e7c317c56b30799099"
        },
        {
          "alg": "SHA-256",
          "content": "c19def3576a41fd9383f4d1f3460256cdd0f929292ca145aefa205cb85753d81"
        },
        {
          "alg": "MD5",
          "content": "b2c6875790578574575630d137e23484"
        }
      ]
    },
    {
      "bom-ref": "91cb6096-f539-4971-be02-5a1e719de383",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/playvideo_64.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "afdc477d08aacf68c175295eefc859932158ae11"
        },
        {
          "alg": "SHA-256",
          "content": "f911ab6d125a19310172e92c545c359803e4006d99ae3f7b90ba30d4213c8662"
        },
        {
          "alg": "MD5",
          "content": "d4c1247a73419371266fbb6b9184ddfa"
        }
      ]
    },
    {
      "bom-ref": "91d12581-690f-4dfa-b9b4-e8eb17cd3656",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ascii",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hexdump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9211f894-205a-4fd0-8db3-c4aae2d7ea54",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_keyboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a823d7661f03c3c130276613802eda87ead11f5a"
        },
        {
          "alg": "SHA-256",
          "content": "b22171bd832fa783af3886a3ab2c4cdfc204c8c43ed5a3974a61b290d909ed07"
        },
        {
          "alg": "MD5",
          "content": "52d210593364d7fbd1b084d3bc3f4b2b"
        }
      ]
    },
    {
      "bom-ref": "9215d027-113b-491b-a814-8e37189a4fa0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcmpisfcc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e08b27a10f7f43b186730dbd727dc38f2201d15"
        },
        {
          "alg": "SHA-256",
          "content": "2398ac01dda9642b8038dfcc35c9529ddbe0b651ede553d413d5c94579de4485"
        },
        {
          "alg": "MD5",
          "content": "d23f6606632402f0deef01a0d4b99181"
        }
      ]
    },
    {
      "bom-ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/nice",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9224fe6f-e627-46e2-be96-805c348b3a35",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RADIUS.v1_0_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ead471b29ea474f3f51585d2f77db17c23d79fca"
        },
        {
          "alg": "SHA-256",
          "content": "88ae57e7bb246cb6da2ec2289ab2fbfeec92fc65ef5411f723acb1c4d3c2065b"
        },
        {
          "alg": "MD5",
          "content": "b7c4b644d9c735a175a7b91662c80c16"
        }
      ]
    },
    {
      "bom-ref": "922e894f-dd77-40b2-8eec-0a9099288c7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmctp1.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9f1b9e35e8bf9fdfca9f6d88b13424abe1e0cd72"
        },
        {
          "alg": "SHA-256",
          "content": "645c446628ac6d12f0518689cc5d7818d46b3a647c494e27246aeb8f3b1a70dd"
        },
        {
          "alg": "MD5",
          "content": "dbf1127be73ae84bedf4426a1c8654e5"
        }
      ]
    },
    {
      "bom-ref": "9237dfa2-c6a6-4982-a6c9-7678693e9fde",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderMem.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57b8c2ff13b620aa6e30613ccff65c4593b1c84d"
        },
        {
          "alg": "SHA-256",
          "content": "e8a328d27275f7987516db4256dc965a24e99e70b41f448d7cdd077676423cea"
        },
        {
          "alg": "MD5",
          "content": "e9c831be3a193556b63c9ae44567b6d2"
        }
      ]
    },
    {
      "bom-ref": "9246e571-a328-4886-9c64-c58f556713f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_cper.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c397334e1d4db80ba5acd79e54b9c19090e460a"
        },
        {
          "alg": "SHA-256",
          "content": "04df44d72139746c9178ac740e965d1b46cce67cff0f470bdd94618babeef473"
        },
        {
          "alg": "MD5",
          "content": "621d12d1dbebaf77f88cac6a62d6efa2"
        }
      ]
    },
    {
      "bom-ref": "925dfd61-6bc8-4a60-ae14-95ce8e93396c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/Drive_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf692a4d2a3463777994264eaefd1ccfdac80891"
        },
        {
          "alg": "SHA-256",
          "content": "4a5c9fa887a1b2bfadd250273bd6495bed737e94b8949ef262e82bcae3b5e1ac"
        },
        {
          "alg": "MD5",
          "content": "fd8d792996ec66af27f294e5ac06309d"
        }
      ]
    },
    {
      "bom-ref": "929afa24-c719-45cb-86ba-5655d8dcb284",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_17_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3cf2800e87a388ff415c53a394a338e4ca165851"
        },
        {
          "alg": "SHA-256",
          "content": "6bef3312e23c35c7bbcd9066bdc91caa4dd5232bd6fb4d08985234697fb3a67f"
        },
        {
          "alg": "MD5",
          "content": "4d039186da5d34cad8e558a3d2aa0876"
        }
      ]
    },
    {
      "bom-ref": "92b14365-0d5c-437d-9d93-971550a0e58e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpagent.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6a582838225a6278c725c17458f947fded16131"
        },
        {
          "alg": "SHA-256",
          "content": "f688485946d8e52da04495c2d0f76bfada58ff0491d40000d1d101bfec03850a"
        },
        {
          "alg": "MD5",
          "content": "f74367d541834ca01c5cceb1fa27e063"
        }
      ]
    },
    {
      "bom-ref": "92b32351-ef5a-4c72-ac85-da4a2604f55f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcSensorExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "814ae08390a9241041c8fda0db33880060392688"
        },
        {
          "alg": "SHA-256",
          "content": "15c8ba0a8b18872e5742aa74536f4226be598b0cd52aa4e18f48577f79f9c09e"
        },
        {
          "alg": "MD5",
          "content": "ceaacc7dafd5cf43537763c75d2149a7"
        }
      ]
    },
    {
      "bom-ref": "92c95cd8-ce64-441e-a31a-b47a3e14f821",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/lib_i2c.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3acd246a7db3348289b69abf4aa8e0b650cb3f72"
        },
        {
          "alg": "SHA-256",
          "content": "c4a4d6521cf8629ae3206d197731f453f11a8ebc1e9c9117b99a594f95916144"
        },
        {
          "alg": "MD5",
          "content": "55687308a68d371c15bf38ebb1dca83d"
        }
      ]
    },
    {
      "bom-ref": "930fd259-6989-4929-b02d-ac7db138881c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/nameif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "93223c42-fa74-4fe7-a060-ab4fcf5e704b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libdl-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a681b98e2358fe4e64f5d311a5425563dd52bde"
        },
        {
          "alg": "SHA-256",
          "content": "d8bf9201ed1cd88e6c830fd20e34dd1ba0c313c8105b0f1645a9a8cd621e99e4"
        },
        {
          "alg": "MD5",
          "content": "12e5894175bcfe681ce74e0e3e12fed1"
        }
      ]
    },
    {
      "bom-ref": "93436513-4904-4bf6-8c43-d962ca432f8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpagent.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6a582838225a6278c725c17458f947fded16131"
        },
        {
          "alg": "SHA-256",
          "content": "f688485946d8e52da04495c2d0f76bfada58ff0491d40000d1d101bfec03850a"
        },
        {
          "alg": "MD5",
          "content": "f74367d541834ca01c5cceb1fa27e063"
        }
      ]
    },
    {
      "bom-ref": "934d7525-4386-4025-ad47-9a0281a46eec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/os-release",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "571bdea41af604494488f7f29cc72c9cab71a7b0"
        },
        {
          "alg": "SHA-256",
          "content": "70e239e95263d4fccc4ab7f35dfeaeb37b33684755e091cb4a75ff2c58e1345a"
        },
        {
          "alg": "MD5",
          "content": "0a99785c8ae8d8c3758b584056bb36e3"
        }
      ]
    },
    {
      "bom-ref": "9352b053-8490-4cf1-881f-18e4629f373c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/freeramdisk",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "93677713-f75a-45b9-aba5-2110b48bf1a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/screenshot.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4e57ad9236fd721a14a581306078b89b0a3db5e6"
        },
        {
          "alg": "SHA-256",
          "content": "4444d831b3e652488ff69e5d25f949439bbb05631c22e996628dad8294591a2e"
        },
        {
          "alg": "MD5",
          "content": "7d3a55012060fba9fcd47b36978b7a67"
        }
      ]
    },
    {
      "bom-ref": "936cbddf-a91f-45d6-99e7-f290825299c3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmount.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b9240192537dd5df45a3c2a1b79e1e551f50bee8"
        },
        {
          "alg": "SHA-256",
          "content": "5505cf3c987f962b424d08edbf9ac7111635edd8b176835b1f525c2090d9ced6"
        },
        {
          "alg": "MD5",
          "content": "bbf9df27d07a6173db55f81d47b3492d"
        }
      ]
    },
    {
      "bom-ref": "93860e5b-c06d-4e75-ac93-aa412a4f5378",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpcre.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c86814283f02c01beb1e257bbe6879818c6f87ff"
        },
        {
          "alg": "SHA-256",
          "content": "b7d0bd3e139d156347f8dbe6e7edb759fe04a6597f43e136c775f829ce9eb3eb"
        },
        {
          "alg": "MD5",
          "content": "1ca4569cf03e096b920faf07f6ed55dd"
        }
      ]
    },
    {
      "bom-ref": "938e6818-c244-4076-925c-b547451aba1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcTaskExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ea1731f0218f5c2cf0fe6b253be5ff5a912547e"
        },
        {
          "alg": "SHA-256",
          "content": "c52f944e25bb6ab34bd7e1a4da42d8f0957a11cd0ae5dadd18f04d9ca54d0d62"
        },
        {
          "alg": "MD5",
          "content": "37ccc1e81daf93f68c9144ae68439c92"
        }
      ]
    },
    {
      "bom-ref": "93a5f482-d850-4bb5-9444-bfb71fd9ffb4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_PUE2.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "631f1c3b242a3e926dde841e77ec44d750e317ae"
        },
        {
          "alg": "SHA-256",
          "content": "1075f8c1a71ab28ed3576ddd74376a73544906b5e78b5a0efc461651bb266965"
        },
        {
          "alg": "MD5",
          "content": "b2b644cb14325edb4db32b62e5871781"
        }
      ]
    },
    {
      "bom-ref": "93b4926c-6233-4813-8c2b-f3237699a38f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/loaddbg.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d45a2e4511f969ff2979836a9324dbbcd2667e49"
        },
        {
          "alg": "SHA-256",
          "content": "438c132f58f2467d06b6c18fe8ea7b622e02bdb15ed25144ee9492e3211673d2"
        },
        {
          "alg": "MD5",
          "content": "9e23cdae6449e65b350f52841e018273"
        }
      ]
    },
    {
      "bom-ref": "93b8650f-ad74-455a-8f9f-8cc74235fc13",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RollbackID.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ebb887eecf9fa9bc9c48f2f2a3b6995f3a3984e1"
        },
        {
          "alg": "SHA-256",
          "content": "a94b24efd5755c0945b87f9939a86a8a17f6b572f6f4693e41add9ab40d01a6b"
        },
        {
          "alg": "MD5",
          "content": "edd302ece475caee2a0902106d9b4134"
        }
      ]
    },
    {
      "bom-ref": "93c3162a-0e71-424a-9526-16ff29fe40e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/ec_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c2fa20f5a60750cb0b35c1292eb792cb2ac5b92d"
        },
        {
          "alg": "SHA-256",
          "content": "a22ca819f293ccd49dd5993ee2c89a042641e58fa2caad2de1d789ecf0ac21db"
        },
        {
          "alg": "MD5",
          "content": "87db77607fa90abd3529119ee46f56ed"
        }
      ]
    },
    {
      "bom-ref": "93e2aeda-878c-4cdf-9c78-119b3628a9ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72e75342892f6782eff7b76f60f515a771a65d02"
        },
        {
          "alg": "SHA-256",
          "content": "e9014d85f2142a448a2b2eab4e1e8e846147a1bfe91fe1bbacb5424cb5bb1938"
        },
        {
          "alg": "MD5",
          "content": "ff1bab12206b47354618c0dd8374ef12"
        }
      ]
    },
    {
      "bom-ref": "93ed2686-2307-454a-88ce-4edc0f602820",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/env",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "94250551-1ff3-4551-b4c8-1d60413d4353",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libanonymous.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e87edeff86ecac9c26aa2e69142bd56479ce1746"
        },
        {
          "alg": "SHA-256",
          "content": "065c03eeec61dc3cd382e2f2fc28dafdc973e224a98ff2beff8c2e718c56067e"
        },
        {
          "alg": "MD5",
          "content": "57a46a72ebd132436179f961ced8faec"
        }
      ]
    },
    {
      "bom-ref": "942c90d0-38b0-4ef5-a4fc-ff2546179895",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/CupsService_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fc463ca0341d0bceddd4a091e29eb6d2e29bf963"
        },
        {
          "alg": "SHA-256",
          "content": "6632f7529adae71c8abb5cc8e3f56ff9458c5c15d66573c31f0c895490599506"
        },
        {
          "alg": "MD5",
          "content": "d9ddc3d91fac5bdb1cc931589c337062"
        }
      ]
    },
    {
      "bom-ref": "9441d79c-4e79-4928-b94b-aa199a64a880",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/acpid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9445245c-750d-4d07-9cd8-b081263b8c8f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/runsv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "946bfd4b-36a2-40d6-a676-91ee9a5e821c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nsenter",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9473ba10-1c29-480a-a3b3-fecc42edac59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ntp_service.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc5c61a51a1d7dec5f7ce0bd9f37744bc1b8bb92"
        },
        {
          "alg": "SHA-256",
          "content": "6ec2e68ad8c337a57b04ac82a0ef1d6dd9b8042680c2c19a70df1c10e4f52cbe"
        },
        {
          "alg": "MD5",
          "content": "d75fb797e4d2c403a01f89740fd3b138"
        }
      ]
    },
    {
      "bom-ref": "94bbfd84-5418-4cf7-9d6f-8c922b43b787",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcNodeManager.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4327e3305eb7ab4def3a3763a7472167d898c00d"
        },
        {
          "alg": "SHA-256",
          "content": "4a67fde485281c1fda87cadd4484724f92b3854f2d78bc24cdad5ee39ba726bb"
        },
        {
          "alg": "MD5",
          "content": "441c49a5c08912488efb72e12c37195a"
        }
      ]
    },
    {
      "bom-ref": "94cc7453-2c8b-49c0-b52b-37260990cff7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/ssdp.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ccaea8adf4576f7102e442b39a4498cc2d775f8"
        },
        {
          "alg": "SHA-256",
          "content": "bc0d5da01906cf218d23dfd1394020271fd9b39b7063f72caa12d5fb1ce36236"
        },
        {
          "alg": "MD5",
          "content": "d6732610f51a50ca1e8d8e4cf8d965ab"
        }
      ]
    },
    {
      "bom-ref": "94d47136-8227-4562-9aaa-a35aa365e175",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/traceroute6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "94df0296-18bf-43fa-86c5-71de769a58ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_0_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f168a0f2eda1f8e59f2370b5f8b421154345d0a"
        },
        {
          "alg": "SHA-256",
          "content": "3da2142ace5ef4ac0a87145f1db960a6f0eb3d4938f706f849ab4163952e6d22"
        },
        {
          "alg": "MD5",
          "content": "fb7142ab34f301ae23e8a64615e8a2f1"
        }
      ]
    },
    {
      "bom-ref": "94f0a7eb-cd03-46a8-b1a0-a1e9e3a6446e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/factory.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5472f29b8434f7d2a9f2b3ad179b24c411e5da51"
        },
        {
          "alg": "SHA-256",
          "content": "7bbffd44be8fe850c240546e0256b2c9d67836a5ac3db440408fb336e1f5e0c1"
        },
        {
          "alg": "MD5",
          "content": "0b8146599c1bfcadf806648b10f11df7"
        }
      ]
    },
    {
      "bom-ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uudecode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "95075577-d69b-4fb2-ae13-ad8b821d1c08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcAccountService_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7af69ca66918f875e0fc33da591cbd74a8d47907"
        },
        {
          "alg": "SHA-256",
          "content": "d536be21567e6fb987c676ee6579704857a52f407ab73f55b6bc84f712c981a1"
        },
        {
          "alg": "MD5",
          "content": "c8bb3ba1765063399205ebe4cdf006b9"
        }
      ]
    },
    {
      "bom-ref": "9508b448-2e94-4035-ad6a-e258eacc8004",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IPMIConfig.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "715c2e604fa6ca8eab6884d80ad20ca62abb2353"
        },
        {
          "alg": "SHA-256",
          "content": "ac91236d568f862d292fd3d1c3dec206c95441f1fa697c3fe5f548930403701d"
        },
        {
          "alg": "MD5",
          "content": "b8d85236d4a0faf2ad5b7fc428e9f675"
        }
      ]
    },
    {
      "bom-ref": "9512c6d0-1518-41b5-8844-746736cceb6f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f67f650db75a32a3251d4023e7ad48dc16c762e0"
        },
        {
          "alg": "SHA-256",
          "content": "1450f1dd99bd937467f265624aa6c9148c6446c3f3aaa22b27a277029a07e9c8"
        },
        {
          "alg": "MD5",
          "content": "93def15d906fc96e939b0eab516b066e"
        }
      ]
    },
    {
      "bom-ref": "95187322-20c4-445c-9fe4-c82a1c2fe872",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/dashboard/power.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0634b5a24dbfaa8456f6862d54f5a8054b599998"
        },
        {
          "alg": "SHA-256",
          "content": "84ce19b6b613f75da9962a143e7631e4925de33b4f1ed335ae6b39d730b49499"
        },
        {
          "alg": "MD5",
          "content": "1aae8d5a415603826d1c7d41d06b36dd"
        }
      ]
    },
    {
      "bom-ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9544527f-a455-4c1e-8d5b-dd7dd1d5b479",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip6tables",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "954ba80e-1e1b-4360-81f1-f35c84468fc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcChassisExtensions.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "06b671563c378761c976ab9ad86c9e2b6c721d2f"
        },
        {
          "alg": "SHA-256",
          "content": "f118229290b9c655e35b4eb105b8266ead171556820f505c5ced2309af5924d1"
        },
        {
          "alg": "MD5",
          "content": "f9dbe20c30f3387d23436079971138ff"
        }
      ]
    },
    {
      "bom-ref": "954c9d21-acf7-40ba-ba8e-a2866e3b718d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Node_LightGray_Landscape.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcb4ba8d847fa3ca569661aff42b31a26e86f2d6"
        },
        {
          "alg": "SHA-256",
          "content": "491cd70c9e05e08ebcafc3ebbc80541dfc19ac3c4430769e85eaacc3d10404a2"
        },
        {
          "alg": "MD5",
          "content": "79801a2d3913144885b76934eff21072"
        }
      ]
    },
    {
      "bom-ref": "955a35b3-fccd-42c0-969c-8d89038f7dba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/traceroute",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9567ef9a-29a5-43a5-9e33-f63a52a42f0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3c380faeaff9dac8a00a108f6037dd741e8deda"
        },
        {
          "alg": "SHA-256",
          "content": "cad7115390c33219445ce383f16815cf5889c3f0b9ab20f134d83eb61d8b684c"
        },
        {
          "alg": "MD5",
          "content": "703d921b89c4eae8fc0e9681967d1f73"
        }
      ]
    },
    {
      "bom-ref": "a35c3514-f6e9-48b4-8fb6-b22fe7bc8b7e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NodeManager_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "28ef62762facb80bc5ea1940f55bfe8d0454ad23"
        },
        {
          "alg": "SHA-256",
          "content": "7746c34c521f91ca5a4f70027f131717d51d2db03db66c30747439a9efa5b027"
        },
        {
          "alg": "MD5",
          "content": "7d2f02eb8f65046834702f61832c6e21"
        }
      ]
    },
    {
      "bom-ref": "95693891-4051-4458-bb79-f2c042c960ee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/EfiDeCompress",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34c7e61f5e037941db984a01ed4bf5c430afaeb0"
        },
        {
          "alg": "SHA-256",
          "content": "c99a9cf97dfc9b29039481f116231e69d24ab9eeda0617366d5b63ee76acbb85"
        },
        {
          "alg": "MD5",
          "content": "317b6285a0cd85874aab89a70b3b3e63"
        }
      ]
    },
    {
      "bom-ref": "957bfdee-dff6-4a78-b3f8-c7676211271a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/etc/ko/ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e14aa6c03d12b9b347bc7a8d5c55857947ec8129"
        },
        {
          "alg": "SHA-256",
          "content": "ef96639624a8182be7dc0007e3ba24d579e20d168f14d22129008d078d21e499"
        },
        {
          "alg": "MD5",
          "content": "7892f868391ecd0cc20e819c7780e1e9"
        }
      ]
    },
    {
      "bom-ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unshare",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "957d9001-3dc4-4855-9e1f-8ec84449b970",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ToggleSUM.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a039cc57b64d778ddfe978f44882fece2575e70e"
        },
        {
          "alg": "SHA-256",
          "content": "e9b163ff1e0311e6ee9c599899129ac619bf7cd205b17ef32a6cc6273af3a027"
        },
        {
          "alg": "MD5",
          "content": "9d78b4cc810c4e7a6b994c2212249a6d"
        }
      ]
    },
    {
      "bom-ref": "95d64b4b-8644-46ae-b068-3c862691529b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/w",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/runsvdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "95f70a6c-46c4-44ca-b33b-3fa46ff797e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libscram.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05846d6ce7b0adf863cf226acf203a14a0f46fae"
        },
        {
          "alg": "SHA-256",
          "content": "0a60aa782cbc7b4a26bbc0884b7660f2430844608e3f356c99aa20e4193683da"
        },
        {
          "alg": "MD5",
          "content": "0357e1497a56fc4a7fbbcc9bf9f5ae2d"
        }
      ]
    },
    {
      "bom-ref": "960b59c0-a95e-4640-a68a-383a826f7771",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_fan_mode.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "618dd8e3efd4f29edcfb705e070cf8f135ebef6a"
        },
        {
          "alg": "SHA-256",
          "content": "8fde5fb7675ee1233e58aa408e05467d6a535647819a38e4000d6e980f51eb3b"
        },
        {
          "alg": "MD5",
          "content": "0f0287bbd792eccf2ffe0dc8e122234e"
        }
      ]
    },
    {
      "bom-ref": "9617e294-a6f3-4fbf-a510-92a976adc383",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network_port.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bae59f7e03bee0355cc986dd96a58197c849093"
        },
        {
          "alg": "SHA-256",
          "content": "95e32c5625b76bf3442a6d1246cb3ba8da0adfeaf081ffea56ccf777edc733be"
        },
        {
          "alg": "MD5",
          "content": "648f779e4c04e8368561b5376eb58010"
        }
      ]
    },
    {
      "bom-ref": "961aa042-bf5a-4e0e-8838-4e423f96b48e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/keyboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ff650c12a91ca541a6c47dcac5e3390606cc510"
        },
        {
          "alg": "SHA-256",
          "content": "39595a9e07d2d4b95fc539a199289892c9abd647798724ca42efd23e1ca3095f"
        },
        {
          "alg": "MD5",
          "content": "98b68863db1ba26b70cd88ba60b60a99"
        }
      ]
    },
    {
      "bom-ref": "9641d376-2f72-4925-867a-a1fff4dfe991",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tac",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/test",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "966e5bc5-8380-47ee-937e-7b79254aacb3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48167f88b8e53584ce031248f70987e074c43052"
        },
        {
          "alg": "SHA-256",
          "content": "d9b28cc6b6013120aee49daa7a787f83166b4a1ae053874a3e47424c8122ec87"
        },
        {
          "alg": "MD5",
          "content": "426d8697bfffa578b5cebe35c893bfcd"
        }
      ]
    },
    {
      "bom-ref": "9679dc81-c45e-4ada-b640-b6b126b18545",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsasl2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98519f0656494efe5eae5558e34f34c960dcbdaf"
        },
        {
          "alg": "SHA-256",
          "content": "698b328988afcf64d05ae6856408861ea5e0c7c35df0164785e05103995cb6f6"
        },
        {
          "alg": "MD5",
          "content": "bd3add5bcadd302345c35f0febd82bac"
        }
      ]
    },
    {
      "bom-ref": "967fad04-a2e7-4bc0-9c75-59160385a7f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_mdns6.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6cdf5a9bce3798d50ffa10c7aee95dfd80533d37"
        },
        {
          "alg": "SHA-256",
          "content": "64e4aec4e0afbe0f8759b1e95637c3f03c6634875f58beb6603e8a26406b847c"
        },
        {
          "alg": "MD5",
          "content": "1a93e890483b82b4ec1c457bcfb32785"
        }
      ]
    },
    {
      "bom-ref": "96805545-c0a1-4287-9013-314a9353000b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_record.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6134b4cda898dac563c1eb861c56d567d18aabca"
        },
        {
          "alg": "SHA-256",
          "content": "d57882df21d689b17c21907b18d59c1cde15a6d25b32e5af4d5e996b72104196"
        },
        {
          "alg": "MD5",
          "content": "bf1ac641147228c744e5813c0cb36eb3"
        }
      ]
    },
    {
      "bom-ref": "96817501-505c-48b7-a93e-b0f3c99f0e04",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a5a3cd25e2721ca01d9acd7e58daa93e578b701"
        },
        {
          "alg": "SHA-256",
          "content": "170479fd0c19f53fa6640a586acb8271104360bb4ca29bf91b2c91453e12d240"
        },
        {
          "alg": "MD5",
          "content": "eee894dd40a733c88289e063c09a0f55"
        }
      ]
    },
    {
      "bom-ref": "968f4197-59e5-4ee2-b6d8-bcf6d0f35d34",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/expand.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fde92777217960f990f72f13a8af17ae6bd20b6c"
        },
        {
          "alg": "SHA-256",
          "content": "eb8a9d5072afdcadab87e13dacf44de9d73f2779f6d87d91336d3f77ba730abe"
        },
        {
          "alg": "MD5",
          "content": "cce73828454c293e9d994d258f623a1e"
        }
      ]
    },
    {
      "bom-ref": "969683d8-930d-4868-b439-e27f6e374c5f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DST_F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "218c147a3d26bf6ec27344d1d32edfe2114a6766"
        },
        {
          "alg": "SHA-256",
          "content": "fed1d6bc9f43233aa46e63740d1ec3b6d8ce88bed2a84d7bb5e565b976855a05"
        },
        {
          "alg": "MD5",
          "content": "7b01495c44e1c597c120ec0c97aa69cb"
        }
      ]
    },
    {
      "bom-ref": "96a961bc-c4f6-4ab1-a5a1-dbda9d753ef4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderGz.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "187df00a5e28837d94f3750d248faa7930ed8f85"
        },
        {
          "alg": "SHA-256",
          "content": "63fd072e3c310548b79af8b45de527918107e76a5d05f21ca5075b914d643a42"
        },
        {
          "alg": "MD5",
          "content": "8d83ea6baa58afdfd3349c95691adac7"
        }
      ]
    },
    {
      "bom-ref": "96ae92a6-d11c-423a-9b71-95e05505d615",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ftpput",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "96cb4d54-ddab-4e4c-8e10-64bc693c7109",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_alert_alerts.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83cb2a6910fb33e57e12ce539f62507571ded40d"
        },
        {
          "alg": "SHA-256",
          "content": "b210d18380cb6ff781f740d1c422e2ac935c7cb9edf88cdb47cc366cd8f93541"
        },
        {
          "alg": "MD5",
          "content": "a8aa58206a64b80271c8af26d4034c0f"
        }
      ]
    },
    {
      "bom-ref": "972eb561-b426-416b-a465-449b5216f799",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libe2p.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b5d34c603dad67131876a198ee5acb6bb94b0fa"
        },
        {
          "alg": "SHA-256",
          "content": "3ebb8f58cd41f3ae8ffe22939e2307dd72068263926b463e813462b1077b5ecf"
        },
        {
          "alg": "MD5",
          "content": "827a4409c74b5dfcc049e1e84dcc687c"
        }
      ]
    },
    {
      "bom-ref": "973c6f32-06d8-477f-9cd6-668635d88f8c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcLeakLeakDetectionExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1aae7786b59624ae70f4f238c0f7a5fd0173d1d6"
        },
        {
          "alg": "SHA-256",
          "content": "7f74b69ae80767aa6a79f3d22d4cf10d32466eb91af88184b9e162d7fb814c42"
        },
        {
          "alg": "MD5",
          "content": "a80ade1354f6c2b6a8201d2f4ffb3eed"
        }
      ]
    },
    {
      "bom-ref": "975e1f4e-a2d1-4d6d-a133-aee90e168fe3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86ed64d0829e3c86af6bcc19bca10419618cf046"
        },
        {
          "alg": "SHA-256",
          "content": "f283c1acd9a237ecbfeac228c035e18b47eaf171a0655c74d3b06102332f799c"
        },
        {
          "alg": "MD5",
          "content": "10d02142393483bff965c2d2f63e0b51"
        }
      ]
    },
    {
      "bom-ref": "9778f127-f545-4060-a4d0-0efe1a6e525b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4d65435dab6a2831a6db586b6d402fd0b143032a"
        },
        {
          "alg": "SHA-256",
          "content": "f322f32a57ecad7d9af97432137ce85c307a68b07173cf07d7ede4a1012f7658"
        },
        {
          "alg": "MD5",
          "content": "91cd85e3a473ba7055d8745c887c9e24"
        }
      ]
    },
    {
      "bom-ref": "97989831-c41f-4174-a8d7-4bd88a5ebcf9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/readprofile",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "97adf89d-e617-457b-94ad-b4997241d701",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_13_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61b6cc51aaac7e54050e308df9f74ffc3fe45bb1"
        },
        {
          "alg": "SHA-256",
          "content": "4ef12ac56b1c32c9211f5a9ecfdc1881f6e962657613a76f2ca7142a4e2786e8"
        },
        {
          "alg": "MD5",
          "content": "900fd84bb8693643fd8d9dbd604fa2d8"
        }
      ]
    },
    {
      "bom-ref": "97ca5f71-6917-418d-914c-e23c35ee3c7f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_system.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "12ee418534f5c8f651442abce39909b22a974957"
        },
        {
          "alg": "SHA-256",
          "content": "12e857d7e88441bd8ccc905307092f8b3c8279b7d60d2046e177accd46ce7f9b"
        },
        {
          "alg": "MD5",
          "content": "c65d4536eed70407f3e3ec49334b87eb"
        }
      ]
    },
    {
      "bom-ref": "97cce4a7-d6a3-4f9c-8e3b-f89e696253a4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/bpn_cpld.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e44605234afa03cf285213f70cc565c2c1f7e562"
        },
        {
          "alg": "SHA-256",
          "content": "2ecb4d27c60e77382abcfaf5f5bc54d4202cf83c884b0d7acb5d03da570f4cd2"
        },
        {
          "alg": "MD5",
          "content": "a9e12c03e035cb23aac057cc9d1344e9"
        }
      ]
    },
    {
      "bom-ref": "97fae90e-1b27-4ab2-acb8-e82d3324f41c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.G1SMH",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9326921c59573c23096f23b06f137ed6bec44af6"
        },
        {
          "alg": "SHA-256",
          "content": "ce5d8ee4e8d22bfef4cbcb5a5972b58feebf57a7ebbb0aafdee3caa4dee57547"
        },
        {
          "alg": "MD5",
          "content": "d53b281879338ab84c5264a74500ed5b"
        }
      ]
    },
    {
      "bom-ref": "9802d57c-9523-4693-a538-3eacf7eb8cc1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_16_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7ce7f0bbb30446e96da70e0614fa745f9fccefeb"
        },
        {
          "alg": "SHA-256",
          "content": "7bb84d17aa798bbcf6734446f09642c3353177919885debac0c40a823151fe19"
        },
        {
          "alg": "MD5",
          "content": "d75df6b50a8720c16c4037a224a1c6f7"
        }
      ]
    },
    {
      "bom-ref": "980ec1d6-e971-4c81-a42a-c182990f92b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/system_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df2209e691aa324017e2b6ed9c3d73f058a967f8"
        },
        {
          "alg": "SHA-256",
          "content": "f6b5bc0361ca05e20ddd0c650e22995064773f5207e84880a0f4c52364ea1d93"
        },
        {
          "alg": "MD5",
          "content": "2d6c9eabffb13f1ebfbc6448e1abc2f7"
        }
      ]
    },
    {
      "bom-ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fdformat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "983fcb38-1117-4ad3-8fcb-e2345525ae64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libgssapiv2.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c541b111d357841919d2d1bd64336b57303a24f6"
        },
        {
          "alg": "SHA-256",
          "content": "7a362fe229fb410f24aea2b1bdc86276e036258f2fe8ceead61179d71cd54d49"
        },
        {
          "alg": "MD5",
          "content": "f7d2d1f089e9a4353f9dd66b825731d9"
        }
      ]
    },
    {
      "bom-ref": "984a9e76-6fc3-47e4-9ea5-18c6fed3d60e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssapi_krb5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b57a3c32db8ba424f5612e0a912e12303d197cb5"
        },
        {
          "alg": "SHA-256",
          "content": "101d2bbfa691e8a3c4fe0b9e6a8b3100318fd6e69dcc049b4cbbf558c95a25bb"
        },
        {
          "alg": "MD5",
          "content": "f7411491c74b7bb379688337fcbed1fa"
        }
      ]
    },
    {
      "bom-ref": "98567788-6567-4c1f-b1e5-33542a01f4eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcObjectImplSwapI32toP32.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "022d33b2039d9c6eb446acdf2a82f8959f108428"
        },
        {
          "alg": "SHA-256",
          "content": "fd6608d364e3eeaf5386a95dd17982db9e2732998bd387c1be50ff313f47fa48"
        },
        {
          "alg": "MD5",
          "content": "00ce69808b70439147ab6428472f2d87"
        }
      ]
    },
    {
      "bom-ref": "9883e6c1-7f6a-4991-8fc7-b562b4fe19f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/libmac_x86_64__V1.0.5.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3930c9ed768acc7c5d818a7d084b40c14e93075"
        },
        {
          "alg": "SHA-256",
          "content": "6cce4d9e2d2c688c9b26c35930d42082557691dd2ae867b4551ae2264cdeaf43"
        },
        {
          "alg": "MD5",
          "content": "db00d2c13c7b55bf05bb33575839bce7"
        }
      ]
    },
    {
      "bom-ref": "9890329d-d43f-4cb3-8bd1-edaac7f16bd6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/world.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4157cb84b990f047787ab544228b6b4577a17973"
        },
        {
          "alg": "SHA-256",
          "content": "5bb2935b4eabed63655f308feb6c64dff1867e55d5c602316b7b9d362a75e49a"
        },
        {
          "alg": "MD5",
          "content": "c542a2161bb862935f0d7b746ac5dbf5"
        }
      ]
    },
    {
      "bom-ref": "98b4936a-3ff6-4f13-9444-65939a1773c8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/tar",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "98bc2d80-a31c-4590-a9de-424918660ca9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcmpisfcc.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e08b27a10f7f43b186730dbd727dc38f2201d15"
        },
        {
          "alg": "SHA-256",
          "content": "2398ac01dda9642b8038dfcc35c9529ddbe0b651ede553d413d5c94579de4485"
        },
        {
          "alg": "MD5",
          "content": "d23f6606632402f0deef01a0d4b99181"
        }
      ]
    },
    {
      "bom-ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libc-2.36.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbae0235fb64a2369f2bddcee8cb962526de88dc"
        },
        {
          "alg": "SHA-256",
          "content": "c67d5eb747b323a199c3035024d9bc93779d3a47a9cbd286fa476e6d6f001dcd"
        },
        {
          "alg": "MD5",
          "content": "c73c76b05317d4761a2babcf15d3b74f"
        }
      ]
    },
    {
      "bom-ref": "98d7e6d9-3f20-4e6d-897a-78466ea002b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cut",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "98d8ccb0-44e9-4a6f-b062-8caac7d7962f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/LicenseManager.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5457ecc8dbab130f98cec5ab9a2646eef0db4c28"
        },
        {
          "alg": "SHA-256",
          "content": "0bf63059d09a2e03d643acd398b0c28736c82cb676c22ddb304a6d356583540f"
        },
        {
          "alg": "MD5",
          "content": "bd75c15c3bda1c7cdfa2101c52028336"
        }
      ]
    },
    {
      "bom-ref": "9906c2aa-5bed-4e18-8276-9117116a1956",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6e5e88c08806943c8a2db556ad11899da056f5f"
        },
        {
          "alg": "SHA-256",
          "content": "2e2387ab724b0161a2680aedcbfb4d46069fe46980cb490ff6e3d9676313f7cd"
        },
        {
          "alg": "MD5",
          "content": "b4d53ab166b9f84f664db02e4c75b6f6"
        }
      ]
    },
    {
      "bom-ref": "9911d254-fc7d-402e-a525-52503f750d32",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/makedevs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9916850b-b79b-4f71-bf9c-1873cfe789ce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/reload.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "da08090cc3dcf707360b55d1528649147e4b468d"
        },
        {
          "alg": "SHA-256",
          "content": "e5d91a66aeec4b66f9499f833cffa234a97698d3193743451f236720588b339f"
        },
        {
          "alg": "MD5",
          "content": "5114f1fcf1e14958897e22321792be57"
        }
      ]
    },
    {
      "bom-ref": "991a5d3f-1633-4ce7-b9d6-4f91dfb5a2b0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ExtendStorage.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20f7d791915e1b72c29522c2e3240e12e5f0b5a1"
        },
        {
          "alg": "SHA-256",
          "content": "bb7ac5c02e727498d3ce94890d053a10cdb7bac42ebf47365a5228498fccd0c6"
        },
        {
          "alg": "MD5",
          "content": "bb38cd8d8e62de246e2970ec9a483796"
        }
      ]
    },
    {
      "bom-ref": "99236c01-169b-49d0-880e-ac6f1f2bc44a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/telnet",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9933da37-aff9-4593-8382-c951f944bbf1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/cpu.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "900502f041de07f5f345c96c95c20821b60a34c6"
        },
        {
          "alg": "SHA-256",
          "content": "2f08bdca85dd7e0840468944d0fcdaaa5aa549d1e8801a04a79271051c61c99c"
        },
        {
          "alg": "MD5",
          "content": "d3eac3b34f803e680b6574d3f1a31e53"
        }
      ]
    },
    {
      "bom-ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gunzip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "99375eef-5c46-46d1-ac78-66921d8d9e5f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/$metadata",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b3b3b16ebedec14728ff8432b887199247aa6c0"
        },
        {
          "alg": "SHA-256",
          "content": "2e11093ea4726641334b57752ebd49d979cc03205037e9148ff96fca1ad4f4b8"
        },
        {
          "alg": "MD5",
          "content": "11fe02e94240db54818808ff20da3029"
        }
      ]
    },
    {
      "bom-ref": "99393507-1063-4fd4-a1a5-71b7fa4f775f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_macro.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "534b24410f986376dde0d0e83107687eb52a27e1"
        },
        {
          "alg": "SHA-256",
          "content": "a8f755be5bf217d90c63af407177a428231354310b8409afd0795a90d4ad3d7f"
        },
        {
          "alg": "MD5",
          "content": "dca27eb4a004c1f092f43bffaaedb8ba"
        }
      ]
    },
    {
      "bom-ref": "99611a6d-566e-4a15-9843-4ab2d8edee38",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/x11dp_trouble_shooting.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ff1b901762e94423167b9abbcfac9daeea3038fd"
        },
        {
          "alg": "SHA-256",
          "content": "5dbb64eef75c4518ba0bda62ecd775784cc0a26d856f5d933224bc70c6faf7df"
        },
        {
          "alg": "MD5",
          "content": "a669cd32d1b651bd552a9bb6fc1c3fc5"
        }
      ]
    },
    {
      "bom-ref": "99902997-d645-44b3-8e07-2f70484e0e3c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamEthInfo_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ac9323d521830db8d2e432579537fccdefc0692b"
        },
        {
          "alg": "SHA-256",
          "content": "5397f8ec037129605499dfe3cddd1c99beb870ed1e614d718f24b2d101a533be"
        },
        {
          "alg": "MD5",
          "content": "b11221ccf50313479c4f69b56357bb70"
        }
      ]
    },
    {
      "bom-ref": "9990f101-aecc-4117-944d-3ae1bb6baaee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_PowerManagementService.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "924ddda6ba0e6a773350897a371e900af71791f0"
        },
        {
          "alg": "SHA-256",
          "content": "fbf98c37d78b7ef1054fbfe97bd9fc5fd66edbf0a3cb962feeb6267a9319a6c4"
        },
        {
          "alg": "MD5",
          "content": "0123fb8569a7a017357a7ab4abcd94ca"
        }
      ]
    },
    {
      "bom-ref": "99bc5f7d-5b87-4167-85be-ed144a5673be",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libdns-9.18.24.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4427cef8be161c503b3e275f49b3a00dc18a5359"
        },
        {
          "alg": "SHA-256",
          "content": "9ba84029f1b4690c4bf214fc6f8a2cb5d2842fa6d4e49e2db07c4e5747e3ebbd"
        },
        {
          "alg": "MD5",
          "content": "f72cc1634c78911ca37c405fff860419"
        }
      ]
    },
    {
      "bom-ref": "99ff3cd4-a0da-4b13-a18a-4d940003ede5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblzma.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ef77d699dba364df0bc91a98228e2fb6e6d4a95d"
        },
        {
          "alg": "SHA-256",
          "content": "89c182e6d9172516dcb2e497f7bec8428d5d2395b23e4646df1bade8177beaf9"
        },
        {
          "alg": "MD5",
          "content": "e0fc14c034c2c291e4db5c2084263f57"
        }
      ]
    },
    {
      "bom-ref": "9a1e088c-0b54-4b7e-b814-8d01eb28204b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpmibs.so.40.2.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14b28105a7c561c5ec6593fc127e22f19b2cbc23"
        },
        {
          "alg": "SHA-256",
          "content": "bad72adb3f6479c37f034b828db2cc7f2410fd1d5fc5b832dbd03fe308953436"
        },
        {
          "alg": "MD5",
          "content": "b73f4eb676d243bb243cbf8833b0808e"
        }
      ]
    },
    {
      "bom-ref": "9a3f439a-20a6-41ae-a317-a3540d5dcc6f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/help.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a76b05757111ec9170d2244c3fbf1563812a266d"
        },
        {
          "alg": "SHA-256",
          "content": "df66c0b4d86fb880beb994a8a351c89afef9c1efec826d7146efe9f51578273a"
        },
        {
          "alg": "MD5",
          "content": "2423fe23d2609611f783f1a87db469d6"
        }
      ]
    },
    {
      "bom-ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/inetd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9a51b79c-a2a8-48f5-b131-43b761694c17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamLaneInfo_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "51bb8597e979095c6faac21f425e3b67accd43c4"
        },
        {
          "alg": "SHA-256",
          "content": "1c266ad66c9b5e8b9d1f34d24a7ba22775acd4bc85070dab52cfb97f42de1a91"
        },
        {
          "alg": "MD5",
          "content": "ebeb294b46bc1415e784dd7b320bea87"
        }
      ]
    },
    {
      "bom-ref": "9a7027ec-ccf4-40ae-9514-97d4d4f922d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrack.so.2.9.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21b8b72195068be5bd3989d08ae6b217cf97a0aa"
        },
        {
          "alg": "SHA-256",
          "content": "cc1ab4c1737899d07a259590f14a83fbe7217cc3147c3c56f63af014aea58ad8"
        },
        {
          "alg": "MD5",
          "content": "74381dfd63028781d4c750ddeedf2484"
        }
      ]
    },
    {
      "bom-ref": "9aa0862f-94c7-49ac-bdbf-8a74717e2d28",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libz.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ceb65b531fe1dda0eeaf2cabbb1b280d69c0554"
        },
        {
          "alg": "SHA-256",
          "content": "9c28915c75552190c20ea2466bd06536e1b6a09768bc73b4ed3e0043e903c21c"
        },
        {
          "alg": "MD5",
          "content": "52904b92629275f8fd329925ba5524fd"
        }
      ]
    },
    {
      "bom-ref": "9ab4adb2-166f-4973-ad10-0276c09748ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "793a6a2528f89d9fecd58f4af7a8ba6a7a1fdf3a"
        },
        {
          "alg": "SHA-256",
          "content": "650033669a827ac4542844eede28f727dffcd3e8a463ebe64df1ee7075d1760b"
        },
        {
          "alg": "MD5",
          "content": "8441a32b91d92baca042e242457805c8"
        }
      ]
    },
    {
      "bom-ref": "9afdf872-441d-4f01-9d0a-c782a3bf4fa8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamTemp.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3945a9bbedec82ac963320a5a59f739cd31f48a"
        },
        {
          "alg": "SHA-256",
          "content": "1268ff8cf4ab48dca2caf07a3b9f8456a0019185b10a90ffb9cfc74cead588b6"
        },
        {
          "alg": "MD5",
          "content": "4eed2049fdde18aaad18b196d8fc197f"
        }
      ]
    },
    {
      "bom-ref": "9b04defa-3fd2-4ed4-babc-c67f6e95f05a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_license_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b6c81dbc5e71e2b909e88a6da2748eb941c23a2d"
        },
        {
          "alg": "SHA-256",
          "content": "aae33bd49606153a10e3538435717f72e3f051e641b83f057539e0e3ac159205"
        },
        {
          "alg": "MD5",
          "content": "16c47473d99380be64938d9385a695db"
        }
      ]
    },
    {
      "bom-ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ttysize",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fgrep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9b3b6873-c8c6-42b5-ae89-ca74a1246f09",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libdl.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a681b98e2358fe4e64f5d311a5425563dd52bde"
        },
        {
          "alg": "SHA-256",
          "content": "d8bf9201ed1cd88e6c830fd20e34dd1ba0c313c8105b0f1645a9a8cd621e99e4"
        },
        {
          "alg": "MD5",
          "content": "12e5894175bcfe681ce74e0e3e12fed1"
        }
      ]
    },
    {
      "bom-ref": "9b4219f2-f1bf-4345-b824-ce3630a23290",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/scriptreplay",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9b56b40b-f121-47fe-a43e-424285473e21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit3combo-bmc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61422649e3e26f3b6d6fe708c8059e5db14a7cc9"
        },
        {
          "alg": "SHA-256",
          "content": "bc41f5677851f54dffc8a42af4d168ec0dd543ae47874384cff457891bea5846"
        },
        {
          "alg": "MD5",
          "content": "fe9452d41858f2f423b8509ce638967d"
        }
      ]
    },
    {
      "bom-ref": "9b7679ed-adeb-4044-b9f1-5471d75631bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/banner_status_green.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72bd67807c78bcc1de8ccfe3cbab93337e384d0c"
        },
        {
          "alg": "SHA-256",
          "content": "b95d8a9cadc9e668441a5a7098aec4d3a3a0647476ebe3864242c99d6d06cac9"
        },
        {
          "alg": "MD5",
          "content": "ab10f34d53dcea914683d83942c7b829"
        }
      ]
    },
    {
      "bom-ref": "9b7fd6d2-ddbd-4823-b64e-4ce36403de86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/iKVM__V1.69.23.0x0.jar.pack.gz_extract/gzip.uncompressed_extract/2314606-4321635.elf32_extract/carved.elf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "68ea5ea2daacaf977daa4b573975264badc37758"
        },
        {
          "alg": "SHA-256",
          "content": "8f3ed3a6674aec4b5d5f1884ad5c6f95aeee8471570d9a02fc33d3e8f2081c16"
        },
        {
          "alg": "MD5",
          "content": "9cc95904a053ec9dcb0369b1cf1a90b7"
        }
      ]
    },
    {
      "bom-ref": "9bae739e-4ee5-4c7b-a103-e408a358c037",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/HARAIDController.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b99fe8c72b74a9ac4abade5d3c8ad7b6a116debf"
        },
        {
          "alg": "SHA-256",
          "content": "65b84515ed231fcbc27dad2b381625c302f175c3cfb12e6f2046ca912d78691d"
        },
        {
          "alg": "MD5",
          "content": "964132fd301e41eac19efe023d4636ed"
        }
      ]
    },
    {
      "bom-ref": "9bb40c93-bac3-45fc-985c-06c53693a5ce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/factory_shareOnly.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4ae756134cbfa5e7372d31e38a6c569cc5537a3f"
        },
        {
          "alg": "SHA-256",
          "content": "71e5767401aba1cdb702eb8f08db683526462807af11ce940e29b88ce3a86950"
        },
        {
          "alg": "MD5",
          "content": "b77279fe77aab3976e5ed1eb9d0ef275"
        }
      ]
    },
    {
      "bom-ref": "9bb564db-229b-4605-a8b8-c81e9756d621",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ssh/sshd_timeout.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "84668426ff27e927ebf0bea038e07501e4b4e304"
        },
        {
          "alg": "SHA-256",
          "content": "fef510386c0c300bca217f36af372b222e959469e0107805a26048b8f9e19fc3"
        },
        {
          "alg": "MD5",
          "content": "34bfd355f10c09360cc631f1421f43f3"
        }
      ]
    },
    {
      "bom-ref": "9bc085e8-3d64-4916-9616-a7c6972fee25",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/webfonts/fa-solid-900.woff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "43dae5c2482bfb5d04d896529600eb621181103a"
        },
        {
          "alg": "SHA-256",
          "content": "7dd5fcdf6f4b330bf82965887ef6b9196b8d27855eddee99ac04fb63de0e351e"
        },
        {
          "alg": "MD5",
          "content": "333bae208dc363746961b234ff6c2500"
        }
      ]
    },
    {
      "bom-ref": "9bee26a6-193a-4333-9ada-8f864d819dc6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RADIUS.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6707d1736ac811c929c20b405c5ecf09642f748e"
        },
        {
          "alg": "SHA-256",
          "content": "447aff84f05282c87f30df1a3254f6e65c394005f407380421e56d05c119bd48"
        },
        {
          "alg": "MD5",
          "content": "e9cf2c3fb32fcdbe13580c4e5a56b576"
        }
      ]
    },
    {
      "bom-ref": "9bfbb59a-a6b5-410f-a57c-7c0cdfcb26e1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logo.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a7d0225dd456c1fc58dc85b218957c366a17c360"
        },
        {
          "alg": "SHA-256",
          "content": "378d56ed81408c8aaef21fd23c44a37c6e72da2eeff0ab4343a99efc54d50937"
        },
        {
          "alg": "MD5",
          "content": "4b78d132fd79627afa0dd1fc0f755058"
        }
      ]
    },
    {
      "bom-ref": "9c059919-1c3f-4f13-92b4-c8ca1fef710e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/syslogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/sulogin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9c4070df-5538-4531-9535-3a3f18fdacb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcProfileProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7458b381de72fa07e43df287804eabd394c3acd1"
        },
        {
          "alg": "SHA-256",
          "content": "1e88e7dcb7176fccfbe02d53e3ab78366f891cf0de75a29b624654be3ddcf108"
        },
        {
          "alg": "MD5",
          "content": "2e7dfb2f40dc6fc2c225ce087892829a"
        }
      ]
    },
    {
      "bom-ref": "9c539493-2ab7-4b55-adfd-9a0316e33350",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/login.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65eb67734666a5a3fe3ad26815280bb5de5cdfed"
        },
        {
          "alg": "SHA-256",
          "content": "9abfadc09f60cee45a4707b3b7c082d93d0ed18327f023338a259182e3ffdf5e"
        },
        {
          "alg": "MD5",
          "content": "e614725d9a16fd941f5df76fdfc2077e"
        }
      ]
    },
    {
      "bom-ref": "9c6e1b60-0382-4c17-8a9a-daf94c2b656b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/ctrlaltdel.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34dc0b2ed8136c1cad87a3057c907fa53877594c"
        },
        {
          "alg": "SHA-256",
          "content": "fb04ed7701ec0c4b599ff2e03fbfb9caba06d4251547c9fc493b7167c3281268"
        },
        {
          "alg": "MD5",
          "content": "047049fb10521d08bac4305c2070d113"
        }
      ]
    },
    {
      "bom-ref": "9c74741e-6e7a-4f32-8089-4a754b4b5693",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFixedBootOrder.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4d6c0186fd5cbd977b7cda8719595dbe624501d"
        },
        {
          "alg": "SHA-256",
          "content": "7e88bf7ab34f94ba4b719a48cb57b471e42e7f59273e391998de4112ba6363ec"
        },
        {
          "alg": "MD5",
          "content": "4b65b1c4baf8fc7e7860694208865413"
        }
      ]
    },
    {
      "bom-ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/smemcap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9c935e29-e34c-4bbd-a646-59c3e6eb2892",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam.so.0.84.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea75a0aad0a60b0b5e53bd43cd73311b27982608"
        },
        {
          "alg": "SHA-256",
          "content": "c52bb517e517e2552d2cfc5901dcc583d300fa0d15ec66f654514f87eea19901"
        },
        {
          "alg": "MD5",
          "content": "ce1a1cb1ec6902d14de4e147ddd14b75"
        }
      ]
    },
    {
      "bom-ref": "9cb1cc6b-4120-404a-9d0d-4eb2c1a729ee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "91419044c6bd48a3286dd68f78f1eb9cd8264ccf"
        },
        {
          "alg": "SHA-256",
          "content": "ca6cf5947f06b05bc5faeb4b025e5c2bc7a88057873afb1eb1f7d6ea901e2738"
        },
        {
          "alg": "MD5",
          "content": "2ad942d5f8bf1b979eaeca5db4ed77ab"
        }
      ]
    },
    {
      "bom-ref": "9cd74508-51bf-43ba-8e56-3b4a96dee7da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamDirect_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "195c8dff300170cbd2dd62e53e7fe26956a36490"
        },
        {
          "alg": "SHA-256",
          "content": "115c35afa84771fb47d90cf2863d7599c454dd3f0ee706ab49df9b0d84e6e16a"
        },
        {
          "alg": "MD5",
          "content": "f39215b7d144384c486ee8d052c7604f"
        }
      ]
    },
    {
      "bom-ref": "9cdb26dc-296e-4204-b34d-27f861b1c8c7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/Base.1.10.3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03f570ab71f5007441a5c94121605cd3099dfc14"
        },
        {
          "alg": "SHA-256",
          "content": "7625f3c32f65481911baf33c8cdeebe8f3e9a8e436ed2ddf8602621fdc689162"
        },
        {
          "alg": "MD5",
          "content": "39290a44a332f1eef636dfe20b0f9ca7"
        }
      ]
    },
    {
      "bom-ref": "9cef097a-b805-4cf2-adc2-3de7a124c571",
      "type": "file",
      "name": "./126925-127188.crt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6f42548896a3c8fd311e94fa0eb3dfc4ec570e7"
        },
        {
          "alg": "SHA-256",
          "content": "39d9e930b58cd20e8aa86a5b86e088932350828aab9d0852a0447ef3d19cfb3e"
        },
        {
          "alg": "MD5",
          "content": "0f7886026720ca30de1722a0477cf3ff"
        }
      ]
    },
    {
      "bom-ref": "9d0571d3-23bc-4307-874e-602e68d91e31",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setfattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9d176419-8497-4185-ac3f-6351df75212e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power_p6.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5323690f8c606e418a9aea7ce809ec90f70c21e3"
        },
        {
          "alg": "SHA-256",
          "content": "9aeb6d7eadb04dd985006648935fef83e51558cdf035a1825105117d2f5c1803"
        },
        {
          "alg": "MD5",
          "content": "c8ce83f3f13fe005e34fd8f99318e9ef"
        }
      ]
    },
    {
      "bom-ref": "9d365d08-3b31-4aa5-a04c-773c369cacb2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ntp_setenv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a3d88f1eb82190cfa993ccaeba1431aa9cbc59a7"
        },
        {
          "alg": "SHA-256",
          "content": "9e0e68c1cd365963c93bb47d7304d5c1909b300aad4913b9cd0d3b48e32c17ed"
        },
        {
          "alg": "MD5",
          "content": "580f1fa4acfca3c7f83b63a5a1c5736b"
        }
      ]
    },
    {
      "bom-ref": "9d59d0f7-12bf-4f25-9620-c87f741d60dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamSecurity_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "590631e12359577b13c6b6d79017ed32fc035fe8"
        },
        {
          "alg": "SHA-256",
          "content": "a4c3ffa87e660eeb361f104072b17701427d3d1cf504d60d1cb2cea6302c494d"
        },
        {
          "alg": "MD5",
          "content": "636b18547d79e937a2a2b6ca1b3f3c47"
        }
      ]
    },
    {
      "bom-ref": "9d6d7833-db53-4b7e-9d3c-fe7546c6996a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/readahead",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9d9b7de9-2afe-4ae8-9697-ddf1c15b8efb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamSensorsVoltMon_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1bef6e2bd2e52371d188da51c40c4562798adc22"
        },
        {
          "alg": "SHA-256",
          "content": "ac13dffa131c93618ac54f83eeee55260f83b3c5d21e89b23802704e425f3bbb"
        },
        {
          "alg": "MD5",
          "content": "8891422dc51e86f2954e5cd31738006b"
        }
      ]
    },
    {
      "bom-ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lsscsi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9da14493-aa82-4a35-b590-b60c33a38b2a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/basename",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9dd649f4-ace7-4014-8992-6549bcc760ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9dd6b0b2-2753-49ae-a496-221c057768e5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/helppage.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d223cf9887fcf17f9d63a727ea4de951a01a1b3"
        },
        {
          "alg": "SHA-256",
          "content": "3b35489293f9fb008a334cb036973c7a354a594df4032ce6607dc3b60a744bb5"
        },
        {
          "alg": "MD5",
          "content": "3d1faf802281c93ac910ea032bbf2f97"
        }
      ]
    },
    {
      "bom-ref": "9e16af46-5729-4a1a-9562-3ffc825398a0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/rom_upload.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0dc7e4e921599aed1cd8ff0dc35d5b9909c62386"
        },
        {
          "alg": "SHA-256",
          "content": "333f1ef55ff5c1209fc3c2e6fc11e82475098e6be5b2e6310e5aee67d9fdee97"
        },
        {
          "alg": "MD5",
          "content": "61397f4473365fbdb9866d4c21052243"
        }
      ]
    },
    {
      "bom-ref": "9e5beb5a-df70-4084-a31f-fc3d413654c4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/power.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5a352273d88cdc7f3ac558293daea6d54c31f1d"
        },
        {
          "alg": "SHA-256",
          "content": "90187f7b33b546dab0783045c1fecb6b760852a41e07eb77baee45c8bfb42d50"
        },
        {
          "alg": "MD5",
          "content": "96eb3dc15335e7c51848de8698fd9f90"
        }
      ]
    },
    {
      "bom-ref": "9e868023-b4a8-4742-9e6e-6f0ef6eb0d1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libSegFault.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ba56760437558a0db40938289af177e9004a7a3"
        },
        {
          "alg": "SHA-256",
          "content": "9543c541b88bca79d8a6faf16548a717e8b5f4e3736e202f9e300a5d9ba005aa"
        },
        {
          "alg": "MD5",
          "content": "d1e1de5b669b0bce3d14136569b5f67e"
        }
      ]
    },
    {
      "bom-ref": "9e8faaf3-5600-4362-b7aa-02facf97063d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_green.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "63e927f197a3c6f18996e35266ac710ced85378d"
        },
        {
          "alg": "SHA-256",
          "content": "46fe9e49a3fa9775f84af2259b6dbd93949bbe7531ffb1df3129f5bad4ddf2eb"
        },
        {
          "alg": "MD5",
          "content": "61b9da29402f4d78444e6b932c741630"
        }
      ]
    },
    {
      "bom-ref": "9ea03db2-28f4-4689-a8a4-0c67c5d3cea7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/LldpService.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4097390203ddf545b34035af273cce1684877055"
        },
        {
          "alg": "SHA-256",
          "content": "93c9c64537f4e126a8c7212fb59bc7b4a6de40c50964453a0e1d826ca333a3db"
        },
        {
          "alg": "MD5",
          "content": "1d98ac4428ce75446cb4b3e8a99ad2b7"
        }
      ]
    },
    {
      "bom-ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/man",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9eb05dd0-f20d-4214-aae8-77c299591713",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dumpleases",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9ec90816-f4be-4472-97e4-db6e89d06c03",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SMTP_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c1347b2a72ca84e06ec8c271c3ddcfd7f337c691"
        },
        {
          "alg": "SHA-256",
          "content": "147e34070a9037b57adbb0df4e058a06966a7ebaaee65442a9ebe8fa76672f2f"
        },
        {
          "alg": "MD5",
          "content": "a38785f7cbf3385f71c1ca98f74b9e1e"
        }
      ]
    },
    {
      "bom-ref": "9ecd018e-6527-41cf-a70a-32aa6aaadb1c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unexpand",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9ecf6f64-41aa-47b6-a1ee-a582fc511f0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libscrutiny.so.4.16.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "716587415e47b2f04913f1520e20d06e7556bed8"
        },
        {
          "alg": "SHA-256",
          "content": "81aa70a266356533eac9a6d06664500fd18240e5c892508b078c1fe3424323c6"
        },
        {
          "alg": "MD5",
          "content": "d4e3e2679c8aaa1522ece78015c38386"
        }
      ]
    },
    {
      "bom-ref": "9ed8f570-aff8-4550-9501-be73f841d2a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/getCPU.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "28f704ca9e60e7e5463a6d227511161f91620c4f"
        },
        {
          "alg": "SHA-256",
          "content": "80f57e355a1e62f74f58bb5b2bec2f4de795f10b566e36ed1d3458784148b3df"
        },
        {
          "alg": "MD5",
          "content": "20fb188f144f174b3bdc18052d606535"
        }
      ]
    },
    {
      "bom-ref": "9f0e3c7d-f654-4e7d-aea0-12cb6fa2033e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/patch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9f1038d1-2e4a-45ea-89cf-839db7df6f50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcclient.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97c9839af0e3f24b87bd275ecba935093ee188b0"
        },
        {
          "alg": "SHA-256",
          "content": "682f65552ec84ff84d3cc9667ccfa52712b40b711d4a65937e5c34e3e4b00f76"
        },
        {
          "alg": "MD5",
          "content": "8fac9537ef369e82d113a8c0a0e9a94a"
        }
      ]
    },
    {
      "bom-ref": "9f16241e-ae54-4aff-9f9a-2fc56c0e39f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiod.so.2.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5461f101552bc82bd1abc1192dfaed3383d88fa"
        },
        {
          "alg": "SHA-256",
          "content": "4444abdc7bb7172e3bd39dae7e2f4d06233be60b90678b1eecfa5e96fe2e85f5"
        },
        {
          "alg": "MD5",
          "content": "368a3e6159b8205c22d2f5d2ee43eed3"
        }
      ]
    },
    {
      "bom-ref": "9f18e33a-2e23-4067-ba65-42203be9e8a4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcQualifierProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f2cdca51272b218dc2ab93f730f300fa86bfc8f"
        },
        {
          "alg": "SHA-256",
          "content": "79283d74e2ba0c80c72d77d3246c44d557ea51d793272ab8171ca91418c44eca"
        },
        {
          "alg": "MD5",
          "content": "ab7199ef8ccb013a7bb2d55512ca7a5d"
        }
      ]
    },
    {
      "bom-ref": "9f1b368b-0032-45af-9958-1f6fedecda17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcUpdateServiceExtensions.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "77e530a89977a8ccede04e1e405a4d5de160962b"
        },
        {
          "alg": "SHA-256",
          "content": "9363dde3d205df4330f00a50d58b808cb01996ff04d1ad6974e56bbcbd48fd0d"
        },
        {
          "alg": "MD5",
          "content": "cbecd18a9b500cdd4a9ddc47900f9f98"
        }
      ]
    },
    {
      "bom-ref": "9f1f6ab4-dc2c-4c2b-8405-655590efd8f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Node_DarkGray_Landscape.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "46c08ed6f202ae55c1fd407830148eddddad9068"
        },
        {
          "alg": "SHA-256",
          "content": "828e09b041ccd8bafed1c5d22a3d6fb8fd23a2f04364e8b37cea9ef597d64f3f"
        },
        {
          "alg": "MD5",
          "content": "5576987552d7f2e9a506eecc10fcaa5a"
        }
      ]
    },
    {
      "bom-ref": "9f230013-c918-46b0-b3c1-b79621ee19fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8bcac0eeb1ce4c2df476deae661e803ccfd74c46"
        },
        {
          "alg": "SHA-256",
          "content": "927a12cb6581ba50e7219ad7d7449cc313c841c21d12fd176bb3d43acc2c3dcc"
        },
        {
          "alg": "MD5",
          "content": "8da278bea5d74150a2a9d4d5fe2b1f36"
        }
      ]
    },
    {
      "bom-ref": "9f316c5f-82ca-4fe4-a2f0-2278a620199b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomain.v1_4_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "099856993edb974948cfa97a99bc49a2a5af4e03"
        },
        {
          "alg": "SHA-256",
          "content": "b4d38f947938024ab0fddfa8a01dea509009d0f93655b9cee081c4dce4f1c594"
        },
        {
          "alg": "MD5",
          "content": "a3fbe14991515b9f62d4384ad92744ae"
        }
      ]
    },
    {
      "bom-ref": "9f40e2f8-5f3d-45e6-bca1-58bc524629af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lsof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9f49314c-4e5c-4721-adc1-ae51a8cf2eab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libscram.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05846d6ce7b0adf863cf226acf203a14a0f46fae"
        },
        {
          "alg": "SHA-256",
          "content": "0a60aa782cbc7b4a26bbc0884b7660f2430844608e3f356c99aa20e4193683da"
        },
        {
          "alg": "MD5",
          "content": "0357e1497a56fc4a7fbbcc9bf9f5ae2d"
        }
      ]
    },
    {
      "bom-ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nandwrite",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "9f6119fd-a630-4e1d-b805-efc1ba469df6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/input.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05284470a38ef1432738fa65ac459adeab57307a"
        },
        {
          "alg": "SHA-256",
          "content": "5ce1af2c757096d9d338708309244a7f7c2d77b1e862249c2de2d3a7561d283b"
        },
        {
          "alg": "MD5",
          "content": "6aab3a41770ed818f3c934b78f066498"
        }
      ]
    },
    {
      "bom-ref": "9f766e0e-f7fc-41d8-bd8b-e42fd558cb51",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/snmptrap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "085cd17a0a7216096f16d12398aa210c4459427a"
        },
        {
          "alg": "SHA-256",
          "content": "7ba87ad904514aaccb460bec925e0a97e973242cde1ce7f9c64d363e85f7cbcb"
        },
        {
          "alg": "MD5",
          "content": "45fbc3f2656e64807a1b65f5708589dc"
        }
      ]
    },
    {
      "bom-ref": "9f7b4235-d864-44dc-836b-4295abae990d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14QBH_PLUS_2U_NO_FANBOARD",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d127c18342a73f06745477624ba67be77c0dc7ea"
        },
        {
          "alg": "SHA-256",
          "content": "8f72de16d6e48c20631f31663f4b40dfb394ff860e01cdecb777b7951f784246"
        },
        {
          "alg": "MD5",
          "content": "e8668f31c47e5fe054b1ccf1a29e26d2"
        }
      ]
    },
    {
      "bom-ref": "9f7bf55b-61e6-4839-97db-ab40906ff080",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "70237f21c5a918782007906989f52088f5a41925"
        },
        {
          "alg": "SHA-256",
          "content": "6ce39529929977f563666287c3d39a260ca3eec012d27a95f53bea00b0ae5fc8"
        },
        {
          "alg": "MD5",
          "content": "7b232ccebbb6b4f0874bf80cd9ee27fd"
        }
      ]
    },
    {
      "bom-ref": "9f8ab894-6254-4167-bcd5-44f3628688b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/factory_dedicateOnly.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d68c884adc5a635ac1c6111b28ee596377aaf8f5"
        },
        {
          "alg": "SHA-256",
          "content": "b33bb7852989a90d0fb3b637638bca83728d7bbfdae3b7fa8ca04199c4bc3311"
        },
        {
          "alg": "MD5",
          "content": "cb0a97f2e12de3696690fc654649e1b1"
        }
      ]
    },
    {
      "bom-ref": "9fa31581-335b-491a-af12-5bed296f4554",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/left.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "860536b884924783eaa6c4fd61f890c39a0d46dc"
        },
        {
          "alg": "SHA-256",
          "content": "647c35c19ecaeb2e9a3cadb6ed77e12c861c7aab3b6cbf4f668404bc9fea7f0c"
        },
        {
          "alg": "MD5",
          "content": "3f8c392dc954ae638e2da54aa6d1445a"
        }
      ]
    },
    {
      "bom-ref": "9fa34935-2bb4-4182-89c4-f8cca3d38f6f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/RoleGroup_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "63c45593dae4f15490c0f1e07a81f5d0f5c37480"
        },
        {
          "alg": "SHA-256",
          "content": "cb6ddf182f28cf5a2eff1ab5f4cbf015eddc12d253a96fc82c2c25e4f547fc44"
        },
        {
          "alg": "MD5",
          "content": "b3c861055f3118d10c8556e9ac846b4d"
        }
      ]
    },
    {
      "bom-ref": "9fcb811b-da2f-45e8-8e39-91c95ebf6cdb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropServerProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "af2ea750468e8bb7017ecb49c8069b250387b4bc"
        },
        {
          "alg": "SHA-256",
          "content": "b36c57073b7a92a867fe9e1b4fc4c52355d414ba0d775af5df852f032766a0a7"
        },
        {
          "alg": "MD5",
          "content": "68df59e96f42071d650f645fdbff92fa"
        }
      ]
    },
    {
      "bom-ref": "9fdd8b1d-c965-4ab7-8437-22c7ac9ce961",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/udevd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b0742eb8f099bac6578ba37948b72282edd76c76"
        },
        {
          "alg": "SHA-256",
          "content": "8b3b0502e53414b5aaeb9374a28eb693248031a391bf170b825d1f479db7cc41"
        },
        {
          "alg": "MD5",
          "content": "e4b3be15cdbfacd9d46589c0b67bfd48"
        }
      ]
    },
    {
      "bom-ref": "9febcbea-a12f-4b91-8b5f-cb1707264e06",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSG_OM",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "75d027cdcf14f7949ec6937b4ecb6cc536d62497"
        },
        {
          "alg": "SHA-256",
          "content": "440edba997f719d643ea96ca99eaa1c4657c86f29bb99449e262319a7f64fa3f"
        },
        {
          "alg": "MD5",
          "content": "167024df25ebd7ff53ed763edc4650cf"
        }
      ]
    },
    {
      "bom-ref": "9ff2de6e-02e5-49f8-ab9d-968acdcca76f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmartPower_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e436397b0342d347067f3f33db53479bfd865916"
        },
        {
          "alg": "SHA-256",
          "content": "9a0c7a2e01bd6f6ff6341c6c84440048cc52866382c76f16b0b2d299b3228164"
        },
        {
          "alg": "MD5",
          "content": "ca71b4476df0cd0ed1e8e64881e23d9c"
        }
      ]
    },
    {
      "bom-ref": "a057a2e7-7cae-4935-9e3f-35a949ec649a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBT_G",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5dc63bde7c18045d605cb8eac0e483fd1ba51c8"
        },
        {
          "alg": "SHA-256",
          "content": "2ad2e95989d138ab99538a4b759a0bfda96a51b029759f28e8ea02868ae85759"
        },
        {
          "alg": "MD5",
          "content": "4593a15c918e1603a9c8ad31ebe0aab5"
        }
      ]
    },
    {
      "bom-ref": "a06b08a3-27ec-47bb-aeaa-27d1d331f408",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/udpsvd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a06fb4b7-267f-44d9-9446-89dee566f1d1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/stunnel/dhparam2048.pem",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f245983d7cd48ca263121a6ba75f4165b691048"
        },
        {
          "alg": "SHA-256",
          "content": "9a89d3a434381d37bf21ef4faba7327ab4bf0b73096846feee90d750b2418488"
        },
        {
          "alg": "MD5",
          "content": "cfab59a75caad4e8824f31bb4886884c"
        }
      ]
    },
    {
      "bom-ref": "a0740287-b5fa-4b23-8b95-1173e26c285e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/check_consist.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "001f98a8a47bc6581e3c5fe8a827f56349ef322d"
        },
        {
          "alg": "SHA-256",
          "content": "e2b0ecd34b68b8c73137531964786792e843066cbbc4334054b610b4635ff815"
        },
        {
          "alg": "MD5",
          "content": "b258010f331aaea43f1b7612777eb810"
        }
      ]
    },
    {
      "bom-ref": "a07d0066-a58a-4f2f-a3e1-6ced5b176cb0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_profile.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbe329ebcf3176e0f0c3818e5c34b1bed0f90112"
        },
        {
          "alg": "SHA-256",
          "content": "3dd6e3cadad01f1a991272cfa11791318ee4173662bffb9024a6533b387ca0f5"
        },
        {
          "alg": "MD5",
          "content": "9925b0ce693d96ccc503380acc0fd359"
        }
      ]
    },
    {
      "bom-ref": "a0adcda9-c146-4074-abeb-64deec30e6f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcPowerSupplyMetricsExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72cec8364174eb8bb9fc73a9bde9a27af43d23b8"
        },
        {
          "alg": "SHA-256",
          "content": "2401ca9dc06963b07020d87614c374abaebb2087296556941908d7c064761fe2"
        },
        {
          "alg": "MD5",
          "content": "5720e3269c9b927e12937a7cf6493e31"
        }
      ]
    },
    {
      "bom-ref": "a36d0dad-adb8-4f46-8bce-d2613e6e58fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/dashboard/host.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b0f6e14f9d1a421ddbc22f13513829323e8de418"
        },
        {
          "alg": "SHA-256",
          "content": "340f8f68dc26f69d33975e9099d0045dd94abb8ac28cb64693889885866cadd5"
        },
        {
          "alg": "MD5",
          "content": "a216d5b264362fffe684825a78527545"
        }
      ]
    },
    {
      "bom-ref": "a0b27aee-efd0-4e9a-9b63-f0797cb3fc2f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mdio",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "09ae8b89f5eaae1c525fe3f25326afd5cde96dcf"
        },
        {
          "alg": "SHA-256",
          "content": "ee94fe0a10988c40204f25c0c89304379ae2cf526c66e6fdff8faf10ba60b690"
        },
        {
          "alg": "MD5",
          "content": "b179c660ebd076eaa491133ee788e740"
        }
      ]
    },
    {
      "bom-ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nanddump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a0bfe6eb-fdb8-47b3-b5d6-16689fe2099f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/insert.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "011aa73146b0bfd724d5f1272aa3487a80d46927"
        },
        {
          "alg": "SHA-256",
          "content": "27cbbb0dfcd56f4c833aad90ccbfa7722e72819680b33e3d651da561675e22d2"
        },
        {
          "alg": "MD5",
          "content": "4d3f6b16bccf7151d8eb90e1668d8ff4"
        }
      ]
    },
    {
      "bom-ref": "a0ca2e2d-7d58-4a3a-9f2f-b64ed2b5f543",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpagent.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5231565c91634d8299643bb1f6ea32e1862242bf"
        },
        {
          "alg": "SHA-256",
          "content": "e9203414ac7c2a92cbe25228a2428e46d4aaa58e38d460691db7a0f4f2b9823f"
        },
        {
          "alg": "MD5",
          "content": "570c9fe57a3b54aed6a3a0ac76856947"
        }
      ]
    },
    {
      "bom-ref": "a0ceaaf4-0cea-4e45-8718-986c42bf025e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamPCIeInfo_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bf3ad31b67807e40735552f3d83453f257c3790b"
        },
        {
          "alg": "SHA-256",
          "content": "9e31f0854b8efc82ceabf9c163ffb7594d5e7643bca7700bd9e42e2f3a58e724"
        },
        {
          "alg": "MD5",
          "content": "d45f6e3eb1eea151747ffefd555fd4fd"
        }
      ]
    },
    {
      "bom-ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/last",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a0e8af23-3b6a-4598-aef6-b59d96fe91c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/save",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db92b5adc78e6dbfc61c9e2aa3991ea30a0ee8fd"
        },
        {
          "alg": "SHA-256",
          "content": "3592c588dcbe6f29017e55f7662af5b1a5c833437dfd11df3ba1e032954729f4"
        },
        {
          "alg": "MD5",
          "content": "90dc3f5c5e20cc80d2e9b28f81253b5c"
        }
      ]
    },
    {
      "bom-ref": "a0f14241-210e-4a10-a373-5669edf360d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcPortsExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9090ff4a21c9fff60bf45cea053c520ddb721959"
        },
        {
          "alg": "SHA-256",
          "content": "1ef9c25b508b51350ab2c0f377a84f0c64a5482811016dc6fb9362b344562018"
        },
        {
          "alg": "MD5",
          "content": "0bbb53e735d1e985061efb4cffeefaac"
        }
      ]
    },
    {
      "bom-ref": "a0f9e923-6270-4246-aec9-3c9388cd6c7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit3combo-bmc.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61422649e3e26f3b6d6fe708c8059e5db14a7cc9"
        },
        {
          "alg": "SHA-256",
          "content": "bc41f5677851f54dffc8a42af4d168ec0dd543ae47874384cff457891bea5846"
        },
        {
          "alg": "MD5",
          "content": "fe9452d41858f2f423b8509ce638967d"
        }
      ]
    },
    {
      "bom-ref": "a0ffaa0f-81ac-4d2e-84f1-3582743c76f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pldm_c2_update",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e0fe0dd78c678027e0a327d7836417d2cfb9d0e0"
        },
        {
          "alg": "SHA-256",
          "content": "009d17e9a31132c903a8e0352e05e48ed0821ab4dcdc210da18642cda024250e"
        },
        {
          "alg": "MD5",
          "content": "1118b1ba158aed5bb11c6a16edafff57"
        }
      ]
    },
    {
      "bom-ref": "a11a5bf3-4457-464d-a646-782745329a04",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsVoltMon.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "534f8351fff63bdc78c40b83dac0272ba9da0866"
        },
        {
          "alg": "SHA-256",
          "content": "71cbf32dc2ada84c31d734bcd961a397344fdc7aab02522ac5ca4c1c7fd9da1d"
        },
        {
          "alg": "MD5",
          "content": "a07037e7c2a113aa72be4f1474e1d56e"
        }
      ]
    },
    {
      "bom-ref": "a1229573-300b-45d7-894f-327e56c12b36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcIndCIMXMLHandler.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cb0840e5388a9b8292e6ac8fd6a1e0d7a48c46c8"
        },
        {
          "alg": "SHA-256",
          "content": "e9c7a8e315c20e88884ec2ec66711efab8b9127b5c27e318f9598529adab103c"
        },
        {
          "alg": "MD5",
          "content": "b8e2e3615f2eb3ca07ea1f433cf25678"
        }
      ]
    },
    {
      "bom-ref": "a12e7e64-911f-4f9b-9844-5e4384d8ea97",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/rdate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a1384c4b-9b6d-49e2-9f9e-282540523c36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/memdump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "02da40662af3478f57e02a1204b7b31ff0107667"
        },
        {
          "alg": "SHA-256",
          "content": "8fa85a68d004b1e2a244caf08aed5002e9a665f7b10b87ba11f835730b5731b9"
        },
        {
          "alg": "MD5",
          "content": "cde31181d13408e7a7e90dd7ca4f9415"
        }
      ]
    },
    {
      "bom-ref": "a16ca291-401b-4c37-aa04-738b2b871cb7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBrokerCore.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "779c0cd06ea905815ea879d895b34b8b3eb36b62"
        },
        {
          "alg": "SHA-256",
          "content": "2cf252b6b66b821b81da98e8530af76c4f02fd48181d6a634c31074cbe6b536d"
        },
        {
          "alg": "MD5",
          "content": "e8f026ed88817f637bce55587cf7b327"
        }
      ]
    },
    {
      "bom-ref": "a181f788-e771-4dc2-9759-7cb24875069e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/touch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a18be1f6-d423-4687-8595-d7063399adbc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_PowerManagementServiceProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c38b3c09e620f751e1ebcbaf2b802ee5133e9c8"
        },
        {
          "alg": "SHA-256",
          "content": "6c76985c1d593d0f6dd75a363de2ba9fc4ee5bdd59f64874d3960949a1ca3d06"
        },
        {
          "alg": "MD5",
          "content": "ef4848c27cae1ab7f6155213833a4c79"
        }
      ]
    },
    {
      "bom-ref": "a1943271-032c-4813-bbdc-0f855504ef24",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsCurrent.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d9b3ac220641836d0dd1ba00dbc7e6bf6e9e3d81"
        },
        {
          "alg": "SHA-256",
          "content": "c460d005d987f7cb63448306484d2110a2a5819ac16960e5ca51fe1089a83314"
        },
        {
          "alg": "MD5",
          "content": "2674d795574f1455689fbd981ecb1559"
        }
      ]
    },
    {
      "bom-ref": "a1a15c86-cd1f-486a-90dd-73398d816bae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/setserial",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a1a909ac-4280-4431-b4ba-cf044c92bfdb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libreadline.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fae65cb41be48fac26d04260ae347cbfb5c63051"
        },
        {
          "alg": "SHA-256",
          "content": "b848d76b290ce6400e5de30a91d47744df9bcb1bb15fbc4f7c73ba744a8afa28"
        },
        {
          "alg": "MD5",
          "content": "5a82c15583df416e04508dc0343f2fe3"
        }
      ]
    },
    {
      "bom-ref": "a1ab9d45-4bcb-474c-8e70-2bd8d5ad9c57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/logger",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a1b99564-be64-44f3-a898-d9da73a02d06",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/loginErr.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b12f98178c51e9ccb0ed4313f7ab335ff88afbcd"
        },
        {
          "alg": "SHA-256",
          "content": "b96591bf07dd15e9d99be083abcc8fd728181c4ce314a3909d7c4dd2113b460f"
        },
        {
          "alg": "MD5",
          "content": "cd2f9b9722e0f9ac8d9dd54b49975d6e"
        }
      ]
    },
    {
      "bom-ref": "a1b9e1f1-c723-443e-9ba4-df0c91a50c10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/mouse_left.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "77049aac3352e6d667effac910d24145bfde9155"
        },
        {
          "alg": "SHA-256",
          "content": "9ef86d30460225869eb6d405fe5ad638ded3a733637fa7a27d476bd708e4a7d2"
        },
        {
          "alg": "MD5",
          "content": "3040633e63ee73b2b5b26bbab9e48b76"
        }
      ]
    },
    {
      "bom-ref": "a1c061d4-b0bf-45cd-9666-00301156c155",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblldpctl.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5b27957703d8a92ce28a70eaf3e516b9049b19c"
        },
        {
          "alg": "SHA-256",
          "content": "5cefc8e2c67312af4c7360e88a08f83e7208bd33eb744b203b00c2cb72d84250"
        },
        {
          "alg": "MD5",
          "content": "697bac27a7769941bf6ba742252b098a"
        }
      ]
    },
    {
      "bom-ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ping",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a1d78ed9-10ba-481a-b546-997d9071493d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmDomain_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3bd62e312c7f9e4eacc6324c47a738b0b224b453"
        },
        {
          "alg": "SHA-256",
          "content": "73976256cd625b1cfe6882457b53a86a77080f60e228161ecd15328e131ee81d"
        },
        {
          "alg": "MD5",
          "content": "3d1264d80e7886e35edd3246683f1e0d"
        }
      ]
    },
    {
      "bom-ref": "a1da8c19-8904-456c-b730-5da0c8ba4525",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/ld-linux.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3636a7eba387bb5e1ccf7ce671e7266831373069"
        },
        {
          "alg": "SHA-256",
          "content": "17ca988d6dfc4686b54da143476d0f13fab9a374bb61883e0172645a4a222369"
        },
        {
          "alg": "MD5",
          "content": "e623f9f83ab0e413b6f79cc08d8d4bba"
        }
      ]
    },
    {
      "bom-ref": "a1e45924-4db2-401a-a590-9a331ee90c58",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_UserAccountProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6af4c2ea5bc66941e511c53175be3f77cabef66"
        },
        {
          "alg": "SHA-256",
          "content": "2b18c71a6f86e509756c236e72d49353fe824a8fa9c4b0057a26da21f2ede6af"
        },
        {
          "alg": "MD5",
          "content": "7e4cd807b60d1c28c9330ae9a243caf7"
        }
      ]
    },
    {
      "bom-ref": "a3b2698a-7db0-4d6a-9417-21a81ce71a22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/printf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a2071b53-e309-48f1-aa6b-91ae52b8cba9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e6f0574c3bb0801bf81317a0d4af6a842686a09f"
        },
        {
          "alg": "SHA-256",
          "content": "08bb781112889e27d568580caa95e61c9315a59a7543736e2c338bfae5522363"
        },
        {
          "alg": "MD5",
          "content": "424053f7c41fd98b7b41065c24df0a4d"
        }
      ]
    },
    {
      "bom-ref": "a20aadbb-e09e-4b8b-ae46-43bd6aad34d1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_dns.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d9872e803b22b1532a804c0900dd4ecc773eb9e8"
        },
        {
          "alg": "SHA-256",
          "content": "9705e56719a80b219cd8dafd9cb6168462c06c090c7a79c77cb5c6a041c6c2f1"
        },
        {
          "alg": "MD5",
          "content": "709af7961678199dde2c91f519b53dd0"
        }
      ]
    },
    {
      "bom-ref": "a235d0de-ef91-4489-a478-3fbdd560b63d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/unblink.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a767536f0e15bba5afdef99ea94510c067318c0d"
        },
        {
          "alg": "SHA-256",
          "content": "756ad3ea1fe4f00f01b55f3e194a377a4c29b98e500ec17a5d2d5ef977b2b377"
        },
        {
          "alg": "MD5",
          "content": "75979a576fd28de49358eaa634cd25d2"
        }
      ]
    },
    {
      "bom-ref": "a23af4ac-005d-49d7-816f-7890c9cdd560",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libplain.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d790d2c17d12fa79d8ba0de21f37a2a65bc496d"
        },
        {
          "alg": "SHA-256",
          "content": "2e153c5f71bd55f24701c39d2d7343b97c680214b7209aae3c8dbc2f1e9322ac"
        },
        {
          "alg": "MD5",
          "content": "ca710a742c73d4d91fad7860fb565fc6"
        }
      ]
    },
    {
      "bom-ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/which",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a24c627c-7c84-4a6e-9c18-71d48b945135",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/kill",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a25c40bd-0d1f-4eb0-b2ee-1ee4225232e4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEED_F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c909ca62ae3081e815994bc1631ec193f68b62ff"
        },
        {
          "alg": "SHA-256",
          "content": "3f127f68e74f820e96eb9243dde7f165df9eba5db2d28aaf1a702474508d090b"
        },
        {
          "alg": "MD5",
          "content": "13eea7ffef95b20132af56fcdb87b627"
        }
      ]
    },
    {
      "bom-ref": "a2698ed3-89a9-488c-96c7-04888ded0d0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcUpdateServiceExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6b0fe9365aae2d6114b5b0dc133c738fc6cbba3"
        },
        {
          "alg": "SHA-256",
          "content": "6d0585ce26f6caf5a2c73e549b23232ea8f0a04cb0486081022fdd569e6cca5a"
        },
        {
          "alg": "MD5",
          "content": "67102d37a123062daed28497eff9cdf0"
        }
      ]
    },
    {
      "bom-ref": "a26aef1b-0365-4427-b0f1-0f7b00923f4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/overview_status.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "08f860cd1cab35ac9ec4cc4ad2b0e2f0057c5f1d"
        },
        {
          "alg": "SHA-256",
          "content": "0e3033b91a696c1917916c88e28bad9b00e9ddbb47b160cbd9d56a0e126f03a0"
        },
        {
          "alg": "MD5",
          "content": "bec03d811ebf1a8ce3515814725c9150"
        }
      ]
    },
    {
      "bom-ref": "a27f674e-f4b3-4a55-ad90-f556ad99b200",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/share/dbus-1/session.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3fc94738e9ed23914e5c37e738de5783809efa91"
        },
        {
          "alg": "SHA-256",
          "content": "206f009ddcf909422f3651c687b4623a5780fb7486c6d650e5332f57c00d6be1"
        },
        {
          "alg": "MD5",
          "content": "b64279d83119ecfbf867a8a0ee9d96fa"
        }
      ]
    },
    {
      "bom-ref": "a282aab1-1215-4456-81eb-42b2f6bd9e78",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libphosphor_dbus.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb145fd3b2cad5ece16eb0314d0afa2315ed9551"
        },
        {
          "alg": "SHA-256",
          "content": "a8cba2a615ab81d61aa2e75e5699c2ce8e5d4644a8284b8afedd890dba4f0dbb"
        },
        {
          "alg": "MD5",
          "content": "48704cbe291d9b2bd55afc8fd8dad708"
        }
      ]
    },
    {
      "bom-ref": "a2983781-976f-4ade-9b5f-93bb024c8f41",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_locale.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "91e7d62682ef51cec92de0b50edc66487315bc79"
        },
        {
          "alg": "SHA-256",
          "content": "a1c48a37bff9b8fb767178ea00e4dadf00281a63d83e7cb8c1fe4b67cf169c35"
        },
        {
          "alg": "MD5",
          "content": "2aeb499a0c37a5eb53ebbe258f490c4d"
        }
      ]
    },
    {
      "bom-ref": "a29d3707-fec6-458a-bf65-82a592aec319",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_ddns.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0f3ece12d630464af2a35253a3e264e7d3c839b"
        },
        {
          "alg": "SHA-256",
          "content": "4f681ad76b64e6c52607e194d79ba20eecdd71d0cbfca054607a47f4455b43b4"
        },
        {
          "alg": "MD5",
          "content": "247874714ddbcfcefd8db16f828e82f2"
        }
      ]
    },
    {
      "bom-ref": "a2af2016-4666-4adb-83d9-ad49bc9351dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiodcxx.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3b559ef12bda17bbe11367997ba030661aeb8a6"
        },
        {
          "alg": "SHA-256",
          "content": "3ae45b870156c88fd6ec59c63df0a75e41586868360e43c0d65efc0614903910"
        },
        {
          "alg": "MD5",
          "content": "b4f9310935b1458a945d70dd017adbb9"
        }
      ]
    },
    {
      "bom-ref": "a2b07bdc-e54d-4e65-91e4-10dfc9cdf820",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libattr.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0dc02667c1451329e26879d97c53bcae6a8d914"
        },
        {
          "alg": "SHA-256",
          "content": "7f50f91cc02a8bf12119b5d4ce81273c69e1fadd9be499bde0f43c47d0026e07"
        },
        {
          "alg": "MD5",
          "content": "e8feb6b8ac215b468839e2ac31a2f90b"
        }
      ]
    },
    {
      "bom-ref": "a2bf1789-0b66-4299-90cc-dc8cea6a9228",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfuse.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd14575ff1d42b6f6821f6b227ada95dc435a3cd"
        },
        {
          "alg": "SHA-256",
          "content": "5f05c0d27c4c697920def19f3108a3c8634eceaf13565bcf017c5933ff30457a"
        },
        {
          "alg": "MD5",
          "content": "cb7d57930c79fa5537837e65f93596f9"
        }
      ]
    },
    {
      "bom-ref": "a2cfe5e4-da16-4a83-ad1e-9f12c19fd836",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libiptc.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2baf805c793e28600f0d0ebb9e903dd83c98c9a0"
        },
        {
          "alg": "SHA-256",
          "content": "7d439bf191c1a7ad0c18d9ba4906d5d1dc4df8d21811f15ee44df0333a372566"
        },
        {
          "alg": "MD5",
          "content": "341fd6be8b899d63656c014dc0ca9ac4"
        }
      ]
    },
    {
      "bom-ref": "a2d0f816-8490-4f26-97f7-8262c4010588",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOam.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e97ef7af7b959cb2e0810fb084b33eeffad2572"
        },
        {
          "alg": "SHA-256",
          "content": "5257946c05bb97936b2277393e28fb4f699655fa05fbd9da6cfbe6ca80656d9e"
        },
        {
          "alg": "MD5",
          "content": "64e2061c61c6803afc76ac0ba2c0eb47"
        }
      ]
    },
    {
      "bom-ref": "a2e133c5-55c3-4926-9d3c-daece851efa7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_15_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df72a97406e96e3652f6856d3055688e9eb35db2"
        },
        {
          "alg": "SHA-256",
          "content": "feea9d11e58a2deced8f50ec29243e44fb492beedfd06108efc98e9a2030d1b5"
        },
        {
          "alg": "MD5",
          "content": "baaf4fce66712e08960e4dc8d3940810"
        }
      ]
    },
    {
      "bom-ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/rmmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a311326e-7f3c-48f3-b605-4aeb766df3ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ExtendStorage.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "330e67bb62831cec0dd54b2e8d0162e2c38818b3"
        },
        {
          "alg": "SHA-256",
          "content": "c1f81537041ada0a906979c139e8858694ca14b4d215b4868270bd346b38d7f0"
        },
        {
          "alg": "MD5",
          "content": "86ed2155ad697048986bdbad184765a4"
        }
      ]
    },
    {
      "bom-ref": "a336ab24-2ddd-4d2f-9f98-cc3d03b72daa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_17.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b879a80f0c1fa696859e8b37d76f32f1a669bfc0"
        },
        {
          "alg": "SHA-256",
          "content": "e4b4e33cf388c936b5dbe60b7f55525541f4af561772637ec9f601521c1fad9d"
        },
        {
          "alg": "MD5",
          "content": "6b3d142910cc198fb7173556ce934940"
        }
      ]
    },
    {
      "bom-ref": "f3294002-7e34-4e67-923a-ae514cf25637",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/EBML.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8dda8f9600cb2420b9bbd6a23723736ed2bf66e3"
        },
        {
          "alg": "SHA-256",
          "content": "02411df426f04abc9b7583070e5421b804273d46ecad2a6979e3dd81933e7b39"
        },
        {
          "alg": "MD5",
          "content": "83f83a10c4980d333fe08c705cf13342"
        }
      ]
    },
    {
      "bom-ref": "a7503cf4-ded0-4f83-b203-f51b01fd84f8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SupermicroAccountServiceExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "444add8305f97a780f96d1b1271b63da9031b9ea"
        },
        {
          "alg": "SHA-256",
          "content": "f6793e4f010a06c676f1ece51f7f07b03930e7b787fb9ec4d2fb99837266f978"
        },
        {
          "alg": "MD5",
          "content": "5740598fa9ea6ff9879aa53ececc53ae"
        }
      ]
    },
    {
      "bom-ref": "a752ea36-5f91-483d-bca0-f4f012007620",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/QueryLicense.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8312fe7b2b803db9e5dd340787599c70c7133d71"
        },
        {
          "alg": "SHA-256",
          "content": "6f2625e27354f7835b24ac753121de224e6a41f41f4a5ad7a5f58ebf6ac464d2"
        },
        {
          "alg": "MD5",
          "content": "fb76a4ff87fbbf74c02a9634d5b93428"
        }
      ]
    },
    {
      "bom-ref": "a76fd725-d72a-49c2-b4db-296f744c88b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/remove-shell",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a78ea411-cf38-47a3-aa8e-b0340c3c921e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f2df0610f2c566fc78612e335209665ccaaa20ad"
        },
        {
          "alg": "SHA-256",
          "content": "4b5fba041fdb5e80d98ff63486ac9634209d96ac2aaef13ff69a78ee3aaf0cb0"
        },
        {
          "alg": "MD5",
          "content": "ee26d078d9409de67b779ed0c49edc46"
        }
      ]
    },
    {
      "bom-ref": "a7b7c724-bca3-43cf-bdab-d0a194b8f983",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/x11up_trouble_shooting.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "309b708e148a834408a21b95b3efd4f690016c94"
        },
        {
          "alg": "SHA-256",
          "content": "908e508e4ba0ee3dd4cdd5236bdece3a62e602c3d4963140e8f822c7be5dd1d7"
        },
        {
          "alg": "MD5",
          "content": "207d73ca044636e90a9ccaf2a692d82c"
        }
      ]
    },
    {
      "bom-ref": "a7ff2c22-6c1d-4bdf-b550-0a4d88220730",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/i2ctool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "77e06db278565330d0b9df101bea7eae2f00eb23"
        },
        {
          "alg": "SHA-256",
          "content": "de329710128fbeb8c87eb810f93b2a3180a5f542bcd81f3b2ccf0975128d0c4c"
        },
        {
          "alg": "MD5",
          "content": "81409a725be2dcaf023e55bcc4a724c5"
        }
      ]
    },
    {
      "bom-ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tail",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a832ead3-ef65-4341-a846-ed48d5b298f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssrpc.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0a6a213bf8792d422cb5cc595f84f6382b79caf"
        },
        {
          "alg": "SHA-256",
          "content": "ae155407a2acb36182c2e4e1ba9edb2ca90a1c28b058f85f58274827132b4426"
        },
        {
          "alg": "MD5",
          "content": "9539707b9fc975731157e4979335f9ec"
        }
      ]
    },
    {
      "bom-ref": "a85ac6fc-19de-4108-98fa-7b4b52af38b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcProfileProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7458b381de72fa07e43df287804eabd394c3acd1"
        },
        {
          "alg": "SHA-256",
          "content": "1e88e7dcb7176fccfbe02d53e3ab78366f891cf0de75a29b624654be3ddcf108"
        },
        {
          "alg": "MD5",
          "content": "2e7dfb2f40dc6fc2c225ce087892829a"
        }
      ]
    },
    {
      "bom-ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a8acddfb-7247-4c50-acdb-e6ff7de47d11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a8b0d7b3-4a60-48a6-b182-07437a620840",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/menu_close.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9cc0d703f314e6ea1f40a917647cb36e52339df0"
        },
        {
          "alg": "SHA-256",
          "content": "d20107b1d2b86218e7a09bebbad87cb3fe1d4a6fdb5073eaed18b02ae474923f"
        },
        {
          "alg": "MD5",
          "content": "9f48b1e3db86006742720f6b5c8d30c6"
        }
      ]
    },
    {
      "bom-ref": "a8b58a82-875b-47ff-872e-8d2d848595a3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/share/udhcpc/default.script",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d5d3ae7054b671968234c3d5bb70828be7a0b932"
        },
        {
          "alg": "SHA-256",
          "content": "dbcb75b5008d4d76b7054549e5eebd74e98eaa589b8adac1a256553189d9c958"
        },
        {
          "alg": "MD5",
          "content": "55246d69d9c3acd39c1611f555047a2e"
        }
      ]
    },
    {
      "bom-ref": "a8b7549f-9bf9-4e13-b7d5-7451f386b1e5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamLaneInfo.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3617714de5151ec2c209d3dd8b0e0dafe420e802"
        },
        {
          "alg": "SHA-256",
          "content": "1b66665e84e43d121a0725567e69d4f05ad71501112f2bb87f69e7e5129c1957"
        },
        {
          "alg": "MD5",
          "content": "aeb5cb1ee3a062d8dcf964e8c86d1539"
        }
      ]
    },
    {
      "bom-ref": "a8d694fc-908a-4c6f-a782-87355db772c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/base32",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/reset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a8fd8b4c-d2df-4c7b-b418-070cae01d1e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_OPT.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "32e7f1bfe8a11b2ccf34701917a5f7956efe5c04"
        },
        {
          "alg": "SHA-256",
          "content": "d7157bd6740afa157dc7f4c63e5cb7d18b435a6416045adbcb4bb3c9d5e2f09f"
        },
        {
          "alg": "MD5",
          "content": "058da1eb68e7c05b6c9beb0c8349874a"
        }
      ]
    },
    {
      "bom-ref": "a90a9701-67ec-4c0a-9909-7c20db1b3c0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpioap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "092acac2936fe1d7bdc818bf5981636cf986da86"
        },
        {
          "alg": "SHA-256",
          "content": "05039ec6394b9c18842a176a9d99a734100fdd86a2d77b7a086cc886319daa42"
        },
        {
          "alg": "MD5",
          "content": "a31ad9caef4cc9829d41ca9b8ddf4ae6"
        }
      ]
    },
    {
      "bom-ref": "a9104fda-f204-4cbf-8b47-55e0e0087794",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/VirtualMediaConfig.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d3d3463fe32b210c62d146c04a9db9daab8f3756"
        },
        {
          "alg": "SHA-256",
          "content": "0724cebc91636c9882ef5fcedb72e388d9bd70818fa0a555b8dc65147a2a7bf5"
        },
        {
          "alg": "MD5",
          "content": "1f111dc35b71c59e2e46f5d4cc27ee65"
        }
      ]
    },
    {
      "bom-ref": "a912edc7-2d49-47b2-be56-4b4b56a959c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.validator.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "39b42d2b746941d1a2b0da37d8b74468f9931635"
        },
        {
          "alg": "SHA-256",
          "content": "f38ee67bcab3e9a0eb0fb198a71c75ea56f2f059dbefe9112d6f8fa17efa12c6"
        },
        {
          "alg": "MD5",
          "content": "e1e67bfa9d9163a472426c75f9e35c27"
        }
      ]
    },
    {
      "bom-ref": "a92d65ee-208c-4da2-8aec-e3d9a7357fd5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmphelpers.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c91e50411cb3c9daf4929f9317c3778cff218ca3"
        },
        {
          "alg": "SHA-256",
          "content": "738334150eeab223a95732430b86aabf83f179aab3168250e35c702da14dcfe3"
        },
        {
          "alg": "MD5",
          "content": "859b15323700d958474bc78c8889609d"
        }
      ]
    },
    {
      "bom-ref": "a934be7c-dc22-4836-8cb8-13de5e448dfb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/note.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ca9b8ff23c67e0074098a07f2177348918d4ab56"
        },
        {
          "alg": "SHA-256",
          "content": "38f0c2443c325ccf9180c505269769159c7ec2c2106eb795ac07ec92d6da4d62"
        },
        {
          "alg": "MD5",
          "content": "b5e7cb89a5c63a98ff4b977268203cd0"
        }
      ]
    },
    {
      "bom-ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/modinfo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a951a8cc-20e3-4fec-b49d-ed86e2181373",
      "type": "file",
      "name": "./0-1997573.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1bdbe7138c88d5c463b7dc4a0a5527bfb798e4a4"
        },
        {
          "alg": "SHA-256",
          "content": "c0af6e8ee7156ca14bb04cc5a3848aa019f904ef814d8f020ed23fdfcd8ebc0a"
        },
        {
          "alg": "MD5",
          "content": "5f1f12cbdc213f154cfefd9809dc2899"
        }
      ]
    },
    {
      "bom-ref": "a9561930-907d-463c-b6e0-06076faa6a7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_mdns.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fcb30f7d442f48733d4a1293f51ae0290c4f1377"
        },
        {
          "alg": "SHA-256",
          "content": "add1eaec0e70695406413e47c0f182deaa11ef54fad399ae3aae52fd5fa3f334"
        },
        {
          "alg": "MD5",
          "content": "112c343ffde3d698b54c74858c67fce9"
        }
      ]
    },
    {
      "bom-ref": "a9596051-4cee-4249-9782-370996ce0b11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libdbus-1.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bac7ed38fea3d91578bf6355d7dcc4cd9e6e631"
        },
        {
          "alg": "SHA-256",
          "content": "f5ef71790a57c5ddfbe1838a0f16d30c4073fcd580a63538ec09e93ab4035793"
        },
        {
          "alg": "MD5",
          "content": "2c67e8ff3d831bed06186c4373e44389"
        }
      ]
    },
    {
      "bom-ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/arp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "a984264e-8841-4347-a7fa-66d585714db2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/udev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b1b0f25861da14b653a988e5cde528002ea4273c"
        },
        {
          "alg": "SHA-256",
          "content": "c50b53956da4ebded70d8e52ddfbeaf4839957d4918625e4e8894b85338b2345"
        },
        {
          "alg": "MD5",
          "content": "9317e19d00084aac5a5ae0fb67190453"
        }
      ]
    },
    {
      "bom-ref": "a9ff053a-aaf3-4608-aafa-509d4f564c49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/config_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2c8d36494ec22660d5ffd777c6b4a742d7f561c0"
        },
        {
          "alg": "SHA-256",
          "content": "b7b0399f26580082570e71647905c57ff6972ed72bcce45e121fd173edad491e"
        },
        {
          "alg": "MD5",
          "content": "cd7f1f7ce3221f3a0748c885f44043c5"
        }
      ]
    },
    {
      "bom-ref": "aa10981d-f948-4579-8343-bee77ac5ce47",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcManagerExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e1169930932911e6f5126260e761d8ecdb7c21ad"
        },
        {
          "alg": "SHA-256",
          "content": "b96338a327c75a9e4ed5138f8f332252fdb7f22761af31010ca3547d32aa4632"
        },
        {
          "alg": "MD5",
          "content": "7dbcb800ddd233dd77632a93a197d3d0"
        }
      ]
    },
    {
      "bom-ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/udpsvd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "aa219017-d07c-41a3-85e0-b984cc3b30ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_files.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adf742914dcdf3bb930adbc058262b7d3438a9d4"
        },
        {
          "alg": "SHA-256",
          "content": "e97ba39e3a6912094197078b9d7b8e7015143a6b91a76b983af03b2f9e499fb3"
        },
        {
          "alg": "MD5",
          "content": "ae17094aabbcafa684e75583f9a2b834"
        }
      ]
    },
    {
      "bom-ref": "aa30cf2b-7ebe-40f6-8d82-22c2da95e5a1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/selmgr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c40f658dffc7f5c887cc68eacac084764220d786"
        },
        {
          "alg": "SHA-256",
          "content": "c9203e4ee7d45a371d314796f708eed14eab049a6a523e89540bbaedaf38c534"
        },
        {
          "alg": "MD5",
          "content": "5e3448d5888e221d0c20dab9f3f2eaf2"
        }
      ]
    },
    {
      "bom-ref": "aa555edb-3fae-43a1-adff-613f8bc671cc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5.so.3.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "905bc0c905e6a2a6a61ff8642fe1778df7590a60"
        },
        {
          "alg": "SHA-256",
          "content": "6453ee8d56135820435b9237718c58cd0d4ae29ee44ba4f87b9a7bfaaceaa7af"
        },
        {
          "alg": "MD5",
          "content": "a9966c9ad82ef00a8da07b0eb0faaa8d"
        }
      ]
    },
    {
      "bom-ref": "aa6e7a84-ce45-4319-9f2a-44bc930a1798",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nohup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "aa6e9a8a-7c0a-4e0a-8926-67d9be18f8e5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/mkfifo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f331c983-ef74-4b6c-a8be-cdd9e206c78d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssrpc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0a6a213bf8792d422cb5cc595f84f6382b79caf"
        },
        {
          "alg": "SHA-256",
          "content": "ae155407a2acb36182c2e4e1ba9edb2ca90a1c28b058f85f58274827132b4426"
        },
        {
          "alg": "MD5",
          "content": "9539707b9fc975731157e4979335f9ec"
        }
      ]
    },
    {
      "bom-ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setsid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "aa8c2c90-431c-41e7-b458-316aa6ac6b6e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcEventDestinationExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66644846e054feb1318de025c87301dd22e3645f"
        },
        {
          "alg": "SHA-256",
          "content": "ef0c88fc2b7959e4c7f47f7920662576b9d5a8f037393b6f972867dc1111285c"
        },
        {
          "alg": "MD5",
          "content": "d644a3d2ca603d4ebd6fc0e851b8fc57"
        }
      ]
    },
    {
      "bom-ref": "aa9b2a9f-e2d5-4f0c-9472-e53543930eb1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmThrottlingStatus.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "70692e0e7d449d65b26c4413942ba07b6cbfdb86"
        },
        {
          "alg": "SHA-256",
          "content": "d20c3f934d621646d06ff64f37f232c1ef1427b3bf46ec21504a185852f06e8c"
        },
        {
          "alg": "MD5",
          "content": "d4602af3d993b66e89b4d8489a599f6f"
        }
      ]
    },
    {
      "bom-ref": "aab36ea2-475d-4a3b-8aa1-f320df6fe83d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_container.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f510a3bb700cd8a500ba7a569f665ee8e02d243"
        },
        {
          "alg": "SHA-256",
          "content": "92d7e1cc9d3f57b95b3284c19df2d56eaa1172fe7c2fe029a4b87472d2687d9b"
        },
        {
          "alg": "MD5",
          "content": "b9413a97161db9ae40bff7f60a051c4f"
        }
      ]
    },
    {
      "bom-ref": "aac0a049-80d7-44ed-8277-ee2579558d49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmartPower.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "779e3d19b25b5dec9cfcf42c6cfc9a7103ee2740"
        },
        {
          "alg": "SHA-256",
          "content": "937bfd426bc93f350ea1796518992eee8f95ef1b964e9a0e7fee3dbdf48fd957"
        },
        {
          "alg": "MD5",
          "content": "ee1f455e02f1ab0b9a1a765265270730"
        }
      ]
    },
    {
      "bom-ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/id",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ab04fd03-f263-4ba6-ade2-d3615a1804fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmd.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "215d123c2f34b6680a15c85ee69674c6f66476bb"
        },
        {
          "alg": "SHA-256",
          "content": "47e48e0c844bcb84156d8ad015431036cd4ce05758b8012ff398e6c23d81edfe"
        },
        {
          "alg": "MD5",
          "content": "d4a6e9aa2615ef4d3d3366fed35639f8"
        }
      ]
    },
    {
      "bom-ref": "ab1110b0-58fa-4e15-aa7e-69f952288350",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/GPUDevice_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "54dc8907ef05f9a18d66805c858e63be4f0faaff"
        },
        {
          "alg": "SHA-256",
          "content": "d8e01d290d6f630044b16b75a93e776375655578d5f63f94984ee0d65f18c92e"
        },
        {
          "alg": "MD5",
          "content": "4638c44b801952e4d6a8966da27f6444"
        }
      ]
    },
    {
      "bom-ref": "ab1e96d3-b609-457b-8af5-ccf057959d8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_filesystem.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a867b6f1b19607afef24799c8952d49a209708cf"
        },
        {
          "alg": "SHA-256",
          "content": "156c7b08b188242ae3691f71f170cc61ec7ecddbc764188a9264f947da6aabc1"
        },
        {
          "alg": "MD5",
          "content": "611d6aac9e9f8068e189bcf6f6c79c1d"
        }
      ]
    },
    {
      "bom-ref": "ab3cc206-86e9-4b69-b978-5e6057e1c1be",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fold",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/sshd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1034764b841688a5a591f04d019eacbbf7313851"
        },
        {
          "alg": "SHA-256",
          "content": "e86dd69ffe11b1b47b0ec924711d3512e68e5e9a782660ef6a3f05509abaf506"
        },
        {
          "alg": "MD5",
          "content": "27210256ebbaaea6512c19246f64ba13"
        }
      ]
    },
    {
      "bom-ref": "ab4c57e2-53a5-448f-a504-2ca3a71c9989",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/dashboard.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c9e4a4eb6feb8873c3e59666f0d2a3047e9cf032"
        },
        {
          "alg": "SHA-256",
          "content": "04ceab78181105e8a8687b039ce54a65feb226b6eae7926e563028c9139f2bfa"
        },
        {
          "alg": "MD5",
          "content": "2e7f4ce406a23af1de633ca239e0abcd"
        }
      ]
    },
    {
      "bom-ref": "ab4f2ff8-63e1-4e96-b1bf-fb8a679af529",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamSensorsTemp_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a1c1d98e0d83c00cf510046ac245e8191d37967e"
        },
        {
          "alg": "SHA-256",
          "content": "3557f27bf0bed59ce2468aad9e6ae29dbacc8e3013e308e9faa466a4bf2cdd3d"
        },
        {
          "alg": "MD5",
          "content": "e5ee4e6d7ae8df7ba6ebb84bd84c4995"
        }
      ]
    },
    {
      "bom-ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/egrep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ab71c969-f64a-4baa-a0c8-656608d3c60b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/lldpd.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dc06f0e426267f32ce88717a03500be1acbff5e3"
        },
        {
          "alg": "SHA-256",
          "content": "30b3a4536d1dae6cb072a78e10728fe0603848f3779c580efd11801725cbb0bc"
        },
        {
          "alg": "MD5",
          "content": "20f270bf021404308b95a7e508ffad75"
        }
      ]
    },
    {
      "bom-ref": "ab814ba6-5e19-494a-8708-cc646f468e32",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dpkg-deb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/hdparm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "abcbf5f5-4b82-4042-986a-975f8cee459d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_license_cpu.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab61f5e3e28bdea74c3721aad28918d2c90e652f"
        },
        {
          "alg": "SHA-256",
          "content": "55ffbcb8d5c2145e800bd4f72568e824674dce821975c6e678ff067a5a4b9345"
        },
        {
          "alg": "MD5",
          "content": "3b3e5c16cc2151872836036adb915922"
        }
      ]
    },
    {
      "bom-ref": "abd2773a-9385-4107-8c5f-7aecb8ac202b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/who",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "abed7b35-a24a-406c-9a36-9eae020e3333",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiThreshold_SensorProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf9cde9c96b7b87128f7991023bb51d9bc30c7ae"
        },
        {
          "alg": "SHA-256",
          "content": "55b876e694378869df09304e23fee9fd533528da02711f8a1b2d82f1c64bce2b"
        },
        {
          "alg": "MD5",
          "content": "6d686bbc5606e56c39dc0600dbbdb6ac"
        }
      ]
    },
    {
      "bom-ref": "ac89269e-d27a-4ca5-a7a0-8821459e5475",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/providerRegister.previous",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c9c425374b9c16d0933a45c99b8c6e165f9f958"
        },
        {
          "alg": "SHA-256",
          "content": "59b40749c178cc3f671fd105ef7a3c21dc9da7de091a1db839545073f1a94326"
        },
        {
          "alg": "MD5",
          "content": "7129d6160186f0560c88f85fec293f0d"
        }
      ]
    },
    {
      "bom-ref": "acb0f862-0b65-4a16-8565-abeee9fdeed7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/registries/TaskEvent.1.0.3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9c54f57eea1fe601f1b7de9f362b317d4d6ade54"
        },
        {
          "alg": "SHA-256",
          "content": "6933ed01b041c2a96f04a9964c3f608f73122690e980bb076b62611dea55f982"
        },
        {
          "alg": "MD5",
          "content": "26eaa1cf9ff856b0b62bc25403417c36"
        }
      ]
    },
    {
      "bom-ref": "acba24b8-29c7-4dbd-a321-3c8f23ab5300",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1d0e37ef158526e94c4f1dc83a0170c07a0ebc8b"
        },
        {
          "alg": "SHA-256",
          "content": "72f2175c4fbc19b31a7955d306e53204f63c5b4c2dd999bba6158c3ed1336db5"
        },
        {
          "alg": "MD5",
          "content": "c1c7f2b0e2b522e16e335a01ab5c30f5"
        }
      ]
    },
    {
      "bom-ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/rpm2cpio",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ace4b6bc-3492-4a20-b10e-f18708996840",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86ed64d0829e3c86af6bcc19bca10419618cf046"
        },
        {
          "alg": "SHA-256",
          "content": "f283c1acd9a237ecbfeac228c035e18b47eaf171a0655c74d3b06102332f799c"
        },
        {
          "alg": "MD5",
          "content": "10d02142393483bff965c2d2f63e0b51"
        }
      ]
    },
    {
      "bom-ref": "ad1fa38d-0f2f-48e0-bda4-129f51a32e62",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfuse.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd14575ff1d42b6f6821f6b227ada95dc435a3cd"
        },
        {
          "alg": "SHA-256",
          "content": "5f05c0d27c4c697920def19f3108a3c8634eceaf13565bcf017c5933ff30457a"
        },
        {
          "alg": "MD5",
          "content": "cb7d57930c79fa5537837e65f93596f9"
        }
      ]
    },
    {
      "bom-ref": "ad2e0728-5ce0-41da-bd95-607df2711df7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libscram.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "05846d6ce7b0adf863cf226acf203a14a0f46fae"
        },
        {
          "alg": "SHA-256",
          "content": "0a60aa782cbc7b4a26bbc0884b7660f2430844608e3f356c99aa20e4193683da"
        },
        {
          "alg": "MD5",
          "content": "0357e1497a56fc4a7fbbcc9bf9f5ae2d"
        }
      ]
    },
    {
      "bom-ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dos2unix",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ad3edaec-52c8-4464-9e0e-910515ebeca9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_JBOD.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ca15a53eb814f269ccc53efc821d58d07bf9d7f2"
        },
        {
          "alg": "SHA-256",
          "content": "9cbcf81e1edbedf6196d75356e732dca3d6541ee9ad1441643b2a1f25b600b0a"
        },
        {
          "alg": "MD5",
          "content": "eca10c2ebbdbdb367db496fbed388b6c"
        }
      ]
    },
    {
      "bom-ref": "ad4631ba-f386-4a94-a960-7b5dd54a1ea0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dpkg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ad4d9ff0-1af7-4877-9bff-5d9519d448e7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58c8b739750dc43519c7116debf325698f5a86c5"
        },
        {
          "alg": "SHA-256",
          "content": "86f106c8eeb33a80eb3ac4478bed39791c6dda1c972ca14a6d368f4a4dc50644"
        },
        {
          "alg": "MD5",
          "content": "c300db14250a75abc8622c9ec86ea22a"
        }
      ]
    },
    {
      "bom-ref": "ad4e2dab-bbd9-4a2d-ad6d-0501c223c6e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsafec.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f7a4e329a10076bfe3de2df9dcfc243772dcafe9"
        },
        {
          "alg": "SHA-256",
          "content": "49a1a5345396a01a83af287b697b2314822374f2714c35f813d0aa9eb9935bce"
        },
        {
          "alg": "MD5",
          "content": "4cf60247d115e7f59b00133f237ca0d2"
        }
      ]
    },
    {
      "bom-ref": "ad5834d8-8495-48c3-bf4f-735c468bd5b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/swapoff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ad66412f-f0bf-4afa-b9ef-ed20dcb8dccc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_health_event.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1770bf1c1a3b693900644e4602476ccf3bddf84d"
        },
        {
          "alg": "SHA-256",
          "content": "6d8da154f07a20f30342c43f7a3755ee1dd5fb7eabf0fc30107b62ba4ca56c2c"
        },
        {
          "alg": "MD5",
          "content": "ed6b2f9fd3640cabbac6d43dc50e8d8c"
        }
      ]
    },
    {
      "bom-ref": "ad863a9c-50b3-4417-af59-77ddb6f333d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pldm_gpu_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1385eb4c1d1bc8d08a9df30b4cca402d0252476e"
        },
        {
          "alg": "SHA-256",
          "content": "74179023546ec39131b7061ced6ed5c9240272f3d9bc47f652814eca3ca437aa"
        },
        {
          "alg": "MD5",
          "content": "85834a86c2fe24e1f3ac74882d4bf53d"
        }
      ]
    },
    {
      "bom-ref": "ada55a9e-2a4f-4d7f-ad20-21fa6b71f98a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/vromtool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9eedaf114d07500c34b0d879b522fa004fae9d23"
        },
        {
          "alg": "SHA-256",
          "content": "e5ebd5c34a8c695b0264617e6d5b193b0e1818adaa731fb65216c31f05fff048"
        },
        {
          "alg": "MD5",
          "content": "e365620694290f0547733b09915eb311"
        }
      ]
    },
    {
      "bom-ref": "adaed617-3ff6-41c1-abcb-294fa363c37a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_s.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1da6fbad2999c6f1e19a99b1eea94884b6093c56"
        },
        {
          "alg": "SHA-256",
          "content": "f7397599f49a559560472effaf480dcbab4ce99399bef907055794de7c5c6b7e"
        },
        {
          "alg": "MD5",
          "content": "2462053d175df6935804b621457b9256"
        }
      ]
    },
    {
      "bom-ref": "adcd53b3-7ddc-4e20-b16a-62314c5f48ff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/config_smart_power_mode.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "091603ddcadf4d2e983558e93404bf546956e62f"
        },
        {
          "alg": "SHA-256",
          "content": "f2b623cc05a0e0377eafc084e73531190ed8f4ae8a374e98e19177b75505ca30"
        },
        {
          "alg": "MD5",
          "content": "69a96ad75e4ac2dce42bca86b8236424"
        }
      ]
    },
    {
      "bom-ref": "adddb723-becb-42a2-a321-977aa721aed3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFanExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d52694e31f00ab1ddd62ee2f36860f5b7e1ec9b0"
        },
        {
          "alg": "SHA-256",
          "content": "5cd32c1b314320e34891052b7956fc3ad294f9ebc44c62288175c081765ccf71"
        },
        {
          "alg": "MD5",
          "content": "b1f12eaaeb5f01ee5bc988a518a0b016"
        }
      ]
    },
    {
      "bom-ref": "addf8952-c092-476e-a095-c61580a57cce",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/folderhandler.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0d3cee45144bad7c433aace89cb24fac605701e"
        },
        {
          "alg": "SHA-256",
          "content": "bfd30ec6685af2c1ac9e3d1dc167029507d4aef12c0942209faec2ac160a4431"
        },
        {
          "alg": "MD5",
          "content": "9a8433d28817451163f43b65627a776b"
        }
      ]
    },
    {
      "bom-ref": "ae0b1ff7-ee9b-4d52-bfa0-13c192c664e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_8.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "005db11f3bc08305488ee006ce7dfb6fe4ae2ed0"
        },
        {
          "alg": "SHA-256",
          "content": "4fbd0daf40ba06e358db39498ebf1a0361b2a090cf12219d4c4f8176f70c00bd"
        },
        {
          "alg": "MD5",
          "content": "6e5669041b27e0ae39ff272213392ffa"
        }
      ]
    },
    {
      "bom-ref": "ae176912-d4bd-4c1a-9796-f72717fb8881",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcclient.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97c9839af0e3f24b87bd275ecba935093ee188b0"
        },
        {
          "alg": "SHA-256",
          "content": "682f65552ec84ff84d3cc9667ccfa52712b40b711d4a65937e5c34e3e4b00f76"
        },
        {
          "alg": "MD5",
          "content": "8fac9537ef369e82d113a8c0a0e9a94a"
        }
      ]
    },
    {
      "bom-ref": "ae1af250-cf37-46f2-9fc4-b6ff41bbaa07",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsasl2.so.3.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98519f0656494efe5eae5558e34f34c960dcbdaf"
        },
        {
          "alg": "SHA-256",
          "content": "698b328988afcf64d05ae6856408861ea5e0c7c35df0164785e05103995cb6f6"
        },
        {
          "alg": "MD5",
          "content": "bd3add5bcadd302345c35f0febd82bac"
        }
      ]
    },
    {
      "bom-ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/iprule",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ae239fab-b86f-4f14-b0d9-910168e3214b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_lock.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "19616e4f26796c74177757d6e7c7ba4569f25db9"
        },
        {
          "alg": "SHA-256",
          "content": "ab27e7b800159bc2cba331b9eca62cb91d123bf5c41ec3175f0f8d803ecc26a9"
        },
        {
          "alg": "MD5",
          "content": "269ad6193f95655d54afe4f5459397d9"
        }
      ]
    },
    {
      "bom-ref": "ae30be5a-7eff-4bd2-905f-63e77365dc64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ae363bb5-6194-4543-8bb9-2c5f8c19f9d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_thread.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bbe32ed9f892506a6c10f2176ccd830fa12446e"
        },
        {
          "alg": "SHA-256",
          "content": "0e3a4f14fdcaa353a011f93397eebf37fb569a445926ecbc63cf76887518e19a"
        },
        {
          "alg": "MD5",
          "content": "11b1783d7bc76d205a92d88df0fdc020"
        }
      ]
    },
    {
      "bom-ref": "ae3c13b8-7618-45ec-ad94-c3d483d129b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13SSF_4FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "912ee48e9a050a62c5ed3e267a8e62d91108e49b"
        },
        {
          "alg": "SHA-256",
          "content": "5e95772bf785dfa2706eae2d4b27ee4bf8e438b74cdfb671826de80d9107baf2"
        },
        {
          "alg": "MD5",
          "content": "b5640be4d891532a2ca42ad10b124742"
        }
      ]
    },
    {
      "bom-ref": "ae3c5f41-5891-4072-bf9e-cfd7ae9b03ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mtd_debug",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a1056dd75c9ef321b7fc213ef3306d4408eae304"
        },
        {
          "alg": "SHA-256",
          "content": "5bcea192bd7eb19681e2e5df866519039160fc61ee83c575c428a5459e4d896d"
        },
        {
          "alg": "MD5",
          "content": "1b3d492f2a96b9f38a60a8ae1e424f43"
        }
      ]
    },
    {
      "bom-ref": "ae3db2e8-9f80-4337-9499-aa4630c9c0fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/touch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/logname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ae839290-b72b-4af2-bd71-35db03dee76c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/vconfig",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "aed9c009-0566-4761-b5c6-7451fd5664e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/chat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "aee04518-1179-45ec-82c9-3ce86eaff0bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.tooltip.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f3537579ce7b26a44228390135f2726a226adb6"
        },
        {
          "alg": "SHA-256",
          "content": "9051f11e9599f0c5c4ca66f6b80cf3f011a99c38d6341d3b611a88207dd832dd"
        },
        {
          "alg": "MD5",
          "content": "c3332f47b391be4a2974542475ddce9b"
        }
      ]
    },
    {
      "bom-ref": "af10ccbd-4d29-41aa-93ca-a7928167c449",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mountpoint",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "af36a67c-2602-43fc-91aa-8311e2d173e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/hwclock",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "af3df921-34b7-45fb-b71e-a4ecd8ee70a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/up.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8f6ed01a01eb49290caaad2eae8963c01fa4af4d"
        },
        {
          "alg": "SHA-256",
          "content": "53535abca8aa87a46435b641380f0984315dc40e8c46325437c20ddfe1d8998a"
        },
        {
          "alg": "MD5",
          "content": "96fdaffe51042c92daf37a0f796a9861"
        }
      ]
    },
    {
      "bom-ref": "af4d9ed5-5f1a-4c9f-91fb-bf0de9298f61",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SupermicroLeakDetectorExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbd38c0c8098cf804a7ed29a66c1eb0dffb4292a"
        },
        {
          "alg": "SHA-256",
          "content": "7900372c97f44fbd86ddfc5f84c4624157f92fccbdd250257ea2ab3e4837448a"
        },
        {
          "alg": "MD5",
          "content": "ca9b9b46f4967308041996e14230afef"
        }
      ]
    },
    {
      "bom-ref": "af58dcc4-051b-4959-9411-8a78b357b297",
      "type": "file",
      "name": "BMC_X13AST2600-ROT20-D301MS_20250802_01.05.02_STDsp.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e925d413932904a587794dcc5fc147c11d2d0209"
        },
        {
          "alg": "SHA-256",
          "content": "f5cb95cf1e63f372b536934c93db7fc85001b281825fcea5f26f892e5a8a4566"
        },
        {
          "alg": "MD5",
          "content": "9e512f0aad47415a81403a8ce5f281ac"
        }
      ]
    },
    {
      "bom-ref": "af7a9db5-3881-4796-a0e1-1b5ba680d18c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sleep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "af8a69d9-5203-497d-9a07-b7ce6e42d28e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libresolv.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "231d30d0a85822ddc05589530bc5513b07071abb"
        },
        {
          "alg": "SHA-256",
          "content": "8f05150c4c730aa4924b3146e1406e816de4cfd2c10d6fab543047e7806496df"
        },
        {
          "alg": "MD5",
          "content": "e0fa9a1db79ec23054dadd9177899d43"
        }
      ]
    },
    {
      "bom-ref": "af8d7d3d-9db6-449d-a14a-4a8fe309cc81",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1430f1aba7abe4881e0570577d2958f29a1b4221"
        },
        {
          "alg": "SHA-256",
          "content": "e7ee9e7b17f82fc20a62506e9996df73a18ed6f6a08988d83fd18209eac2af22"
        },
        {
          "alg": "MD5",
          "content": "9f94e2e095322f28f68a0611669dfcb9"
        }
      ]
    },
    {
      "bom-ref": "af9688fc-fae9-4a43-a1f1-040c21d2f6e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBG_GD",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "923461891d51906093f1e6d86626f4a90acfa712"
        },
        {
          "alg": "SHA-256",
          "content": "ab9fc33ef9d5dcd3bd20d9b03f5847c63a151b0d3b75051a60b5fac790b9a226"
        },
        {
          "alg": "MD5",
          "content": "4186f71b6593e3de735f82db1597de12"
        }
      ]
    },
    {
      "bom-ref": "af99cfb9-adc8-4bfc-898c-2dc4400c55bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/realpath",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "afac8268-cd52-4cf9-ad4b-a8453708ae17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_TextRedirectionServiceProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74b665505090c7d18eb33af9e6a01b4091796fb6"
        },
        {
          "alg": "SHA-256",
          "content": "3c53a295c586f1739aeaa24d338635eb97b2cbf4592ba21bc6f75aafaec449dc"
        },
        {
          "alg": "MD5",
          "content": "8eed36efa945f87bbabd2372d8f6051d"
        }
      ]
    },
    {
      "bom-ref": "f3468446-7d8e-4484-a4d9-ff7be249c623",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/physical_broadcom_HBA.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3269e0583b41c0d6d19ee5e9d9df2572369ff8dc"
        },
        {
          "alg": "SHA-256",
          "content": "c07e26e39d1e307351755aab2a6002527943223a895b804f4e2e644ab78a2150"
        },
        {
          "alg": "MD5",
          "content": "7999cb6aa919d30cea2939de5d0c93f8"
        }
      ]
    },
    {
      "bom-ref": "afb0d6c6-1ef1-4c2d-8c39-dd68539ad2d9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamFreq_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6eb725e93732e54ad6fa2528ded8e13e607d172e"
        },
        {
          "alg": "SHA-256",
          "content": "88ce9a3497c530e6bd53ba204d3e1274c48dd52e5c8babf001ace8aedaf32228"
        },
        {
          "alg": "MD5",
          "content": "e7d165768a019297c948a69ee946d7a3"
        }
      ]
    },
    {
      "bom-ref": "afc26272-44d9-4929-967a-4aeb2d2589a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/paste",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b01024ca-8e60-47b9-b0d0-d2faa897d293",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/iod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fff5d5fe64c30c76874b494b60e3ad57508c8456"
        },
        {
          "alg": "SHA-256",
          "content": "24552781dd546776347c903d3a348e1833dc92fbb436f201790e83a30e8901ca"
        },
        {
          "alg": "MD5",
          "content": "56e7b77a17f44e1c211bd394e90df677"
        }
      ]
    },
    {
      "bom-ref": "b0188d7e-3f91-4fbc-9b9b-eabe06f80ccd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gunzip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b032ddfa-1e17-4974-ac8e-a27a1ef1bdb1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uuencode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b0338786-c64d-4a7f-9f00-d1a5ad7cbafc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "41ac74bba4d10e2f84aac801687ec0e706d0478b"
        },
        {
          "alg": "SHA-256",
          "content": "33b02e091ce4e53048e0cf7eee6e09b53d2096321805a3d9fc7801cf0eb24e40"
        },
        {
          "alg": "MD5",
          "content": "a613f5b4f19cbf1420a07f1a56e8384c"
        }
      ]
    },
    {
      "bom-ref": "b048574e-34b1-402c-9cd7-fab5320d4ec8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/blank.bmp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bbf2d9bbd873c4a226059d17aa21ff1a889525b2"
        },
        {
          "alg": "SHA-256",
          "content": "1e1128c16567f3118376ce272f47a0e1a410d047a0922a1e197bb5367200728e"
        },
        {
          "alg": "MD5",
          "content": "91c527d37dc10bd73f18a8c3a5f8b993"
        }
      ]
    },
    {
      "bom-ref": "b04ae4a8-72e8-4cdf-b96c-4fd69839913c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db0da814d72ca703a37cb32fc9caf2f680a92ea4"
        },
        {
          "alg": "SHA-256",
          "content": "75aa62d60c28daeb8da3eb5ebd51b12b6d032ad9168d3b6e56d239e7070dcbb8"
        },
        {
          "alg": "MD5",
          "content": "4337420c3270236ffe4d9462ba8f4569"
        }
      ]
    },
    {
      "bom-ref": "b0846d00-304a-4339-9eac-bae334b1b3ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_UserAccount.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "84224643f4b9e85991df92dbd38c0bc1a617373a"
        },
        {
          "alg": "SHA-256",
          "content": "bf52434cbef93648e3e83c9264003e2f5f3af278b6559713abc6c0e8c2ee3ef6"
        },
        {
          "alg": "MD5",
          "content": "66722be14f3b465ded33613ee812cf47"
        }
      ]
    },
    {
      "bom-ref": "b086c1c7-92e8-47d0-a0cc-6573faf6ca97",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_powerRestorePolicy.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bfd10d250b32504fb18d7a3c03f9f9de03cfd70c"
        },
        {
          "alg": "SHA-256",
          "content": "776288eb7118322868170bef74c257739d77bf5ac3c3f84bea55f5336a601356"
        },
        {
          "alg": "MD5",
          "content": "e9e94b34615edf98356db4ee0d8ae0a0"
        }
      ]
    },
    {
      "bom-ref": "b0a30da6-ddb3-4f7c-9cbf-f38583df2725",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/mofs/root/cimv2/IPMI_SoftwareIdentity.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f38d1b3ec3836d72230fd96cb7f75acf8f62c9e4"
        },
        {
          "alg": "SHA-256",
          "content": "c78914058223a72771e2a0d347de82ece0a9ab7b9865ba2ecf65d15a3eb44ffb"
        },
        {
          "alg": "MD5",
          "content": "87b198ff933a7c1d91af781968d5bdd1"
        }
      ]
    },
    {
      "bom-ref": "b0b13b6a-0d30-4ab2-a078-d38dabe3c4dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unlink",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b0cfe4a5-f194-4e3e-a0d9-2d771de23e7f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/hotKey.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "67095882523808762b2a40b4e09dabd8fa554b15"
        },
        {
          "alg": "SHA-256",
          "content": "4b5c4121e61b6362564e098c676545f9c5bc7817f2886c99eae364f571616a9b"
        },
        {
          "alg": "MD5",
          "content": "ca53b873941ae53b55f7188893516956"
        }
      ]
    },
    {
      "bom-ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mdev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b0f1e956-dcf7-47c3-af88-20b5da01bb5f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libjson-c.so.4.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b3e0d34bb90aa096f35f13d55d8738aeb474ce12"
        },
        {
          "alg": "SHA-256",
          "content": "60a730320d8a26662e85bbc89dcdd967bfe66d5c9c379b25c0d36dcb8eb120b1"
        },
        {
          "alg": "MD5",
          "content": "665cfefe257e53f7e4774989888b2204"
        }
      ]
    },
    {
      "bom-ref": "b10be247-fb22-43b3-a473-b001669260b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcFileRepository.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64efa4bbb1111b4255f6b924d1ae5c549ef40fa8"
        },
        {
          "alg": "SHA-256",
          "content": "d440914639cd70b97dd11d037ef7f623252492f4efa4f9761142b9ee9b5f7e06"
        },
        {
          "alg": "MD5",
          "content": "e6201b393f6c99c6bde694a7d0220fac"
        }
      ]
    },
    {
      "bom-ref": "b10e1172-4656-4fbc-9150-d8fca998bffe",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstdc++.so.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49004bc15d6c235b175b6efeabe98d4622753b22"
        },
        {
          "alg": "SHA-256",
          "content": "4a9467ac3a877bd6a36a60f117ce25852b38739ff05137b26912dcc40e0358f8"
        },
        {
          "alg": "MD5",
          "content": "47b6a3c30ddca174e47cd0d9791d3fda"
        }
      ]
    },
    {
      "bom-ref": "b1101a30-ab2c-4fbc-b303-742e285b4b86",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/topmenu.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b730810f05eea82b6aa27979a272088a40b595d0"
        },
        {
          "alg": "SHA-256",
          "content": "f2a7be29c2a08a4ab8f390ef830739cbeca2da9341cfa28c25121c09a8c1696c"
        },
        {
          "alg": "MD5",
          "content": "35d419fafd498afb3758b06c3d82c3b3"
        }
      ]
    },
    {
      "bom-ref": "b11a3a2b-7d8c-4b94-9e32-12f8ea2ff942",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_10_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f98f7a59b25196f4a15c3127979e391c04fb9c03"
        },
        {
          "alg": "SHA-256",
          "content": "72c05d4c45e3a27037b1be35e2e7712e1b59461b296ebf3545b4e468353ffad8"
        },
        {
          "alg": "MD5",
          "content": "c3cbc20644c3ec8f23886129c5d18c14"
        }
      ]
    },
    {
      "bom-ref": "b12e2893-8a4c-4e85-a0bc-0a712f4a07d3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_hesiod.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c93d3ebff914ce1afe6fe9693cbe3dad38e4ece2"
        },
        {
          "alg": "SHA-256",
          "content": "2a1d13ca184e6e52a8b9598407f101fd670071ba3da8d7e35ba56ffd92737026"
        },
        {
          "alg": "MD5",
          "content": "f6e6d6f43a82e628f1a4d9f3d11bd853"
        }
      ]
    },
    {
      "bom-ref": "b136d0ca-1226-4716-9f29-55343df49517",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_files.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adf742914dcdf3bb930adbc058262b7d3438a9d4"
        },
        {
          "alg": "SHA-256",
          "content": "e97ba39e3a6912094197078b9d7b8e7015143a6b91a76b983af03b2f9e499fb3"
        },
        {
          "alg": "MD5",
          "content": "ae17094aabbcafa684e75583f9a2b834"
        }
      ]
    },
    {
      "bom-ref": "b141c9ca-efc1-4e59-a349-d337e0af9527",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Policy.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6a3038bbd50bd89e50b32e1d597e95725650b93b"
        },
        {
          "alg": "SHA-256",
          "content": "f7dde8e5a2dc13ff597e18fdf4c1723ef34a57b07a5d7a33954ff3ca30b44811"
        },
        {
          "alg": "MD5",
          "content": "250008acd38dc70d1efba06f1500f7c2"
        }
      ]
    },
    {
      "bom-ref": "b16814d8-4fed-4a1c-b8d2-601ef222983c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/udhcpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b190e73b-9537-4b3b-bb6d-d972552aaa7a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.editable.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4c34b057f9d4201dcbd81197eb784a958e6c0776"
        },
        {
          "alg": "SHA-256",
          "content": "362020293336d7e2b0f66dfa1af855df989ef7c063e5af214c0d76a7371b343e"
        },
        {
          "alg": "MD5",
          "content": "23d8f09250a996824099d30e7fd94379"
        }
      ]
    },
    {
      "bom-ref": "b1fe24bd-c1a3-4b9b-bec3-3357cc11db65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/.slogd.swo",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf8a49d927a1e8edf2068a3f08c0cf63961a6772"
        },
        {
          "alg": "SHA-256",
          "content": "b9bd417b162e888e1025ca3672a2fc9a95221a1de01c12514110c306180d17d1"
        },
        {
          "alg": "MD5",
          "content": "9c4cfb0abc817f49e7e1e2cf26889a7e"
        }
      ]
    },
    {
      "bom-ref": "b20ebf5b-7a83-4111-b676-6abc3ecc542a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/adctool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "00046fb212749b0e766115e1c98b32616a4dc5ff"
        },
        {
          "alg": "SHA-256",
          "content": "f0173b7a700d6ea178dd362f108e3eecdb72b5c74954641aa045b7ed5d2b0e9a"
        },
        {
          "alg": "MD5",
          "content": "f550e13ca2481600444ad3586b416d7e"
        }
      ]
    },
    {
      "bom-ref": "b21468f1-b6f0-446a-a05d-cccd19ab78ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsystemd.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f4b015be10d7c3db1fea9d371d135321e54c20e"
        },
        {
          "alg": "SHA-256",
          "content": "58f4e0076e815e9a418585a8d325d549beafbc07d15dd4fa845046ee477e1d4b"
        },
        {
          "alg": "MD5",
          "content": "5199c5203fbbd52dce69c6cca3d6b858"
        }
      ]
    },
    {
      "bom-ref": "b223c696-5229-46de-b1ed-b6942c4b5fae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrad.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1dcc8c63a1f81dd8fb505472dd2c7aaaeada2886"
        },
        {
          "alg": "SHA-256",
          "content": "b150eb70d34605ad251d5b6b307178f52e5439dc9bc7aad1dc687ddb17fb3bbc"
        },
        {
          "alg": "MD5",
          "content": "e8b634787c3c43c7dc95acdea592e88b"
        }
      ]
    },
    {
      "bom-ref": "b230030d-d54d-4dc3-aee6-da0d6508f2e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pfr_rot",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "de90dda2ff497738dc63828f134879169623cdc4"
        },
        {
          "alg": "SHA-256",
          "content": "b935ee63d1165d20d5277409bc0a762e7514337b371f47223ab7df5ca5474009"
        },
        {
          "alg": "MD5",
          "content": "80bda54e88f0638f0990b7c6dc49c74c"
        }
      ]
    },
    {
      "bom-ref": "b2605f5d-e7af-4276-aee4-fd38dd7ab70e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssapi_krb5.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b57a3c32db8ba424f5612e0a912e12303d197cb5"
        },
        {
          "alg": "SHA-256",
          "content": "101d2bbfa691e8a3c4fe0b9e6a8b3100318fd6e69dcc049b4cbbf558c95a25bb"
        },
        {
          "alg": "MD5",
          "content": "f7411491c74b7bb379688337fcbed1fa"
        }
      ]
    },
    {
      "bom-ref": "b266a084-9131-4b7f-8824-36d72dcd069a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pidof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b27dc8c8-d951-43f8-89a6-3db5de57a3f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libm-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1998f4dedfa25b2dcff34096980363a07183a390"
        },
        {
          "alg": "SHA-256",
          "content": "0b02609385f6267eb86dcef99de917afb8b703f1f8262125551606456f0790b0"
        },
        {
          "alg": "MD5",
          "content": "3e3f55cb516da70a20955a4c100c86fd"
        }
      ]
    },
    {
      "bom-ref": "b293b07a-3276-4cf5-8aab-1c59bf538e84",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ead9115426f4a097c588c07ec581f25047db6eb3"
        },
        {
          "alg": "SHA-256",
          "content": "1bde97a57da7dd7a1c0effbd86f55f428efac3d2298f80986e428e13b9244a87"
        },
        {
          "alg": "MD5",
          "content": "a78840a43195279cd8609ad0b6a9fc34"
        }
      ]
    },
    {
      "bom-ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/svc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b2f251c3-8452-4e27-a62f-150f9be6b58f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmptrapd.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6dfd0fa8c33f4dc4ecc941a315e7171e597d8829"
        },
        {
          "alg": "SHA-256",
          "content": "148329f9d341476e2ba4e1e4b961958d75c91e00b0f1cf72cf714fc990a57104"
        },
        {
          "alg": "MD5",
          "content": "e8cf3f5545c33649ff13723e0fd0facc"
        }
      ]
    },
    {
      "bom-ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uptime",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b3004026-1f69-4a58-bce8-f1c479b92c38",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/watch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b3241060-e8c3-411a-8988-06a2e2b575f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_power.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b8f75f38940dfc67fab8eb1877d16b1d628cae83"
        },
        {
          "alg": "SHA-256",
          "content": "3160858fc6a66d8c32278dcfbbed11b23fd6436492164bc86ffea4efb5f1c60a"
        },
        {
          "alg": "MD5",
          "content": "907cd4a4ea322042ebaa70c183f56901"
        }
      ]
    },
    {
      "bom-ref": "b337304d-f1bc-40a3-9960-ded78a8bbe32",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/factory_jbod.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cede69eda8a30c6e36734440e86752c79d0973dc"
        },
        {
          "alg": "SHA-256",
          "content": "c0ba58e5c3ac1ed18be68bedaf616fd5b45297b85c1f65035b3f56c36f843494"
        },
        {
          "alg": "MD5",
          "content": "973a99d637c704e63b8f1c7194542503"
        }
      ]
    },
    {
      "bom-ref": "b33863d0-02c7-4856-b20b-a678f7d8fe48",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcPortsExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6a01b23238785b53525e6a52a6464b28260f3e52"
        },
        {
          "alg": "SHA-256",
          "content": "9776476e1d08f6fc95934e43691238fb4e04947a77509f8078f303c752e247e9"
        },
        {
          "alg": "MD5",
          "content": "97c60805a61bfb298dc6e06dad78e77c"
        }
      ]
    },
    {
      "bom-ref": "b35a0597-a3ec-47e0-9134-2afd61feb76f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_host.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3a3989555067988805e9fd01e9d201deb54fb05a"
        },
        {
          "alg": "SHA-256",
          "content": "e0cdc82bc101d57d15019b09ca96b343c96409e0798b517dd6908f6c796815fc"
        },
        {
          "alg": "MD5",
          "content": "78958651d00c7206f9136850875d3645"
        }
      ]
    },
    {
      "bom-ref": "b35f0ded-140d-4286-b749-9c62f7f6d1d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap-ng.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2365de6e4073ba24ee2f825c773395d9bacfafb0"
        },
        {
          "alg": "SHA-256",
          "content": "3aae811e6588809c5a4ead920c4d909c46b78a27f4dabb25c08e2e71f2ac3d0b"
        },
        {
          "alg": "MD5",
          "content": "aa94bc3d29e63c53fc19c8bf711d245d"
        }
      ]
    },
    {
      "bom-ref": "b35fcad5-9b77-428c-9c05-e7f83e44fa81",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/getopt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b36b4bab-8f2c-43d5-8a30-3e95166ba099",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libblkid.so.1.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6924e36b26d4a18ad85ff5efc8b2599126bc5d27"
        },
        {
          "alg": "SHA-256",
          "content": "70e7d7361cf32604ebe40438d15c7ac8afcfc94bbdf8b6a4431efdbf7e072afe"
        },
        {
          "alg": "MD5",
          "content": "22be4e7ec1ee523348903a02d5911b6c"
        }
      ]
    },
    {
      "bom-ref": "b376d0f1-e7e3-4080-b99d-da7cbab029ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/share/sfcb/20_indication.mof",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ab674483b3b6b44d4d044b524e3d1bc7d626ead7"
        },
        {
          "alg": "SHA-256",
          "content": "b8f4b59c3dda5251d34e8ec88ce43a29cc48dbcce47b657c2ec81fdb1b472d1b"
        },
        {
          "alg": "MD5",
          "content": "6555135c681dbd776afe88d9aa9fb894"
        }
      ]
    },
    {
      "bom-ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/xzcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b3e84a94-32de-4f3f-bdd7-60a5df10b720",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb5support.so.0.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6323368eeadb6cf6e72ba885cb3ee700a379c538"
        },
        {
          "alg": "SHA-256",
          "content": "3c8cd3d5721a6ea6ef421edbc1c34c9ec390901bcc9c1d37ddc9ed9cbc56332d"
        },
        {
          "alg": "MD5",
          "content": "dfb7f207ed9135f82c251060b260783f"
        }
      ]
    },
    {
      "bom-ref": "b3fcec48-3e7b-4cf6-99c3-a88f98e373be",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/lib/libSFCC_API.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4ea24ea703fa91785076d513cee6cdbca2cc2e0"
        },
        {
          "alg": "SHA-256",
          "content": "816db77d35c5ab7237f62e6809314735ba5a1f1b917090afa3802cb42e6413fe"
        },
        {
          "alg": "MD5",
          "content": "030c88c0a41e6a45128e8b505c999999"
        }
      ]
    },
    {
      "bom-ref": "b4275499-f15d-49dc-b484-93104fed5baf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/eventnotifier",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fb2f88fe86bd909ed98c2bafaa5d9b520db0d499"
        },
        {
          "alg": "SHA-256",
          "content": "ead1b50c316de7786a0a9eac9acf63202571d3e64db6341bd8a0915b6f4e6c51"
        },
        {
          "alg": "MD5",
          "content": "035df61b06d243c60f3bac4c6cd02b22"
        }
      ]
    },
    {
      "bom-ref": "b44dccbc-54e3-4706-81f0-12ef1fb5d849",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/dpm-setup-ast3000",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9fdfcd601d29240c758bfe3dfa4813fc8c741566"
        },
        {
          "alg": "SHA-256",
          "content": "f8975630f66a47ba1350a39f0d93b673dc8ffcb86426ba5a0807a3ab3add8f08"
        },
        {
          "alg": "MD5",
          "content": "a55e66a1266f166de9b823d3cafdf76c"
        }
      ]
    },
    {
      "bom-ref": "b45954a6-6df4-4c8e-b253-0739d20469d0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/remote.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3399b1bb0b314b8d666acae58b406eae50a417f"
        },
        {
          "alg": "SHA-256",
          "content": "514991ddcff6864254ec94a69997995462a0c75746b294a11400c7a1d1a78b96"
        },
        {
          "alg": "MD5",
          "content": "0986d632c44f69a655b9c25f3e236aa5"
        }
      ]
    },
    {
      "bom-ref": "b46eb45e-3936-4227-aa0e-593a18810764",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgpiodcxx.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3b559ef12bda17bbe11367997ba030661aeb8a6"
        },
        {
          "alg": "SHA-256",
          "content": "3ae45b870156c88fd6ec59c63df0a75e41586868360e43c0d65efc0614903910"
        },
        {
          "alg": "MD5",
          "content": "b4f9310935b1458a945d70dd017adbb9"
        }
      ]
    },
    {
      "bom-ref": "b4a7e542-a685-4a24-b200-dc2bdce80569",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuv.so.1.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d310b90b6f13aabaac71d1c11b2b0e0debee4666"
        },
        {
          "alg": "SHA-256",
          "content": "fbd9ec76d59f8f40f5aa4364e711e2cb62ad8ad74de5b99330b97816093a5e3f"
        },
        {
          "alg": "MD5",
          "content": "e96203676da186cd9642a68b37045b88"
        }
      ]
    },
    {
      "bom-ref": "b4c0f480-4c2e-48f6-8fd3-ff1ef3216c94",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/getset_ikvmport",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d402f0da31663a45124b867a7ee51b4ced90128"
        },
        {
          "alg": "SHA-256",
          "content": "102da6c72aa5e888fd09e4d2746a4e6030ae1de261fa3c8647bedc273be31a71"
        },
        {
          "alg": "MD5",
          "content": "a8b5f4151a295abcfc69d4d1d4ac0459"
        }
      ]
    },
    {
      "bom-ref": "b4c1f915-2c11-4ee1-afb0-80b30c246092",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/object/modalObj.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b30e3e3dcc843b7aa6768e932a30a411beeee36"
        },
        {
          "alg": "SHA-256",
          "content": "c3499ab42df7283a2dbf65669f39d3dc13842f6916a02fbfcf0e058b3beb2aaa"
        },
        {
          "alg": "MD5",
          "content": "6bb480047cd6b9236b0dbaf5ffa60514"
        }
      ]
    },
    {
      "bom-ref": "b4cb2376-7341-46d1-8da8-c607ba861bee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/reedata_tool.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "92778a2be88162b668d73821b11c2768e4c0b312"
        },
        {
          "alg": "SHA-256",
          "content": "2ac426220bc9a0d04f3af5eab1214d7ebbe5d8c701088b5a52775e46807ab399"
        },
        {
          "alg": "MD5",
          "content": "5f2b9df6dd1da56b4796ea9757382999"
        }
      ]
    },
    {
      "bom-ref": "b4ce9b25-7d0d-47a4-a56a-647a9a8e52c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/storage/storageMonitor.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ba1c0dcce678e4e14cd502d2aa2845745393d4e"
        },
        {
          "alg": "SHA-256",
          "content": "d58ed1774bc0e4b6d063f37e6e69510017e794582ee4382b3bce1151ea2d2cdd"
        },
        {
          "alg": "MD5",
          "content": "f19708307c0a1120d20a507b3ed0b182"
        }
      ]
    },
    {
      "bom-ref": "b4d5a09d-4adf-4a4e-9a98-b38695adc600",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/show_status_check.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3aeccf9eb96c6fc2f094a7827f35414a3076af76"
        },
        {
          "alg": "SHA-256",
          "content": "e1324368d684368f86437c4aebd401bc27432ac9d56bef8b7dc6d567663803ca"
        },
        {
          "alg": "MD5",
          "content": "a11f62089942b6f7df9f97530f0e8181"
        }
      ]
    },
    {
      "bom-ref": "b4ddaf27-9bbb-436d-885e-9dac2dc2a1b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/kcs_drv.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0c7294b7c02dfdf82d58593ac6a702e9dcda63c0"
        },
        {
          "alg": "SHA-256",
          "content": "d49c84bf1d1a126bfbb93cd92917471659ccaae42c87505d17158186d0514416"
        },
        {
          "alg": "MD5",
          "content": "88a6e485ecfb63b4c27d5c95a6d719d9"
        }
      ]
    },
    {
      "bom-ref": "b4ec204a-cd61-4704-a9b9-4e5201368e6c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/Redfish.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "25a6ec3dcc81ca2fec13b2b391ce31eb6d128368"
        },
        {
          "alg": "SHA-256",
          "content": "584e76d868513f2cad969fc539062e1603a271653475d31f1db1d93abe0e770f"
        },
        {
          "alg": "MD5",
          "content": "94075de4f81f562b6c91ab94e515ff82"
        }
      ]
    },
    {
      "bom-ref": "b4f88db1-d32d-4017-ba0a-620d39c745b8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mem",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "acb52d928818257451241c6b844bf86839482386"
        },
        {
          "alg": "SHA-256",
          "content": "e0a5026e792b8db75f568200318646f5c8f936bd1e4f1ed04f6eac277f16ca37"
        },
        {
          "alg": "MD5",
          "content": "eb5f04c856576b12733f32157fa89a2e"
        }
      ]
    },
    {
      "bom-ref": "b516d085-4346-4e41-a5e9-362d7917925d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/depmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mktemp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b580b5b5-aec7-45cb-b8ba-b792dc295685",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmp.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a0e640d61736325b877fae9046b4b358cc6381e"
        },
        {
          "alg": "SHA-256",
          "content": "29998f992af5d5c062fe9cf7cef2015dd1e5b383f861abd6f445ec3d8e1df649"
        },
        {
          "alg": "MD5",
          "content": "c83f72accc1292482f87ef7b24f5332d"
        }
      ]
    },
    {
      "bom-ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/chat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b5b8a880-95a1-4c97-96cb-f6cdd02cc644",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/libmac_x86_64__V1.0.5.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7e2460a8779cf34fefa3c41ebe90436ec91704e9"
        },
        {
          "alg": "SHA-256",
          "content": "786068625a38f57d4a97064de808a8393690278cb57e09dc1cd1466f596a8a1c"
        },
        {
          "alg": "MD5",
          "content": "47b097da54a3341ab7ea2ea97764e50f"
        }
      ]
    },
    {
      "bom-ref": "b5b95c19-f16f-445c-90d2-18dc77e53b5c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_RecordLog.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73f14604a4b1a2bb146ed5ca5893d26e6b895a5e"
        },
        {
          "alg": "SHA-256",
          "content": "97e7c7f2432189f0bc52a01aa33ff5ca332be3a9ea399656e95517f1604fd50b"
        },
        {
          "alg": "MD5",
          "content": "0ed47fde1e4cf4e98f350ca34613101d"
        }
      ]
    },
    {
      "bom-ref": "f348b7af-8966-4f84-bf19-cb4ea202d2c1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libgssrpc.so.4.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d0a6a213bf8792d422cb5cc595f84f6382b79caf"
        },
        {
          "alg": "SHA-256",
          "content": "ae155407a2acb36182c2e4e1ba9edb2ca90a1c28b058f85f58274827132b4426"
        },
        {
          "alg": "MD5",
          "content": "9539707b9fc975731157e4979335f9ec"
        }
      ]
    },
    {
      "bom-ref": "b5d1d487-a20c-4ff6-a12a-dff1ccdb15cc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcProcessorsExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "36ac8ba86323052fb0c053a0f3d97937f1ef9a47"
        },
        {
          "alg": "SHA-256",
          "content": "939f1f6f526638b7eec8dde9b76693141ff09f2f77e7f69b8c5bfea6877c30ed"
        },
        {
          "alg": "MD5",
          "content": "2960bd12abe2c3484cbd54345255d0fa"
        }
      ]
    },
    {
      "bom-ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2cset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b5f43fd9-e888-4025-9d1b-3337a0e6f8d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/comm",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b6153afa-d58a-4a17-af0a-1846a8bee489",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/login.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f313459b197c39039a490492e586faf124a9cc71"
        },
        {
          "alg": "SHA-256",
          "content": "defadb6d744ad3810a2a57457043f1ca21b027b74ef95d240750c3706d0109c1"
        },
        {
          "alg": "MD5",
          "content": "87260b53640cd6eca50fd9afd56b9dc5"
        }
      ]
    },
    {
      "bom-ref": "b63c5fe1-9686-498c-b835-0706486a09b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/fullScreen.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90d8687fb52fbbeada0c3e0934f9e84f8d6ea13e"
        },
        {
          "alg": "SHA-256",
          "content": "81a4268a68c0c4a38c06c9b1d89aae42fb5abffd6ded3bdeaa715f5bd261dd64"
        },
        {
          "alg": "MD5",
          "content": "52aaca4eeaeb913a313f35bf64e82c60"
        }
      ]
    },
    {
      "bom-ref": "b63db20d-2c9d-4b46-9718-0e195a98532b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmTrigger_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b7007fc594c3d26f77fb0b847c8bd90151b3254"
        },
        {
          "alg": "SHA-256",
          "content": "43fd416fffa2c6555e78f4aed3c2934b8ce5382c5d82d1e534ab1dff656326be"
        },
        {
          "alg": "MD5",
          "content": "4c6cf512596572cdf0d3ccdff4f9ec38"
        }
      ]
    },
    {
      "bom-ref": "b650c8da-fa63-48b2-917d-b46fff83469a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Dump.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c93de1e9186b6b15b765bb24fe2a0a620a723a5"
        },
        {
          "alg": "SHA-256",
          "content": "3b76737a6b25746eae582a3a7597bd213ec24d989067880a6a1e67ee9715ce9d"
        },
        {
          "alg": "MD5",
          "content": "843b58fcda8dcb8e69624b4dc9552e00"
        }
      ]
    },
    {
      "bom-ref": "b65eec5e-3793-47da-acd3-e7e14b4005b6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fullspeed.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c47868a3740aa71dd1a5eff585dd33ea4625c697"
        },
        {
          "alg": "SHA-256",
          "content": "acbceb61dcea819a17cbfff44f06809955f2c8dd13c1e14327cf3215df7889ee"
        },
        {
          "alg": "MD5",
          "content": "4027c529f47741206356af3cc8627c9a"
        }
      ]
    },
    {
      "bom-ref": "b6662f1d-6cfd-4615-a2fc-4298aabe4316",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/lang_kvm_help.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65b81b5dfd8eaf208374f9e48b9bd8c0e438861f"
        },
        {
          "alg": "SHA-256",
          "content": "cae42a93e449215816764eb89e9e4eea1080377388f9f7a7782fa6f070b875a2"
        },
        {
          "alg": "MD5",
          "content": "813617e52772f93af2262400ca7dff4d"
        }
      ]
    },
    {
      "bom-ref": "b66c08cd-0328-4393-af5f-e33443fd10a2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_17_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b3050f620cdcfea408a9e46c6e288b078800ff7"
        },
        {
          "alg": "SHA-256",
          "content": "f51117042d42f726bf0acb12604434d0a821b4979ca06e692d47a1196409278a"
        },
        {
          "alg": "MD5",
          "content": "d2d3031b00ee400a9bdc447105a8e720"
        }
      ]
    },
    {
      "bom-ref": "b67ade93-5e64-4bde-ba08-13646864e8c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "53f839794dbfc5e6286f343a5498c452e6b6b67e"
        },
        {
          "alg": "SHA-256",
          "content": "4c083e2300acb0b76923720265dbf0fb41fbe766d3dd583d8a0c0b00cfe9410b"
        },
        {
          "alg": "MD5",
          "content": "56c08ce4001c1b637a7a760f7a20d3ae"
        }
      ]
    },
    {
      "bom-ref": "b683952c-d14f-4262-8cb5-3f2a90e7e431",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_context.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "163687e70159453081459b5f37eb5de5b12c40c3"
        },
        {
          "alg": "SHA-256",
          "content": "6bdc58a66f26af8c143a01ef722aa196be8d37c4e1e1519cb3bd5678f377a8b2"
        },
        {
          "alg": "MD5",
          "content": "ba098dfe02f6ad84a3f22156fa5fc083"
        }
      ]
    },
    {
      "bom-ref": "b68f8c12-de9b-4704-948c-e94f955a126f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ping6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b6a0347b-6145-43f3-94d5-777dcb539644",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_thread.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bbe32ed9f892506a6c10f2176ccd830fa12446e"
        },
        {
          "alg": "SHA-256",
          "content": "0e3a4f14fdcaa353a011f93397eebf37fb569a445926ecbc63cf76887518e19a"
        },
        {
          "alg": "MD5",
          "content": "11b1783d7bc76d205a92d88df0fdc020"
        }
      ]
    },
    {
      "bom-ref": "b6a8144c-609c-45c1-8104-fc0297494bec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFirmwareInventoryCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0995d21af3bcaf39011b6d21b084b9f895d4592b"
        },
        {
          "alg": "SHA-256",
          "content": "9e8b969817366752542527c3afc3cfc98be3ed7946540e452cd6817e9223e291"
        },
        {
          "alg": "MD5",
          "content": "29df54608febd9ca2ebc20bc1638e360"
        }
      ]
    },
    {
      "bom-ref": "b6bd4f0b-4d1f-4d51-9bae-fe0b9a980d9e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/44networking.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bfe8f267ccbe138e78ff993d6698f4ffdbcc3864"
        },
        {
          "alg": "SHA-256",
          "content": "a6862456cf9a552eb5791dd60d8d6e4d155d2ceb3babfb11fc706da1ee870736"
        },
        {
          "alg": "MD5",
          "content": "9760bf42f3d9e5d4f2eb762eeacfb6e0"
        }
      ]
    },
    {
      "bom-ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/paste",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b6c48839-f5a2-439d-801c-05395cdcd041",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/NmThrottlingStatus_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "57504df623c8396c58bed65d8c33d87b1a3fbf21"
        },
        {
          "alg": "SHA-256",
          "content": "b539f79b94553e28c54ec7ef69e9c380364a7b73bfe3332434fe33e48fb5b51f"
        },
        {
          "alg": "MD5",
          "content": "b94699f4c62699133f9c11717e5c3827"
        }
      ]
    },
    {
      "bom-ref": "b6d6da31-328f-47e5-8a40-5cc4af236e06",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cc2117e8eff958ed24133dd5a0803f9694eecb09"
        },
        {
          "alg": "SHA-256",
          "content": "3566babe16d1b59d519628117dda1485d450b9b3e1dbedfa167067009b81bf37"
        },
        {
          "alg": "MD5",
          "content": "e7f378f2bb801774d4f6c482b5caf1c4"
        }
      ]
    },
    {
      "bom-ref": "b6edbe70-2545-4515-bd73-732b99afa8fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/netstat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b6fdc51c-0bd5-4c96-8943-8506af09a1f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/liblldpctl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5b27957703d8a92ce28a70eaf3e516b9049b19c"
        },
        {
          "alg": "SHA-256",
          "content": "5cefc8e2c67312af4c7360e88a08f83e7208bd33eb744b203b00c2cb72d84250"
        },
        {
          "alg": "MD5",
          "content": "697bac27a7769941bf6ba742252b098a"
        }
      ]
    },
    {
      "bom-ref": "b71d6679-d013-4388-a69c-ccd1e99e585c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/sulogin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b731583b-8cd5-4448-b96a-d1129acd4f97",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_20_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d7006b083bfc5b1be259b206b1ab36846c90a5f9"
        },
        {
          "alg": "SHA-256",
          "content": "bf658ec5049ea1972ca600c50c98d847b8189a34a058a2952cb5ba782138581f"
        },
        {
          "alg": "MD5",
          "content": "7de91c75971b8648aea7f7f17ea781a4"
        }
      ]
    },
    {
      "bom-ref": "b75ae6e3-cedb-4f6c-ad87-d78ef3967672",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage_controller.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8bcfaf58b5d917d8a8b4533298922ffc88f0efad"
        },
        {
          "alg": "SHA-256",
          "content": "f77009b8257a856c2a465a5f1d07871f458935a8ca2831c031358926fa367297"
        },
        {
          "alg": "MD5",
          "content": "b5e351dc6f057ba80d01b958ff3b5955"
        }
      ]
    },
    {
      "bom-ref": "b761d298-2e6a-4f98-8caf-293457324bb9",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed_extract/8372640-8396707.gzip_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2e472c5aa7c382213514aaaf8a74b963c7cb2b83"
        },
        {
          "alg": "SHA-256",
          "content": "8dc487fa54958c3c64d67e7547b68a855f77ca9fb9de49a2cf74a320418b1552"
        },
        {
          "alg": "MD5",
          "content": "dac5d422a423bc5fa20f32f8d657322c"
        }
      ]
    },
    {
      "bom-ref": "b79d7167-5789-4a80-b122-aae3ff1dec1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/ast2600_usb2_udc.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c79db7860c6809d3aadc211aa4e0467fcd09f383"
        },
        {
          "alg": "SHA-256",
          "content": "fc82c72d7de6382e17c604f6f2b4ee9a3aba3702b4f73c91f50c8cb5ad2155f6"
        },
        {
          "alg": "MD5",
          "content": "e9fd76eff8751a499b296c3c8e830870"
        }
      ]
    },
    {
      "bom-ref": "b7a19c64-f66d-4c50-8ffa-a9e79f10c43c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit-bmc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8aa1c84c0a933199644edbb3888723acff374333"
        },
        {
          "alg": "SHA-256",
          "content": "2afd30b75566f50cc478e13caf314b176d80ab10df83b18d482df0d95ed08f53"
        },
        {
          "alg": "MD5",
          "content": "1c4d5e2e456285c1b2def2d59f4309e3"
        }
      ]
    },
    {
      "bom-ref": "b7cf3ed0-e692-429b-9995-0233a74c2740",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/img_crc_check",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3fa977168078e40296daa491795e283f4f5828f7"
        },
        {
          "alg": "SHA-256",
          "content": "d24c80978390f1659f7e5f0540601084215f7afc5ecc4a37c260195cdbb135fd"
        },
        {
          "alg": "MD5",
          "content": "b188bb2112c15ebeafed688ac35503d1"
        }
      ]
    },
    {
      "bom-ref": "b7d7e6c5-4d26-47ea-81bd-b16194b6ba67",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmctp.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "96d901fd1ec2f40bbf7a26bea9ea0d6e35247c92"
        },
        {
          "alg": "SHA-256",
          "content": "aaf07349c22cfe2d0a4adb6df9df00e9f59df8fd5bcb5bea159a78a7f913e51d"
        },
        {
          "alg": "MD5",
          "content": "c50535cbd829912181f3a246cf8e630d"
        }
      ]
    },
    {
      "bom-ref": "b80ced56-3a6c-46ee-aec9-b6b347b421d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/cttyhack",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b825091c-a2bb-456f-a2e9-c1a7ed6c544a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcMemoryExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34f72ea9eab72d28daae6bf98a5998202d5eaf21"
        },
        {
          "alg": "SHA-256",
          "content": "25467d0b58bfa96223c5881eeae932bbb0a48b9f935e0c389a8718f40811e6ec"
        },
        {
          "alg": "MD5",
          "content": "7b73b42d7e648eceff5b1feae84558fd"
        }
      ]
    },
    {
      "bom-ref": "b83170dd-a3fe-4f03-923a-26cb5d521209",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcQualifierProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f2cdca51272b218dc2ab93f730f300fa86bfc8f"
        },
        {
          "alg": "SHA-256",
          "content": "79283d74e2ba0c80c72d77d3246c44d557ea51d793272ab8171ca91418c44eca"
        },
        {
          "alg": "MD5",
          "content": "ab7199ef8ccb013a7bb2d55512ca7a5d"
        }
      ]
    },
    {
      "bom-ref": "b840aa19-73af-4034-bfe5-f2b8e9fe2fcd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_15.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "54bec92f38e902fe0e87339c693f04a60714c33a"
        },
        {
          "alg": "SHA-256",
          "content": "fbfb37b0f9fd5981c434156d9d02105da10fa3fe861837e0bb17111db650c5c8"
        },
        {
          "alg": "MD5",
          "content": "3e964ef8000527c4cfaf98e301384da4"
        }
      ]
    },
    {
      "bom-ref": "b842fe0a-4e4f-4fd1-9043-bdf093040c9f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lighttpd.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c86a96847d568b50c08e646275213e99d4304175"
        },
        {
          "alg": "SHA-256",
          "content": "3288f458a73295eb57328593473106d522d242a7b98f118a697a869363938b45"
        },
        {
          "alg": "MD5",
          "content": "185b961bc87bfec276871cf14581dcdd"
        }
      ]
    },
    {
      "bom-ref": "f3505c9f-7bc3-4928-8b6f-b26ce699adb6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypto.so.1.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fc7b4cefb586a10e62363f262f53b45b650efa44"
        },
        {
          "alg": "SHA-256",
          "content": "6d66245a347c1379bf9da1ef39a33beeaaf7b9d0c481f9c5183f89e44395aaff"
        },
        {
          "alg": "MD5",
          "content": "c28e6fb0457533f45352e7d7c81c4c86"
        }
      ]
    },
    {
      "bom-ref": "b8612f8b-f1ba-4468-b289-527f723aaeb3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/man_ikvm_html5_bootstrap.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5b973736771f03eb9a0e04239a62dbfb43b8b8ce"
        },
        {
          "alg": "SHA-256",
          "content": "da74df48c159c537802a18eba9b6321d711d9de9bc7504d92a005a84d79a1816"
        },
        {
          "alg": "MD5",
          "content": "ac1afb15798fb5cbec2d616e7405781a"
        }
      ]
    },
    {
      "bom-ref": "b86eaf51-0341-4598-9aec-b05bb725d80e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/network_delete_checked.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8f291aace881e12b632b52f99e5787cf8a9fc3a3"
        },
        {
          "alg": "SHA-256",
          "content": "98fd4c14556ce6c59b3d86fa2ee10bb9cd5e940bafccb94735b3a1da0f57cefa"
        },
        {
          "alg": "MD5",
          "content": "62f897e0d8ea1c3cc2cbf49edf12f048"
        }
      ]
    },
    {
      "bom-ref": "b87ef7cb-f46f-4b18-86b4-5ca17f1ed246",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/mouse_middle.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "32c258b0874833cbe55fa94a802212d52b114573"
        },
        {
          "alg": "SHA-256",
          "content": "748531033e411651406a60680d0210e9d8d30a012327091acaba83545ac1aa0d"
        },
        {
          "alg": "MD5",
          "content": "937e856e92d0141b5efc1f5d5c21e4b2"
        }
      ]
    },
    {
      "bom-ref": "b8840357-701e-4da2-acf2-8f1519e9ce94",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkdb5.so.10",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adfd60fecd3221a987ff21090e377ec40f929d56"
        },
        {
          "alg": "SHA-256",
          "content": "4ecdceb0baf3964c1941fab95f45fe3c2697d2bba9af30a2fcd3732adad68e33"
        },
        {
          "alg": "MD5",
          "content": "869143339ba07ddeaa68b2a3a69e9cdc"
        }
      ]
    },
    {
      "bom-ref": "b887a475-2699-43ba-90e6-b888f82dc778",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/reset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b892c74e-0244-42e1-a9ae-a2c72d8d1675",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/nvmetool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b7fa577ef286d7bb8288c006edfd9d3f3e46b582"
        },
        {
          "alg": "SHA-256",
          "content": "af7ac647cf811b458178c516e23bc67b3347c423a95196bafb798ae0997d8b99"
        },
        {
          "alg": "MD5",
          "content": "8a995b04f8e4072e3bf0747b2a43f517"
        }
      ]
    },
    {
      "bom-ref": "b8999693-0ef0-45aa-ada4-fa8f6b1a9fa2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b29b3dea128f1544b982439e270c00948c01ef00"
        },
        {
          "alg": "SHA-256",
          "content": "abc8caafa0de7e495696f043b80fa6d2e4cb3a68ef45fbaf4eae42fce45dcca5"
        },
        {
          "alg": "MD5",
          "content": "20ff1ae073203c16e0a449a67d254416"
        }
      ]
    },
    {
      "bom-ref": "b8b51ab3-c38b-481a-acc4-756d9d4b868b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Snooping.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5500163b653dcd76bcf65bfb556790adcea22910"
        },
        {
          "alg": "SHA-256",
          "content": "346e65bf251ae3070a5a8e912c2f5a832b2c6ff8f91686f55ea4d203d1cea888"
        },
        {
          "alg": "MD5",
          "content": "f6ea0e5b12a93c6bd3d442597f08587a"
        }
      ]
    },
    {
      "bom-ref": "b8c13cbd-ea1a-4654-a76e-4e50eed8336f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_dns-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d9872e803b22b1532a804c0900dd4ecc773eb9e8"
        },
        {
          "alg": "SHA-256",
          "content": "9705e56719a80b219cd8dafd9cb6168462c06c090c7a79c77cb5c6a041c6c2f1"
        },
        {
          "alg": "MD5",
          "content": "709af7961678199dde2c91f519b53dd0"
        }
      ]
    },
    {
      "bom-ref": "b904dc3f-17de-4695-887e-2b733688745b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dos2unix",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b942eac8-11c3-4adc-8b68-d7338ce0dc4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/ld-linux-armhf.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3636a7eba387bb5e1ccf7ce671e7266831373069"
        },
        {
          "alg": "SHA-256",
          "content": "17ca988d6dfc4686b54da143476d0f13fab9a374bb61883e0172645a4a222369"
        },
        {
          "alg": "MD5",
          "content": "e623f9f83ab0e413b6f79cc08d8d4bba"
        }
      ]
    },
    {
      "bom-ref": "b94b2e41-0603-41f8-98f8-7e5c28c53400",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_snooping.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "89de3d5c80caab741c24aedbb72a99936114c829"
        },
        {
          "alg": "SHA-256",
          "content": "c4751ab1fb6b9bf0ec812be503d75aae420ca07b6e11e8bef9cd85eb802a0dad"
        },
        {
          "alg": "MD5",
          "content": "6611a520267fe8ac607d6150365f4e22"
        }
      ]
    },
    {
      "bom-ref": "b953bdf0-bf13-4525-a812-de1e055467ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setuidgid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b95b71ce-7043-4f83-a7a6-c4ffd1c1d151",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_lang.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5d01edda939b03edb44d93984444b50958eaf920"
        },
        {
          "alg": "SHA-256",
          "content": "700c69b56c885d84ec706fc73c860549e88ecb880f681d6e4b181c258134f328"
        },
        {
          "alg": "MD5",
          "content": "e72bd8b57adb4c128f3e6cfa51afdb5e"
        }
      ]
    },
    {
      "bom-ref": "b9695cf6-2aef-4521-b396-5da168474f4a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcIndCIMXMLHandler.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cb0840e5388a9b8292e6ac8fd6a1e0d7a48c46c8"
        },
        {
          "alg": "SHA-256",
          "content": "e9c7a8e315c20e88884ec2ec66711efab8b9127b5c27e318f9598529adab103c"
        },
        {
          "alg": "MD5",
          "content": "b8e2e3615f2eb3ca07ea1f433cf25678"
        }
      ]
    },
    {
      "bom-ref": "b976f03c-e1d9-4cac-ae72-6cf51aa2b817",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4464f03754a467d54f983ca9e9a6b97fd976199"
        },
        {
          "alg": "SHA-256",
          "content": "c5ad4fc9556f28179976f3855dd6a86afa96bdc6e0b7668e01bc8397ff621cbb"
        },
        {
          "alg": "MD5",
          "content": "0a41aefbb26bfbdb00b0ff34c450223b"
        }
      ]
    },
    {
      "bom-ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/less",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b981ea3f-ece0-4f5d-aff1-4db7d8ebd82d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOam.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d8e773250de78d4d4467b4f03d91c67c0b23d946"
        },
        {
          "alg": "SHA-256",
          "content": "250beb289d6b15d875358166fa13a002a32287d0a461dd84546717b9dbf604dc"
        },
        {
          "alg": "MD5",
          "content": "96e61451b3129b04ce55108e12bcc602"
        }
      ]
    },
    {
      "bom-ref": "b98b77e3-691d-4a22-8ce3-505d63cf0e27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpiofind",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fca91d30f84ba1a6d9c036f1e74e45cadb4e1e9e"
        },
        {
          "alg": "SHA-256",
          "content": "f4a52d8eb324ac886415d6118beeaf49d7d1a7556158b02fd8bf847f009f9b43"
        },
        {
          "alg": "MD5",
          "content": "abf4c2d346d03eb5f2bc883e5917a0a3"
        }
      ]
    },
    {
      "bom-ref": "b9913a1c-4946-48f5-bad5-6500fcbbd3ad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/timeout",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b9933717-74b1-4ddb-ae42-abd579dae73a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiThreshold_SensorProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf9cde9c96b7b87128f7991023bb51d9bc30c7ae"
        },
        {
          "alg": "SHA-256",
          "content": "55b876e694378869df09304e23fee9fd533528da02711f8a1b2d82f1c64bce2b"
        },
        {
          "alg": "MD5",
          "content": "6d686bbc5606e56c39dc0600dbbdb6ac"
        }
      ]
    },
    {
      "bom-ref": "b9cf9f2b-0a9f-4b3e-8521-e2cccc9d4f0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcManagerExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "645000f785c998786c4bac9e7bede2e4624572e6"
        },
        {
          "alg": "SHA-256",
          "content": "c086a804b23eb8eefa59479de13bc33d60a4fc6836b3640999ba3e9b71b7f515"
        },
        {
          "alg": "MD5",
          "content": "fdb03ab7e121fa91012f9b92c395d100"
        }
      ]
    },
    {
      "bom-ref": "b9e18b01-5330-40ae-b5fe-ede8d0156c37",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_cpld.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a350dcdda05bbef41cb27772028920feccfd4d61"
        },
        {
          "alg": "SHA-256",
          "content": "c27aa9df9f54330946dd9a06e94a6e454c95f3311386449d498b88cb4230fe9a"
        },
        {
          "alg": "MD5",
          "content": "24be50df6fd0b1fc0e3d4356413065b6"
        }
      ]
    },
    {
      "bom-ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/md5sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "b9f485d1-e1c4-4682-b121-2ae6c48a50e3",
      "type": "file",
      "name": "./1997573-5274341.xz_extract/xz.uncompressed_extract/10936716-12085052.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "742cc8d4dbf795f2c7eb3d9db2b15e977e1a5b78"
        },
        {
          "alg": "SHA-256",
          "content": "ad7466eb577c07e26511bd355ea1c6c48cf21eeaaf93fb15bde8f521c194ab2b"
        },
        {
          "alg": "MD5",
          "content": "7a08005a1fd76082eb9609c646b8a8b1"
        }
      ]
    },
    {
      "bom-ref": "ba4fafe7-206b-4e66-8503-6df53b92a12d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBasicAuthentication.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "90d888803b2a7da3e9ce7fe26d528ba49e250829"
        },
        {
          "alg": "SHA-256",
          "content": "912563dd582d975b6f26b0d7997de9d6237ac7e12a567daf2d04b464e18ef07d"
        },
        {
          "alg": "MD5",
          "content": "51e9e8d91802c3df2a6d29e745f80215"
        }
      ]
    },
    {
      "bom-ref": "ba53eea8-8197-4275-9653-2cd3a65de36d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libattr.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0dc02667c1451329e26879d97c53bcae6a8d914"
        },
        {
          "alg": "SHA-256",
          "content": "7f50f91cc02a8bf12119b5d4ce81273c69e1fadd9be499bde0f43c47d0026e07"
        },
        {
          "alg": "MD5",
          "content": "e8feb6b8ac215b468839e2ac31a2f90b"
        }
      ]
    },
    {
      "bom-ref": "ba58c846-ca4d-4941-b3f3-c3bed7635e44",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib8.so.08.1408.0000",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "805af848bbc5e9e340b9865ed15fd9c315d4f731"
        },
        {
          "alg": "SHA-256",
          "content": "6ceaa9dfb18357cdbf52de3eb6ce786147ad74c8487d150cc286f2579b9e9114"
        },
        {
          "alg": "MD5",
          "content": "bc0820dc26f5d3dc091333238ec81651"
        }
      ]
    },
    {
      "bom-ref": "ba5e6f7e-8fde-4579-8efe-ab38c959c51f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86b77f43e26d9bf9586f69cdf2bc086a0d44e44c"
        },
        {
          "alg": "SHA-256",
          "content": "e5f77d44783d64c57d149005a8c718a08920d59369a7aedf466f2f2e2c4fa093"
        },
        {
          "alg": "MD5",
          "content": "00398bdbf8781eaf12583add9e07dc6b"
        }
      ]
    },
    {
      "bom-ref": "ba92748d-9020-4117-9aba-6298d753164e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/share/crashdump/input/crashdump_input_icx.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73a33e8bbcad21a501c9c19d804375f7e2b283c7"
        },
        {
          "alg": "SHA-256",
          "content": "95d342c295c72c0812aeebefd47d005902b66e2733666eba3a873a127a183ce6"
        },
        {
          "alg": "MD5",
          "content": "32ade7054d075ab1fc24b749ebb66eab"
        }
      ]
    },
    {
      "bom-ref": "ba965c7e-e7b3-4a81-a72a-ac52e99a737f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/lightbox_prev.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8023a97bff6d9ceca20b26479dc397a58cf1fd5b"
        },
        {
          "alg": "SHA-256",
          "content": "accc71943f21744fe4ecdbe6fca177268042117655d268d57aa389aecbc758f2"
        },
        {
          "alg": "MD5",
          "content": "e54e57d280f09f1e8ecef7a641c0f8b3"
        }
      ]
    },
    {
      "bom-ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/powertop",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bad36364-0b24-4575-9b56-f240f05bf9cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/warning.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6c43281dc8831357715036d57a33732acd555a8"
        },
        {
          "alg": "SHA-256",
          "content": "d7ba35ca6ed3c9fffd105cfe972d6746517c050ec167140559c5013c9b0f1b81"
        },
        {
          "alg": "MD5",
          "content": "d71f26448542969be94d7fbb39410d2f"
        }
      ]
    },
    {
      "bom-ref": "bb0abfdd-e193-4d23-bb04-0b52ab0aaa32",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/Volume_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8658a1a1a7ff79bcfcaa2d51df9c15f0bcb9e0f1"
        },
        {
          "alg": "SHA-256",
          "content": "2a224b7e2ce1b91c579f63030bf438a900e338a8351b62436b204f2f46907a22"
        },
        {
          "alg": "MD5",
          "content": "d345d93ecb0ad695ebe4860729219c85"
        }
      ]
    },
    {
      "bom-ref": "bb0cbec2-432a-409f-91aa-4a14b1119e0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a3ded3a5345ca6830fd0e2710e4df679e0e5bd6b"
        },
        {
          "alg": "SHA-256",
          "content": "aaa882347d8d88c30a3553ebf7f9ff84217b9074b457ceb1a438f95e96311ab4"
        },
        {
          "alg": "MD5",
          "content": "95c086b215af6c4cbf05a1207f004143"
        }
      ]
    },
    {
      "bom-ref": "bb197d8f-92eb-4a69-8e1c-2f982c97fef3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/bpn_cpld_update.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fe8267c8c845876e8736375df62e5be7684fee78"
        },
        {
          "alg": "SHA-256",
          "content": "54c9ed6f8824c66d69b628d2c75933bc84e952d2119f204f8abc61367b48aa0a"
        },
        {
          "alg": "MD5",
          "content": "4a9fc760c32f508a2f285ad0e9415b81"
        }
      ]
    },
    {
      "bom-ref": "bb2a76eb-0bad-4c00-a24f-bfd223212f92",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/language.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd25f08f203394c23860ca0ad7d1fcd93ed9c143"
        },
        {
          "alg": "SHA-256",
          "content": "0e68456e4f4d89193b86fb77d33236ab9962d928c8cc0b418e45a8305f82e1c3"
        },
        {
          "alg": "MD5",
          "content": "457981752a3a61e3194910929505075a"
        }
      ]
    },
    {
      "bom-ref": "bb4ac4b8-bd5d-4b6b-b480-33c657411c22",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/find",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bb4e40a6-670e-44a5-bef0-8dee6cfb2d7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/systemLock.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1a6bc6e67ae1ef8ab145f50b1c290a2b6cdf32f4"
        },
        {
          "alg": "SHA-256",
          "content": "6c566aa18af0b13740b61535e05df1623eefac39f8da743b2c4ab3d75700ea7e"
        },
        {
          "alg": "MD5",
          "content": "882aad18fb5cbfd76ac69a78b1f9eeba"
        }
      ]
    },
    {
      "bom-ref": "bb5115bc-f588-4886-b166-059f7d315118",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ssl/CA.pl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "20009ebca84af77198047a7de887b6ea3819d7bb"
        },
        {
          "alg": "SHA-256",
          "content": "61ab95f7e96f2b0f2acdcafb8afde2f6c43e899416397230c2fae9c1e701e45b"
        },
        {
          "alg": "MD5",
          "content": "bd242291f50246fbcb3f69c601bb907f"
        }
      ]
    },
    {
      "bom-ref": "bbabebf3-279a-4315-ba40-db89ced4f07a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/more",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bbe1535e-72b7-4fce-b309-88c2a11a384f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_kcs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d41531d4651724bf35c7a141fa56aa2bcee67a82"
        },
        {
          "alg": "SHA-256",
          "content": "9f97726be8dab05b7bdc67ebcc45fe83bbe249abb3d60fcc0ebd05a06c68337d"
        },
        {
          "alg": "MD5",
          "content": "d20321e91dd40d4de7c2df3051dcc53d"
        }
      ]
    },
    {
      "bom-ref": "bbe37d6c-331a-4dc1-908c-f8e98cdc3451",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/GPUDevice.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2dc57bf9a9ba7d4999f6993de97213504d5bda89"
        },
        {
          "alg": "SHA-256",
          "content": "5130bb419bc110a2cd26f28af587907391a73c569337af66e2b95120b007a819"
        },
        {
          "alg": "MD5",
          "content": "12fb1d32bd8de5c6df5ec92995deaf2f"
        }
      ]
    },
    {
      "bom-ref": "bc08e665-a3d5-498e-b516-74dbb279e8ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/resize",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bc321ac7-fa32-4fbb-987f-7b34b9a9cffc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/expand",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bc3ab192-d637-4dd3-9991-53747754aa21",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFirmwareInventory.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adb7dc8704940bceeec4b8a3714bc38862c6e126"
        },
        {
          "alg": "SHA-256",
          "content": "15ae2a50a4cf8ebfe9d0d7ab7512584ad7e79841386307637c2e13f3549531e0"
        },
        {
          "alg": "MD5",
          "content": "83e7c13e394dd2d0c1bb12a726225789"
        }
      ]
    },
    {
      "bom-ref": "bc3eb7a7-7aae-4b74-bb60-0c816ab3d8f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/zcip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bc45338b-0b19-4fb9-956a-77881e517979",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/panel.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3200ba067695117ee5d6072665c875fd4dd1eb0a"
        },
        {
          "alg": "SHA-256",
          "content": "6f7f90dd0cb70c57b756f68bf752ee4d46abfc30cca32153f318766b17bf5648"
        },
        {
          "alg": "MD5",
          "content": "1d03f041f83049b53934b054f2bcb4e1"
        }
      ]
    },
    {
      "bom-ref": "bc4ee5a9-1dff-42ad-9571-46a30ba9de08",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hostid",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bc5bee66-ccfe-4a02-ad14-ca7f8e699081",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SupermicroAccountServiceExtension.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "93569daddbfa515d2b36969176f7669c5daa8653"
        },
        {
          "alg": "SHA-256",
          "content": "664a3a0ef3a96ae49d07173866fd1a2ac199ad987f5cd76744452772ff3dc57f"
        },
        {
          "alg": "MD5",
          "content": "55f9b1e93923a982291bd35bf2b53721"
        }
      ]
    },
    {
      "bom-ref": "bc6b77a9-9492-40c9-a4b9-9f422631201d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_pcie.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f18b3738b248dca55ca4844db8b45e0e0feb6ec"
        },
        {
          "alg": "SHA-256",
          "content": "9935756e27bf8c998e704126e4d108b3d2974f10ac54486d85e8a62f6dcb0c04"
        },
        {
          "alg": "MD5",
          "content": "5fc3117a39bee0d5477281da5a8644c7"
        }
      ]
    },
    {
      "bom-ref": "bc851e16-d394-459b-8f95-8980a31de89f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/banner_status_yellow.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b4a438ffbc5a863351b84cd864a43a46bea4a069"
        },
        {
          "alg": "SHA-256",
          "content": "f29d2fd1fe810626f76a4442e98bbf9d439892d8d378fa8519d531153e3303ae"
        },
        {
          "alg": "MD5",
          "content": "0cf8f6f537c1cef758e851e943bb8d52"
        }
      ]
    },
    {
      "bom-ref": "bc9408ad-bb60-4820-9e4d-d1dc86dbbffb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomain.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bba2172cdc04d617c4ce2199aec936fb59123c1"
        },
        {
          "alg": "SHA-256",
          "content": "1273632f56b81a8d0fbf54edf3ce2506728b16b8fb5a6490a12d03e8c96c19ae"
        },
        {
          "alg": "MD5",
          "content": "2d95a80b90232e6a2588b61beadb5d77"
        }
      ]
    },
    {
      "bom-ref": "bc95cc59-8533-4dbc-ad8e-25315f698d99",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/MN_Power_Off.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "513e15b7a0debab5d01bb332a37a0b7764a017cc"
        },
        {
          "alg": "SHA-256",
          "content": "cc4f2289d0296f55c25fc54bcdd9faa8ee92a0272599948f8e5c843a0e28ca5f"
        },
        {
          "alg": "MD5",
          "content": "c3d294e6359c47c51725ae3ef288d315"
        }
      ]
    },
    {
      "bom-ref": "bc96bef7-ce14-4cc5-a491-ace67a529089",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_compat.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d96f3079932f7eea9b312c9d9cc4f35f4b916bc2"
        },
        {
          "alg": "SHA-256",
          "content": "07e54b12bfe49788e02b246ad6cb5779eb5ad8d987f94663759011117adfd400"
        },
        {
          "alg": "MD5",
          "content": "ea0a208c0464cb133a708a1776c75b38"
        }
      ]
    },
    {
      "bom-ref": "bc99928c-e28f-4705-a424-e11d84c71bbb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/klogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bca69100-cbc2-4181-8079-4c94b5904b28",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamEthStatus_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ae0b7243ee302d865db1d9c42850d1edbda8f330"
        },
        {
          "alg": "SHA-256",
          "content": "0f13813c579ae2b62ab7ece68e8c7f03dc6e20fdb0e72d085073d1a173f3b4dc"
        },
        {
          "alg": "MD5",
          "content": "59303fd3fd148fe2098ef18bdde1bfe4"
        }
      ]
    },
    {
      "bom-ref": "bcb95990-d2d7-4f65-b5fb-c90b76a6020b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/inetd.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fa9dc1bc3956d6e9c9b391599a7a8ed849ebc739"
        },
        {
          "alg": "SHA-256",
          "content": "f6459ba7829280affb3509353778c74c6c81e9a7ad07ba01e91c659306707c01"
        },
        {
          "alg": "MD5",
          "content": "6d8fae6fa420384f72724fe3d9097c6f"
        }
      ]
    },
    {
      "bom-ref": "bd09d83d-1253-4736-93a7-d6f05f8d0be4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_coroutine.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5425e5134484dbd593bcbc359999d333ef48b3f7"
        },
        {
          "alg": "SHA-256",
          "content": "a255272c6c134ea90dca95d160528d9a91ff709419dd050db2755055edd092e0"
        },
        {
          "alg": "MD5",
          "content": "1f20ff54bd20c2894edd0d0d0b7f2075"
        }
      ]
    },
    {
      "bom-ref": "bd09ec5d-b3b7-4361-85dc-0e22e0ae11a1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_mdns4_minimal.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7366db176f5e216b7e02a9855ba7d51d269fa30c"
        },
        {
          "alg": "SHA-256",
          "content": "5b0262e8e2a5c58fba5fbb5918d7d4f465f4444742391fe79a44e0c26332e2ab"
        },
        {
          "alg": "MD5",
          "content": "83955198f8f4133391b294eccbce5c06"
        }
      ]
    },
    {
      "bom-ref": "bd15c670-4cd6-4739-9695-4a4b43ca68ae",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_5.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "436881354ff304e7830e120d544cb25401094798"
        },
        {
          "alg": "SHA-256",
          "content": "5777b648854dc79acf8183ac8833f2d8279295d2be99086b54a29bcaf0d9b422"
        },
        {
          "alg": "MD5",
          "content": "9eef28d8bcb81a706907760c0f9b8d8a"
        }
      ]
    },
    {
      "bom-ref": "bd25e92f-94bf-42da-ba91-f7e7e1acce8c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/bpn_cpld.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e44605234afa03cf285213f70cc565c2c1f7e562"
        },
        {
          "alg": "SHA-256",
          "content": "2ecb4d27c60e77382abcfaf5f5bc54d4202cf83c884b0d7acb5d03da570f4cd2"
        },
        {
          "alg": "MD5",
          "content": "a9e12c03e035cb23aac057cc9d1344e9"
        }
      ]
    },
    {
      "bom-ref": "bd32bde0-7e1b-4827-9b86-46d9847ec9d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logo-opera.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e4266e7682defc2d7c6de6e77b92fcda8267d7be"
        },
        {
          "alg": "SHA-256",
          "content": "41026449a4448c77c0b42a98cbae96db3cdce5775851860e598f1d914bf8a84d"
        },
        {
          "alg": "MD5",
          "content": "0bd1a3ff017b4e87c8ef8adbcdfbd2ac"
        }
      ]
    },
    {
      "bom-ref": "bd3cd1c0-4511-45af-b915-c3253c6be9b9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery.blockUI.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6910908925e0682e45b30f7848e219376cec0dfa"
        },
        {
          "alg": "SHA-256",
          "content": "2e4cc098bdebbf91c4a335577d0472ded159d8c02776070e63832b0267c3c419"
        },
        {
          "alg": "MD5",
          "content": "e8df9850165251ea4ca3ae99aaeb0dd9"
        }
      ]
    },
    {
      "bom-ref": "bd4f9019-17e1-4576-9b57-5db5ab7d387b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcHttpAdapter.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16f0f7ddeb0d3565eb00ba9f7c78a16b909d8f2e"
        },
        {
          "alg": "SHA-256",
          "content": "b419d08ef6de4c00780de544d283e3f0935547529643fb24b153e082e52ace06"
        },
        {
          "alg": "MD5",
          "content": "8bc2a1bb518674242859c6078ce6e545"
        }
      ]
    },
    {
      "bom-ref": "bd622e24-e1be-4c5d-b093-5fc782a28303",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/blockdev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bd8f8477-1c1b-4e82-8e28-8e8b34acbdf4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/runsvdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bd988869-d5c1-4965-81b2-d2a93978687d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6325ca4f54dce3d02f414b353279fa224b99ed7"
        },
        {
          "alg": "SHA-256",
          "content": "1265d0a3136ed74463af7fb310cbcad1a3313e9c7f076bcdf06ebc1cc4a85ca1"
        },
        {
          "alg": "MD5",
          "content": "d372da57e93fb0d4b2e4cd9741bdf0d7"
        }
      ]
    },
    {
      "bom-ref": "bda42d37-7c1b-4f5b-bec5-27123717475d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b1e905d18bd004d73ea48541d2dd955c94e3f5c4"
        },
        {
          "alg": "SHA-256",
          "content": "22486d3d96756c3fd5d356a32465783d2ce8b04ff54ea93595cb71852febcab5"
        },
        {
          "alg": "MD5",
          "content": "4bd71149fb45024df36b0ffe3165e880"
        }
      ]
    },
    {
      "bom-ref": "bdaea78e-0eca-4865-88ec-836565014d90",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcServiceRootExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df3266f7979e7a40c2ffd1f0e1913d4b5ab3f243"
        },
        {
          "alg": "SHA-256",
          "content": "80c7ae9ebb41138396f2e07426e2faebcf7e0d583efea635c72c6a2c5c7d73ab"
        },
        {
          "alg": "MD5",
          "content": "dc4548dfe04524b1ac2b8dd37caf8f36"
        }
      ]
    },
    {
      "bom-ref": "bdb6a8ef-7b4b-419d-ae8d-d899f6e624df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_UserAccountProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6af4c2ea5bc66941e511c53175be3f77cabef66"
        },
        {
          "alg": "SHA-256",
          "content": "2b18c71a6f86e509756c236e72d49353fe824a8fa9c4b0057a26da21f2ede6af"
        },
        {
          "alg": "MD5",
          "content": "7e4cd807b60d1c28c9330ae9a243caf7"
        }
      ]
    },
    {
      "bom-ref": "bdce294f-72f5-4ea7-8df7-1eddad9ceb66",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_8_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a6805b32b703a8d8332e176053a0c413599f0711"
        },
        {
          "alg": "SHA-256",
          "content": "e2a5c955f5b5b1ec3406ccaf4d3e92200c748b320963c836f0126b95f0fbecca"
        },
        {
          "alg": "MD5",
          "content": "51b0263ccdabef1ca45d6461ad49d664"
        }
      ]
    },
    {
      "bom-ref": "bdd1d054-d48b-45d6-bc32-8f4c02bcb09b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/updater.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "db4855e91fb16eed87d3f82c5d829140468142eb"
        },
        {
          "alg": "SHA-256",
          "content": "5fd0a6cf622f35522d0ed19b2dc1ec230ac3fff9ba7c5d6c8f6e9acfc6edb5e0"
        },
        {
          "alg": "MD5",
          "content": "f6ad7557efc2d34804269af41998a022"
        }
      ]
    },
    {
      "bom-ref": "bdd50734-2af3-4834-a75f-c716c134d793",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5srv_mit.so.12",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cec153f407766ffa8e15f06b72e53354a02007cf"
        },
        {
          "alg": "SHA-256",
          "content": "eda635b190033107ae2efbaf2e527f3dd775793f6630d0c25ce4684d49db5098"
        },
        {
          "alg": "MD5",
          "content": "f631585caddfcaa93f9c2c8170a3ef7d"
        }
      ]
    },
    {
      "bom-ref": "bde12a75-ba21-4f32-9eb4-250fee43f3b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/account_lock.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8f7a046183c5ee0c5cc0a18bf9d2fd2c22b3d978"
        },
        {
          "alg": "SHA-256",
          "content": "defa22e0e3de2539a1b1395186e96305b82076763bc429f2a5f00350cba3fc1f"
        },
        {
          "alg": "MD5",
          "content": "c23e0f7a75107ef0a9991a5157f730a7"
        }
      ]
    },
    {
      "bom-ref": "bdf2358b-586d-43c6-8d41-5172419e2ab3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/row_alert.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f66a2e64f5124b9f5bbe96fbc20bba60abe0d9f"
        },
        {
          "alg": "SHA-256",
          "content": "e6b74efc2003da43500e191de455dd6331a20faade6e0a91b8f1995189de7ce1"
        },
        {
          "alg": "MD5",
          "content": "a7fcae82b52c1260b2ac5ee9b5ecc634"
        }
      ]
    },
    {
      "bom-ref": "be0d3274-d93f-4860-8c03-2d948c08fa72",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RollbackID.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59f9973047d55214e146115037a48d608227d019"
        },
        {
          "alg": "SHA-256",
          "content": "b50e2736e4e29336ed8a3e1c9c121cf1262796c63c6c6e574187316db2cfc969"
        },
        {
          "alg": "MD5",
          "content": "b6fda4a64dbf3f4acf34af1e285e718d"
        }
      ]
    },
    {
      "bom-ref": "be237960-293e-4eb8-a670-6cadae19f8ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/disconnect.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "821ccf63e5e99d45b492e0f56b12a596a18949fc"
        },
        {
          "alg": "SHA-256",
          "content": "d9377be835230f0576709b7996478dc78d4ad2917456fed341335b7f36fbf45c"
        },
        {
          "alg": "MD5",
          "content": "55b337e28a81f723146e00f67be7871b"
        }
      ]
    },
    {
      "bom-ref": "be28e386-75e3-43bd-9bce-160d92c97586",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e9e9df4d71f25eac905ef0fe36bbf64741c3c2ba"
        },
        {
          "alg": "SHA-256",
          "content": "9f2daf903f2774c3852c0264094d60f65e120d8cea21dcea2164d8fd9ca1624c"
        },
        {
          "alg": "MD5",
          "content": "d897a2015f7ac806521145cf2784a3c6"
        }
      ]
    },
    {
      "bom-ref": "be873599-5d10-4eb2-b6d9-7602c7f2e848",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dnsdomainname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "be88bfc7-2e32-4e55-94c5-f867d31ff150",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/spdm_nv_rootCA.der",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "72be15b8b2c8d3f482f84237a6fcc45b8a1354e8"
        },
        {
          "alg": "SHA-256",
          "content": "102bf659d5419614c9d8e6aecebc80454eb26b1df6a769ac720b9a690b167b48"
        },
        {
          "alg": "MD5",
          "content": "c5fbb59fbd3e4188a6dd60df3fba52fb"
        }
      ]
    },
    {
      "bom-ref": "be9b63fa-dab3-4bb9-8cb4-b4ad51c97166",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcMultiNodeCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f0705f07e0ee3bee734d4c03c1a006386536fb62"
        },
        {
          "alg": "SHA-256",
          "content": "32c07c2db0c7685d305577de928b5079821d6b3b25274ca46c6d80657bcfef3f"
        },
        {
          "alg": "MD5",
          "content": "463aac00091a4d8e6e328a784a49bf6e"
        }
      ]
    },
    {
      "bom-ref": "beaba0f6-fa09-4708-b5e3-ef38bbec42e4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBrokerCore.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "779c0cd06ea905815ea879d895b34b8b3eb36b62"
        },
        {
          "alg": "SHA-256",
          "content": "2cf252b6b66b821b81da98e8530af76c4f02fd48181d6a634c31074cbe6b536d"
        },
        {
          "alg": "MD5",
          "content": "e8f026ed88817f637bce55587cf7b327"
        }
      ]
    },
    {
      "bom-ref": "bec03f87-64b9-4cd7-af23-26f6ead470fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libext2fs.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6f633db55bab7e9346d6f2f7d3595af7af624527"
        },
        {
          "alg": "SHA-256",
          "content": "8c827d1ecb848098501ede3dba670f9eebf8f1988653f423fa1730bac51757db"
        },
        {
          "alg": "MD5",
          "content": "7c2f8715505b6aa46bd929243d43ee4c"
        }
      ]
    },
    {
      "bom-ref": "bee53cb1-c200-4f62-8be2-715c4382f43a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/fwmanagement.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7ddbffc071d0040bdba166316b07eba1064ba6e3"
        },
        {
          "alg": "SHA-256",
          "content": "49714ba6fa9d4137083d63f5adeea4417c797bab8fecf04cd9c1937ea3b5ae70"
        },
        {
          "alg": "MD5",
          "content": "70245c039fb7cbad12a9ff844eace2c2"
        }
      ]
    },
    {
      "bom-ref": "beeb5e0c-d8a5-482d-ba6b-10fa2d75fbcb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/mkpasswd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bf052e0c-5132-43bf-8f9f-a754228a153c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9a7ebfcf1111cc085a18fd5597bca99a569e2030"
        },
        {
          "alg": "SHA-256",
          "content": "9d3db65f4b613b1be8b9ed5bcb77f36ad9356f8eaa801d016e898aa5f0c1e167"
        },
        {
          "alg": "MD5",
          "content": "9e564e39dcb3070265daa78611b6696c"
        }
      ]
    },
    {
      "bom-ref": "bf07e11f-c2d4-49be-84d7-ca58ac64a528",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcVolumeExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "268b3acb33332fe69ef08a051d4a77e59b28289c"
        },
        {
          "alg": "SHA-256",
          "content": "d164118033e44ca55bba69208877ba5f34717e002248eddcd1e5c75c600a714f"
        },
        {
          "alg": "MD5",
          "content": "9f7e5f7e6bbe6d71787cc6f01a089e9a"
        }
      ]
    },
    {
      "bom-ref": "bf2fff39-f187-4b65-88e5-5524b9060ff0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/config/ntp.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fc275d9f93d90787cceff4569acf658032a700fd"
        },
        {
          "alg": "SHA-256",
          "content": "099153c85505255c12800e90037555fd28058136d8165417173b443f8969ebfc"
        },
        {
          "alg": "MD5",
          "content": "d82cb6ad4e6547136679f06852180ccb"
        }
      ]
    },
    {
      "bom-ref": "bf56344b-2b27-4780-85d5-ad6849f9dbf1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/right.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad20736aa94ce4a97c224d4e468551d92630a7f0"
        },
        {
          "alg": "SHA-256",
          "content": "b0eda150420876df5998ba2bce5e3a42151e98fdca94595c1e387e2a6787e486"
        },
        {
          "alg": "MD5",
          "content": "243d316366d9b435f59c377378770124"
        }
      ]
    },
    {
      "bom-ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pipe_progress",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "bf9e9f57-6611-47ce-b365-5ec38fd91613",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_10.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3051a71d7184217b77931dae765fa3d2d1bf3fcf"
        },
        {
          "alg": "SHA-256",
          "content": "ec49729a857c5c5912ff25e6810af2b89c5869fe3ae1f64269b0061cc0cbe704"
        },
        {
          "alg": "MD5",
          "content": "99f31b1985a00c7803012ac414f4760f"
        }
      ]
    },
    {
      "bom-ref": "bfa0f56b-de84-4088-9ae6-92039c4c8d0b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/CXLTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "442a8554e38ea9bf2100e19e0d5b733e70d93441"
        },
        {
          "alg": "SHA-256",
          "content": "51217db4160ab07abc27407c26edc5d1c9aa236f5e135b4fbe924549bed4e09a"
        },
        {
          "alg": "MD5",
          "content": "726f2f3998f3eb2d001fbe6bad31f9a8"
        }
      ]
    },
    {
      "bom-ref": "bfa8ae3c-6cd1-4a36-9e1a-96c85e965b6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_network_lldp.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "028a3a6bea48d72d884a3f6d6a60d54c6bdca5c6"
        },
        {
          "alg": "SHA-256",
          "content": "4a1ab2fccdf582e2fd22e561aa55f76ebf52ac63fc31892fea79a1dbee45586e"
        },
        {
          "alg": "MD5",
          "content": "f8d36f2a98f35714c8fa65a10312aea9"
        }
      ]
    },
    {
      "bom-ref": "bfdee99d-a2aa-4bf2-aa55-72718b8fe8f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/sys_cmpn/overview_fru.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a7f4a0947c31eaba7a64bcc8d012750bd7269e68"
        },
        {
          "alg": "SHA-256",
          "content": "14717f295e69ce3461890f5f6298149dc4deefde3f86b1b183e40145976a41b8"
        },
        {
          "alg": "MD5",
          "content": "e420edd7a4641bf740868c0a1bd412df"
        }
      ]
    },
    {
      "bom-ref": "bfe7729f-60d9-4046-a657-4b1d8e42e7bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_PUE3.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "631f1c3b242a3e926dde841e77ec44d750e317ae"
        },
        {
          "alg": "SHA-256",
          "content": "1075f8c1a71ab28ed3576ddd74376a73544906b5e78b5a0efc461651bb266965"
        },
        {
          "alg": "MD5",
          "content": "b2b644cb14325edb4db32b62e5871781"
        }
      ]
    },
    {
      "bom-ref": "bfea2820-280a-4dd3-a2f0-60d12404796a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/eraseAbort.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74673fb3fa2bd7a46b3dcecae25a9e14b07b52cd"
        },
        {
          "alg": "SHA-256",
          "content": "3ec9cefadadac537865b7d7fb78f05e7fd56b9f05dc5202c93e119fc01f85805"
        },
        {
          "alg": "MD5",
          "content": "4c0051b6429184f65829ccb4a9b5557b"
        }
      ]
    },
    {
      "bom-ref": "c00ff5fc-89f7-45cd-987d-9f18fb021271",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c029b294-89f7-4967-8653-775a36230324",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/savefromPS_OOB",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "91f98584c171eb7ad5fd4f5bd819cc2843a8f755"
        },
        {
          "alg": "SHA-256",
          "content": "9f6f85d88f1bd0cb7013473e46f652dd57b6574a0031070646dd48759211206d"
        },
        {
          "alg": "MD5",
          "content": "ae94ee40c8316882ae45fc7a2cb493d3"
        }
      ]
    },
    {
      "bom-ref": "c0353971-95be-4768-9ff1-785bb1dc6d10",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/services",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "efefd9451800ae16f3a656d10cc12f9145b4007c"
        },
        {
          "alg": "SHA-256",
          "content": "37ef02d60c714356dc523832c57d4329ef70f942e70588a04b04d1337f51c94e"
        },
        {
          "alg": "MD5",
          "content": "122858b98661d43d00c65b916be46634"
        }
      ]
    },
    {
      "bom-ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/mkfs.vfat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c0623a74-1a45-492d-ad2a-91dca06a0887",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/physical_nvme_no_EjeInj.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a731cd01ba6cd7a0c668c70bb98fc4f94623a5a7"
        },
        {
          "alg": "SHA-256",
          "content": "2af236d3fc9bba3c95e23337cd240e84bc52d70a6ee1282ab06fc80fb176a959"
        },
        {
          "alg": "MD5",
          "content": "15477ac00b3f3fbb298b06610536208b"
        }
      ]
    },
    {
      "bom-ref": "c088bed4-44e7-4132-9248-d5764ca1787e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/volname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c0944f4a-7b17-42a8-b8fd-9669b725b9c7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lib/mod_dirlisting.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "daec931d217e1d536349290bd94839ecfaba9ea0"
        },
        {
          "alg": "SHA-256",
          "content": "0736e706487a9458718b04a58ad7c17b86cb538f461d7af41426844716d899d2"
        },
        {
          "alg": "MD5",
          "content": "64f4465333b43f899b455d342f710ba7"
        }
      ]
    },
    {
      "bom-ref": "c09f3717-8632-4719-bccd-8ed41a21f55c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_datetime.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9469c0748e5bd334b702be901309ec6d3a1d3aa5"
        },
        {
          "alg": "SHA-256",
          "content": "f5622907b3ebb7205ad6a8468d82064e793cf866ccff4b0d367df77d7128f0df"
        },
        {
          "alg": "MD5",
          "content": "17e20e8cad7a49bd88a82f0a630436ec"
        }
      ]
    },
    {
      "bom-ref": "c0a21dec-bf4c-4893-b720-bf9f512bf6b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/login_lock_alert.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6efd5a827b59cb18f3aee431e783b7c49c0dd4f8"
        },
        {
          "alg": "SHA-256",
          "content": "22ae6dff4ec261e19ad045e7f8661d6825d594c04f22150220e2393b4d917b48"
        },
        {
          "alg": "MD5",
          "content": "1210258f6d5febe3e9c77b0cb19c266f"
        }
      ]
    },
    {
      "bom-ref": "c0a3d819-c47b-4c73-80be-6287eb4664af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/udhcpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c0af0e13-7964-4a81-b02a-dff8e23858ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libatomic.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48b910a8ccf63d5be6b85d1db031b227fee4bec4"
        },
        {
          "alg": "SHA-256",
          "content": "992bac30241c4cff67f8fcfc7801e9bab1143369da17edb7d88a42e90f8813a8"
        },
        {
          "alg": "MD5",
          "content": "fd500dcbda526b31367f53737dc428f8"
        }
      ]
    },
    {
      "bom-ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/who",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/realpath",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lzcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c0cde309-ce8a-43d5-b91e-ea3e88ac8046",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_9_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9e98995f69c303b85de23e0d09496e1dbe921cbb"
        },
        {
          "alg": "SHA-256",
          "content": "18a5896a233f0c499550c1c7d5c55e68793328f77888f0d7d2f88098dbc52a60"
        },
        {
          "alg": "MD5",
          "content": "3fc7bffa52482e5c0acb3123f05de769"
        }
      ]
    },
    {
      "bom-ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f36c88de-0658-44e2-be21-30ea18b7503d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/html5boxplayer_playvideo.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "afdc477d08aacf68c175295eefc859932158ae11"
        },
        {
          "alg": "SHA-256",
          "content": "f911ab6d125a19310172e92c545c359803e4006d99ae3f7b90ba30d4213c8662"
        },
        {
          "alg": "MD5",
          "content": "d4c1247a73419371266fbb6b9184ddfa"
        }
      ]
    },
    {
      "bom-ref": "c0d09227-30e3-4f86-8ed9-46f38e91b0bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1339562bbb5cfbcdce32505319ee0200910a1656"
        },
        {
          "alg": "SHA-256",
          "content": "e5a9d7651c3a469f966317650edfc6681d33622ee927f2005d2eb75aaf13fde3"
        },
        {
          "alg": "MD5",
          "content": "d0939a31b100fc3ba938b552f28dafe4"
        }
      ]
    },
    {
      "bom-ref": "c0f0d127-e35a-4b19-83a7-81b3f8e64cf3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpmibs.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14b28105a7c561c5ec6593fc127e22f19b2cbc23"
        },
        {
          "alg": "SHA-256",
          "content": "bad72adb3f6479c37f034b828db2cc7f2410fd1d5fc5b832dbd03fe308953436"
        },
        {
          "alg": "MD5",
          "content": "b73f4eb676d243bb243cbf8833b0808e"
        }
      ]
    },
    {
      "bom-ref": "c0f56216-2043-422f-8a4b-6dad9f5a86ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H13SSH_4FAN",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0ec77780faea7822993451bee5cbe0e71ee53d6d"
        },
        {
          "alg": "SHA-256",
          "content": "24f1310934827c84e7009298e50b110ef1193dacd00c8085292426d66b5257e2"
        },
        {
          "alg": "MD5",
          "content": "6abf548496d54376185df6f4c4fd1572"
        }
      ]
    },
    {
      "bom-ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/killall5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c1426fa9-e29f-4278-9d8b-a09f30829843",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/udhcpc6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c1441cf7-4784-4b07-bdfc-bf5fc578f319",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/settings.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f40ef647d3c3490a0d9521c62de3eee2ce58f2d"
        },
        {
          "alg": "SHA-256",
          "content": "c2c847a8a2c7064829c62ecb6f4b0c09669b7c0560a90935eb436c9fb0b25b74"
        },
        {
          "alg": "MD5",
          "content": "400ce1a6c0d7114a21dc9205c008210f"
        }
      ]
    },
    {
      "bom-ref": "c147cbda-7d80-4416-9402-b1b3e3c91092",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcChassisExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0d3835647e7555fa9cec8d06adb4185f536bdb4"
        },
        {
          "alg": "SHA-256",
          "content": "12e983736302725db66d37f0fc34fd6257fdbb990d93ccf9762d605a33a50cc1"
        },
        {
          "alg": "MD5",
          "content": "ce81b132629fc23684594911ab8b8244"
        }
      ]
    },
    {
      "bom-ref": "c170be90-c2ce-456f-bbfc-fad96dbe6c11",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_RecordLogProvider.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "44224f8dffa500bcdeff8ea1ff801ba90bc73d16"
        },
        {
          "alg": "SHA-256",
          "content": "07cd3ace7e791c5f8b9c403f2adac78d2b5b131bbdeefda798da7eb90b08a9fe"
        },
        {
          "alg": "MD5",
          "content": "7999eb46b27ea72f116d18d5dd1bd0d1"
        }
      ]
    },
    {
      "bom-ref": "c192ad49-e28e-4cd5-a780-204a5c825a57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/iKVM__V1.69.23.0x0.jar.pack.gz_extract/gzip.uncompressed_extract/6852634-8662651.unknown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6ffc247a4a587ae4ab216594904cd7e9ee0ca0bd"
        },
        {
          "alg": "SHA-256",
          "content": "94f409857a4d81f0be876674d9a2db7cf2c1aac7e81886d0c44f43c0d8c5da2b"
        },
        {
          "alg": "MD5",
          "content": "017035d99ad9c31e0b1699dea6ef985e"
        }
      ]
    },
    {
      "bom-ref": "c1a01a80-e201-435d-bde8-a32ff0682f1d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/upnp_start",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "27e9d5413e1432dde1d34fffca9659de10536e27"
        },
        {
          "alg": "SHA-256",
          "content": "7577ecfe8443e2ff9bcab03b5935c7eadf2c65c8c52f3c461ae60b37a477328e"
        },
        {
          "alg": "MD5",
          "content": "18b7fcc5a7d49d31a402c9e2204da468"
        }
      ]
    },
    {
      "bom-ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lsusb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c1b09e86-46e1-4cc6-9517-174a22b1aebb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Peci.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b4be69bd3360e867322a427760dd3e98f7dd9c5a"
        },
        {
          "alg": "SHA-256",
          "content": "7f9c691f3b2c5779106a4791293c9ad9163f080af4277ff17c95fdd6f4d586f9"
        },
        {
          "alg": "MD5",
          "content": "451fba11b9b54306933aecbc0dc5e9d1"
        }
      ]
    },
    {
      "bom-ref": "c1b14181-a661-4bd1-a32f-1420145113fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libdbus-1.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0bac7ed38fea3d91578bf6355d7dcc4cd9e6e631"
        },
        {
          "alg": "SHA-256",
          "content": "f5ef71790a57c5ddfbe1838a0f16d30c4073fcd580a63538ec09e93ab4035793"
        },
        {
          "alg": "MD5",
          "content": "2c67e8ff3d831bed06186c4373e44389"
        }
      ]
    },
    {
      "bom-ref": "c1b7453a-1b99-4558-8f87-d749e05863b3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiIPMI_UserAccountProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6af4c2ea5bc66941e511c53175be3f77cabef66"
        },
        {
          "alg": "SHA-256",
          "content": "2b18c71a6f86e509756c236e72d49353fe824a8fa9c4b0057a26da21f2ede6af"
        },
        {
          "alg": "MD5",
          "content": "7e4cd807b60d1c28c9330ae9a243caf7"
        }
      ]
    },
    {
      "bom-ref": "c1c60606-a500-40d3-8b89-0678f2957da7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bzcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c1f5321c-e0a2-4f61-86b4-66d144189bb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubimkvol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c20c6ef7-bc9c-4065-839f-e99154cd2bac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/hover/user.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c9deccdcfd88c67ee334d026a870b73e11074c1f"
        },
        {
          "alg": "SHA-256",
          "content": "7a7f8ea0aebf464b2aa257d93dbff6262d7cf8ec2d2d2b3c9137031e73a953ff"
        },
        {
          "alg": "MD5",
          "content": "b3de45ae9520aad23f13e593f06db5bb"
        }
      ]
    },
    {
      "bom-ref": "c20f955c-4ec9-4c67-b7b0-3a4779f214e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ToggleSUM.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "564afe41a19fa051170754ea78e3a172a6cd5d91"
        },
        {
          "alg": "SHA-256",
          "content": "921628d11d3abb7f09b7f50b6a419bf46e7b20615c3ba56982eed0b3ed1c6099"
        },
        {
          "alg": "MD5",
          "content": "0ac298a53cce311adaee5f7a42da8aea"
        }
      ]
    },
    {
      "bom-ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pwd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c223cea8-9129-4260-924f-c03511892399",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/MemoryHealthComp.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "886cd8a80b74aa6cfba8a735ab6ab61cd26afc7e"
        },
        {
          "alg": "SHA-256",
          "content": "70cf7ad650cc6aa4c3d9b21714aa02f9bb2e2f2e7153fe67851fd7552c656b39"
        },
        {
          "alg": "MD5",
          "content": "d639fb6676dbb82552b5ce543ec91e27"
        }
      ]
    },
    {
      "bom-ref": "c22e943f-376e-4e94-b35e-f39cf4db39b2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/shuf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c233361a-420c-45a8-8a35-cfdd036decec",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/usleep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c243feed-595d-4100-a696-fb780ae06223",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcClientXML.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d8ad38f778259f9b926210f752e6d64bc567971"
        },
        {
          "alg": "SHA-256",
          "content": "5c45ae6f06e8404983f059da2d7066a4a940f58b47c2b441bbc2b5dcc4444806"
        },
        {
          "alg": "MD5",
          "content": "78a89895bc64aff235f1c709d2b686ef"
        }
      ]
    },
    {
      "bom-ref": "c249990d-400f-44e0-aef6-6b9ae0b6a3dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap-ng.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2365de6e4073ba24ee2f825c773395d9bacfafb0"
        },
        {
          "alg": "SHA-256",
          "content": "3aae811e6588809c5a4ead920c4d909c46b78a27f4dabb25c08e2e71f2ac3d0b"
        },
        {
          "alg": "MD5",
          "content": "aa94bc3d29e63c53fc19c8bf711d245d"
        }
      ]
    },
    {
      "bom-ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/logread",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f37b8f2c-ae8a-4814-9fe8-f0b62f760e6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pmap",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c284fdc8-fff9-4583-bf5f-8c2c6210d87e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBasicAuthentication.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74f7185e42a038c9f47ab481899f528d757cf68e"
        },
        {
          "alg": "SHA-256",
          "content": "cbd68097bcf1d0650685ed3f042639e09e878542506d7210b5efd524c25def85"
        },
        {
          "alg": "MD5",
          "content": "a69d1f40055d50fd3e3cbd61bb2d0e28"
        }
      ]
    },
    {
      "bom-ref": "c2862550-1840-40ae-9826-91d1f7b11e8c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/dashboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d2621a0e7fbb502f942572f224914c17b66ed6b2"
        },
        {
          "alg": "SHA-256",
          "content": "af5a447d9a4894488a139e0af5b8ae76169bf991145c7a2409533cd167f9d935"
        },
        {
          "alg": "MD5",
          "content": "58a957d90cda875a7530709cb8b9a5ad"
        }
      ]
    },
    {
      "bom-ref": "c29c735a-db0f-42ad-8ac7-5064c5fe3183",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpiomon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "448f5a21f0e5cc27d08cb615d6900ff15b926e51"
        },
        {
          "alg": "SHA-256",
          "content": "543fcb7f23e0978f86fe8e4cc5e1a827e275427bdd95ae6c5207843259d6aa47"
        },
        {
          "alg": "MD5",
          "content": "5efb961a482800ba331102ba717f5a26"
        }
      ]
    },
    {
      "bom-ref": "c2de6ead-6dbb-4f6f-b629-38dfe2de2b51",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/g_vm1.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aef492c8a60ee56f3779c757490cc252a3bb97f7"
        },
        {
          "alg": "SHA-256",
          "content": "fc824b6a0434ef1e99d894bcf429083eedb71cf14b32c0ce5b1c0fe49baef211"
        },
        {
          "alg": "MD5",
          "content": "eaafe4bb6cd84cb878febeea4bf2b00e"
        }
      ]
    },
    {
      "bom-ref": "c31e20f7-259e-47fc-b15c-8128e5f31042",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_13.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "160a9d981b3c28137837e989fca219ba5cd15e67"
        },
        {
          "alg": "SHA-256",
          "content": "11f6f66844c9f4ddd66e2c5cb8110e64e58a811f3f7a24b534cc02a656b3fb43"
        },
        {
          "alg": "MD5",
          "content": "945871e87dea9acf9799689a325777a5"
        }
      ]
    },
    {
      "bom-ref": "c3203bd0-c491-4d6e-84d2-a6b0925dac1b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsafec.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f7a4e329a10076bfe3de2df9dcfc243772dcafe9"
        },
        {
          "alg": "SHA-256",
          "content": "49a1a5345396a01a83af287b697b2314822374f2714c35f813d0aa9eb9935bce"
        },
        {
          "alg": "MD5",
          "content": "4cf60247d115e7f59b00133f237ca0d2"
        }
      ]
    },
    {
      "bom-ref": "c32e0303-2612-4c61-a2cc-f7de4b84e8cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dbus-1/system.d/xyz.openbmc_project.MCTP.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed6c38f4dfb4267a221766f74dfcb2460251bd5e"
        },
        {
          "alg": "SHA-256",
          "content": "f306eb6252a7e976b3530fd2bcbb98fd289e0c7a17fe536302a7b79fc64f2e53"
        },
        {
          "alg": "MD5",
          "content": "d6fa6f86bee9dd57233fc88cc20cb311"
        }
      ]
    },
    {
      "bom-ref": "c3393e0a-e6e2-4bb3-ad4f-d1a2fc83ba55",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libssl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "594871c48f22d331838911db7aec6e843f665382"
        },
        {
          "alg": "SHA-256",
          "content": "3bcf0d5b64eade33f3fbcbd600867cf4e8b32b2845e5095a45ddd89dc09ef41d"
        },
        {
          "alg": "MD5",
          "content": "53d34e537bb10640b23bfbd236170a0a"
        }
      ]
    },
    {
      "bom-ref": "c340b466-22a4-4166-99ef-61a523f44f0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cal",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c3454d80-b620-4f3e-a28d-b34260a925dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9e05bb2b7d6d5b27098772cfad942b5a96a00188"
        },
        {
          "alg": "SHA-256",
          "content": "ace011747590f63ebac6a478d5af06a6b435f498faa189ed3864a456693cc9dd"
        },
        {
          "alg": "MD5",
          "content": "fe1ab9c491e49a8106c0496bdefa45f4"
        }
      ]
    },
    {
      "bom-ref": "c347227a-a1fd-4e3b-9d4d-f35e51022c75",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/gpioget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "89677720614711077c43dc6f849c370a6f23a6dd"
        },
        {
          "alg": "SHA-256",
          "content": "cbfe10830ec56ea162735f29581d960975f980a8681af4a6276910812c519564"
        },
        {
          "alg": "MD5",
          "content": "44c0b73c2ca71f3c023691718d1ee351"
        }
      ]
    },
    {
      "bom-ref": "c361b1c7-60ad-4787-821a-25be8b44e995",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBG_LC_PLUS_8U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1100fe877338772434bf891ccfe0de263713f4e9"
        },
        {
          "alg": "SHA-256",
          "content": "b692ac6896ca3a05ae2aabe7fddc444305b08513ab22097d07bbefe5ade826b2"
        },
        {
          "alg": "MD5",
          "content": "03addf7a44d0ddf0a592d7c00938eb06"
        }
      ]
    },
    {
      "bom-ref": "c377e858-0bdf-4b2c-a924-17c72f9c9908",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_12.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61488332ff706939de60ad522aca0733fa2250fe"
        },
        {
          "alg": "SHA-256",
          "content": "752f164a118ddf474592aeb469b897dbff71c2e97ceb81cf2e1ad0079484fc6d"
        },
        {
          "alg": "MD5",
          "content": "b751e73bff769c49d61ead274312272f"
        }
      ]
    },
    {
      "bom-ref": "c38684f4-8d20-457a-a1a5-cb545c6ec08c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/jquery.jqplot.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8f825a3e135f41532e9528ff94337fa0c045ae8b"
        },
        {
          "alg": "SHA-256",
          "content": "049164b3f2ce4edbb06ba523f0dc296543ee0694a960e3aa6c328d48b8bb475a"
        },
        {
          "alg": "MD5",
          "content": "490436e91b14521358b4b41861ea30e6"
        }
      ]
    },
    {
      "bom-ref": "c3c5598c-95cb-47a6-90d1-179458208eca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/slit_bmc_i2c.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3acd246a7db3348289b69abf4aa8e0b650cb3f72"
        },
        {
          "alg": "SHA-256",
          "content": "c4a4d6521cf8629ae3206d197731f453f11a8ebc1e9c9117b99a594f95916144"
        },
        {
          "alg": "MD5",
          "content": "55687308a68d371c15bf38ebb1dca83d"
        }
      ]
    },
    {
      "bom-ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/mkpasswd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c3c70688-a211-4874-92b2-3f0d24812e6f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/virtualkeyboard.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8fe3768cb8f4ee5cea44ee7ca3246ec592979dce"
        },
        {
          "alg": "SHA-256",
          "content": "2085f491457430d124e9ef182d6c993e5a975eee76503eb4dca8f94605644329"
        },
        {
          "alg": "MD5",
          "content": "7a2c1d470064be56491e809fd5114678"
        }
      ]
    },
    {
      "bom-ref": "c3d5a76f-82d1-40d1-a23b-fb50050624af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/object/qrcode.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58859a9cc002bbfcdcf9b0fdcded92f6675aa6d3"
        },
        {
          "alg": "SHA-256",
          "content": "a7cfcb51ef66943d637f1ff859e7bdd2c72a0b71cd9a61c2a28e6d86406b9b2c"
        },
        {
          "alg": "MD5",
          "content": "dbd982da0cd87dac6c992cf78ecbe8c6"
        }
      ]
    },
    {
      "bom-ref": "c3d7ceb1-b702-45d9-ae22-3b19f2ed9c8b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libip4tc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d37ba5aeb35646ffa7efb0718c774ab7ca9903b"
        },
        {
          "alg": "SHA-256",
          "content": "92e7ccf64c5b3bee23c7034202a4d9b0eaca78e2f98b9bebb596f53d892f59bd"
        },
        {
          "alg": "MD5",
          "content": "6d3ab2b03ea9d69453f318bee6b262ad"
        }
      ]
    },
    {
      "bom-ref": "c3dfdbe1-1c36-459c-9e68-30c7af4e0310",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/remote.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c324880f7bc1b33281e362b4007a1beab66fd483"
        },
        {
          "alg": "SHA-256",
          "content": "171489adef3e366034ab391f96224002e89ea4cfa94ca678dd6b19763d6d4388"
        },
        {
          "alg": "MD5",
          "content": "cc5dc448eab695f0dbe055d0d3b44d83"
        }
      ]
    },
    {
      "bom-ref": "c3efdfda-191e-4034-84ab-5c788392ce71",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dhcpv6/dhcp6c.conf-stateless",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7274971adce3401aee3d8d2a77003bf05652445c"
        },
        {
          "alg": "SHA-256",
          "content": "e849f29e6c38c866947271fc971768b15ad23013e1e47ef8c4040411df15adaf"
        },
        {
          "alg": "MD5",
          "content": "5e1fab78d520d9c82852da69d067f7ec"
        }
      ]
    },
    {
      "bom-ref": "c3f36991-e1ea-42dc-9f95-aaff31f729ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcCimXmlCodec.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b00e6e042a4370f57608ff1584580406cb08a62a"
        },
        {
          "alg": "SHA-256",
          "content": "8f4768c91b03820dad813a60af5ea22e717238f1da7799304a6b3ebe9163fd98"
        },
        {
          "alg": "MD5",
          "content": "c1eff99b7348a6401bc91e39c593c991"
        }
      ]
    },
    {
      "bom-ref": "c40c4758-784b-4973-ba9e-4297ce1a359c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f3a141246306ab20bca53a1fab44fe0b8102f2b"
        },
        {
          "alg": "SHA-256",
          "content": "bcdd242ed167fc9bd26405e8a902bae873a75721559cad4238b39424d1863213"
        },
        {
          "alg": "MD5",
          "content": "a60c814a6de82c09cf75cb7055f5fedc"
        }
      ]
    },
    {
      "bom-ref": "c4277097-cf78-43dc-80af-b0b9f6579662",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInteropServerProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9f0b029a81ca76ab307058dc899f9e0107f8eaa3"
        },
        {
          "alg": "SHA-256",
          "content": "69035c838c7b13f49bd2ca1a1f7ae9035ba1a8720264f20c3e785b2da4ff9eb9"
        },
        {
          "alg": "MD5",
          "content": "cc353150c28e77716a7ae6cf011057de"
        }
      ]
    },
    {
      "bom-ref": "c433c155-502f-43df-bb27-4d2ae15f128f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamPower.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6e82de6a450eb0ea8da601cbbd706039e5e54ab"
        },
        {
          "alg": "SHA-256",
          "content": "3dcd4929ba3c459383627844a63166b0e89eb055f652bc9c87d3334999682c43"
        },
        {
          "alg": "MD5",
          "content": "c59fa60073fe3773d621123c37493bb6"
        }
      ]
    },
    {
      "bom-ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/expand",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c4715ceb-47ef-4ece-9166-3534875c7ea0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NTP.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "afc78e5ebf95ff163d3053dc2ce0b3a5962a5621"
        },
        {
          "alg": "SHA-256",
          "content": "bfa0c68232031cb955b3cff9606c7a46849914832ac3e07dbdf7fa3381ebb9f1"
        },
        {
          "alg": "MD5",
          "content": "52b26a7e7fdf16b1e4495301460613d0"
        }
      ]
    },
    {
      "bom-ref": "c473473a-5c30-4bc3-aba7-fa53b58d417b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fsfreeze",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c4b56263-aba6-4120-9e20-1f7127a26c20",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/intelVroc_logical_action.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4038f9e8b13ab9c493bb464af10ad9d084a318e1"
        },
        {
          "alg": "SHA-256",
          "content": "3cd3d91855eef33bdaa6c336b42d4e9ffd795d1ce765c3fbf3d82e8eee8af409"
        },
        {
          "alg": "MD5",
          "content": "51addc66a82ad5198b7368f576de80d9"
        }
      ]
    },
    {
      "bom-ref": "c4c8c92c-6ad0-4b7a-a43c-9376d2ab6195",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/nanddump",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c4dd0459-f085-45a7-882a-c73ec8ba7286",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_16_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dca5dedfc610a21eb17e4f89baefd796dea2f7bb"
        },
        {
          "alg": "SHA-256",
          "content": "9adb08d921cc480c0e67c525b5a40b080f35bdfbe400977af6bfa1a6ede045bc"
        },
        {
          "alg": "MD5",
          "content": "f7081db912f4792f39b9a26a940566a5"
        }
      ]
    },
    {
      "bom-ref": "c4eafce1-8696-40aa-a8d5-9e873ada6fd8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/lib/libSFCC_API.so.4",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4ea24ea703fa91785076d513cee6cdbca2cc2e0"
        },
        {
          "alg": "SHA-256",
          "content": "816db77d35c5ab7237f62e6809314735ba5a1f1b917090afa3802cb42e6413fe"
        },
        {
          "alg": "MD5",
          "content": "030c88c0a41e6a45128e8b505c999999"
        }
      ]
    },
    {
      "bom-ref": "c4f36b64-ec27-4244-bbd1-38dc3664a051",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/fullscreen.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "077c62b89b7d5b5131ded30e012dba506477444b"
        },
        {
          "alg": "SHA-256",
          "content": "f48cdd8f87d3b7b0ce92988d19ff58d2be2b59119e30141e76b19834db6ca378"
        },
        {
          "alg": "MD5",
          "content": "0d59eb9ef2531aa01c1d69956d706b4f"
        }
      ]
    },
    {
      "bom-ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/run-init",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c51c73c8-7fda-4084-ad9e-0c1f3a4edbaa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/DumpService.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d89142d5c6c4210b018f74c005aff214c3c90e8"
        },
        {
          "alg": "SHA-256",
          "content": "56d71c06d54fa443a4689d5ece3626574e98ceb5d87a8cd4f52fe741c27aa81b"
        },
        {
          "alg": "MD5",
          "content": "d24a73a60c560e4b66e38e1def7e3e35"
        }
      ]
    },
    {
      "bom-ref": "c545c10a-ec85-4e7d-8788-e859459b4454",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5aca88007e1a19f5070563540f4ca7cf7b520e31"
        },
        {
          "alg": "SHA-256",
          "content": "5015e9c038f83a6353b42a2117561d90e86871e1264fd1540a25880aa0aa94a0"
        },
        {
          "alg": "MD5",
          "content": "594271196d391be87977c3ab38209db3"
        }
      ]
    },
    {
      "bom-ref": "c54e9967-8237-4833-9789-fa98a515682b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pscan",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c55854b4-c06f-4b59-af10-3b19530c609d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/hosts",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6e1fc1d172ad676fda2a787312b7e9d5adedda8b"
        },
        {
          "alg": "SHA-256",
          "content": "645b300f3d5c71b9da0cf500a5d100bb896d4ebd95e288f14c13e61eff09eb03"
        },
        {
          "alg": "MD5",
          "content": "bc024d70bce41ca867cc4b5c67dbd452"
        }
      ]
    },
    {
      "bom-ref": "c5645d0f-07fc-40f3-8e7a-4feb88f5d5d0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/fw.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "522c065597c35d15bd2548facd0dda265b3a0d80"
        },
        {
          "alg": "SHA-256",
          "content": "a8f0bb9608506baef988fe33fc89c9093696613bb87f9caf2852c5a4cec06777"
        },
        {
          "alg": "MD5",
          "content": "0c3e895a27d9527ff6dcd2cf9e009cc6"
        }
      ]
    },
    {
      "bom-ref": "c595ff97-4d04-4d38-8a10-905ef5a5e37f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/wc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "c5a5ec8c-7d03-40bf-b744-48f63f271a5d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7e1f62bbea55089a08deb314477864a9fd719c02"
        },
        {
          "alg": "SHA-256",
          "content": "521001f9e3dc9805aa91d7844f182ea33c218c0687aa7b29db9354b8485319b1"
        },
        {
          "alg": "MD5",
          "content": "e85a65171a371dacf13d345133802f95"
        }
      ]
    },
    {
      "bom-ref": "c5aefde2-a211-46d5-b46b-b04f7c3a3262",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamHbm.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8def5bf10bb9e5bd374806f98a38390da41cb53d"
        },
        {
          "alg": "SHA-256",
          "content": "67b89d4b69363b854ba17aedafbf51e1a02a84d608e16d214a496ab172878217"
        },
        {
          "alg": "MD5",
          "content": "9d45b7224687c0dc8cb6db2224f6a5b3"
        }
      ]
    },
    {
      "bom-ref": "d4b6c8a9-fc70-4c74-a43b-14dba27a7e8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcPowerSupplyMetricsExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "96ad4fa77f996f65efcc6dfe2dcfb25f332e3979"
        },
        {
          "alg": "SHA-256",
          "content": "743b2678281832f2cfe78a24fadf6b7395fceda4c2c01e58e11fc416e25811c3"
        },
        {
          "alg": "MD5",
          "content": "f97a3b79baf10eebcf9079c08970423c"
        }
      ]
    },
    {
      "bom-ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mpstat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d4d56576-6d30-43a5-925c-ac343cabe244",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmctp7edrvrintfc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a0fe6315474ba50fa40d4f980ebf221e99c15d47"
        },
        {
          "alg": "SHA-256",
          "content": "4ed928c154aca8c4d92b966008912094a49453e3a26bd494ab5435084303f584"
        },
        {
          "alg": "MD5",
          "content": "7a2360f0154af4ec64a573a5ab091409"
        }
      ]
    },
    {
      "bom-ref": "d4dbff2d-418d-43d8-8944-0531250dd7bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libbsd.so.0.11.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98db6640f9107bb5a25c9333c0f7652581a24642"
        },
        {
          "alg": "SHA-256",
          "content": "b9d368c0f7c3befbe4113bd7ecf8d80c2a42288f22467f675f1da2d27ffb485e"
        },
        {
          "alg": "MD5",
          "content": "47934cc3b7257a5bfd1f37d9ef59ee61"
        }
      ]
    },
    {
      "bom-ref": "d4e90ebc-c722-4ca7-81a3-4a6bf4237c2b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d4eefd51-2eba-4370-837e-44beb35de269",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libk5crypto.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03f4a1baf19a790665a56a5c3f632731f2e9ef27"
        },
        {
          "alg": "SHA-256",
          "content": "1ea442a82eb199e83be393e7e45baf0502804d21bf88583fcbbb4046b4cfb253"
        },
        {
          "alg": "MD5",
          "content": "f471a8188dfced52b6aca88c5b9c903a"
        }
      ]
    },
    {
      "bom-ref": "f37e2b52-8813-4a55-ad79-903add647d64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_chrono.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e8a8fc922078f47a9e30401e7c44637b43b0443e"
        },
        {
          "alg": "SHA-256",
          "content": "47a283ef1644de938d4f41888fbab80e9759dc1974e376e0975f7f119b66e34b"
        },
        {
          "alg": "MD5",
          "content": "14c865699735bf917a3bf81b677befb6"
        }
      ]
    },
    {
      "bom-ref": "d4f398e5-e102-4a8b-b7d9-687318fcd0d0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_fiber.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1adc0a110e6606ccf6e07304102a4213932dce2c"
        },
        {
          "alg": "SHA-256",
          "content": "c17f036de610684d0f4c11ff8314da143d8fb8d585d1d97b19ad9a28d5595071"
        },
        {
          "alg": "MD5",
          "content": "27ca482dddceed8e574c492c9864e5af"
        }
      ]
    },
    {
      "bom-ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ipneigh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d5523356-9b9e-44e5-b505-7245bf64b2a9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcPowerSupplyMetricsExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9bf407175b5ae553a54df7a76597131c01c941d5"
        },
        {
          "alg": "SHA-256",
          "content": "fd836f9c4350eb392fb53512ba0cddc15a618eb3cd5665226e8ac5339f25da47"
        },
        {
          "alg": "MD5",
          "content": "ff820ba6656b87be72e5c48e7973526f"
        }
      ]
    },
    {
      "bom-ref": "d585924c-f64b-4269-9f5a-824bb20b7b1b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcFirmwareInventory.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c8223c3e046a93196abfbc47a4b87d89afc98a3b"
        },
        {
          "alg": "SHA-256",
          "content": "54fd4d70cbb19eac71bdf27a67616918a1f3b58f418e6d1b1a1091d811678287"
        },
        {
          "alg": "MD5",
          "content": "cef06b974be4eeab6147dae14630c375"
        }
      ]
    },
    {
      "bom-ref": "d58a2a78-a36c-44c5-a4a3-b2b3fd8c9428",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_license.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1e62358ccd84c8995f299c94d4a1241bbc109685"
        },
        {
          "alg": "SHA-256",
          "content": "1e92c2decdd4b86a0e5ebd5fc0bcb15bcd5e00289eb0f5627738d88b51e0c82c"
        },
        {
          "alg": "MD5",
          "content": "20b734d9a1f09f8685db8e288727a4bb"
        }
      ]
    },
    {
      "bom-ref": "d598cacc-ea58-4aee-a725-b5a588b5ed6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/hotspareDedicated.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0775257f06aa1b8a3bdc6398ab330221a94a6b38"
        },
        {
          "alg": "SHA-256",
          "content": "40be8c4ad55838f87901a1371f02e19c0ad474fbdb49b8d5ff96b1212ea860b6"
        },
        {
          "alg": "MD5",
          "content": "329cc2ea85bdf8229c0bac485ff34cf6"
        }
      ]
    },
    {
      "bom-ref": "d59db10a-051c-42bf-be7e-b0ee9242bc4c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/darkSPDM_help.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1931785297738a6902090abe7b587a919067c29a"
        },
        {
          "alg": "SHA-256",
          "content": "d13ad3580211815520d1e64c062e953878680a89fd4ca50280778c595a30b0d3"
        },
        {
          "alg": "MD5",
          "content": "55d001e997ff048ae2b65043a7e6e02d"
        }
      ]
    },
    {
      "bom-ref": "d5bc8cdb-adc4-45eb-978f-e539a07166bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/service.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2d207d1255eb0af1ae6ea2b32edca0b3281f334d"
        },
        {
          "alg": "SHA-256",
          "content": "b0b376dd52b0bdeb61c7d8f01fbd35731e962d15f636c8a7066c01266b6bae68"
        },
        {
          "alg": "MD5",
          "content": "a8d94819a6c92e3fb4d126ffd29b5759"
        }
      ]
    },
    {
      "bom-ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ssl_client",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d5f78a87-1eb9-497b-86d2-923e55765c2a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/upnp_dev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "be2b385df36ad8ba929e3ffa7ea9b43dd19333b0"
        },
        {
          "alg": "SHA-256",
          "content": "50a3081f689cb70dd526812671ed014ece894b2a8d7dabbab3a87510420d4d1d"
        },
        {
          "alg": "MD5",
          "content": "21b783b713db60a05e3ee019dc41be0c"
        }
      ]
    },
    {
      "bom-ref": "d610b8b3-d642-4a6a-affd-08b744cc6431",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/access_unload",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e71ffdcd63b6fd2fabfef538522c96d105ae4c0b"
        },
        {
          "alg": "SHA-256",
          "content": "23ebe8d91340397902c84e88ff52820f9ec47dd80c5e590592d70311d8eb8b9b"
        },
        {
          "alg": "MD5",
          "content": "02eb0db598e0fe62ffbb915904cc3417"
        }
      ]
    },
    {
      "bom-ref": "d64d9791-0ab7-40cc-bf03-40e5d7f456d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/screen_capture.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "31c76ad541fde388040b58f2afcd16523b4e3ac3"
        },
        {
          "alg": "SHA-256",
          "content": "2253c1c1b91543a8c8fc4aeeba706664a90ef1a48058ce66b1abad3b8d3bc042"
        },
        {
          "alg": "MD5",
          "content": "ae2ca1b847af2ce0de8801afe9e0ba33"
        }
      ]
    },
    {
      "bom-ref": "d662026e-3b6e-4919-b8ba-369399f40ff7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chmod",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unexpand",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d6f33100-e235-4b9f-8c22-6b539f1922e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/retimerUpdate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1f365916683377701309a4fe3d9d7f0458a35423"
        },
        {
          "alg": "SHA-256",
          "content": "ce0c1aad13bb0815fc46831c3dd026daef4f9ba80cf9b40da9e3c111d9bdaf31"
        },
        {
          "alg": "MD5",
          "content": "3da1884dd61f06917aeaa420de38cf07"
        }
      ]
    },
    {
      "bom-ref": "d70428a4-633c-4748-8a6f-7fbf16b70991",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/memory2x.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "919d3e6bab212f64a3ff4e6f329d5e69f8ee9a3a"
        },
        {
          "alg": "SHA-256",
          "content": "40bc3612f15475cb68f6fbfb13fd9eff109ed24e7b9e6ac4aa8e49bb9ac536e0"
        },
        {
          "alg": "MD5",
          "content": "b9a6224a60985defc8c2b3ae95a23c5d"
        }
      ]
    },
    {
      "bom-ref": "d75cf600-1cc0-4584-af67-53470ae75e41",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mctp-demux-daemon-ep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0049d574341cdf8f01b50564f6b35de013a6752c"
        },
        {
          "alg": "SHA-256",
          "content": "95d9f833eadf96485607b4ff89bfcce379cf582db5b615263252a280cc11e1c6"
        },
        {
          "alg": "MD5",
          "content": "2e391eec2c2a4fba7ba170c415f823b8"
        }
      ]
    },
    {
      "bom-ref": "d76d1a7f-32cb-4b26-8d73-6a2eaf27bf8d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_program_options.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "95eb2c73ec63f85427cbfb43b0c876a028f452d9"
        },
        {
          "alg": "SHA-256",
          "content": "4297dd39f11cd596e39e33c6ae2531eb6444a1ee6ce3b098896f57f5fdc2d947"
        },
        {
          "alg": "MD5",
          "content": "241de24c28c0f9752e14c12a5a7f55b5"
        }
      ]
    },
    {
      "bom-ref": "d7768730-95bd-47e3-adcd-857510bb091b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/mouse_none.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e2b0fb43c6319151d75fd9938cb66896dd3753f5"
        },
        {
          "alg": "SHA-256",
          "content": "c5d4c37827daab4e179305701e0d01046566ed9ace8f8da350d4265b4d1cbc6d"
        },
        {
          "alg": "MD5",
          "content": "e76a6ea3c13b91c1ae1fe3907aa3a50b"
        }
      ]
    },
    {
      "bom-ref": "d77df6f8-8d35-43cf-bf10-5f939496caac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/u_ether.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3208d834d889cc572432d996b7a30ee5375b933a"
        },
        {
          "alg": "SHA-256",
          "content": "32ceb18d42eb277b1fe1c7d1df59c368c0602ef9f5029ef6aaf0fd6ac7f9e7d5"
        },
        {
          "alg": "MD5",
          "content": "ef47ec8ae848213021ff9c04d1ab6c37"
        }
      ]
    },
    {
      "bom-ref": "d790579c-8036-41c8-99f7-8ee78ea5a1c3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/uid_ctrl.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5fd3f5d955da44bd37217ebda0b135cb3397cc78"
        },
        {
          "alg": "SHA-256",
          "content": "67c34ed3c4a05a543a4f0395cdad5c4f27c791b8458cb05be98f186f8370f46a"
        },
        {
          "alg": "MD5",
          "content": "10f7367de0b9d181d9545fcf3a85b98a"
        }
      ]
    },
    {
      "bom-ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/[[",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/zcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d7cc4974-fa80-4c7a-985c-d21e01b28340",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/failover.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2f2929eac0dd039ef264c4a74b7975f29902ba5d"
        },
        {
          "alg": "SHA-256",
          "content": "609ba5508e73e0c51711f13ea36a7956b5a4214ecc79d549b5f1db8251a7c256"
        },
        {
          "alg": "MD5",
          "content": "3bececd9bb3abeae646906d99b1c75d5"
        }
      ]
    },
    {
      "bom-ref": "d7d8c397-894e-4bba-a67a-d813d5bba8d7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/helppage.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c022af97c5e1edaabaf51d3e1fb99fcc04f60270"
        },
        {
          "alg": "SHA-256",
          "content": "c069e487ae05823747d282255e52b066b4cfb9a2e97dea5ea4e5e02f53a26580"
        },
        {
          "alg": "MD5",
          "content": "98f65590ac8e043e9ed39951c0ccd919"
        }
      ]
    },
    {
      "bom-ref": "d7dba4f9-4599-4f62-9851-953a0bc1afc7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamLaneInfo.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "80b841038df510863f5cba3b27ce5c4686cf56b3"
        },
        {
          "alg": "SHA-256",
          "content": "ccfd1f38d34e7d363ec098d041bcfbb00b98ac80a3d92952ca22d35de9b2703a"
        },
        {
          "alg": "MD5",
          "content": "d4c73c1fac5e84ece47ff42bc2b7d095"
        }
      ]
    },
    {
      "bom-ref": "d7ebd513-4ceb-4ad8-a27b-03ef32f3bc5f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/plugins/jqplot.barRenderer.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "34b488a0fe4fac8a9b33b2e5423c615c67c74a77"
        },
        {
          "alg": "SHA-256",
          "content": "f9ef32e6c9c3a5ec7b0c1a80bcdb85e384d9ab476f334a4f14cd9603e4702aa5"
        },
        {
          "alg": "MD5",
          "content": "ab09574e5f5b0eb3b58d1aa598118389"
        }
      ]
    },
    {
      "bom-ref": "d815ed08-b9ed-49fb-8e8e-faf415f5063e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libmount.so.1.1.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b9240192537dd5df45a3c2a1b79e1e551f50bee8"
        },
        {
          "alg": "SHA-256",
          "content": "5505cf3c987f962b424d08edbf9ac7111635edd8b176835b1f525c2090d9ced6"
        },
        {
          "alg": "MD5",
          "content": "bbf9df27d07a6173db55f81d47b3492d"
        }
      ]
    },
    {
      "bom-ref": "d8333d0d-738f-432f-9a6f-85f3bcfbe71d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/crc32",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d83fc464-5b1f-4e5f-b80c-0b55a0f757db",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e5eb45e1a92f520125055ffb1690ad986ec6cad"
        },
        {
          "alg": "SHA-256",
          "content": "2a10f7e64aa3639e1e590041256467a845ae339950c952e6ad28c4e36cdb5f13"
        },
        {
          "alg": "MD5",
          "content": "df14e8942e131ee7fbaae881f80c4d5f"
        }
      ]
    },
    {
      "bom-ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ifdown",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d84be541-42b3-45c3-ad0b-227a4ef47e2f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SMTP.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1bafdef491b925216e598ade854bc172a2523ffc"
        },
        {
          "alg": "SHA-256",
          "content": "6577517ab444979c3b0980a79e69de45707267ceeebaf809582baab98f20b68d"
        },
        {
          "alg": "MD5",
          "content": "dc2c0188f1645cb4c59365e5bf87fc33"
        }
      ]
    },
    {
      "bom-ref": "d84f327c-73f6-4790-a579-20b1e631e99c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unlink",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d866f255-beae-4c73-b0b5-16c484c3e7d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6be43073c81cd1caef86bcd98485fcb176ee4abf"
        },
        {
          "alg": "SHA-256",
          "content": "4014897be7c5fceab089b65913f2d4cf1b040362bca15bf01c3288f2df139722"
        },
        {
          "alg": "MD5",
          "content": "20e4e6415721dc7eaf378e463d7647f1"
        }
      ]
    },
    {
      "bom-ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fbset",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d8982923-e43d-4504-91fc-9988c137ef39",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmp.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a0e640d61736325b877fae9046b4b358cc6381e"
        },
        {
          "alg": "SHA-256",
          "content": "29998f992af5d5c062fe9cf7cef2015dd1e5b383f861abd6f445ec3d8e1df649"
        },
        {
          "alg": "MD5",
          "content": "c83f72accc1292482f87ef7b24f5332d"
        }
      ]
    },
    {
      "bom-ref": "d89a168c-95f1-466c-8b05-4cad7f50d20c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmTrigger.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8aca9e965eff7731120294b9b0732ee495a06498"
        },
        {
          "alg": "SHA-256",
          "content": "a834a4ce86635b500ca23984df8fa0d79f098d6f799592799a7c01fb468538bd"
        },
        {
          "alg": "MD5",
          "content": "136b95e2d9855453150743141e457c7b"
        }
      ]
    },
    {
      "bom-ref": "d8d7ce80-3090-48ba-b0c3-8ff2ae7c5a14",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/tunctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d8d85c3d-9970-4c92-8478-d9e6a8933d0d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/search.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98f844fca707781fa6681e80bb4b331946327a31"
        },
        {
          "alg": "SHA-256",
          "content": "93dcc03f57941d2b89fd8e768d131e5056c232e2c31cfc3f53c47d4802da3cfe"
        },
        {
          "alg": "MD5",
          "content": "45e82d83f7ad0c8be3c91b7cc408beda"
        }
      ]
    },
    {
      "bom-ref": "d8e3d11a-ca4c-472e-a4ca-922add1f72aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_random.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b10500da2dbd3dff7290e17766db58b9466a02d"
        },
        {
          "alg": "SHA-256",
          "content": "83151a8e89bdcf402e56659ea468c314eceb5a1ae61ae54d7233ac19544f6ad9"
        },
        {
          "alg": "MD5",
          "content": "2ad8ce483050cbc070a18805a0306e0a"
        }
      ]
    },
    {
      "bom-ref": "d8e7f5bd-e0b1-4479-915f-fc6e5e167825",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ee1cc5bfd9ffa51c8adc8d0bdc9c1cfbb2f43a75"
        },
        {
          "alg": "SHA-256",
          "content": "6067d87046e7fc29286ce8f58c7b7458e22f2ca171927275a553a6b861aa9655"
        },
        {
          "alg": "MD5",
          "content": "e29a75d01ce01468fc01a672a2320ae6"
        }
      ]
    },
    {
      "bom-ref": "d8f46ddb-af65-48a7-89d2-7ace7ce4a565",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcIndCIMXMLHandler.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cb0840e5388a9b8292e6ac8fd6a1e0d7a48c46c8"
        },
        {
          "alg": "SHA-256",
          "content": "e9c7a8e315c20e88884ec2ec66711efab8b9127b5c27e318f9598529adab103c"
        },
        {
          "alg": "MD5",
          "content": "b8e2e3615f2eb3ca07ea1f433cf25678"
        }
      ]
    },
    {
      "bom-ref": "d8fce3be-54e8-451c-9904-be7ced21042f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/storage.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66b2d74befe4e54a3356de5c78888bc794a9e551"
        },
        {
          "alg": "SHA-256",
          "content": "1c61d0ebaa2b2dd5f8aaa50aae84f6096d7d358a19a3c275a87066cf70f4c989"
        },
        {
          "alg": "MD5",
          "content": "f9fcab7bab0cb8b42b886b3115ab0206"
        }
      ]
    },
    {
      "bom-ref": "d912f5d6-caf2-49a2-9cd1-14941b4d93f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/hotspareRemove.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "35875771ad692bee0eecfc6c0c67a48f7df21203"
        },
        {
          "alg": "SHA-256",
          "content": "2af9ec11133a5e61e64c53f45322e49038912a09d0dcb08c13f2b17a788c2817"
        },
        {
          "alg": "MD5",
          "content": "2d2b5d5d70dd5ed3460d3fe58273436a"
        }
      ]
    },
    {
      "bom-ref": "d91a5ac3-57ef-4697-9e45-881f0c765260",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrypto.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fc7b4cefb586a10e62363f262f53b45b650efa44"
        },
        {
          "alg": "SHA-256",
          "content": "6d66245a347c1379bf9da1ef39a33beeaaf7b9d0c481f9c5183f89e44395aaff"
        },
        {
          "alg": "MD5",
          "content": "c28e6fb0457533f45352e7d7c81c4c86"
        }
      ]
    },
    {
      "bom-ref": "d92c108c-bb30-4f75-971d-9e75e3624852",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/fsck",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d942cda0-de78-4cc2-9b03-da42053960dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ActivateLicense.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ee1ddf92541cacc194247b7f8efee9e6ca40e050"
        },
        {
          "alg": "SHA-256",
          "content": "089814fb45f0a4027358248384188eddb2796ede1b52bebe1702f3393cd95791"
        },
        {
          "alg": "MD5",
          "content": "2215f07543b33a117a1eac9015872a99"
        }
      ]
    },
    {
      "bom-ref": "d9529013-0a82-4a71-8cd9-99ca67bf9af6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpmibs.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14b28105a7c561c5ec6593fc127e22f19b2cbc23"
        },
        {
          "alg": "SHA-256",
          "content": "bad72adb3f6479c37f034b828db2cc7f2410fd1d5fc5b832dbd03fe308953436"
        },
        {
          "alg": "MD5",
          "content": "b73f4eb676d243bb243cbf8833b0808e"
        }
      ]
    },
    {
      "bom-ref": "d952b05e-7386-41bf-8dfb-a2e0f1ff045f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/network_delete.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3be74ee75078f6ba0a64bfdcfcde389cd506b91c"
        },
        {
          "alg": "SHA-256",
          "content": "2c229338e03e0b398c5c96481dd293dee6e0eec482fb36b4da96bd60aa877145"
        },
        {
          "alg": "MD5",
          "content": "859978cb6f16ebb5443e1e74d9a34d1c"
        }
      ]
    },
    {
      "bom-ref": "d9788bd7-827d-4a87-a999-78fde630ae98",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/losetup",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/i2ctransfer",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "d9a4d26d-4beb-4f8c-a265-fc80367f7a88",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/account_pwd_warning.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2366d287232287988034978ae3588badb282ddd1"
        },
        {
          "alg": "SHA-256",
          "content": "aceb803fadfd767020784b2812db9997b0e468d35ec50683dde1e73124e03017"
        },
        {
          "alg": "MD5",
          "content": "31edcf78fd834c3b311d6e402dfec957"
        }
      ]
    },
    {
      "bom-ref": "d9affc45-c48f-4779-b76b-d659d5b9da02",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SAW_F",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8704f4545c886aa9a5ed1f0e67e4faf35b1fa65b"
        },
        {
          "alg": "SHA-256",
          "content": "c4aa6d55af5d7a6bbb748115ced4b47ce6d96a9da3e68a44a069d2038aa4e9c8"
        },
        {
          "alg": "MD5",
          "content": "d7a76350814d82cd1aeddf2ac268b017"
        }
      ]
    },
    {
      "bom-ref": "d9e72d1a-093b-4bb0-acb1-9ab6c86761f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage_summary.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "676eb265100e75e0440e96acde606c86ea6432d3"
        },
        {
          "alg": "SHA-256",
          "content": "3f982dc29089e773c20015c8350281ecd8b704ea742d64c571392d89c8ec570c"
        },
        {
          "alg": "MD5",
          "content": "d6177c08687720d86a5351b7c4f56697"
        }
      ]
    },
    {
      "bom-ref": "da02d449-c6ff-4adb-b56a-7c9d27dc39f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_iostreams.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4de27a3756eb38ea169fc7761f09ad31a0485148"
        },
        {
          "alg": "SHA-256",
          "content": "b433b1777df34004074cd7ee1cc4e3e39aa6d08e7770b580e238443eb6fbed5e"
        },
        {
          "alg": "MD5",
          "content": "71d5618e1624d72cc6dee898aa11cfc3"
        }
      ]
    },
    {
      "bom-ref": "da430bfe-2e8b-423f-9d88-bd19781c8772",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/ast2600-pwm-fan.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42f138c38cf9742522e0a2d523d9a15ef6fa0844"
        },
        {
          "alg": "SHA-256",
          "content": "a4b750c91037e2e3cd66275384908fa823fb18f8a453285c7927f935550d14c2"
        },
        {
          "alg": "MD5",
          "content": "6621249fdd1127718e385aa484820441"
        }
      ]
    },
    {
      "bom-ref": "da4ab16f-e7b1-47ca-bbab-e1a41a9c42a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/logname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "da4cf21a-cc44-44ee-8cc1-53ff3fc1cc0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/background.jpg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bb84ea7e436f015dfb7034c48786998e0596ede4"
        },
        {
          "alg": "SHA-256",
          "content": "5bbe56cc8fd407f13c04d33e807bd95cf43f290afb936663817fc29e8f9105e4"
        },
        {
          "alg": "MD5",
          "content": "4d597ac10345dc4e32039ae21d8db85d"
        }
      ]
    },
    {
      "bom-ref": "da559dce-14f5-48cc-8aaf-cb1201501758",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/pdbtool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "019984fc47a594f35a496f8f2d04f0720d0f62a5"
        },
        {
          "alg": "SHA-256",
          "content": "d955ae0ed32b0222116bc81fe79fc3f717b45d8a6cf6efe5ce7ed26e4893b036"
        },
        {
          "alg": "MD5",
          "content": "f47a4a9be254e3746ce747e95f3438ad"
        }
      ]
    },
    {
      "bom-ref": "da601a53-4a0b-410a-9d60-0147894ec6f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/getty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "da6a15d7-7bc1-4ee6-a61c-aa9121baab3b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/side_lightbox.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a414a0d1c99a5ad505b92c559c2199aed995015d"
        },
        {
          "alg": "SHA-256",
          "content": "744971a7e7004db81bbf5876a1f102830a223d021f94c0df72a408abfb660b1c"
        },
        {
          "alg": "MD5",
          "content": "22dd83b22ea54951738be0a1c82f7879"
        }
      ]
    },
    {
      "bom-ref": "da72a63f-0fc0-48c0-ad3e-fa0dbb0cccf3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/crontab",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "da843118-b2b5-4c8b-8d6e-38466cbf1b7c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_url.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a99aac8fa96f2af054bc5197d82d7d80fd2c1c5b"
        },
        {
          "alg": "SHA-256",
          "content": "8b78ca66e41ffede8c4f7acc54d4f07a304d3d64609d18558762d7efdbd40c98"
        },
        {
          "alg": "MD5",
          "content": "154555e8ceb090e5ab49b391e8e35a85"
        }
      ]
    },
    {
      "bom-ref": "da899be4-b39e-47e7-8fdd-5232cda17e38",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ManagerConfig.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "acf80d241f35f8fe4748c8a02de88ed5bb049ed9"
        },
        {
          "alg": "SHA-256",
          "content": "22b6f2497d532229e8345b5ab465453d0add129c3e0bd98cae57d879264c0cc7"
        },
        {
          "alg": "MD5",
          "content": "2c9aca3efba62a5d40874d919d061597"
        }
      ]
    },
    {
      "bom-ref": "dab2bb9d-4ebd-41a5-a5f3-8880002fed3d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.dataviz.core.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5e6eedcd3267a12549e3fb6248cd6e7f21a466c4"
        },
        {
          "alg": "SHA-256",
          "content": "7da1998b934829d0695a69532d41133bcaa2873f748c607aec72c2af42b95698"
        },
        {
          "alg": "MD5",
          "content": "4ee822e58f2f9eeef3bd02b93e0cf7d7"
        }
      ]
    },
    {
      "bom-ref": "dac8ea0a-bca2-4614-9277-39ab85d047a0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_fiber.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1adc0a110e6606ccf6e07304102a4213932dce2c"
        },
        {
          "alg": "SHA-256",
          "content": "c17f036de610684d0f4c11ff8314da143d8fb8d585d1d97b19ad9a28d5595071"
        },
        {
          "alg": "MD5",
          "content": "27ca482dddceed8e574c492c9864e5af"
        }
      ]
    },
    {
      "bom-ref": "dacde5db-abf9-475d-b061-5bd67425a265",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tcpsvd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dafca263-79ec-4d40-a5c8-742c4cb24edb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dbus-1/system.d/xyz.openbmc_project.Issm.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d0ffeddf625ea8cae7d2de291b86b8990468853"
        },
        {
          "alg": "SHA-256",
          "content": "abe6ee3c1ff839a64b7ab53b661209a902ebd338b7ca8c540da35d76c20206ed"
        },
        {
          "alg": "MD5",
          "content": "7257d987e24b5568cbea2af20b40af93"
        }
      ]
    },
    {
      "bom-ref": "db2e800a-39ba-4ab8-94a5-6a06a471c925",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_red.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbea1d74b98cedac53909c556e87c81001628411"
        },
        {
          "alg": "SHA-256",
          "content": "8cff6a6b1af161cb968e80cbd86d9f6b62040da6f213a9b882b954d74433c582"
        },
        {
          "alg": "MD5",
          "content": "1be9ef1ec829def4a3b4c0a74a9b3109"
        }
      ]
    },
    {
      "bom-ref": "db38fba6-cc70-4113-a0f8-993bbb20ed37",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/html5boxplayer_fullscreen.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eb87eaeedb4ec5f7f3ea34273c2355e6a11e0115"
        },
        {
          "alg": "SHA-256",
          "content": "fe781d4df3d3d6f26266a6b5dab0fc6b1724149815b9e1b7b7208a65fb51b50a"
        },
        {
          "alg": "MD5",
          "content": "414f9548cdbee58da9f72132a9c0d824"
        }
      ]
    },
    {
      "bom-ref": "db43a967-df81-427f-9df4-9192f83752f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkadm5clnt.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fbf53a9679c161052458b0fc51a051e4537e7e5c"
        },
        {
          "alg": "SHA-256",
          "content": "73e4e589e4a8ccb214723f24e01ddebb533bb60f6929825a462bb9cbf4a8220e"
        },
        {
          "alg": "MD5",
          "content": "cb433f90f46ed0f1ce509e0ede80456e"
        }
      ]
    },
    {
      "bom-ref": "db4d7fbe-1d3a-41a1-8137-51a0bf45f070",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_B11.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "376bd81f1432d17a4a37e0bb3028d1b9bfb00ef5"
        },
        {
          "alg": "SHA-256",
          "content": "6aff02fcad1109af723951d5ea7c4f3f61ec7e2e3ba3947845da98314c22a771"
        },
        {
          "alg": "MD5",
          "content": "3ec3cacf292f0f5738e0ebf7648dd119"
        }
      ]
    },
    {
      "bom-ref": "db61c843-0c1a-44aa-93a9-b588c9ca5e3e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsystemd.so.0.34.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f4b015be10d7c3db1fea9d371d135321e54c20e"
        },
        {
          "alg": "SHA-256",
          "content": "58f4e0076e815e9a418585a8d325d549beafbc07d15dd4fa845046ee477e1d4b"
        },
        {
          "alg": "MD5",
          "content": "5199c5203fbbd52dce69c6cca3d6b858"
        }
      ]
    },
    {
      "bom-ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/raidautorun",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "db86165a-76cb-475b-922f-2ba4b79bd29a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/diff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "db93d5d5-17b3-4b93-a452-1e56cad3cf57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rmdir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "db9638f1-b03a-4810-a85e-48d1492b8c91",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/timeout",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/whoami",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/rx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dbb48549-00ba-4d09-b67e-adc5c57b3f64",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.drawing.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73791cf605de7f0f2c10f67f9cc6815cc3cd76a5"
        },
        {
          "alg": "SHA-256",
          "content": "7b6d30bfbcb66222ae783748a68123a4ceaf371894611439c5e00d6aec39f71e"
        },
        {
          "alg": "MD5",
          "content": "d0351ba92626609f863e40e1a85e700e"
        }
      ]
    },
    {
      "bom-ref": "dbc0325d-f8f2-4e2e-b164-3f3a3da4093a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/BMRC_mctp_unified.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4ae8750ba05b88018bcafaaecb5fe900ce126c64"
        },
        {
          "alg": "SHA-256",
          "content": "52a699370153c1674c517ae286fde6e513e81c1da408eff85731640bf7ba1818"
        },
        {
          "alg": "MD5",
          "content": "313f22ddf6774fda15c0ed0fa70bfec3"
        }
      ]
    },
    {
      "bom-ref": "dbcb579a-bd2f-438f-ac9c-cc5f0192bb74",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEDW_F_SIMPLY_DOUBLE",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aa8bc2c87769cfae43d4c8abcc14f403a94797df"
        },
        {
          "alg": "SHA-256",
          "content": "c00478f9dbf37d5bb27951000a9c7d06bdb89c66d50c71445b1b192c58ac21f8"
        },
        {
          "alg": "MD5",
          "content": "6facc540763fc47ebb6b6ee2efcdd96a"
        }
      ]
    },
    {
      "bom-ref": "dbd579f3-1254-4fb6-ae4e-99fe925bcf4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/change_raid_layout.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21ca493431c4aaae3c913d24c87b1fcd0223f0df"
        },
        {
          "alg": "SHA-256",
          "content": "08c47aef16acdf5a051e201805d8cfdd7a691b333d3a2a2488a4c03d776cdd79"
        },
        {
          "alg": "MD5",
          "content": "f6e760e4d53c5becca0bfc5cf39c23a0"
        }
      ]
    },
    {
      "bom-ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/traceroute",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dbf48ea6-4d55-4160-a850-4aaa04e1f9e6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcProfileProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7458b381de72fa07e43df287804eabd394c3acd1"
        },
        {
          "alg": "SHA-256",
          "content": "1e88e7dcb7176fccfbe02d53e3ab78366f891cf0de75a29b624654be3ddcf108"
        },
        {
          "alg": "MD5",
          "content": "2e7dfb2f40dc6fc2c225ce087892829a"
        }
      ]
    },
    {
      "bom-ref": "dc1a53b9-2e1b-40e4-9e5d-ad5f75f056cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcUtil.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b5cec096ca73e315063a753b31b0fbb5f4c47af3"
        },
        {
          "alg": "SHA-256",
          "content": "51a7d5a8bb2167b81fb4ba5f8c5a87c99c4468b4c8b64c55cedf088bfe287e66"
        },
        {
          "alg": "MD5",
          "content": "45dcde1021b376f1df0b0e44cf5aa748"
        }
      ]
    },
    {
      "bom-ref": "dc2204ea-3223-4872-a81a-c617ed9ef01a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c3bcc1c02dfd36fbf2cbb2401d62e4940ad6fe3b"
        },
        {
          "alg": "SHA-256",
          "content": "ff19cf298d9fae3a8a4866805ad64f19077edda7ab31f3641d62f129102ea54e"
        },
        {
          "alg": "MD5",
          "content": "62719d18fc08ceabf40c4574b0d3d0d2"
        }
      ]
    },
    {
      "bom-ref": "dc2b1257-e11a-421e-82b7-ec2c3f70bd4d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_bmc_reset.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9ec90ecf67ea153f9bab096fc66771e7a76d5fe7"
        },
        {
          "alg": "SHA-256",
          "content": "8942c0440a97f00d3192e2dc9b3cfed0666e0d9aa9cdfb265c1dedd2cb8d2986"
        },
        {
          "alg": "MD5",
          "content": "0f0be2cad3bc5244c5818da2215986ca"
        }
      ]
    },
    {
      "bom-ref": "dc30cfba-b947-449f-a3b6-f23e17eb0ed9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcChassisNVMESSDExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f9a9a5e0d7a1e614e38a1e48e29003422a8a7b8d"
        },
        {
          "alg": "SHA-256",
          "content": "c9c650c633ce9ad35f3bce50994f41d5e91e0cc19d61e603b310fa3023ea88b6"
        },
        {
          "alg": "MD5",
          "content": "c7583dc437767c7fe37697d652585255"
        }
      ]
    },
    {
      "bom-ref": "dc501b31-efae-45f1-9726-5f608194f9af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamEthStatusCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ba3cc2a69d802872e647f8b893356ce603269284"
        },
        {
          "alg": "SHA-256",
          "content": "bfb6479289c4b7e7f635964bf2ef8453a32e942b87a716805d10962020a9bdaa"
        },
        {
          "alg": "MD5",
          "content": "02eb3e7c7e12acbd2e94187c1bb80233"
        }
      ]
    },
    {
      "bom-ref": "dc682096-1e6b-420c-b2c6-dcd7fc306827",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libthread_db-1.0.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "96dae3a511463cdbef4c6724e6456023357504c4"
        },
        {
          "alg": "SHA-256",
          "content": "63c1705f97925202b5b32d2ff232aa9941527591259a8ab2fff6108ad66d643b"
        },
        {
          "alg": "MD5",
          "content": "caa3987a593c137e167addc24360aa21"
        }
      ]
    },
    {
      "bom-ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/sendmail",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dc6e97f6-f095-4001-8e87-325042903590",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/etc/udev/rules.d/10-local.rules",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "85d3241c2318be2d20c5b3f68eeaf9b98217523d"
        },
        {
          "alg": "SHA-256",
          "content": "7bca598ce76ba1e5c391a7ca2593daa06b162645ca4dcbdf84b07bff424cdf2f"
        },
        {
          "alg": "MD5",
          "content": "77ce42fbc4cf0227db2c11d4fd4d0221"
        }
      ]
    },
    {
      "bom-ref": "dc82a06e-6471-4024-ad8a-e7e12de65ae3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_4.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "01480fc411728b834d1ffad9106ecc594f6ea6e8"
        },
        {
          "alg": "SHA-256",
          "content": "03e8fdc776a3b347349331a9cdc7731f34cc811771ff4166537be7c6db0bdecc"
        },
        {
          "alg": "MD5",
          "content": "6b6316d8717bbf5f6736d9708618cebd"
        }
      ]
    },
    {
      "bom-ref": "dc8906ca-4c9e-4f74-bd46-82d23e92413a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/taskserviced",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "60b7cbb9968f50e7f0ace0e55e92b5ec26a7a952"
        },
        {
          "alg": "SHA-256",
          "content": "6fc2b755eb0a4db686b674a527c1085285c89d5bca5f82629e08188c7a32295f"
        },
        {
          "alg": "MD5",
          "content": "f9b443de59ccc49d5e5578ca5eaaae15"
        }
      ]
    },
    {
      "bom-ref": "dca7e046-9a39-4319-9d72-9c2952dac2d4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nmeter",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dcb5e609-e67e-4b3c-b9a3-deedc97667ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsmartcols.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a4f65766ab540c6b70193402566f7b7c26e1649c"
        },
        {
          "alg": "SHA-256",
          "content": "a8650eaafa62290004086d255a0ff745e1ff6554b0835d7b4bd8291c74760c27"
        },
        {
          "alg": "MD5",
          "content": "ae41e3c5028eb86a96813b93d369966b"
        }
      ]
    },
    {
      "bom-ref": "dcc3dd70-b0ba-4f9c-8a66-dd430ddd50aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IKVM.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7a13901055516b6515fb724b46dcc8df5aaebac"
        },
        {
          "alg": "SHA-256",
          "content": "b6157546ea82d166e3c5b5495f7acfe082958aaa65ab5ec42350c501da2947a8"
        },
        {
          "alg": "MD5",
          "content": "e672865b38183c9c45396bdc22679d8f"
        }
      ]
    },
    {
      "bom-ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pgrep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dcedf751-77ec-480f-8473-8b8b4bebdb9c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/authorizer.fcgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ff443759a4a91181beb8bf94193794530c1686a"
        },
        {
          "alg": "SHA-256",
          "content": "5ff3cf0f7ded699652cda9af4593655ad8d50452b5e940feb3fd8c9869b6c86b"
        },
        {
          "alg": "MD5",
          "content": "2d7dfeb5bb38e63ef36e87ce930c3df4"
        }
      ]
    },
    {
      "bom-ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/strings",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dd03a1dc-2b8f-4a2c-ae6b-00fac55dbf1d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SNMPv2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97b16c5403a5d0f89da132997f3b9a6f68b4f4e4"
        },
        {
          "alg": "SHA-256",
          "content": "e8015b35e83476713cd8ac78bfeb16837792cf84181eb90e09da629cfa9c1bb5"
        },
        {
          "alg": "MD5",
          "content": "61255ef66e95d8860a9efb0583aa32d1"
        }
      ]
    },
    {
      "bom-ref": "dd0d0dbc-63d2-4d3c-9265-4fc2401a8649",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_rakp.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d8463a8a585909c7d96e977c22e21374f8e8f895"
        },
        {
          "alg": "SHA-256",
          "content": "ef96bc7463aa5b8dc6fada18df94dfbe6a39d9182bb451d5d344c1435174aab6"
        },
        {
          "alg": "MD5",
          "content": "32c12dc8db96c62f39d00bbc9126ea60"
        }
      ]
    },
    {
      "bom-ref": "dd3a6fc3-b55a-4c61-95c5-c3e56b50838a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/77remote_console.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1870c8a728e151e223bbd5ba9c5ea609e92dc17b"
        },
        {
          "alg": "SHA-256",
          "content": "6adb397b5f52e6c6f02bc8931abc8931345ecf3fa5575cd0119411e017a8caa2"
        },
        {
          "alg": "MD5",
          "content": "e29c4cabb1dafdf0ae6f969253083b56"
        }
      ]
    },
    {
      "bom-ref": "dd516512-883b-4575-a89d-558ff57b2cda",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_nowide.so.1.81.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "30cba0b28d4437e608b7746bcc66d9e84e03125c"
        },
        {
          "alg": "SHA-256",
          "content": "cf008dd5b3d3655ec89b0cc179c363f72aa245c3f80a761c9f44e1f6dbf997b1"
        },
        {
          "alg": "MD5",
          "content": "13c59e9fa4cbc5db3d56d1173d84a6fe"
        }
      ]
    },
    {
      "bom-ref": "dd52cd6e-cbaa-4e8b-9d20-1c661034a39f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/stagedUpdate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b7cbd54810d76d892cbbccaa8637ceb17a1c43d1"
        },
        {
          "alg": "SHA-256",
          "content": "87e6224dcf681194027efe99a206134260275419abbfbd85fad24fbc12518102"
        },
        {
          "alg": "MD5",
          "content": "f3bfc3bfd07cae512d7811cc54e307b8"
        }
      ]
    },
    {
      "bom-ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/iostat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dd8d910d-5414-42af-b52c-f1d51b3d7fd0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/KCSInterface_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f2222df59d5524dab546a23b9d901a6eeb6860c"
        },
        {
          "alg": "SHA-256",
          "content": "86aa2dc7f61132feb68b8d53e422ef9087e039be55173831c0395a5d5ec1b6a0"
        },
        {
          "alg": "MD5",
          "content": "24ee93e24311783080e49fa8600fba89"
        }
      ]
    },
    {
      "bom-ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ftpget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dd9dfb23-2931-43c1-8945-998430737522",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/logread",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dda7c3e0-182c-4fec-835c-c98ba4719b63",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/sys_storage_taskQue.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b7411d28472853d1d20369528a61208ada3f5a50"
        },
        {
          "alg": "SHA-256",
          "content": "73d90a5e0f069ccd21071bf82432029c9aa2eafb5a33f5aae7fece9e1d88a445"
        },
        {
          "alg": "MD5",
          "content": "06c1fc9842ce533bc74e524e16befbad"
        }
      ]
    },
    {
      "bom-ref": "ddc2e991-62aa-4e6c-9402-615dd18071a6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libplain.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d790d2c17d12fa79d8ba0de21f37a2a65bc496d"
        },
        {
          "alg": "SHA-256",
          "content": "2e153c5f71bd55f24701c39d2d7343b97c680214b7209aae3c8dbc2f1e9322ac"
        },
        {
          "alg": "MD5",
          "content": "ca710a742c73d4d91fad7860fb565fc6"
        }
      ]
    },
    {
      "bom-ref": "ddef39b1-9f4d-4e99-b61d-da021261fb99",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.G1SBC",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65d89f1f3f470da1a96a31e284d1858f24e24f3c"
        },
        {
          "alg": "SHA-256",
          "content": "1d58904eb8da5b103815ce336459bf24ecbf5a291ecad56f56101422d9eab229"
        },
        {
          "alg": "MD5",
          "content": "846d6da5a6e3594161c0069cb076ebfc"
        }
      ]
    },
    {
      "bom-ref": "de02c15f-9ed8-4eb2-b886-41de8918b0e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/bootstrap.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3f094f010bfb0c022a51b62778d4361d1cad3fd6"
        },
        {
          "alg": "SHA-256",
          "content": "5c36e28c9a7bd864b673e223db7e1934923227536ffbdf871f58b6f09b9ac8c9"
        },
        {
          "alg": "MD5",
          "content": "a08792f518b51f0f1422b5c96df9eb8a"
        }
      ]
    },
    {
      "bom-ref": "de1d9ffa-6852-4bd5-afb2-8fa85d0d6c89",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/jsunzip.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14fc40805dfd0e84deaf6950c926216a13d685bf"
        },
        {
          "alg": "SHA-256",
          "content": "aff453e50dd7805c99299d0bb5c4dbf673489d394d314c2f3ab8ae17f1c35077"
        },
        {
          "alg": "MD5",
          "content": "c0a6b3c2343aca07c0fe7ca0237d8939"
        }
      ]
    },
    {
      "bom-ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/telnetd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/findfs",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "de4a2d22-3389-40a0-91fd-6fc2a30b8444",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuv.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d310b90b6f13aabaac71d1c11b2b0e0debee4666"
        },
        {
          "alg": "SHA-256",
          "content": "fbd9ec76d59f8f40f5aa4364e711e2cb62ad8ad74de5b99330b97816093a5e3f"
        },
        {
          "alg": "MD5",
          "content": "e96203676da186cd9642a68b37045b88"
        }
      ]
    },
    {
      "bom-ref": "de4ad4f5-ff47-4e0f-bfb8-bfe33a20e895",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SSLCert.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0e8f9a12de94c79ef2391fd464e37d948a788f1e"
        },
        {
          "alg": "SHA-256",
          "content": "09267b30c6ee30e9f3532ce485329a7fad727151ca59cd44c2a9ab1ffe150f02"
        },
        {
          "alg": "MD5",
          "content": "97fc5eccaf4dedabadedb714361905f6"
        }
      ]
    },
    {
      "bom-ref": "de6bf8a0-0c2c-4769-a21a-2d7a77a82534",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13DEM",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a07d686e4d8cf020435335dece891ae1216c3e78"
        },
        {
          "alg": "SHA-256",
          "content": "6e8eefce746245c289cf579f013ec1bf3006a13ef53de3f3cc34429818e6ef18"
        },
        {
          "alg": "MD5",
          "content": "d99862fefeef4bc3ad35bdb68d6de0cc"
        }
      ]
    },
    {
      "bom-ref": "de6c8821-09b2-4d00-8a35-0318ba63d446",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/update.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c92d695fbc7cc72c719c192179ca9376eab074c1"
        },
        {
          "alg": "SHA-256",
          "content": "fd216a976cabd7a0c35c3191e9bd0e7a877af12519e81372099570ea79a40f3b"
        },
        {
          "alg": "MD5",
          "content": "75904156bef75bcba659a1398acf754a"
        }
      ]
    },
    {
      "bom-ref": "de868b77-b179-468e-97c3-9d600e25cde9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/ClearLicense.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f95c966126957a1a7e19468e39c2f6eca062a2eb"
        },
        {
          "alg": "SHA-256",
          "content": "72e809743b00f72f91fdfa7c40273eff5b1e8442609fd1cba22dcd4eacf3c0fe"
        },
        {
          "alg": "MD5",
          "content": "48575564f416ab4868a3c7016b8c1bb0"
        }
      ]
    },
    {
      "bom-ref": "de89a30a-4440-4f2c-8cd5-2c003b97d9bb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "86ed64d0829e3c86af6bcc19bca10419618cf046"
        },
        {
          "alg": "SHA-256",
          "content": "f283c1acd9a237ecbfeac228c035e18b47eaf171a0655c74d3b06102332f799c"
        },
        {
          "alg": "MD5",
          "content": "10d02142393483bff965c2d2f63e0b51"
        }
      ]
    },
    {
      "bom-ref": "de9a09fd-f4f8-4107-b8a8-b0b20b170339",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/chrt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dea48362-3834-4a9b-830d-40c984a8c6b7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ddns_update.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b96b983388a201e8bdad113e8f36bed9c880ae15"
        },
        {
          "alg": "SHA-256",
          "content": "cad1e8a1e6a57f0b3fdba7c96a844b30a5084d92d7c38f0d16f32a396cab7aff"
        },
        {
          "alg": "MD5",
          "content": "ee9bcdecea8a3808e793766e49899d1d"
        }
      ]
    },
    {
      "bom-ref": "dea72a34-ac35-4b38-a932-871d8463afb6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/tc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "deb08eda-003b-402d-9187-25db3e073225",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/vrmtool",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8ae9f14991effb3909c1561591bf3509dcc8e028"
        },
        {
          "alg": "SHA-256",
          "content": "ffdcb65ea702d3f63309cde3d5aff851706df207ae924c8cec07ab2cb5378b77"
        },
        {
          "alg": "MD5",
          "content": "174d36a100f81fa70c3686bc84d7a7c4"
        }
      ]
    },
    {
      "bom-ref": "debd81eb-032f-403e-9ca4-ef369733c7da",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/record_start.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e26818abfb1b39e9a9107ea68f62e71346be103e"
        },
        {
          "alg": "SHA-256",
          "content": "2e9a9e6e364e600e0ea77bb75e0fda9db8cf887a3c2c35b2113cb4699a7eea2f"
        },
        {
          "alg": "MD5",
          "content": "4014b546f227f2b4ad06d0b8d872188f"
        }
      ]
    },
    {
      "bom-ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/init",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dee0dd0c-e3d8-4240-a80a-4b240bee5072",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_fw.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ea874dffff45d2a55655b7ce8b230605c8b22561"
        },
        {
          "alg": "SHA-256",
          "content": "0b3825b40647c47a9e0acc68fa5b21e80d9b3b4a706d8871efc041fb22a75a67"
        },
        {
          "alg": "MD5",
          "content": "59ed97f909cb3f56e0559e7ba1e70561"
        }
      ]
    },
    {
      "bom-ref": "def6f02b-77c3-408f-a6ad-20fa9a6932f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libtinfo.so.5.9",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6d28156aa6dcf0aa29748fb825c7c7f39381e484"
        },
        {
          "alg": "SHA-256",
          "content": "70c9700091303f9d1e359b0aa9b807af79463e1252d72ace63747d8073a5635c"
        },
        {
          "alg": "MD5",
          "content": "360d82c0567c6a41a30706ac270dedca"
        }
      ]
    },
    {
      "bom-ref": "defff098-222a-46cb-81e0-fe21e13f0928",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mem_task",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5eb29b71cd8cea1e5f788f3373f99f0f978c4dce"
        },
        {
          "alg": "SHA-256",
          "content": "b7222c9282f7164b8c9d5c15b79b731322439f4d14b079ced8e982e47f049fe7"
        },
        {
          "alg": "MD5",
          "content": "a74cd46f35d60f57ab48a3bf1407a994"
        }
      ]
    },
    {
      "bom-ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/tc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "df2757be-e2fb-4199-8bb5-af149ceb4411",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/up_ikvm.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ff33b689bf9ea0006774d256467b08ae25e58865"
        },
        {
          "alg": "SHA-256",
          "content": "0c19983da45cc577a8f68c89607d3c8a428c23fa23ea791e6e00ce8a7312285b"
        },
        {
          "alg": "MD5",
          "content": "82db94ea70a8191c6b5a46a7329bef9a"
        }
      ]
    },
    {
      "bom-ref": "df3b9f78-2904-494a-af9a-e0348c8d0d19",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInternalProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "193e06cd6f150a382fa4ee18092169da64280d82"
        },
        {
          "alg": "SHA-256",
          "content": "8cd4f983d78cb9b3d5ae38c729738685e960030221c60be2bc7f6c3fc0350cb2"
        },
        {
          "alg": "MD5",
          "content": "15816d6cee8e8ef0ced6ef426e13d452"
        }
      ]
    },
    {
      "bom-ref": "df486c8b-0715-41a7-89ec-4d6340c898ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/man",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "df49d458-ce59-4819-b8fd-fab05eb5ca3a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_18_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fad0faaee01fef4d42a982d270ce698c7d2efded"
        },
        {
          "alg": "SHA-256",
          "content": "3124758fc3b09d03ffd46bb547c570e7aa7fcb744cbf9adb6d94a4accd2a8ed6"
        },
        {
          "alg": "MD5",
          "content": "b7cfc2bac093b5f87f6e85afbdd89d21"
        }
      ]
    },
    {
      "bom-ref": "df4a3fcd-1468-4d69-a226-be8424e2069b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/ExtendVirtualMediaCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e6809e45e0bd82fc0ac06092077319780bcc12e1"
        },
        {
          "alg": "SHA-256",
          "content": "4f29d907da7ae76f701bb1ff6c6bc39fd7699ae553aefdca3706ec3804470b76"
        },
        {
          "alg": "MD5",
          "content": "283a5792e7b9f149d7165dcf3563277a"
        }
      ]
    },
    {
      "bom-ref": "df57cb27-1de6-41b2-81b0-85a2488d6f55",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_fw_resiliency.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f3de153f5a2028899715664d5f073dae92904c14"
        },
        {
          "alg": "SHA-256",
          "content": "7bd56ad52f0ea20758ba2031f53bde5418062b5dfe0304cfea220d71d7697525"
        },
        {
          "alg": "MD5",
          "content": "dd30516a916f6ba76da3d9740baf8b67"
        }
      ]
    },
    {
      "bom-ref": "df690613-68bf-4e0d-99d1-8cc9f7041bf9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/ipmi.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98060e0721bac3eae08fd6f0aa48d8488a797428"
        },
        {
          "alg": "SHA-256",
          "content": "220ecbe86d6a709e9f346b52ebc86b71b6dc8cd473437e15e630c5f449c0ece0"
        },
        {
          "alg": "MD5",
          "content": "d00c48bd263e730932819288c1fc59d7"
        }
      ]
    },
    {
      "bom-ref": "df6e8363-952d-4bd8-b716-cbda86ce7008",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/share/dbus-1/system.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ed2670c2f53438a10a5059947c25e4fee80df7e2"
        },
        {
          "alg": "SHA-256",
          "content": "7be0905f2d3ab89b7a04b5b02bdf0f3e1a8c13b6d66aa2bb5e18a2fe32020dab"
        },
        {
          "alg": "MD5",
          "content": "2d06f807015faedb793ba0d4748cd1da"
        }
      ]
    },
    {
      "bom-ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "df840171-3e32-4673-bf14-5fccadbd9511",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSG_OD",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6aa964a77475024fc485e839699558d0a4711f5c"
        },
        {
          "alg": "SHA-256",
          "content": "60f3223558936ed7d502a5415e38cab966954dad4417a801106409fde8a36bb1"
        },
        {
          "alg": "MD5",
          "content": "750b161c656ed98538a77f94465de869"
        }
      ]
    },
    {
      "bom-ref": "df97dc57-2b99-406c-a304-cccfd780d356",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lsusb",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dfa93baa-3751-4a71-b3fc-54f5339952ca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/kendo/kendo.excel.min.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf324d59b2fa66b0dd7a97beec5986f245a8bdba"
        },
        {
          "alg": "SHA-256",
          "content": "cc17925001d51c0152f468d5ff7537fe68f1aa69030d228b13c6382b38142e60"
        },
        {
          "alg": "MD5",
          "content": "a4be13f66df789541520bc70211dfbba"
        }
      ]
    },
    {
      "bom-ref": "dfb9e857-eeaf-48bf-ac52-8829317a58e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mpstat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "dfc48fcb-2d4b-41a6-b5fc-1ddab878f97d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/RedfishError_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "54f515c5acb06ac66d83fa5d72314e9d2a2a475b"
        },
        {
          "alg": "SHA-256",
          "content": "30d2376ebe5edc703da40229b161b58957f20b640bb5090a5b0d32046d09645c"
        },
        {
          "alg": "MD5",
          "content": "b57c59671286b7c49bd3aed316a9428c"
        }
      ]
    },
    {
      "bom-ref": "dfca0886-28d3-476e-9fec-dec4474857e0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "655d1343d8dbdbbe8002b1b4d93276ac94030c0d"
        },
        {
          "alg": "SHA-256",
          "content": "e4546e609d2cb1df14423fc14042a21f43924fbbe01b9884716f279d5b061391"
        },
        {
          "alg": "MD5",
          "content": "4d6606867e94159b35d620b0666980d8"
        }
      ]
    },
    {
      "bom-ref": "dfffdb94-21f6-41f6-8080-31de2d0f2f52",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/lzop",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e00dc526-c33b-49e1-8891-b694be19cf9b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libscrutiny.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "716587415e47b2f04913f1520e20d06e7556bed8"
        },
        {
          "alg": "SHA-256",
          "content": "81aa70a266356533eac9a6d06664500fd18240e5c892508b078c1fe3424323c6"
        },
        {
          "alg": "MD5",
          "content": "d4e3e2679c8aaa1522ece78015c38386"
        }
      ]
    },
    {
      "bom-ref": "e0202add-d435-424d-a381-bf7e699cde51",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/renice",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e0325742-23ac-477a-91f9-554f9f4fcde3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/makeGood2.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "438f0d207ab25295ee2cbb6e701f6f9c0347cf8c"
        },
        {
          "alg": "SHA-256",
          "content": "a2324fa81bf90316144d39189689c3d03ad03b07160e58395b8fc948ee40dd2b"
        },
        {
          "alg": "MD5",
          "content": "b0f25e4afa3e8764a86132094d6d1f7f"
        }
      ]
    },
    {
      "bom-ref": "e03426dc-4782-44de-ac73-efd5a5ab193b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmpmibs.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "14b28105a7c561c5ec6593fc127e22f19b2cbc23"
        },
        {
          "alg": "SHA-256",
          "content": "bad72adb3f6479c37f034b828db2cc7f2410fd1d5fc5b832dbd03fe308953436"
        },
        {
          "alg": "MD5",
          "content": "b73f4eb676d243bb243cbf8833b0808e"
        }
      ]
    },
    {
      "bom-ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubirmvol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e0705992-1070-4eea-9569-df5c0c149396",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit3combo-bmc.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61422649e3e26f3b6d6fe708c8059e5db14a7cc9"
        },
        {
          "alg": "SHA-256",
          "content": "bc41f5677851f54dffc8a42af4d168ec0dd543ae47874384cff457891bea5846"
        },
        {
          "alg": "MD5",
          "content": "fe9452d41858f2f423b8509ce638967d"
        }
      ]
    },
    {
      "bom-ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/run-parts",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e08a1b15-fdc2-4e1d-b1a9-acc3b4aed9d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsTemp.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6351e7da5b9118c3129fbca58ef62e089a94761"
        },
        {
          "alg": "SHA-256",
          "content": "f017ef05bdf561c5aed4066e2135857fead003888e780008457001c403febe87"
        },
        {
          "alg": "MD5",
          "content": "78c7d25d32fbeef40566f98f0fb857c8"
        }
      ]
    },
    {
      "bom-ref": "e0b0059e-2337-4655-80b7-3380f819a952",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/IPMIConfig_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dd1cb6f9e5e811d499c0b2c96e83cef384a2c291"
        },
        {
          "alg": "SHA-256",
          "content": "79e1919298e8d7f90d80e913bfc2b73353028087612097c68b638e38a933b01a"
        },
        {
          "alg": "MD5",
          "content": "803f81be8a7dc13e62202be5bfbd76b4"
        }
      ]
    },
    {
      "bom-ref": "e0b3e4a1-d9d8-4d86-87e4-3c7faf6a88fa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/pcie_switch.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d4db7246b28d07910c349f27d0d88487463dc2d"
        },
        {
          "alg": "SHA-256",
          "content": "554311988c343624ce2a14d6ad7d76ba844c0d27742ea27bfdf937791bdc6151"
        },
        {
          "alg": "MD5",
          "content": "37a8f555f6c0c914776f2534d259ccf3"
        }
      ]
    },
    {
      "bom-ref": "e0b556f5-9711-47b6-a945-63abbd79e839",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/script",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/lzop",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e0dbfa84-2fd7-45f7-bfe5-793d9dde9f0a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_coroutine.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5425e5134484dbd593bcbc359999d333ef48b3f7"
        },
        {
          "alg": "SHA-256",
          "content": "a255272c6c134ea90dca95d160528d9a91ff709419dd050db2755055edd092e0"
        },
        {
          "alg": "MD5",
          "content": "1f20ff54bd20c2894edd0d0d0b7f2075"
        }
      ]
    },
    {
      "bom-ref": "e0e06851-781f-4998-a975-813b6287c485",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/rtcwake",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e0ee0b1b-cc7f-442f-8179-0664f6517192",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipmi_sensor",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1d821d13e28dff3c898e5f3b15f0632e96cefbec"
        },
        {
          "alg": "SHA-256",
          "content": "5941412cd9a09307312582b7a0231c1d195b994fab2e4c44ec9086879f1901a7"
        },
        {
          "alg": "MD5",
          "content": "b8c07f34149bd099211cd6869b635c2a"
        }
      ]
    },
    {
      "bom-ref": "e10627fc-9a4f-43f0-8fc5-050b9cc47fbc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libBrokenLocale-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7bb13ed877fd8f132fd27aeabf10ffba52bb78fb"
        },
        {
          "alg": "SHA-256",
          "content": "d9d3910d28e68c6a3175396b148b112d860ba4e13c4747d149ec25c63daaeebc"
        },
        {
          "alg": "MD5",
          "content": "0721f2748e73d246ec7100a0708ab977"
        }
      ]
    },
    {
      "bom-ref": "e11ed86f-b081-4502-88b8-9d0a0d84b1f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSecurity.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21d49359f89413efa1a1a29ffcba6793650922b9"
        },
        {
          "alg": "SHA-256",
          "content": "206fdf043b7f5e88913cb9f4f85dafaf8f55d340cb207c0ae99b80df0e6a07c8"
        },
        {
          "alg": "MD5",
          "content": "860c3971fa79caaebb2b01e358fa6cd8"
        }
      ]
    },
    {
      "bom-ref": "e11fd0f8-8a61-4db3-b214-157010f09865",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IKVM.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "70e77ba9ee3feac20ace403afebc88930347f29a"
        },
        {
          "alg": "SHA-256",
          "content": "3deb2e4f0e72891e905ce3436de3755e2a7d8e84f9cf3fe4117b62575bded789"
        },
        {
          "alg": "MD5",
          "content": "c1236d2594ad9045e2b0396582be0e09"
        }
      ]
    },
    {
      "bom-ref": "e12cf0db-2494-4a28-af33-3792a1473617",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkdb5.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adfd60fecd3221a987ff21090e377ec40f929d56"
        },
        {
          "alg": "SHA-256",
          "content": "4ecdceb0baf3964c1941fab95f45fe3c2697d2bba9af30a2fcd3732adad68e33"
        },
        {
          "alg": "MD5",
          "content": "869143339ba07ddeaa68b2a3a69e9cdc"
        }
      ]
    },
    {
      "bom-ref": "e1304f2f-7cce-4a39-ab36-3f68d15777d5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/FilterRule_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "296d1720d65593254b4557c7f4471c8972d97814"
        },
        {
          "alg": "SHA-256",
          "content": "bec936531a4766f43a7da57d7dc728d623b0854a44577f54c0bf8da67cf30bb9"
        },
        {
          "alg": "MD5",
          "content": "a0ff612cacf23fa4805b6373f86ff3ed"
        }
      ]
    },
    {
      "bom-ref": "e157ef5d-1e26-4ac8-8a25-909a31f27708",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rfHiiParser",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a5119ef5ce3d9487a8219ff49ccca3f5a39fc31b"
        },
        {
          "alg": "SHA-256",
          "content": "8f9c2c7a11708259e770907000411dffe8a139bcd9e17b456d5f0182366dc50c"
        },
        {
          "alg": "MD5",
          "content": "df798356e04d00740e4870523bf9c993"
        }
      ]
    },
    {
      "bom-ref": "e161d313-17a6-440b-ae35-aaeb7403edd4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpthread-2.30.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "915ac7e151ca64d9e4b58e55665b128cd5154b64"
        },
        {
          "alg": "SHA-256",
          "content": "d6619e6cf1e137845d8ffbdbba45ae72454a8af4f530d32d669efd9c2101d446"
        },
        {
          "alg": "MD5",
          "content": "8799d69e5c55a5c407a80a1118b62464"
        }
      ]
    },
    {
      "bom-ref": "e16f5f64-ddee-464e-a248-a1617fcaa856",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/chpasswd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e1866038-8f27-4b29-834f-668b48293739",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmp.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a0e640d61736325b877fae9046b4b358cc6381e"
        },
        {
          "alg": "SHA-256",
          "content": "29998f992af5d5c062fe9cf7cef2015dd1e5b383f861abd6f445ec3d8e1df649"
        },
        {
          "alg": "MD5",
          "content": "c83f72accc1292482f87ef7b24f5332d"
        }
      ]
    },
    {
      "bom-ref": "e1965b84-8ce4-42e1-9156-0045723a2fea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcFixedBootOrder_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "720ab4caf0046ba3b9886ce205130160d458cfdc"
        },
        {
          "alg": "SHA-256",
          "content": "52b409d8e6052f732211d48ecb94ab47c8a062b45922cf7b69df661def37ce6d"
        },
        {
          "alg": "MD5",
          "content": "5421bf7432e25dc6732bb68425e20791"
        }
      ]
    },
    {
      "bom-ref": "e198336a-c069-47ad-b895-4a5f8d87442c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/screen_700x700.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a89df7a8cbaf23291429ea9b5403489ce93c0c91"
        },
        {
          "alg": "SHA-256",
          "content": "372107d22fe0d9f70ef2e31673c3eadb64336f810ad80b1c657481159190a541"
        },
        {
          "alg": "MD5",
          "content": "84fbf5c3ab4c67dddaeaadbde1648313"
        }
      ]
    },
    {
      "bom-ref": "e199f85a-1424-43cd-b29e-e620347709cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiDiscrete_SensorProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "52028d2590e6c00aaba67816c2a939b295ed5e3c"
        },
        {
          "alg": "SHA-256",
          "content": "4dca2527ceed5549003edaff9e1ff777f0f05689cd783e1e1ef27b77b743f522"
        },
        {
          "alg": "MD5",
          "content": "0fa351821b8a3f1a425cf7a6c26c32c5"
        }
      ]
    },
    {
      "bom-ref": "e1b27813-8062-4294-8a33-5a294c8d3b30",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/upgrade_process.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ca8d92f0e124604d119d043a25bf8ffea19f16c0"
        },
        {
          "alg": "SHA-256",
          "content": "8db0f4584ec308c08b226e10da1c47af1ab0b4afd3854c5ad529721dc31094ac"
        },
        {
          "alg": "MD5",
          "content": "3a9675c17227d7bfe9a38962e1341f3c"
        }
      ]
    },
    {
      "bom-ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/logger",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e1cded73-7d92-48ab-a8e9-801718860ca4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstorelib.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3019e7f0ff40df99c86c87d12efba315ec97cace"
        },
        {
          "alg": "SHA-256",
          "content": "8480d20fcf2b91198e55a4713927e61be4042fba1f9041538927902b41e79076"
        },
        {
          "alg": "MD5",
          "content": "a459a1531a5e727fca55b9ccb1967f31"
        }
      ]
    },
    {
      "bom-ref": "e1e06893-88f8-40d1-98bb-a0e0052c0d7b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/special_login_check.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "44cfce08db99d7efc462ad1a341d96c565698403"
        },
        {
          "alg": "SHA-256",
          "content": "c03338ad9076ca72757bc25c51cccbf1f03332dd0a3c3313e82af565944d240a"
        },
        {
          "alg": "MD5",
          "content": "acec1d62c6165eac32775ac7dd7f0dc6"
        }
      ]
    },
    {
      "bom-ref": "e1eefff3-c3cd-48f8-a52a-edd414603fa1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcrack.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21b8b72195068be5bd3989d08ae6b217cf97a0aa"
        },
        {
          "alg": "SHA-256",
          "content": "cc1ab4c1737899d07a259590f14a83fbe7217cc3147c3c56f63af014aea58ad8"
        },
        {
          "alg": "MD5",
          "content": "74381dfd63028781d4c750ddeedf2484"
        }
      ]
    },
    {
      "bom-ref": "e2050477-7a11-4a92-ac9c-e5d0964eca6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/menu_open_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5ecdf92572010421109f206d0fdd778547aa2732"
        },
        {
          "alg": "SHA-256",
          "content": "8c442b6f6ca23f546f6c41904f9a76fcc7a412a646621c699a1383e97710ab8c"
        },
        {
          "alg": "MD5",
          "content": "0ec4517979d0ece8e7642bc118ee719a"
        }
      ]
    },
    {
      "bom-ref": "e209f6ef-5803-4963-81e0-677a9fd63ebc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/raidautorun",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e22640e1-5c90-41c1-bf32-f570afd0f483",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SysLockdown.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98e897f2525f2ce5cdbda0392e773a1b34890f85"
        },
        {
          "alg": "SHA-256",
          "content": "0371b1247e8cb76b40fa00934a36dc1590439c7a75a7dfea7537266dd4c217cd"
        },
        {
          "alg": "MD5",
          "content": "eca175b943c365197e4b189cd36756cc"
        }
      ]
    },
    {
      "bom-ref": "e2594760-0718-47b2-ac47-de4b4607973e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sync",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e259da3b-8b6b-454d-83e2-b0d702b64187",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/expr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubirsvol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e2b09d7c-ca85-4ba4-a62c-04476f048ccf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IKVM.v1_0_3.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "45bd442ceedb5a285afdb1922f1cdb77dccd4b2e"
        },
        {
          "alg": "SHA-256",
          "content": "a03ffa0e2bc8b5b3d78944305e94f9df4b367bda61d40fc00f02b53435b37ca2"
        },
        {
          "alg": "MD5",
          "content": "50241b3f58a32246a3af8a83c602e8cb"
        }
      ]
    },
    {
      "bom-ref": "e2b1871f-197e-46e8-b00d-1a68d5fdb40c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/delStroage.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "65761328f8781a9a884f70dfc80d24328a0076f4"
        },
        {
          "alg": "SHA-256",
          "content": "434276e031cb68dc5bc2226c1a4510fc66dcfab2670cb73459694478cc858386"
        },
        {
          "alg": "MD5",
          "content": "953e81aed6d3e938c8943a97e45bc940"
        }
      ]
    },
    {
      "bom-ref": "e2b2a9f6-5ce5-4946-acc1-7c6a3bcffa65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/helppage/nodata.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3e9710e33a8745a1269f3be4de3a4b130b2c27df"
        },
        {
          "alg": "SHA-256",
          "content": "9bedba5ec0767a4e1bfe801b4fc4119ecd7fa12168712e28c6553378b8f1fd3c"
        },
        {
          "alg": "MD5",
          "content": "1301ee8098efd4956781039c6bf3a713"
        }
      ]
    },
    {
      "bom-ref": "e2b8ba65-7949-4650-9a1f-86826177aac2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/systemLockWarning.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "42afd7bcc8b80c93682c01641160698e044f5758"
        },
        {
          "alg": "SHA-256",
          "content": "898b14b5d67c84363112d8b8350db8fb052fefffb2079e6e8d5f636ec72ad51b"
        },
        {
          "alg": "MD5",
          "content": "5cb3eb61642a77600d5cad60b24eedb9"
        }
      ]
    },
    {
      "bom-ref": "e2c66059-53dd-4a21-a098-2ac9cb5939ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcom_err.so.2.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8cdd7580da6ee9758d1d7ba96c2bced8de77ecb6"
        },
        {
          "alg": "SHA-256",
          "content": "efd85528b5e17db71cb28119a27f71a398a48c568134c93b2d4cec9482bcd1fe"
        },
        {
          "alg": "MD5",
          "content": "f431b3af79c7c5a4193f62a7a0edadb3"
        }
      ]
    },
    {
      "bom-ref": "e2df7760-05b7-41d1-bae5-2c48c1408f8a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/factory_SMC.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "aecb90b414ddc0571130536ee47a70dfbc6f0902"
        },
        {
          "alg": "SHA-256",
          "content": "ab4f758847cf3d91ff54372a43c4f52fcdb157b17ac02fab9406e67267bc4735"
        },
        {
          "alg": "MD5",
          "content": "7d6ece1b6dcd0bc272ed6e89ffbcd83e"
        }
      ]
    },
    {
      "bom-ref": "e300d01d-c95b-4c7e-bfd8-d7914d3132f3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubiupdatevol",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e30212a6-e9ea-488e-a22b-91c0c4ee847d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libm.so.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1998f4dedfa25b2dcff34096980363a07183a390"
        },
        {
          "alg": "SHA-256",
          "content": "0b02609385f6267eb86dcef99de917afb8b703f1f8262125551606456f0790b0"
        },
        {
          "alg": "MD5",
          "content": "3e3f55cb516da70a20955a4c100c86fd"
        }
      ]
    },
    {
      "bom-ref": "e308440b-50ab-4432-af75-797ac882e2bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/login.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bf2bd52b620403401ba6e71bfdd426e832830059"
        },
        {
          "alg": "SHA-256",
          "content": "3ab7e411940afac6cb73849cef51ccf207019d100e26101da004d297853fa587"
        },
        {
          "alg": "MD5",
          "content": "6741eca3228f3f1629b68676ea9500c5"
        }
      ]
    },
    {
      "bom-ref": "e3121e6c-8eb6-45c9-b7fa-00451069f10e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/index_header.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "56aec63c28a558e58c52b0e687275dcd53da291a"
        },
        {
          "alg": "SHA-256",
          "content": "56cd1d5deedacd8dd1142c983ff356aeccdb3772f6f85d4c8e40f14f01cd071a"
        },
        {
          "alg": "MD5",
          "content": "e2b923ffec71a6a42978963e53c84034"
        }
      ]
    },
    {
      "bom-ref": "e3229cbb-c64a-46d9-954f-0dc495adf3c9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_webSession.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dbb282ca4fb50a351612544efe2a53bb29393b24"
        },
        {
          "alg": "SHA-256",
          "content": "42ea4ad9f181c4d147edb0b8575835f373e35141320f6eadf80e758a687d3fd6"
        },
        {
          "alg": "MD5",
          "content": "155b263c240f7551a63b0a98a20986a8"
        }
      ]
    },
    {
      "bom-ref": "e323a3f6-54b3-485c-bfce-ee5a849d542f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/config_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1b1cdb833ba807c4bd756117e5cb23574a84a1c3"
        },
        {
          "alg": "SHA-256",
          "content": "eee91e7d0516ec830e1cdf4dae3b26865f0b361c211cde0b885b2317a6f866c3"
        },
        {
          "alg": "MD5",
          "content": "4a42b1cd49dd94a018dda5272725847d"
        }
      ]
    },
    {
      "bom-ref": "e3244181-15dd-420c-b5d2-a9cf10f13a0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcBrokerCore.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "779c0cd06ea905815ea879d895b34b8b3eb36b62"
        },
        {
          "alg": "SHA-256",
          "content": "2cf252b6b66b821b81da98e8530af76c4f02fd48181d6a634c31074cbe6b536d"
        },
        {
          "alg": "MD5",
          "content": "e8f026ed88817f637bce55587cf7b327"
        }
      ]
    },
    {
      "bom-ref": "e32b9149-939c-4c49-95e8-b751752c6e58",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/adjtimex",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e3482c6e-9741-45ab-a0a9-2c0c1a85160f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcjson.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6c5a68db031971bfcbed5ccc90093e7025003ed9"
        },
        {
          "alg": "SHA-256",
          "content": "02f960883b401869eb7c690256ae7849bce7ae91a4e85f1252a9054b3cf7297f"
        },
        {
          "alg": "MD5",
          "content": "c2ab5fb4e45119a52538b1877458f239"
        }
      ]
    },
    {
      "bom-ref": "e3505fcb-828c-48f9-90e5-83d16f1807e9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/status_green_small.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f303e91433111ce5043531186d7189e394bd13aa"
        },
        {
          "alg": "SHA-256",
          "content": "a876208d01623f619110500dc2a1f4d04942575e588f92d6086644eccd770296"
        },
        {
          "alg": "MD5",
          "content": "a2efda502311e6e49380c85312c69b2e"
        }
      ]
    },
    {
      "bom-ref": "e3589a2a-620f-476c-acef-4df35a53adb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/false",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e36d5195-d17c-45c0-8d86-0a1680dcf17f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/PLXTask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5123fd028d736bf6247c79106b0a93aafc725f69"
        },
        {
          "alg": "SHA-256",
          "content": "e70eacea7320f9bb5d8ced4241b1b88dcd56f424ee129718c825d69650772456"
        },
        {
          "alg": "MD5",
          "content": "72869288813ef84e369c84ddcce445a5"
        }
      ]
    },
    {
      "bom-ref": "e374db85-7922-4942-89a6-74ca7b6d096f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/IPAccessControl.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "badf5d812311a093e23e57a4a27ec5374a1cacd7"
        },
        {
          "alg": "SHA-256",
          "content": "9ad4e3f3c31605f783f3325a29e4c6e9e87610c3cc409e50206436da58d9daeb"
        },
        {
          "alg": "MD5",
          "content": "781ae9aac10923f9c8eed11e255b4bbc"
        }
      ]
    },
    {
      "bom-ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/fakeidentd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/mv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e399aba6-9cb6-44ac-9150-44eaa06bf858",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/hd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e39d485f-1040-48cb-80e7-06aaa4b6e607",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmptrapd.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ab3dacad5679750a36d5429489570e6ccd39a82"
        },
        {
          "alg": "SHA-256",
          "content": "4e448ce280dfa7bac103a2d8ecaa5f6e31461397903f361d216cca940cabab17"
        },
        {
          "alg": "MD5",
          "content": "b501a22158f4d104ecf691a2cf92c296"
        }
      ]
    },
    {
      "bom-ref": "e3b50c74-a9b5-4244-a932-20b6ee72d274",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderSf.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ebbd3799bcd41911fa0b956b49169f473ce0cf1e"
        },
        {
          "alg": "SHA-256",
          "content": "f2ac326b4b01425c58cffecb4134a9515516cba2010ed2e976a020bf12496471"
        },
        {
          "alg": "MD5",
          "content": "314169122ba78ca7729a739240627c23"
        }
      ]
    },
    {
      "bom-ref": "e3b7e767-c282-427f-84e0-9f7573615705",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_locale.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "91e7d62682ef51cec92de0b50edc66487315bc79"
        },
        {
          "alg": "SHA-256",
          "content": "a1c48a37bff9b8fb767178ea00e4dadf00281a63d83e7cb8c1fe4b67cf169c35"
        },
        {
          "alg": "MD5",
          "content": "2aeb499a0c37a5eb53ebbe258f490c4d"
        }
      ]
    },
    {
      "bom-ref": "e3ce7897-4bdd-484a-b848-ebd19701ca2f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_7.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3fffd4eedbdc881bf54ac48afdf0ef43600803e0"
        },
        {
          "alg": "SHA-256",
          "content": "45186c78daaea3affc190d596fa325423cda0a87d9ad544b6488c1bf7dab36cf"
        },
        {
          "alg": "MD5",
          "content": "41e49228ed4abbe1148fce54ef9faf10"
        }
      ]
    },
    {
      "bom-ref": "e40b3194-648a-4e55-947a-3bbc24773dca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmp.so.40",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a0e640d61736325b877fae9046b4b358cc6381e"
        },
        {
          "alg": "SHA-256",
          "content": "29998f992af5d5c062fe9cf7cef2015dd1e5b383f861abd6f445ec3d8e1df649"
        },
        {
          "alg": "MD5",
          "content": "c83f72accc1292482f87ef7b24f5332d"
        }
      ]
    },
    {
      "bom-ref": "e4229e58-405a-4d9d-8714-f80feb196e7f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_14.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f297b85d53f876db9eefb0e858130739ef1030e6"
        },
        {
          "alg": "SHA-256",
          "content": "c8637b914f870c8c3ed5722e1fe5c87b5e42244a8fbd98793669c67c229a17f8"
        },
        {
          "alg": "MD5",
          "content": "24656bccce6c954b4ad9af839d11a64c"
        }
      ]
    },
    {
      "bom-ref": "e424d27b-3524-4f98-9b24-108de83564ba",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bunzip2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e48bd44d-942e-4078-a909-b456d7f2f2ad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/hush",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e4d13926-7a28-4133-8c68-1fe0269940a4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/FilterRule.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c68a6bd780865e4592235ed6b6212930486f94c2"
        },
        {
          "alg": "SHA-256",
          "content": "10761439532e5786c29c0253ef358613ef2095d3eebaee8c15134772bee2dec8"
        },
        {
          "alg": "MD5",
          "content": "26473c983a111f05037dc3d9e67c55f7"
        }
      ]
    },
    {
      "bom-ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e4fbfb3d-c934-4971-9fae-f89b6c9d73b4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/bbptask",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "614e1efc13f6781cbdcd930aad603ca45adc663f"
        },
        {
          "alg": "SHA-256",
          "content": "7c39bcb94e21ddece9e492d2380b2b600dec19f1b64810c2977f00317b705179"
        },
        {
          "alg": "MD5",
          "content": "d13932099bcae89122e42ebb52a0ff54"
        }
      ]
    },
    {
      "bom-ref": "e5211d42-b26d-4f6e-a5d7-0eb97affe5aa",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_7_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f82ec053ed981885ae54534181706d6a9bcc2626"
        },
        {
          "alg": "SHA-256",
          "content": "f9cfd23c6b882c2d2c577334d983046a6f261aa58dcf2f946ef38847fec4e1b1"
        },
        {
          "alg": "MD5",
          "content": "30084dcf59626d86c4917c73937dbc21"
        }
      ]
    },
    {
      "bom-ref": "e5246e39-8013-4056-847a-c491d3174dab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/wget",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e52816e8-ea65-42df-83d4-422d6688123b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcOamCollection_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f93aab94c90d2cfdb99ee7b0ae1fbfc9d57e9c1d"
        },
        {
          "alg": "SHA-256",
          "content": "049be36ffdfbdc0723d2f97795f368a959e5cf334303a720b763b48e169cf1f5"
        },
        {
          "alg": "MD5",
          "content": "160a1ecbc8332959c33ea0f6faef37fa"
        }
      ]
    },
    {
      "bom-ref": "e53244c6-7d65-4e1c-b3d3-e4ec7b243ae5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcUtil.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd2bad991e3ec21e29d761cff15df94152a8a82f"
        },
        {
          "alg": "SHA-256",
          "content": "7d4367bec76360c7db93d6eb01bba49547ea380107f6306e961ff8e4deceffd3"
        },
        {
          "alg": "MD5",
          "content": "3699b0eb231fe372d9776ca25587e7dd"
        }
      ]
    },
    {
      "bom-ref": "e555767f-4003-4a20-a224-94b5a21a300b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/hostname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e5877c42-0a25-42b9-8312-29373a1af24c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmPolicy.v1_1_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4377f9e73e8ddb8ce71901c86eb8dea61f5e9fd"
        },
        {
          "alg": "SHA-256",
          "content": "078590bc77e97ac7332bd8fe310cf57ce97cd659fd8454521368c5298ec3aab2"
        },
        {
          "alg": "MD5",
          "content": "7f3c41e35c816ee7e1429d1ebd24e195"
        }
      ]
    },
    {
      "bom-ref": "e5dfa709-4db8-451a-9f9b-a406c96cf049",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderMem.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c8a5f92f80b1c3ad7afed184ec012825e8c0a8f3"
        },
        {
          "alg": "SHA-256",
          "content": "b1d44ef967c28d7aeccc628ba3ae0d1af8ffb5008aa4f10779d6e543f5a10b71"
        },
        {
          "alg": "MD5",
          "content": "7ab600cb9193ea6e75493cc7abc12014"
        }
      ]
    },
    {
      "bom-ref": "e5f695bc-8af9-49c8-8963-831faccae51d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/ctrl.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7ba915905f7ba2a13bf78f768bcd29d7fc15d28"
        },
        {
          "alg": "SHA-256",
          "content": "59441c6b3f53fbc49004d291cb63ce537a0762cdfae1f3d12689f1945e1288c5"
        },
        {
          "alg": "MD5",
          "content": "52c456d05d8c521194746d1d0deb2540"
        }
      ]
    },
    {
      "bom-ref": "e5fdf953-0ab9-4054-ab25-6fc95c3dc061",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/spdm_smci_rootCA.der",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8296736f2a5a878ef37bb44d45321c63ad6b852f"
        },
        {
          "alg": "SHA-256",
          "content": "b98919c84721a4fbe6aec448850f73a0173fd622fb0c5429b790077c148b8f13"
        },
        {
          "alg": "MD5",
          "content": "eb1fd553fe7e78acfa1bbb128722b5c0"
        }
      ]
    },
    {
      "bom-ref": "e6236792-bb52-4bb0-a60d-de6aee999b8a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "537416e7bbc402d34d8969797fe7e53912a4fb47"
        },
        {
          "alg": "SHA-256",
          "content": "753ece6c1970500b5312e9e2e269a0b0e44076c17ff74c65a70d572820b05c33"
        },
        {
          "alg": "MD5",
          "content": "0414809cbb6f25238567cd58a10a1aed"
        }
      ]
    },
    {
      "bom-ref": "e63b5621-2b4f-423c-b0ce-fb059139add2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSG_OD_10U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b19a9517ece7e0881459c3a9978bc180c6122b8"
        },
        {
          "alg": "SHA-256",
          "content": "e6aa65c42eb82a98c6d423634f5c0f425144c10cf92e8636747d86d2a760432e"
        },
        {
          "alg": "MD5",
          "content": "74a458afc15ff931972d54dc0a165f47"
        }
      ]
    },
    {
      "bom-ref": "e63b5a8e-c608-4f16-a4e4-68e25409464a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/iostat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e64d043d-671c-4da1-8427-10e3d01a129a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/service_redfish.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2d207d1255eb0af1ae6ea2b32edca0b3281f334d"
        },
        {
          "alg": "SHA-256",
          "content": "b0b376dd52b0bdeb61c7d8f01fbd35731e962d15f636c8a7066c01266b6bae68"
        },
        {
          "alg": "MD5",
          "content": "a8d94819a6c92e3fb4d126ffd29b5759"
        }
      ]
    },
    {
      "bom-ref": "e6538312-7c27-45ea-95d6-a054f878e61b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NodeManager.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5a680def1b9e48db678df41780cccd896c910cd4"
        },
        {
          "alg": "SHA-256",
          "content": "6fdee5983964d825de2c935d5dc4a1bd85b20faf7b4c6bdb85611b7b1bacb130"
        },
        {
          "alg": "MD5",
          "content": "9c94281a92001a9d35ddaae84891d5da"
        }
      ]
    },
    {
      "bom-ref": "e6702469-e66e-4c7e-8cbb-876a551c6cad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/html5boxplayer_hd.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "62ad4f349191844af49b60df4de3129239357366"
        },
        {
          "alg": "SHA-256",
          "content": "b944e759c81970600fd1404870f3cc0acfac6a77bd910264c5c346239ac7d2d5"
        },
        {
          "alg": "MD5",
          "content": "a637617a32ec78540d04d0751cddb654"
        }
      ]
    },
    {
      "bom-ref": "e67b8d1d-02a5-4761-b5fc-899c7f06dbc0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/des.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "87a8e5c547818260169788bdaa0be8e4b9f03b58"
        },
        {
          "alg": "SHA-256",
          "content": "1c2a94dd2c206828ac791b8d58c88a827dda5c85da64cd3d7ebd82936362a0dc"
        },
        {
          "alg": "MD5",
          "content": "125a6bfc7f7591d7031d3a7b880eea82"
        }
      ]
    },
    {
      "bom-ref": "e69787e0-9463-4ef6-a91a-9b032b1977f2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_directory.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a8934548d10fcd752b1ad1b7917d0f4ebddd39cc"
        },
        {
          "alg": "SHA-256",
          "content": "cbf3f3f013ffffd6d30deef84a670700bafc9c116b04fcf623eb04da96a1457f"
        },
        {
          "alg": "MD5",
          "content": "ecbc4ebb4d7a0323c1e7461303676846"
        }
      ]
    },
    {
      "bom-ref": "e6a5ac72-e925-4249-b59e-8886288b0394",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libslit-bmc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8aa1c84c0a933199644edbb3888723acff374333"
        },
        {
          "alg": "SHA-256",
          "content": "2afd30b75566f50cc478e13caf314b176d80ab10df83b18d482df0d95ed08f53"
        },
        {
          "alg": "MD5",
          "content": "1c4d5e2e456285c1b2def2d59f4309e3"
        }
      ]
    },
    {
      "bom-ref": "e6bae9b2-72e1-4dbf-bd01-d8a22cd0249a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/indicate_p.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a1047a93ef339362ab1078adb9802843e8ee3367"
        },
        {
          "alg": "SHA-256",
          "content": "8147b435ec0bc14c776b7f00bd275ebc898ceef604b51045c342b635d81f24f5"
        },
        {
          "alg": "MD5",
          "content": "11a65cb1708ffd9f9ed84537a5568e4e"
        }
      ]
    },
    {
      "bom-ref": "e6ca777a-e3d1-4eb9-bb42-159e50cffa83",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_SoftwareInstallationService.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b0f98313a2a83b780eef8bb2fca60f952ad0054f"
        },
        {
          "alg": "SHA-256",
          "content": "c910a3da2a6b22b6f0c5f496ad674fc43d52778efc8e398a6996c33927293819"
        },
        {
          "alg": "MD5",
          "content": "0a6020f24cd97e93cb97412b67c25c76"
        }
      ]
    },
    {
      "bom-ref": "e6d52b90-a2ea-4715-8eb8-f5f73c6379e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpci.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2894b1d445cb15e0bad928f3470ee336729bb018"
        },
        {
          "alg": "SHA-256",
          "content": "6e9e180e4a5c1d7bba7fb6d4accec8ec461192e5c5aae65adf11781d4a1ab0a8"
        },
        {
          "alg": "MD5",
          "content": "de2e637be4e1979d33cbbd140a9e8b4b"
        }
      ]
    },
    {
      "bom-ref": "e70faa7f-cb67-42ff-bcb8-96e40ffd166f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcEthernetInterfaceExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "41cdf92ac463cd220e3f884812d1b4cc73b058fa"
        },
        {
          "alg": "SHA-256",
          "content": "c099bece04d73bbc3f7d036fdeefc5f44be6cc2237e2a6cea4d75011aefe3b3c"
        },
        {
          "alg": "MD5",
          "content": "3c19864cfac69ba39838c3fa7ddd0677"
        }
      ]
    },
    {
      "bom-ref": "e732c344-67ee-41bd-b9f6-f8518d49bad2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/MOBHandler",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0d733d54b8943487cd71216dcfe47270d3fceb8e"
        },
        {
          "alg": "SHA-256",
          "content": "2e44c76cf3358ac1acbfc19fba5c046430133e2e88ddd5d107b25aa23c2ecf22"
        },
        {
          "alg": "MD5",
          "content": "282da1039bd8377659afce844fc73ab1"
        }
      ]
    },
    {
      "bom-ref": "e73fb94b-5953-4ddf-bdd1-b8eb5b325b91",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuuid.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a385445a0399dea518d822f9cf73f27594710e73"
        },
        {
          "alg": "SHA-256",
          "content": "9b227f70bfcb37cb7a85169fa5f34c3b3fd8f32ab5f325207658c4e228b2fb95"
        },
        {
          "alg": "MD5",
          "content": "ef1df35480bae12a18508e9942ad7ba2"
        }
      ]
    },
    {
      "bom-ref": "e749b60b-64ba-4992-9c11-8a38c58c0782",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/keysym.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1c6f99a896d5a254993c88ff42157060d03eda56"
        },
        {
          "alg": "SHA-256",
          "content": "7869fbc8bbcb67aed62b3c9c90773b19255beac3240a3c1ac6457e81110086da"
        },
        {
          "alg": "MD5",
          "content": "8697db621fe4658e6bbaac11cb2a7bc8"
        }
      ]
    },
    {
      "bom-ref": "e7821334-9f92-4c55-b715-6ebe70115720",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/hostname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e7933a5a-590a-47a7-aad8-5ffd3412ac0f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/pstree",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e798ff08-7eae-4f9a-9958-7584ba44ffc8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_bmc_kcs.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b1a9e7515ba67a3876a1a44e79fe7ed6ca1ba9d0"
        },
        {
          "alg": "SHA-256",
          "content": "0911c604ba99c2c03ef854918f92a771e647568abf1ce9657c561a16f1cac2a9"
        },
        {
          "alg": "MD5",
          "content": "e4b8c0af2c0168c4fa5430b43f34827b"
        }
      ]
    },
    {
      "bom-ref": "e79abc9a-119d-4312-bfb2-261059b12f9a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Syslog.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ff877084882190aaec9f201c76669b1839f5bee0"
        },
        {
          "alg": "SHA-256",
          "content": "af6ad9ab045fe3950fd92cbdd8b73111833321bcdb9717942ae4b0af31bcbea2"
        },
        {
          "alg": "MD5",
          "content": "cebb005591e85894500869551b7cefe2"
        }
      ]
    },
    {
      "bom-ref": "e79b10fc-d0db-41dc-8077-eee79e08f4f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/httpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59ffe4998db4d76e5aed1ff26190f6b31fb911a3"
        },
        {
          "alg": "SHA-256",
          "content": "62bce0d81dba8f57417e45acddad675dcb74f856bb007d35dad2079aa50ad7c1"
        },
        {
          "alg": "MD5",
          "content": "e3ee790da128d7baa39ef86f6ce7836a"
        }
      ]
    },
    {
      "bom-ref": "e7bad671-5154-486c-8d90-795b6ec506a2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/registration/repository/root/cimv2/qualifiers.idx",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6416cec1fc927d95303c33d1fb40c16302713b3"
        },
        {
          "alg": "SHA-256",
          "content": "7ebc9a235353bebb5adc868713befd1c5c780dac6db664bd71e23ce5d11ffb24"
        },
        {
          "alg": "MD5",
          "content": "fc3892795b9f2f2549a93ad4816376e5"
        }
      ]
    },
    {
      "bom-ref": "e80c4237-5d70-4fbe-a130-7e6d8c59f147",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/power_p3.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df78323232afb39a0554d886b81db6e4d7ffb101"
        },
        {
          "alg": "SHA-256",
          "content": "c8fbf6aa1fb20988ea0718e31f5964cb5690ec6e98bb7ba3ac632af9d1e38a06"
        },
        {
          "alg": "MD5",
          "content": "faa42de274069c8a3dd2acb07cf2a645"
        }
      ]
    },
    {
      "bom-ref": "e81cf15a-4939-4902-8daa-f81013f7ab99",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_9.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4a7a3972268fe00af7dd005dffb64e66bead4181"
        },
        {
          "alg": "SHA-256",
          "content": "28a3aeaf3546223fc7e29619e9472531aa219e1ea8f81c574c4629ec6cafb82d"
        },
        {
          "alg": "MD5",
          "content": "d4e031b2e2e44d51fcf3849d667f74fe"
        }
      ]
    },
    {
      "bom-ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setkeycodes",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e83f0147-23eb-45f0-9c83-ff2fcceae4cf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuuid.so.1.3.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a385445a0399dea518d822f9cf73f27594710e73"
        },
        {
          "alg": "SHA-256",
          "content": "9b227f70bfcb37cb7a85169fa5f34c3b3fd8f32ab5f325207658c4e228b2fb95"
        },
        {
          "alg": "MD5",
          "content": "ef1df35480bae12a18508e9942ad7ba2"
        }
      ]
    },
    {
      "bom-ref": "e85549e3-d024-4d48-85c5-35ed7c4ee07f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/BMCInfo_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "725e6798a16b516bddfd04e6775a4a37058b6a7f"
        },
        {
          "alg": "SHA-256",
          "content": "9e1ad215a64a5435136f5a02387621aa6e42e64d8ef897f814ce6150d10f7689"
        },
        {
          "alg": "MD5",
          "content": "62b031217358e7066fb6f485ad4873d9"
        }
      ]
    },
    {
      "bom-ref": "e87f165e-eeda-4f52-ad9c-3478ec634f5a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_input.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b6c8f1f087aa07e0d579c74ec842d63abfef070"
        },
        {
          "alg": "SHA-256",
          "content": "3eeb5274025125a3580f3fecae709bc659debf573cb5903b92824b08fe40ca5c"
        },
        {
          "alg": "MD5",
          "content": "2a6f78c73d2cda992e1a9c7a66c599b3"
        }
      ]
    },
    {
      "bom-ref": "e8e133c3-4f15-4aa8-bc01-4434ed53eba0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/shred",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e8f03685-c8d7-4057-8a23-f4f97460e015",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcSystemExtensions.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3cc075cad6d3bf15f0473d8807a66bc0957eb9a6"
        },
        {
          "alg": "SHA-256",
          "content": "a11ec92e03336a13f37cc266f8fbc8646c8e496347ae80d5be94a02c50c37c68"
        },
        {
          "alg": "MD5",
          "content": "97ddc2f6a809a9d3f5c4bdd687876d6e"
        }
      ]
    },
    {
      "bom-ref": "e91acd80-20ad-404f-8d04-48ce4a4544a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cryptpw",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e9254056-1250-48a3-b6d2-95c2a0c5aec2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/RoleGroup.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0c8cae56e82e2d39e4e1d39784c5d18a1708da0b"
        },
        {
          "alg": "SHA-256",
          "content": "fabb71f1985920b85eccaad67a7de6733fb4f6877260bb21b3ba51f14ce7631c"
        },
        {
          "alg": "MD5",
          "content": "d6020bb685870d67b3192d67ad39e214"
        }
      ]
    },
    {
      "bom-ref": "e942a366-a3c0-4b61-b1f6-84aaf62072e2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/chgrp",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e945485c-b3ec-4e9d-b2a7-6869bb1ddcd1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmDomain.v1_3_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2fa802ed9616e859556c50477c24cef41138d6a6"
        },
        {
          "alg": "SHA-256",
          "content": "7056bb1aa137c4871b9a09fe9dcf2dcd0c111f635d41741d1c421571c5dea0f3"
        },
        {
          "alg": "MD5",
          "content": "9fa01494951156097a7e3acc774f4d3a"
        }
      ]
    },
    {
      "bom-ref": "e9582bf7-d166-4b2b-be0f-d44870d27e15",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/uname",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e95be3fd-2b92-42bc-9a80-00cb6cef9e1b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/fallocate",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e95f10a8-bfe7-4657-9b04-18d98ddbcf85",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/partprobe",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e978e03a-8947-4a93-9487-03e6c8e4c9ac",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/rfb.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c423b4bfe2750e790ed44e5473ae3891e4a84b3a"
        },
        {
          "alg": "SHA-256",
          "content": "827f8797df2d961e693c992194f5a9346c50a327205a10cc7992a0008bf1125e"
        },
        {
          "alg": "MD5",
          "content": "402ec2b8ea0e42b7d0fc6e8b5cad2b1b"
        }
      ]
    },
    {
      "bom-ref": "e988a336-fac9-4a7c-9ca7-2f2a2f772e4e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libteec.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d65a897459d157245644efb77d73af76e1932ace"
        },
        {
          "alg": "SHA-256",
          "content": "2999ed74e38914ee21c76a1dde37ada773f02d581fbe1ef2153bd449b1ee6332"
        },
        {
          "alg": "MD5",
          "content": "d3375bd317e5cf5321a19c4f92ba2152"
        }
      ]
    },
    {
      "bom-ref": "e9b4e2a6-7743-4ef5-86dc-eb6206a00952",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSG_OD_4U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59d5888eb98a36350a1cc5b7be9ddb6b3ba7761f"
        },
        {
          "alg": "SHA-256",
          "content": "2a98f7cdd4d1525fa5207843ca06daf35d939f9fef6a2bc11f76c46f426cb2c8"
        },
        {
          "alg": "MD5",
          "content": "ac30113962d213aaa05d469cf965ae7c"
        }
      ]
    },
    {
      "bom-ref": "e9b5d759-2955-4bc4-931e-73703c6e6d65",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libverto.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c67a272c7c6d06a90e27160a6a3815e802a5492"
        },
        {
          "alg": "SHA-256",
          "content": "fbf81609dc68852e0493bf6ec058670bdeaded13e5aa4f5a1e2a6dd3f9c90009"
        },
        {
          "alg": "MD5",
          "content": "f5c51d1a2457511280b3148ebf476115"
        }
      ]
    },
    {
      "bom-ref": "e9b7170d-f623-4b63-91ef-ae0fa42e030e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/cmpi/libcmpiThreshold_SensorProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cf9cde9c96b7b87128f7991023bb51d9bc30c7ae"
        },
        {
          "alg": "SHA-256",
          "content": "55b876e694378869df09304e23fee9fd533528da02711f8a1b2d82f1c64bce2b"
        },
        {
          "alg": "MD5",
          "content": "6d686bbc5606e56c39dc0600dbbdb6ac"
        }
      ]
    },
    {
      "bom-ref": "e9cc0913-97c4-46a3-b657-80951a8a72ab",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/lightbox_next.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e6e6a55a23018abc4673c4e4f0422271bc6a50ca"
        },
        {
          "alg": "SHA-256",
          "content": "5f32ecde435438d1dfa65237e15f3bb6eb0445c6e1c4ad8e71fea2d98ebf888f"
        },
        {
          "alg": "MD5",
          "content": "29cb0d09abba938888feb40ffb2b03fe"
        }
      ]
    },
    {
      "bom-ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/resize",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e9e8dbff-2001-416e-82f6-6bc6cbe83b1d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/DumpService_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a6219559c36b483c135c2536288d3ef75ef9c8eb"
        },
        {
          "alg": "SHA-256",
          "content": "9d964219739cc75641f2d36770a543d8e39498f8085f9b373bc83383c297007d"
        },
        {
          "alg": "MD5",
          "content": "8a17f1b81e93f966c52fab84e3314db1"
        }
      ]
    },
    {
      "bom-ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/add-shell",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "e9fe6143-b228-4151-aa7d-60184ebfafb8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/SMASH/lib/libSFCC_API.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c4ea24ea703fa91785076d513cee6cdbca2cc2e0"
        },
        {
          "alg": "SHA-256",
          "content": "816db77d35c5ab7237f62e6809314735ba5a1f1b917090afa3802cb42e6413fe"
        },
        {
          "alg": "MD5",
          "content": "030c88c0a41e6a45128e8b505c999999"
        }
      ]
    },
    {
      "bom-ref": "ea126ced-35fa-4877-8cf0-a77111208b0c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/nameif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ea364242-cc95-4492-8a63-977bb16f5054",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/bin/crypto_unload",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ccc9b824a08171c9a92bb4bc949a8a84e3d9bb0e"
        },
        {
          "alg": "SHA-256",
          "content": "02d5f18ccc7ce98324d1900e9fccc26a491bd8459ded983540c6743f84c8e6b9"
        },
        {
          "alg": "MD5",
          "content": "419ec5298be99594dfd6d12714bbdd47"
        }
      ]
    },
    {
      "bom-ref": "ea60d15c-cc91-4b77-a6a6-e39e338f66f9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/drag.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1124f5cffca8329758bc2d199a0be49c438b1917"
        },
        {
          "alg": "SHA-256",
          "content": "40d4cddbf1e243bcef41015bb4ed5bb249b5a9f40bd8bfda231d55ef1131f937"
        },
        {
          "alg": "MD5",
          "content": "e9d6f1fbe35dfcfdf49ce49c0880612a"
        }
      ]
    },
    {
      "bom-ref": "ea61c5e9-c005-40ff-9f6f-b330d064f66e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpci.so.3.8.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2894b1d445cb15e0bad928f3470ee336729bb018"
        },
        {
          "alg": "SHA-256",
          "content": "6e9e180e4a5c1d7bba7fb6d4accec8ec461192e5c5aae65adf11781d4a1ab0a8"
        },
        {
          "alg": "MD5",
          "content": "de2e637be4e1979d33cbbd140a9e8b4b"
        }
      ]
    },
    {
      "bom-ref": "eac3260c-f0ea-40d7-9dfd-226d0c197de6",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libplain.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7d790d2c17d12fa79d8ba0de21f37a2a65bc496d"
        },
        {
          "alg": "SHA-256",
          "content": "2e153c5f71bd55f24701c39d2d7343b97c680214b7209aae3c8dbc2f1e9322ac"
        },
        {
          "alg": "MD5",
          "content": "ca710a742c73d4d91fad7860fb565fc6"
        }
      ]
    },
    {
      "bom-ref": "eacc151c-0ae6-4943-9d82-eb42e4844632",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/OemDumpService.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a9807d15fe01eaf9eee8d601fabe594c9381b538"
        },
        {
          "alg": "SHA-256",
          "content": "0f8f27d7b9746bd3e828d48975c42146f152f333c37ed897c98c24eb6b9baca8"
        },
        {
          "alg": "MD5",
          "content": "5caa42cd60497e45175d45ece7c5c35c"
        }
      ]
    },
    {
      "bom-ref": "ead8c98a-5025-4026-9389-3254142ba543",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/user_pw_lock.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "74148a3ed0dd200228d2b3b2fe7987475084446c"
        },
        {
          "alg": "SHA-256",
          "content": "f97e618160cdf17730a3ebb1dc661e6ab0bdefef35768d60841fb1106b4e9f98"
        },
        {
          "alg": "MD5",
          "content": "a6c2f60c6a55f1e88e10a4cbc17795b1"
        }
      ]
    },
    {
      "bom-ref": "eb038ee1-dea2-4ccb-942c-06853639b5bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpam_misc.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4f7070eaa4b489e6f76c6bddaa0b5bcd57f0d3da"
        },
        {
          "alg": "SHA-256",
          "content": "00c1efd1a7673edc66771060c55713d71c76b9a28e5895556a07da506185a94a"
        },
        {
          "alg": "MD5",
          "content": "ee5f5e4e0702d9b4255d053300f869f5"
        }
      ]
    },
    {
      "bom-ref": "eb03b4c2-7c2c-4042-be0a-68f6cd70852b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/side_play.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e218c1b75ee114cc332c188e9bb33a4748b4abc2"
        },
        {
          "alg": "SHA-256",
          "content": "10ca15e4a765ae5e40925691f0250ae753b7b10d98ec233733a7f199efca37d6"
        },
        {
          "alg": "MD5",
          "content": "9de41fbb52b667f39a0788136ad0ceb8"
        }
      ]
    },
    {
      "bom-ref": "eb13fa3c-118f-47a3-9671-ab52c025e8a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ParseBootProgressCode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2743ffea537c51aa1f266a4c945baecf230cda7e"
        },
        {
          "alg": "SHA-256",
          "content": "8e0ef08827cbe1bd227799f1a7f1819e11ca740e8f84a298753b34eea012ff10"
        },
        {
          "alg": "MD5",
          "content": "70a71a46432ec573db852546546c9296"
        }
      ]
    },
    {
      "bom-ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/tty",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "eb2f0df8-2e8a-40b7-ad40-15dd89107241",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcElementCapabilitiesProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b61a9de4c41005f3942768e5dd2db4f10010460e"
        },
        {
          "alg": "SHA-256",
          "content": "2ddfafb5f10694b6cfe8e42418d00b8b10116dc2f7600b8616455270d44d578c"
        },
        {
          "alg": "MD5",
          "content": "a1927b2ae8be3277f2a0aeabb217e2cb"
        }
      ]
    },
    {
      "bom-ref": "eb45c133-cbe6-4f94-a2bf-948d581d999d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/udev/udev.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f23182dec154b92871627f9653fa5a428fcefef7"
        },
        {
          "alg": "SHA-256",
          "content": "270d3d1df5859b1d90771fe739d33c3a5d05ac92b6ee79614a41ba28b179d9d9"
        },
        {
          "alg": "MD5",
          "content": "8a5ff3c5744a5622b9eabf20f2c46eaf"
        }
      ]
    },
    {
      "bom-ref": "eb476b79-feac-480c-a263-cd0853e5809b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/lighttpd_port.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "06a6179a1607b6a693787e2aa5ae02c8d1d1b804"
        },
        {
          "alg": "SHA-256",
          "content": "a40c968621a265447e48b27c75fd1cd2480560094714718ad10b3759ef049a8f"
        },
        {
          "alg": "MD5",
          "content": "d2fe5daeb4d1124d8e412c3943a54927"
        }
      ]
    },
    {
      "bom-ref": "eb4b5ddd-b298-48fa-8263-0467700610b0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkrb_validate.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c1030fcd378571d5da131a74569073a1b93adddc"
        },
        {
          "alg": "SHA-256",
          "content": "2e401c188276fa8d00924542c9703f5f5adffc2fde52898c7ba200e6a3a900e6"
        },
        {
          "alg": "MD5",
          "content": "1a82ed0d3210f7f279a08308162bf6a0"
        }
      ]
    },
    {
      "bom-ref": "eb4d2567-4985-42c9-ad51-9042b91ecb43",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_db.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "add577b2bee7006c056bfb9dd9098cd77a9424aa"
        },
        {
          "alg": "SHA-256",
          "content": "830ac71c89c765dac83ab04c6b7a31c93c9b35aaa272ff2b510925f58ad7bc2d"
        },
        {
          "alg": "MD5",
          "content": "a0061de53278a6c53438966b253cab74"
        }
      ]
    },
    {
      "bom-ref": "eb4e9698-9082-4a09-8407-ff513814ad74",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcap.so.2.65",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5aca88007e1a19f5070563540f4ca7cf7b520e31"
        },
        {
          "alg": "SHA-256",
          "content": "5015e9c038f83a6353b42a2117561d90e86871e1264fd1540a25880aa0aa94a0"
        },
        {
          "alg": "MD5",
          "content": "594271196d391be87977c3ab38209db3"
        }
      ]
    },
    {
      "bom-ref": "eb568073-2d92-401e-b979-93f97074eb79",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcHttpAdapter.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16f0f7ddeb0d3565eb00ba9f7c78a16b909d8f2e"
        },
        {
          "alg": "SHA-256",
          "content": "b419d08ef6de4c00780de544d283e3f0935547529643fb24b153e082e52ace06"
        },
        {
          "alg": "MD5",
          "content": "8bc2a1bb518674242859c6078ce6e545"
        }
      ]
    },
    {
      "bom-ref": "eb5b6301-25e2-47b9-954b-2abab99d6f9d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/RollbackID_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7dd9e7cdf990e83c02204d718fc24106c3dd769d"
        },
        {
          "alg": "SHA-256",
          "content": "5dbb0cb7650f670bbc6da1a711978042e8a8de45d14229f4fdc64f3412d6c0e3"
        },
        {
          "alg": "MD5",
          "content": "80ec5f83ca5806a1784a0977580fbf63"
        }
      ]
    },
    {
      "bom-ref": "eb6f503d-e87b-4560-b9bd-6e398cd102d0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SDW",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6e07d8ff891612ede3470d43b7e73e5bfa1d31f3"
        },
        {
          "alg": "SHA-256",
          "content": "4be44c29cb15bbaa0740561c83cd925e447a062f03fb7568560b9beb674ea7b7"
        },
        {
          "alg": "MD5",
          "content": "5a4520084bedf463738c5b441fc0bdc4"
        }
      ]
    },
    {
      "bom-ref": "eb7c840a-edb1-4cdf-b80e-c8e45feca156",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcElementCapabilitiesProvider.la",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "444f57fe15a32e7664986fa522752362e5037fc7"
        },
        {
          "alg": "SHA-256",
          "content": "f5bdeb4f34abebefdf6c33b6139f1bc8029d84460e05a7e4be21ca13ab572332"
        },
        {
          "alg": "MD5",
          "content": "dd57a0e5ee5f1891eb3e84031635cae4"
        }
      ]
    },
    {
      "bom-ref": "eb8f99a6-5a3c-4126-8fff-1f534b2ffc5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/popmaildir",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "eba61104-83db-43e1-b3bb-93e3bf5cf57c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcNode.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2a7b40d2ed9a4204144921a46869abf5303814af"
        },
        {
          "alg": "SHA-256",
          "content": "3e4bf0bd9a3a22b8e6f91b539a72f91d70c83692f8d14a15f6f81ea27d7e1217"
        },
        {
          "alg": "MD5",
          "content": "9901279fe423e9eb52523400ab41f4ba"
        }
      ]
    },
    {
      "bom-ref": "ebbbe8cc-a728-409f-97d8-a282dd493407",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libe2p.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b5d34c603dad67131876a198ee5acb6bb94b0fa"
        },
        {
          "alg": "SHA-256",
          "content": "3ebb8f58cd41f3ae8ffe22939e2307dd72068263926b463e813462b1077b5ecf"
        },
        {
          "alg": "MD5",
          "content": "827a4409c74b5dfcc049e1e84dcc687c"
        }
      ]
    },
    {
      "bom-ref": "ebe076c1-b45f-4320-87a6-38aa1bab68ef",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ifplugd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ebfb75e8-3656-4fb1-8b20-74174311d92d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_6_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e2dbdcb2694808bed228274849f3e2199c506bda"
        },
        {
          "alg": "SHA-256",
          "content": "c1287870d2e5b021834da32957f79297ec71606f86d068c7683c14f4917ca464"
        },
        {
          "alg": "MD5",
          "content": "51f1fb9f40709ffbf8c9d63565a3da21"
        }
      ]
    },
    {
      "bom-ref": "ec0da941-afa0-4da4-87b6-25b6e95383d3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libexpat.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "dcdad264d19e601bbc20bb57e3899923779ee582"
        },
        {
          "alg": "SHA-256",
          "content": "5307c084b5953b62880b733282f786a154b747f72f090299cb7acba5a6564ccf"
        },
        {
          "alg": "MD5",
          "content": "96a361b044c3427a184ce648d88f9ad8"
        }
      ]
    },
    {
      "bom-ref": "ec21538f-aab3-4129-b814-b42747a4cee3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/kendo.default.min.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "98765fab24ff842249295b84e45c939109b8117d"
        },
        {
          "alg": "SHA-256",
          "content": "f53e38209e0f48548faad2d46db9d71bb552d9723fb61dc38ab1ee1ca5d56cb2"
        },
        {
          "alg": "MD5",
          "content": "d0da4e165ab33423632bafc44220a190"
        }
      ]
    },
    {
      "bom-ref": "ec3b9fbe-8efe-401a-9cca-4ff3371cf27c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ls",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ec45d283-ca99-48c2-b383-babf02234ffd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_5_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d3eb56b84eb80275163d4f8c31eaa86c8173c7db"
        },
        {
          "alg": "SHA-256",
          "content": "5f4f50576942f33de6e88056132b4f3ae14fb37f7f182ae9e751c7647c291b91"
        },
        {
          "alg": "MD5",
          "content": "57502277e74364eb44ca8f1c045c76ea"
        }
      ]
    },
    {
      "bom-ref": "ec4e5ec6-c893-4f49-8857-23c4fd07c137",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/redfish/dashboard/eventLog.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d1c68daa1f8c5243003e1ab77aa764841d210051"
        },
        {
          "alg": "SHA-256",
          "content": "87924e53e75a74d7859dc1e1f4762880a943814aa3c798f45e7e1b666a644cbf"
        },
        {
          "alg": "MD5",
          "content": "d09942d1ab9b30df8fa1bbdc00e10b17"
        }
      ]
    },
    {
      "bom-ref": "ec6fe40d-2d93-4f14-996c-1b6f47ac3915",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/i3cinit",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8fa62dc614abbf34c98bbca139b462ce664c7374"
        },
        {
          "alg": "SHA-256",
          "content": "f5f7a0d04fcc8b2d50f27f99bb9943db0e32bd2d1a24787bade029bbf4510a7b"
        },
        {
          "alg": "MD5",
          "content": "40eb1310c5fd3ca070eacd81f6d71ce6"
        }
      ]
    },
    {
      "bom-ref": "ec9e3686-2e23-4f3e-9df9-2cf6792e992a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/SOL__V0.5.11.jar.pack.gz",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c2cf7e76648e5d49b21fa52ff244c4e69d61d643"
        },
        {
          "alg": "SHA-256",
          "content": "11674bcecf9bda1a900d1373d6996360e6ca4a8af03b34069bf16543b2d0d909"
        },
        {
          "alg": "MD5",
          "content": "a029349bb790cf4267c89549b8dac3e0"
        }
      ]
    },
    {
      "bom-ref": "ed10d96c-8b18-4d6d-8a2e-0e64f2d29f5b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/chpasswd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ed269807-ec7b-4648-a1f8-9a8d8c2582fd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip6tables-save",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "ed419429-6a13-4ad5-9358-57b7d8a1d473",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/ikvmStyle_x13.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6a8771c04f23e70d5e53999b95c3ffd24c437c7"
        },
        {
          "alg": "SHA-256",
          "content": "d50f72e7cb5ebd5a9afbaa1427d9e99e1b91a52a1cbc5d557640f1e15ca3a6e3"
        },
        {
          "alg": "MD5",
          "content": "6b0156e58cff9ad76b7724a41746cff1"
        }
      ]
    },
    {
      "bom-ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libirs-9.18.24.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "595d82fa583de1d3d4fd1a74560c1f79abc75e98"
        },
        {
          "alg": "SHA-256",
          "content": "b1f4d15c280e59fdb99f7626cc95a930a054431206d58847c3e035ea1209e232"
        },
        {
          "alg": "MD5",
          "content": "4b037c161b04178490d0b419c4cf11f7"
        }
      ]
    },
    {
      "bom-ref": "ed833947-850a-43c5-9438-ae8af0c55eff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libreadline.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "fae65cb41be48fac26d04260ae347cbfb5c63051"
        },
        {
          "alg": "SHA-256",
          "content": "b848d76b290ce6400e5de30a91d47744df9bcb1bb15fbc4f7c73ba744a8afa28"
        },
        {
          "alg": "MD5",
          "content": "5a82c15583df416e04508dc0343f2fe3"
        }
      ]
    },
    {
      "bom-ref": "eda458ee-7253-46a2-b7b4-8720e75ba514",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_2_11.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "31a1600db3461bde3be52eb7f43b75cc5296dbeb"
        },
        {
          "alg": "SHA-256",
          "content": "358bd8a22cf4aea8e745fae6460b8f9bf627546e6d691ee42d127ade034ccbfc"
        },
        {
          "alg": "MD5",
          "content": "d3c6bdac5dba6512d2927a5dcaa0ecac"
        }
      ]
    },
    {
      "bom-ref": "edb607c3-12e1-4a91-83f8-f92ef0423039",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ast_fwu",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ae960f421aacc3ab57ee3a03c983498d8e111482"
        },
        {
          "alg": "SHA-256",
          "content": "7e74f29cc2451efc582dc4c0795a7b8be4a75848ff2be62855bfefaf57e017b5"
        },
        {
          "alg": "MD5",
          "content": "141a9517674c2f5e89b68c213e6fe06f"
        }
      ]
    },
    {
      "bom-ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/rev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "edc05ed3-8768-4c25-b89a-f7e30ea87397",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/od",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ee0961f2-bb8c-4673-882b-26e344d58ef8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBG_LC_PLUS",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4215b8bb5d5aa360ed32e5f2afecd50353c10c72"
        },
        {
          "alg": "SHA-256",
          "content": "3967b4413d26b04b813b73f07c1090a86b7b65fabdaa98fbae9958b805992c91"
        },
        {
          "alg": "MD5",
          "content": "bc8b92fbe81a030428dd10b05a6ae2b0"
        }
      ]
    },
    {
      "bom-ref": "ee78b6c0-b3bd-42c9-91de-005cd725189e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/dictionaries.tar.gz_extract/gzip.uncompressed_extract/dictionaries/StorageController_v1.bin",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b657fd7528a7384dabe94ffc282879c6da5cf123"
        },
        {
          "alg": "SHA-256",
          "content": "d15819f20c2f641157f047c3c31a47e8691b082ca17d0351c985d758eb096878"
        },
        {
          "alg": "MD5",
          "content": "8599741315c6ff9faf5c1bcaa4974f7f"
        }
      ]
    },
    {
      "bom-ref": "ee810823-abd9-4c49-a77d-2ad1ce318ddf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcProfileProvider.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7458b381de72fa07e43df287804eabd394c3acd1"
        },
        {
          "alg": "SHA-256",
          "content": "1e88e7dcb7176fccfbe02d53e3ab78366f891cf0de75a29b624654be3ddcf108"
        },
        {
          "alg": "MD5",
          "content": "2e7dfb2f40dc6fc2c225ce087892829a"
        }
      ]
    },
    {
      "bom-ref": "ee891ef9-9717-4896-8078-2c21968ad637",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/nav_ui_x13.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ee636c75abc68b7e327c822b64c7d1e4f1a0812"
        },
        {
          "alg": "SHA-256",
          "content": "064b916f869fabd15c8cb55239ca6d2bf5be87f8d59ef307f706ca15d7ba3eff"
        },
        {
          "alg": "MD5",
          "content": "bca2f266bf8fe6b9b4c039c00f76333c"
        }
      ]
    },
    {
      "bom-ref": "eedf49ef-69d2-4b9e-938f-9ee3e7334ea0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/HostInterface.sh",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a468712472b14f293c300f2b3bb3fab0fb0170df"
        },
        {
          "alg": "SHA-256",
          "content": "4f9a462f0052e4cb99d945fbc1c929950e65e4493fdaaedc0d3f188ae850aa47"
        },
        {
          "alg": "MD5",
          "content": "8fda774a66719f7dbcd8367adc3dd5c8"
        }
      ]
    },
    {
      "bom-ref": "eee0f9f2-eae2-4661-83c4-c27cd2d8da83",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Syslog.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ecf1b25fc3012d0dfa1ac1a1b80eac0b3b0a4b00"
        },
        {
          "alg": "SHA-256",
          "content": "dcf113e1875c6caefe970552022c85a23505eec11e211e95c427ffbcda05d1b7"
        },
        {
          "alg": "MD5",
          "content": "cba50b4b29ce5e416d9b77db7f4592c0"
        }
      ]
    },
    {
      "bom-ref": "eef8e136-1eee-4e5f-bd64-07d0f8cfce0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/edit_logical_drive.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d6563fab5f9757bee5548e32793f7fb4f3587671"
        },
        {
          "alg": "SHA-256",
          "content": "39ed8eb5e5993e02848f51279caa8715d5783999f21ff42fa46a0b22a7ec4f9b"
        },
        {
          "alg": "MD5",
          "content": "ab4749ccf9f4a5d972bfd7b211fb3e84"
        }
      ]
    },
    {
      "bom-ref": "ef0fc90e-0293-4594-bcb4-f21c2f3a4269",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/logical_marvell.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "48e56c19f5baecdd5e22cf10cdf6e37dcbdddf23"
        },
        {
          "alg": "SHA-256",
          "content": "fa77e8137cc8abe2df7081f580ed544a65ac49367257cd1a088a13bcfc43bcf9"
        },
        {
          "alg": "MD5",
          "content": "26c0627fbeb9d0082c1ece794623e507"
        }
      ]
    },
    {
      "bom-ref": "ef1465e0-edd8-4b84-a30a-7cc0197d5cf7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/OemPSfactory_STD.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b65166bffe61b5e3260ab3a1b6f3a05d6ccac87d"
        },
        {
          "alg": "SHA-256",
          "content": "9ed4fc0073f37b40d88b799fdd36e50a4bb4a15263ebf6c5d7b6ba748af7be03"
        },
        {
          "alg": "MD5",
          "content": "591b418f4a46459e6c9a2b2da76bc578"
        }
      ]
    },
    {
      "bom-ref": "ef29908d-11de-47b0-a123-e3bed560a377",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ipaddr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ef60a410-0c92-4f36-94ba-6c8d65f9b6a1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcInternalProvider.so.0.0.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "193e06cd6f150a382fa4ee18092169da64280d82"
        },
        {
          "alg": "SHA-256",
          "content": "8cd4f983d78cb9b3d5ae38c729738685e960030221c60be2bc7f6c3fc0350cb2"
        },
        {
          "alg": "MD5",
          "content": "15816d6cee8e8ef0ced6ef426e13d452"
        }
      ]
    },
    {
      "bom-ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/pivot_root",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ef7021a0-9d59-4a0a-92ec-24eac3e68b59",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/snmp_config.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a24010a31e8232bc33e994aa375d157c4b0529e5"
        },
        {
          "alg": "SHA-256",
          "content": "51ad4fd13a6e37904cfcdb40306d906a95f57fc8810339463cc677168c31f76c"
        },
        {
          "alg": "MD5",
          "content": "eededd298f96985e99e591fd0083f860"
        }
      ]
    },
    {
      "bom-ref": "eff405f0-7b8a-46ef-bfcb-1a37230ba5e8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/images/showextrakeys.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3add7fa6d480cf3e791e3777410f5fac8122ba61"
        },
        {
          "alg": "SHA-256",
          "content": "fdb1a13fdfeebfe2e66882817c503fef0d36d7798d1e3b2717c882722f112172"
        },
        {
          "alg": "MD5",
          "content": "f1301a40529f5f8266f3bfffe055de49"
        }
      ]
    },
    {
      "bom-ref": "f00bfd48-734f-42a8-a475-e8d087ed3135",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/carousel_right.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "81f316d7f2e5f3c67281821864d85eaa783fa4c5"
        },
        {
          "alg": "SHA-256",
          "content": "261c0dca16cf246a4daa40747fa88e9b3e6ff12227347f679d43ca653f1d77f9"
        },
        {
          "alg": "MD5",
          "content": "04a5104bd00485f64e096c2d487abfd0"
        }
      ]
    },
    {
      "bom-ref": "f01353d5-7c14-4e5d-8281-2dba1ab56a97",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/ipcalc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f013647d-a63a-4f0e-a675-1a6425e61f15",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/busctl",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d51635b1e0997e7fea8e8af66c29af891061549e"
        },
        {
          "alg": "SHA-256",
          "content": "a7b15521f416314580afae675301ca1a33c6d676703d63ef3a3187595fd72861"
        },
        {
          "alg": "MD5",
          "content": "36b85a204e9a335b07f07c01e79489d3"
        }
      ]
    },
    {
      "bom-ref": "f01fbc87-167c-4fa5-9e62-843acc0f2ce9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/ssl/openssl.cnf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "88de0dff70b2da9086a8c5e99bc28df88825454e"
        },
        {
          "alg": "SHA-256",
          "content": "8e61193bb02b777b5d3a57f66570a18b5c78760b1ea7772ba6c1c6a3501479f2"
        },
        {
          "alg": "MD5",
          "content": "501127f7f76fffca32b670fefb4ca83e"
        }
      ]
    },
    {
      "bom-ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/deallocvt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f037e8d4-0a80-4482-bab5-d99221418aed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfcgi++.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e23ff920af42f30e4bbabdb292a51b2759553885"
        },
        {
          "alg": "SHA-256",
          "content": "b65622ddef67a12193187317c574d318ed1b793e7880ddb40dfc99ec85726ab7"
        },
        {
          "alg": "MD5",
          "content": "c60b67a5e33aab8cce10a28fb81cac3c"
        }
      ]
    },
    {
      "bom-ref": "f040b940-b2f3-446c-b788-c019340d035b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/sha3sum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f05b8a32-807e-4135-b115-7e2ecc862fff",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/loading.gif",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5647f7834f310eaf10fa1210e828ffc3a97b00e2"
        },
        {
          "alg": "SHA-256",
          "content": "c3ede61a2ec26ce0a3cf66dd91f4fe0bda64a90531e337e731100efbc2b2e1b1"
        },
        {
          "alg": "MD5",
          "content": "bd72dde32e02048026f50306cb4f7aa7"
        }
      ]
    },
    {
      "bom-ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/lpr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/arch",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f06a9ab9-ddf7-48e5-8def-5d7e286abc9f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_4_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b30ef5a1b47dfb09f45223f438cab31309d50ec0"
        },
        {
          "alg": "SHA-256",
          "content": "256f2d25bb8191d6a64f81ba8534ba7628a43c427c3b3ccf5a44380deffe637b"
        },
        {
          "alg": "MD5",
          "content": "095baffc62b720c4b519e19601dad95a"
        }
      ]
    },
    {
      "bom-ref": "f09481e2-022d-4191-ae6d-f3255e98e50f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnss_mdns4.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df9a38d1993168e89ede21a0abd31cf74f954718"
        },
        {
          "alg": "SHA-256",
          "content": "458b07fccc7ed6501c7a2554f6eefe6e394815b6221a26d799c70f0514baee0c"
        },
        {
          "alg": "MD5",
          "content": "d6064fca84c71cfd3a1ea7ba43140b24"
        }
      ]
    },
    {
      "bom-ref": "f0c2d123-c591-467e-a662-216747131d6a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstdc++.so.6",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49004bc15d6c235b175b6efeabe98d4622753b22"
        },
        {
          "alg": "SHA-256",
          "content": "4a9467ac3a877bd6a36a60f117ce25852b38739ff05137b26912dcc40e0358f8"
        },
        {
          "alg": "MD5",
          "content": "47b6a3c30ddca174e47cd0d9791d3fda"
        }
      ]
    },
    {
      "bom-ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/su",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/sleep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f0e543a3-1cdd-4e3f-962c-8b70c9c07fb2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderGz.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "187df00a5e28837d94f3750d248faa7930ed8f85"
        },
        {
          "alg": "SHA-256",
          "content": "63fd072e3c310548b79af8b45de527918107e76a5d05f21ca5075b914d643a42"
        },
        {
          "alg": "MD5",
          "content": "8d83ea6baa58afdfd3349c95691adac7"
        }
      ]
    },
    {
      "bom-ref": "f0e8199f-35ec-4db7-8d1a-9b7266b8ec94",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/MemoryPFA_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8b35964a4e3140ee5d56d843aa1001d688cacc17"
        },
        {
          "alg": "SHA-256",
          "content": "7f992ac64ade5564817a8cde76a374363b66feb1159cefdf88345c439ea74991"
        },
        {
          "alg": "MD5",
          "content": "a8f8e12170fa91c25b0f2736d8910fb7"
        }
      ]
    },
    {
      "bom-ref": "f0fb2b2a-27c7-4d61-ac34-c420d64c1a9c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/crond",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/setconsole",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f1035c27-7835-4881-ad46-fbcd259dcf36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/fw_printenv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "50683d8dba4e1b89e4f6e1b573358dce943af59c"
        },
        {
          "alg": "SHA-256",
          "content": "a07bcbdeca3bb3e7a6e1164d112f003dff9445cabf32442c7c2193e9e17bef91"
        },
        {
          "alg": "MD5",
          "content": "1a49f85bec84e5af03f40620735fff5c"
        }
      ]
    },
    {
      "bom-ref": "f10be348-72e7-4815-9e5e-f512c4667027",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/web-socket-js/README.txt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eead469ca48a3d9fca75602647f569666122e81b"
        },
        {
          "alg": "SHA-256",
          "content": "feea540e13e369f1e0b63b9d669bb8b009e06aa1dd67bcde53ff3c78243a492d"
        },
        {
          "alg": "MD5",
          "content": "5a45dcc53cb510a3d045c36254f1fccf"
        }
      ]
    },
    {
      "bom-ref": "f11000b5-870c-40e3-987d-addea146b5bf",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/maintain_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0f94320064209dfa255eaac8c44d1ffa240cdd61"
        },
        {
          "alg": "SHA-256",
          "content": "9f6076f441cccae8d7efac8fec1e3f6ca0a6fdbd05b2bbf0c33a9d48eccfe557"
        },
        {
          "alg": "MD5",
          "content": "3facdd1e908d405b30f286ab377803f0"
        }
      ]
    },
    {
      "bom-ref": "f11f4d54-d6d7-4811-b7d6-bbdb2500a7bc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/usb/udc-core.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "057519c353fd33b39906b12be1fd88c921895f89"
        },
        {
          "alg": "SHA-256",
          "content": "855ece7704c4cae7968232ce61ee8a7af3a3e37dedf1216cd0a48bc0d6c07ec2"
        },
        {
          "alg": "MD5",
          "content": "5735afc5023459ad88a0c2f2786c32da"
        }
      ]
    },
    {
      "bom-ref": "f12e496a-883a-434a-86c9-0ea7ec289ea5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libkmod.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f6f45a68931ea375908a18f457def4b0770bea50"
        },
        {
          "alg": "SHA-256",
          "content": "c7b098c5e5b8ff6cfcdca806164c1e0d292c8ccafc5cb36a355106020fa6d523"
        },
        {
          "alg": "MD5",
          "content": "be69052287f9e07633f385c59a28957f"
        }
      ]
    },
    {
      "bom-ref": "f15038d4-0bf8-4ab2-9dd0-4e92bce177b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/snmpd.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c309177234eb234e88211231ae0964f319249004"
        },
        {
          "alg": "SHA-256",
          "content": "fe83e815ec9bbc25323b6f77aad0b55387b4e093c710a61ecff3ff90208c6969"
        },
        {
          "alg": "MD5",
          "content": "0cc794470f4ac9952e7627fa3645fe62"
        }
      ]
    },
    {
      "bom-ref": "f1527c5c-71c8-4c20-8eec-b0b25c219a23",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/VirtualMediaConfig.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21839fcc277e9ae2483826a703443f5a8b5b744b"
        },
        {
          "alg": "SHA-256",
          "content": "f3c2baf65c37f2dc77d08d2ada7c573b30b31eb4ac0f45b87b159bd590b88af5"
        },
        {
          "alg": "MD5",
          "content": "8f237b62c5034178cccb585f0ba7171d"
        }
      ]
    },
    {
      "bom-ref": "f17a8851-9a1f-4422-84b0-a9e2ed0565bd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcProcessorsExtensions.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "407d17ab8236cbc9b5a8658a877e6979236436a8"
        },
        {
          "alg": "SHA-256",
          "content": "796022ad282a89490262ec9e8dce0b80c5a07b4ab914594315981534eea8402a"
        },
        {
          "alg": "MD5",
          "content": "7d37f7422ce0850c34844f668faf4dbb"
        }
      ]
    },
    {
      "bom-ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/head",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f188b0f2-ebf4-4d43-b6de-bc9aeb6045a7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcDriveExtensions.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a1c0c791644a860675859d498c1ac0b09c56dc44"
        },
        {
          "alg": "SHA-256",
          "content": "2eaf1597e043fcbb36536bff6acf58107e6756d1d9a778653e6ff65d087b032b"
        },
        {
          "alg": "MD5",
          "content": "a4680963a7a413f7c8669a8ed293925a"
        }
      ]
    },
    {
      "bom-ref": "f19db424-574e-4e8b-8cce-a752bd13c089",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/free",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f1a46a02-12bb-480f-ab78-1f8e3c5e92d8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpthread.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "915ac7e151ca64d9e4b58e55665b128cd5154b64"
        },
        {
          "alg": "SHA-256",
          "content": "d6619e6cf1e137845d8ffbdbba45ae72454a8af4f530d32d669efd9c2101d446"
        },
        {
          "alg": "MD5",
          "content": "8799d69e5c55a5c407a80a1118b62464"
        }
      ]
    },
    {
      "bom-ref": "f1afed28-5bd1-4bac-8652-7ac1079e982a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcFileRepository.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "64efa4bbb1111b4255f6b924d1ae5c549ef40fa8"
        },
        {
          "alg": "SHA-256",
          "content": "d440914639cd70b97dd11d037ef7f623252492f4efa4f9761142b9ee9b5f7e06"
        },
        {
          "alg": "MD5",
          "content": "e6201b393f6c99c6bde694a7d0220fac"
        }
      ]
    },
    {
      "bom-ref": "f1b25786-5164-472b-9bf2-cd0d8de34e57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcHttpAdapter.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "16f0f7ddeb0d3565eb00ba9f7c78a16b909d8f2e"
        },
        {
          "alg": "SHA-256",
          "content": "b419d08ef6de4c00780de544d283e3f0935547529643fb24b153e082e52ace06"
        },
        {
          "alg": "MD5",
          "content": "8bc2a1bb518674242859c6078ce6e545"
        }
      ]
    },
    {
      "bom-ref": "f1c15227-653c-4937-bc2a-289b0bab098c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/uisopout.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "4d9e273b0aa454c979aee0c26a76349a6be1bdfa"
        },
        {
          "alg": "SHA-256",
          "content": "021dd762d9a791acd1b960f96dec0bec61f8095c9c8df29f3cf69d7260cb97d2"
        },
        {
          "alg": "MD5",
          "content": "f0c4dbd30a380972d13d847fbbf6dd4a"
        }
      ]
    },
    {
      "bom-ref": "f1ff8e7f-990e-4152-aa6e-5f0653e571df",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ntpd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f2123661-ca8e-4252-aa09-7fae2f65cb30",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Peci.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83d74f16c0174b1dfdff96af78b396b1135b44cc"
        },
        {
          "alg": "SHA-256",
          "content": "49083147e1a28821cd25d4917102df5960156aefdf1f1a86e98b946985e0192e"
        },
        {
          "alg": "MD5",
          "content": "57bfb326baf74c01f8a4fc46531e3a45"
        }
      ]
    },
    {
      "bom-ref": "f214afe8-2046-4e03-a0aa-605a2ac614b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libfdisk.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8d82d57a3eba6800a248a928572145f40d24ee25"
        },
        {
          "alg": "SHA-256",
          "content": "914424526ca34a84af8e7bb31fff0b627e96b467fc1d42760abf2f6e650c010e"
        },
        {
          "alg": "MD5",
          "content": "a3a004513f3fb7f45514799e1bd0ec06"
        }
      ]
    },
    {
      "bom-ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/ubidetach",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f2200fac-ba00-494a-ae67-7a3b2dc9a131",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsystemd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7f4b015be10d7c3db1fea9d371d135321e54c20e"
        },
        {
          "alg": "SHA-256",
          "content": "58f4e0076e815e9a418585a8d325d549beafbc07d15dd4fa845046ee477e1d4b"
        },
        {
          "alg": "MD5",
          "content": "5199c5203fbbd52dce69c6cca3d6b858"
        }
      ]
    },
    {
      "bom-ref": "f220c22c-4154-43f5-bd8b-3260208fc3e3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/passwd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "21125d8b73635ec547178c711e3de0a546ea21f3"
        },
        {
          "alg": "SHA-256",
          "content": "80c176a942b7b7249b5196d75b17b0d2ea43134eddc9b4a0f6aee2d686d0b13c"
        },
        {
          "alg": "MD5",
          "content": "2c20e81869b8de2cfb9f48a0966382d3"
        }
      ]
    },
    {
      "bom-ref": "f2520c96-9add-4fa5-bc7a-1ffae4cc770b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/defaults/OemPSfactory_SmartCooling.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d88810e8a6e0b2b077f5c2968157b8d6748c4f48"
        },
        {
          "alg": "SHA-256",
          "content": "5ba8e7f8b31247e9e716833e1971b247d1a5c9338d6cce138973371b9d169181"
        },
        {
          "alg": "MD5",
          "content": "b2311151ff99bbb7266b511d7f62fb11"
        }
      ]
    },
    {
      "bom-ref": "f2634d82-a5f5-4686-b213-bb4efa7a241d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsysfs.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7acb9e0975bc5c9d23451a82097cf6ba06707781"
        },
        {
          "alg": "SHA-256",
          "content": "861502a695210d94f17c3851a82a1519834a251d112f72f23a32f57a7d2408b8"
        },
        {
          "alg": "MD5",
          "content": "d5eefa4af0589c444d6fd4c934ca0b26"
        }
      ]
    },
    {
      "bom-ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dbus-daemon",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2f3830af639ab19daf87bf127d342a3bb0229f9a"
        },
        {
          "alg": "SHA-256",
          "content": "ffefe000eabd6b3f5d9be97024891302318b2236b122b676d99d58da54124b17"
        },
        {
          "alg": "MD5",
          "content": "9ece4a0ce5bdc14b71a56254afae0527"
        }
      ]
    },
    {
      "bom-ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libisccfg-9.18.24.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "61beeae365bec72cece98fd7898f14a00c2a00a2"
        },
        {
          "alg": "SHA-256",
          "content": "04cb93b4bcf4e8b0bbd59a1af75bacead3298d97accdf6f1ac5e11d94ccbadcf"
        },
        {
          "alg": "MD5",
          "content": "b04a06b8a5f0b90ec69cb82e51c7e2ca"
        }
      ]
    },
    {
      "bom-ref": "f2742f89-e25f-478a-89ae-c1a7963c9eea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libuuid.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a385445a0399dea518d822f9cf73f27594710e73"
        },
        {
          "alg": "SHA-256",
          "content": "9b227f70bfcb37cb7a85169fa5f34c3b3fd8f32ab5f325207658c4e228b2fb95"
        },
        {
          "alg": "MD5",
          "content": "ef1df35480bae12a18508e9942ad7ba2"
        }
      ]
    },
    {
      "bom-ref": "f275c09b-0429-4a10-a2ce-808e681b1460",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_3_6.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e9321a78a33a0f3cbf7e4985461e26dd7d1f3d83"
        },
        {
          "alg": "SHA-256",
          "content": "0d8d75627c6b157df256739b4efdb0dcae7210d241dd02d0f28f59601a5c86bc"
        },
        {
          "alg": "MD5",
          "content": "9f1977b0f2bd28fdd1c31d4e6484be1d"
        }
      ]
    },
    {
      "bom-ref": "f28c062e-5123-4412-a4d2-d68466eacdee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dnsserver_updater",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a28c33f78fbd29b20135a6a9c5753fa659554cc6"
        },
        {
          "alg": "SHA-256",
          "content": "b4bc9ec66a8198ad818df58cb0c530dc72aa4e44ffccbe14ea430ef82f0c5742"
        },
        {
          "alg": "MD5",
          "content": "1914ff9ca210b36122346b7b614d4f3f"
        }
      ]
    },
    {
      "bom-ref": "f2a00388-01ec-4f90-a2cb-cfe13ae755d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/var/lib/sfcb/stage/regs/IPMI_PowerManagementService.reg",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a3eb05543f45cc039dc89a52f3fe7eac51cbfb8f"
        },
        {
          "alg": "SHA-256",
          "content": "0b70299a0cc01fd34f1282972117be2087cd4d48743d92ab4ae99ae038db650f"
        },
        {
          "alg": "MD5",
          "content": "8e21c767530c06eeffe86768f073d674"
        }
      ]
    },
    {
      "bom-ref": "f2d1d458-9f15-451c-935c-7733a08bb558",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/WebUI.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a3441c9e61b43c959ec9a26d9e7a652a82b1a623"
        },
        {
          "alg": "SHA-256",
          "content": "de9c030fffd54a3ef894e15b60a5700235b68186ea57eb09bff8c50984b73ce5"
        },
        {
          "alg": "MD5",
          "content": "ccf671ede1310aca35eecde1bf47504d"
        }
      ]
    },
    {
      "bom-ref": "f2d9026d-2ff1-4f58-a679-6e973a28bd8a",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libradius_client.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d27077214cc466d2ba7904aa8531c7410a23a19"
        },
        {
          "alg": "SHA-256",
          "content": "ef400862f627b1b6d05d4383f83caed8aa1296f9f8269a91cf444463c7fbbd6f"
        },
        {
          "alg": "MD5",
          "content": "1c04f10c2552c473e4949a0feb9aee9b"
        }
      ]
    },
    {
      "bom-ref": "f8a3f0cb-0837-4e28-ab7f-676f57de3f93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcEthernetInterfaceExtensions.v1_0_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "13b135f1324b5a12c1d5996138d47f12ce8d9436"
        },
        {
          "alg": "SHA-256",
          "content": "31a2dc6c8d59c0b2f9381c7aec4d33505554643b73a17526ffc91659fd9a895b"
        },
        {
          "alg": "MD5",
          "content": "7598729c9c71ff56895a7c2ffb3bcf6a"
        }
      ]
    },
    {
      "bom-ref": "f8d43e3e-bb50-42b5-8380-49f7af08111d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14DBG_MAP",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "58e18781f337a578fd10513751a21e80a5012d77"
        },
        {
          "alg": "SHA-256",
          "content": "d82c18a0344546060f4a94fa16ef5f0977bf8ab74a0b0f24df130db66286885b"
        },
        {
          "alg": "MD5",
          "content": "539051d6081c25a7d56394ae9643f2a6"
        }
      ]
    },
    {
      "bom-ref": "f8e7cbc7-57e6-4b49-b076-192b66f78719",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/dbus-1/session.conf",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5c5593f2393d535c2bea7feb3af805be7bc33587"
        },
        {
          "alg": "SHA-256",
          "content": "2218b9313dc6d2e07d85751f318124cc5138787358ae1039703321cf6b35602a"
        },
        {
          "alg": "MD5",
          "content": "cc8ea0872ace9945b8fcfc232c316be2"
        }
      ]
    },
    {
      "bom-ref": "f905ccd3-5b67-417d-b0ff-9ac6f75cd3f5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X14SBM_TF",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "268ce45349e2fe26eea10d853d0c53ccc08568bf"
        },
        {
          "alg": "SHA-256",
          "content": "0a49dc86a914538a06e98eb5968e3013010e44ecfd8c7055f06e867e716f2f9e"
        },
        {
          "alg": "MD5",
          "content": "b4094fd63df1ad2ef11a39b6db344f29"
        }
      ]
    },
    {
      "bom-ref": "f909c3d3-ccce-4797-812f-ba404283a970",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/NmTriggerCollection.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "66d33c216bfc5ae87f39dc1bffe0c37b86883a88"
        },
        {
          "alg": "SHA-256",
          "content": "d28be10ce5cd1d6fca7eb7758049da2913f32a3751615e8bc9e596e9ab77bbd2"
        },
        {
          "alg": "MD5",
          "content": "54494a426c04acbdfcea743a98ba738a"
        }
      ]
    },
    {
      "bom-ref": "f9624623-ac5f-45b5-84ef-d587853e2a1e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libpamc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "ad4352eb29219fedb534c5879fc90ae24f9bc2cb"
        },
        {
          "alg": "SHA-256",
          "content": "0165cc729d0cb47999017bb17131920ee3c0f8f167a23015360b382ecac2d53d"
        },
        {
          "alg": "MD5",
          "content": "ff01a26dafa4053f19d90e5af314abb6"
        }
      ]
    },
    {
      "bom-ref": "f97470c7-5eef-45d7-8344-dd58f890a517",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/watchdog",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f983ec4c-3c62-4ff8-9c95-c33d236b1f4b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmptrapd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6dfd0fa8c33f4dc4ecc941a315e7171e597d8829"
        },
        {
          "alg": "SHA-256",
          "content": "148329f9d341476e2ba4e1e4b961958d75c91e00b0f1cf72cf714fc990a57104"
        },
        {
          "alg": "MD5",
          "content": "e8cf3f5545c33649ff13723e0fd0facc"
        }
      ]
    },
    {
      "bom-ref": "f98fcebd-3334-4f8e-a6fd-e2dbea945594",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/dd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "f99632d8-27ad-4b8c-84e8-d165098c4018",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libtinfo.so.5",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6d28156aa6dcf0aa29748fb825c7c7f39381e484"
        },
        {
          "alg": "SHA-256",
          "content": "70c9700091303f9d1e359b0aa9b807af79463e1252d72ace63747d8073a5635c"
        },
        {
          "alg": "MD5",
          "content": "360d82c0567c6a41a30706ac270dedca"
        }
      ]
    },
    {
      "bom-ref": "f99749b0-7588-45a8-8b83-29b636561732",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/libexec/sshd-session",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d505327af8abb6ad1172a1e9546249455926e5f9"
        },
        {
          "alg": "SHA-256",
          "content": "986f257ae8e26a29be4e888c9ea639a7cf39fee2c3e724f675efeacab188ad71"
        },
        {
          "alg": "MD5",
          "content": "c52a0b91a4714f79ebe51cda54121450"
        }
      ]
    },
    {
      "bom-ref": "f9ced76c-8ca6-410b-861a-5b51838e0ac2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/linux64",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fa0f4ced-84ee-4635-b674-6f7b705ec307",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcUtil.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "bd2bad991e3ec21e29d761cff15df94152a8a82f"
        },
        {
          "alg": "SHA-256",
          "content": "7d4367bec76360c7db93d6eb01bba49547ea380107f6306e961ff8e4deceffd3"
        },
        {
          "alg": "MD5",
          "content": "3699b0eb231fe372d9776ca25587e7dd"
        }
      ]
    },
    {
      "bom-ref": "fa285da9-a1f5-474d-8402-bfba8296f361",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/setfattr",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fa3126bc-66bf-4797-8392-7d8f5999568e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/mntc_trouble_shooting.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "37661c0d2f9a2a7f48bd61e69ffdedcdfefef4d1"
        },
        {
          "alg": "SHA-256",
          "content": "fdeaedfc6619317b70e3bb1f9aff732de2f3f7ef1ce4b13dc7288afff72fb168"
        },
        {
          "alg": "MD5",
          "content": "170b91829f58894e528c41f08c4d999a"
        }
      ]
    },
    {
      "bom-ref": "fa51c06d-6057-485e-aeb0-1984ba2f3899",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcNode_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "84b10499f6d9f271dce8da63ed55be3cc95c07b7"
        },
        {
          "alg": "SHA-256",
          "content": "d10b09f1192edec2638f14cf9b0327aef4dcec74b76e99e437d1d3f6884bfc5f"
        },
        {
          "alg": "MD5",
          "content": "f8d27029fb779baabac028377ea68e5c"
        }
      ]
    },
    {
      "bom-ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unix2dos",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fa6150a3-8652-45cf-b365-017c18697085",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_14_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c0341271c5411b8c47f58f2411a85668fedd6e49"
        },
        {
          "alg": "SHA-256",
          "content": "4f24f9a655aac8dc494d19d3bf428cff48995226c93add81a0b59c0dff4b178b"
        },
        {
          "alg": "MD5",
          "content": "24173d094a3f68708ab2aa80b6af6710"
        }
      ]
    },
    {
      "bom-ref": "fa795f5e-cf91-4e74-b51c-14cec92cd3e4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcClientXML.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9d8ad38f778259f9b926210f752e6d64bc567971"
        },
        {
          "alg": "SHA-256",
          "content": "5c45ae6f06e8404983f059da2d7066a4a940f58b47c2b441bbc2b5dcc4444806"
        },
        {
          "alg": "MD5",
          "content": "78a89895bc64aff235f1c709d2b686ef"
        }
      ]
    },
    {
      "bom-ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/syslogd",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fa832478-dcb5-4f4d-ae85-00e1d6dbc5a0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnsl.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e997ef2fe3e70cf09bff164b27f77e85bdf494fa"
        },
        {
          "alg": "SHA-256",
          "content": "83be203ba1d903ea64595e13cb1a2c13deedc6e05927507d1c008543df4710f4"
        },
        {
          "alg": "MD5",
          "content": "ef7db7887916338673ad165d85478bdc"
        }
      ]
    },
    {
      "bom-ref": "fa8a256e-bd9c-4e7b-8a9f-575a243a7cb2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcProfileProvider.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7458b381de72fa07e43df287804eabd394c3acd1"
        },
        {
          "alg": "SHA-256",
          "content": "1e88e7dcb7176fccfbe02d53e3ab78366f891cf0de75a29b624654be3ddcf108"
        },
        {
          "alg": "MD5",
          "content": "2e7dfb2f40dc6fc2c225ce087892829a"
        }
      ]
    },
    {
      "bom-ref": "faae45c9-95bc-4a89-b30a-5efd7faf07c0",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_12_1.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c6dd52c04276dd412994a4dafd57df04c9aef245"
        },
        {
          "alg": "SHA-256",
          "content": "f81355a9b77787321589c34324ffe0f8b436209d8b7692c40bca9662795165f1"
        },
        {
          "alg": "MD5",
          "content": "a11443db065cd89d63320c2490557230"
        }
      ]
    },
    {
      "bom-ref": "fac1a1a4-90cc-40ab-bcaf-a58aabd1888c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcSoftwareInventoryExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3d05d488ab7bcb38dc9a644d765881af1a4b2c08"
        },
        {
          "alg": "SHA-256",
          "content": "88c459da684888388dca4391017004bd4cfac1c99c5f9ba83af59718f80fa5f8"
        },
        {
          "alg": "MD5",
          "content": "71908b49a6cedbe4503d8e1ee9e646d3"
        }
      ]
    },
    {
      "bom-ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/dumpleases",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fadf2c90-9c70-4dc6-9ef6-5f294493fc12",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/local/httpd/dhparams.pem",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a7e31ed77353028d7bb018b3d4c1bd2e47e5aa52"
        },
        {
          "alg": "SHA-256",
          "content": "c79f54bce6f80139c76e565366b3d852c40380caac8033b9fa239ff651dd604b"
        },
        {
          "alg": "MD5",
          "content": "c1cf1b2a08780e9a30362b67f9d5665d"
        }
      ]
    },
    {
      "bom-ref": "faec9220-1d68-456b-b86f-333a6b2203ea",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamSensorsTemp.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "3b8450c56b9e03645b85b865eac00776bc262754"
        },
        {
          "alg": "SHA-256",
          "content": "3e5f1c41d65444d4379ffd7fc72fb0e1143a315904b44a42fa9cdceff8d50a94"
        },
        {
          "alg": "MD5",
          "content": "60ea1108f3492a91bc7cdccbaac8ba9e"
        }
      ]
    },
    {
      "bom-ref": "fafda255-4b6d-41b0-8605-4f9ad76a37c5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamStatus.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6de1c280607f2993271c2cadc6a2265bfbeb2814"
        },
        {
          "alg": "SHA-256",
          "content": "47f291d49ad727985ce0cce708595067cc4ce3b9f10036fd1d35b7ad642044e9"
        },
        {
          "alg": "MD5",
          "content": "2c347797769af719f4eef5e083e925c1"
        }
      ]
    },
    {
      "bom-ref": "fb021257-91c0-4021-a15f-a52a713b51f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/auth_grey.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "306c42a7ac4995576ddef028e3e756312f424e40"
        },
        {
          "alg": "SHA-256",
          "content": "fc51d69f63ec4a3b8f2033ee2a9442b22a1dfc4818de3a1640cc848ca030205e"
        },
        {
          "alg": "MD5",
          "content": "4055d20013e796b9403d5eeb459766db"
        }
      ]
    },
    {
      "bom-ref": "fb2aa28f-68f5-4b1f-9f00-95d2117b4237",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/switch_root",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fb6618c8-945e-4d41-b9d6-c7ed0a37d6fb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/help_hotKey.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e2bebbd3fdb74fbfb06dd1fb7b56bd67f836822b"
        },
        {
          "alg": "SHA-256",
          "content": "14fbf7da6ed7faa4f7f6bb9b324fb3822c1d08cf9b892bbdeaccc7bc34a0a048"
        },
        {
          "alg": "MD5",
          "content": "eff798cbd31bbb56bdca4d22ecb087e5"
        }
      ]
    },
    {
      "bom-ref": "fba2849e-567f-4d45-80d5-d1a8717dbdee",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamInfo.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "01f1bd1a94e9da8a375853fd3c4211a0b3ce7623"
        },
        {
          "alg": "SHA-256",
          "content": "89e52d449710271d1b39c5179d881d78492cad4d226d871c410ff8b8f6c67dd8"
        },
        {
          "alg": "MD5",
          "content": "f349f0d2d7cc1c29667a5944725f1b62"
        }
      ]
    },
    {
      "bom-ref": "fbae06bc-3ad2-4986-b609-b6d907b8d436",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/ikvm/keyboard.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e24d9880da44dcf25ca4171ce67b2ccb128f9ccf"
        },
        {
          "alg": "SHA-256",
          "content": "d09896864e174c322fddce5c36809d85db9fc8ece388da245c0776813f31a994"
        },
        {
          "alg": "MD5",
          "content": "d3db232bd4643af0c5a72abae1b8ff29"
        }
      ]
    },
    {
      "bom-ref": "fbb4115c-0c4b-4c27-a136-05a26d3d0d17",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SmcPowerExtensions_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1692f988fddfe42602eeb2c74aeb27345d8a44d1"
        },
        {
          "alg": "SHA-256",
          "content": "77ba60c309c93c3d8d35ac37a571394da202aedf796e43436d2e8c686a6bcb67"
        },
        {
          "alg": "MD5",
          "content": "632d35b25e49de2c21cb3f4bb979cbe9"
        }
      ]
    },
    {
      "bom-ref": "fbcf2dcb-cc9e-4be3-b926-99392656106c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/debugBMC.pbk256",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f57f00220c5fec5965c6dc26e409c5e031332f92"
        },
        {
          "alg": "SHA-256",
          "content": "b2ab8cd2b8ce54c42534d724e6c19f13765aa3af44a7fac6a1a55e960a2f747a"
        },
        {
          "alg": "MD5",
          "content": "ddda28c0434374dbf6b1425f126f63ad"
        }
      ]
    },
    {
      "bom-ref": "fbd556b9-af5e-4271-9152-89429a649412",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/LDAP.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "eebcf16613b083c021e764d557e320f69f575375"
        },
        {
          "alg": "SHA-256",
          "content": "bd3c1f5cb97c9705d8fb0a3e82ef74e6c5f5af4f6a2b46cf9b3156d400d8a8c7"
        },
        {
          "alg": "MD5",
          "content": "523881bee3b4034359469b6bd479af5e"
        }
      ]
    },
    {
      "bom-ref": "fbe6bd2a-cf0d-42d2-8054-d48d0a2b4b8e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.H14DSG_OM_4U",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59d5888eb98a36350a1cc5b7be9ddb6b3ba7761f"
        },
        {
          "alg": "SHA-256",
          "content": "2a98f7cdd4d1525fa5207843ca06daf35d939f9fef6a2bc11f76c46f426cb2c8"
        },
        {
          "alg": "MD5",
          "content": "ac30113962d213aaa05d469cf965ae7c"
        }
      ]
    },
    {
      "bom-ref": "fbfcb509-e189-4822-a535-57f4d26a5224",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/cksum",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fc0a2cf1-270c-4921-9f9c-a6baeb1c727f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unzip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/beep",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fc138016-64fc-48b1-8d7a-874b986b1264",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_1_18.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b7afabe178140cf13851eddeace14c9b7bb9411d"
        },
        {
          "alg": "SHA-256",
          "content": "537085c87641ad36e3a23ca5dbba3d11867a67a87420ee1dec2df6dedaeb5588"
        },
        {
          "alg": "MD5",
          "content": "947654b058e699e15547a3ecfc1b90b7"
        }
      ]
    },
    {
      "bom-ref": "fc40d541-62e2-4f3e-b9b7-6c491d1c02f4",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/systemd/system/dbus.socket",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f9e472e82994fb87896d6eaffc2492cd440b7ecc"
        },
        {
          "alg": "SHA-256",
          "content": "e05359bbdc083b8db2b49542b26429166b5e13367a63668a4e8ff8a1b496f7ae"
        },
        {
          "alg": "MD5",
          "content": "62f04719035a96fab36b5d7a7b00446b"
        }
      ]
    },
    {
      "bom-ref": "fc81f3cc-8d05-4502-85ae-d01bbc5d5750",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libstdc++.so.6.0.30",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "49004bc15d6c235b175b6efeabe98d4622753b22"
        },
        {
          "alg": "SHA-256",
          "content": "4a9467ac3a877bd6a36a60f117ce25852b38739ff05137b26912dcc40e0358f8"
        },
        {
          "alg": "MD5",
          "content": "47b6a3c30ddca174e47cd0d9791d3fda"
        }
      ]
    },
    {
      "bom-ref": "fc881ade-db90-4a4c-8bf8-5246f25671d2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libext2fs.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6f633db55bab7e9346d6f2f7d3595af7af624527"
        },
        {
          "alg": "SHA-256",
          "content": "8c827d1ecb848098501ede3dba670f9eebf8f1988653f423fa1730bac51757db"
        },
        {
          "alg": "MD5",
          "content": "7c2f8715505b6aa46bd929243d43ee4c"
        }
      ]
    },
    {
      "bom-ref": "fca4b817-6287-414e-aad6-686dd471efb5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/setpriv",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fcb88f07-9bc7-4d37-9969-64f1ced5cb46",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsdbusplus.so.1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "99f3636ad63abeb7c24ee3add86328dd261b04c5"
        },
        {
          "alg": "SHA-256",
          "content": "3d3e729cb8f91041aaa3827a50531afd5f116819c75a604ac9799e0cb9d210d1"
        },
        {
          "alg": "MD5",
          "content": "a1b09526f50bd2dfb0380426d832cc0a"
        }
      ]
    },
    {
      "bom-ref": "fcc10cd2-8065-45e1-9758-ffbb0aff4781",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/slattach",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fcd8862b-8829-4a09-8b4e-7a42681995b5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/menu_open_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "0b67a2327aa6ab9f50a1f96bf9229f059b18415e"
        },
        {
          "alg": "SHA-256",
          "content": "322584fc98c4367687b106f4436445be3383c615ab47ea2f7d4f838bdc646f0b"
        },
        {
          "alg": "MD5",
          "content": "b4de9b6962cd7a4c50c438a8ca17a115"
        }
      ]
    },
    {
      "bom-ref": "fcdb897b-709f-4712-97f2-1eef477aa84c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/dhcprelay",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fcdc8520-6cf3-49a0-8a22-5d6be522bd57",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/bzcat",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fd192683-2269-46fd-9084-b347af95ce6d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libcimcclient.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "97c9839af0e3f24b87bd275ecba935093ee188b0"
        },
        {
          "alg": "SHA-256",
          "content": "682f65552ec84ff84d3cc9667ccfa52712b40b711d4a65937e5c34e3e4b00f76"
        },
        {
          "alg": "MD5",
          "content": "8fac9537ef369e82d113a8c0a0e9a94a"
        }
      ]
    },
    {
      "bom-ref": "fd390e27-b595-4d6d-94d6-8048270fb10e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/cgi/rakp_ctrl.cgi",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "59830062490dbc1fa37535a2ed805e125d2a5db4"
        },
        {
          "alg": "SHA-256",
          "content": "8f5a884196284986946f5abd075fa312457f7d53fa375ca5ae53aa892c3cc44e"
        },
        {
          "alg": "MD5",
          "content": "3bef49aa5ed9fcc859c828c8282e168f"
        }
      ]
    },
    {
      "bom-ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/getopt",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/sbin/partprobe",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fd8c8997-f8d4-4d92-b5e0-94a93c1ce2cd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/poweroff",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fdb61e77-94b1-4e36-bc43-8785aa24031b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/libtirpc.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "83e14166b7c5b716ee6475d17a5eafb47b2b32b5"
        },
        {
          "alg": "SHA-256",
          "content": "d32cc17d6bfd8be45f5eb07a01ca9d839350927f254cad04891f344ab735f31b"
        },
        {
          "alg": "MD5",
          "content": "2e6133cfef677681c4fc9e3792e173ea"
        }
      ]
    },
    {
      "bom-ref": "fdcae03b-800b-458e-b380-cafa3ab8fd4d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libboost_random.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "2b10500da2dbd3dff7290e17766db58b9466a02d"
        },
        {
          "alg": "SHA-256",
          "content": "83151a8e89bdcf402e56659ea468c314eceb5a1ae61ae54d7233ac19544f6ad9"
        },
        {
          "alg": "MD5",
          "content": "2ad8ce483050cbc070a18805a0306e0a"
        }
      ]
    },
    {
      "bom-ref": "fdceca69-5cb8-45e6-8944-d9a3fee93acd",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libk5crypto.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "03f4a1baf19a790665a56a5c3f632731f2e9ef27"
        },
        {
          "alg": "SHA-256",
          "content": "1ea442a82eb199e83be393e7e45baf0502804d21bf88583fcbbb4046b4cfb253"
        },
        {
          "alg": "MD5",
          "content": "f471a8188dfced52b6aca88c5b9c903a"
        }
      ]
    },
    {
      "bom-ref": "fde3c1f0-fa5e-4627-8810-24af9a641587",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/OemDumpService.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7c5e50ff3a3933c9e195a44f13fcec0a278bd9c8"
        },
        {
          "alg": "SHA-256",
          "content": "b53609fc6c02e73c5413c2e80ca16fb25c0f62e63fd2491f0156f524b1f6f79a"
        },
        {
          "alg": "MD5",
          "content": "f0db6205b5867419ef2e5d1d2ace7aca"
        }
      ]
    },
    {
      "bom-ref": "fdf3f8c0-61dc-4e17-8594-9aeded567749",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcIndCIMXMLHandler.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cb0840e5388a9b8292e6ac8fd6a1e0d7a48c46c8"
        },
        {
          "alg": "SHA-256",
          "content": "e9c7a8e315c20e88884ec2ec66711efab8b9127b5c27e318f9598529adab103c"
        },
        {
          "alg": "MD5",
          "content": "b8e2e3615f2eb3ca07ea1f433cf25678"
        }
      ]
    },
    {
      "bom-ref": "fe25ab73-a0fa-4f07-af4e-449d93f8a8c3",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/js/html5gallery/skins/darkness/pause.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "a421938b16c35261393c20d12723da11f26ab236"
        },
        {
          "alg": "SHA-256",
          "content": "5c6bcd67c776161e107a7aa42a3964c119f27354e6e873a396994803448ed67e"
        },
        {
          "alg": "MD5",
          "content": "bee836a64a65eefa80655bf93a6e279f"
        }
      ]
    },
    {
      "bom-ref": "fe272191-2260-493f-b90e-74a7779abe78",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_account_overview.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b2e2c76c7372ae50d37790728b78ce5f02451f79"
        },
        {
          "alg": "SHA-256",
          "content": "30d5d50d392f71227dbcb9deff73185d5a39f55094046f481d0fe603f627115c"
        },
        {
          "alg": "MD5",
          "content": "61d44e0193bc1ae969d91f444f664283"
        }
      ]
    },
    {
      "bom-ref": "fe2fb3de-e044-4ea4-be2a-f09a24527f9f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/freeramdisk",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fe3af555-f068-4382-9681-7274e11f3bc2",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/sfcb/libsfcClassProviderGz.so.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "187df00a5e28837d94f3750d248faa7930ed8f85"
        },
        {
          "alg": "SHA-256",
          "content": "63fd072e3c310548b79af8b45de527918107e76a5d05f21ca5075b914d643a42"
        },
        {
          "alg": "MD5",
          "content": "8d83ea6baa58afdfd3349c95691adac7"
        }
      ]
    },
    {
      "bom-ref": "fe54000d-3af7-4475-901a-9cdb0402cdc9",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libkdb5.so.10.0",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "adfd60fecd3221a987ff21090e377ec40f929d56"
        },
        {
          "alg": "SHA-256",
          "content": "4ecdceb0baf3964c1941fab95f45fe3c2697d2bba9af30a2fcd3732adad68e33"
        },
        {
          "alg": "MD5",
          "content": "869143339ba07ddeaa68b2a3a69e9cdc"
        }
      ]
    },
    {
      "bom-ref": "fe68439f-7461-455d-9231-2d080f834b36",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/blockdev",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fe7d0d87-b9c7-441d-970a-f12c1ebf20cb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/liblinux_x86__V1.0.5.jar.pack.gz_extract/gzip.uncompressed",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "410e3df441c3ed4e466ab25043811fc65b11a6e2"
        },
        {
          "alg": "SHA-256",
          "content": "27948a4b459411c04eda32a57051387042c5d23548b2b7ec9e9c24c77a42286f"
        },
        {
          "alg": "MD5",
          "content": "93c97e3c6f5c1818ab7e73d11b9df502"
        }
      ]
    },
    {
      "bom-ref": "fe94b260-062a-4be2-9033-816bf5fb0a27",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Resource.v1_11_2.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6e81b77a6caeb03c1e9fed267109e7ac56224aae"
        },
        {
          "alg": "SHA-256",
          "content": "8ef0d80ebc3ad4f48bad40a6d3efaae9425c2fc01bbd3f0fad43f45959fbded1"
        },
        {
          "alg": "MD5",
          "content": "fe24ba8162bee808e12263bb0593cef3"
        }
      ]
    },
    {
      "bom-ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/modprobe",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fea50021-dbdb-436e-bfc5-b608f1ac4c49",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/page/config_users.www",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cd7e9b68bd978347281ec811c047bb0052e5d838"
        },
        {
          "alg": "SHA-256",
          "content": "7676c8bfbbb18a3a5aadff8bf39d76d70498f64782abdf98ac1e6ecceefa0513"
        },
        {
          "alg": "MD5",
          "content": "768f6fde913ac10d65335191875a60df"
        }
      ]
    },
    {
      "bom-ref": "fea92ebd-c4f1-4c77-9201-8a2f39354c0e",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/lib/sasl2/libotp.so.3",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "b23a5b832c38984bbc76bdaa1483047f3eab1bdf"
        },
        {
          "alg": "SHA-256",
          "content": "7333c376e846c9199905c87ac6b73d9895165b61b3de6250109e757e67affaf1"
        },
        {
          "alg": "MD5",
          "content": "9233b1234133ddf29bcb35634e47765e"
        }
      ]
    },
    {
      "bom-ref": "feb96516-1124-4c72-b753-b11df12266db",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/ManagerConfig_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "54ad2d9710211d3ea252aae4d7ecde3ef62e3a7f"
        },
        {
          "alg": "SHA-256",
          "content": "2ccd9b58917f904890550115410604dc1acb65a5dd42f869331c7869d15ad043"
        },
        {
          "alg": "MD5",
          "content": "161a9fe7160c2e462b72b5b31c5b1815"
        }
      ]
    },
    {
      "bom-ref": "febace7b-79f8-49d7-a5c3-79a7dd784410",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcNode.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ec4b81efc092547abe806276f9440b04050ba2d"
        },
        {
          "alg": "SHA-256",
          "content": "c9cddfb230281b188553cfd973764dd724288e6e833aa26e8e7e80dae892ad6d"
        },
        {
          "alg": "MD5",
          "content": "e09ed532cce383c1924e93000308051d"
        }
      ]
    },
    {
      "bom-ref": "fede6f49-724e-4f38-a53d-cabbe264adf1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/reboot",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fee45f6e-8f30-4dc2-b0c0-282b38b59398",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/init.d/optee1",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "df181db87d7b3aa9b447d12fa08ace2732407520"
        },
        {
          "alg": "SHA-256",
          "content": "01bcd16c660025ca25715ba14382f295a84a6e524b52ad9b326cf7d0bb0a9b15"
        },
        {
          "alg": "MD5",
          "content": "9fb293ec12006f9353669dbde3369285"
        }
      ]
    },
    {
      "bom-ref": "ff148b23-be82-4b1e-b8af-fe0cb57df377",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/sbin/ip6tables-save",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "8c80fbfe769bf9a0e752beca6781dee7567fbfd3"
        },
        {
          "alg": "SHA-256",
          "content": "20c29c4cadac221e36ed5c096830bbeb1239c057d83ac8b8b13f2237b4b4b6a5"
        },
        {
          "alg": "MD5",
          "content": "743ebcda1af35ce864f0cc8c058f3350"
        }
      ]
    },
    {
      "bom-ref": "ff208c77-3ea6-46fc-a085-242e98604c3b",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/remote_click.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "9b8a7fec1835ba2fe3037a3c5b80deb1befb69d0"
        },
        {
          "alg": "SHA-256",
          "content": "9ca7021a71beea2fb952075d4182b18ca36af54bdc8862d4e0fd4510846bc040"
        },
        {
          "alg": "MD5",
          "content": "1fb75d55d0ff93401c7ed5ba9cb6a3bd"
        }
      ]
    },
    {
      "bom-ref": "ff33b7c9-d97c-49ee-8a55-431474e26472",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/nproc",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/uuencode",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ff3b6483-f8e6-47b7-9474-6a24445f59ed",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libnetsnmptrapd.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "6dfd0fa8c33f4dc4ecc941a315e7171e597d8829"
        },
        {
          "alg": "SHA-256",
          "content": "148329f9d341476e2ba4e1e4b961958d75c91e00b0f1cf72cf714fc990a57104"
        },
        {
          "alg": "MD5",
          "content": "e8cf3f5545c33649ff13723e0fd0facc"
        }
      ]
    },
    {
      "bom-ref": "ff40d858-0c84-4cc6-83ca-2968fe17f2f7",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsysfs.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "7acb9e0975bc5c9d23451a82097cf6ba06707781"
        },
        {
          "alg": "SHA-256",
          "content": "861502a695210d94f17c3851a82a1519834a251d112f72f23a32f57a7d2408b8"
        },
        {
          "alg": "MD5",
          "content": "d5eefa4af0589c444d6fd4c934ca0b26"
        }
      ]
    },
    {
      "bom-ref": "ff411469-d04c-4300-88e7-692680278435",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/unzip",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ff45a565-b989-41c9-ba42-88ec32386aeb",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/module/storage.ko",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "73b84b29f83a55c765f4ef62431df7a840aa569d"
        },
        {
          "alg": "SHA-256",
          "content": "c6a79a467a2fac8f0a2445951b327177cc2b3c6813f4d8a539138a7546c02f82"
        },
        {
          "alg": "MD5",
          "content": "dc90c1994bb9c89c7a1fcb7361b8aa89"
        }
      ]
    },
    {
      "bom-ref": "ff55bdc9-537f-4b82-ba7c-c10d9ef7ea8f",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/SmcOamEthStatus.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "f1dff333250fc94444143322eb8245d0bb2fb6de"
        },
        {
          "alg": "SHA-256",
          "content": "2b6a992907ebcb4afc47999e5029479aac3c4f2e20e5316828668be5f3e546b6"
        },
        {
          "alg": "MD5",
          "content": "1fed3c4ac875cbef56a369b1c3f93d62"
        }
      ]
    },
    {
      "bom-ref": "ff57d7e4-7200-4671-b989-204db967d5a8",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/JsonSchemas.tar.xz_extract/xz.uncompressed_extract/smc_json_schema/Dump.v1_0_0.json",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c7259e7177ca0be874cb8ea0b64c4c44c9d6ead0"
        },
        {
          "alg": "SHA-256",
          "content": "a92aa5d847d93eb9bdb7c21b5d4681898740d02b01be71e3f8fbf56e33ec4d6b"
        },
        {
          "alg": "MD5",
          "content": "85be48bac26332c02a6aa707f60d9aab"
        }
      ]
    },
    {
      "bom-ref": "ff6ce643-c704-4bab-abd0-f0515ba94f66",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libsdbusplus.so",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "99f3636ad63abeb7c24ee3add86328dd261b04c5"
        },
        {
          "alg": "SHA-256",
          "content": "3d3e729cb8f91041aaa3827a50531afd5f116819c75a604ac9799e0cb9d210d1"
        },
        {
          "alg": "MD5",
          "content": "a1b09526f50bd2dfb0380426d832cc0a"
        }
      ]
    },
    {
      "bom-ref": "ff7f2807-f149-4830-8ba6-79f4981e4f63",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/images/system_hover.png",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "cd50b6c5c43c9de246e2217ba056a1735133cf77"
        },
        {
          "alg": "SHA-256",
          "content": "558cffc602f1dc2591895d4294d03c002111f09693d3d331e096a9066ba7e364"
        },
        {
          "alg": "MD5",
          "content": "ee12b21bfa3a180897a61cb2f3e6cb69"
        }
      ]
    },
    {
      "bom-ref": "ff8b077d-05b8-4034-b23c-5b2f558ff2a5",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/etc/conf/SDRBlock.X13SEFR_A",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "5877d779b7863de946f9afdb89951fd942a3aa3f"
        },
        {
          "alg": "SHA-256",
          "content": "8874a2763f98e5a579a0027523127ffbdb6413c4de1a76f32e0be94fffd9df9d"
        },
        {
          "alg": "MD5",
          "content": "4f4b2b567c4681e2a3db8be96cf15d39"
        }
      ]
    },
    {
      "bom-ref": "ffa028a1-cc1d-4dcc-95d0-b979fd4a0f02",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/css/login.css",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "1ff626a7ea8b883c6c67ada79df950d044f83fa8"
        },
        {
          "alg": "SHA-256",
          "content": "5909b1e55bae511e23cc1e8a34387b79254f07824b4501bde2e2bc67143f5595"
        },
        {
          "alg": "MD5",
          "content": "4e467c3ad932f2f904fe56dc8292942b"
        }
      ]
    },
    {
      "bom-ref": "ffb4b138-9f89-403a-b123-a489d7d81d20",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/novnc/include/util.js",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "80c698b57e7f09404423196b8e5bde472f2e3214"
        },
        {
          "alg": "SHA-256",
          "content": "c87f3c5fd0aeb4f1525d8b23204084e65c6e576f7600bac6cd593445a1065461"
        },
        {
          "alg": "MD5",
          "content": "ce8de33b8b701ca0b7e41fd93b87deb0"
        }
      ]
    },
    {
      "bom-ref": "ffce94a5-b227-41e2-a667-dbc06cb59f93",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/bin/resume",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "ffe85aa6-22e2-440f-bf40-2301108252b1",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/usr/bin/ts",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "e86d0f07db6a38fd2ed6a3fd21bf0339f653e8cf"
        },
        {
          "alg": "SHA-256",
          "content": "78b3c363298d84412e4e9350cf258b8f307d778b2fd3937f5c9cefcb1eb5cca8"
        },
        {
          "alg": "MD5",
          "content": "57aaa064dc970201c8e80bb4d429fdd6"
        }
      ]
    },
    {
      "bom-ref": "fffaf31c-acc4-408d-a615-b1a1ea1fafad",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/web/Metadata.tar.xz_extract/xz.uncompressed_extract/smc_metadata/SysLockdown_v1.xml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "d48103793366c8fc79904524f0c3fbb8eb221af1"
        },
        {
          "alg": "SHA-256",
          "content": "7e874c8def6cc80390224ac5291bfb2229e468c7368040517a887c603d1e5495"
        },
        {
          "alg": "MD5",
          "content": "854c11dc120a7a5781c9c9426de12e3f"
        }
      ]
    },
    {
      "bom-ref": "fffe6ec0-53d9-4af6-ac08-364b9bb0e44d",
      "type": "file",
      "name": "./6488064-48136192.squashfs_v4_le_extract/lib/libresolv.so.2",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "231d30d0a85822ddc05589530bc5513b07071abb"
        },
        {
          "alg": "SHA-256",
          "content": "8f05150c4c730aa4924b3146e1406e816de4cfd2c10d6fab543047e7806496df"
        },
        {
          "alg": "MD5",
          "content": "e0fa9a1db79ec23054dadd9177899d43"
        }
      ]
    },
    {
      "bom-ref": "0783c71a-890d-4464-9a02-7f185e21a3ee",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5a763989-4b7e-47c7-a812-184ca4366fc7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4bb8307b-9abc-4b02-82c8-33d9a561dab4",
      "type": "library",
      "group": "isc",
      "name": "bind",
      "version": "9.18.24",
      "licenses": [
        {
          "expression": "MPL-2.0"
        }
      ],
      "purl": "pkg:generic/isc/bind@9.18.24"
    },
    {
      "bom-ref": "b3471a76-9f97-4347-878f-760dea3f94b8",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "23d99d7a-a57b-4350-8cb3-d67f1b30601c",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "c7cc06a8-0ae4-4710-91a9-e37540b38e90",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b51f9acd-424c-40e6-bbea-62e86b1cde1a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4cd69b39-3b26-4cea-9201-485f045e999a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "44a79066-5b5b-4fba-a931-c576d8d58ad7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cdcf9927-e528-4845-8911-2875fecd02f1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "eb57e84c-f33e-4594-b362-4bf27059d6ba",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d4c4d04c-1045-4e87-b7a5-51b223317ede",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "942e87e8-9929-4d1f-ae65-bdaf226a8cf1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "618b0649-9a1e-424e-8213-e13b117e7df2",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f69674cc-3bea-49d4-8e41-4b662b46f0d5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0e2cd5eb-0a1c-451c-be98-89b0e283e8c4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3e90dd06-8631-45ec-ab6c-212696db6570",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "812a20ec-16ed-416a-a1ed-ac367783e0bf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ee4c9aee-b069-4aa7-a280-b5d3ffa4a812",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e27f607a-e377-44e0-9bea-4f2b2491b4a8",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6de4f77e-742e-415c-8d07-c69fc16d8cb0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "faf64dbb-77b0-4967-a139-91e2425efb2c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a974770f-2619-450f-81e6-54d10e1bd720",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "90fc602d-1465-49e5-a611-48a4af4e7c7c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "292b5047-7e57-480d-88b8-11b63e95b0f3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "97637e16-0961-4009-b8b4-ad40d854d1d9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2eca2947-ba16-458c-960b-616c4e0edfca",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "778afa68-51aa-405a-a8fd-66a142c6ec79",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f6c81fc2-580e-4dc0-a920-3f44b3a7075c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f797ac62-f080-42fb-ae0a-005962bc8aa2",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1b6ba5a2-641d-4ff2-a5d9-83ada06522ae",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ec1341cf-daa9-43da-bb39-3d7498f026cc",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "45d7997a-99fe-42e6-bef1-ad7539ae9378",
      "type": "library",
      "group": "lighttpd",
      "name": "lighttpd",
      "version": "1.4.54",
      "licenses": [
        {
          "expression": "BSD-3-Clause"
        }
      ],
      "cpe": "cpe:2.3:a:lighttpd:lighttpd:1.4.54:*:*:*:*:*:*:*",
      "purl": "pkg:generic/lighttpd/lighttpd@1.4.54"
    },
    {
      "bom-ref": "8520ee6d-5283-4bdd-a286-4792e3c0f555",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c7abf60c-0c26-4f84-9341-fd1709078a45",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5920d7fb-e566-448d-96c9-9860ca364870",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6aeead73-2182-4221-971c-dbba60dc4595",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cd8a4fb6-b89a-43a6-b975-e0278a75c105",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "001d6c87-2890-4bc3-9915-66b34d7c0034",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d47579c1-75ca-42ef-9951-f24448c4e081",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0d949332-34d1-49fa-9d0a-c706e62d02fd",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "dd70f5ca-9a05-49eb-bc97-f98351b7167c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c82978a8-eb41-4e66-87c6-039856604f6c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1508bbad-d13d-492b-b412-b66e6d1ff727",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6b383c3b-cc36-4112-b575-52e956e4e5f3",
      "type": "library",
      "group": "haxx",
      "name": "libcurl",
      "version": "8.9.1",
      "cpe": "cpe:2.3:a:haxx:libcurl:8.9.1:*:*:*:*:*:*:*",
      "purl": "pkg:generic/haxx/libcurl@8.9.1"
    },
    {
      "bom-ref": "442e49ae-744a-44ff-bc69-e00db0080646",
      "type": "library",
      "group": "haxx",
      "name": "curl",
      "version": "8.9.1",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "cpe": "cpe:2.3:a:haxx:curl:8.9.1:*:*:*:*:*:*:*",
      "purl": "pkg:generic/haxx/curl@8.9.1"
    },
    {
      "bom-ref": "09ac9acd-7eba-4683-92dd-43d25ef75c12",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b59e1b3d-c141-47a7-8b28-720799497f81",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4931ea0b-af66-4b3c-9092-21e97a8fe26d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "06689213-59e0-4fd9-963f-7072d9686f94",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "de0fa4ad-e6e2-4ec2-bc08-3650a8cffdf2",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "54576107-5585-4032-9e83-d6a546a03ee7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "60679d4a-a622-4477-a58b-d4a12cedc6c7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e58ecc54-937b-4ef9-b0ba-83de7c4eaa06",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "94864b51-e90d-4846-9e5c-7d7deb102ecf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2f8d4c7e-ca1b-4d46-b037-78a022393ef1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1eb38c38-4537-4335-8751-1a1bbfcd1693",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "45e941b3-21d4-4c92-a430-fb84815fc222",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "294bce9e-d99b-4640-8064-be44b00addca",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4bb7cd7f-4e29-4a04-9658-882c51e20896",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "00a1f3ff-5b20-4441-ab90-64879e0cdc2d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b3f64888-4723-4e88-8b66-2c1346c923fb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f97d3f56-b001-4b3f-b51c-586d1832e313",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "854767d6-022f-4b67-8e10-0de0e1d9a7d1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a511bcdb-f5a7-408c-b7ab-9cc411556cf0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "639f77fd-8495-4763-8bba-fb08516a0d6d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7bb088ce-c278-4b7e-bb9e-35cdf34808f0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b960860c-d389-45d7-89c5-85db475fc373",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1ab983e6-218d-4b19-b671-9cfca4ab9163",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5c9afd71-16cd-4f38-b215-62e7da20f7f2",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2192974c-3ac7-4238-bac3-0542ac43f574",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7eb55b25-4273-4ba7-888c-e86ebc13506d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "83c699b5-458e-42e9-92e6-e292c04051fd",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "05bbbe1e-5304-491b-a175-6c47e14f7901",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cfcc7318-71dd-410d-b221-343abbf5f854",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "bec46705-d0bd-4ebf-8636-46c0f3c4d4d7",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "973e8713-49fd-4651-a34d-ed392a696c1e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "922dcf2d-b691-4dcb-8773-ccd73b32c624",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7f0d3a3d-2be3-49cb-98e7-df0fed69ccdb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4dd51a8a-2e85-4166-9dfb-a0a7f60f36d2",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "de1b4e65-5851-4338-93d8-3f570d990820",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f7c2afd7-64d0-4e29-b25a-4526520f5891",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b75e8c3d-68cb-4952-8429-5979b1a22a1b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e744be2d-9005-41e8-b86c-58b328b00861",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d11fb6ed-86ad-4f52-9eed-482c22c0d1a9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b90963ad-d63f-4c6f-958a-74f97eca6b3c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b9f36306-7b96-43a8-8e3e-7e649ae8da9c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b492ae52-277d-4574-bb50-485b76540751",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d329a049-868b-4d49-8169-ed9480a1f3af",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "09f956cf-2954-46ba-8842-c27cceca7fa6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "302d3dcb-a5b5-48e5-9501-5e542c088e3c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5dce737f-d598-495c-827a-d7f9f42e02f6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "822b59ca-ce8c-4625-8f4f-8ab7ed246ad4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "556e6847-339f-4599-b311-2846e1625713",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "cbfdbbed-2fd2-4617-a388-e0b9b185fd4b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d55c1bdb-e2cb-42db-ba85-e7b99deaf3ef",
      "type": "library",
      "group": "gnu",
      "name": "zlib",
      "version": "1.2.11",
      "licenses": [
        {
          "expression": "Zlib"
        }
      ],
      "purl": "pkg:generic/gnu/zlib@1.2.11"
    },
    {
      "bom-ref": "c25654bb-f622-4946-9ac0-793e6f389b18",
      "type": "library",
      "group": "zlib",
      "name": "zlib",
      "version": "1.2.11",
      "licenses": [
        {
          "expression": "Zlib"
        }
      ],
      "cpe": "cpe:2.3:a:zlib:zlib:1.2.11:*:*:*:*:*:*:*",
      "purl": "pkg:generic/zlib/zlib@1.2.11"
    },
    {
      "bom-ref": "0c4cc85c-434f-4426-99b1-336252b314a6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "40a17eb4-8717-4521-ba17-a7163cf4b06d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e4035c75-70ea-4ac7-8927-c22f09ebaf09",
      "type": "library",
      "group": "openbsd",
      "name": "openssh",
      "version": "9.8p1",
      "licenses": [
        {
          "expression": "0BSD OR BSD-2-Clause OR BSD-3-Clause OR ISC OR LicenseRef-Public-Domain OR MIT"
        }
      ],
      "purl": "pkg:generic/openbsd/openssh@9.8p1"
    },
    {
      "bom-ref": "26e6be5a-773a-4826-a8d5-fac6d4c8cc33",
      "type": "library",
      "group": "openssh",
      "name": "openssh",
      "version": "9.8p1",
      "licenses": [
        {
          "expression": "0BSD OR BSD-2-Clause OR BSD-3-Clause OR ISC OR LicenseRef-Public-Domain OR MIT"
        }
      ],
      "purl": "pkg:generic/openssh/openssh@9.8p1"
    },
    {
      "bom-ref": "99032924-23ec-4d30-ae9c-a40c27aa33df",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "29426c4c-7f96-443b-8592-9b94a203ddab",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "342573d8-5756-438b-bc92-814fb7f057a1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fcd4e5db-3f18-42a2-8ace-7a38744f4e22",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "a4cd94f4-70f6-4468-9cac-d074c0e6dd2f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "350bfc5e-dc04-4243-aceb-36b0454f1569",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8fbb6b0b-abfd-4d81-b123-f2dab10d9144",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "607cb34b-04e7-47b7-85a4-f79f9d9e2676",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fe19334f-8ac0-40ed-864d-038dfbe1327f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ed6a05ae-885e-4c42-b063-fba1d46af7c7",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "7ab09767-9d28-4b7a-8661-c4a0db30e5bb",
      "type": "library",
      "group": "pcre",
      "name": "pcre",
      "version": "8.33",
      "licenses": [
        {
          "expression": "BSD-1-Clause"
        }
      ],
      "cpe": "cpe:2.3:a:pcre:pcre:8.33:*:*:*:*:*:*:*",
      "purl": "pkg:generic/pcre/pcre@8.33"
    },
    {
      "bom-ref": "373f5454-2120-4145-926f-55feeee6fffd",
      "type": "library",
      "group": "systemd_project",
      "name": "systemd",
      "version": "251",
      "licenses": [
        {
          "expression": "LGPL-2.1-or-later OR CC0-1.0 OR GPL-2.0-or-later OR MIT-0"
        }
      ],
      "cpe": "cpe:2.3:a:systemd_project:systemd:251:-:*:*:*:*:*:*",
      "purl": "pkg:generic/systemd_project/systemd@251"
    },
    {
      "bom-ref": "cf6b5e28-9b8f-40d3-8705-9dcd9fc12ae0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2053bfbc-889b-4942-ba7f-3a42627a2ad0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3543adfc-c7c0-466e-843b-4dff346c0cd3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6cd641b2-cc2f-4c47-9195-56e562b4c4b3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8dbee049-e643-4664-bfef-ad3a5a312b85",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e19e1068-2c17-460b-b4d9-356cd0e716d9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1d23194f-8cec-4137-bfa2-485d6fab740d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e9925bfe-db42-412a-b485-ad9e65bf1dee",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "dfd37ed9-98f7-4acd-8b43-46b3828edc4d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ab846128-7003-4de4-b6b7-2a2101cfabcf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c8a369d2-7356-4344-855e-6c03b84104a4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "54eb5889-f339-47b5-866b-2967c8a9d5cb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8ba1555c-30b5-4785-90e8-7b938e4d802d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2972d5d6-52ce-4887-97c8-00797500170a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2f4f21d3-b5ef-453f-bc1a-ca53d64ee3a5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f8c590d1-4380-4bad-8d0e-353a7c07b500",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0515d63f-4c71-402d-ae00-a08da512267c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "67c71bce-76c2-45fd-8aff-043d53a7c468",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "36756984-b8f4-4e2d-a0d9-a0cfbbbf1616",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ecbc34a0-34a6-4689-8c83-59807c126a01",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "586e47b6-08f8-40c7-b53c-d24d28d432b0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4fd0bc20-bc1a-4dd2-a2ec-cbb819817c64",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e1592250-0cf6-4c8d-b40c-0a06125e13e2",
      "type": "library",
      "group": "openssl",
      "name": "openssl",
      "version": "1.1.1w",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "cpe": "cpe:2.3:a:openssl:openssl:1.1.1w:*:*:*:*:*:*:*",
      "purl": "pkg:generic/openssl/openssl@1.1.1w"
    },
    {
      "bom-ref": "0d7ade69-6cc3-41ba-a74b-aecdd6478abc",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "9a7f37d4-40c0-4b3b-9668-605ab8c01ff1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e7565464-a675-4715-8e86-4acc8e6c6af6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "94196082-1302-4500-876b-acdddbd525ce",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "921bcd7b-0617-49ee-8fe8-b6f641a81216",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b162ab6e-d317-4ebe-9997-08a5095b8e64",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fb825576-02cb-47e7-ba33-6e5aa2ae402d",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "869f4780-a17a-432e-99e1-dc16546847b8",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b3ac242a-2065-4ccc-82d8-c85af39e2315",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2b4af850-84bd-4f81-b4c0-6cdf8006d9a5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "44999ff9-12e3-4fe2-a69d-6b94c04068fe",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3f0f22e1-ae70-4bca-a664-eec6a4c57c30",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6daa7bdf-bb60-44d1-bf7b-f6d9c011fb68",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "33cf822e-eaaa-4915-82ea-0b5805de7378",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c282a119-5446-49d5-9fb6-45ce3bab836f",
      "type": "library",
      "group": "gnu",
      "name": "glibc",
      "version": "2.36",
      "licenses": [
        {
          "expression": "GPL-2.0-or-later OR LGPL-2.1-or-later"
        }
      ],
      "cpe": "cpe:2.3:a:gnu:glibc:2.36:*:*:*:*:*:*:*",
      "purl": "pkg:generic/gnu/glibc@2.36"
    },
    {
      "bom-ref": "2d452aba-7a02-4c7d-87e1-280bf8c59609",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "68b21fb7-ec0a-4365-a668-9ed60d15a4db",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "25aceb81-4ef5-4668-8bae-1c3decdac99c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "11472751-39a6-48a2-85cb-668590003034",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4ce46489-7774-4440-a6eb-fd61a72fe9d5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d29e18e6-f3b0-414d-9fcf-93014ef9c6a5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "92d92de0-9969-4d81-af37-7c3dedd248fc",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "881aae18-844b-4d8f-bcff-b4c88bba26c9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d9145db0-4d46-447f-af19-a017b1233f19",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "983def2f-aef9-4e9f-a95f-4c6c3fa906be",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6c3ed291-c06c-4d9d-a8e2-cbec41a064f3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "fd3ab60f-940d-474a-8ab2-3c0333be33f3",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "5bfc506d-4ef3-4e70-887b-d4b02115a162",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "525af50c-6f70-4d02-9569-c42f87296b97",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "02f5c995-01be-47f7-aeb0-6501b1eda478",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c3d04040-caf7-4994-80f0-471d99c44907",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ac05e2b1-c52d-4c06-aa9e-55c3b0e95b96",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "40450f58-390b-4cc2-9285-052e055e6300",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5633222c-94d1-4318-b4e0-fc39b542a6f5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "21f350c3-c22c-413d-b70b-5b1d8a63f12c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "907bf56d-1d81-45a8-93f9-c9cb553826be",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "29cde003-4068-40f5-bd6a-2c824da49836",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f23e1bd2-30c9-4125-ae35-54c34fb1c7ec",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "300c8979-cfc0-442e-8a8d-89e22cb2c94c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0c1ab5f8-e55b-40b7-94ef-d82ed54c2188",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "21461112-71e7-45cc-aafa-d5666cf0e8c0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "bd69e55b-b840-4672-99ed-0da45799cc85",
      "type": "library",
      "group": "supermicro",
      "name": "ipmi"
    },
    {
      "bom-ref": "ec315413-3a82-4a12-b8f6-7335f3e7b0be",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ae098a8f-0e1e-4c39-9b34-3ca29b3ace1f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "884bda62-9c61-4e8b-8224-0013ff8be244",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b723433f-2333-46e3-a4e9-8a3fc83ca10b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "727d8804-db6b-468d-b398-1742c0775897",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c7483525-ec57-459c-be6f-2f73148c7ab3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "875d5789-3708-4cd2-bd59-afcc96619f15",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b3427e51-232b-42dc-80dc-39cfdac7f1e4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "52ee3cbf-f110-4a11-9d22-76f565429316",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "276340f9-d986-48cb-8019-1164c1678878",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "91920184-fd77-4c8d-a24c-4a328fc5e744",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "660477af-d781-4f21-911e-2ab88dc9979c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f890df34-8d69-44fd-9a6b-a3371c9e5241",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4b9cbed7-f688-461b-b881-8f8c99da6e80",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "57009608-29ad-41ad-819b-14c3ee44641e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "dea06c63-68a2-4120-a9f3-ecb572683064",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7f169ce5-8112-4ddb-9eb5-f2110550fb66",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "921485c6-4294-41d3-84f5-cf455ae6e398",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b5cfec75-ca5f-4674-9156-0b55e602778b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b13b8b89-368e-40e3-ac3e-86779691c1e1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5d7a6ae7-565b-4f23-b7aa-a01544b50085",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e27351c2-bac6-4674-904d-b828ae3b5780",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ea98e3b4-f08a-4a27-8726-030d5f469d37",
      "type": "library",
      "group": "ext2_filesystems_utilities",
      "name": "e2fsprogs",
      "version": "1.46.5",
      "licenses": [
        {
          "expression": "GPL-1.0-only OR LGPL-2.0-only OR MIT"
        }
      ],
      "purl": "pkg:generic/ext2_filesystems_utilities/e2fsprogs@1.46.5"
    },
    {
      "bom-ref": "39cf6867-f3db-4d8f-81c0-215b663ef95d",
      "type": "library",
      "group": "e2fsprogs_project",
      "name": "e2fsprogs",
      "version": "1.46.5",
      "licenses": [
        {
          "expression": "GPL-1.0-only OR LGPL-2.0-only OR MIT"
        }
      ],
      "cpe": "cpe:2.3:a:e2fsprogs_project:e2fsprogs:1.46.5:*:*:*:*:*:*:*",
      "purl": "pkg:generic/e2fsprogs_project/e2fsprogs@1.46.5"
    },
    {
      "bom-ref": "ee618d9d-cff1-469a-a7f1-e76bd47ec8cc",
      "type": "library",
      "group": "ext2_filesystems_utilities",
      "name": "e2fsprogs",
      "version": "1.45.6",
      "licenses": [
        {
          "expression": "GPL-1.0-only OR LGPL-2.0-only OR MIT"
        }
      ],
      "purl": "pkg:generic/ext2_filesystems_utilities/e2fsprogs@1.45.6"
    },
    {
      "bom-ref": "e243bf52-5976-4ea9-9330-e7565dac2cb8",
      "type": "library",
      "group": "e2fsprogs_project",
      "name": "e2fsprogs",
      "version": "1.45.6",
      "licenses": [
        {
          "expression": "GPL-1.0-only OR LGPL-2.0-only OR MIT"
        }
      ],
      "purl": "pkg:generic/e2fsprogs_project/e2fsprogs@1.45.6"
    },
    {
      "bom-ref": "c954335b-5ef8-491d-8950-a26128ab99d8",
      "type": "library",
      "group": "d-bus",
      "name": "d-bus",
      "version": "1.14.0",
      "purl": "pkg:generic/d-bus/d-bus@1.14.0"
    },
    {
      "bom-ref": "731c46d6-7488-42ce-991f-8c754e5e5e9c",
      "type": "library",
      "group": "d-bus_project",
      "name": "d-bus",
      "version": "1.14.0",
      "purl": "pkg:generic/d-bus_project/d-bus@1.14.0"
    },
    {
      "bom-ref": "12cf3756-f75c-46f7-81d7-8f11ef802c96",
      "type": "library",
      "group": "freedesktop",
      "name": "dbus",
      "version": "1.14.0",
      "licenses": [
        {
          "expression": "(AFL-2.1 OR GPL-2.0-or-later)"
        }
      ],
      "cpe": "cpe:2.3:a:freedesktop:dbus:1.14.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/freedesktop/dbus@1.14.0"
    },
    {
      "bom-ref": "ed9e4d4b-451e-4918-8c7c-435729f175ec",
      "type": "library",
      "group": "freedesktop",
      "name": "libdbus",
      "version": "1.14.0",
      "purl": "pkg:generic/freedesktop/libdbus@1.14.0"
    },
    {
      "bom-ref": "719739c2-c73e-4a84-b22b-6da6f59d3e27",
      "type": "library",
      "group": "dbus-broker_project",
      "name": "dbus-broker",
      "version": "1.14.0",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:generic/dbus-broker_project/dbus-broker@1.14.0"
    },
    {
      "bom-ref": "5c9ed054-b875-45d5-b28d-ca3e458dc363",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "070bc172-c800-41ff-a6e5-a35ac12f91ab",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "533ede75-297a-4797-b921-d9e0ab293622",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "13e9ecac-c683-401c-80a1-60a68b01d49c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d4f12ca9-878f-4763-9f85-ab6adf434971",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "66657252-310c-415d-844e-f9c00f064d4a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "124a4c5e-79e5-4286-8d9a-538c876b4f3a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "987b0d10-ca8d-43f9-bf50-ba9d584928f3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "952e4272-60cd-4d7c-a3d3-459aa724ec9b",
      "type": "library",
      "group": "libuv_project",
      "name": "libuv",
      "version": "1.45.0",
      "purl": "pkg:generic/libuv_project/libuv@1.45.0"
    },
    {
      "bom-ref": "88438639-05bb-4d34-a430-0fb44dd0d788",
      "type": "library",
      "group": "libuv",
      "name": "libuv",
      "version": "1.45.0",
      "cpe": "cpe:2.3:a:libuv:libuv:1.45.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/libuv/libuv@1.45.0"
    },
    {
      "bom-ref": "cbca0615-fc2a-4306-8a4e-cf4d42a9e420",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "a5ca71a9-62d6-4231-a9bc-1ae9c9992288",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "e37c64f2-9597-42a1-bb02-d681b927d6ed",
      "type": "library",
      "group": "isc",
      "name": "bind",
      "version": "9.18.24",
      "licenses": [
        {
          "expression": "MPL-2.0"
        }
      ],
      "purl": "pkg:generic/isc/bind@9.18.24"
    },
    {
      "bom-ref": "f25a862a-df0f-4590-9f32-697284765d57",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "ef47ce7f-1279-4c08-82fa-7ff9140611ed",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "cdff457f-b029-4ee2-b107-2fa1cb2b897f",
      "type": "library",
      "group": "marlam",
      "name": "msmtp",
      "version": "1.8.23",
      "licenses": [
        {
          "expression": "GPL-3.0-or-later"
        }
      ],
      "purl": "pkg:generic/marlam/msmtp@1.8.23"
    },
    {
      "bom-ref": "8c14b067-5bf7-43fa-8001-fa8284b36fd3",
      "type": "library",
      "group": "martin_lambers",
      "name": "msmtp",
      "version": "1.8.23",
      "licenses": [
        {
          "expression": "GPL-3.0-or-later"
        }
      ],
      "purl": "pkg:generic/martin_lambers/msmtp@1.8.23"
    },
    {
      "bom-ref": "8ba828da-a5d4-476e-b59e-338173bfaa4c",
      "type": "library",
      "group": "netfilter",
      "name": "iptables",
      "version": "1.4.21",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:netfilter:iptables:1.4.21:*:*:*:*:*:*:*",
      "purl": "pkg:generic/netfilter/iptables@1.4.21"
    },
    {
      "bom-ref": "94bc29f1-9a06-4bf4-9341-25a2ff658afb",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "2e7ddf90-ffb5-410a-858b-0c76527073ae",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b02def8c-d2e3-4960-91d0-2459a6dd71f1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "082e7c0e-cfb5-44ea-b831-dde591d903e5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "71f667d6-c9ec-4100-8102-f0eb2a4e0f30",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0d757aa2-7d57-438a-861c-35193f10caf9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "28f87a4f-2e33-4225-92c1-262b419f20a6",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "50a765b7-5116-4f5f-9ab2-2ae5f13b01e3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "79166f5b-b270-48de-b192-61a6987f63de",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "955d7516-00c6-4446-8dd3-396e4fd5019d",
      "type": "library",
      "group": "libupnp_project",
      "name": "libupnp",
      "version": "1.14.20",
      "licenses": [
        {
          "expression": "BSD-3-Clause"
        }
      ],
      "purl": "pkg:generic/libupnp_project/libupnp@1.14.20"
    },
    {
      "bom-ref": "d606b24b-2cbb-4e10-beb9-877b9731380f",
      "type": "library",
      "group": "pupnp_project",
      "name": "pupnp",
      "version": "1.14.20",
      "purl": "pkg:generic/pupnp_project/pupnp@1.14.20"
    },
    {
      "bom-ref": "7a9ac5ef-eb40-4c8b-9649-e0b905d75636",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "eabf1a54-f000-4429-af25-0e7751f083cf",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "129d16dc-963a-46a7-8d35-c30dc74bf5e5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "db71dab8-ddfd-47ed-9622-8d58be6e7718",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "7dbc2119-89f4-404a-aa5f-e073be8eff3e",
      "type": "library",
      "group": "systemd_project",
      "name": "systemd",
      "version": "251",
      "licenses": [
        {
          "expression": "LGPL-2.1-or-later OR CC0-1.0 OR GPL-2.0-or-later OR MIT-0"
        }
      ],
      "cpe": "cpe:2.3:a:systemd_project:systemd:251:-:*:*:*:*:*:*",
      "purl": "pkg:generic/systemd_project/systemd@251"
    },
    {
      "bom-ref": "380e12c6-ccbb-4ae2-b1f7-b0e813cb156f",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "13d934ef-9207-42e9-bae4-99dab60b87af",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "33886458-aa4b-40cb-a4cb-8c5a3d36ad9c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "821148f2-4c7b-4d05-9296-a28fea382ace",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c4ef31e8-0786-4c70-a2af-297e790f0d3b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "99fae0fa-21ac-4cf5-a5e7-7c15a2347736",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "de9dbb5c-5e21-42ee-b07b-15947d0b6003",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5161690f-3289-4c39-86e9-be272357559d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1b51f551-0901-4425-bd02-4dd08d0bf5f9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8ca174ce-34ca-47a3-8ada-18a7f85d6232",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "01ca7ad5-762c-4758-b203-c4c1a3da82b3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "dba52e41-1641-4f59-8d42-b9aa6b6557b3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6ef58cd9-d31a-4488-9708-589789c8f8ac",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3896c01c-2764-46cd-9543-b4abce41ffd4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6bd2fa35-0958-4f19-b59a-a3c8f989604a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "353d15ce-0e80-4acc-b983-4d5b63b6ecd0",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "022124a2-cd54-435a-b412-c698f7e86d14",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "b61a357a-d935-47ba-b3a5-8aa5ee52b41f",
      "type": "library",
      "group": "systemd_project",
      "name": "systemd",
      "version": "251",
      "licenses": [
        {
          "expression": "LGPL-2.1-or-later OR CC0-1.0 OR GPL-2.0-or-later OR MIT-0"
        }
      ],
      "cpe": "cpe:2.3:a:systemd_project:systemd:251:-:*:*:*:*:*:*",
      "purl": "pkg:generic/systemd_project/systemd@251"
    },
    {
      "bom-ref": "4f79bb26-ebfe-4bf1-8dfe-cb6c1b64a9c9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e4174b9f-f89d-4113-83f3-f88d8725051d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ea8b2fb9-192a-45db-9962-bf934269d6dd",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "881888ab-e51d-4355-b3d5-3eccd52a1f94",
      "type": "library",
      "group": "xmlsoft",
      "name": "libxml2",
      "version": "2.10.4",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.10.4:*:*:*:*:*:*:*",
      "purl": "pkg:generic/xmlsoft/libxml2@2.10.4"
    },
    {
      "bom-ref": "3938a939-e06f-4603-988b-4a1d9802d9ee",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3df104aa-66d0-4b3b-b01f-8d9786aeeaee",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "c5ec186d-2de5-4981-817d-4e7f4d14413c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "aafa1065-b729-4eaa-804e-e6aaef693195",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "452d31bb-ca2d-475d-a0a4-58918c5cb259",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "8ec8b8c1-3c35-46fd-b927-ccc926935178",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "4af00f2d-6ca3-4a08-80b9-3327c2e6aab4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6e45cabb-32d9-4aa9-b53a-476bb86b1cd4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f9c0c848-d0b0-427a-b95e-a177b59915a7",
      "type": "library",
      "group": "gnu",
      "name": "zlib",
      "version": "1.2.8",
      "licenses": [
        {
          "expression": "Zlib"
        }
      ],
      "purl": "pkg:generic/gnu/zlib@1.2.8"
    },
    {
      "bom-ref": "d9c44480-0a4b-4020-8891-e4177c5e6eb6",
      "type": "library",
      "group": "zlib",
      "name": "zlib",
      "version": "1.2.8",
      "licenses": [
        {
          "expression": "Zlib"
        }
      ],
      "cpe": "cpe:2.3:a:zlib:zlib:1.2.8:*:*:*:*:*:*:*",
      "purl": "pkg:generic/zlib/zlib@1.2.8"
    },
    {
      "bom-ref": "6fe41d44-a3b2-45c2-a6a0-7751efa2d76e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0fbe7052-7bfc-4a9e-bbba-efdceacb26c1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ebd60de9-59bb-44ca-94fe-fa3df967df73",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "5b979ee5-7309-4338-80fa-85025e8fd6d3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d8cefe0f-a5f1-46ab-a937-4ed68a5c6097",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "dd88f4ad-109e-4ddd-8f91-4f04d6fe9361",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "15a0cae1-256a-47aa-b777-def09e949eaa",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "367b1218-4f1a-4db5-a865-c0d29603b45b",
      "type": "library",
      "group": "facebook",
      "name": "zstandard",
      "version": "1.5.2",
      "cpe": "cpe:2.3:a:facebook:zstandard:1.5.2:*:*:*:*:*:*:*",
      "purl": "pkg:generic/facebook/zstandard@1.5.2"
    },
    {
      "bom-ref": "18426329-cdde-4ba3-b2e1-2f4ac85e49d4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1dc4427b-761c-45a1-848f-cb2551733e46",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "0523efb4-11d5-4d63-ad8e-b175809f74a5",
      "type": "library",
      "group": "isc",
      "name": "bind",
      "version": "9.18.24",
      "licenses": [
        {
          "expression": "MPL-2.0"
        }
      ],
      "purl": "pkg:generic/isc/bind@9.18.24"
    },
    {
      "bom-ref": "a8178a38-8de5-495a-83ba-4d89a6524b9d",
      "type": "library",
      "group": "json-c",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c/json-c@0.13.99"
    },
    {
      "bom-ref": "bb812279-584c-41a8-984e-6e4eeefe2aa6",
      "type": "library",
      "group": "json-c_project",
      "name": "json-c",
      "version": "0.13.99",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:generic/json-c_project/json-c@0.13.99"
    },
    {
      "bom-ref": "01b53b28-a784-40bd-a240-dbd35631ad8c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3ba23c67-7974-43d0-bf79-83909698137d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "d43fe152-b6de-435a-b8b1-766f784e0ff1",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "36fa5bfa-9f49-4b2a-9c33-8c6b3b142c80",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "85195839-3758-4dcc-b696-026d04664fb3",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "46bdefc4-1fe8-4a1c-bdb1-b497a459864a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3eb3ba4b-e7e9-41d6-b567-45efee86074a",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "988a82cf-1f39-4dbc-993a-71b06d5d3bc5",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "82e58776-9a33-4141-9118-891e6ba2761e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "6f20b889-ecc3-4fab-9726-5fd48e5ec233",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3da5da6c-5597-4b9b-bbae-6df238f86103",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1dd86d97-4691-4816-9615-8b50cc84245b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "ac117ac4-8acf-42c0-84ac-7dd864b39a04",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "13dc0e2b-2489-4316-9edc-f0fa04de92d4",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "da2c1898-aaa4-4a7e-9492-892a67f3ca11",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "f5f2877f-d7f4-4127-a7f4-42eb50a48be5",
      "type": "library",
      "group": "openssl",
      "name": "openssl",
      "version": "1.1.1w",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "cpe": "cpe:2.3:a:openssl:openssl:1.1.1w:*:*:*:*:*:*:*",
      "purl": "pkg:generic/openssl/openssl@1.1.1w"
    },
    {
      "bom-ref": "2713b865-ba97-4838-b03e-530fa5327a57",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "145e8ddf-3b5b-4e72-9d48-dd03af72f3ac",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3fb5cf2a-7040-4bb5-ae3e-6e4bdcba5b3b",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "1614f998-226d-4d04-89de-5b98f23dca29",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "76e9f51e-eca1-40a0-ad8f-2710a037c398",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "663a8225-f97f-420f-96c3-f332cd987b43",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "3b62b011-01eb-44d4-bb8c-31bf37dda7d8",
      "type": "library",
      "group": "ntp",
      "name": "ntp",
      "version": "4.2.8p12",
      "purl": "pkg:generic/ntp/ntp@4.2.8p12"
    },
    {
      "bom-ref": "b05aaa7a-7cc6-43e8-8b12-048baa0e0571",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "74cf70fa-c981-43f3-b7d5-234d68a15538",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "e5d883cb-4949-4665-87cf-f201710ccdf9",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "81a6b22e-facb-4a75-8c5b-0fb2593ac693",
      "type": "library",
      "group": "ext2_filesystems_utilities",
      "name": "e2fsprogs",
      "version": "1.45.6",
      "licenses": [
        {
          "expression": "GPL-1.0-only OR LGPL-2.0-only OR MIT"
        }
      ],
      "purl": "pkg:generic/ext2_filesystems_utilities/e2fsprogs@1.45.6"
    },
    {
      "bom-ref": "473d208d-fe73-4a6c-98f6-f8f805927942",
      "type": "library",
      "group": "e2fsprogs_project",
      "name": "e2fsprogs",
      "version": "1.45.6",
      "licenses": [
        {
          "expression": "GPL-1.0-only OR LGPL-2.0-only OR MIT"
        }
      ],
      "purl": "pkg:generic/e2fsprogs_project/e2fsprogs@1.45.6"
    },
    {
      "bom-ref": "bfc093db-c0d5-4c44-a475-618df2a8154d",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "81e7d503-c9ba-4ec2-9398-d565d019b77c",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    },
    {
      "bom-ref": "43b0f840-14bb-4e88-aa1a-103957d54490",
      "type": "library",
      "group": "mit",
      "name": "kerberos_5",
      "version": "1.18.5",
      "purl": "pkg:generic/mit/kerberos_5@1.18.5"
    },
    {
      "bom-ref": "72491bf5-a6e1-41e1-b70f-ca291a595e1e",
      "type": "library",
      "group": "busybox",
      "name": "busybox",
      "version": "1.35.0",
      "licenses": [
        {
          "expression": "GPL-1.0-only"
        }
      ],
      "cpe": "cpe:2.3:a:busybox:busybox:1.35.0:*:*:*:*:*:*:*",
      "purl": "pkg:generic/busybox/busybox@1.35.0"
    }
  ],
  "dependencies": [
    {
      "ref": "24f4dd95-0a5e-4d41-a445-b2ff04194831",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a",
      "dependsOn": [
        "85e521d8-afde-4703-80d0-9309b83c0aff"
      ]
    },
    {
      "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2",
      "dependsOn": [
        "c5cac6c4-4f7b-4fcf-a1b7-78c37ef5a6be"
      ]
    },
    {
      "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b",
      "dependsOn": [
        "1deda17c-a004-44d1-8360-ad7cf8372dc4"
      ]
    },
    {
      "ref": "517a24c2-a53a-4d7a-9fbe-d4c85389e0df",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7e2439e6-25fc-4f28-b254-b487493c7d6c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a0b27aee-efd0-4e9a-9b63-f0797cb3fc2f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b79d7167-5789-4a80-b122-aae3ff1dec1e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c2de6ead-6dbb-4f6f-b629-38dfe2de2b51",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7dda97d8-497d-466b-b2ef-6280badfe291",
      "dependsOn": [
        "d5767527-c387-46cc-91de-aa7fc22b20f1"
      ]
    },
    {
      "ref": "c29c735a-db0f-42ad-8ac7-5064c5fe3183",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c769f00b-982e-442a-97a1-08de103eecab",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5577e910-c742-4163-b07b-285c20307e49",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e",
      "dependsOn": [
        "22f9558d-05ce-42ad-a1b2-cccf393400ba"
      ]
    },
    {
      "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5",
      "dependsOn": [
        "92cd1776-2574-469e-bc65-529a7963e87f"
      ]
    },
    {
      "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55",
        "d718ada5-e4d3-4f57-a658-2a56029fafdd",
        "89cce52e-31c3-4f9f-ab40-6a8362c750d1"
      ]
    },
    {
      "ref": "553f3efc-3702-442a-89ad-d66b8ac18a01",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "58645350-32db-48b3-a582-f145aec556a3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "60f70a68-0137-43d5-9894-5e016396a36c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba",
      "dependsOn": [
        "1414470e-9401-4f0d-b0cd-8d9bf0f315e3"
      ]
    },
    {
      "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a",
      "dependsOn": [
        "8cdac6b8-4c25-4e67-8cd2-3d694f98ca23"
      ]
    },
    {
      "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd",
      "dependsOn": [
        "1823cf8e-6c93-44be-9316-53f384b42e62"
      ]
    },
    {
      "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc",
      "dependsOn": [
        "18731bd6-9f4c-4c9b-9b11-95623f2e4185"
      ]
    },
    {
      "ref": "a181f788-e771-4dc2-9759-7cb24875069e",
      "dependsOn": [
        "c2521c4c-4347-48e0-bfac-638f04489e26"
      ]
    },
    {
      "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198",
      "dependsOn": [
        "2849e41c-d987-44a4-afb7-ed0367040cea"
      ]
    },
    {
      "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371",
      "dependsOn": [
        "bd5a8161-bcf5-4a02-94c4-dd8ba699cf5d"
      ]
    },
    {
      "ref": "07ee7806-7897-4489-94a8-46b69e4d9ebd",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af",
      "dependsOn": [
        "64afb47d-fb7f-42d4-9fff-3bde1c7b66d3",
        "232aca93-0e32-4166-b5f0-7ecf9462b913",
        "1f63813d-d925-41d9-843c-33d79c236689",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "215433f0-d8bd-43b7-9c10-f0a8d62092bf",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4e99a9cf-91c0-48a2-8228-bc48a76a308d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a7ff2c22-6c1d-4bdf-b550-0a4d88220730",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b6153afa-d58a-4a17-af0a-1846a8bee489",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e",
      "dependsOn": [
        "0937e902-3cfc-404f-ab21-d531ad84746b"
      ]
    },
    {
      "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603",
      "dependsOn": [
        "ea86af82-bd87-4925-b1d7-538ab0c12eae"
      ]
    },
    {
      "ref": "f99749b0-7588-45a8-8b83-29b636561732",
      "dependsOn": [
        "7ce9f326-5531-4afb-8523-69bac79708e2",
        "53ac54b8-07e1-492b-9c58-215bbb5f9b19",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "17d0ef31-cc74-4a84-9324-200d34dec3c2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "86879e61-73b4-403f-84c5-310a91f84cae",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24",
      "dependsOn": [
        "ca777da4-1012-4ded-b786-b5cfccaa632f"
      ]
    },
    {
      "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a",
      "dependsOn": [
        "4b09cbcd-17db-4ac1-b3f1-59f0745a6fe3"
      ]
    },
    {
      "ref": "c9a63b90-b88a-405a-95a3-94ac90a8efc7",
      "dependsOn": [
        "876922f7-bf73-49a2-8715-45dac70bdffa",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "106b5736-663c-4853-89db-8002f8b37960",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "35f7eca2-ccce-4611-a29a-fec82b985260",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "67d10056-e5b3-46a1-be6e-d3e0d37f6dbd",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b9933717-74b1-4ddb-ae42-abd579dae73a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0",
      "dependsOn": [
        "0b16b430-774b-4ccd-9522-f2c8827de252"
      ]
    },
    {
      "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3",
      "dependsOn": [
        "c09aaf3b-238b-4085-b17c-c3b76a814731"
      ]
    },
    {
      "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160",
      "dependsOn": [
        "411cd19f-d63c-4ad1-8fa9-86bf09f939cf"
      ]
    },
    {
      "ref": "0a3d8da3-4ce9-4342-91e8-62da6270598e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "deb08eda-003b-402d-9187-25db3e073225",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4",
      "dependsOn": [
        "8ef4a7ca-d149-4345-8ac5-57dcb89ee922"
      ]
    },
    {
      "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc",
      "dependsOn": [
        "bfb7f52d-4f28-4a80-8176-d1fefeb0339d"
      ]
    },
    {
      "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b",
      "dependsOn": [
        "ff8f377d-989a-427e-b2f3-7232ca28923d"
      ]
    },
    {
      "ref": "62a79987-a91e-405c-86e6-94845eb64ce6",
      "dependsOn": [
        "0da06006-3be2-4265-afda-b23b0c423590"
      ]
    },
    {
      "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1",
      "dependsOn": [
        "1a39166b-aded-4939-a713-45e7bcb53ca9",
        "bc45c2ff-643a-4ace-81ed-ba11d2e6a6bd"
      ]
    },
    {
      "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92",
      "dependsOn": [
        "ad700ad7-0b1b-43f7-9b6d-0814a3c04fae"
      ]
    },
    {
      "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae",
      "dependsOn": [
        "90c98916-70bb-420b-b4f1-59b0232a8c46"
      ]
    },
    {
      "ref": "ef7021a0-9d59-4a0a-92ec-24eac3e68b59",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "17cf9bfe-aa5b-4c02-9505-bea6e020874c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7f4624d5-ef2d-4608-b2bb-f06428058ebf",
      "dependsOn": [
        "000002b5-7ea4-49d0-b371-adcef5f96c3d",
        "000d8527-800f-45f1-91fb-af850cdef26d",
        "0013d7d5-27bc-421f-8a03-1cbdfbc2b374",
        "a4a839ad-49c8-4652-ae00-99e70e878176",
        "a4b39832-d3b2-4d4f-a3ab-9cbb17d4a7d8",
        "a4b6f6fa-d65f-4906-91d5-24729b7ae4df",
        "a4c3015b-4c3b-4201-b8f1-65bd6115cb8c",
        "a4cac266-c00d-4ead-a60c-7bad5350010b",
        "a4ccd1ec-4850-40b6-9f71-89d3d51a2e18",
        "a4dc67c2-6657-4cc6-b003-5953240f7e15",
        "a5039b57-77dc-4ed6-a55c-3bb542992971",
        "a507105e-dc21-4b23-aae8-44213cbb314e",
        "a51c574f-e37f-4785-839a-5f75433aa2e2",
        "a5208142-4019-407b-a37c-980541f30904",
        "a52096cd-6c7d-4233-8ece-1e1d7e13e658",
        "a563b9b0-cb25-4932-b8ad-4d9cf1c7e270",
        "a580b2e1-5a52-4297-bbf8-58a7a806b27d",
        "a5be950e-451c-4ed2-bc3f-d402f694af4a",
        "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b",
        "a5d71f5b-191e-428d-87ae-3507418bd937",
        "a5e6805f-e8d4-4de4-bb51-43c4d2519bc7",
        "a5ec65a5-360d-4c6c-80d9-401969c895d2",
        "a5f4b5de-094b-4c5b-9fb9-b70bad716d39",
        "a5faf6b4-e734-4ba0-bba5-012263eace8d",
        "a60dda21-0ef0-4e90-b67c-4a3701db7235",
        "a65912b9-b70f-4b0e-bf39-13f61a32817a",
        "a686f827-ec51-4ac6-a116-b8a0a768b296",
        "a68a393e-d3d3-44d6-b5e7-251ed2ee3d5d",
        "a6a9b867-31c9-4787-b1ac-951c7cb0a1e7",
        "a6f57ff9-c52c-4ff3-96cc-4f15ca83f4f2",
        "c6658798-b541-4df5-8b55-f8582e62c1ac",
        "c67b5b68-ade4-4034-81a8-d788dd1bd829",
        "c67dd4e3-aaca-4cd3-88da-c09b75de18a5",
        "c69ce6f6-20d8-4e84-900d-c9cec76023f2",
        "c6c857f2-3b81-45ad-b430-dc8abd591c9a",
        "c6cba35b-05ce-4a1e-a374-c89786912323",
        "c6d0ec12-36e8-4a1c-ac60-8dd456f81d03",
        "c6d71efb-42e3-4468-ae89-5e10ae522fc7",
        "c6e21ece-d3d5-4191-a64c-63233295e3a8",
        "c6f303e1-33ce-4d3d-b993-381d6977580e",
        "c73a6347-23df-4f38-b371-b0fdfd56f879",
        "c75b43ea-4e0f-4401-8f75-5f9115440ae0",
        "f3b26259-c9de-405f-90c0-efa955b0bdd3",
        "f3c72fcd-048f-4d71-b869-16ea3807e9f5",
        "f4033d5d-62a1-4de4-ac79-a718afcf0c70",
        "f41e1d4f-0e41-4652-9ca1-225d699d160b",
        "f42711a1-891b-41f5-9765-82fd31de6d4b",
        "00187ac6-ae30-4a7a-9ff8-b1c0be481c6a",
        "001bb4b2-1058-4b77-8c6e-8a1e9c1de296",
        "1a654e4e-c942-4ce3-9ae8-c2f6e6142338",
        "1a706a76-db44-42ef-ba04-6f7138a3a93b",
        "1aa200ea-eb7f-4615-a348-94eacdfab652",
        "1ab06a43-24f1-4dba-b361-ad0752aa7c47",
        "1ac10346-ad97-456a-8b90-f88856120843",
        "1ad5f173-e681-40f4-919c-f1fc09edfb3a",
        "1ad89fab-89c0-4734-b827-aae2b1cf62b5",
        "1adabe31-43b9-48b6-9dec-ba200f7dddcc",
        "1ae21fb9-5e85-418c-a983-23060492fac1",
        "1ae5e5a8-1b4f-4d5d-b22d-5874396d454c",
        "1af086c0-6cda-4c0b-b89a-9f2ece122b6f",
        "1af6eec4-9603-4d0b-a30d-2c801f8c294e",
        "1afa9de0-ac80-4ba3-819c-eccfdbd861b9",
        "1aff7f2a-8b50-4b86-91f1-6c012792e406",
        "1b2b20b1-f72d-4f8a-8dc5-2417d8300a9f",
        "1b3d49cd-9764-4172-b82a-399aee001ea3",
        "1b4702b6-ac84-47c7-acfa-6e3998b4777c",
        "1b72714a-3264-498a-94a3-34d3edb30be3",
        "a49314e8-eecf-4163-9142-4c805e8ec45e",
        "a4977a69-57cd-43f7-b29f-928a72c84260",
        "a4a6cc69-b43c-4e2c-a91b-aac00763d480",
        "c8547a1e-a94f-4900-9bc0-8d36bffe9c41",
        "c854bcb7-252a-49f4-b4f7-15aa374033cb",
        "c88a5444-8ae9-416b-a31b-4b948ac0203f",
        "c88f8135-b9b0-4666-b66f-73f7b9164448",
        "f47ed3a4-8386-494b-88c1-dd7bb9ee2f0b",
        "f48ff213-5bac-4bad-8d71-d159c3ef7822",
        "f49cbb31-7585-43ad-b60a-a797c01e2bfb",
        "f4a76330-86e1-408d-9f00-081174fac482",
        "f4c56090-a109-40db-92d8-4abd9634a09f",
        "f50f811d-6349-46a6-a44c-b04811d4012d",
        "f511245f-4e41-47a1-a1df-d741423f5988",
        "f519acd4-ec62-43bd-8dd9-8c14b9131404",
        "f5455021-d9bd-4878-a449-fa09caf41df5",
        "f54ae5ee-b90b-499e-b597-a7afbb8c4c20",
        "f5871e39-bcb5-4881-953b-e597e9c1a3f3",
        "f58fa016-ba5b-43d0-8bee-96821fec1978",
        "f59f296e-1573-4bd9-8a27-0d5b073dc1d8",
        "f5b432e1-a85a-46a7-ac83-e06b661eeca0",
        "f5b7e260-4046-479b-879f-011ceb3cb7f6",
        "f5e4f8db-ced5-4aed-8b0a-e2147f6f598a",
        "f5ec4186-9ebc-4639-8ba5-9ed7fa86f903",
        "f61fed65-3cb0-4a06-b872-8fd71c0260b5",
        "f667d14d-825f-4795-b492-5a7b639b8364",
        "f6817ede-ed49-470d-ae1a-9a90333586aa",
        "f6870933-b741-4a3e-b950-a78231c1b11d",
        "f68877a8-233f-47cc-a6da-8f11f60a29a7",
        "f68bef9b-d4bd-459a-aba4-ffeaec95ddb5",
        "f6c69a52-4380-410b-b8f3-435eaf3a0f3f",
        "f6ca127f-431c-48e6-8e98-2d29833f49a8",
        "f6ccdd0f-92a6-47af-bc5c-98a0b08e6644",
        "f6f4b06c-ffd0-47a4-916f-72dba6b095e7",
        "f713d887-1697-4553-ae3a-361d9e0d6689",
        "f715632b-2ba2-4c52-8776-559d6e29ff80",
        "f7224e46-7174-4145-8e10-4afad557280e",
        "f732f606-5f46-4d40-93e7-42f347748c34",
        "f7578b57-579d-4860-bfc7-acf0aa6d8ea4",
        "f760cbc4-16c0-4e08-be06-2a1a82167dc9",
        "f790dd65-5f2f-4002-9f67-998f02ac624f",
        "f7953038-ae7f-48c8-86b5-a6c2e22df3dd",
        "f79e2108-175c-451b-8856-601e8a7f7986",
        "f7fd194e-1465-4837-a855-f7023f9d9a6a",
        "f813c388-2db2-4c61-9625-4dc639ecac8d",
        "f81e1e0a-84d3-40b7-aba5-fecf954aca59",
        "f81fc0b2-707c-492f-95c9-1768d76150b5",
        "f8240433-3519-4099-8aa3-9b9947b72fea",
        "f83f4f1b-1845-4e0b-b66d-89eb9417b519",
        "f8588eef-bd46-411a-ba97-3002da051c48",
        "f87e4e89-6583-4064-89c8-d30462cfbf86",
        "f884a9ad-cad8-4928-b1a9-e2b944877fba",
        "f895774a-9349-444e-9794-370bc0a71b63",
        "00209d57-f76f-4a38-9ba0-130e69390d92",
        "0027a5ee-df44-4799-9e69-4dd3feac193b",
        "0052d528-fa95-45db-8de9-8c58440a18b6",
        "007f4c79-9ae9-40f4-bb3f-7645c8f363de",
        "0088b473-e3d6-4b29-ab3c-2b4a44952ac7",
        "0088c375-700a-4c15-801d-b2db58b00116",
        "00b6402d-a807-4685-a61f-aa18aed70fdc",
        "00b69eb9-a0c1-43b8-a855-710d434ddb88",
        "00cab445-ad78-452b-b8e5-cc4254a4fa0f",
        "00db5dbb-0b19-4c97-bb52-78d4118ac3f5",
        "00e06dd2-2c26-4580-ad5a-fcacbf45925b",
        "00e7d85e-c457-4586-b39d-1e319c8e40b3",
        "010a844c-2166-413e-aca1-f5f147b8d61c",
        "0112090c-954f-4191-a9d8-b0491a9c63cb",
        "01123f2a-a1f9-4e56-98c5-a666be0a02fb",
        "013b6ff0-a611-435b-9dac-d61573401939",
        "013df739-200e-453f-b451-799726081fd3",
        "014cdc4b-1031-4519-8fc6-da8b173c2149",
        "014f1cb3-dbe4-4fdf-ad66-bfc12ecc4aa3",
        "01505a68-ee92-4a17-a5f5-0bc6d6677ca2",
        "0156d3c5-ffcd-40e8-a171-b9225f9c09c6",
        "01788dfe-19bf-40b7-86d5-50b115d5348a",
        "017cea36-1184-48f2-a565-c4ef2f03a2ef",
        "01877e66-985a-4017-a2fb-81bbaf427f77",
        "0193309c-5d04-4bfa-98b2-d6060d13c284",
        "01a8a83d-c5fd-4577-836a-50128cbeb0d7",
        "01a93b85-9dda-4e64-b542-2866753ed487",
        "01b59f23-de1e-44d2-bb72-a01336f0c7ff",
        "01c8613f-6462-4755-9b65-700753412bc4",
        "01e2882d-483e-40bb-93a4-32a9e75cd2d6",
        "01ed9869-2fc6-4356-ba53-c90edb727fa7",
        "02384364-dacf-4c93-ac2b-ce6835b35830",
        "024edb44-9e4a-4fcb-9a81-cd33216d681b",
        "02542bc2-5fe5-4bda-b2fb-21832414618a",
        "025795b1-0fb2-4e72-9a9f-74ce11f9143d",
        "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a",
        "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab",
        "029b962c-ce24-467e-b8a9-a1ea8803e83a",
        "02a080db-2edf-4520-902c-2cc40fa2ac71",
        "02c32201-61d3-4cad-ae7d-59570b0407fa",
        "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86",
        "031687d4-32b9-4659-b8a9-c4db5e552aab",
        "032969c1-21f4-4917-97a9-1023be61d926",
        "03378a02-0d7d-4e84-acb6-6e6f7410ac94",
        "0346d4c5-c20c-4a72-8f68-d8998befe09a",
        "035a466d-6f40-4144-8688-e39ed8ef969e",
        "036a6535-6322-4a24-bb2c-3b74d0b15481",
        "0379c716-c80a-4f02-8f24-15cb2465b819",
        "0388c3cc-d1cf-4192-8e23-9ecde9786b42",
        "039a4e05-efbe-4e4d-8092-393b5f9f0bba",
        "03a89f83-eb80-4755-860a-4d46c2378739",
        "03b6bb64-a3a2-4ac5-8b0f-78efa4a77f86",
        "03c93935-63b6-49be-8ed3-350f7629b15b",
        "03cf73cb-d795-45f7-a380-8f378d8ccc35",
        "03dafdd4-1e46-4681-9d52-b346b4a901f1",
        "03f21f44-46da-4867-8f53-1bc705f92134",
        "041782fd-db5b-4f84-88dc-4bc601b5270a",
        "0430e961-36a7-4d1c-9dde-5ea55c632143",
        "043c00f0-9efe-4874-9448-f6912fde9681",
        "045af516-5f24-4f5f-a101-235011fd3ae4",
        "046df221-ab63-4bdc-933d-17e078da5e68",
        "047cde2f-6048-447d-819f-b77f96d51b78",
        "049ac68d-5a29-46b8-8a56-312d56b826eb",
        "04a6dbf9-0718-47f7-a69a-4b9fbed074ed",
        "04b8b736-c910-4743-b53a-995d20fa1bcc",
        "04d6e54a-b33e-4cf7-acd8-d624c9d53a92",
        "051974f1-fec9-47bb-bf52-04e55f301039",
        "0524c8f2-b3b1-4624-9f1f-14bfcf5d3397",
        "0536366b-ab2d-40aa-a3d7-811db174c335",
        "05396339-b918-49ef-aca8-1b6a12ff64cb",
        "05427b2d-e41c-4b2f-99ef-5fa10e9a44ab",
        "054e35cf-c521-4ca5-8a37-86563aeb7c1a",
        "055c16be-5531-4353-ae5f-f775a604a2ac",
        "058aac02-1961-445c-ab39-5588a73f0bf5",
        "05977b4b-4300-42ae-8e5a-5ed99ada4bfd",
        "05b97c1b-e0d0-41b2-99a6-e4d88dbde837",
        "05c223ef-c98c-4682-ac1c-1ac739c46dfc",
        "05f560a0-a3a9-45ce-b54d-baf248b76fa0",
        "0607c597-04a2-4afa-918f-7c7683a346dc",
        "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1",
        "068fe258-409f-40c1-bbff-72647aeb2ce3",
        "06d7e6d3-eeab-4765-aba6-643dde953dd4",
        "06dac57c-b11e-4c61-844b-3040a9b06f21",
        "0710a46c-f332-4ce1-a71b-2d4a7d15ba93",
        "0718ba97-7648-4bcc-9b28-67cd546ef88a",
        "07255f7e-d2ce-4017-9eaf-f26ae0c7e089",
        "073376d3-f892-4c9f-86e0-472d86ce7f32",
        "07398ddd-b24f-4b4c-8694-3b031bf78992",
        "0754e277-2804-4346-8968-38e062356c72",
        "075e87dc-0dde-4e12-bead-96a8ea1abe07",
        "07625e6c-6bee-47fb-84a5-39acf6aeff4e",
        "07654863-b5da-470d-899e-0d8f3f740f15",
        "079358b7-675d-437e-ade2-375cda0e52f1",
        "07b8aae2-d256-4b89-8cc3-2348450f2300",
        "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f",
        "07cfd701-2347-4698-a4b3-325db10dc5bf",
        "07ee7806-7897-4489-94a8-46b69e4d9ebd",
        "08075ef2-0533-4823-9167-5506cfb4ff87",
        "081b62e4-7f89-4050-adc7-ac68efa02920",
        "0851dee1-9547-43d3-b25d-8d2420e35a11",
        "08636125-47dd-48db-8dae-a1129f5c9016",
        "086c8ae1-12e8-425f-bdb3-8d9e8e2e8e6b",
        "08724ed7-487d-4b4c-84cf-0ec6378c38a8",
        "087ec506-19de-4f1b-9b18-58e2174d4456",
        "08866cdb-fcb4-45d3-832c-f50f91d097c0",
        "08a3bb99-5e05-45c5-8d8a-4540479d2960",
        "08b7282d-0a82-4b9d-9096-c329ee294b80",
        "08bb6fac-2d13-49ac-9b99-17e03fc0ab74",
        "08bc03a9-e542-47b3-916e-80900990a0f8",
        "08f4778c-dd6f-4997-859c-a659c9d0dee5",
        "08f813ba-1e36-4c08-98a8-f372188bddc4",
        "0926069f-b569-4745-9218-4ade71f5a77e",
        "09278433-2cb3-4f71-8086-7471a4a92b58",
        "09314032-62b3-45a6-a073-3d67743c1d29",
        "093475ca-a01d-4134-aceb-9809902d7e36",
        "094fa776-29eb-4798-adfd-0f4eca313cef",
        "0974a29b-c52e-41b9-b80f-55e3f665d27f",
        "09778a9d-3686-4c78-973e-6d60638f974d",
        "09c6d793-dfe8-41a8-9044-eb73e47fb824",
        "09ceacbd-7ff2-4a60-b834-edbe44d95c48",
        "09cf976f-05bc-4542-b80e-64ee5c79dfbd",
        "09d8c0da-87e6-4f65-a000-bb7109b2825d",
        "0a008556-137b-4682-b925-15b3bc14a797",
        "0a031b03-ad03-4a9d-a8d8-cc3b0fbf5861",
        "0a14c6bd-a126-434e-8cff-e7d5e4f2cbd4",
        "1b80fbc8-0426-4785-8029-30ed4641b04d",
        "1b9550ba-43fc-4e61-9e8a-581549da12ef",
        "1bade9ce-a1fe-4316-aa66-7937d5fafa97",
        "1bafc419-d64b-4f1e-b701-c38cb3babe9c",
        "1c0e3f56-5207-4e60-a351-429df967d770",
        "1c1ce797-3bc6-44a9-8284-3ef2bcd64fb9",
        "1c2f6260-bd1f-4062-9b2d-456bf64d4483",
        "1c308700-3aab-4d49-a900-48bc200e10d6",
        "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4",
        "1c5fdae2-ad23-4278-9f3d-aaedf2675468",
        "1c687902-814f-4446-b558-8479c52d4f36",
        "1c7ad17c-9bfe-494e-bacd-d4adc249bf33",
        "1c887d5b-0c13-485f-9f50-3fbf77df76bc",
        "1c90d2cb-991b-4d66-9643-0b69f09146e3",
        "1c9cf951-0e85-4dbb-94fc-76b8a5d5df03",
        "1ca77146-c9de-4ed8-aaeb-63ebdcd51200",
        "1cad8c7b-7ff9-4b8f-8770-3965efff8771",
        "1cb1dfd4-85d4-4c9c-b777-b7492521b0a3",
        "1cb38870-1b5c-4368-8392-a8c72b93e495",
        "1cd0eda4-7281-478d-8bd8-020fd3de3fe6",
        "1cdf64ba-29f7-4ae4-ab0e-13aa13226805",
        "1cf963df-9477-43b5-a717-523fd88d5d3d",
        "1d046eca-39bc-4a9b-a8ac-e957f330b2c2",
        "1d1568df-3b5a-4939-92df-0111aecec67b",
        "1d227f04-bdc0-4992-9044-24fb9540c876",
        "1d5757b8-07ae-4ec1-83a9-3ec352582392",
        "1d72197c-f1b1-4a69-8af1-20363877edab",
        "1d72d35e-b0f1-437c-ae18-e826abaaca93",
        "1d744141-ecbb-4ce0-ab44-750b0412c8df",
        "1d8bcd9c-993d-4f03-892a-a095d225f0bb",
        "1da872c6-3d54-457c-b6cb-b2155e56b39d",
        "1dac8d47-2298-419e-a829-4dcd2fcec2d4",
        "1db1adb2-e5ea-442b-a900-9fdd814010d1",
        "1dbd5b60-81ff-40eb-92ec-4236a6398262",
        "1e084026-084f-4841-af83-6fb073351946",
        "1e23a243-f2bd-4335-8054-6e11f3aca326",
        "1e3dbe99-320e-4158-939e-0aba5f8681bf",
        "1e45113e-09f3-40a8-a024-c2451cfcc978",
        "1e4593d1-897f-45d3-873a-7215ee881ce0",
        "1e4f7e99-6314-4fd1-b486-fd202acf61ec",
        "1e550475-92a7-45d8-a360-c619bcdd6bfb",
        "1e59488c-71c6-496a-a617-25aab01d364d",
        "1e7710a0-a948-45b2-97bf-c05f5b3778b2",
        "1e9955f9-d678-49ae-aeb0-c72f101cb0c1",
        "1ed52b31-11a3-46f1-a9b3-ccc223eaf7b2",
        "1ed8bd57-9051-4af6-b34e-2a598a76e137",
        "1ef94ce1-7963-4ff3-8554-2bad622cb6d4",
        "1f077ae7-18dc-4020-adfb-4e958e90ed6b",
        "1f1faa64-dabf-467e-a29a-58438d9b227b",
        "1f29862e-de1f-45ef-9084-e969ed4e8fe7",
        "1f2b0fd9-ffd6-4ed9-8924-b89e40c714e3",
        "1f390a51-ea22-45b7-9aec-a004695fed7a",
        "1f409787-ba44-48cc-975d-7a884e502673",
        "1f531a36-9c8d-4178-91bd-4297edc61d70",
        "1f541f33-2afe-4974-8261-e8414636154f",
        "1f54c888-dc0c-4e78-a282-335f1bc94f7c",
        "1f644a0b-6ede-45d1-848c-270c79432824",
        "1f65ac8b-e15f-49aa-b1bb-569a24bbeb08",
        "1f746526-a126-42f0-b155-f213496600c2",
        "1f781cd3-6714-44a2-8c33-35ff55832204",
        "1f7921a1-3002-4745-ac78-40745e7a3d8c",
        "1f8cc7a6-51c1-4c4a-9f38-da21d1d3b68c",
        "1fb4ef3d-372c-4bf7-b074-0a814211c07b",
        "1fe2639b-6072-47fc-94d7-22dfbce7a9d6",
        "1fe7e060-79e8-4859-a7db-55b328e6003c",
        "1ff1f602-113d-4e2f-8b5e-db9d7e55497b",
        "200e2926-fa7e-4459-85c1-4d0f9db53cbf",
        "204a0582-9c3e-4f10-8a36-bd496b68403c",
        "208150af-f387-444a-a905-65060365fae6",
        "209be16a-878b-41b6-8ef2-d5be0ab9cec6",
        "20a0188a-b608-42a4-8c9e-90d88b84f970",
        "20a12227-6079-417b-9827-5face6f82b59",
        "20b80792-a595-488e-a8ff-5335fbd84079",
        "20b9992a-3fd7-44fb-bd53-f8e6f44024b9",
        "20d3c49a-ad09-4568-9551-87598e1be72e",
        "20e5752d-1aff-4488-b8aa-8ed61bc19376",
        "20ecfc2e-1584-4505-83bc-048063c0a71c",
        "20fd4df2-2974-47ff-b555-68cee2d8e7b6",
        "210d7542-9c26-4c1f-afd0-f71b2a8ec3f4",
        "21120b49-bbf1-413c-af0a-870b58ce5b54",
        "21190c19-f600-4856-ba32-67df8f7b64e5",
        "2128e7c9-cc06-431b-8e58-b2de4422a481",
        "2138fb91-5142-46cd-a5fe-8fa9fb68902e",
        "215433f0-d8bd-43b7-9c10-f0a8d62092bf",
        "215dffff-26d6-4241-a532-4d5330df589b",
        "21ac4d95-330d-4ff7-ab23-db1d581e5b3e",
        "21afb4aa-5054-4cd1-8f56-20c9e3039140",
        "21bc2dca-9760-4754-82be-066b219e8fba",
        "21d9a376-ebe6-426f-9f10-e153d16c4342",
        "21dca9d7-3ac8-4282-aa79-a62f8d92c1fe",
        "21e7913d-556b-41d1-9c7c-2b7589ff5089",
        "2201e099-7447-4c74-801c-5d86b30c07a6",
        "22285efb-a123-44c9-a6d9-cb6b2b70f673",
        "222a4b72-486c-484b-ad4f-5b2c125bf0eb",
        "223872dd-ad8d-40d7-95ea-79528540093c",
        "22392810-6b3a-4247-a84a-9f0fbcca141f",
        "224c8c96-05a8-44bb-91d2-832915173642",
        "22682aba-f5fd-4c03-a962-4f82151881ff",
        "226f67ac-9c71-4731-91e2-d540e8bb1555",
        "22718682-e67f-42e1-a309-931e0f717591",
        "22791198-f7c7-4e4b-a85d-0c9fd7e952d7",
        "2284da3a-b5b3-4a04-bbee-f03aadae5dd6",
        "228b8754-4f10-41ac-81f6-4480df2d9909",
        "22ba1ed8-0841-472c-9581-852a897b0fe0",
        "22c769de-6385-471d-9be8-604934fc46fc",
        "22d36550-5f9b-4d4c-9446-a6a9f919b743",
        "22d3ad5e-4e67-40a6-bc8c-5d1458c0630c",
        "22d84e91-0e00-43ac-9634-819a345c23b5",
        "22fed80a-b839-4723-afcc-0c27a3dc9083",
        "2301b18c-448c-4063-bd59-c8333cd5d8fe",
        "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b",
        "231aafeb-a991-473e-91ed-b91df1b0adb6",
        "232a4b6b-3f0c-4fde-9509-78bdceef8256",
        "23397719-5cae-44a6-a388-604be4e32101",
        "233ef88e-4c48-442a-8dab-77003dfeae76",
        "2342da43-58c5-4203-839e-9a4e2a934efb",
        "a70a90f0-c667-40e4-9396-b38481d26d93",
        "a74e74ad-b230-4806-a83e-f4dfa7846efd",
        "c769f00b-982e-442a-97a1-08de103eecab",
        "c78089c9-64c0-4f73-af9b-03825107ac5f",
        "c783635d-2b9c-4318-8107-e050b3d2f3d5",
        "c79d2616-170d-4095-a10c-8024c0f6b6b2",
        "c7c5f82a-c1d8-480d-aa73-f729a77a311d",
        "c7c785c3-d749-40aa-a6eb-7af5613a0cf6",
        "c7ca1d22-f139-4031-8655-98aaa3ca6327",
        "c808f02c-1116-4964-ad8d-b7ddcceb2f36",
        "c82f3679-002f-4c66-9073-ca336e59349f",
        "23661591-1876-4cb3-b926-830d01a78b14",
        "2374476b-9521-4ae5-bb51-5be4e15d3c3d",
        "2377267d-8033-4d0f-8896-3634822211f7",
        "239f1579-7449-4282-94f1-ce31cd4c68ef",
        "239f5bc0-363a-4552-8d0a-e0800011d745",
        "c8a3df0b-7172-487b-800b-d97fb0324f09",
        "c8b2e402-da43-4e9f-985e-7aca44a2540c",
        "c8dae5cf-5af0-45ce-bb4a-93e913b2de04",
        "c913a3d7-d016-4463-b95c-91266511e1b2",
        "c926f709-09a4-42ac-b936-5ddd9b0f99e6",
        "c92a9a6c-fe67-4bd9-9af9-8506ef592df2",
        "c942e209-7d13-4321-8eef-e8a336bce351",
        "c94668ee-abae-4c85-a864-4b6292c30597",
        "c98a2f59-1aac-48d7-9327-a2ab90f4da38",
        "c995bf59-e198-44f2-84c3-02d3a99ab18b",
        "c9a14a9a-a4f8-436a-b870-9c99d1849641",
        "c9a2f36b-1367-4c12-bd29-ad2d000c3916",
        "c9a63b90-b88a-405a-95a3-94ac90a8efc7",
        "c9be8d69-4105-4f4f-8d60-ef5a2105ad35",
        "c9e78aec-4a62-4642-9e0a-f4c5882c3d68",
        "c9fe9d9b-b53c-44fa-80e8-7ab0a1d7fb60",
        "ca03d7ce-e9bb-4855-8be1-76f480b1f870",
        "ca0e01e7-804d-4c8b-8730-2c21f9f1d765",
        "ca1e57c9-1acb-455a-85a9-79f8ad15c3e2",
        "ca667591-9081-4d00-add7-390ecda13bef",
        "ca6c8a2a-6531-4608-81e7-5a8c74876bc9",
        "ca9d3e65-ab76-4afd-9f43-7a794b4fda29",
        "caa85e99-559c-4241-bb15-1c2bb23e39e9",
        "cac12798-1157-4ad6-81bf-050d786eea34",
        "cac1b734-f923-46fa-ad23-61763d0cfb17",
        "cac6a419-8fb0-4a83-85fc-d619733ae68d",
        "cac9f7a0-c559-4a50-bfbf-1ad665315d02",
        "cae0f4b1-fe29-4baf-bc17-a731f01101a8",
        "cb2e8093-9430-49dc-82b5-a77388890c73",
        "cb3b83ef-7100-4c5f-9822-45d293562233",
        "cb43a31e-64f1-4d70-8864-aef889b546c4",
        "cb64ec51-e909-445f-b72e-8a3a6defd036",
        "cb6804a5-5e21-4a7e-9478-d1290662de52",
        "cb7fe145-617b-4715-bfc4-d44392dd2f13",
        "cb88310b-e9a2-4492-a836-1d0cab4eda8f",
        "cb889de2-2b15-4f0c-ab79-44ff3fff7099",
        "cb8fe4bf-b9c5-4f3f-81f2-da26d47ffccc",
        "cb9c4f66-9b45-4c70-9294-43bf8f496885",
        "cbb1bdab-a4eb-4cd9-a1ba-958795f86045",
        "cbb9bb19-f567-48ba-8e77-46f573503cd8",
        "cbb9ead8-0b2e-47f8-881b-ec9101eaf290",
        "cbc66627-7c55-44ec-89f8-c5fb42a8d2fb",
        "cbca2402-ce70-478d-a11f-f831b2b4e402",
        "cbdba35b-a848-44d4-839e-4dcb3dba6df2",
        "cbfd10af-5c6d-4e2e-a8f5-2946ff2cbfca",
        "cc0d1f80-9683-4c0b-8eef-03f81c259371",
        "cc1c84bd-0e03-430e-bd01-f03703884f9f",
        "cc372503-067b-49e6-8be5-c1b368c0ec9f",
        "cc589195-a635-407d-9b54-a4e518df10f9",
        "cc71e7d6-4d84-41fa-949a-dcdaaa6cf7bb",
        "cc98098c-c20a-4095-a8fc-0a977a1f7a1f",
        "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa",
        "ccc03edf-4c7f-4ab1-a8f6-751e88e9b6c5",
        "ccd000f8-3dee-49e2-ab46-ac7ab7f61b87",
        "cce10140-1070-454e-addd-912aeb038694",
        "cce1b203-496e-4080-9292-bf8eb6d8058f",
        "cce286bc-29e8-448c-92de-3dff3438c0ed",
        "cce77498-1422-40c6-806e-2bf7d8e88cf4",
        "ccec8c86-73e3-4ed6-9a38-54d576651c10",
        "cd028e4e-108e-4eb5-a382-4b489b3c62b4",
        "cd34a26d-76d3-4149-9275-4c116baac74d",
        "cd3929a2-ea29-41a7-9ed4-f1e26e25c9e3",
        "cd3ac4c3-7ff7-41e4-973a-b838b7449c38",
        "cd4e833c-33dd-4ead-84e6-7283ffda6750",
        "cd62721a-64d3-43e3-90f4-e5bec52be027",
        "cd771914-9210-401b-9522-43f62d29c63b",
        "cd7acea7-231a-4728-af9a-548a94e64cde",
        "cd7eb25e-10ea-450f-b326-a17181f24480",
        "cd916b90-5f89-453a-be47-4ac31caf6502",
        "cd9299b1-751e-466d-8570-2bec7e3b8c24",
        "cd9a54e7-926b-4cb6-ad75-de82d87830c4",
        "cda699c6-bc0e-425e-aaf7-474b4edde402",
        "cdb635fe-c7a6-4bfb-bd30-e6c57979a149",
        "cdd04b76-b62f-4b85-92ad-9b7292cbafdb",
        "cde83a23-8e7e-4f00-a2af-0ef2a3c420df",
        "cdfecd8a-ff92-40bb-86d1-bfc898f80a47",
        "ce007e2c-6e66-459f-a7c7-4d8278d32677",
        "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8",
        "ce24fdfb-7fad-4dfa-a3fe-5192f4a0f49c",
        "ce350abe-2ada-41c5-9125-5c74f4caf219",
        "ce7b2454-e780-48c8-8220-bf483c988a5e",
        "cea7a4a4-a2ec-4783-9f36-151de16bef2b",
        "ceaacced-5895-48e4-a2f6-ad55a57c7aad",
        "ceb41795-29d2-4487-b27f-d30d4320447a",
        "ced777c4-f097-4a21-a50c-0e43c277f84e",
        "cef14346-674f-4275-a10d-c293409c1464",
        "cf147b35-a4fd-4a47-a2ce-f55356d44ce6",
        "cf211d00-d3a6-439a-aecb-25627eb37ee5",
        "cf4781d7-59dc-4318-bf18-01278d234cf8",
        "cf625bc3-961e-49fe-8010-ec3dcf2d4f05",
        "cf7dc051-bc03-4031-9d2e-453ebf37c318",
        "cf950ca1-5240-4b19-8482-b11bbed98c95",
        "cf9baf96-236e-47d1-a0c8-1b8274c9f1b0",
        "cfc835d6-5ffa-4d5d-b83a-1dfc07910583",
        "cfdc8540-39b8-4bdc-a2d7-a41ad87bca00",
        "cfdc91f7-ed90-4bbf-99a5-8a0e5b127388",
        "cfe36b89-8125-476b-90d0-f4ca5a817cc6",
        "cfea1f86-2d91-431f-8fa6-606337b71e2d",
        "cff79766-958e-4a4e-9136-76c662857964",
        "d0316326-9baf-4e81-b52f-84d5b7248031",
        "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb",
        "d0332767-0bcb-4f96-befd-00010c816091",
        "d036d426-ebb7-4c8c-a23c-656e116dcf54",
        "d0380940-f84e-45de-901e-2c33b401d277",
        "d038cc43-67bf-4f84-a755-ff747950221c",
        "d058c055-7833-4282-9a7a-546d10d02d3a",
        "d058f3a0-96ab-46cd-8acb-0cf80d081722",
        "d07e65ec-4509-45fc-9f4f-15bbc4050e98",
        "d098b5a9-87b1-4dce-8940-29aaa70e071f",
        "d09bd394-13fd-4724-b42d-0000cfba7e20",
        "d0a2412c-c202-4700-937a-fffb85503952",
        "d0a32d66-ca9c-4131-b7c2-ed9f27e76d0c",
        "d0af0bca-2949-48ef-bace-7cfe48b48cb2",
        "d0b5cd13-07a6-48ce-a904-b0ef52f2e4d6",
        "d0be729d-07a3-40ba-a9bd-e4cb7ec428ab",
        "d0de2005-8745-43c8-9a65-2c999b6dcd6b",
        "d0fcb7bb-a5ad-4f8d-bce7-78bb8a4c5eaa",
        "d1074694-6d81-4cb6-bbdf-e0c51d507604",
        "d12c99c4-9bc5-4a08-973a-81f1a81673af",
        "d158a875-d6dc-46c8-98c9-ce5b4b56b18b",
        "d16a17fd-a7f1-48b1-82a3-4de85fae0e64",
        "d198402e-9b02-4322-84a3-8cf5f8a768f5",
        "d1b5f4ff-e2b3-4d86-a408-4c7ff9e32e6b",
        "d1db76c2-8678-42af-a8ab-c8a3e4e323fc",
        "d1f29803-6f28-43c4-b875-17f45b4364d6",
        "d220c64f-e38c-4249-8264-4c6b723ee3cf",
        "d22d7094-04da-4cfd-b407-ca72d411e93e",
        "d238525f-3ce2-40bd-bfdd-dce0a6e6e5d4",
        "d2389205-cbbc-4a96-bee9-8c335e8a7a50",
        "d23fd5e3-aa8a-4aea-9b15-6aaa0d0255ee",
        "d2411f01-ac8d-4f9d-baea-71907b16ca1e",
        "d2413045-6327-4651-ace0-c9c199ba736f",
        "d2707557-0490-4b5e-9044-ca0287125a73",
        "d279cdc1-dbd3-4184-a8a2-7d75aea5e557",
        "d28f9790-0647-47ce-956b-1a17e298d2c0",
        "d2a1ed32-cd1f-4f5f-b95e-dbcde6b4f263",
        "d2c7bee5-7ef9-4188-a8a0-679cf36a4ce3",
        "d2cea02b-5355-448f-b578-51428ff0c860",
        "d2cfb273-326b-48af-8434-c4dc79659376",
        "d2da9aca-516d-4426-88b5-a40571916cee",
        "d32a4901-813f-448c-8fc7-5a6d35fcfe1f",
        "d341cabf-9b8d-458f-a2e1-7f5d57978769",
        "d34ab30e-ab9d-444a-9f0b-b72b0e472a41",
        "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36",
        "d3656cbb-40ca-4b91-90fc-26bc2774d5a3",
        "d366c2ce-f424-4724-b915-668c404e6234",
        "d36e9c82-1356-4dfb-a21c-0010945ed760",
        "d3711f3c-bc02-4df8-8080-78e7e117c9cd",
        "d38e3989-6d6c-471c-81ad-ca84861b2cab",
        "d39c9279-a2e2-4958-9e98-8dde0d3ce886",
        "d3a3d64f-ff3f-4a0f-8cd9-5d3fa354b35a",
        "d3b6b4f7-25e7-49b0-90b1-78e765bdd1bd",
        "d3bfe37c-ea10-446a-9564-115a84479a6e",
        "d3db215b-7ecd-4f28-89ac-e425e72432ff",
        "d3f735b8-5a7f-4393-9366-f7ea98d4295c",
        "d3f85aed-275e-4c2e-a2c7-13cfb423b5d6",
        "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa",
        "d407cb54-515e-419f-b2d8-a0a00d4cddd6",
        "d407e95f-a07f-4110-bbab-77495f27ae95",
        "d42b2c25-7e89-4ee5-9fc8-3d69df53ee85",
        "d438ffb7-2a32-4019-a78a-73128da4e7d4",
        "d442402e-cab3-4a37-a713-733d7344a48f",
        "d444afab-76a6-4424-b12f-d441babbacd8",
        "d44d7ee4-d115-48b7-8bad-790ec9ae7f4b",
        "d455f6f6-7d86-4a38-9434-09cd10598a18",
        "d4615f4a-f6c7-4f34-8196-664559ce590b",
        "d46367b2-d1e4-4dfa-bb0f-5973e8d76095",
        "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a",
        "d472c908-051c-4abf-a733-e07417c40176",
        "d4766063-0e62-4c2b-8e99-b3a119d99a80",
        "d47c3ab7-b310-4bf7-b4c4-2036a27b80e7",
        "d49cc88b-8ec3-4ce4-a0ec-582e744fd17c",
        "d4b04c49-a9c0-4adf-b86b-64e2d33dab75",
        "d4b64176-d822-4664-beee-357c092940a9",
        "151116e8-287e-49b9-99aa-e2285c18a15b",
        "1524a564-329c-4678-8eff-48d104fd67d8",
        "152d4b35-3a2c-4587-9b32-8e45db51f504",
        "15316ca3-6a6a-43c6-83cb-bae57f8bb775",
        "155fdb98-729b-4f7e-8614-eeeb475953d7",
        "1578a136-d18f-4a04-b403-cbcebaab1510",
        "15b97194-a760-4f08-97b0-1f57bfb36d27",
        "15caa398-a6d1-4cd2-ac49-58672f0cafd4",
        "15cfe643-7aa0-49fc-a27e-3e8a1f7d736c",
        "15d725bf-6d9a-493d-9f47-2fdf3d2260c6",
        "15dc11de-be51-4f38-84ee-a6ea15f14443",
        "16005a53-267e-4dd2-9785-2553fb756387",
        "160bd697-a285-498c-a5bb-5a22c784b734",
        "161383aa-dbe6-4d47-bfe6-f0e9f51cdec8",
        "161faece-43d7-46da-9bf0-aa09ebf89912",
        "0d820543-237d-4819-a9d5-828987a295c4",
        "16205d88-af71-4c4f-94ab-c4b66d9a6b40",
        "0d915fe9-2915-46a2-82f5-a093ee8169b7",
        "0db82a39-1450-4c86-9fe5-9bef20f41e30",
        "0dbdd267-7ed2-48fc-9037-e92473cf950d",
        "0de9d288-2ce0-47b1-bd2e-c3637a72a4ae",
        "0e29126d-2009-43c1-890b-63813c0c23f7",
        "0e42a0c4-d8ce-4efa-a6d7-c61a2bb5eb08",
        "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7",
        "0e7a4ace-cc77-48ce-8fc0-890e8865c1e8",
        "0e9329b0-2ddd-46af-aaa4-13b2aab2a256",
        "0ed55727-0b9b-4e8a-99e7-26c5d5eccb79",
        "0edc95e9-7f23-41f4-963a-a29841196e71",
        "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a",
        "0eec4d33-294a-43df-a39c-01015be40ee3",
        "0eefd799-0d3e-45a3-bb51-ec1f15cf14bb",
        "0f135cc2-ef3b-43ab-baf2-40ff77170b4a",
        "0f1cf6f8-9ab8-4bea-9ef9-f4bb1f9d4766",
        "0f281d86-cc41-40a6-9a0d-34a739079a33",
        "0f2a3a5b-05af-4b9c-bd41-e8c006cb8316",
        "0f2a4338-61af-473a-89d6-90d1f9578d6d",
        "0f35e693-fcb8-4217-b82c-eeac53641dfc",
        "0f374874-7ac6-45f3-8435-50a7c39e5e2d",
        "0f4cc1da-b0aa-4fcc-8cdb-0a025eb06323",
        "0f5e089b-d298-4189-8394-b63c218c55af",
        "0f624251-14df-45c1-afae-ab1ded7fecb1",
        "0f9837e1-982e-4c50-b54a-4a1246e96893",
        "0f9b3731-296e-4f62-ac8a-27b4a4125eca",
        "0fa15fd4-a7a2-4e13-9df0-0453ce024ca7",
        "100bd2cf-7812-4f60-b79d-ed9b1a4c2a08",
        "101b42fd-f86c-4c4a-bf9a-35764b06d7a1",
        "1061aebb-69e2-4b52-8626-80596afa48da",
        "106b5736-663c-4853-89db-8002f8b37960",
        "107871fc-5966-4531-a9b2-19d77cd8c2b5",
        "10848abe-a997-4819-afee-3cbaf3ea95dc",
        "1089922b-52a7-40f9-aef0-10656549eb35",
        "108cae1e-21a4-40e7-937d-32ef8e944da0",
        "10b5deed-eca9-4544-a2b3-7fbe2a5717a4",
        "10bb5c62-4bbd-40c4-a238-9ab1d0a7cbdd",
        "10cfd216-044d-46b9-a46f-2408dc1d372d",
        "10ea472c-c23d-4053-8a6a-cd0bc9fb113c",
        "10f4e6bb-5755-412e-acba-cfb942048f77",
        "112612e3-1bb7-4090-8679-006ae766d5fb",
        "11440931-f52f-467b-86e2-212971f77666",
        "1183d77a-6f93-4762-8367-07b7d9722cd8",
        "1197c366-c040-4524-b51e-c716a3aa2c72",
        "11a33ae5-2b41-4445-b47d-3c1416ed9970",
        "11ae8d90-8933-4083-a8e5-bbb655940623",
        "0a1559a2-7bd9-4114-8e4d-923553830a6c",
        "11b8c085-6b73-4753-8ac9-c74dadaa3bf9",
        "11d5e58b-0ab6-4ba0-8d40-5275dda83858",
        "11dd1f33-deee-4927-9877-e2576ff5a734",
        "11e5249a-a425-4223-a684-e137276b7231",
        "11ee7e9f-ce1e-4da6-b707-1411208b099e",
        "12014eb9-b74d-4452-8038-9d882c2eeadb",
        "121975b4-797c-4344-9a7f-1d363a2f2308",
        "1246a945-58f6-4b14-97e0-d6ecad348d89",
        "12538338-c990-4e93-8ca9-d5819a2f3214",
        "12585be2-bb5d-4be2-bdc9-cc53ee94a2de",
        "126114f1-89ef-4082-b301-0a7467c11464",
        "126b287a-d0c2-4d09-a335-1cadec48d729",
        "126c99b1-f887-4e7d-92cd-f3dbd2120bf8",
        "127d2afd-3117-471e-8727-8f9f2b227846",
        "1289202d-c451-42b5-b46f-8b90aa7a5596",
        "12d46231-fcef-4b56-a1aa-5961f51231ed",
        "12d67cb5-d3ff-4abc-ad22-dd3cf52de507",
        "12e650d3-033c-4cb3-b948-77664e288e7d",
        "12ecfc4d-560c-4faa-93bb-b491ceec8678",
        "12f80869-b280-411f-9871-effec560eb44",
        "130af279-e5bf-4f4f-a89b-784e442ae6e3",
        "1337cdd1-1fcc-4fc5-ac2e-a65d5124fd60",
        "13770122-13f7-4624-be7c-7bfa7a9f9e83",
        "137a2d6d-62fc-408f-b51b-0db1ada5db17",
        "138632f4-91a9-455e-8743-4443191feee6",
        "1398ff19-d3c1-4f1d-a7e2-571dc66a19d4",
        "13a6926d-1eb7-441d-95ed-e40f48720d8f",
        "13b5347b-4235-4bc8-a58f-86be2a7816e8",
        "13c7e308-ddd0-4e16-af99-ca79e65ae142",
        "13e2d288-58c0-41b0-8b25-9c1a493063e3",
        "1407aa03-0765-4709-a18a-7211088adbb1",
        "141febc8-b59a-4a56-8ff6-a0a7193045b4",
        "0a162311-dc40-4252-ae96-6edcf7911528",
        "0a281466-8705-4055-bf04-35d55241c8b7",
        "0a2d69ea-dc29-4cc5-9919-08f7effc47f0",
        "1446b1b9-729f-4d2c-a81f-fa0a21e00194",
        "144a1de4-c0da-4d8f-9bcc-b371a4716743",
        "14581f4d-50d5-4651-9c7c-6dd4e4444070",
        "14607e4c-4bbf-4f8f-b0f2-c0afcaedbf95",
        "0a3d8da3-4ce9-4342-91e8-62da6270598e",
        "0a4bcbd7-8961-4dfa-b5ce-51893b57100c",
        "0a5adc57-5995-44e8-93a2-b87bfd6766bc",
        "0a5b9723-b18e-46da-93e9-729af14d80b9",
        "0a899e06-0b2d-42e2-adcd-939ac699b30c",
        "0a99d336-d43e-4f90-b795-332af6c41ee4",
        "0ac3dcb5-fb9d-4a58-8e57-58c474cdeeb7",
        "0adec78c-f181-49b2-b259-912204acfd7e",
        "0ae96900-86a6-4498-90ac-9451740aa3b0",
        "0b543350-1095-47aa-a8e2-d25362f82e21",
        "0b671a7c-c5a2-43a9-90cc-71308b8fc159",
        "0b6fd3f4-3071-4891-852b-9f3cd7949524",
        "0b896d8f-b1fa-4e8b-9074-667646bfcf96",
        "0bb4cbeb-a110-48ea-9ac9-e5d24178711b",
        "0bc9864b-202b-4b30-9130-e4acebee9805",
        "0be007c8-3b74-462e-b995-305bad1858e8",
        "0be98a53-7c36-4f06-b48c-549aa6742f4b",
        "0beb2035-6a6c-4dd1-914a-cec60a5eb4b7",
        "0bf99f5e-a6df-4d14-aca5-9467b3674f22",
        "0bfa154d-09d6-45ae-867e-1f83ebd26895",
        "0c07be20-ce5d-4c7b-99b5-e5c6c91e4be8",
        "0c1cebbb-504e-4d61-8dce-42c941af1c11",
        "0c1f400e-2e0c-4d27-9283-a0fa4df5de9a",
        "0c23b1d9-6d99-4eaa-ab01-59a205fc34f4",
        "0c274dfb-8230-4dad-94e2-c4fdc0ec2435",
        "0c29aff9-ce97-418c-9992-bb2a98cf586e",
        "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a",
        "0c3821e0-5444-4efa-9e76-19b6443e96ee",
        "0c4d3f1c-3458-4337-a12d-1cb45ddd7697",
        "0c61ed58-9136-4b81-b9e1-8a53be691350",
        "0ca2d423-6101-480e-8dcd-1b5ee1ff7e23",
        "0cc8ebca-6d76-458a-8694-19b60b7910bb",
        "14958aa9-b489-4410-8e3b-32bbda41f387",
        "14a28903-c2cb-4aad-9d12-dec72c0e9e45",
        "0ccb94a9-081f-4f35-9b3a-9e0a2fe18f2f",
        "0d0219b0-8430-4157-a916-8f8477c022b2",
        "0d05cabd-08de-45e7-a8fa-e691efe8cc07",
        "0d201246-42af-49e4-b6ee-700c08ded68d",
        "0d281f5c-8167-4b16-8bc7-7303a380c2a1",
        "0d609960-7bc9-47f3-8e70-06aabfad5600",
        "0d7e0cfc-0d9a-4971-81ee-f517b582c61e",
        "14a2a114-ed24-4114-ba52-08f9ecdbeb68",
        "14b209fc-ad3c-47be-b0e3-a6afd280f096",
        "14e8f1ad-324d-4a1f-a324-149a4fa43adf",
        "150f2450-b967-4ab9-82ce-9b1bcc5d9bce",
        "24519a84-b67c-414c-9bbd-4e7b640d9000",
        "24622dc0-83c3-4c15-9d2e-1d18bbc47bd0",
        "246ff87e-87b2-4bdc-933f-c97e59816b91",
        "248df14c-4480-48f1-98c1-9c0a1e34c4ed",
        "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69",
        "249805fb-2579-485d-b35d-bd3c4ac6b551",
        "24a1dc8e-2d39-4f7a-ab71-6de5361dcc71",
        "24a2e681-7476-4de9-990d-552c1774ba28",
        "24a79dec-acaa-4af0-8949-62b5ebe5744e",
        "24ed1f77-0688-4d28-81fb-75339f77bc8c",
        "24f3189c-82dd-45d3-b6b5-f5cc1b3f433e",
        "24f4dd95-0a5e-4d41-a445-b2ff04194831",
        "25047410-c0d8-4182-8c41-cc17515514c9",
        "254db88f-a182-4aea-bffe-2080c4f6703d",
        "254dcf4f-9547-4ed7-9e13-3a4e95e0ce38",
        "25668e70-bb24-4561-a762-681e9418a96f",
        "25744fde-a647-435e-aa20-6a2f8baa8dd9",
        "25b2804d-e222-4318-a3c0-4e3c1ed93541",
        "25f956f5-15ac-4ed4-bc6a-5ad1388c0c4e",
        "2601ea13-20b8-4cff-983f-035dec52ed79",
        "261bdba7-329e-4263-9cd5-b79442ea5c80",
        "261f1e0e-ca4c-4bc0-95cb-f5e03fbb5dd8",
        "261f83e7-8795-4a4e-b514-fc4622695007",
        "263109c7-90d0-4d37-8536-b8657317163a",
        "264ae821-4457-4e5a-84bd-8fe25ceeca46",
        "266a2216-565e-4a0b-a600-17b5d1e9f559",
        "266f501c-5ce8-498d-b1b8-3437acfef023",
        "26a4e309-a1bb-46db-9ef7-ceda8faf0e0c",
        "26becd45-5529-44b3-8f72-967cba36d8e0",
        "26c0abd3-ea38-48bf-81a4-ab0b5c22acd0",
        "1631d335-4e18-42de-9f8f-e4408789e416",
        "163f9b25-799d-4851-9488-a854a7985428",
        "1678ff77-c12a-43c9-a4e9-d6a0ea274ee0",
        "167d6c40-df0c-4747-aecf-3de6f8eb505c",
        "1680b215-a706-46e6-8392-09555fbadc49",
        "168bc92f-3c25-4af6-bd9f-f186c7f0fa22",
        "16a4bfc0-d56a-4aac-865f-588bb0d4ade5",
        "16b46c3c-7f75-4200-abd6-65c39a578038",
        "16e47fe4-b545-43c6-b57a-6e32963d7eda",
        "16eae172-07df-4ffa-9080-eef6feb89ab6",
        "16f3a79c-e535-47b8-8394-85e082442a77",
        "170201c8-a79b-4817-b2d6-a6dfefb0879c",
        "1703420e-565f-44a3-92c0-04f67677058c",
        "1707178d-8b0e-448c-b12e-08c1ad39c301",
        "17085d5a-731f-47fb-8949-ef5511fc5dca",
        "1716f8d4-0a9a-459c-95a5-a846e5dc5c52",
        "17208586-7e43-40ee-82a1-ecd052448176",
        "1727730c-9ba7-4aab-8b44-2eb28386fc55",
        "172a610d-b336-45a8-8713-b9e01d6b485e",
        "177b4ceb-b88f-46b9-93e3-7dd8be5a147d",
        "178b9e94-06e4-4494-8356-44de72bd4f85",
        "17959634-e267-4d26-9ad0-b1cc415227a8",
        "17b96540-dfc5-4920-9420-92d63f95336e",
        "17cad429-2da5-42ad-8146-c841433fba88",
        "17cf9bfe-aa5b-4c02-9505-bea6e020874c",
        "17d0ef31-cc74-4a84-9324-200d34dec3c2",
        "17efe53d-7b13-4cc4-b495-94ab4975a6bb",
        "184180d9-dada-49f2-bd3d-e979a470422e",
        "18832609-580f-45b4-9d85-a7328e0f5309",
        "1886da4b-9c22-4da5-b574-0d002210eb6d",
        "188da172-db60-4250-a9f0-7a719755a31c",
        "188e1002-c127-43fc-9679-7f007a237a95",
        "18af2599-3194-48c8-b757-de1ec8ffd9db",
        "18b9a9c9-eae5-4c19-8394-648a47db91a9",
        "18d5d194-9f23-4af7-8764-82254a6a9cbf",
        "18da7bdc-27aa-4366-8e36-329c020d6240",
        "18e8b57d-e4ab-4495-8975-d029aef54997",
        "18ee2327-ad56-4d9a-8256-fd812be59e28",
        "194e1a80-c4f6-4025-b129-dba4dc0b8e21",
        "19724f73-ac6c-44fc-a540-64a51d4f3fe8",
        "197df624-5e76-4ffb-b244-67136a0f5434",
        "197fd069-07b1-4c10-aaea-5841ce4a7c65",
        "19862c91-5e7a-43e7-b289-eb011232fd44",
        "19999c9d-4ad4-4c7b-9278-5d9ba533e1ce",
        "19a29b01-defe-4905-8bd0-0a499d3f0e7a",
        "19b1e81a-bcbf-44d4-90f1-e67f396362e6",
        "19c513bc-9363-46a7-b4ec-e4aacf1ce0d7",
        "26ed1e27-9ef8-436c-bb16-f3bc48556a12",
        "26f3286c-fbb6-4c4a-95cf-de6099be8582",
        "26fe0198-aa14-47d5-9691-0ed865c755ae",
        "27087611-9828-49ec-abf3-995e62dbb580",
        "2740de94-784a-403c-a698-fc8af5d01b34",
        "2756902c-0871-4682-a101-c7024d8ca67d",
        "27664969-90a0-4d1a-8d81-d57b68ceaae1",
        "2773e2d3-11b4-460b-9ca3-ffd4160af271",
        "27b6f530-345b-46de-b3dd-9dedce2e4716",
        "27b8dc41-090c-4541-8ca0-501c1e913963",
        "27c87110-acda-4223-b0e2-41003cf928ea",
        "27d802a3-e328-48ee-8a29-f072c9285b2b",
        "27e7382a-47df-4e07-9507-8961f58d0fd8",
        "27ef2646-9ca0-4a01-8850-86fcb6c67007",
        "27f40211-203d-4a56-920d-8cba32026bfc",
        "27f7b90a-49ed-4a44-9544-f245ab4d2dfc",
        "27ff6ba7-7f83-4123-bcc9-152412a30841",
        "2824b1ec-df63-424c-9c78-ccac8a36136a",
        "283e4638-bf3c-49f6-95ab-b29a6b015493",
        "288453e0-b0e0-43d9-811b-a2f9b2df6d1a",
        "288ce6a9-5cf1-46cc-abf0-760e0d9486d1",
        "28995edb-a3e1-4ead-975f-9aeb0743f1ca",
        "28a3a773-a24a-4889-b65d-7078d7edc378",
        "28b1c794-9ac5-49c8-911c-411eab898a24",
        "28d39d70-62af-41ec-bb3d-a061af3e9807",
        "28f7ae44-73a4-4a5b-bd24-28bdc2ac0879",
        "23a99b03-dc18-4691-9413-0de4713965df",
        "23ade486-3794-4c12-9a6a-bb4a645110ba",
        "23b19a78-969d-401d-bee5-b31877e46c17",
        "242773e6-0ea8-42a1-95f5-2dba6c8b0b76",
        "243460a2-9622-48f0-a3b0-8e4ef18e67a6",
        "2436ae64-62e8-449f-bc9d-a0294b30c548",
        "243783fe-d8a1-44f2-9257-1f5eab6f67ad",
        "4956ce24-ff71-42f2-bcf4-c7c122ac5de1",
        "496e6955-3c18-4bf8-8bdb-b274d0015d2c",
        "4974b59a-8578-4c2d-a4ec-a76ef427b75b",
        "498a256a-5858-4312-b1f7-1c115488e24e",
        "49b93dc0-1247-487d-b9c5-23555d58f29e",
        "49c1d847-32ff-4a14-a82f-ed655ed74603",
        "4a1fd372-4feb-49d7-b948-eb6a5c29412e",
        "4a3afd91-e09f-4daf-800d-b40312f9873d",
        "2918a24f-745a-4712-a425-6b06e6cf1e47",
        "292f212b-7947-4d3d-aa18-ce757fb6ecf5",
        "294b82ef-52b1-458f-a414-c48dfd2184e3",
        "298247ca-27c4-4731-9e83-a1b1efd88e65",
        "298ab732-814c-4b02-ba87-ccfd2518a8dd",
        "29ac9de6-e8f8-4986-a09e-e71f08d01d98",
        "29ae83df-1f25-40f3-8b3a-d9134542ea40",
        "29e311f9-5c82-4e2c-8475-b7de60d1adb3",
        "29fbc12b-0207-4838-8454-7ff56b58f406",
        "2a150611-cb7d-41e8-8c99-0a582fdf848a",
        "2a1e3a81-2c99-4c20-950f-8968fbb06534",
        "2a2201f3-201a-4bfb-bde2-03806fac0d59",
        "2a26ad27-f204-4b29-9ba7-dd0433208289",
        "2a2805a4-5486-4715-b472-460b58dd0f3f",
        "2a29f838-ee62-4604-981e-a89866061698",
        "2a2fe49c-d6a9-4def-b74e-5f26f8419773",
        "2a36a303-d635-4de1-8dc4-f794c40958c8",
        "2a3a51c9-0ef0-43b3-a040-70c017be2bbe",
        "2a4cc5de-288b-4c3b-83ef-4d64b63e0d68",
        "2a52e25a-16f5-44a1-b9e8-cb035123864f",
        "2a5b62c1-279e-4e81-9310-4dcd34cb1ad1",
        "2a7bff5f-2bb3-40bc-9263-99657db5b73d",
        "2ab0db81-b144-4638-8754-76d62ebd37e0",
        "2abeb926-9e38-4871-bc41-994b402bc64b",
        "2b036b18-6658-47ac-a258-ff8b2bd08327",
        "2b0eaec2-8448-4743-8e24-3f5ba16db09f",
        "2b222773-bd8e-4491-a803-b4ab6e0e2cea",
        "2b242495-1106-4f57-8660-a0f475969daf",
        "2b2b5048-5d70-423e-82ea-b2180d2d6a95",
        "2b3d9f7d-445a-42dd-be69-fc9a1291c168",
        "2b5e7652-4309-494f-ba21-779ccc189097",
        "2b72a4e1-2d47-4e11-98d5-d80443a61183",
        "2b7391d6-4a01-4e33-bbf4-697d69a83344",
        "2b8249e4-5483-4d58-b509-576d5781cd8e",
        "2b86fad9-d9bc-43da-8b3d-ac2605f68d76",
        "2b95e539-4ad4-4df8-8989-b98779d1d8fc",
        "2b9d4229-f277-471f-a4e2-32025a3aa623",
        "2b9eacda-1527-4912-a280-f562935d7078",
        "2ba0a19d-0af5-4f2f-9d63-8c8575120fdc",
        "2ba5326e-4db3-4687-bf74-1f7151b41e18",
        "487879c6-5ce2-4761-8c1d-8e3c01f84087",
        "488422ee-ad5a-4941-b934-ae855ab1054e",
        "48b7b1ac-09d1-4b6c-babe-f9be1d6ab88a",
        "48cf91df-34d4-48dd-bcad-785bbcf37559",
        "48d5e387-87b8-442b-992d-cb6f84c2bf71",
        "48dbba5d-577d-44d9-8320-87c77dff7aa5",
        "48f36d50-c9d2-47e5-bcad-10b45d09dde8",
        "49035b95-bef4-4a71-86de-25ab8c2b0fd5",
        "490f9bec-0105-4a8c-a42e-afa88a77159a",
        "4926f177-0c71-4869-8f8c-261617b81c22",
        "4a513490-9b4f-4fd5-ada5-698590cf995f",
        "4a694955-46cf-4d32-92a3-813fb2d8f9c6",
        "4ab5d118-4285-40ac-a844-c7cd6d1d5762",
        "4ac46406-f7e0-4b90-aad3-df380e92f3da",
        "4ae519fe-1707-429d-96b6-74b7eaa75329",
        "4aefedb0-4e17-49a9-9c10-203bd7cb84fe",
        "4aff0fd0-0522-4095-b0cc-143ef83020c9",
        "4b037be0-4aca-44ef-811e-1c1f677de0a6",
        "4b25316a-7efc-4e44-ac67-8d747bdd3c6a",
        "4b260d72-219a-4fdb-af04-5a42658e2aa8",
        "4b260df9-54b6-4238-8fc5-3eced7a8397e",
        "4b451eb1-1556-49d7-ab44-31d50fb03c66",
        "4b51c6a6-330d-484b-80fb-457239059428",
        "4b53b9f1-4dff-40b4-9286-a9523ecff1f4",
        "4b53ea67-5590-4e90-b393-1ddfe1d634e7",
        "4b795b18-7bd1-43ce-9e50-cd947ef1f6fc",
        "4b927001-482c-4235-945c-9ec20e660056",
        "4ba2a7b7-4098-4f12-abfd-60d52aa52e11",
        "4bcbacda-6ca3-47a4-9a5b-bd767d49cb5a",
        "4bd1d2e2-7fe9-4659-a181-3b607b8b0561",
        "4bdac274-9fff-40e9-ad52-c75d8127488e",
        "4bdb24a2-22e7-4261-9808-9da9b5d3d8a5",
        "4bfc69be-2cca-48bd-9356-2989585debf8",
        "4c2f80e1-f0b1-4f90-981e-45fee2f412bd",
        "4c3a46e0-5a68-49d5-9fb1-a27a56ae77ea",
        "4c41e368-b432-4b6a-a733-16f6eb832a0f",
        "4c426a46-dbdc-404c-94de-444bbbaed7e7",
        "4c68c19f-521a-4971-82e5-c910ae65a166",
        "4c706c35-94de-41e0-b593-ed33930f61d2",
        "4d041a58-f47d-400e-9419-f514b926b7bc",
        "4d06a0b7-5b8a-467a-8943-75a729864023",
        "4d2a5794-afcd-4a82-b379-3729e7cecc4c",
        "4d518faa-22fe-4a3f-9d0c-9150c2f0a429",
        "4d5c7067-7b01-4ac0-abc9-33a715d6c8c2",
        "4d726a57-23d4-403c-9b3b-7fc6e84d0293",
        "4d9b1855-a8de-4fd6-b5af-9fd0969eadc6",
        "4d9f2895-f208-4718-a088-9a739285e1ff",
        "4da5400d-d250-43f2-ac20-7a44fd8ffb27",
        "4db1e9b5-ae99-4a7a-91f0-bea84bf5c280",
        "4dd217e4-6fc2-4bb2-945c-eaf384199f30",
        "4ddb5a7d-bc6c-48b3-8370-0722a29ed008",
        "4de2153f-d017-4943-bf58-5c9aa3ca9f8b",
        "4df94226-f9a5-4621-b6d1-3863c4bc60e7",
        "4e52c62f-321b-4f33-82fd-6e712a90d172",
        "4e5403fa-c568-40f0-8185-188e9e1de442",
        "4e6b6558-37e3-4c48-8dfa-5f330dcb3a54",
        "4e8751cd-10e0-4e03-bf00-1e0735e6dde5",
        "4e973590-af2f-493e-84fa-44a5030ac36e",
        "4e99a9cf-91c0-48a2-8228-bc48a76a308d",
        "4eb6612a-dea5-4289-856e-dccf7187a97d",
        "4eca0355-2c07-4674-aa93-4c683bc56192",
        "4ed555ad-3f5b-4fc2-a221-89654b41b558",
        "4eddb031-308d-40f7-b374-d821b9c28425",
        "4ee1c5ee-20e0-4611-bfed-a9bbf84f10ef",
        "4eed2588-ae8f-4890-b89c-76f5881ae792",
        "4ef7a6ac-64c3-433d-8b08-ac280ba795da",
        "4f018da6-7fd3-4493-8d12-65eb75d258bf",
        "4f01c2c8-c9cc-4fb9-b13c-52a9fb647390",
        "4f161b93-49e3-4e9f-b90d-ca43a0c3e196",
        "4f186a8d-19a4-4e95-ba41-e25c8399b2b9",
        "4f34862a-4dda-451c-955f-c52129458850",
        "4f3dec22-1769-4c12-a9f4-f7e12b7306b6",
        "4f4ed2b1-22aa-4b61-b3e0-9906fc3f03c9",
        "4f577540-c9c3-4e3f-97c6-caab5838b7bd",
        "4f5b1419-f1c3-4a61-bfd2-0d5f6cae7965",
        "4f81f90a-762c-4b6c-ab27-fb549b23bb7e",
        "4f8380a1-5423-4cf2-bad2-1d791bdf0e9b",
        "4fb83286-6b5b-4627-97ae-232b372bcd57",
        "4fc39793-5fbf-4866-8bd6-61531e925647",
        "4fd027f0-ac4d-4d12-982f-6eef7d443c21",
        "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f",
        "4fea6dc9-8c71-43a2-a67b-d5028408a4d2",
        "4fff1796-4634-454f-801e-a3d687f140f8",
        "504d0ff6-9c12-4e2f-9a7a-bed1a6351849",
        "50567481-5ef2-48c3-8c66-2da2f43c1d4f",
        "506be2f3-248e-4914-bd99-d3259ff4b68b",
        "5097b52d-190c-4b67-87d1-621e6cc3d41c",
        "50980852-705d-40cb-a25f-781f7f3c7f47",
        "50a803c6-863f-45e0-95d7-b01d3099450b",
        "50b481cf-70c8-4db5-935d-3c58174ea93e",
        "50b9ecaf-aee0-4ead-a382-77218247fd1a",
        "50bda125-8c23-4a30-a95b-8f915b61a1ec",
        "50cf33f4-cc7d-4627-8485-5cfdf4777bb1",
        "50dd6d66-18b2-45c9-b62b-6432cf66058f",
        "50f42a59-59a3-4532-91a5-f0e2bd4057e9",
        "50f9a64b-e484-45f0-9116-3e2cd5144b7e",
        "511ad0b1-1f33-4239-980b-7f4fcd2c1f67",
        "517a24c2-a53a-4d7a-9fbe-d4c85389e0df",
        "5180a509-e080-439a-bec4-ff8c171f2062",
        "51905219-d221-4808-be96-38fb2e471941",
        "519f0dc6-2384-4a23-8018-2370c897ac2c",
        "51bfe0d3-2207-466a-8694-7b03fe174042",
        "51cf6d72-2596-4280-8e0a-5b50930cd720",
        "51d5ecc9-f7cc-4d46-9566-b8f3bdce5a50",
        "51de363b-fb94-4182-a96b-1f560605c78f",
        "520528a6-c80a-4ef0-8a66-bbfc329293b3",
        "52067b4c-dd9d-419b-a4bb-d6a3c141937b",
        "5215aa52-36f2-4337-8585-d844795072ba",
        "5231b42c-f1b6-4882-82a9-88b7e05abdba",
        "523d0562-2ab0-407a-8b6e-8a56b69f91c7",
        "524073a7-7ac3-490f-bd13-c7d9d1d0fdad",
        "5244b9c8-d42b-4e95-b48d-65e4a445a1be",
        "5246aca5-88e9-4347-a2b6-53a1933225e6",
        "5258bd4d-dacb-4e1b-974f-e5061b84ae60",
        "528ca0f8-d3db-4f0a-bb5a-ddf8abf735e1",
        "52c04fca-0a25-45e2-bee4-009f55a52830",
        "52c10567-df42-4559-8a0f-f5be31e58806",
        "52ced4c2-a704-4fc3-a5b1-3e74df8cd433",
        "52f012ab-49d6-436f-8994-5e4733575be7",
        "53010d9c-75c4-424b-8638-69869fad53f0",
        "53116a8c-0f2e-4bec-8be3-a98a6c4c61c2",
        "5324e68c-be91-4145-820c-a1c25c43b426",
        "53328b4a-1f74-4cac-81c1-2c31561624af",
        "53336d29-5ca2-48d3-8e2e-4c76d7a8356c",
        "533613ea-870a-40e7-80e3-4d9f16aa52c5",
        "535899ec-ee66-4606-bff4-66d3cf45f543",
        "5381a14f-f782-49a4-9c2b-f49ca15f6612",
        "538cd735-4f4e-4aec-9625-70939a8646b1",
        "53a3bf59-9c4e-40d4-9d39-fa99fa7f8ab3",
        "53b29503-319a-453b-bb02-4239c494ef2f",
        "53c0d457-924f-4879-89c5-55e547852257",
        "53e6a0ee-b3d6-430f-b421-76672523c510",
        "53edfe54-a14b-4674-8f78-fc8b9ae07c5b",
        "5405a809-8d71-4e23-b866-bf219cd0971d",
        "542da220-7e50-4ba0-8b03-ab76edafe252",
        "54357e30-887d-4e2f-b4b7-42009ee787e2",
        "54520091-6f97-4c6f-a3f3-b2ceaa8e9a86",
        "54561f46-70a8-4d71-a94d-721b4813fddd",
        "54638666-6110-44a7-8a9b-e297f1d6492e",
        "54819d64-1874-471d-a826-bd04661eab68",
        "4c797086-6591-4e50-9559-68c1bf62663b",
        "4c806047-c736-4a09-8d94-7e1fcba827ad",
        "4c89845f-4e4d-4893-8094-9926408ec707",
        "4caa45a8-604f-47b0-a4f4-f88a9e322b2e",
        "4caa5597-f61b-4c7a-bf34-4b9c714dfde4",
        "4cc73820-09a0-433d-83b8-35508b35c05a",
        "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8",
        "54ce6812-d431-4699-9b08-405519d17ce0",
        "5927bfe2-d4bd-405a-8bc5-1000abac66dd",
        "5945efe8-5909-4f2b-baa6-fba1bbfa3c1e",
        "5956d40b-f66d-4a8c-bf51-e657fdbf2638",
        "595f3b05-bf98-4e79-bb10-be8202c3e90a",
        "59786dbe-9ddf-4a36-9839-06dd7dc8010f",
        "59be737b-9a97-4a55-b14f-2a28c5dafae7",
        "59bf90e7-aeea-4668-afa4-9ece823c2565",
        "59c64b7a-0298-49db-90a1-c11f5c7f572c",
        "59dcc66e-67e1-48a4-beb5-c49194efdbc5",
        "59fdac62-85d4-4311-a8f9-86d29e5eab9c",
        "54e1ed44-7ecd-4086-8d72-bc24ae6932cc",
        "54f0060b-c39c-4d0b-a68f-67d2b1e44466",
        "55358aa5-14bc-46d0-a9e3-e2c4a699ed86",
        "553f3efc-3702-442a-89ad-d66b8ac18a01",
        "5541d43b-d125-4130-b0d6-5c72198a97f7",
        "555a5727-8371-403a-819c-9c9ef15b9bc7",
        "555e5783-b23b-45d6-9f13-23256e013b91",
        "55640ced-f955-477c-a1ec-d4d62a05da07",
        "55647101-77db-4189-a8a1-101ed0b76c33",
        "55748a60-a552-4266-856c-624b1c1664b6",
        "5577e910-c742-4163-b07b-285c20307e49",
        "5592cf14-86f7-47cc-87b0-4aeea6e000c6",
        "55b12daf-797b-48e2-bc7f-d0cc8a264132",
        "55b3ac70-7fcc-46b9-9f3d-2bfe6e0b1a0e",
        "55b689d0-366f-4265-a980-2e99a7165c2c",
        "55b6c29d-c17e-420c-bd83-23613bb382ea",
        "55d84635-4ad0-4cf9-9425-4ab32f7eab97",
        "55dbeb8d-a7ef-4453-bab5-553717c69afe",
        "55f4a805-0e10-444c-847a-cc6e43ac19ac",
        "55f6db31-a787-42f4-844b-8c1e18058cb4",
        "55f70b02-b718-4111-a329-d4b14717efe9",
        "560a9887-c367-4707-8db2-d53e751d5249",
        "563140d2-7b45-4fef-8256-9f64ff90d808",
        "563c8f5e-c1c0-4b94-ab5e-b03394b03eba",
        "563deeb9-566c-473e-a801-137b599eba13",
        "56527af8-fa31-4bd8-b0d4-876c26f80f0b",
        "565c4ffe-4b57-42f8-9324-e2d9d64629fc",
        "566bc5fa-94ca-41cf-96c9-3654cab23c0e",
        "5671e4e6-1591-4536-8760-c25c213b2d05",
        "56787d14-da1c-4a85-8097-8d6a56fb1465",
        "5681e502-a3db-4269-a9cc-af9627cf5a7e",
        "568df591-5fe2-47a5-aff0-3691ff31aa2e",
        "568f2395-87d2-4ef2-943b-bb63035eeab5",
        "569c1828-7763-4162-95a7-9b797018e98a",
        "569e2af4-8cd2-4535-bb5e-d55d1ebcb650",
        "56e012a3-338a-4b29-81a8-fe87ab0ad664",
        "56ecbf9b-0fa1-4848-a911-d53054931fb0",
        "56f2095e-dd92-460d-9152-9699725b735f",
        "572c924a-4ff6-45f0-8796-d5d4e5a73ae4",
        "574a6230-d6e6-4674-84c5-7e532a0ec44b",
        "5763423f-81db-4068-95df-9b32e1869a34",
        "577ad76f-1495-4e7a-af7a-879a6d351d48",
        "5791e738-a30d-48a2-9b86-03474ec2c92b",
        "57c91f59-2368-4728-a7f2-b949a363d5ab",
        "57faec3d-b5d9-4a69-b538-3fbea64b910a",
        "5806d3e5-2bf1-4869-bce1-7e4f497b57de",
        "580da860-81e0-464f-b577-807e8bfd81c6",
        "583551c9-1851-4bcf-9d8e-8025184e5c1c",
        "58645350-32db-48b3-a582-f145aec556a3",
        "587c076e-8763-4f1b-a514-ff354a95336f",
        "587c77c5-0284-4fcb-ac12-941b451f0839",
        "588885e3-e20f-4cf3-80f0-a1eea4612984",
        "58b40f4e-68b4-4fc8-a200-68e77bb8edc6",
        "58c946d3-1cb3-4c7c-9ac8-851a0a06d2b7",
        "58cda575-4932-48ad-868e-3a0e8485ba52",
        "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1",
        "58dd5786-9350-4694-9c8c-0fc087a8e4dc",
        "58f7e4d7-170e-471f-a717-3ea4b2272731",
        "58fa9094-a3f2-4d04-803c-b746f85190aa",
        "591147f0-8315-435f-83e5-84fd4fef1fde",
        "5913e667-6834-4a1c-9324-316ba191e163",
        "5914d3ef-0847-42da-848b-5cd776c93d22",
        "54920cd8-739e-4968-97fb-cf828a4c7331",
        "5498e92a-5ce7-45e7-a0a4-ced152438ad9",
        "7b716383-449e-4e64-9fce-14bc87a022e8",
        "7b7424b8-08cc-4005-b89c-7e39e26381c3",
        "7b958777-fc99-4d6e-8a7d-6eed7c5e10b2",
        "7b9b6a6c-1e79-489e-8a53-67d189edf14a",
        "7ba55d2e-654a-4d89-a88b-df354228cfc1",
        "7bda2b0e-faf7-40f0-8a45-68c8bf0e822b",
        "7be32168-1e58-4ae4-a94f-5af9f80cf1a8",
        "7c0abbb2-5593-4810-a5c5-31265130fb8b",
        "7c0ebb26-324a-4ad9-8b3a-d04086f80f50",
        "7c0fca56-56fd-42b2-8e2c-85a4bfd3e81e",
        "7c51f638-65c2-4353-837a-afdb29fdb1fe",
        "7c757f99-962b-4e82-8df3-26dc54e5c022",
        "7cc227dd-e28c-4dd2-8d28-03902ce7080e",
        "7cc79a6c-a725-4f20-9177-ddf6b2ddbb93",
        "7cd1f88c-97be-4ae2-86ab-1b09b9942f94",
        "7cd8d145-14ed-4646-ac26-5075e65f66dd",
        "7cf5ee5e-1b98-40a4-a4bc-a0ad3670b3fa",
        "7d03b96d-9d8a-4e91-962c-229144d39da6",
        "7d0b0517-61c9-415a-a94d-38d4dd7f85d0",
        "7d1958e3-b6fc-4141-aad5-d70d1fba324a",
        "7d2a3158-36e4-4b89-9460-9a619a0aef93",
        "7d3718a0-d6d3-49bf-b002-006f400865e8",
        "7d5381a4-a535-45f2-ba39-bf2f128801e8",
        "7d5d556c-a297-4f36-8fc1-6c4bb0c2054f",
        "7d685412-2983-4cfe-8fe1-12224a7bae12",
        "7d85bf07-a678-4be8-95d3-c58e67e7430f",
        "7d905aa2-5186-4a04-9779-653181a75c8f",
        "7d99d2d7-9936-4b6e-af3f-30a51291fd80",
        "7da17858-d364-463d-914a-9461263d7f75",
        "7da751d0-1840-4c39-8259-3ad3e7ea0d44",
        "7dac57e4-46b5-4b14-a7b2-150037cc5461",
        "7daf0a39-9f93-4bda-81ad-e20aed84e861",
        "7db532c5-1e24-4e3e-9113-9bb19676a6de",
        "7dda97d8-497d-466b-b2ef-6280badfe291",
        "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8",
        "7de9e55b-c147-4841-b6e4-03de92cacd47",
        "7dea5445-ba99-4a75-a06d-7c46714e2547",
        "7defca8e-e197-4db0-816e-71a4493a23b7",
        "7e015bc5-f427-4868-86bd-153f6ec450b3",
        "7e072abb-f899-4944-b088-69272d7c908c",
        "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c",
        "7e2439e6-25fc-4f28-b254-b487493c7d6c",
        "7e2cc1d4-6514-468b-a205-ce48381e4959",
        "7e3b2725-1a1e-4fba-be4f-42486d048d49",
        "7e3f09c1-0f76-40ba-9593-3d95965c3678",
        "7e46fce4-da1e-4ba9-b57e-ec280d0f9dac",
        "7e57baaf-2ccb-4ca7-abdd-41bb0da0aae9",
        "7e60d0b4-4e2a-4a67-ac01-f5ed598961cf",
        "7e81413c-ae9b-4e7a-a6f9-7288ecb2e92e",
        "7eae09d9-7eb9-4310-a48f-cfaa375f0cd3",
        "7ec5f6d6-46a1-4d8e-a0aa-a8db9a25b114",
        "7ee0f868-38cd-41d2-84a9-0b2f4783eacc",
        "7eed6dc3-61eb-4c15-8967-77a178230a43",
        "7f12032c-a56a-46ee-88bc-2de3c55f7b85",
        "7f43f0de-e1bd-471e-a57f-9c63c60e71a9",
        "7f4f31e4-ad85-43e9-9721-49577d4b2cdd",
        "7f783198-1232-40f3-99e9-a704114f04b9",
        "7f8da2b8-a073-4f87-8b70-c574c635c8dd",
        "7f948334-0946-476c-ad95-99136f2f72a5",
        "7f969ea6-b248-449c-aa8d-2f8513a70f23",
        "7fe6f281-6853-43d7-9db4-8407c11c3ee5",
        "7ffc02a7-dc0f-444a-ba4e-ad7094421d73",
        "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f",
        "800f0195-4b4a-417a-8762-278789badf8b",
        "8022a7f1-9191-4326-a08a-5165c75d90c1",
        "803ebae1-65ba-4079-b13f-2acecc905c54",
        "80615f39-4916-4762-a97c-c240c4ed5468",
        "8061b0da-5cbb-4931-8c69-bf8bb864242a",
        "80664cc9-c05a-4be0-9130-282aa66affa9",
        "80693fb2-ed5c-4817-bd4a-ee976b3b4d14",
        "80815d31-2f2f-487d-bc7a-2d9ee9bb06da",
        "808994bb-0c1c-4ac7-bedb-134448854884",
        "809adc1e-a0a4-4eea-887d-e4ddc9aa5a65",
        "80ca859f-b688-42b9-9d23-14db43d2e9ca",
        "80d1a811-8623-461b-a633-9e721bebd27f",
        "80dad638-de8f-4409-b2a4-cc87b965d6fd",
        "80fa22c6-b071-4bd8-abae-953c3c3cf900",
        "8103e1bd-bbdf-475b-a87d-eaa08100a211",
        "811a5467-8fa0-46f0-a1b4-9f28c1d3640d",
        "81256973-92b5-44f1-96e8-826860be431c",
        "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e",
        "8146c997-29a5-4db5-a7ac-7bb3a61243f6",
        "815406bf-4ba8-423f-9db1-c4e1ad99456e",
        "816fd62c-9f38-4b13-b540-8ee64d1041c7",
        "8193a07e-028c-4c81-bca7-18c6d43df608",
        "81a35abe-e605-43a6-aa12-0ec3de52f177",
        "81a7eb0b-c5c2-43f8-b5ec-ad3dc856af0e",
        "81b5bb7f-030d-4cda-8b94-36e749336b6d",
        "81b7b82c-6649-424f-a184-b073f745f292",
        "81befa31-1238-44e7-b42b-0333669f29c0",
        "81d1422d-1452-48af-9ac5-9769e2ca905d",
        "81d2da44-38bc-495b-9aef-d57b50a8fc23",
        "81e41371-2f3b-440c-8119-ae8b8842632c",
        "81ee7048-c647-477a-ac11-ad8d547799cd",
        "81f0ad90-83b3-4681-b141-d72e431ebc4e",
        "81f83158-4ffa-4e50-9b99-145fbee35a07",
        "820a995d-9ce5-4501-9244-e8918210c808",
        "82471bb0-9046-4440-a8dc-37890ca0c50e",
        "824c81c4-50dc-4703-84d4-104cd9579397",
        "82553659-a2f1-40ac-bc98-be995101306e",
        "8261c903-4bf3-46ed-8f79-7f88f7551fb6",
        "8264ff87-571f-43d0-9caa-a89f1e83dae2",
        "828839f4-453a-4b8b-ba79-7b56f7497573",
        "828fce15-6771-4003-8b81-5a027c4db552",
        "8294193c-a4d3-4d22-b485-3e82a845eb9a",
        "829ebdc8-c42b-4ec5-b479-77759f48bc0d",
        "82bcc744-04ff-43bb-b6bb-d975d0a7aa3a",
        "82ca60f5-e4a1-4884-8c30-1e36eadf5894",
        "82ca70bc-ead7-47d0-9fdf-5272e6fbc4eb",
        "82eaa627-93ec-43f1-af73-c6a3a08c4f2f",
        "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64",
        "82f0fbf8-a97b-47e9-a03e-50086fa27ceb",
        "8341a3c5-ab4d-4022-8717-f8dedb7da553",
        "83851c99-d7e7-434e-a3d6-20649dcd8c1c",
        "83947ba5-9878-4f54-9941-1279aa91f062",
        "83bd870b-2735-4ee8-8b4a-544f2875ef01",
        "83e8332b-bb2c-4d5b-9515-755ea894b71c",
        "83f3cb6d-ec81-40dd-9b99-45cc7ed0c615",
        "840d3707-b701-4b2d-b436-40928b79b769",
        "84155b1a-690e-4ec8-850b-4b669c05de00",
        "842fee5c-1e26-49f2-b3ad-b7e78af8db4e",
        "8434d954-9882-472c-bd22-fe985107f75f",
        "843bdf9e-45fa-40cc-9c6f-8eaedf0d6a76",
        "845e159f-4f2b-4fd2-b320-7ab54e7424da",
        "8470f6f6-73bb-4a72-9f31-ec66aee3a802",
        "847dc334-3b46-4640-8813-a8e18f87e905",
        "84a8fb43-f833-444f-9cb3-364b27f16cf9",
        "84b803ee-6787-4b08-a193-f66c2fd6017e",
        "84c0dfef-722c-41ba-bcfe-5f474116f429",
        "84d825ad-abf2-4a39-9b3e-d6ac88a92d7c",
        "8501305b-7353-4327-a857-75c46dcafada",
        "852d10b4-67c4-4176-a084-b53f32263af6",
        "854860a4-f015-4823-ad39-2443cc46f989",
        "854d95d7-bd1a-4270-a7b7-104005ba715f",
        "8565cac2-391e-40ec-ba7f-cb4ffd4424b1",
        "85b716b5-46e1-4491-a4b9-666bdcb3fd2d",
        "85b9dd90-4479-4f2d-8f80-753902a67fdb",
        "85ba459f-d919-41ee-a7a9-18433198a07b",
        "85dd9f4d-0cbc-4541-acb2-d3b9b44e0972",
        "85e01f5e-7893-450c-839a-a96a1813bbe4",
        "8606edbc-87de-4c60-a4d0-9e63981b4040",
        "860d14d1-9b1b-4d57-b30e-07c528229729",
        "860d5bb7-2ee3-4c89-81f8-7c2e6aa307ec",
        "8623f0a9-b348-4e3b-89cd-b3851a380e0d",
        "86346026-80d6-4d5d-a62d-c79581392911",
        "86568eb5-1690-44e7-8b39-329d77e9223e",
        "86596e0a-cc5c-4c2f-b11e-28f00f759f8e",
        "866da63e-428d-4970-9792-a820d4e257cf",
        "86879e61-73b4-403f-84c5-310a91f84cae",
        "86924018-7f22-4748-8180-b61a2cdfc2a4",
        "86af3958-2c1f-412a-ac76-6745d0595db6",
        "86c91669-4477-4eb1-84fa-3a8d6d429c70",
        "86ec9671-8b26-4627-a019-16c9b0f017f6",
        "86ed8269-5ab0-4871-8c9d-b6a3a0b6bd20",
        "86f4f90b-f617-4fb7-81e3-d9f66d1e1703",
        "86fd562e-1f31-4a00-94ba-44353bfaee3d",
        "8703a7af-7ed5-40ef-a588-f3528d476d8e",
        "87188d9e-b3c2-41be-9abd-37357aa80ef5",
        "871adafd-8c53-4427-83be-43aacd45bb10",
        "872e7573-23b0-4ec0-8823-cb29770f134c",
        "874b78d2-0be0-4d30-a064-9483f7c98c09",
        "874c3ee5-7f36-43bd-8558-51ffd9bbbeef",
        "87529254-1e12-4645-934c-4d800d5b0e62",
        "8768cfea-b589-4d7b-a112-da578f5cbe52",
        "7b21ba3a-8b14-41d2-9094-dd30eac9583b",
        "7b63c3ff-a6e8-4662-b601-2007b8b996d5",
        "7b6e9221-3fc8-4462-bbb2-6c50229a2dd8",
        "8856febb-99e4-4cdb-8645-8cbf121ef898",
        "887e3ec0-60c3-4ffd-ac93-5b12337bf591",
        "8886ce2c-8516-4896-a7ab-0068713bfe0f",
        "88b4ca8e-6f7b-43fa-b814-ae0226069fd3",
        "876f892e-c766-4bf7-9684-13cd41f9c040",
        "876fe42e-7762-440a-99c6-364250ad16db",
        "87719abf-1d76-468e-bfbe-4d5e5d7cb631",
        "877f6ab9-ccf0-42ac-9f05-44275b72e031",
        "877ff2fa-3188-40bb-868b-a1f88c820384",
        "8784f25b-a4fe-49c0-aec3-2ab4ba363899",
        "87883146-ad4d-4f03-a68c-6bcb62e5ac33",
        "879302f7-417e-4e7e-b442-da6e5031a28e",
        "87bdab38-a87f-47a7-95fb-289236d7213d",
        "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc",
        "87ca8729-28aa-4277-ae38-37bbfac40107",
        "87edd959-f5ee-4510-984a-de5e94b7f17a",
        "87fd8291-894a-482f-924f-ecf380a6b168",
        "88016bc4-32d8-4255-b8fd-47a3fb335888",
        "880850ad-6944-49b3-b9f9-f1797354040b",
        "8815eaaf-e979-480d-94a0-a80a835675f3",
        "884f91be-f505-4295-9bfc-be2712272a13",
        "a3be6c3a-ca38-4798-b242-d5855b2d093b",
        "a3c0e66c-006e-49f3-a08f-99a6588946bc",
        "a4117bae-9a8e-42e2-bfe6-ffb838d4166d",
        "a4217b21-31dd-4c10-8ac7-90bd25fa1c01",
        "a427f127-8fb8-488a-8f54-7e0dee36a8c1",
        "a450f635-9d7e-4b4b-8917-c7503eb90fe6",
        "19e05dca-9d37-4756-95ce-36e42f3fab8a",
        "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7",
        "1a5b9a1d-1d42-49dc-8e7c-7eaf93744fc2",
        "2baec49c-7411-49f7-8a70-418c5d125fb9",
        "2be1721d-38ec-4754-a797-74a00ff28ff1",
        "2beef19a-588d-4970-9ded-ac4d7e4dc6a9",
        "2c2c2aae-0ca5-46d9-9288-d9b5d2327e76",
        "2c2cb467-901e-47cd-ad1d-a6f874e84caa",
        "2c4048b6-0bc4-48b4-83d5-32b645f2cd75",
        "2c485856-f5cd-4b31-82ef-7ae3a0faa6fe",
        "2c723aa7-c241-4fd5-9512-e99dcf57db6b",
        "2c98aeb2-9981-4525-97a8-b9ba288753a9",
        "2cc6d78a-9db7-4e1f-b9e7-3885675ce14a",
        "2ccdb0fd-0afe-4f81-ade2-e29f48754a96",
        "2cedcb74-3d55-411d-b2e8-2ef8f715b2fa",
        "2d0a95cf-2756-4a4e-95ab-c9daaf940289",
        "2d0e5945-f58a-4244-9ce1-edb07e97607b",
        "2d1841f2-fdf4-4221-98ca-2e0296cd62c8",
        "2d23a221-ed87-4386-be0e-9d2b7c2b40d2",
        "2d32f1c7-0660-48f2-8aae-b70b112cd232",
        "2d7d8566-f4f8-4e85-9b38-227346f01e00",
        "2d7e0be1-e6a3-44c6-91c6-d164ef4d2361",
        "2db00b7e-ca70-427f-bef0-6df2b08f15bd",
        "2db01ec5-f4da-4e5d-a302-83e9520fc3c8",
        "2dbda06a-1e79-45a3-8484-eb0848b14dbd",
        "48329e94-0548-4475-9626-c61048289e1a",
        "2dc2d608-e5ba-481e-aa33-7a633b77b68a",
        "2dd70b37-da0c-430b-9c46-76f04401801a",
        "2dfc54df-b84a-43a8-9e2a-867b1ffe1c64",
        "2e2d8bf6-4a73-4639-964b-c9d87954ce78",
        "2e324721-9240-4849-bf53-109c02c29de0",
        "2e360864-663f-4d23-b14c-a77433dec78a",
        "2e4badcd-6548-4c56-a9df-57ec4ce1da91",
        "2e6823f5-bd0a-4e08-8cfb-a7b929c2d918",
        "2e699bbc-813e-450b-b662-34f5053cea91",
        "2e6eae5e-186f-4c97-af60-099a379b0dda",
        "2e6f7c76-6585-4bbc-a83f-6e19eea06b13",
        "2ea749b7-b527-46ee-8a50-c7db1928909b",
        "2ec59c68-6eb2-4abb-8823-c19072ab0303",
        "2ec90d5c-8935-4253-8afa-94c20a3843eb",
        "2eefb93f-1c88-4271-8d6c-a66490c9e5cb",
        "2f053662-74fc-42ef-b3a3-2fa73ac1b3fe",
        "2f10b443-2ec4-4cee-ae0c-0ca0ff58764d",
        "2f1818a8-ca61-4dd3-bb27-72aa92b76bc9",
        "2f19340f-ecdc-43ba-aef2-711d205c4637",
        "2f3f685f-316b-4c18-b5fd-b89c9222cc21",
        "2f5a8c76-dcd5-4378-8f8a-d67f06a0740a",
        "2f5b8b89-94a3-4628-a30b-960343a362ca",
        "2f70eb1b-7ab9-41ec-86e5-edb25faee6a9",
        "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a",
        "2fa04fa3-0656-4684-984b-01c9ad0221bc",
        "2fa65e0e-0d5a-476a-b2d7-cfff196b2212",
        "2fc381b5-8010-4b70-830f-f35b70727829",
        "2fc3cab1-5eeb-4122-9009-f42e7e74741a",
        "2fceaa49-b145-4635-bdb2-5a78a1be861d",
        "2fe01a8a-4459-4e37-a8e7-cc66c2f0cfe3",
        "2fefcab0-54c8-458a-82a3-aefdbd914f77",
        "3029968c-872f-4c3c-92d5-9d2366098294",
        "3033da9a-8ae9-4c29-9bc6-c14d1ab7a55c",
        "304024b3-fb62-4d07-b19e-a188371d4595",
        "30468716-a260-4170-86bd-60bc0833ed00",
        "304a9bc5-049e-4268-8016-11f8069a7db9",
        "3055c50c-7479-4414-b174-dd3e02e1e3ee",
        "307faec9-f4e3-4079-98ec-137064ae3b78",
        "30a1748d-75a7-484b-b8d6-13501cbb2813",
        "30a70c8e-8eef-480a-9446-240fc7c2b247",
        "30af3494-869b-4724-aebc-fe68f4ba22d8",
        "30bea5cd-d921-44ea-ac0c-a5f1f144ff77",
        "30d6c52a-5c92-4505-8abd-bf6e97806177",
        "30d9e97b-9e0f-44b8-83d0-86c0738030db",
        "30da3ea4-fff3-41bd-8456-2029089a03b9",
        "30dccd46-a9d6-42fe-818e-296ed1adac7d",
        "30decfaf-23a6-467a-b00c-5503fdd5773a",
        "30f0a968-3cd6-4592-a9bf-9d05128a3167",
        "30fa38fa-5bf3-4fc1-a6b4-8a6e9dd37f40",
        "31230b62-1148-43ec-a8d2-7620c2e1bf7e",
        "31304c63-7d9b-485e-8f45-b9a73aae1499",
        "313a9f2e-227a-478f-9ea4-cd9683a98970",
        "314e09d6-38e7-47ab-a389-a780a4d6b945",
        "3160e550-5866-4012-b6f3-f31dff5fd007",
        "3189298a-a97e-432a-84f4-398c6ccc2c72",
        "319f4a0d-2d34-4f22-bbfc-58424dcb1603",
        "31a6fc8e-7bda-496e-83dd-46b603fd4088",
        "31b6a99a-c24d-4a9e-b3ae-a75f34c11393",
        "31b78323-dab0-4afa-a052-b59c8f2061de",
        "31ba2612-b0b3-4e51-9243-f09c1fbbe023",
        "31cccb39-94e0-4c04-81d9-ef76961da93a",
        "31d60c89-7214-4947-844a-b38135d996e5",
        "31d61675-d604-4840-afdc-d65cce68bd86",
        "31e6ae8b-ea82-45bc-8316-0ff879a7bcd6",
        "32140fe2-0589-40ad-94d3-98d52c3b24f9",
        "48375426-e110-455d-860c-e2953c760f9a",
        "3217f544-c69d-48f8-bdef-c97871addd16",
        "3218e47c-7c52-4464-bfcc-e249bdea8b07",
        "32317cd2-8780-41e6-a8e7-cbdda65ac13e",
        "324daaff-49e3-41bb-ac3b-bf17d27e38e2",
        "327b1b17-bbfb-4aa7-a452-f7ba31c2d957",
        "3297b825-fc9d-4b6e-af9e-7d0569721292",
        "32a54828-0e81-43b4-922b-711af83a593d",
        "32c9a8ea-f212-440c-9c5a-8e4086228b43",
        "32d3f124-05f4-4774-ab5b-83132b946ceb",
        "32d88c53-4176-4ff6-a585-a95caf89022b",
        "32e0d84c-2789-46f4-9ca4-129498c87caf",
        "32edeae2-11e5-49e9-bdc7-92aef1fb3ceb",
        "33557717-fb93-4cba-9541-eba0bbc8a3f6",
        "336a9f4a-4b69-4be1-bbe7-100b13b71fba",
        "336dfe5e-dec6-48c2-b21a-6b5c68b52fff",
        "339b58f0-37e2-4844-96a4-6327616759d7",
        "33c28134-c1a6-4883-a2c3-6d720255eea4",
        "33da3c59-94f1-472a-899e-8addc0652355",
        "33fe8d66-c7e7-4fef-b9ef-32b57ebee408",
        "3407c654-35af-423b-8cfd-4140bf3f8285",
        "347d0bf9-1df2-48d1-9107-fa5670313175",
        "34ab818d-3348-460b-8bf3-4255fcccf7e9",
        "34bb618c-e523-4612-b636-29309f2c46e4",
        "34d69ff8-6563-4039-a7e7-4e6d174190a9",
        "34e6110d-a1fa-4c19-9a80-8e240469d760",
        "34f79dec-e483-46ab-b558-33107bdc5092",
        "34fdeb55-3a3a-4adf-99b3-2a845fdbba50",
        "350a0574-10a3-43f0-a03f-dc8afc06dd19",
        "351b43e9-c53f-409c-8aaf-50fa46cfdcec",
        "4853f410-66f0-44f6-bdc3-f1dfe4c5ac1e",
        "351d3885-9b80-4c39-8f3b-3fd6c71db84d",
        "352009de-affe-4229-a504-8bec9789a5e1",
        "352e2f5f-79f8-4792-b11c-2ced156f06b7",
        "35654fc3-59cc-4cdc-bb23-76133e6643bc",
        "3570cba7-a168-48f9-9704-abf54f4c26ac",
        "35985de6-b284-42e2-a9ee-439159acd05c",
        "35a014bd-5f4b-4f2a-9128-5ccf6b8e4aaf",
        "35b54b87-657f-4622-80de-729fc9498f19",
        "35b965e3-6836-4d68-8e5d-249ae30b8b0d",
        "35c1ff16-98d2-4e9f-98a6-e84fc51c9405",
        "35ced6c3-3884-44f6-802d-a9a84a8eee6a",
        "35f7eca2-ccce-4611-a29a-fec82b985260",
        "3602626e-d793-4371-9d01-4bea16003ee2",
        "361a90b9-ca28-4e7d-a95d-33d56c997ff3",
        "362cadb9-754d-41ee-8f72-7850237e25e1",
        "3637ad68-a7a9-4734-acb9-7bcd7c26d37a",
        "3638a378-7a3b-4f56-8766-979250c5192f",
        "365bb562-ff08-4696-bf4e-da38441f6256",
        "367891b2-f226-4261-868d-23f471eed1d7",
        "3692ed62-82cb-42b5-8620-7975d1e50dff",
        "369ea41f-c334-48eb-90d5-8544803c68d5",
        "36a00551-6e7c-4384-a7df-db0906b7ec17",
        "36c42851-a1d8-40c5-b3d8-7b6bacba4fbd",
        "36c46d40-d57b-4daf-b06d-9fc087da666d",
        "36db62f9-f0f6-4d56-aa76-97272aa32889",
        "36ecce89-1d99-4293-acdc-afc4b16c1f74",
        "36f6b08c-7a59-4011-bc93-ac608f4b304f",
        "36fd20ee-c6d9-40a4-8a1c-12c08af90df9",
        "37074295-0e8a-4c59-a420-a56876f2ab0c",
        "37240b83-aaae-4410-9141-615310ce7ba8",
        "372641b0-28cc-4e3e-a1ce-2ac692061528",
        "37330a26-b35a-44ca-9fb0-03e51cbc7045",
        "375b6a7f-35a8-4df6-9204-f3c28f296166",
        "37665345-af4f-4243-b58a-d7f045290c8d",
        "3766b074-a022-45e1-ab93-aaa91d8aa953",
        "3768d45a-b444-4b01-9b0e-11b6551a3316",
        "37797edd-9c21-405d-b633-078a1f7d3d34",
        "378436b1-a54f-4654-a0a9-2f3b7b9064f7",
        "3786dbfa-945c-46c8-9cab-d5f011158c27",
        "379bd734-dc85-4e0c-b682-da7d4cb5a31c",
        "37c34d6f-7f62-4530-9d96-94d629384a9a",
        "37de1f95-97fb-447b-a806-8b895414a4d8",
        "37e1056e-33e0-4667-b0bf-0056838bf2c5",
        "4854042e-a70e-44c6-ae47-5f7ea33bc11e",
        "37e31a0d-7e32-4cfa-ad51-f314b861bb58",
        "38065d2b-00ef-4414-863c-d02ec5a0f5bb",
        "38274df5-5837-4462-8c6d-6aade6e3ddae",
        "3870a109-2465-4305-9040-dad1eb17457a",
        "3875c4d5-69d6-4611-8fde-d5b3eca2d481",
        "38994767-2a3b-4549-ab7c-599b8344c871",
        "38ad4bcd-44fc-42b9-a35a-a11200b872e0",
        "38bb154b-3c7e-4bcd-b8c0-15e9f7da7553",
        "38c619a1-1e6d-4cff-8289-6db54878f8b1",
        "38cac964-8e21-4207-8b71-d7ad6beab383",
        "38cd7ba2-28a7-4d5d-b1da-fad57afd89cb",
        "38ce1f0a-d1e3-415e-ab6e-5d01baa6925d",
        "38d8f7db-255e-4aed-8868-c042f71986ec",
        "38ddf8bd-6853-4022-87af-c79ca21bf862",
        "38e4cda0-a94a-48e6-8e7f-d8a0cd9c34fa",
        "39145d9f-9c43-491b-a61b-d76ef3bc9630",
        "3924e696-111f-4c13-a24c-af4325a0b3a1",
        "392814e2-ab6b-422c-8458-9808c4a23524",
        "392e7090-acde-4040-83af-77c68023a7d4",
        "393b0146-18dc-4a40-ab4b-8bd52afe294b",
        "393e63a6-c5fd-454b-b548-1b15eb0f2233",
        "394dead1-88b9-4d51-a5e7-39d4d110278f",
        "39635f6a-e38e-4e31-9438-2b240e2ef8e1",
        "398206b8-76cb-44c1-862b-f088ffa9436a",
        "398672ef-0081-42c2-baf1-8e2bea5b4378",
        "39914e89-ca73-482d-98a5-48df1ee15164",
        "399a5f26-52dd-42f4-b4c9-94ed8af90136",
        "39a7237e-66dd-4d40-befa-a317ad3815ae",
        "39a9a7f5-ca26-432e-90bb-5335966d170a",
        "39c203c1-e2c8-4db1-b9d4-eada9841d254",
        "39c64e7a-4075-4cc2-a526-2adb86e19274",
        "39e12322-ccfb-4f41-8c25-bd4fd478af00",
        "39eaefb2-5695-4868-b246-1d81766a35d2",
        "39fb0758-e0cd-4e3a-b549-60c5bba64e23",
        "3a10d783-5d15-489f-9c54-fa16fbcf525f",
        "3a190b27-e968-4393-a29a-faeffd7e1b39",
        "3a377662-d2ec-4a85-b0d8-e6a924d8fac0",
        "3a4a8295-e04c-4272-9cde-601de631890e",
        "3a4b50ef-ee7e-400e-ba26-5468d633c1d2",
        "3a4dffc9-a835-4796-87cc-c5328404fb50",
        "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb",
        "3a5a2066-287b-4dfe-a0e9-bfc6c5172ee0",
        "3a627350-d649-4f1d-a19b-c8cfebc01f59",
        "3a74e3ec-bc06-4227-98a2-6a545a300847",
        "3a76b358-595f-423e-89ac-16db48781661",
        "3a896bad-2370-445e-ac32-cde9b1921b88",
        "3a8d01fd-d78b-48fc-8c69-346588d5de7c",
        "485fe0f2-bad7-41b7-88ae-841af641fbdf",
        "3a9d4254-c67e-487d-8ae5-7225a22b1f41",
        "3aa1b645-0789-4626-8c97-1f550c542284",
        "3aa752bf-b130-4409-bbe2-4671835d48bf",
        "3ac120fa-faa0-45a2-88ba-09516bd69d83",
        "3b396ea3-b7a2-4173-8e1c-67ca341b47ea",
        "3b466ea3-8f30-4112-ac0b-5d142a612895",
        "3b4ff086-7118-4f90-9311-c44c18aabd68",
        "3b5a5f8a-9292-4c30-ad09-23146d7c9310",
        "3b745d30-8f6d-48e2-9d99-f13518b5f53a",
        "3b79f797-8fff-46fd-b322-e7e1a0458a1a",
        "3b937216-560d-4252-ba9a-eba98a218e06",
        "3ba022dd-3e45-4df4-a3a8-a8e69ea32934",
        "3ba826c4-5e60-40fc-8fdd-c805a95cbbcb",
        "3baed10a-9696-4362-8a33-5bf366181e6d",
        "3bb5f6fe-a8eb-4607-8fb0-a8f38b6d01a6",
        "3bbe87d2-7f9c-4362-977a-f9b2228bc388",
        "3bcd0e0f-e27a-4a4c-9dcb-832d349bb6e6",
        "3c0a2c98-ffd9-47ba-9160-70231990d56f",
        "3c3e31ae-073f-4d88-93d2-d7766f0b2b5b",
        "3c4d0d6f-bbad-4f19-9743-a23057a40d03",
        "3c55ccb6-454b-40a0-b670-4ccabfa7f956",
        "3c7fbd8b-2ccf-49d1-80da-495164b9e28a",
        "3c8cafe0-a307-4210-aaa5-486400336de9",
        "3c9140e0-cff2-462d-959d-356cd29c72b8",
        "3c9ccfa2-f47f-4094-9a82-3f2836f41b47",
        "3ca24a24-40fc-4996-a082-750294bea03a",
        "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55",
        "3d012200-628c-4e20-b64d-4676db69c066",
        "3d12438f-6237-4934-84dd-55793664fa08",
        "3d2203c9-122a-49e9-9bb5-61077c5ea0c4",
        "3d2df0c9-af3e-41d2-8ede-a6107489bba1",
        "3d369482-8093-4a5b-bc2b-33ddd96d461c",
        "3d678463-5201-4317-86b3-d2e1fbd816bb",
        "3d854d81-cb96-4fa0-9608-93b76177a223",
        "3d9dda7f-bd95-4453-9d38-5f8b36a2b20d",
        "3dc3a86a-afa3-4862-b38b-d6c794a848dd",
        "3ddf563d-eb86-42cd-8912-b29ca5e2c7e0",
        "3de5594f-6a9f-4559-8639-5df90e2324e1",
        "3dea594c-cb8c-4b30-8435-db26f3a1057e",
        "3e165136-677c-400a-87ac-e32aeb41a24b",
        "3e2b3ea8-b1bf-42dc-9784-451ec896c81f",
        "3e55181e-a0c5-4f0f-aed3-d422b259e878",
        "3e661179-3ba9-4e42-bbf8-b0a1b53140fa",
        "3e7ccf79-6fba-4ea6-95d2-727904376958",
        "3e7d98ba-0f03-4395-aeed-686f7bc4a404",
        "3e9e0e87-0c99-4c18-9a6e-66831358cf8b",
        "3ebc340b-f096-4902-9678-6e0d72315f15",
        "3ec689ef-9298-42ef-aa0b-eaf996832259",
        "3efe38a8-ac01-4da3-b572-fa80d8c7727a",
        "3f14baa3-d28a-41b7-b836-ea74ce65439f",
        "3f37ec59-fa5a-4f0d-9512-552d29f5820a",
        "3f4baac7-1030-467d-8e20-f2189a7f8156",
        "3f4db854-9960-4349-8711-50fda4c46b00",
        "3f60380e-8904-4304-9027-364d6c877976",
        "3f91edf3-934a-49a7-be55-f2ab56faf05b",
        "3fc91083-e27e-449b-ab6f-0b311062a726",
        "3fde8c74-738d-4953-89fd-692b06cbf8bb",
        "3ff2ef28-59d4-4174-b5c0-fac5aab6e5aa",
        "3ffb8d3d-f06e-42dd-b5ce-fe0cfeba3106",
        "3fff1413-d994-4755-ac94-5fd10b5742ff",
        "40061d93-6774-4a7b-85f5-b39ade1c4d57",
        "4013a270-6320-4bc7-87df-0271db7d862a",
        "402f5699-f98a-4269-b40c-eeb7cae91f60",
        "4043a625-e7df-426b-bf5f-673024334d65",
        "4058ca5b-aca6-4db6-b5b7-bc9695e6449d",
        "405a7083-9ce6-4407-a49a-bcee27a9d8fd",
        "40855a63-7302-4a22-ae16-6ea08c5cb38b",
        "4087ec3e-31c7-4f28-8124-bf39dc58aa44",
        "4087f86a-e003-4028-93db-09398778ede1",
        "40b8a4d2-806f-4b83-ae23-619c71a66ed7",
        "40e08399-7e6f-434b-821c-c65d17d22796",
        "40e87b13-e9be-48b3-ad8e-21e644d8edf5",
        "40efea2f-217a-452b-8bd2-7a1051cc9581",
        "40fe7659-bb54-4643-b728-10b81d767a0c",
        "4104bf7f-f764-423e-88d5-c3cf14eead7d",
        "41079c4f-ca22-4850-96b7-c77080de7ee8",
        "415e0ff8-2289-4554-8c39-fff6b849ba09",
        "416ea5b9-f904-4ecc-a5c3-98f44b9f142a",
        "41711761-8d14-4e28-901d-f461c29f3aa0",
        "41765e8d-a07c-4dfc-9fd9-1b6d5a757c32",
        "41862ab9-cc31-44ad-b9b2-4ae22b532bb8",
        "41879027-50df-40bc-9407-681a8bf126d2",
        "4190e007-e92e-43b8-827c-c372fcc461b6",
        "41945a08-84fa-4d2b-bfbe-775bd897c0d3",
        "41e8fd85-81cf-4779-a7ae-119e2f814b9a",
        "41f2523e-b9a8-4cdd-9ce0-06f5126880cb",
        "4204bdaf-2f98-47d3-a5ea-934ba2b7121f",
        "42495f05-f540-441e-ac6c-43fd89748be1",
        "425874c7-c24e-4ab5-9364-a9ecf7b3b18a",
        "425c2696-464a-43a3-abc3-6d66414f9cdd",
        "4273cc83-8d0d-4c06-a1e7-d0a2ae493168",
        "4279b2da-ff1e-43a9-88ab-cb77e2cf99a9",
        "42aacc43-ad1d-4bf8-b34b-7b07d745b15c",
        "42d12144-13d0-42e5-86b0-f3f0994efa31",
        "42d12fed-f379-43a6-adb3-95a054f50a9d",
        "42e41f4d-6779-43d1-8ec5-364c205b8ca2",
        "42f37526-a806-4105-be92-ea6d72cd0af2",
        "4340c3de-5e8a-46a8-b105-e91b8cf73f46",
        "434b9b49-0acf-433d-bfb5-cb233b42f1f9",
        "434e7e2f-1882-4871-bb3e-467461bd16f3",
        "435121a1-e638-470a-a496-0d1eb40a47a4",
        "437984dc-4e07-48aa-b957-db6b0d0a04da",
        "437c97a7-98dc-4372-b742-e8f0e4967134",
        "438597b8-16d5-4571-aab6-0c0b3defc399",
        "43923a94-716c-4137-9886-ec795514ac77",
        "439a3816-0877-4aca-87fe-8c33108b4421",
        "439a6857-3ea0-4536-840d-2de9c4e1c89f",
        "439cb71a-6dc7-4552-aaf8-92605d81d2e2",
        "43a2bec0-8675-458e-8a52-118966f8e24e",
        "43b104e8-3747-4963-8e92-3ba1000be220",
        "43c6b62b-2cbe-46c8-9bc7-bf15ea6d866a",
        "43ebdb0c-f3e1-4105-a4db-b2e00b15cfc6",
        "4401785d-bb18-4728-93d4-01e236e1861b",
        "440c58e6-9dbc-4783-985e-02888035106b",
        "4415e9f5-6aa0-4676-b9fb-ff5485d70107",
        "441ef7ff-2764-4faf-8d9f-d567404eae6c",
        "443c42cf-60de-46e2-b9bf-5ac59a9c6996",
        "444724af-5277-4f06-9dca-0bd5f26d6880",
        "44546e8a-104d-477d-ab63-86d8d84d323f",
        "445cebdf-d2d7-4d0e-9328-6b7f8f9e69b3",
        "447bd9ea-d23e-41ac-9db5-99e8cc330407",
        "448d530d-494c-458a-b790-5eacec889a53",
        "44a00f2e-1ee8-4ae3-95f4-073555ef25bb",
        "44ad704b-73be-49f4-b28c-b59c3be3e3e0",
        "44b38d74-0886-4a61-b449-e5bb40d66e0d",
        "44b4f8f3-9f42-46e3-ae0d-f14aa33aea4f",
        "7ae2b238-ad9e-46d2-90b0-21b8498d0693",
        "44b6d5e2-2514-40f1-a41a-413f0f3ae9d2",
        "44c1685a-eed1-496e-baec-646f586920ad",
        "44ca53af-de56-4138-9746-9cd2cecb700b",
        "44db6921-d544-4d03-b0c9-0a086d989194",
        "450c00db-04b1-440e-9a8c-a2c5a0538b51",
        "7afc8477-b5d1-4c01-9858-bc070bd86319",
        "450eddab-fe1e-4308-9d71-842bc023c44f",
        "4513bb30-7232-4791-b6f5-14db554d7415",
        "454a0f1b-08b4-45f5-9e99-98c5c6933459",
        "454de516-cfe1-4889-b795-fa274eebeafc",
        "454fd965-ce45-4917-9017-a9442c3b07b8",
        "455285d7-64b5-47ae-9d0f-22a5d603a166",
        "4573dc90-3f02-4312-9bf3-e723897c9adc",
        "4585e883-24b3-4bcf-9e66-afe652c35dce",
        "4594494c-0f5a-4f64-a684-8f650d22e0b1",
        "459958f9-ccad-439c-a76d-ea593587f63c",
        "45a54cb2-e6f1-4c57-ace2-84f25be5a7d5",
        "45dcae77-6c5c-4526-b131-28e4d5f32b4e",
        "45def12d-6f13-474e-be2c-f3dbb98283e0",
        "45e19610-fcd2-4cf9-b84f-1207b7a5bbac",
        "45f0b742-b3de-4b17-8772-2fddb8252ff4",
        "45f8e92e-bed9-4c99-82d2-e41abc222335",
        "460aa8a8-0712-44d1-b19a-97486f2b3dc8",
        "464eb908-1834-4ea0-8c66-0cfb4249505a",
        "466c80ef-6537-4a12-b2a3-db33c72381b7",
        "467b7807-388b-472c-8890-169fb36e2aa4",
        "4685d60b-de6a-44f1-b43d-073d5276e20b",
        "469192d0-ccfe-4894-a23d-0f4a00eb43c5",
        "46a86fc3-e294-4953-8376-86d36b032f64",
        "46bf9d36-260f-4d1c-a4ec-a015eacbe1f7",
        "46c94d49-c012-465b-8d73-e32cbca1f5c5",
        "46d706e8-5430-4e0f-832d-6545a0cc22b7",
        "46ee1adc-330f-4898-95f3-5a3145278ca0",
        "46ffe31f-ef74-43f1-9ec1-e7d37ac70a07",
        "4714eb1c-e4ba-497a-83ad-2e703b93287a",
        "473165a7-6172-4fff-9758-572947765259",
        "473810dd-e8de-458b-8aac-eb1e4c27f3f9",
        "474525a9-7cad-4467-9812-cb18ffe80a0e",
        "47467983-a44a-4b1a-8956-19051a996111",
        "4746a1ce-01e3-4d44-b1a4-050a27056baf",
        "47576937-4e6c-473e-96b5-61b96494dacb",
        "4785b28a-0f60-40bd-9dc4-697647b84dbb",
        "47944f22-d774-4e0d-bf5c-207882640002",
        "479b798d-8103-4bbe-a74b-8db0fdfc0225",
        "47a7ad2f-f575-4736-b77d-937b342ad328",
        "47c0bec3-735f-4aaa-8fc2-40af49a72b0a",
        "47cb61d4-fc0b-48c0-b3ba-a9dc3d7aacff",
        "47d093b0-b683-4075-860b-4e9a4401baed",
        "480cecbb-cdef-4bd1-b462-bcd2b4c04f4a",
        "4812716c-2d19-45ad-aaec-a0a206e17043",
        "482604d2-b02c-4367-a3b7-eefee89464d2",
        "5a141b3c-0b09-42fa-b6cb-ea6ebcfa4268",
        "5a2d0254-7197-44aa-8060-d4fe0f3818aa",
        "5a3b96bc-8bfc-4345-ba6a-3e904abeda0b",
        "5a445047-9c4d-44b5-9487-ca3f119564e3",
        "5a490cb9-7db4-49d2-add5-1a715c1be95e",
        "5a6d6ef0-3d65-4f9e-8077-49e2d15a47bf",
        "5a73800b-d74c-43b4-98ab-aeeea714e676",
        "5a8171fd-dfd4-4884-ad1e-fb7a6eb9b05a",
        "5a89c04b-a846-45de-bbf8-a15ae3be6fc6",
        "5a8c645d-c803-4526-b91c-a1027f39baeb",
        "5a9b7f71-2f8e-4799-841e-098e6660f3e0",
        "5aa965dc-6f23-4f63-9316-2ab4c5a4084b",
        "5ac253db-431d-4fc1-ad29-dc7ae9ba586c",
        "5ac86764-3775-4e19-96a8-c87cb1b561b1",
        "5ad6ce85-3ea3-45bb-b471-2ce307525dfe",
        "5b15b7b5-d35e-4263-bdf7-ff9aa3ef6707",
        "5b272f40-ca77-44d4-8085-7fb936f68626",
        "5b3c2fb9-1ab2-44da-a429-ee56d7b96628",
        "5b56e97e-b8c4-470f-80ed-6aeb1ecb61f1",
        "5b5b107b-ab7a-44b7-afc6-25819bf6227f",
        "5b5d391d-4e5e-45d9-8fa0-b9b5a2ac8f4f",
        "5b903692-e48c-4e4f-94ab-7cd14517888c",
        "5bba614a-56dc-4bc7-9864-6a3e7edf59b4",
        "5bd44bf2-9da6-4a5a-9eee-98d94415d2b8",
        "5be40131-d4f1-4f5e-8907-a920ae2bfbc1",
        "5bf64b68-2e13-46fb-8229-310d74e137cc",
        "5c0d894f-facc-4962-838c-b9c5228866b3",
        "5c577b17-21b3-4f7d-a5fd-6c774c0f8f56",
        "5c6d814b-1a3d-4c13-902d-5d02ac94050a",
        "5c757857-f6dd-4860-ba7b-0f4063e344c2",
        "5c79d3fc-c219-4625-8300-507a9fa83179",
        "5c7d135a-376a-43c7-b991-a0bca6087192",
        "5c8e3405-4e28-4232-b60a-407bd1c4352b",
        "5cd0da5e-0231-44bc-a3b1-689feac6047f",
        "5cd318c9-8f7a-429e-87ba-228f59666965",
        "5cf9e671-4dba-48d7-b437-cf9f6ecbfcea",
        "5cfdf60c-7ad7-48dc-9d88-605aaa69aa1a",
        "5d1d969b-868f-449f-9220-f3f76b0a303b",
        "5d2db798-fcb7-4900-a2d4-2618fb17c1b9",
        "5d7ab366-9f60-4c89-a999-0f3a32d2851f",
        "5d7d0fd8-a652-4080-b59d-632416eff550",
        "5d915ddf-f8b2-46bf-a85f-fba4f6891dd4",
        "5da1dc2a-1e37-4e25-90c2-d4d6eb8f97a5",
        "5dc6096f-ab92-41aa-b6be-b8911682d3e7",
        "5e00dac1-06bc-4f19-923b-007aa7e22d7c",
        "5e01ede2-400e-447e-84e0-d544078a55b3",
        "5e163271-0b6e-48ba-aa6e-2239054d8ba2",
        "5e19be9b-751f-4077-b1e1-9e48da2f31c0",
        "5e232522-53a1-4dbb-a698-9734370df233",
        "5e27bafa-6d93-4add-b298-2d552672cf2a",
        "5e75404b-66c8-4489-b8d7-8c840bde33f5",
        "5e7618e5-1aa0-4952-b7c6-6baec8599928",
        "5e7c6af4-0f6a-4497-acb1-00296604b646",
        "5e8cfe68-b499-4dc4-961a-4152b7b50d8b",
        "5eb0bf71-f59f-4097-a5b2-9125f9c800a2",
        "5ebc5682-305d-41ad-869d-5f047dc02840",
        "5f16fcc0-e2cf-4562-9627-4d0c152d1e95",
        "5f20a312-2b4d-4818-8313-23331d36684f",
        "5f29c679-4535-443b-89b4-97a670be92ca",
        "5f658446-c686-403e-9335-20dd715c8087",
        "5f673520-c0b4-47b0-b1cb-9893502cdd35",
        "5f7c80bb-0f91-49c8-9fcb-d2ca728b4e18",
        "5f84ff25-4fd6-4589-bf82-a4c6f22f3a28",
        "5f919e69-4ceb-4a5c-b958-2ea26db58c86",
        "5f91e8fc-a1f1-498d-a410-36bae9803141",
        "5f9e2400-3f92-4233-81cd-e7d14c60d0b3",
        "5f9f7fd1-54ae-402b-a84b-059db05c8163",
        "5fb9319e-d168-4d05-9956-f56776d283dc",
        "5fca1e2c-a6db-4850-9b60-712f95a41f03",
        "c5c9b6af-7a18-4a17-bb0e-841b0c3ee002",
        "5ff48c6b-0434-48ad-ab52-5f2443ea5e5f",
        "600e854e-8913-4545-9159-796b809b43a2",
        "60146c8a-7a27-4ec7-bbf4-bf4471836356",
        "601774ea-ff9a-4f3f-8129-ef395e84e38b",
        "601d138c-bc65-452d-a892-ed0799c70f60",
        "c5cb65f3-d5bf-4699-8489-c5a753b1d198",
        "6054f576-b62a-400f-b3f1-9ac42fc9eb0d",
        "60827204-8c28-497d-b6b8-52a3d81be9c9",
        "60917a88-7d03-4086-a4d3-50848aefb4de",
        "6097b0ed-510b-4e82-b7ec-46e05ad4ca92",
        "609d869d-8b5e-4f04-ba2e-e9338895b57c",
        "60cfe26a-8fe6-495d-8bcf-a310f98e79b4",
        "60f70a68-0137-43d5-9894-5e016396a36c",
        "6123f157-9705-425d-929d-1a5e0a94fcfd",
        "612734cf-d240-45d6-a755-f21b06529a79",
        "6133422c-dd61-40b0-b7b4-eede2dd5aa5b",
        "614b2fdb-8088-40b4-94ee-ee567f8a326a",
        "6156cdf4-bbe4-4ec3-ba64-3f2740560145",
        "617430ff-f425-4897-9718-57fe5536324b",
        "618f71cb-342f-4e43-8d73-4c4f436f4dae",
        "61b70de6-c703-4c8e-8544-6b238bb9cab3",
        "61b83895-e38f-446c-9932-8efbbbf4e899",
        "61d70c14-333a-4441-8190-c768a6ace8e9",
        "61eb18f1-b67a-42eb-8e52-cb52c00f4a07",
        "62002d65-6d31-4279-b792-2c52386dd762",
        "6248985f-6b67-4dce-8382-272829a13929",
        "626ae4df-38bc-44e6-87fa-36c08435bf89",
        "62957373-1517-4609-b4a3-243d15d8417b",
        "c5f5bbc0-1415-4b4a-ab10-b08c29811ea2",
        "62995564-5ff8-4153-ab02-3d01f26c0abb",
        "62a79987-a91e-405c-86e6-94845eb64ce6",
        "62ad2eee-7c72-42ff-89ac-83f3416fd210",
        "62d7ae93-4bcf-4a30-b684-965e678e9eb3",
        "63186a1e-92be-41a6-a808-59fa657c86ac",
        "631897bc-86f4-4d91-82ec-3fcf06ce8750",
        "6325a7bd-9b3e-44ba-a1ef-31c2f628ec7c",
        "632d501e-337a-4984-88fc-8b99c67ee2bd",
        "6341c9f8-656d-4b39-aeb9-75c6f021a873",
        "63609d94-8fa6-49ec-88f5-b8f2dbfc8610",
        "637812a5-479a-4c56-990f-1e9cca378733",
        "639480b6-854f-48b2-9411-8fc7efccaf75",
        "63a8ad17-448f-431c-bf1b-1895792119bb",
        "63b4e4c9-7a63-4501-a222-99e57ebb91d0",
        "63be6d4f-13bc-4a70-9618-d53348db43d7",
        "63d1a447-4137-4612-a825-47edcc98b9b9",
        "63d303c2-4f4e-4366-a497-0ee89702912b",
        "63d7c2fd-c9a1-412e-9c75-720772da641c",
        "63e603f0-447b-4d1e-a4aa-4904d3f44b9e",
        "63f94d3a-741b-4ed0-84b6-939d9917906b",
        "64076eba-8447-4e5d-be70-f0da11af429d",
        "64326591-f16c-4e8b-aabd-e572dd630c2e",
        "647c04a2-8264-4fc0-82c8-5650f48477f2",
        "649b45ad-b849-4d7e-ab45-979c16f2df76",
        "64aab0b4-0305-4547-b19d-3a9c04b98ee9",
        "64b8e66e-41d0-4a56-9d97-21d5a5a0d06a",
        "64d5799d-ffef-4242-b348-553a875a3b1a",
        "64dbf207-8664-4885-9270-098ad1025b13",
        "64dda20f-46be-4e1b-8695-188426679a08",
        "652d7f1c-7c51-41d1-8dd5-143d1c28364c",
        "c5f73049-31e1-45a1-a75b-6bcbaf6ba778",
        "65353dee-5391-45a3-9dfb-cd5e72784447",
        "653ab36a-638d-4d2a-af0c-c35f086a4a04",
        "657a1b2e-98a5-4835-a8f7-df50785de852",
        "657d7f52-a267-4ad0-b213-0dffecac1e18",
        "65aa5bca-8a98-4d91-b3b6-aa51f919d671",
        "65b52ca1-2b49-49eb-9d7e-6f940db877c5",
        "65c1d0c8-f11b-4736-9401-69f25cfa2e8e",
        "65c56968-8889-44c8-8edb-93d63b660d7a",
        "65f0db1d-1bfc-4bca-aea1-37777e298578",
        "6608b864-7b75-415b-8cec-c9e423b9afc5",
        "663e045b-b93d-4cce-b7ae-f9f3ae65a2f6",
        "665b0e52-b264-4ffb-8636-03dd05c89217",
        "665c9b8f-9634-429a-abcb-53355fee2a26",
        "6668e411-8add-4b76-95a5-34e69d7cfd53",
        "66b063cf-7a75-402f-8b42-4581dbddcc34",
        "66b4de79-be74-4fc7-b282-ee6b5c0e6692",
        "66c10d4b-2a4b-470a-9b17-7698dd7ea4da",
        "66c40eae-7ccb-444c-94e7-db8d0760de52",
        "66d13dbc-3602-4b2d-bc2a-1c62cd019b0c",
        "66fe55a7-120f-48f2-944b-34172ad9dc7a",
        "6714ce38-099a-4020-b69e-4a774436e7fc",
        "671a6d88-39c1-4c04-9559-d9f19d376abb",
        "67278b74-b007-4525-ab95-dba8c68bb561",
        "67489109-5c20-4d0f-9161-faf983ebd7bb",
        "67574344-37c7-4672-8436-41028125f7f8",
        "677da80d-0f8e-4363-abf3-0bb67ac24558",
        "6790eaac-c8b4-47b4-a3f6-7d01c05d36ad",
        "67a720f1-9711-4427-9a55-c540b256c343",
        "67ab3f68-9915-4255-b0f8-d2723a290ba5",
        "67c14469-bac1-4032-b159-610e11bf272e",
        "67c4ff6a-2f79-4df8-8a3b-1a1428ef12c6",
        "67d10056-e5b3-46a1-be6e-d3e0d37f6dbd",
        "68264d0a-d3a0-4468-b74e-b300ea141d22",
        "682bd4e6-1ad4-4ec1-8e48-a2ce39fb9e49",
        "682c3105-0f1d-4735-becf-f4bc5fda40c5",
        "683d33f2-9753-4356-8f26-651b99d9743a",
        "685a48ac-53c7-4a0e-bd12-4725dce721c6",
        "687637ac-4932-41d8-bc2b-c5b0522c3486",
        "68a5bffe-e060-4e54-a4c0-5de011172777",
        "68b32112-8ad2-474e-bb45-7f7914f3be60",
        "68c0a52d-3b19-4657-b2d8-800e40706895",
        "68d6fddf-468f-4974-940b-4ba48bd7dcf9",
        "c62deee6-9e15-478f-86d6-153a3982407d",
        "68e3d8d2-9e88-4737-a50b-0605a3d67fc2",
        "68f4aef2-eac1-4e2c-a79c-c54b099822e3",
        "69278867-7010-47d7-ade2-37798d31b94a",
        "692fe51e-cf05-48f8-835e-d493444aaf1b",
        "6946cb66-b62a-4abf-8e16-0939b53ae7f7",
        "69974318-715f-4807-ae77-772b4416aa9a",
        "69ad7d07-9053-47fd-9185-669c67e2055a",
        "69c3df91-a1ba-4d48-8d2d-cd76b7462b11",
        "69e9d354-0b84-4cd0-96b6-5e66d52a3dda",
        "69fc3a1f-c964-47a2-8369-2db1d14e4fb5",
        "6aa38a78-ffb3-40bc-9c5f-18df3382d502",
        "6aa45381-9c30-4e49-b06f-8a56c903237b",
        "6adb20cf-36c8-4ad3-8cd9-153e7be3ff4f",
        "6afe4b4a-2453-4f57-a142-766455b8b4f4",
        "6b16fbe3-ead3-472b-b74d-78cf2f2088b8",
        "6b1d3d61-0efb-4d2b-8678-e953e3dda258",
        "6b23f7a6-dc17-4da6-89aa-506e5a96e588",
        "6b4a356e-7a6b-4cab-a8af-66b31c604b46",
        "6b4a8025-9746-48cd-a8cf-4ba2d6c71f7b",
        "6b4f073c-b020-4b59-a808-51f30565a9f6",
        "6b4f7662-3a16-4b2a-936e-58c9341666a8",
        "6b7df4e0-e342-44ab-87a2-075d9c0d9982",
        "6b88120e-2dc4-4566-b6d8-41348a0b7daf",
        "6b925273-a7a0-4331-a309-1ef4bcc163fe",
        "6bc5ab44-6820-46a0-9946-2beb2389b486",
        "6bdfe3c7-2039-4800-b892-cd6d859fbcfc",
        "6bf913e6-692d-4415-9a2a-34f70114062f",
        "6bf916b6-675b-4022-90ae-f16604ea62b7",
        "6c1c5999-da15-4017-b4d1-9b2cc1d5296f",
        "6c1cc9cb-78b6-4261-83cd-5f737674580b",
        "6c21861b-0801-4837-984e-fcdc2751634d",
        "6c3c36a8-77c3-4947-a253-d353a80d5107",
        "6c5b9333-0ff4-42d8-aa98-38731d5e3479",
        "6c7a3c80-73bc-4071-9758-9e66bb733ec9",
        "6c7f5c8b-2b51-4d29-b238-8589fbf78ec2",
        "6c81ff32-875d-4c1f-be45-38b395f6639f",
        "6c918336-7f93-4063-ae0f-6042419e066d",
        "6ca67834-43cc-45ac-bcdc-c0354bc98c70",
        "6cbaee28-e2e3-42ce-b18b-34d1ce20cbad",
        "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb",
        "6cc0fdbd-c397-4d26-892d-e8066ac6bd75",
        "6d069e2a-840a-4f70-9eb5-a41b5a0a9405",
        "6d0f10b2-3ccf-4c80-87e5-cd71c03737c2",
        "6d579ef0-e20f-435b-aac5-2e3df85c7d6f",
        "6d84b148-22ea-4998-bf1f-c0145175970f",
        "6dcfec64-9fd4-4554-b635-ba0f9821975d",
        "6dd7f98f-607a-47b4-b7cf-6e051da88aee",
        "6deee1cf-e353-4041-9b90-92ea140fd3cd",
        "6df5bdda-7c8b-40f1-a0b4-292c2e3a7047",
        "6e090479-3cd8-4ef3-8022-c4a0f31e6ca4",
        "6e1fcb8d-abfb-46ea-96a8-b09f43f0aacc",
        "6e3144b1-0f25-45c8-9d23-0ec4262f2d59",
        "6e412dde-b806-4043-97c4-e5f7824dde81",
        "6e5ab6d9-5abc-417f-b54c-053c147a202e",
        "6e6e9027-018a-47fc-9b14-b8da676b61b1",
        "6e6f8542-b81e-4458-ab3c-814ba42a6dc2",
        "6e71be23-1004-4615-9b0a-abe72d4afed1",
        "6e9ba527-f7d4-45b6-afe3-6e90397e3f9b",
        "6e9bf08c-b65a-489d-8389-9ea336c41fa8",
        "6ee7b6b5-5fe7-471c-8c5b-13c6c295e71c",
        "6ef4a29c-d7e0-47ab-a746-8e2f2c188a12",
        "6efcd145-4655-44f4-a8a5-55d05ed8be72",
        "6f2ac99d-3a80-4273-8a9c-de72929a320e",
        "6f2f6619-5d6b-45db-828b-b85e01f520e6",
        "6f457b23-58c4-4a60-8977-c52d5625663c",
        "6f620615-1f89-4b8e-ad0e-c1cc28474756",
        "6f69fb37-2f9c-4c23-b9d9-a46e8f8e4518",
        "6f6a243c-861a-4daf-a438-9297775dca5b",
        "6f6f95a4-119b-4314-ab1f-c545b9bdd6d8",
        "6f714f8c-9701-4e65-896a-ce857e9f4fb7",
        "6f80511b-f7c9-4690-94eb-9b2a14564123",
        "6f8dcc5d-0d24-41fa-b9f2-85848cf45463",
        "6f9b2222-a213-4bd1-b01a-4345b4aefa42",
        "6fb430dc-ebab-4d15-aee0-3ee7afdc2645",
        "6ff68af7-b295-48db-a1d9-badfb50e0827",
        "706d8743-143b-479b-9f9a-82deb5653ca3",
        "70767c32-6210-4343-8ecc-71a3ca4d2822",
        "70a5823d-1b61-4255-8469-efe87266975f",
        "70ab7054-bfe1-4cb7-8082-759a0996c2c7",
        "70b2d8d1-6338-43a3-9282-ffdfb4ca80a5",
        "70b8e719-4bf2-4f85-8a8d-e4f11d7fec25",
        "70bd8806-7cf7-4faa-8f07-add409f3c218",
        "70ebc9b5-bb7f-451c-9075-dcc319442aaf",
        "711fb3f6-cdab-442b-a736-7cebe53a6bd7",
        "7137f2e4-758e-44ba-bb48-8d09ace22d00",
        "713bda82-ec82-4175-87c9-06cd5b49fa24",
        "715a724e-a379-4c0a-822d-f05114e30363",
        "715ca7b5-a9db-4897-9001-f7af51e13409",
        "7160937d-149d-41a4-b43d-d735abcdac76",
        "71709cc4-a543-4970-96af-5483fb59b49d",
        "7173eb33-9d17-412e-a8c5-8474dcb14b33",
        "7188e1ee-05fd-4e19-9230-9ca11a0e9ce0",
        "718b1f2e-9995-4008-884f-f35cf385e884",
        "71a79de7-7bb0-40ca-b5f8-5e51736a6ad0",
        "71e8ba49-be03-47a0-8528-e9bb130cf9fd",
        "71ed03f4-859a-4610-ac5b-ed6cd999651c",
        "71f05dcc-70f5-483d-a365-2c3524780ada",
        "71f5adf3-9223-40ae-a50c-dd8bc5460dc6",
        "72074f28-5cdc-4c60-8472-e61afd12911e",
        "722934f9-4490-4bfb-8651-d050a69b7724",
        "723a4748-234f-4136-b8f6-e36bd8d91f99",
        "723d77ab-bfc0-4502-a598-84d35dad19cf",
        "7249156b-4688-4597-a547-f987f37bc591",
        "c6493c2c-9350-4577-b092-6af36ee0f1ed",
        "7250e7e6-7942-4251-b7e6-574b4449aded",
        "726b6dd5-6bab-4c8f-8908-9a9032a8ee16",
        "7271e846-3b9e-42a7-ab71-b2275f16c8d1",
        "728e48be-e56f-4bad-8972-27c10fa93782",
        "728fac92-dc0f-4bd4-a5bb-27747a2d0948",
        "7292e381-9d6f-405f-8788-7292fb77edb3",
        "72b81246-85a5-40bf-adef-42bcb7d8b008",
        "72be0d1b-3e12-4675-9032-6b61041c26a5",
        "72d2fef2-16a2-4ebc-983c-8a9ffca7d4f1",
        "72d9944a-cf83-4f5d-9205-1240e541e84f",
        "72dd2bcf-1f19-41c3-bfc7-087b861df603",
        "72edc313-5a70-4812-8b5f-c809bc108d2b",
        "72ef3631-04e6-49cd-86ef-024205eb57b6",
        "73150b8f-0edc-4f38-be02-b8dd6476b5ec",
        "731d05d1-8dd7-4cdf-8859-bb0bd0e7e708",
        "7320f07d-a600-4c95-81f2-753b353f7b3b",
        "73240837-973b-45f2-a839-707503c95693",
        "733176db-8ecb-4088-8522-449591f08155",
        "73494d7f-a46c-435c-acaa-5250649c27f8",
        "735b7497-0eac-4e2c-a9f3-71a745d46acd",
        "7360fb9f-76b6-4198-a6d8-da63a625f07b",
        "7367501c-263c-4afa-8f61-aedb3f1a18bd",
        "73b4a226-843b-4c0c-9ef8-3f752ff65c92",
        "73c38dba-8a87-434d-a71a-67c88a86018a",
        "73d4f2a2-10e6-4f19-a932-337cff8159a2",
        "73d9c2f6-f6a8-4d5d-b742-51fe62761b54",
        "7404ab1d-48de-447f-875f-f65dcfaa1e84",
        "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8",
        "748aeebc-028e-45f2-9bed-b059abc30e4a",
        "748de04c-bed6-45c8-9f98-7ff28c0ac510",
        "74930ff4-2ef8-4d2b-961e-af668e06eefb",
        "749582a9-56dc-4310-abf2-9aa465ac12c9",
        "749ffc4c-ebed-4eb7-bc8c-0bbf8c7f4bbb",
        "74a4f998-e194-442c-b9ae-d995bb331a49",
        "74ae8737-bd0f-45be-9245-4921004291ac",
        "74b61aef-638d-4d15-bfd1-d73f55309d41",
        "74d00dc1-3619-42bd-946f-6f92ff366894",
        "74d0c359-0d5f-4f2c-a793-ceb103346635",
        "74ed224d-2709-4474-9df8-fa05935447eb",
        "7520e3fb-35f0-4142-9e14-870f71791614",
        "7525ec03-30ec-4791-b3ac-eab511b6f046",
        "7558efc1-8170-4492-b49f-e8a8567b55b6",
        "75665cea-3457-4464-a3be-b69b54252d37",
        "75700549-472b-4445-80e7-d6f09c6c702c",
        "757f21f8-7714-40f4-b36b-f47c5020f0fd",
        "75b805bd-39fe-4bc2-b26e-ffdd754bae63",
        "75e5f093-c8a4-4766-b57d-31428c6ed7a7",
        "75edc4db-62df-4b9f-a390-6ec103d9a4b9",
        "75f16409-8527-428d-9918-29408fb1919a",
        "75f899c8-48b5-4957-b81b-2b7b057ebe37",
        "763631ec-96d5-47ac-bc86-f74d67d7b7cb",
        "766157f8-66ca-41b6-bef7-662eb8273033",
        "7678832c-f6a5-45ac-9801-3075d2704364",
        "767f97f4-f75f-49a8-abf7-fc012acb321d",
        "7b0b9494-61ff-453d-a9fa-b26d509bd661",
        "76842095-2cac-4906-9e85-23a9148e7aae",
        "769b6f86-8fe2-4248-bd3b-78f9da9d2151",
        "76a34960-a904-4940-970d-809027aef021",
        "76ad4cf8-86fe-41dc-b7d6-ac6b9925e26a",
        "76b5638f-529b-4c16-bc6b-9613d3547f3c",
        "76bbdbc7-07ec-45d0-92df-031427128200",
        "76be9559-abff-47fa-8c2c-f7c658ce05eb",
        "76c0466b-3235-42f7-af7b-fd898a286c6c",
        "76d3edf8-a301-4109-91c3-318f8cb409fc",
        "76daa96f-881b-4b19-977c-6ed680a82d80",
        "76fbd30d-8128-467e-b395-851b01dbad3c",
        "771f7aeb-dcac-4d9d-a50d-c8df73baa340",
        "7730cb03-2217-42ff-9a22-aaeb6e3625d2",
        "7765909b-bd21-4e07-8171-df0816ab90b7",
        "77699af7-8b9d-4e77-8b90-eac4c1b3c6eb",
        "77754cf7-0df6-4fe9-aee3-af68579d240f",
        "777a2d2f-9779-44a9-9213-43eaf0a92358",
        "777b43e5-3792-42c1-b526-5f55a410592a",
        "f2e93d0f-6365-4b87-ad27-9a94dcb9d17d",
        "778568c9-9db8-468d-a8cc-3ef27866ec00",
        "778a7e04-3901-4284-a47d-ee9c059be047",
        "778d0609-cae5-4d3f-bb4e-568a62990c2d",
        "77ed3d7d-04b0-4e54-9dbf-046143413336",
        "77f518f4-c28d-425a-a68f-9f7444f2d2a6",
        "784657f7-2cb1-486a-8ed8-94d33485055f",
        "785742f2-5dc8-455d-b824-7f41b14dee86",
        "786ad8e6-4c4b-42f8-9ac5-5f23d35e8a20",
        "78795279-f94e-4f8e-9d66-c28ba331524d",
        "7881be8d-8361-4819-8f7f-2334593e0787",
        "78857cd1-42e5-4737-8ee8-e4c4f3ff72c2",
        "78982085-d50b-404a-91da-31a27bd03084",
        "78a009e7-0ffc-43a8-92b3-1c9775f5111b",
        "78cf63b3-8c07-4dbb-8f6d-ee737a401e5c",
        "78f103e6-9ad9-4970-af50-c9da7c0f3dae",
        "79121aa0-be21-469d-8262-3dba005b66ae",
        "792cb097-e480-416b-9ae0-e9ff9f392f7d",
        "79433505-999f-4a3d-9376-19fa5590e62d",
        "7943845c-187b-40eb-a881-62a102bfb617",
        "794d6c36-aa4a-44f7-bbc2-2c103b8f3f3e",
        "79536333-e36e-4064-b897-d09a42c95595",
        "7967d8a7-1d52-431b-bb5c-26951ba8c263",
        "797962ea-e340-4cfc-9cfc-1f78e3f410ce",
        "798a8005-eebc-4961-8e40-1c9126d3bb5c",
        "798ed185-7725-4df3-9d8e-0704218edfeb",
        "799087b6-a64a-4266-a576-ba517ecc96d5",
        "79ad51ff-a7b4-4a59-9a27-a9701a14f257",
        "7a0f4267-bc9e-4f9c-9318-bcb2d4c249b7",
        "7a300fc8-11db-4e95-a3e1-b267709caecb",
        "7a511af0-10c5-452c-818b-6cf47c132a2c",
        "7a5ff62d-0f74-48e8-a504-2eaba9fd0ae1",
        "7a937250-c3b7-4c40-8824-79ee66d1e72b",
        "7a9cb339-2780-4c15-897a-087683786c23",
        "7adc10e5-ece8-4acd-b72f-a7604c8a0fde",
        "7ade0f69-39fb-49b5-8a90-7ad54ae682cd",
        "88bb13ef-0f82-4f66-b77a-13e9240c9189",
        "88c11407-4cb3-4ed4-b535-7aad61b81d10",
        "88d098e5-ca7e-4e5c-8a22-87b1c8fb80ca",
        "88e410c5-499f-4072-9b7e-af2c49b9f8b8",
        "88ea2021-44b8-4639-baa6-1c9a786718d3",
        "f31c7cc9-f861-4a50-b4d7-633cd22da37d",
        "88ed32e0-ea76-4283-ade9-7754094d98f6",
        "8925cd87-17ae-46d8-9f6a-1f0d20fb0ec1",
        "8932b81e-4cf8-4eef-a172-4e58fcdc8ad2",
        "893db2ba-219c-4997-9ac1-30e6d0529e71",
        "897576d9-4d84-4dc0-86d0-1aa0b309d348",
        "89a4f8e9-492b-44e0-823f-6ec263ab8f5e",
        "89ad77b1-33c5-4dc6-a0db-34ecd951b9ab",
        "89bcbc9a-1471-4d09-99e9-180251156b36",
        "89bda1bc-df89-41d6-89a6-deb0c0164f6c",
        "89c83aef-b364-4e1d-97d7-8e3742dc8a21",
        "89d0513c-55c2-4809-ad99-62e59ac2ff64",
        "89ebca95-37f4-422c-933e-1472692d2d78",
        "f3280888-e5a2-475d-9285-af91a8df328b",
        "89f06a82-8aa0-426e-825c-b30b0fd62a66",
        "8a00d1f3-5795-4b06-8dbb-4cafc298c5ec",
        "8a5fc2d6-3172-4fe4-bbb4-42bb02d756d1",
        "8a7914fc-818d-472e-88be-f1e075b464af",
        "8a85326e-0fa5-406e-9780-e247b6da047f",
        "8a89a776-55bb-4fe7-b120-fa74c2b8a787",
        "8a960441-88ce-4907-a87d-fd58183a7806",
        "8ac3a760-a251-4b2d-b0b0-d0ebad6b0697",
        "8ac9c30b-5cc9-41ff-9202-d95d97a6600a",
        "8ad71adc-1269-4f16-8882-81a5d15e9e2a",
        "8ada50a8-cb0f-4b11-82bf-c2abae87050c",
        "8adc69ef-f187-4e69-be77-2f25afab6240",
        "8ae1826b-8292-468f-b5ae-373d082ca905",
        "8afb8814-2b7c-429b-82e8-e77eb8dde0bc",
        "8b3668bf-d080-495b-aba8-4ed777531385",
        "8b4654a6-1c0b-4aae-9617-121bb7e32501",
        "8b5356bb-ed4f-46c1-a490-1b8daeeb7525",
        "8b705ae5-a34b-471c-945f-f271ea68e517",
        "8b765769-8ac8-4712-8556-3b8c9f479dce",
        "8b82a092-f57d-4d30-81bf-8a8697d14347",
        "8ba0622d-16ae-40be-9f7b-1e2ed64eba6e",
        "8bb3c5a5-f027-4ca5-a82f-6b6d5524d0e4",
        "8bb58d72-67e4-417b-ae86-f9f645fb527b",
        "8bcc3bc4-05d3-43d2-a960-e9b88a2158f8",
        "8bf798e6-05e4-4143-a469-80ef18a9b512",
        "8bfc3d2a-187c-4478-90a5-6fc6db51ec6b",
        "8bfd2f09-bcab-4f7c-9d9d-5aea4eab8e57",
        "8c2109cf-14e0-4692-874d-9243f1d03ef6",
        "8c2993a8-a1dd-436d-938f-1d16c9b370df",
        "8c5824c7-4645-47b5-9e67-70e1caaef639",
        "8c68e1a2-7655-4d81-bbba-997b0e67f447",
        "8c7cd3da-0f73-48e5-b933-7a434d3643b8",
        "8c822de6-7fa7-4d75-b864-de0455b8a94f",
        "8c909917-0e5b-45c4-b27d-b12d6b595c22",
        "8ca30144-2c20-498c-ae8f-4308fc2f5edd",
        "8ca7eb3e-3b7d-4dc1-82d7-1ed0b4204856",
        "8caf4336-a54e-4907-957d-d87f6b1766b9",
        "8cb7b82a-e14f-4359-b679-64e98f1b8f8d",
        "8cc1b16f-6ef1-4f56-b191-47889f2e7419",
        "8cc970cf-871b-4818-a50e-2281b7cd8eca",
        "8ce1848d-6456-43b7-b9d9-9a4047d170a8",
        "8ce3ee34-6bfb-40bc-9a7b-b4aa831c161e",
        "8ce8d94c-59b4-4c46-9d14-035ee49a1009",
        "8ced118c-c19b-43a0-b8cd-1047fdf94e52",
        "8cf2cb62-c78a-45a4-af0a-0a406942eefc",
        "8d168d2f-5958-4098-b3c8-3e3476741bcc",
        "8d385bb0-6f77-4806-9876-ef8ad346fd94",
        "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75",
        "8d3f2bdf-4d12-4e0d-82fb-09d928ea8e64",
        "8d4fd786-8726-418f-bc76-5af2f6bf1f27",
        "8d5354a5-f76c-4cf6-b628-0cbba2bf1a10",
        "8d57d6d3-bf44-4055-bad4-e7429bb39dfe",
        "8d5a42e4-e67e-4876-9bae-37e27ca33a24",
        "8d7a07d6-8ec8-42f1-b5a1-c8ba4c6e4a98",
        "8da0d9f0-6ef2-440e-9ae9-2ad34bce7871",
        "8dc1af7b-fb00-43d8-b8cc-542eac0df520",
        "8ddc9388-5572-48bf-9a55-858c32ba9134",
        "8defe7d2-9f58-4bfd-a65f-574c0ae8a17a",
        "8e302e21-5988-4bd8-b630-ef48941a6a3e",
        "8e3b0452-a4d1-4a6b-bc7b-ac59c2e6eece",
        "8e6bc5cb-4ee9-4254-afed-7bc361a9806c",
        "8e6e7558-4e22-40f5-b287-e7bc902765ea",
        "8e92afdf-c705-4ecf-9ddc-67ea6857afb5",
        "8e95288f-32d3-4ec3-8b67-61858eebf263",
        "8e988761-8c96-4110-a683-79fc3e3d3506",
        "8ea0f778-534d-449c-b629-d62cdb4bff66",
        "8ea772ef-c5ac-4a26-9157-cf951f32c287",
        "8ed2459c-d06e-466e-9291-9173c556e0f8",
        "8ed256b3-305e-46c5-a8c8-26092acf64fa",
        "8edbeec2-bc81-4efe-865e-8f67adf67ae5",
        "8ede5bc6-9ca4-422d-a4a1-6927f8b8d1b6",
        "8efcb0c1-9a31-4ed2-9487-58bbe4004d0e",
        "8f0a08f7-a594-407d-b592-7ee0fd5d727f",
        "8f1608e0-8f3c-4c58-9f50-114394d6c07a",
        "8f28944c-e7c7-4c5b-ad4e-863089b3cafa",
        "8f7ca2f9-6a6a-4947-81ce-f5d7a84f56e9",
        "8f7d4596-05ab-4cae-a0cd-bf8684865584",
        "8f85807a-1c53-4468-ad63-624afba43424",
        "8f865069-db3f-40b0-90ff-77a73eba347a",
        "8f9ad981-2801-4064-af07-e6622a105e27",
        "8f9b5359-9eca-4f91-82c5-510e3c5f84a0",
        "8fb01043-6aa7-48c5-a67c-9d1fefc20472",
        "8fc7c000-1bee-4ded-89ec-4b3f4e7fe15b",
        "8fce3014-d948-4a8a-be09-75c3504ff299",
        "8fe6a7ed-c87a-478a-9322-8dcfdb2977ba",
        "9029041d-581a-4eed-a592-89e895dd8bfa",
        "902ad3ac-467f-4114-a7c2-ae6fbe6cbec1",
        "902c990c-6292-483e-8874-a26a9fc11153",
        "902fafe9-ec88-479b-883a-ae3bb4390e39",
        "903dc195-fbc6-4805-b389-0408eac82a50",
        "90465a3b-fef7-4b69-9da9-3d4859033d16",
        "90896613-84af-4e3a-a994-e720669bd45e",
        "90929fd3-b507-4e95-b91b-58d675665301",
        "90a7e7d0-5d4f-4aaf-b4b0-aa69a86d8131",
        "90a87c9d-002f-4635-a7dd-fbdb88ef8689",
        "90aa573a-0996-4e2c-802b-f847e30e4809",
        "90b758b1-46c9-412d-beaf-a9bb4dfeee17",
        "90cc43f2-6e73-4f2f-aae0-7d0ab561933a",
        "90d30923-4550-467b-83ef-9c67d63bd25f",
        "91072551-6b25-4fe3-8aeb-f3de71197180",
        "910e73de-67de-45f4-bc4d-9afef3a5dd7d",
        "f3280e73-fa62-40d8-886f-4ec9a45a3f1c",
        "911cc030-00a5-4c60-a170-a248f6cf1316",
        "91251859-6fc3-46f4-9489-69a1e8a2c5a0",
        "91524c9d-ef45-4477-a83d-afa63101e220",
        "916d3a56-1b7f-470e-9f1c-e563fb242dcc",
        "916df323-ca44-43a5-86a8-78dcd088a77c",
        "918010c7-4d6b-4bcf-8a09-333dee1bb310",
        "9185133a-4c5f-4737-87ae-ee764cd2b131",
        "91a9ef5f-99bd-4074-8bf3-d423ce485ecd",
        "91ad3f98-0eb1-4d13-af15-b90fdc6be320",
        "91b5a182-ce7a-430f-b7e0-c70fc45f30a9",
        "91c6080d-cc3a-4b6a-a5af-c1e2b2ab8a26",
        "91cb6096-f539-4971-be02-5a1e719de383",
        "91d12581-690f-4dfa-b9b4-e8eb17cd3656",
        "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a",
        "9211f894-205a-4fd0-8db3-c4aae2d7ea54",
        "9215d027-113b-491b-a814-8e37189a4fa0",
        "921e1a74-1a63-456b-99cc-e2e2fdd8c239",
        "9224fe6f-e627-46e2-be96-805c348b3a35",
        "922e894f-dd77-40b2-8eec-0a9099288c7b",
        "9237dfa2-c6a6-4982-a6c9-7678693e9fde",
        "9246e571-a328-4886-9c64-c58f556713f2",
        "925dfd61-6bc8-4a60-ae14-95ce8e93396c",
        "929afa24-c719-45cb-86ba-5655d8dcb284",
        "92b14365-0d5c-437d-9d93-971550a0e58e",
        "92b32351-ef5a-4c72-ac85-da4a2604f55f",
        "92c95cd8-ce64-441e-a31a-b47a3e14f821",
        "930fd259-6989-4929-b02d-ac7db138881c",
        "93223c42-fa74-4fe7-a060-ab4fcf5e704b",
        "93436513-4904-4bf6-8c43-d962ca432f8e",
        "934d7525-4386-4025-ad47-9a0281a46eec",
        "9352b053-8490-4cf1-881f-18e4629f373c",
        "93677713-f75a-45b9-aba5-2110b48bf1a8",
        "936cbddf-a91f-45d6-99e7-f290825299c3",
        "93860e5b-c06d-4e75-ac93-aa412a4f5378",
        "938e6818-c244-4076-925c-b547451aba1e",
        "93a5f482-d850-4bb5-9444-bfb71fd9ffb4",
        "93b4926c-6233-4813-8c2b-f3237699a38f",
        "93b8650f-ad74-455a-8f9f-8cc74235fc13",
        "93c3162a-0e71-424a-9526-16ff29fe40e9",
        "93e2aeda-878c-4cdf-9c78-119b3628a9ba",
        "93ed2686-2307-454a-88ce-4edc0f602820",
        "94250551-1ff3-4551-b4c8-1d60413d4353",
        "942c90d0-38b0-4ef5-a4fc-ff2546179895",
        "9441d79c-4e79-4928-b94b-aa199a64a880",
        "9445245c-750d-4d07-9cd8-b081263b8c8f",
        "946bfd4b-36a2-40d6-a676-91ee9a5e821c",
        "9473ba10-1c29-480a-a3b3-fecc42edac59",
        "94bbfd84-5418-4cf7-9d6f-8c922b43b787",
        "94cc7453-2c8b-49c0-b52b-37260990cff7",
        "94d47136-8227-4562-9aaa-a35aa365e175",
        "94df0296-18bf-43fa-86c5-71de769a58ed",
        "94f0a7eb-cd03-46a8-b1a0-a1e9e3a6446e",
        "94fbc5be-c39e-468b-bfbc-8a78cb63147c",
        "95075577-d69b-4fb2-ae13-ad8b821d1c08",
        "9508b448-2e94-4035-ad6a-e258eacc8004",
        "9512c6d0-1518-41b5-8844-746736cceb6f",
        "95187322-20c4-445c-9fe4-c82a1c2fe872",
        "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd",
        "9544527f-a455-4c1e-8d5b-dd7dd1d5b479",
        "954ba80e-1e1b-4360-81f1-f35c84468fc6",
        "954c9d21-acf7-40ba-ba8e-a2866e3b718d",
        "955a35b3-fccd-42c0-969c-8d89038f7dba",
        "9567ef9a-29a5-43a5-9e33-f63a52a42f0f",
        "a35c3514-f6e9-48b4-8fb6-b22fe7bc8b7e",
        "95693891-4051-4458-bb79-f2c042c960ee",
        "957bfdee-dff6-4a78-b3f8-c7676211271a",
        "957d5d62-181e-4389-b2d4-f9a8fb8063f3",
        "957d9001-3dc4-4855-9e1f-8ec84449b970",
        "95d64b4b-8644-46ae-b068-3c862691529b",
        "95e1cdb7-37c8-4805-ab3b-79440521b0ca",
        "95f70a6c-46c4-44ca-b33b-3fa46ff797e2",
        "960b59c0-a95e-4640-a68a-383a826f7771",
        "9617e294-a6f3-4fbf-a510-92a976adc383",
        "961aa042-bf5a-4e0e-8838-4e423f96b48e",
        "9641d376-2f72-4925-867a-a1fff4dfe991",
        "96610d69-2cc1-4fda-a5ae-83bb3fb14f10",
        "966e5bc5-8380-47ee-937e-7b79254aacb3",
        "9679dc81-c45e-4ada-b640-b6b126b18545",
        "967fad04-a2e7-4bc0-9c75-59160385a7f8",
        "96805545-c0a1-4287-9013-314a9353000b",
        "96817501-505c-48b7-a93e-b0f3c99f0e04",
        "968f4197-59e5-4ee2-b6d8-bcf6d0f35d34",
        "969683d8-930d-4868-b439-e27f6e374c5f",
        "96a961bc-c4f6-4ab1-a5a1-dbda9d753ef4",
        "96ae92a6-d11c-423a-9b71-95e05505d615",
        "96cb4d54-ddab-4e4c-8e10-64bc693c7109",
        "972eb561-b426-416b-a465-449b5216f799",
        "973c6f32-06d8-477f-9cd6-668635d88f8c",
        "975e1f4e-a2d1-4d6d-a133-aee90e168fe3",
        "9778f127-f545-4060-a4d0-0efe1a6e525b",
        "97989831-c41f-4174-a8d7-4bd88a5ebcf9",
        "97adf89d-e617-457b-94ad-b4997241d701",
        "97ca5f71-6917-418d-914c-e23c35ee3c7f",
        "97cce4a7-d6a3-4f9c-8e3b-f89e696253a4",
        "97fae90e-1b27-4ab2-acb8-e82d3324f41c",
        "9802d57c-9523-4693-a538-3eacf7eb8cc1",
        "980ec1d6-e971-4c81-a42a-c182990f92b9",
        "982f17d9-b696-4dc4-97e9-acce9ed21c7a",
        "983fcb38-1117-4ad3-8fcb-e2345525ae64",
        "984a9e76-6fc3-47e4-9ea5-18c6fed3d60e",
        "98567788-6567-4c1f-b1e5-33542a01f4eb",
        "9883e6c1-7f6a-4991-8fc7-b562b4fe19f3",
        "9890329d-d43f-4cb3-8bd1-edaac7f16bd6",
        "98b4936a-3ff6-4f13-9444-65939a1773c8",
        "98bc2d80-a31c-4590-a9de-424918660ca9",
        "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4",
        "98d7e6d9-3f20-4e6d-897a-78466ea002b9",
        "98d8ccb0-44e9-4a6f-b062-8caac7d7962f",
        "9906c2aa-5bed-4e18-8276-9117116a1956",
        "9911d254-fc7d-402e-a525-52503f750d32",
        "9916850b-b79b-4f71-bf9c-1873cfe789ce",
        "991a5d3f-1633-4ce7-b9d6-4f91dfb5a2b0",
        "99236c01-169b-49d0-880e-ac6f1f2bc44a",
        "9933da37-aff9-4593-8382-c951f944bbf1",
        "99372590-f5bb-46b2-9c7a-eaf77d21c3d6",
        "99375eef-5c46-46d1-ac78-66921d8d9e5f",
        "99393507-1063-4fd4-a1a5-71b7fa4f775f",
        "99611a6d-566e-4a15-9843-4ab2d8edee38",
        "99902997-d645-44b3-8e07-2f70484e0e3c",
        "9990f101-aecc-4117-944d-3ae1bb6baaee",
        "99bc5f7d-5b87-4167-85be-ed144a5673be",
        "99ff3cd4-a0da-4b13-a18a-4d940003ede5",
        "9a1e088c-0b54-4b7e-b814-8d01eb28204b",
        "9a3f439a-20a6-41ae-a317-a3540d5dcc6f",
        "9a41130a-e561-4499-a2fd-aea4ad3e3cd6",
        "9a4d4993-8b3d-4613-ada6-47ac6698b911",
        "9a51b79c-a2a8-48f5-b131-43b761694c17",
        "9a7027ec-ccf4-40ae-9514-97d4d4f922d7",
        "9aa0862f-94c7-49ac-bdbf-8a74717e2d28",
        "9ab4adb2-166f-4973-ad10-0276c09748ef",
        "9afdf872-441d-4f01-9d0a-c782a3bf4fa8",
        "9b04defa-3fd2-4ed4-babc-c67f6e95f05a",
        "9b1cdb85-bd95-4cc3-9d18-7e563094c355",
        "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b",
        "9b3b6873-c8c6-42b5-ae89-ca74a1246f09",
        "9b4219f2-f1bf-4345-b824-ce3630a23290",
        "9b56b40b-f121-47fe-a43e-424285473e21",
        "9b7679ed-adeb-4044-b9f1-5471d75631bf",
        "9b7fd6d2-ddbd-4823-b64e-4ce36403de86",
        "9bae739e-4ee5-4c7b-a103-e408a358c037",
        "9bb40c93-bac3-45fc-985c-06c53693a5ce",
        "9bb564db-229b-4605-a8b8-c81e9756d621",
        "9bc085e8-3d64-4916-9616-a7c6972fee25",
        "9bee26a6-193a-4333-9ada-8f864d819dc6",
        "9bfbb59a-a6b5-410f-a57c-7c0cdfcb26e1",
        "9c059919-1c3f-4f13-92b4-c8ca1fef710e",
        "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0",
        "9c4070df-5538-4531-9535-3a3f18fdacb8",
        "9c539493-2ab7-4b55-adfd-9a0316e33350",
        "9c6e1b60-0382-4c17-8a9a-daf94c2b656b",
        "9c74741e-6e7a-4f32-8089-4a754b4b5693",
        "9c80b756-0bf7-450f-922e-d106bbd0e3e9",
        "9c935e29-e34c-4bbd-a646-59c3e6eb2892",
        "9cb1cc6b-4120-404a-9d0d-4eb2c1a729ee",
        "9cd74508-51bf-43ba-8e56-3b4a96dee7da",
        "9cdb26dc-296e-4204-b34d-27f861b1c8c7",
        "9cef097a-b805-4cf2-adc2-3de7a124c571",
        "9d0571d3-23bc-4307-874e-602e68d91e31",
        "9d176419-8497-4185-ac3f-6351df75212e",
        "9d365d08-3b31-4aa5-a04c-773c369cacb2",
        "9d59d0f7-12bf-4f25-9620-c87f741d60dc",
        "9d6d7833-db53-4b7e-9d3c-fe7546c6996a",
        "9d9b7de9-2afe-4ae8-9697-ddf1c15b8efb",
        "9da0eed6-71f6-4b30-8190-3f7e4be0113f",
        "9da14493-aa82-4a35-b590-b60c33a38b2a",
        "9dd649f4-ace7-4014-8992-6549bcc760ac",
        "9dd6b0b2-2753-49ae-a496-221c057768e5",
        "9e16af46-5729-4a1a-9562-3ffc825398a0",
        "9e5beb5a-df70-4084-a31f-fc3d413654c4",
        "9e868023-b4a8-4742-9e6e-6f0ef6eb0d1e",
        "9e8faaf3-5600-4362-b7aa-02facf97063d",
        "9ea03db2-28f4-4689-a8a4-0c67c5d3cea7",
        "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e",
        "9eb05dd0-f20d-4214-aae8-77c299591713",
        "9ec90816-f4be-4472-97e4-db6e89d06c03",
        "9ecd018e-6527-41cf-a70a-32aa6aaadb1c",
        "9ecf6f64-41aa-47b6-a1ee-a582fc511f0c",
        "9ed8f570-aff8-4550-9501-be73f841d2a8",
        "9f0e3c7d-f654-4e7d-aea0-12cb6fa2033e",
        "9f1038d1-2e4a-45ea-89cf-839db7df6f50",
        "9f16241e-ae54-4aff-9f9a-2fc56c0e39f9",
        "9f18e33a-2e23-4067-ba65-42203be9e8a4",
        "9f1b368b-0032-45af-9958-1f6fedecda17",
        "9f1f6ab4-dc2c-4c2b-8405-655590efd8f4",
        "9f230013-c918-46b0-b3c1-b79621ee19fd",
        "9f316c5f-82ca-4fe4-a2f0-2278a620199b",
        "9f40e2f8-5f3d-45e6-bca1-58bc524629af",
        "9f49314c-4e5c-4721-adc1-ae51a8cf2eab",
        "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576",
        "9f6119fd-a630-4e1d-b805-efc1ba469df6",
        "9f766e0e-f7fc-41d8-bd8b-e42fd558cb51",
        "9f7b4235-d864-44dc-836b-4295abae990d",
        "9f7bf55b-61e6-4839-97db-ab40906ff080",
        "9f8ab894-6254-4167-bcd5-44f3628688b1",
        "9fa31581-335b-491a-af12-5bed296f4554",
        "9fa34935-2bb4-4182-89c4-f8cca3d38f6f",
        "9fcb811b-da2f-45e8-8e39-91c95ebf6cdb",
        "9fdd8b1d-c965-4ab7-8437-22c7ac9ce961",
        "9febcbea-a12f-4b91-8b5f-cb1707264e06",
        "9ff2de6e-02e5-49f8-ab9d-968acdcca76f",
        "a057a2e7-7cae-4935-9e3f-35a949ec649a",
        "a06b08a3-27ec-47bb-aeaa-27d1d331f408",
        "a06fb4b7-267f-44d9-9446-89dee566f1d1",
        "a0740287-b5fa-4b23-8b95-1173e26c285e",
        "a07d0066-a58a-4f2f-a3e1-6ced5b176cb0",
        "a0adcda9-c146-4074-abeb-64deec30e6f8",
        "a36d0dad-adb8-4f46-8bce-d2613e6e58fa",
        "a0b27aee-efd0-4e9a-9b63-f0797cb3fc2f",
        "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2",
        "a0bfe6eb-fdb8-47b3-b5d6-16689fe2099f",
        "a0ca2e2d-7d58-4a3a-9f2f-b64ed2b5f543",
        "a0ceaaf4-0cea-4e45-8718-986c42bf025e",
        "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9",
        "a0e8af23-3b6a-4598-aef6-b59d96fe91c9",
        "a0f14241-210e-4a10-a373-5669edf360d2",
        "a0f9e923-6270-4246-aec9-3c9388cd6c7b",
        "a0ffaa0f-81ac-4d2e-84f1-3582743c76f2",
        "a11a5bf3-4457-464d-a646-782745329a04",
        "a1229573-300b-45d7-894f-327e56c12b36",
        "a12e7e64-911f-4f9b-9844-5e4384d8ea97",
        "a1384c4b-9b6d-49e2-9f9e-282540523c36",
        "a16ca291-401b-4c37-aa04-738b2b871cb7",
        "a181f788-e771-4dc2-9759-7cb24875069e",
        "a18520f5-71d6-4e93-8038-52dd684f3cb8",
        "a18be1f6-d423-4687-8595-d7063399adbc",
        "a1943271-032c-4813-bbdc-0f855504ef24",
        "a1a15c86-cd1f-486a-90dd-73398d816bae",
        "a1a909ac-4280-4431-b4ba-cf044c92bfdb",
        "a1ab9d45-4bcb-474c-8e70-2bd8d5ad9c57",
        "a1b99564-be64-44f3-a898-d9da73a02d06",
        "a1b9e1f1-c723-443e-9ba4-df0c91a50c10",
        "a1c061d4-b0bf-45cd-9666-00301156c155",
        "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051",
        "a1d78ed9-10ba-481a-b546-997d9071493d",
        "a1da8c19-8904-456c-b730-5da0c8ba4525",
        "a1e45924-4db2-401a-a590-9a331ee90c58",
        "a3b2698a-7db0-4d6a-9417-21a81ce71a22",
        "a2071b53-e309-48f1-aa6b-91ae52b8cba9",
        "a20aadbb-e09e-4b8b-ae46-43bd6aad34d1",
        "a235d0de-ef91-4489-a478-3fbdd560b63d",
        "a23af4ac-005d-49d7-816f-7890c9cdd560",
        "a24a2c88-b3d4-4774-9965-81e5af1d23c0",
        "a24c627c-7c84-4a6e-9c18-71d48b945135",
        "a25c40bd-0d1f-4eb0-b2ee-1ee4225232e4",
        "a2698ed3-89a9-488c-96c7-04888ded0d0e",
        "a26aef1b-0365-4427-b0f1-0f7b00923f4a",
        "a27f674e-f4b3-4a55-ad90-f556ad99b200",
        "a282aab1-1215-4456-81eb-42b2f6bd9e78",
        "a2983781-976f-4ade-9b5f-93bb024c8f41",
        "a29d3707-fec6-458a-bf65-82a592aec319",
        "a2af2016-4666-4adb-83d9-ad49bc9351dd",
        "a2b07bdc-e54d-4e65-91e4-10dfc9cdf820",
        "a2bf1789-0b66-4299-90cc-dc8cea6a9228",
        "a2cfe5e4-da16-4a83-ad1e-9f12c19fd836",
        "a2d0f816-8490-4f26-97f7-8262c4010588",
        "a2e133c5-55c3-4926-9d3c-daece851efa7",
        "a2e4ab23-446e-4f69-a75b-58f4e0ad7385",
        "a2eb5966-b94c-4f30-8b77-040ff6abcd79",
        "a311326e-7f3c-48f3-b605-4aeb766df3ef",
        "a336ab24-2ddd-4d2f-9f98-cc3d03b72daa",
        "f3294002-7e34-4e67-923a-ae514cf25637",
        "a7503cf4-ded0-4f83-b203-f51b01fd84f8",
        "a752ea36-5f91-483d-bca0-f4f012007620",
        "a76fd725-d72a-49c2-b4db-296f744c88b6",
        "a78ea411-cf38-47a3-aa8e-b0340c3c921e",
        "a7b7c724-bca3-43cf-bdab-d0a194b8f983",
        "a7ff2c22-6c1d-4bdf-b550-0a4d88220730",
        "a80ed5dd-8157-4d00-a434-b8eabbd18a83",
        "a832ead3-ef65-4341-a846-ed48d5b298f5",
        "a85ac6fc-19de-4108-98fa-7b4b52af38b4",
        "a85cd4e0-9d79-495b-a0b5-877ba28cce25",
        "a8acddfb-7247-4c50-acdb-e6ff7de47d11",
        "a8b0d7b3-4a60-48a6-b182-07437a620840",
        "a8b58a82-875b-47ff-872e-8d2d848595a3",
        "a8b7549f-9bf9-4e13-b7d5-7451f386b1e5",
        "a8d694fc-908a-4c6f-a782-87355db772c0",
        "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89",
        "a8fd8b4c-d2df-4c7b-b418-070cae01d1e7",
        "a90a9701-67ec-4c0a-9909-7c20db1b3c0c",
        "a9104fda-f204-4cbf-8b47-55e0e0087794",
        "a912edc7-2d49-47b2-be56-4b4b56a959c5",
        "a92d65ee-208c-4da2-8aec-e3d9a7357fd5",
        "a934be7c-dc22-4836-8cb8-13de5e448dfb",
        "a946e7c6-4d07-48a3-b5ef-2d03783ecca6",
        "a951a8cc-20e3-4fec-b49d-ed86e2181373",
        "a9561930-907d-463c-b6e0-06076faa6a7d",
        "a9596051-4cee-4249-9782-370996ce0b11",
        "a97f9f4b-ebdc-4b6b-a50a-389417b707a9",
        "a984264e-8841-4347-a7fa-66d585714db2",
        "a9ff053a-aaf3-4608-aafa-509d4f564c49",
        "aa10981d-f948-4579-8343-bee77ac5ce47",
        "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc",
        "aa219017-d07c-41a3-85e0-b984cc3b30ef",
        "aa30cf2b-7ebe-40f6-8d82-22c2da95e5a1",
        "aa555edb-3fae-43a1-adff-613f8bc671cc",
        "aa6e7a84-ce45-4319-9f2a-44bc930a1798",
        "aa6e9a8a-7c0a-4e0a-8926-67d9be18f8e5",
        "f331c983-ef74-4b6c-a8be-cdd9e206c78d",
        "aa80dda6-9ed2-42fb-9a53-216c8a81bc19",
        "aa8c2c90-431c-41e7-b458-316aa6ac6b6e",
        "aa9b2a9f-e2d5-4f0c-9472-e53543930eb1",
        "aab36ea2-475d-4a3b-8aa1-f320df6fe83d",
        "aac0a049-80d7-44ed-8277-ee2579558d49",
        "aae84e5c-1e5c-4fda-ad61-31a182691d3c",
        "ab04fd03-f263-4ba6-ade2-d3615a1804fc",
        "ab1110b0-58fa-4e15-aa7e-69f952288350",
        "ab1e96d3-b609-457b-8af5-ccf057959d8e",
        "ab3cc206-86e9-4b69-b978-5e6057e1c1be",
        "ab454ba0-653d-481c-a42a-b6d9364ed90f",
        "ab4c57e2-53a5-448f-a504-2ca3a71c9989",
        "ab4f2ff8-63e1-4e96-b1bf-fb8a679af529",
        "ab6b2c94-3046-435d-bfc0-196777b2a1eb",
        "ab71c969-f64a-4baa-a0c8-656608d3c60b",
        "ab814ba6-5e19-494a-8708-cc646f468e32",
        "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e",
        "abcbf5f5-4b82-4042-986a-975f8cee459d",
        "abd2773a-9385-4107-8c5f-7aecb8ac202b",
        "abed7b35-a24a-406c-9a36-9eae020e3333",
        "ac89269e-d27a-4ca5-a7a0-8821459e5475",
        "acb0f862-0b65-4a16-8565-abeee9fdeed7",
        "acba24b8-29c7-4dbd-a321-3c8f23ab5300",
        "ace02164-d4f0-4093-ad34-2ead2f48baf0",
        "ace4b6bc-3492-4a20-b10e-f18708996840",
        "ad1fa38d-0f2f-48e0-bda4-129f51a32e62",
        "ad2e0728-5ce0-41da-bd95-607df2711df7",
        "ad34b5d9-93b9-4817-93ca-8e187e5dae93",
        "ad3edaec-52c8-4464-9e0e-910515ebeca9",
        "ad4631ba-f386-4a94-a960-7b5dd54a1ea0",
        "ad4d9ff0-1af7-4877-9bff-5d9519d448e7",
        "ad4e2dab-bbd9-4a2d-ad6d-0501c223c6e3",
        "ad5834d8-8495-48c3-bf4f-735c468bd5b9",
        "ad66412f-f0bf-4afa-b9ef-ed20dcb8dccc",
        "ad863a9c-50b3-4417-af59-77ddb6f333d8",
        "ada55a9e-2a4f-4d7f-ad20-21fa6b71f98a",
        "adaed617-3ff6-41c1-abcb-294fa363c37a",
        "adcd53b3-7ddc-4e20-b16a-62314c5f48ff",
        "adddb723-becb-42a2-a321-977aa721aed3",
        "addf8952-c092-476e-a095-c61580a57cce",
        "ae0b1ff7-ee9b-4d52-bfa0-13c192c664e3",
        "ae176912-d4bd-4c1a-9796-f72717fb8881",
        "ae1af250-cf37-46f2-9fc4-b6ff41bbaa07",
        "ae1fd514-21a3-4771-b5d0-060e156cbdcd",
        "ae239fab-b86f-4f14-b0d9-910168e3214b",
        "ae30be5a-7eff-4bd2-905f-63e77365dc64",
        "ae363bb5-6194-4543-8bb9-2c5f8c19f9d7",
        "ae3c13b8-7618-45ec-ad94-c3d483d129b4",
        "ae3c5f41-5891-4072-bf9e-cfd7ae9b03ae",
        "ae3db2e8-9f80-4337-9499-aa4630c9c0fa",
        "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0",
        "ae839290-b72b-4af2-bd71-35db03dee76c",
        "aed9c009-0566-4761-b5c6-7451fd5664e9",
        "aee04518-1179-45ec-82c9-3ce86eaff0bb",
        "af10ccbd-4d29-41aa-93ca-a7928167c449",
        "af36a67c-2602-43fc-91aa-8311e2d173e8",
        "af3df921-34b7-45fb-b71e-a4ecd8ee70a6",
        "af4d9ed5-5f1a-4c9f-91fb-bf0de9298f61",
        "af58dcc4-051b-4959-9411-8a78b357b297",
        "af7a9db5-3881-4796-a0e1-1b5ba680d18c",
        "af8a69d9-5203-497d-9a07-b7ce6e42d28e",
        "af8d7d3d-9db6-449d-a14a-4a8fe309cc81",
        "af9688fc-fae9-4a43-a1f1-040c21d2f6e2",
        "af99cfb9-adc8-4bfc-898c-2dc4400c55bf",
        "afac8268-cd52-4cf9-ad4b-a8453708ae17",
        "f3468446-7d8e-4484-a4d9-ff7be249c623",
        "afb0d6c6-1ef1-4c2d-8c39-dd68539ad2d9",
        "afc26272-44d9-4929-967a-4aeb2d2589a6",
        "b01024ca-8e60-47b9-b0d0-d2faa897d293",
        "b0188d7e-3f91-4fbc-9b9b-eabe06f80ccd",
        "b032ddfa-1e17-4974-ac8e-a27a1ef1bdb1",
        "b0338786-c64d-4a7f-9f00-d1a5ad7cbafc",
        "b048574e-34b1-402c-9cd7-fab5320d4ec8",
        "b04ae4a8-72e8-4cdf-b96c-4fd69839913c",
        "b0846d00-304a-4339-9eac-bae334b1b3ae",
        "b086c1c7-92e8-47d0-a0cc-6573faf6ca97",
        "b0a30da6-ddb3-4f7c-9cbf-f38583df2725",
        "b0b13b6a-0d30-4ab2-a078-d38dabe3c4dd",
        "b0cfe4a5-f194-4e3e-a0d9-2d771de23e7f",
        "b0d7a47d-f74c-4cce-a60c-199c28c181d6",
        "b0f1e956-dcf7-47c3-af88-20b5da01bb5f",
        "b10be247-fb22-43b3-a473-b001669260b7",
        "b10e1172-4656-4fbc-9150-d8fca998bffe",
        "b1101a30-ab2c-4fbc-b303-742e285b4b86",
        "b11a3a2b-7d8c-4b94-9e32-12f8ea2ff942",
        "b12e2893-8a4c-4e85-a0bc-0a712f4a07d3",
        "b136d0ca-1226-4716-9f29-55343df49517",
        "b141c9ca-efc1-4e59-a349-d337e0af9527",
        "b16814d8-4fed-4a1c-b8d2-601ef222983c",
        "b190e73b-9537-4b3b-bb6d-d972552aaa7a",
        "b1fe24bd-c1a3-4b9b-bec3-3357cc11db65",
        "b20ebf5b-7a83-4111-b676-6abc3ecc542a",
        "b21468f1-b6f0-446a-a05d-cccd19ab78ea",
        "b223c696-5229-46de-b1ed-b6942c4b5fae",
        "b230030d-d54d-4dc3-aee6-da0d6508f2e3",
        "b2605f5d-e7af-4276-aee4-fd38dd7ab70e",
        "b266a084-9131-4b7f-8824-36d72dcd069a",
        "b27dc8c8-d951-43f8-89a6-3db5de57a3f9",
        "b293b07a-3276-4cf5-8aab-1c59bf538e84",
        "b2bdd466-afc9-4a4e-a454-0d505bdcafc0",
        "b2f251c3-8452-4e27-a62f-150f9be6b58f",
        "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa",
        "b3004026-1f69-4a58-bce8-f1c479b92c38",
        "b3241060-e8c3-411a-8988-06a2e2b575f3",
        "b337304d-f1bc-40a3-9960-ded78a8bbe32",
        "b33863d0-02c7-4856-b20b-a678f7d8fe48",
        "b35a0597-a3ec-47e0-9134-2afd61feb76f",
        "b35f0ded-140d-4286-b749-9c62f7f6d1d2",
        "b35fcad5-9b77-428c-9c05-e7f83e44fa81",
        "b36b4bab-8f2c-43d5-8a30-3e95166ba099",
        "b376d0f1-e7e3-4080-b99d-da7cbab029ac",
        "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5",
        "b3e84a94-32de-4f3f-bdd7-60a5df10b720",
        "b3fcec48-3e7b-4cf6-99c3-a88f98e373be",
        "b4275499-f15d-49dc-b484-93104fed5baf",
        "b44dccbc-54e3-4706-81f0-12ef1fb5d849",
        "b45954a6-6df4-4c8e-b253-0739d20469d0",
        "b46eb45e-3936-4227-aa0e-593a18810764",
        "b4a7e542-a685-4a24-b200-dc2bdce80569",
        "b4c0f480-4c2e-48f6-8fd3-ff1ef3216c94",
        "b4c1f915-2c11-4ee1-afb0-80b30c246092",
        "b4cb2376-7341-46d1-8da8-c607ba861bee",
        "b4ce9b25-7d0d-47a4-a56a-647a9a8e52c0",
        "b4d5a09d-4adf-4a4e-9a98-b38695adc600",
        "b4ddaf27-9bbb-436d-885e-9dac2dc2a1b7",
        "b4ec204a-cd61-4704-a9b9-4e5201368e6c",
        "b4f88db1-d32d-4017-ba0a-620d39c745b8",
        "b516d085-4346-4e41-a5e9-362d7917925d",
        "b56e4155-7937-49dd-b951-4e24bd0d3cb9",
        "b580b5b5-aec7-45cb-b8ba-b792dc295685",
        "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f",
        "b5b8a880-95a1-4c97-96cb-f6cdd02cc644",
        "b5b95c19-f16f-445c-90d2-18dc77e53b5c",
        "f348b7af-8966-4f84-bf19-cb4ea202d2c1",
        "b5d1d487-a20c-4ff6-a12a-dff1ccdb15cc",
        "b5d5d4cc-17c5-41cc-af33-073aae55ae5b",
        "b5f43fd9-e888-4025-9d1b-3337a0e6f8d4",
        "b6153afa-d58a-4a17-af0a-1846a8bee489",
        "b63c5fe1-9686-498c-b835-0706486a09b2",
        "b63db20d-2c9d-4b46-9718-0e195a98532b",
        "b650c8da-fa63-48b2-917d-b46fff83469a",
        "b65eec5e-3793-47da-acd3-e7e14b4005b6",
        "b6662f1d-6cfd-4615-a2fc-4298aabe4316",
        "b66c08cd-0328-4393-af5f-e33443fd10a2",
        "b67ade93-5e64-4bde-ba08-13646864e8c5",
        "b683952c-d14f-4262-8cb5-3f2a90e7e431",
        "b68f8c12-de9b-4704-948c-e94f955a126f",
        "b6a0347b-6145-43f3-94d5-777dcb539644",
        "b6a8144c-609c-45c1-8104-fc0297494bec",
        "b6bd4f0b-4d1f-4d51-9bae-fe0b9a980d9e",
        "b6c1dc24-29e2-4c0d-96db-e554cce91766",
        "b6c48839-f5a2-439d-801c-05395cdcd041",
        "b6d6da31-328f-47e5-8a40-5cc4af236e06",
        "b6edbe70-2545-4515-bd73-732b99afa8fa",
        "b6fdc51c-0bd5-4c96-8943-8506af09a1f2",
        "b71d6679-d013-4388-a69c-ccd1e99e585c",
        "b731583b-8cd5-4448-b96a-d1129acd4f97",
        "b75ae6e3-cedb-4f6c-ad87-d78ef3967672",
        "b761d298-2e6a-4f98-8caf-293457324bb9",
        "b79d7167-5789-4a80-b122-aae3ff1dec1e",
        "b7a19c64-f66d-4c50-8ffa-a9e79f10c43c",
        "b7cf3ed0-e692-429b-9995-0233a74c2740",
        "b7d7e6c5-4d26-47ea-81bd-b16194b6ba67",
        "b80ced56-3a6c-46ee-aec9-b6b347b421d4",
        "b825091c-a2bb-456f-a2e9-c1a7ed6c544a",
        "b83170dd-a3fe-4f03-923a-26cb5d521209",
        "b840aa19-73af-4034-bfe5-f2b8e9fe2fcd",
        "b842fe0a-4e4f-4fd1-9043-bdf093040c9f",
        "f3505c9f-7bc3-4928-8b6f-b26ce699adb6",
        "b8612f8b-f1ba-4468-b289-527f723aaeb3",
        "b86eaf51-0341-4598-9aec-b05bb725d80e",
        "b87ef7cb-f46f-4b18-86b4-5ca17f1ed246",
        "b8840357-701e-4da2-acf2-8f1519e9ce94",
        "b887a475-2699-43ba-90e6-b888f82dc778",
        "b892c74e-0244-42e1-a9ae-a2c72d8d1675",
        "b8999693-0ef0-45aa-ada4-fa8f6b1a9fa2",
        "b8b51ab3-c38b-481a-acc4-756d9d4b868b",
        "b8c13cbd-ea1a-4654-a76e-4e50eed8336f",
        "b904dc3f-17de-4695-887e-2b733688745b",
        "b942eac8-11c3-4adc-8b68-d7338ce0dc4e",
        "b94b2e41-0603-41f8-98f8-7e5c28c53400",
        "b953bdf0-bf13-4525-a812-de1e055467ab",
        "b95b71ce-7043-4f83-a7a6-c4ffd1c1d151",
        "b9695cf6-2aef-4521-b396-5da168474f4a",
        "b976f03c-e1d9-4cac-ae72-6cf51aa2b817",
        "b9819efc-6932-4b3f-a856-4a483ed6fe5c",
        "b981ea3f-ece0-4f5d-aff1-4db7d8ebd82d",
        "b98b77e3-691d-4a22-8ce3-505d63cf0e27",
        "b9913a1c-4946-48f5-bad5-6500fcbbd3ad",
        "b9933717-74b1-4ddb-ae42-abd579dae73a",
        "b9cf9f2b-0a9f-4b3e-8521-e2cccc9d4f0f",
        "b9e18b01-5330-40ae-b5fe-ede8d0156c37",
        "b9eb78f9-1ad4-42cc-8751-b6dd184e8610",
        "b9f485d1-e1c4-4682-b121-2ae6c48a50e3",
        "ba4fafe7-206b-4e66-8503-6df53b92a12d",
        "ba53eea8-8197-4275-9653-2cd3a65de36d",
        "ba58c846-ca4d-4941-b3f3-c3bed7635e44",
        "ba5e6f7e-8fde-4579-8efe-ab38c959c51f",
        "ba92748d-9020-4117-9aba-6298d753164e",
        "ba965c7e-e7b3-4a81-a72a-ac52e99a737f",
        "baa16630-71fa-4aa8-8d19-f53fdeec1a50",
        "bad36364-0b24-4575-9b56-f240f05bf9cb",
        "bb0abfdd-e193-4d23-bb04-0b52ab0aaa32",
        "bb0cbec2-432a-409f-91aa-4a14b1119e0f",
        "bb197d8f-92eb-4a69-8e1c-2f982c97fef3",
        "bb2a76eb-0bad-4c00-a24f-bfd223212f92",
        "bb4ac4b8-bd5d-4b6b-b480-33c657411c22",
        "bb4e40a6-670e-44a5-bef0-8dee6cfb2d7d",
        "bb5115bc-f588-4886-b166-059f7d315118",
        "bbabebf3-279a-4315-ba40-db89ced4f07a",
        "bbe1535e-72b7-4fce-b309-88c2a11a384f",
        "bbe37d6c-331a-4dc1-908c-f8e98cdc3451",
        "bc08e665-a3d5-498e-b516-74dbb279e8ae",
        "bc321ac7-fa32-4fbb-987f-7b34b9a9cffc",
        "bc3ab192-d637-4dd3-9991-53747754aa21",
        "bc3eb7a7-7aae-4b74-bb60-0c816ab3d8f9",
        "bc45338b-0b19-4fb9-956a-77881e517979",
        "bc4ee5a9-1dff-42ad-9571-46a30ba9de08",
        "bc5bee66-ccfe-4a02-ad14-ca7f8e699081",
        "bc6b77a9-9492-40c9-a4b9-9f422631201d",
        "bc851e16-d394-459b-8f95-8980a31de89f",
        "bc9408ad-bb60-4820-9e4d-d1dc86dbbffb",
        "bc95cc59-8533-4dbc-ad8e-25315f698d99",
        "bc96bef7-ce14-4cc5-a491-ace67a529089",
        "bc99928c-e28f-4705-a424-e11d84c71bbb",
        "bca69100-cbc2-4181-8079-4c94b5904b28",
        "bcb95990-d2d7-4f65-b5fb-c90b76a6020b",
        "bd09d83d-1253-4736-93a7-d6f05f8d0be4",
        "bd09ec5d-b3b7-4361-85dc-0e22e0ae11a1",
        "bd15c670-4cd6-4739-9695-4a4b43ca68ae",
        "bd25e92f-94bf-42da-ba91-f7e7e1acce8c",
        "bd32bde0-7e1b-4827-9b86-46d9847ec9d4",
        "bd3cd1c0-4511-45af-b915-c3253c6be9b9",
        "bd4f9019-17e1-4576-9b57-5db5ab7d387b",
        "bd622e24-e1be-4c5d-b093-5fc782a28303",
        "bd8f8477-1c1b-4e82-8e28-8e8b34acbdf4",
        "bd988869-d5c1-4965-81b2-d2a93978687d",
        "bda42d37-7c1b-4f5b-bec5-27123717475d",
        "bdaea78e-0eca-4865-88ec-836565014d90",
        "bdb6a8ef-7b4b-419d-ae8d-d899f6e624df",
        "bdce294f-72f5-4ea7-8df7-1eddad9ceb66",
        "bdd1d054-d48b-45d6-bc32-8f4c02bcb09b",
        "bdd50734-2af3-4834-a75f-c716c134d793",
        "bde12a75-ba21-4f32-9eb4-250fee43f3b7",
        "bdf2358b-586d-43c6-8d41-5172419e2ab3",
        "be0d3274-d93f-4860-8c03-2d948c08fa72",
        "be237960-293e-4eb8-a670-6cadae19f8ca",
        "be28e386-75e3-43bd-9bce-160d92c97586",
        "be873599-5d10-4eb2-b6d9-7602c7f2e848",
        "be88bfc7-2e32-4e55-94c5-f867d31ff150",
        "be9b63fa-dab3-4bb9-8cb4-b4ad51c97166",
        "beaba0f6-fa09-4708-b5e3-ef38bbec42e4",
        "bec03f87-64b9-4cd7-af23-26f6ead470fc",
        "bee53cb1-c200-4f62-8be2-715c4382f43a",
        "beeb5e0c-d8a5-482d-ba6b-10fa2d75fbcb",
        "bf052e0c-5132-43bf-8f9f-a754228a153c",
        "bf07e11f-c2d4-49be-84d7-ca58ac64a528",
        "bf2fff39-f187-4b65-88e5-5524b9060ff0",
        "bf56344b-2b27-4780-85d5-ad6849f9dbf1",
        "bf5b3482-515d-429a-9a3f-b78bb4e35e8b",
        "bf9e9f57-6611-47ce-b365-5ec38fd91613",
        "bfa0f56b-de84-4088-9ae6-92039c4c8d0b",
        "bfa8ae3c-6cd1-4a36-9e1a-96c85e965b6d",
        "bfdee99d-a2aa-4bf2-aa55-72718b8fe8f3",
        "bfe7729f-60d9-4046-a657-4b1d8e42e7bc",
        "bfea2820-280a-4dd3-a2f0-60d12404796a",
        "c00ff5fc-89f7-45cd-987d-9f18fb021271",
        "c029b294-89f7-4967-8653-775a36230324",
        "c0353971-95be-4768-9ff1-785bb1dc6d10",
        "c0399c53-25b0-42cf-a8b2-2f943f26a15c",
        "c0623a74-1a45-492d-ad2a-91dca06a0887",
        "c088bed4-44e7-4132-9248-d5764ca1787e",
        "c0944f4a-7b17-42a8-b8fd-9669b725b9c7",
        "c09f3717-8632-4719-bccd-8ed41a21f55c",
        "c0a21dec-bf4c-4893-b720-bf9f512bf6b5",
        "c0a3d819-c47b-4c73-80be-6287eb4664af",
        "c0af0e13-7964-4a81-b02a-dff8e23858ba",
        "c0af2c0e-5223-463e-b5c3-aa89e4e86e62",
        "c0c4dae6-812f-4cc1-81d0-a1221a0b8006",
        "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73",
        "c0cde309-ce8a-43d5-b91e-ea3e88ac8046",
        "c0ce12d1-a233-4401-97e0-891ba8b0a18c",
        "f36c88de-0658-44e2-be21-30ea18b7503d",
        "c0d09227-30e3-4f86-8ed9-46f38e91b0bb",
        "c0f0d127-e35a-4b19-83a7-81b3f8e64cf3",
        "c0f56216-2043-422f-8a4b-6dad9f5a86ac",
        "c108228e-ebf8-4954-8fc2-0bc7b3b12c73",
        "c1426fa9-e29f-4278-9d8b-a09f30829843",
        "c1441cf7-4784-4b07-bdfc-bf5fc578f319",
        "c147cbda-7d80-4416-9402-b1b3e3c91092",
        "c170be90-c2ce-456f-bbfc-fad96dbe6c11",
        "c192ad49-e28e-4cd5-a780-204a5c825a57",
        "c1a01a80-e201-435d-bde8-a32ff0682f1d",
        "c1b053db-d186-4ef9-9f5e-8ba395c50cc3",
        "c1b09e86-46e1-4cc6-9517-174a22b1aebb",
        "c1b14181-a661-4bd1-a32f-1420145113fd",
        "c1b7453a-1b99-4558-8f87-d749e05863b3",
        "c1c60606-a500-40d3-8b89-0678f2957da7",
        "c1f5321c-e0a2-4f61-86b4-66d144189bb8",
        "c20c6ef7-bc9c-4065-839f-e99154cd2bac",
        "c20f955c-4ec9-4c67-b7b0-3a4779f214e2",
        "c21d93fe-6be9-4d33-91c4-606ccd43a160",
        "c223cea8-9129-4260-924f-c03511892399",
        "c22e943f-376e-4e94-b35e-f39cf4db39b2",
        "c233361a-420c-45a8-8a35-cfdd036decec",
        "c243feed-595d-4100-a696-fb780ae06223",
        "c249990d-400f-44e0-aef6-6b9ae0b6a3dc",
        "c2742ebd-c743-49f0-9e6d-cc8b5f736237",
        "f37b8f2c-ae8a-4814-9fe8-f0b62f760e6d",
        "c284fdc8-fff9-4583-bf5f-8c2c6210d87e",
        "c2862550-1840-40ae-9826-91d1f7b11e8c",
        "c29c735a-db0f-42ad-8ac7-5064c5fe3183",
        "c2de6ead-6dbb-4f6f-b629-38dfe2de2b51",
        "c31e20f7-259e-47fc-b15c-8128e5f31042",
        "c3203bd0-c491-4d6e-84d2-a6b0925dac1b",
        "c32e0303-2612-4c61-a2cc-f7de4b84e8cf",
        "c3393e0a-e6e2-4bb3-ad4f-d1a2fc83ba55",
        "c340b466-22a4-4166-99ef-61a523f44f0d",
        "c3454d80-b620-4f3e-a28d-b34260a925dc",
        "c347227a-a1fd-4e3b-9d4d-f35e51022c75",
        "c361b1c7-60ad-4787-821a-25be8b44e995",
        "c377e858-0bdf-4b2c-a924-17c72f9c9908",
        "c38684f4-8d20-457a-a1a5-cb545c6ec08c",
        "c3c5598c-95cb-47a6-90d1-179458208eca",
        "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3",
        "c3c70688-a211-4874-92b2-3f0d24812e6f",
        "c3d5a76f-82d1-40d1-a23b-fb50050624af",
        "c3d7ceb1-b702-45d9-ae22-3b19f2ed9c8b",
        "c3dfdbe1-1c36-459c-9e68-30c7af4e0310",
        "c3efdfda-191e-4034-84ab-5c788392ce71",
        "c3f36991-e1ea-42dc-9f95-aaff31f729ea",
        "c40c4758-784b-4973-ba9e-4297ce1a359c",
        "c4277097-cf78-43dc-80af-b0b9f6579662",
        "c433c155-502f-43df-bb27-4d2ae15f128f",
        "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7",
        "c4715ceb-47ef-4ece-9166-3534875c7ea0",
        "c473473a-5c30-4bc3-aba7-fa53b58d417b",
        "c4b56263-aba6-4120-9e20-1f7127a26c20",
        "c4c8c92c-6ad0-4b7a-a43c-9376d2ab6195",
        "c4dd0459-f085-45a7-882a-c73ec8ba7286",
        "c4eafce1-8696-40aa-a8d5-9e873ada6fd8",
        "c4f36b64-ec27-4244-bbd1-38dc3664a051",
        "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd",
        "c51c73c8-7fda-4084-ad9e-0c1f3a4edbaa",
        "c545c10a-ec85-4e7d-8788-e859459b4454",
        "c54e9967-8237-4833-9789-fa98a515682b",
        "c55854b4-c06f-4b59-af10-3b19530c609d",
        "c5645d0f-07fc-40f3-8e7a-4feb88f5d5d0",
        "c595ff97-4d04-4d38-8a10-905ef5a5e37f",
        "c5a5ec8c-7d03-40bf-b744-48f63f271a5d",
        "c5aefde2-a211-46d5-b46b-b04f7c3a3262",
        "d4b6c8a9-fc70-4c74-a43b-14dba27a7e8e",
        "d4b6ff03-4be1-43af-b5df-3652cf6b28f4",
        "d4d56576-6d30-43a5-925c-ac343cabe244",
        "d4dbff2d-418d-43d8-8944-0531250dd7bd",
        "d4e90ebc-c722-4ca7-81a3-4a6bf4237c2b",
        "d4eefd51-2eba-4370-837e-44beb35de269",
        "f37e2b52-8813-4a55-ad79-903add647d64",
        "d4f398e5-e102-4a8b-b7d9-687318fcd0d0",
        "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6",
        "d5523356-9b9e-44e5-b505-7245bf64b2a9",
        "d585924c-f64b-4269-9f5a-824bb20b7b1b",
        "d58a2a78-a36c-44c5-a4a3-b2b3fd8c9428",
        "d598cacc-ea58-4aee-a725-b5a588b5ed6a",
        "d59db10a-051c-42bf-be7e-b0ee9242bc4c",
        "d5bc8cdb-adc4-45eb-978f-e539a07166bc",
        "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8",
        "d5f78a87-1eb9-497b-86d2-923e55765c2a",
        "d610b8b3-d642-4a6a-affd-08b744cc6431",
        "d64d9791-0ab7-40cc-bf03-40e5d7f456d8",
        "d662026e-3b6e-4919-b8ba-369399f40ff7",
        "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098",
        "d6f33100-e235-4b9f-8c22-6b539f1922e9",
        "d70428a4-633c-4748-8a6f-7fbf16b70991",
        "d75cf600-1cc0-4584-af67-53470ae75e41",
        "d76d1a7f-32cb-4b26-8d73-6a2eaf27bf8d",
        "d7768730-95bd-47e3-adcd-857510bb091b",
        "d77df6f8-8d35-43cf-bf10-5f939496caac",
        "d790579c-8036-41c8-99f7-8ee78ea5a1c3",
        "d7af1990-ff7e-477f-8a91-65f82768ed1e",
        "d7c20da2-7385-47d7-abb2-6f90ce252bd3",
        "d7cc4974-fa80-4c7a-985c-d21e01b28340",
        "d7d8c397-894e-4bba-a67a-d813d5bba8d7",
        "d7dba4f9-4599-4f62-9851-953a0bc1afc7",
        "d7ebd513-4ceb-4ad8-a27b-03ef32f3bc5f",
        "d815ed08-b9ed-49fb-8e8e-faf415f5063e",
        "d8333d0d-738f-432f-9a6f-85f3bcfbe71d",
        "d83fc464-5b1f-4e5f-b80c-0b55a0f757db",
        "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8",
        "d84be541-42b3-45c3-ad0b-227a4ef47e2f",
        "d84f327c-73f6-4790-a579-20b1e631e99c",
        "d866f255-beae-4c73-b0b5-16c484c3e7d8",
        "d8915ce7-52a7-45a9-a92d-fbffabde7146",
        "d8982923-e43d-4504-91fc-9988c137ef39",
        "d89a168c-95f1-466c-8b05-4cad7f50d20c",
        "d8d7ce80-3090-48ba-b0c3-8ff2ae7c5a14",
        "d8d85c3d-9970-4c92-8478-d9e6a8933d0d",
        "d8e3d11a-ca4c-472e-a4ca-922add1f72aa",
        "d8e7f5bd-e0b1-4479-915f-fc6e5e167825",
        "d8f46ddb-af65-48a7-89d2-7ace7ce4a565",
        "d8fce3be-54e8-451c-9904-be7ced21042f",
        "d912f5d6-caf2-49a2-9cd1-14941b4d93f5",
        "d91a5ac3-57ef-4697-9e45-881f0c765260",
        "d92c108c-bb30-4f75-971d-9e75e3624852",
        "d942cda0-de78-4cc2-9b03-da42053960dc",
        "d9529013-0a82-4a71-8cd9-99ca67bf9af6",
        "d952b05e-7386-41bf-8dfb-a2e0f1ff045f",
        "d9788bd7-827d-4a87-a999-78fde630ae98",
        "d9831296-77a0-421d-beb1-cab91b2d1b0f",
        "d9a4d26d-4beb-4f8c-a265-fc80367f7a88",
        "d9affc45-c48f-4779-b76b-d659d5b9da02",
        "d9e72d1a-093b-4bb0-acb1-9ab6c86761f4",
        "da02d449-c6ff-4adb-b56a-7c9d27dc39f2",
        "da430bfe-2e8b-423f-9d88-bd19781c8772",
        "da4ab16f-e7b1-47ca-bbab-e1a41a9c42a7",
        "da4cf21a-cc44-44ee-8cc1-53ff3fc1cc0c",
        "da559dce-14f5-48cc-8aaf-cb1201501758",
        "da601a53-4a0b-410a-9d60-0147894ec6f3",
        "da6a15d7-7bc1-4ee6-a61c-aa9121baab3b",
        "da72a63f-0fc0-48c0-ad3e-fa0dbb0cccf3",
        "da843118-b2b5-4c8b-8d6e-38466cbf1b7c",
        "da899be4-b39e-47e7-8fdd-5232cda17e38",
        "dab2bb9d-4ebd-41a5-a5f3-8880002fed3d",
        "dac8ea0a-bca2-4614-9277-39ab85d047a0",
        "dacde5db-abf9-475d-b061-5bd67425a265",
        "dafca263-79ec-4d40-a5c8-742c4cb24edb",
        "db2e800a-39ba-4ab8-94a5-6a06a471c925",
        "db38fba6-cc70-4113-a0f8-993bbb20ed37",
        "db43a967-df81-427f-9df4-9192f83752f3",
        "db4d7fbe-1d3a-41a1-8137-51a0bf45f070",
        "db61c843-0c1a-44aa-93a9-b588c9ca5e3e",
        "db6ac9ba-fc50-4ac4-843e-068348264f5e",
        "db86165a-76cb-475b-922f-2ba4b79bd29a",
        "db93d5d5-17b3-4b93-a452-1e56cad3cf57",
        "db9638f1-b03a-4810-a85e-48d1492b8c91",
        "db9c1254-a9bf-4e24-a0ce-a8458a01a70d",
        "dba15a6b-cb63-4e14-991d-0eacc1321ad5",
        "dbb48549-00ba-4d09-b67e-adc5c57b3f64",
        "dbc0325d-f8f2-4e2e-b164-3f3a3da4093a",
        "dbcb579a-bd2f-438f-ac9c-cc5f0192bb74",
        "dbd579f3-1254-4fb6-ae4e-99fe925bcf4e",
        "dbf2a839-9cd1-4ce4-adb0-285c323ce54c",
        "dbf48ea6-4d55-4160-a850-4aaa04e1f9e6",
        "dc1a53b9-2e1b-40e4-9e5d-ad5f75f056cf",
        "dc2204ea-3223-4872-a81a-c617ed9ef01a",
        "dc2b1257-e11a-421e-82b7-ec2c3f70bd4d",
        "dc30cfba-b947-449f-a3b6-f23e17eb0ed9",
        "dc501b31-efae-45f1-9726-5f608194f9af",
        "dc682096-1e6b-420c-b2c6-dcd7fc306827",
        "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b",
        "dc6e97f6-f095-4001-8e87-325042903590",
        "dc82a06e-6471-4024-ad8a-e7e12de65ae3",
        "dc8906ca-4c9e-4f74-bd46-82d23e92413a",
        "dca7e046-9a39-4319-9d72-9c2952dac2d4",
        "dcb5e609-e67e-4b3c-b9a3-deedc97667ca",
        "dcc3dd70-b0ba-4f9c-8a66-dd430ddd50aa",
        "dcd48a38-28ae-40ac-b285-82a05adb60f0",
        "dcedf751-77ec-480f-8473-8b8b4bebdb9c",
        "dcfe3644-e5ef-44ce-ba31-908993521fd9",
        "dd03a1dc-2b8f-4a2c-ae6b-00fac55dbf1d",
        "dd0d0dbc-63d2-4d3c-9265-4fc2401a8649",
        "dd3a6fc3-b55a-4c61-95c5-c3e56b50838a",
        "dd516512-883b-4575-a89d-558ff57b2cda",
        "dd52cd6e-cbaa-4e8b-9d20-1c661034a39f",
        "dd76d9e0-2a32-4b36-ac56-d775341bdf58",
        "dd8d910d-5414-42af-b52c-f1d51b3d7fd0",
        "dd9728b0-adf5-4380-be4d-36363a8e7b2d",
        "dd9dfb23-2931-43c1-8945-998430737522",
        "dda7c3e0-182c-4fec-835c-c98ba4719b63",
        "ddc2e991-62aa-4e6c-9402-615dd18071a6",
        "ddef39b1-9f4d-4e99-b61d-da021261fb99",
        "de02c15f-9ed8-4eb2-b886-41de8918b0e8",
        "de1d9ffa-6852-4bd5-afb2-8fa85d0d6c89",
        "de2c3649-47ce-41d0-8a35-18dee658d4ed",
        "de3f8668-2cab-46da-b06d-7f2144a29e3a",
        "de4a2d22-3389-40a0-91fd-6fc2a30b8444",
        "de4ad4f5-ff47-4e0f-bfb8-bfe33a20e895",
        "de6bf8a0-0c2c-4769-a21a-2d7a77a82534",
        "de6c8821-09b2-4d00-8a35-0318ba63d446",
        "de868b77-b179-468e-97c3-9d600e25cde9",
        "de89a30a-4440-4f2c-8cd5-2c003b97d9bb",
        "de9a09fd-f4f8-4107-b8a8-b0b20b170339",
        "dea48362-3834-4a9b-830d-40c984a8c6b7",
        "dea72a34-ac35-4b38-a932-871d8463afb6",
        "deb08eda-003b-402d-9187-25db3e073225",
        "debd81eb-032f-403e-9ca4-ef369733c7da",
        "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5",
        "dee0dd0c-e3d8-4240-a80a-4b240bee5072",
        "def6f02b-77c3-408f-a6ad-20fa9a6932f4",
        "defff098-222a-46cb-81e0-fe21e13f0928",
        "df26774b-3d75-4db3-a2a4-a31a966e67dd",
        "df2757be-e2fb-4199-8bb5-af149ceb4411",
        "df3b9f78-2904-494a-af9a-e0348c8d0d19",
        "df486c8b-0715-41a7-89ec-4d6340c898ba",
        "df49d458-ce59-4819-b8fd-fab05eb5ca3a",
        "df4a3fcd-1468-4d69-a226-be8424e2069b",
        "df57cb27-1de6-41b2-81b0-85a2488d6f55",
        "df690613-68bf-4e0d-99d1-8cc9f7041bf9",
        "df6e8363-952d-4bd8-b716-cbda86ce7008",
        "df7400a9-1152-40f6-9cfc-9584c1d90b15",
        "df840171-3e32-4673-bf14-5fccadbd9511",
        "df97dc57-2b99-406c-a304-cccfd780d356",
        "dfa93baa-3751-4a71-b3fc-54f5339952ca",
        "dfb9e857-eeaf-48bf-ac52-8829317a58e8",
        "dfc48fcb-2d4b-41a6-b5fc-1ddab878f97d",
        "dfca0886-28d3-476e-9fec-dec4474857e0",
        "dfffdb94-21f6-41f6-8080-31de2d0f2f52",
        "e00dc526-c33b-49e1-8891-b694be19cf9b",
        "e0202add-d435-424d-a381-bf7e699cde51",
        "e0325742-23ac-477a-91f9-554f9f4fcde3",
        "e03426dc-4782-44de-ac73-efd5a5ab193b",
        "e04de3fe-85eb-4214-8968-0d5aa67848dc",
        "e0705992-1070-4eea-9569-df5c0c149396",
        "e08515ba-09cf-47c1-a794-3d3d9157cd2c",
        "e08a1b15-fdc2-4e1d-b1a9-acc3b4aed9d5",
        "e0b0059e-2337-4655-80b7-3380f819a952",
        "e0b3e4a1-d9d8-4d86-87e4-3c7faf6a88fa",
        "e0b556f5-9711-47b6-a945-63abbd79e839",
        "e0c49ab0-0595-4b4a-8256-420ff255ec49",
        "e0dbfa84-2fd7-45f7-bfe5-793d9dde9f0a",
        "e0e06851-781f-4998-a975-813b6287c485",
        "e0ee0b1b-cc7f-442f-8179-0664f6517192",
        "e10627fc-9a4f-43f0-8fc5-050b9cc47fbc",
        "e11ed86f-b081-4502-88b8-9d0a0d84b1f4",
        "e11fd0f8-8a61-4db3-b214-157010f09865",
        "e12cf0db-2494-4a28-af33-3792a1473617",
        "e1304f2f-7cce-4a39-ab36-3f68d15777d5",
        "e157ef5d-1e26-4ac8-8a25-909a31f27708",
        "e161d313-17a6-440b-ae35-aaeb7403edd4",
        "e16f5f64-ddee-464e-a248-a1617fcaa856",
        "e1866038-8f27-4b29-834f-668b48293739",
        "e1965b84-8ce4-42e1-9156-0045723a2fea",
        "e198336a-c069-47ad-b895-4a5f8d87442c",
        "e199f85a-1424-43cd-b29e-e620347709cb",
        "e1b27813-8062-4294-8a33-5a294c8d3b30",
        "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37",
        "e1cded73-7d92-48ab-a8e9-801718860ca4",
        "e1e06893-88f8-40d1-98bb-a0e0052c0d7b",
        "e1eefff3-c3cd-48f8-a52a-edd414603fa1",
        "e2050477-7a11-4a92-ac9c-e5d0964eca6a",
        "e209f6ef-5803-4963-81e0-677a9fd63ebc",
        "e22640e1-5c90-41c1-bf32-f570afd0f483",
        "e2594760-0718-47b2-ac47-de4b4607973e",
        "e259da3b-8b6b-454d-83e2-b0d702b64187",
        "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558",
        "e2b09d7c-ca85-4ba4-a62c-04476f048ccf",
        "e2b1871f-197e-46e8-b00d-1a68d5fdb40c",
        "e2b2a9f6-5ce5-4946-acc1-7c6a3bcffa65",
        "e2b8ba65-7949-4650-9a1f-86826177aac2",
        "e2c66059-53dd-4a21-a098-2ac9cb5939ba",
        "e2df7760-05b7-41d1-bae5-2c48c1408f8a",
        "e300d01d-c95b-4c7e-bfd8-d7914d3132f3",
        "e30212a6-e9ea-488e-a22b-91c0c4ee847d",
        "e308440b-50ab-4432-af75-797ac882e2bd",
        "e3121e6c-8eb6-45c9-b7fa-00451069f10e",
        "e3229cbb-c64a-46d9-954f-0dc495adf3c9",
        "e323a3f6-54b3-485c-bfce-ee5a849d542f",
        "e3244181-15dd-420c-b5d2-a9cf10f13a0f",
        "e32b9149-939c-4c49-95e8-b751752c6e58",
        "e3482c6e-9741-45ab-a0a9-2c0c1a85160f",
        "e3505fcb-828c-48f9-90e5-83d16f1807e9",
        "e3589a2a-620f-476c-acef-4df35a53adb8",
        "e36d5195-d17c-45c0-8d86-0a1680dcf17f",
        "e374db85-7922-4942-89a6-74ca7b6d096f",
        "e3836da5-c9ed-4aaf-bc54-54262146a9fc",
        "e38b6b2f-05f8-4384-9b1c-1bfac511a014",
        "e399aba6-9cb6-44ac-9150-44eaa06bf858",
        "e39d485f-1040-48cb-80e7-06aaa4b6e607",
        "e3b50c74-a9b5-4244-a932-20b6ee72d274",
        "e3b7e767-c282-427f-84e0-9f7573615705",
        "e3ce7897-4bdd-484a-b848-ebd19701ca2f",
        "e40b3194-648a-4e55-947a-3bbc24773dca",
        "e4229e58-405a-4d9d-8714-f80feb196e7f",
        "e424d27b-3524-4f98-9b24-108de83564ba",
        "e48bd44d-942e-4078-a909-b456d7f2f2ad",
        "e4d13926-7a28-4133-8c68-1fe0269940a4",
        "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8",
        "e4fbfb3d-c934-4971-9fae-f89b6c9d73b4",
        "e5211d42-b26d-4f6e-a5d7-0eb97affe5aa",
        "e5246e39-8013-4056-847a-c491d3174dab",
        "e52816e8-ea65-42df-83d4-422d6688123b",
        "e53244c6-7d65-4e1c-b3d3-e4ec7b243ae5",
        "e555767f-4003-4a20-a224-94b5a21a300b",
        "e5877c42-0a25-42b9-8312-29373a1af24c",
        "e5dfa709-4db8-451a-9f9b-a406c96cf049",
        "e5f695bc-8af9-49c8-8963-831faccae51d",
        "e5fdf953-0ab9-4054-ab25-6fc95c3dc061",
        "e6236792-bb52-4bb0-a60d-de6aee999b8a",
        "e63b5621-2b4f-423c-b0ce-fb059139add2",
        "e63b5a8e-c608-4f16-a4e4-68e25409464a",
        "e64d043d-671c-4da1-8427-10e3d01a129a",
        "e6538312-7c27-45ea-95d6-a054f878e61b",
        "e6702469-e66e-4c7e-8cbb-876a551c6cad",
        "e67b8d1d-02a5-4761-b5fc-899c7f06dbc0",
        "e69787e0-9463-4ef6-a91a-9b032b1977f2",
        "e6a5ac72-e925-4249-b59e-8886288b0394",
        "e6bae9b2-72e1-4dbf-bd01-d8a22cd0249a",
        "e6ca777a-e3d1-4eb9-bb42-159e50cffa83",
        "e6d52b90-a2ea-4715-8eb8-f5f73c6379e2",
        "e70faa7f-cb67-42ff-bcb8-96e40ffd166f",
        "e732c344-67ee-41bd-b9f6-f8518d49bad2",
        "e73fb94b-5953-4ddf-bdd1-b8eb5b325b91",
        "e749b60b-64ba-4992-9c11-8a38c58c0782",
        "e7821334-9f92-4c55-b715-6ebe70115720",
        "e7933a5a-590a-47a7-aad8-5ffd3412ac0f",
        "e798ff08-7eae-4f9a-9958-7584ba44ffc8",
        "e79abc9a-119d-4312-bfb2-261059b12f9a",
        "e79b10fc-d0db-41dc-8077-eee79e08f4f9",
        "e7bad671-5154-486c-8d90-795b6ec506a2",
        "e80c4237-5d70-4fbe-a130-7e6d8c59f147",
        "e81cf15a-4939-4902-8daa-f81013f7ab99",
        "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35",
        "e83f0147-23eb-45f0-9c83-ff2fcceae4cf",
        "e85549e3-d024-4d48-85c5-35ed7c4ee07f",
        "e87f165e-eeda-4f52-ad9c-3478ec634f5a",
        "e8e133c3-4f15-4aa8-bc01-4434ed53eba0",
        "e8f03685-c8d7-4057-8a23-f4f97460e015",
        "e91acd80-20ad-404f-8d04-48ce4a4544a5",
        "e9254056-1250-48a3-b6d2-95c2a0c5aec2",
        "e942a366-a3c0-4b61-b1f6-84aaf62072e2",
        "e945485c-b3ec-4e9d-b2a7-6869bb1ddcd1",
        "e9582bf7-d166-4b2b-be0f-d44870d27e15",
        "e95be3fd-2b92-42bc-9a80-00cb6cef9e1b",
        "e95f10a8-bfe7-4657-9b04-18d98ddbcf85",
        "e978e03a-8947-4a93-9487-03e6c8e4c9ac",
        "e988a336-fac9-4a7c-9ca7-2f2a2f772e4e",
        "e9b4e2a6-7743-4ef5-86dc-eb6206a00952",
        "e9b5d759-2955-4bc4-931e-73703c6e6d65",
        "e9b7170d-f623-4b63-91ef-ae0fa42e030e",
        "e9cc0913-97c4-46a3-b657-80951a8a72ab",
        "e9e4a57d-12b9-4f4d-8115-b0111aa75b88",
        "e9e8dbff-2001-416e-82f6-6bc6cbe83b1d",
        "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2",
        "e9fe6143-b228-4151-aa7d-60184ebfafb8",
        "ea126ced-35fa-4877-8cf0-a77111208b0c",
        "ea364242-cc95-4492-8a63-977bb16f5054",
        "ea60d15c-cc91-4b77-a6a6-e39e338f66f9",
        "ea61c5e9-c005-40ff-9f6f-b330d064f66e",
        "eac3260c-f0ea-40d7-9dfd-226d0c197de6",
        "eacc151c-0ae6-4943-9d82-eb42e4844632",
        "ead8c98a-5025-4026-9389-3254142ba543",
        "eb038ee1-dea2-4ccb-942c-06853639b5bd",
        "eb03b4c2-7c2c-4042-be0a-68f6cd70852b",
        "eb13fa3c-118f-47a3-9671-ab52c025e8a7",
        "eb20e045-eddc-41ff-b309-ca054af6b1a7",
        "eb2f0df8-2e8a-40b7-ad40-15dd89107241",
        "eb45c133-cbe6-4f94-a2bf-948d581d999d",
        "eb476b79-feac-480c-a263-cd0853e5809b",
        "eb4b5ddd-b298-48fa-8263-0467700610b0",
        "eb4d2567-4985-42c9-ad51-9042b91ecb43",
        "eb4e9698-9082-4a09-8407-ff513814ad74",
        "eb568073-2d92-401e-b979-93f97074eb79",
        "eb5b6301-25e2-47b9-954b-2abab99d6f9d",
        "eb6f503d-e87b-4560-b9bd-6e398cd102d0",
        "eb7c840a-edb1-4cdf-b80e-c8e45feca156",
        "eb8f99a6-5a3c-4126-8fff-1f534b2ffc5b",
        "eba61104-83db-43e1-b3bb-93e3bf5cf57c",
        "ebbbe8cc-a728-409f-97d8-a282dd493407",
        "ebe076c1-b45f-4320-87a6-38aa1bab68ef",
        "ebfb75e8-3656-4fb1-8b20-74174311d92d",
        "ec0da941-afa0-4da4-87b6-25b6e95383d3",
        "ec21538f-aab3-4129-b814-b42747a4cee3",
        "ec3b9fbe-8efe-401a-9cca-4ff3371cf27c",
        "ec45d283-ca99-48c2-b383-babf02234ffd",
        "ec4e5ec6-c893-4f49-8857-23c4fd07c137",
        "ec6fe40d-2d93-4f14-996c-1b6f47ac3915",
        "ec9e3686-2e23-4f3e-9df9-2cf6792e992a",
        "ed10d96c-8b18-4d6d-8a2e-0e64f2d29f5b",
        "ed269807-ec7b-4648-a1f8-9a8d8c2582fd",
        "ed419429-6a13-4ad5-9358-57b7d8a1d473",
        "ed5586b6-2176-4eba-9c63-a33fb8131adc",
        "ed833947-850a-43c5-9438-ae8af0c55eff",
        "eda458ee-7253-46a2-b7b4-8720e75ba514",
        "edb607c3-12e1-4a91-83f8-f92ef0423039",
        "edb79ed9-db2d-411e-8d0c-ca5d0df2d568",
        "edc05ed3-8768-4c25-b89a-f7e30ea87397",
        "ee0961f2-bb8c-4673-882b-26e344d58ef8",
        "ee78b6c0-b3bd-42c9-91de-005cd725189e",
        "ee810823-abd9-4c49-a77d-2ad1ce318ddf",
        "ee891ef9-9717-4896-8078-2c21968ad637",
        "eedf49ef-69d2-4b9e-938f-9ee3e7334ea0",
        "eee0f9f2-eae2-4661-83c4-c27cd2d8da83",
        "eef8e136-1eee-4e5f-bd64-07d0f8cfce0e",
        "ef0fc90e-0293-4594-bcb4-f21c2f3a4269",
        "ef1465e0-edd8-4b84-a30a-7cc0197d5cf7",
        "ef29908d-11de-47b0-a123-e3bed560a377",
        "ef60a410-0c92-4f36-94ba-6c8d65f9b6a1",
        "ef60c25c-0064-4b95-b1c4-85eaf8091381",
        "ef7021a0-9d59-4a0a-92ec-24eac3e68b59",
        "eff405f0-7b8a-46ef-bfcb-1a37230ba5e8",
        "f00bfd48-734f-42a8-a475-e8d087ed3135",
        "f01353d5-7c14-4e5d-8281-2dba1ab56a97",
        "f013647d-a63a-4f0e-a675-1a6425e61f15",
        "f01fbc87-167c-4fa5-9e62-843acc0f2ce9",
        "f0213a24-fc13-49d4-aa98-b7e53aaffdc3",
        "f037e8d4-0a80-4482-bab5-d99221418aed",
        "f040b940-b2f3-446c-b788-c019340d035b",
        "f05b8a32-807e-4135-b115-7e2ecc862fff",
        "f05f97f1-4ccd-4a5c-99a1-115188fb5a88",
        "f061aadb-c55f-42e0-9d47-d2c0cae92bb0",
        "f06a9ab9-ddf7-48e5-8def-5d7e286abc9f",
        "f09481e2-022d-4191-ae6d-f3255e98e50f",
        "f0c2d123-c591-467e-a662-216747131d6a",
        "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56",
        "f0dea834-5373-42c9-876c-d1c1c4bfddca",
        "f0e543a3-1cdd-4e3f-962c-8b70c9c07fb2",
        "f0e8199f-35ec-4db7-8d1a-9b7266b8ec94",
        "f0fb2b2a-27c7-4d61-ac34-c420d64c1a9c",
        "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416",
        "f1035c27-7835-4881-ad46-fbcd259dcf36",
        "f10be348-72e7-4815-9e5e-f512c4667027",
        "f11000b5-870c-40e3-987d-addea146b5bf",
        "f11f4d54-d6d7-4811-b7d6-bbdb2500a7bc",
        "f12e496a-883a-434a-86c9-0ea7ec289ea5",
        "f15038d4-0bf8-4ab2-9dd0-4e92bce177b5",
        "f1527c5c-71c8-4c20-8eec-b0b25c219a23",
        "f17a8851-9a1f-4422-84b0-a9e2ed0565bd",
        "f1866f89-fc5b-4ef8-b6ca-c94e34278235",
        "f188b0f2-ebf4-4d43-b6de-bc9aeb6045a7",
        "f19db424-574e-4e8b-8cce-a752bd13c089",
        "f1a46a02-12bb-480f-ab78-1f8e3c5e92d8",
        "f1afed28-5bd1-4bac-8652-7ac1079e982a",
        "f1b25786-5164-472b-9bf2-cd0d8de34e57",
        "f1c15227-653c-4937-bc2a-289b0bab098c",
        "f1ff8e7f-990e-4152-aa6e-5f0653e571df",
        "f2123661-ca8e-4252-aa09-7fae2f65cb30",
        "f214afe8-2046-4e03-a0aa-605a2ac614b5",
        "f2193013-094f-4b9a-a7bf-16335acb7ce4",
        "f2200fac-ba00-494a-ae67-7a3b2dc9a131",
        "f220c22c-4154-43f5-bd8b-3260208fc3e3",
        "f2520c96-9add-4fa5-bc7a-1ffae4cc770b",
        "f2634d82-a5f5-4686-b213-bb4efa7a241d",
        "f266140d-7be6-49eb-8fde-7fc5925c04a5",
        "f26b46c0-97c4-4c0e-82af-892e5570e2af",
        "f2742f89-e25f-478a-89ae-c1a7963c9eea",
        "f275c09b-0429-4a10-a2ce-808e681b1460",
        "f28c062e-5123-4412-a4d2-d68466eacdee",
        "f2a00388-01ec-4f90-a2cb-cfe13ae755d2",
        "f2d1d458-9f15-451c-935c-7733a08bb558",
        "f2d9026d-2ff1-4f58-a679-6e973a28bd8a",
        "f8a3f0cb-0837-4e28-ab7f-676f57de3f93",
        "f8d43e3e-bb50-42b5-8380-49f7af08111d",
        "f8e7cbc7-57e6-4b49-b076-192b66f78719",
        "f905ccd3-5b67-417d-b0ff-9ac6f75cd3f5",
        "f909c3d3-ccce-4797-812f-ba404283a970",
        "f9624623-ac5f-45b5-84ef-d587853e2a1e",
        "f97470c7-5eef-45d7-8344-dd58f890a517",
        "f983ec4c-3c62-4ff8-9c95-c33d236b1f4b",
        "f98fcebd-3334-4f8e-a6fd-e2dbea945594",
        "f99632d8-27ad-4b8c-84e8-d165098c4018",
        "f99749b0-7588-45a8-8b83-29b636561732",
        "f9ced76c-8ca6-410b-861a-5b51838e0ac2",
        "fa0f4ced-84ee-4635-b674-6f7b705ec307",
        "fa285da9-a1f5-474d-8402-bfba8296f361",
        "fa3126bc-66bf-4797-8392-7d8f5999568e",
        "fa51c06d-6057-485e-aeb0-1984ba2f3899",
        "fa527c66-dc6d-422c-8f26-d9026896f9fc",
        "fa6150a3-8652-45cf-b365-017c18697085",
        "fa795f5e-cf91-4e74-b51c-14cec92cd3e4",
        "fa802a89-62fc-40b2-bd51-b8d2f77dc975",
        "fa832478-dcb5-4f4d-ae85-00e1d6dbc5a0",
        "fa8a256e-bd9c-4e7b-8a9f-575a243a7cb2",
        "faae45c9-95bc-4a89-b30a-5efd7faf07c0",
        "fac1a1a4-90cc-40ab-bcaf-a58aabd1888c",
        "facb56a6-fd9e-4e63-bd22-654408bd7e7d",
        "fadf2c90-9c70-4dc6-9ef6-5f294493fc12",
        "faec9220-1d68-456b-b86f-333a6b2203ea",
        "fafda255-4b6d-41b0-8605-4f9ad76a37c5",
        "fb021257-91c0-4021-a15f-a52a713b51f7",
        "fb2aa28f-68f5-4b1f-9f00-95d2117b4237",
        "fb6618c8-945e-4d41-b9d6-c7ed0a37d6fb",
        "fba2849e-567f-4d45-80d5-d1a8717dbdee",
        "fbae06bc-3ad2-4986-b609-b6d907b8d436",
        "fbb4115c-0c4b-4c27-a136-05a26d3d0d17",
        "fbcf2dcb-cc9e-4be3-b926-99392656106c",
        "fbd556b9-af5e-4271-9152-89429a649412",
        "fbe6bd2a-cf0d-42d2-8054-d48d0a2b4b8e",
        "fbfcb509-e189-4822-a535-57f4d26a5224",
        "fc0a2cf1-270c-4921-9f9c-a6baeb1c727f",
        "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be",
        "fc138016-64fc-48b1-8d7a-874b986b1264",
        "fc40d541-62e2-4f3e-b9b7-6c491d1c02f4",
        "fc81f3cc-8d05-4502-85ae-d01bbc5d5750",
        "fc881ade-db90-4a4c-8bf8-5246f25671d2",
        "fca4b817-6287-414e-aad6-686dd471efb5",
        "fcb88f07-9bc7-4d37-9969-64f1ced5cb46",
        "fcc10cd2-8065-45e1-9758-ffbb0aff4781",
        "fcd8862b-8829-4a09-8b4e-7a42681995b5",
        "fcdb897b-709f-4712-97f2-1eef477aa84c",
        "fcdc8520-6cf3-49a0-8a22-5d6be522bd57",
        "fd192683-2269-46fd-9084-b347af95ce6d",
        "fd390e27-b595-4d6d-94d6-8048270fb10e",
        "fd5e68e1-a061-4f5b-bc5f-1017194bff9d",
        "fd6ae539-816d-4184-adf5-2b1a094bc67c",
        "fd8c8997-f8d4-4d92-b5e0-94a93c1ce2cd",
        "fdb61e77-94b1-4e36-bc43-8785aa24031b",
        "fdcae03b-800b-458e-b380-cafa3ab8fd4d",
        "fdceca69-5cb8-45e6-8944-d9a3fee93acd",
        "fde3c1f0-fa5e-4627-8810-24af9a641587",
        "fdf3f8c0-61dc-4e17-8594-9aeded567749",
        "fe25ab73-a0fa-4f07-af4e-449d93f8a8c3",
        "fe272191-2260-493f-b90e-74a7779abe78",
        "fe2fb3de-e044-4ea4-be2a-f09a24527f9f",
        "fe3af555-f068-4382-9681-7274e11f3bc2",
        "fe54000d-3af7-4475-901a-9cdb0402cdc9",
        "fe68439f-7461-455d-9231-2d080f834b36",
        "fe7d0d87-b9c7-441d-970a-f12c1ebf20cb",
        "fe94b260-062a-4be2-9033-816bf5fb0a27",
        "fea33f75-989c-4e39-b15e-bd15bb12e60e",
        "fea50021-dbdb-436e-bfc5-b608f1ac4c49",
        "fea92ebd-c4f1-4c77-9201-8a2f39354c0e",
        "feb96516-1124-4c72-b753-b11df12266db",
        "febace7b-79f8-49d7-a5c3-79a7dd784410",
        "fede6f49-724e-4f38-a53d-cabbe264adf1",
        "fee45f6e-8f30-4dc2-b0c0-282b38b59398",
        "ff148b23-be82-4b1e-b8af-fe0cb57df377",
        "ff208c77-3ea6-46fc-a085-242e98604c3b",
        "ff33b7c9-d97c-49ee-8a55-431474e26472",
        "ff37dd9c-2627-4444-bb3f-b6d701f3e874",
        "ff3b6483-f8e6-47b7-9474-6a24445f59ed",
        "ff40d858-0c84-4cc6-83ca-2968fe17f2f7",
        "ff411469-d04c-4300-88e7-692680278435",
        "ff45a565-b989-41c9-ba42-88ec32386aeb",
        "ff55bdc9-537f-4b82-ba7c-c10d9ef7ea8f",
        "ff57d7e4-7200-4671-b989-204db967d5a8",
        "ff6ce643-c704-4bab-abd0-f0515ba94f66",
        "ff7f2807-f149-4830-8ba6-79f4981e4f63",
        "ff8b077d-05b8-4034-b23c-5b2f558ff2a5",
        "ffa028a1-cc1d-4dcc-95d0-b979fd4a0f02",
        "ffb4b138-9f89-403a-b123-a489d7d81d20",
        "ffce94a5-b227-41e2-a667-dbc06cb59f93",
        "ffe85aa6-22e2-440f-bf40-2301108252b1",
        "fffaf31c-acc4-408d-a615-b1a1ea1fafad",
        "fffe6ec0-53d9-4af6-ac08-364b9bb0e44d"
      ]
    },
    {
      "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69",
      "dependsOn": [
        "0783c71a-890d-4464-9a02-7f185e21a3ee"
      ]
    },
    {
      "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2",
      "dependsOn": [
        "5a763989-4b7e-47c7-a812-184ca4366fc7"
      ]
    },
    {
      "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc",
      "dependsOn": [
        "4bb8307b-9abc-4b02-82c8-33d9a561dab4",
        "b3471a76-9f97-4347-878f-760dea3f94b8",
        "23d99d7a-a57b-4350-8cb3-d67f1b30601c",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "11ee7e9f-ce1e-4da6-b707-1411208b099e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "cdb635fe-c7a6-4bfb-bd30-e6c57979a149",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "44546e8a-104d-477d-ab63-86d8d84d323f",
      "dependsOn": [
        "c7cc06a8-0ae4-4710-91a9-e37540b38e90"
      ]
    },
    {
      "ref": "73494d7f-a46c-435c-acaa-5250649c27f8",
      "dependsOn": [
        "b51f9acd-424c-40e6-bbea-62e86b1cde1a"
      ]
    },
    {
      "ref": "9641d376-2f72-4925-867a-a1fff4dfe991",
      "dependsOn": [
        "4cd69b39-3b26-4cea-9201-485f045e999a"
      ]
    },
    {
      "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8",
      "dependsOn": [
        "44a79066-5b5b-4fba-a931-c576d8d58ad7"
      ]
    },
    {
      "ref": "da430bfe-2e8b-423f-9d88-bd19781c8772",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0c29aff9-ce97-418c-9992-bb2a98cf586e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "69e9d354-0b84-4cd0-96b6-5e66d52a3dda",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "439cb71a-6dc7-4552-aaf8-92605d81d2e2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5681e502-a3db-4269-a9cc-af9627cf5a7e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3f4db854-9960-4349-8711-50fda4c46b00",
      "dependsOn": [
        "cdcf9927-e528-4845-8911-2875fecd02f1"
      ]
    },
    {
      "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a",
      "dependsOn": [
        "eb57e84c-f33e-4594-b362-4bf27059d6ba"
      ]
    },
    {
      "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8",
      "dependsOn": [
        "d4c4d04c-1045-4e87-b7a5-51b223317ede"
      ]
    },
    {
      "ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235",
      "dependsOn": [
        "cbd5c2ea-af30-43c8-88d8-b80edf68c558"
      ]
    },
    {
      "ref": "a1229573-300b-45d7-894f-327e56c12b36",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80",
      "dependsOn": [
        "942e87e8-9929-4d1f-ae65-bdaf226a8cf1"
      ]
    },
    {
      "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e",
      "dependsOn": [
        "618b0649-9a1e-424e-8213-e13b117e7df2"
      ]
    },
    {
      "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6",
      "dependsOn": [
        "f69674cc-3bea-49d4-8e41-4b662b46f0d5"
      ]
    },
    {
      "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006",
      "dependsOn": [
        "0e2cd5eb-0a1c-451c-be98-89b0e283e8c4"
      ]
    },
    {
      "ref": "4853f410-66f0-44f6-bdc3-f1dfe4c5ac1e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "808994bb-0c1c-4ac7-bedb-134448854884",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051",
      "dependsOn": [
        "3e90dd06-8631-45ec-ab6c-212696db6570"
      ]
    },
    {
      "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a",
      "dependsOn": [
        "812a20ec-16ed-416a-a1ed-ac367783e0bf"
      ]
    },
    {
      "ref": "7eed6dc3-61eb-4c15-8967-77a178230a43",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340",
      "dependsOn": [
        "ee4c9aee-b069-4aa7-a280-b5d3ffa4a812"
      ]
    },
    {
      "ref": "916df323-ca44-43a5-86a8-78dcd088a77c",
      "dependsOn": [
        "e27f607a-e377-44e0-9bea-4f2b2491b4a8"
      ]
    },
    {
      "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a",
      "dependsOn": [
        "6de4f77e-742e-415c-8d07-c69fc16d8cb0"
      ]
    },
    {
      "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610",
      "dependsOn": [
        "faf64dbb-77b0-4967-a139-91e2425efb2c"
      ]
    },
    {
      "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568",
      "dependsOn": [
        "a974770f-2619-450f-81e6-54d10e1bd720"
      ]
    },
    {
      "ref": "079358b7-675d-437e-ade2-375cda0e52f1",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "20a0188a-b608-42a4-8c9e-90d88b84f970",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a0e8af23-3b6a-4598-aef6-b59d96fe91c9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6",
      "dependsOn": [
        "90fc602d-1465-49e5-a611-48a4af4e7c7c"
      ]
    },
    {
      "ref": "2b72a4e1-2d47-4e11-98d5-d80443a61183",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d3f85aed-275e-4c2e-a2c7-13cfb423b5d6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "441ef7ff-2764-4faf-8d9f-d567404eae6c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4e5403fa-c568-40f0-8185-188e9e1de442",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "e36d5195-d17c-45c0-8d86-0a1680dcf17f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697",
      "dependsOn": [
        "292b5047-7e57-480d-88b8-11b63e95b0f3"
      ]
    },
    {
      "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e",
      "dependsOn": [
        "97637e16-0961-4009-b8b4-ad40d854d1d9"
      ]
    },
    {
      "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c",
      "dependsOn": [
        "2eca2947-ba16-458c-960b-616c4e0edfca"
      ]
    },
    {
      "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583",
      "dependsOn": [
        "778afa68-51aa-405a-a8fd-66a142c6ec79"
      ]
    },
    {
      "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014",
      "dependsOn": [
        "f6c81fc2-580e-4dc0-a920-3f44b3a7075c"
      ]
    },
    {
      "ref": "24a79dec-acaa-4af0-8949-62b5ebe5744e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7cd1f88c-97be-4ae2-86ab-1b09b9942f94",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9567ef9a-29a5-43a5-9e33-f63a52a42f0f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4caa45a8-604f-47b0-a4f4-f88a9e322b2e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "051974f1-fec9-47bb-bf52-04e55f301039",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9a1e088c-0b54-4b7e-b814-8d01eb28204b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a90a9701-67ec-4c0a-9909-7c20db1b3c0c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62",
      "dependsOn": [
        "f797ac62-f080-42fb-ae0a-005962bc8aa2"
      ]
    },
    {
      "ref": "081b62e4-7f89-4050-adc7-ac68efa02920",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0a281466-8705-4055-bf04-35d55241c8b7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3a10d783-5d15-489f-9c54-fa16fbcf525f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4c797086-6591-4e50-9559-68c1bf62663b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "91251859-6fc3-46f4-9489-69a1e8a2c5a0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "93c3162a-0e71-424a-9526-16ff29fe40e9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008",
      "dependsOn": [
        "1b6ba5a2-641d-4ff2-a5d9-83ada06522ae"
      ]
    },
    {
      "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9",
      "dependsOn": [
        "ec1341cf-daa9-43da-bb39-3d7498f026cc"
      ]
    },
    {
      "ref": "f3b26259-c9de-405f-90c0-efa955b0bdd3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1f390a51-ea22-45b7-9aec-a004695fed7a",
      "dependsOn": [
        "45d7997a-99fe-42e6-bef1-ad7539ae9378",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1b72714a-3264-498a-94a3-34d3edb30be3",
      "dependsOn": [
        "8520ee6d-5283-4bdd-a286-4792e3c0f555"
      ]
    },
    {
      "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c",
      "dependsOn": [
        "c7abf60c-0c26-4f84-9341-fd1709078a45"
      ]
    },
    {
      "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb",
      "dependsOn": [
        "5920d7fb-e566-448d-96c9-9860ca364870"
      ]
    },
    {
      "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10",
      "dependsOn": [
        "6aeead73-2182-4221-971c-dbba60dc4595"
      ]
    },
    {
      "ref": "0d820543-237d-4819-a9d5-828987a295c4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2284da3a-b5b3-4a04-bbee-f03aadae5dd6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "87edd959-f5ee-4510-984a-de5e94b7f17a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c",
      "dependsOn": [
        "cd8a4fb6-b89a-43a6-b975-e0278a75c105"
      ]
    },
    {
      "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44",
      "dependsOn": [
        "001d6c87-2890-4bc3-9915-66b34d7c0034"
      ]
    },
    {
      "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff",
      "dependsOn": [
        "d47579c1-75ca-42ef-9951-f24448c4e081"
      ]
    },
    {
      "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49",
      "dependsOn": [
        "0d949332-34d1-49fa-9d0a-c706e62d02fd"
      ]
    },
    {
      "ref": "0156d3c5-ffcd-40e8-a171-b9225f9c09c6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2ea749b7-b527-46ee-8a50-c7db1928909b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "dc8906ca-4c9e-4f74-bd46-82d23e92413a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "e157ef5d-1e26-4ac8-8a25-909a31f27708",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "51905219-d221-4808-be96-38fb2e471941",
      "dependsOn": [
        "dd70f5ca-9a05-49eb-bc97-f98351b7167c"
      ]
    },
    {
      "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0",
      "dependsOn": [
        "c82978a8-eb41-4e66-87c6-039856604f6c"
      ]
    },
    {
      "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402",
      "dependsOn": [
        "1508bbad-d13d-492b-b412-b66e6d1ff727"
      ]
    },
    {
      "ref": "1398ff19-d3c1-4f1d-a7e2-571dc66a19d4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "18da7bdc-27aa-4366-8e36-329c020d6240",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "42e41f4d-6779-43d1-8ec5-364c205b8ca2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5c577b17-21b3-4f7d-a5fd-6c774c0f8f56",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "aa30cf2b-7ebe-40f6-8d82-22c2da95e5a1",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a",
      "dependsOn": [
        "6b383c3b-cc36-4112-b575-52e956e4e5f3",
        "442e49ae-744a-44ff-bc69-e00db0080646",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a",
      "dependsOn": [
        "09ac9acd-7eba-4683-92dd-43d25ef75c12"
      ]
    },
    {
      "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86",
      "dependsOn": [
        "b59e1b3d-c141-47a7-8b28-720799497f81"
      ]
    },
    {
      "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb",
      "dependsOn": [
        "4931ea0b-af66-4b3c-9092-21e97a8fe26d"
      ]
    },
    {
      "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146",
      "dependsOn": [
        "06689213-59e0-4fd9-963f-7072d9686f94"
      ]
    },
    {
      "ref": "482604d2-b02c-4367-a3b7-eefee89464d2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b4f88db1-d32d-4017-ba0a-620d39c745b8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f1c15227-653c-4937-bc2a-289b0bab098c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167",
      "dependsOn": [
        "de0fa4ad-e6e2-4ec2-bc08-3650a8cffdf2"
      ]
    },
    {
      "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8",
      "dependsOn": [
        "54576107-5585-4032-9e83-d6a546a03ee7"
      ]
    },
    {
      "ref": "a1e45924-4db2-401a-a590-9a331ee90c58",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ada55a9e-2a4f-4d7f-ad20-21fa6b71f98a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d",
      "dependsOn": [
        "60679d4a-a622-4477-a58b-d4a12cedc6c7"
      ]
    },
    {
      "ref": "3e661179-3ba9-4e42-bbf8-b0a1b53140fa",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "08075ef2-0533-4823-9167-5506cfb4ff87",
      "dependsOn": [
        "e58ecc54-937b-4ef9-b0ba-83de7c4eaa06"
      ]
    },
    {
      "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce",
      "dependsOn": [
        "94864b51-e90d-4846-9e5c-7d7deb102ecf"
      ]
    },
    {
      "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664",
      "dependsOn": [
        "2f8d4c7e-ca1b-4d46-b037-78a022393ef1"
      ]
    },
    {
      "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53",
      "dependsOn": [
        "1eb38c38-4537-4335-8751-1a1bbfcd1693"
      ]
    },
    {
      "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f",
      "dependsOn": [
        "45e941b3-21d4-4c92-a430-fb84815fc222"
      ]
    },
    {
      "ref": "ff411469-d04c-4300-88e7-692680278435",
      "dependsOn": [
        "294bce9e-d99b-4640-8064-be44b00addca"
      ]
    },
    {
      "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1",
      "dependsOn": [
        "4bb7cd7f-4e29-4a04-9658-882c51e20896"
      ]
    },
    {
      "ref": "178b9e94-06e4-4494-8356-44de72bd4f85",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "352009de-affe-4229-a504-8bec9789a5e1",
      "dependsOn": [
        "00a1f3ff-5b20-4441-ab90-64879e0cdc2d"
      ]
    },
    {
      "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b",
      "dependsOn": [
        "b3f64888-4723-4e88-8b66-2c1346c923fb"
      ]
    },
    {
      "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f",
      "dependsOn": [
        "f97d3f56-b001-4b3f-b51c-586d1832e313"
      ]
    },
    {
      "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86",
      "dependsOn": [
        "854767d6-022f-4b67-8e10-0de0e1d9a7d1"
      ]
    },
    {
      "ref": "4bdac274-9fff-40e9-ad52-c75d8127488e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "811a5467-8fa0-46f0-a1b4-9f28c1d3640d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "78f103e6-9ad9-4970-af50-c9da7c0f3dae",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "89f06a82-8aa0-426e-825c-b30b0fd62a66",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92",
      "dependsOn": [
        "a511bcdb-f5a7-408c-b7ab-9cc411556cf0"
      ]
    },
    {
      "ref": "435121a1-e638-470a-a496-0d1eb40a47a4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2f10b443-2ec4-4cee-ae0c-0ca0ff58764d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7160937d-149d-41a4-b43d-d735abcdac76",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "73d4f2a2-10e6-4f19-a932-337cff8159a2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b4275499-f15d-49dc-b484-93104fed5baf",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0926069f-b569-4745-9218-4ade71f5a77e",
      "dependsOn": [
        "639f77fd-8495-4763-8bba-fb08516a0d6d"
      ]
    },
    {
      "ref": "043c00f0-9efe-4874-9448-f6912fde9681",
      "dependsOn": [
        "7bb088ce-c278-4b7e-bb9e-35cdf34808f0"
      ]
    },
    {
      "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2",
      "dependsOn": [
        "b960860c-d389-45d7-89c5-85db475fc373"
      ]
    },
    {
      "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e",
      "dependsOn": [
        "1ab983e6-218d-4b19-b671-9cfca4ab9163"
      ]
    },
    {
      "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9",
      "dependsOn": [
        "5c9afd71-16cd-4f38-b215-62e7da20f7f2"
      ]
    },
    {
      "ref": "f4a76330-86e1-408d-9f00-081174fac482",
      "dependsOn": [
        "2192974c-3ac7-4238-bac3-0542ac43f574"
      ]
    },
    {
      "ref": "08bc03a9-e542-47b3-916e-80900990a0f8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3029968c-872f-4c3c-92d5-9d2366098294",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07",
      "dependsOn": [
        "7eb55b25-4273-4ba7-888c-e86ebc13506d"
      ]
    },
    {
      "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9",
      "dependsOn": [
        "83c699b5-458e-42e9-92e6-e292c04051fd"
      ]
    },
    {
      "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e",
      "dependsOn": [
        "05bbbe1e-5304-491b-a175-6c47e14f7901"
      ]
    },
    {
      "ref": "4aefedb0-4e17-49a9-9c10-203bd7cb84fe",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6325a7bd-9b3e-44ba-a1ef-31c2f628ec7c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "90b758b1-46c9-412d-beaf-a9bb4dfeee17",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b230030d-d54d-4dc3-aee6-da0d6508f2e3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d0a32d66-ca9c-4131-b7c2-ed9f27e76d0c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911",
      "dependsOn": [
        "cfcc7318-71dd-410d-b221-343abbf5f854"
      ]
    },
    {
      "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c",
      "dependsOn": [
        "bec46705-d0bd-4ebf-8636-46c0f3c4d4d7"
      ]
    },
    {
      "ref": "842fee5c-1e26-49f2-b3ad-b7e78af8db4e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "49c1d847-32ff-4a14-a82f-ed655ed74603",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c",
      "dependsOn": [
        "973e8713-49fd-4651-a34d-ed392a696c1e"
      ]
    },
    {
      "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6",
      "dependsOn": [
        "922dcf2d-b691-4dcb-8773-ccd73b32c624"
      ]
    },
    {
      "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55",
      "dependsOn": [
        "7f0d3a3d-2be3-49cb-98e7-df0fed69ccdb"
      ]
    },
    {
      "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24",
      "dependsOn": [
        "4dd51a8a-2e85-4166-9dfb-a0a7f60f36d2"
      ]
    },
    {
      "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c",
      "dependsOn": [
        "de1b4e65-5851-4338-93d8-3f570d990820"
      ]
    },
    {
      "ref": "0388c3cc-d1cf-4192-8e23-9ecde9786b42",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "24f3189c-82dd-45d3-b6b5-f5cc1b3f433e",
      "dependsOn": [
        "1d581af4-6bc4-40e4-bc67-5662c4c01a1c"
      ]
    },
    {
      "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137",
      "dependsOn": [
        "f7c2afd7-64d0-4e29-b25a-4526520f5891"
      ]
    },
    {
      "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5",
      "dependsOn": [
        "b75e8c3d-68cb-4952-8429-5979b1a22a1b"
      ]
    },
    {
      "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4",
      "dependsOn": [
        "e744be2d-9005-41e8-b86c-58b328b00861"
      ]
    },
    {
      "ref": "74d00dc1-3619-42bd-946f-6f92ff366894",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "014cdc4b-1031-4519-8fc6-da8b173c2149",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "26becd45-5529-44b3-8f72-967cba36d8e0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "e0ee0b1b-cc7f-442f-8179-0664f6517192",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257",
      "dependsOn": [
        "d11fb6ed-86ad-4f52-9eed-482c22c0d1a9"
      ]
    },
    {
      "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f",
      "dependsOn": [
        "b90963ad-d63f-4c6f-958a-74f97eca6b3c"
      ]
    },
    {
      "ref": "ab814ba6-5e19-494a-8708-cc646f468e32",
      "dependsOn": [
        "b9f36306-7b96-43a8-8e3e-7e649ae8da9c"
      ]
    },
    {
      "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73",
      "dependsOn": [
        "b492ae52-277d-4574-bb50-485b76540751"
      ]
    },
    {
      "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3",
      "dependsOn": [
        "d329a049-868b-4d49-8169-ed9480a1f3af"
      ]
    },
    {
      "ref": "3768d45a-b444-4b01-9b0e-11b6551a3316",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "41079c4f-ca22-4850-96b7-c77080de7ee8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0ccb94a9-081f-4f35-9b3a-9e0a2fe18f2f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "223872dd-ad8d-40d7-95ea-79528540093c",
      "dependsOn": [
        "09f956cf-2954-46ba-8842-c27cceca7fa6"
      ]
    },
    {
      "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773",
      "dependsOn": [
        "302d3dcb-a5b5-48e5-9501-5e542c088e3c"
      ]
    },
    {
      "ref": "24a2e681-7476-4de9-990d-552c1774ba28",
      "dependsOn": [
        "5dce737f-d598-495c-827a-d7f9f42e02f6"
      ]
    },
    {
      "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae",
      "dependsOn": [
        "822b59ca-ce8c-4625-8f4f-8ab7ed246ad4"
      ]
    },
    {
      "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be",
      "dependsOn": [
        "556e6847-339f-4599-b311-2846e1625713"
      ]
    },
    {
      "ref": "1c308700-3aab-4d49-a900-48bc200e10d6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "50b481cf-70c8-4db5-935d-3c58174ea93e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "61d70c14-333a-4441-8190-c768a6ace8e9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559",
      "dependsOn": [
        "cbfdbbed-2fd2-4617-a388-e0b9b185fd4b"
      ]
    },
    {
      "ref": "00209d57-f76f-4a38-9ba0-130e69390d92",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "160bd697-a285-498c-a5bb-5a22c784b734",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1631d335-4e18-42de-9f8f-e4408789e416",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2e324721-9240-4849-bf53-109c02c29de0",
      "dependsOn": [
        "d55c1bdb-e2cb-42db-ba85-e7b99deaf3ef",
        "c25654bb-f622-4946-9ac0-793e6f389b18"
      ]
    },
    {
      "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3",
      "dependsOn": [
        "0c4cc85c-434f-4426-99b1-336252b314a6"
      ]
    },
    {
      "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8",
      "dependsOn": [
        "40a17eb4-8717-4521-ba17-a7163cf4b06d"
      ]
    },
    {
      "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f",
      "dependsOn": [
        "e4035c75-70ea-4ac7-8927-c22f09ebaf09",
        "26e6be5a-773a-4826-a8d5-fac6d4c8cc33",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0c1cebbb-504e-4d61-8dce-42c941af1c11",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7881be8d-8361-4819-8f7f-2334593e0787",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "38994767-2a3b-4549-ab7c-599b8344c871",
      "dependsOn": [
        "99032924-23ec-4d30-ae9c-a40c27aa33df"
      ]
    },
    {
      "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb",
      "dependsOn": [
        "29426c4c-7f96-443b-8592-9b94a203ddab"
      ]
    },
    {
      "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1",
      "dependsOn": [
        "342573d8-5756-438b-bc92-814fb7f057a1"
      ]
    },
    {
      "ref": "5e232522-53a1-4dbb-a698-9734370df233",
      "dependsOn": [
        "fcd4e5db-3f18-42a2-8ace-7a38744f4e22"
      ]
    },
    {
      "ref": "30af3494-869b-4724-aebc-fe68f4ba22d8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3a190b27-e968-4393-a29a-faeffd7e1b39",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "cb6804a5-5e21-4a7e-9478-d1290662de52",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d7cc4974-fa80-4c7a-985c-d21e01b28340",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79",
      "dependsOn": [
        "a4cd94f4-70f6-4468-9cac-d074c0e6dd2f"
      ]
    },
    {
      "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381",
      "dependsOn": [
        "350bfc5e-dc04-4243-aceb-36b0454f1569"
      ]
    },
    {
      "ref": "1fb4ef3d-372c-4bf7-b074-0a814211c07b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449",
      "dependsOn": [
        "8fbb6b0b-abfd-4d81-b123-f2dab10d9144"
      ]
    },
    {
      "ref": "cd7acea7-231a-4728-af9a-548a94e64cde",
      "dependsOn": [
        "607cb34b-04e7-47b7-85a4-f79f9d9e2676"
      ]
    },
    {
      "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d",
      "dependsOn": [
        "fe19334f-8ac0-40ed-864d-038dfbe1327f"
      ]
    },
    {
      "ref": "0013d7d5-27bc-421f-8a03-1cbdfbc2b374",
      "dependsOn": [
        "ed6a05ae-885e-4c42-b063-fba1d46af7c7",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c913a3d7-d016-4463-b95c-91266511e1b2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "defff098-222a-46cb-81e0-fe21e13f0928",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "000d8527-800f-45f1-91fb-af850cdef26d",
      "dependsOn": [
        "7ab09767-9d28-4b7a-8661-c4a0db30e5bb",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3297b825-fc9d-4b6e-af9e-7d0569721292",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "39eaefb2-5695-4868-b246-1d81766a35d2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "85b716b5-46e1-4491-a4b9-666bdcb3fd2d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "86ec9671-8b26-4627-a019-16c9b0f017f6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f013647d-a63a-4f0e-a675-1a6425e61f15",
      "dependsOn": [
        "373f5454-2120-4145-926f-55feeee6fffd"
      ]
    },
    {
      "ref": "5180a509-e080-439a-bec4-ff8c171f2062",
      "dependsOn": [
        "cf6b5e28-9b8f-40d3-8705-9dcd9fc12ae0"
      ]
    },
    {
      "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa",
      "dependsOn": [
        "2053bfbc-889b-4942-ba7f-3a42627a2ad0"
      ]
    },
    {
      "ref": "9352b053-8490-4cf1-881f-18e4629f373c",
      "dependsOn": [
        "3543adfc-c7c0-466e-843b-4dff346c0cd3"
      ]
    },
    {
      "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd",
      "dependsOn": [
        "6cd641b2-cc2f-4c47-9195-56e562b4c4b3"
      ]
    },
    {
      "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38",
      "dependsOn": [
        "8dbee049-e643-4664-bfef-ad3a5a312b85"
      ]
    },
    {
      "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa",
      "dependsOn": [
        "e19e1068-2c17-460b-b4d9-356cd0e716d9"
      ]
    },
    {
      "ref": "07654863-b5da-470d-899e-0d8f3f740f15",
      "dependsOn": [
        "1d23194f-8cec-4137-bfa2-485d6fab740d"
      ]
    },
    {
      "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3",
      "dependsOn": [
        "e9925bfe-db42-412a-b485-ad9e65bf1dee"
      ]
    },
    {
      "ref": "6d84b148-22ea-4998-bf1f-c0145175970f",
      "dependsOn": [
        "dfd37ed9-98f7-4acd-8b43-46b3828edc4d"
      ]
    },
    {
      "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5",
      "dependsOn": [
        "ab846128-7003-4de4-b6b7-2a2101cfabcf"
      ]
    },
    {
      "ref": "e7821334-9f92-4c55-b715-6ebe70115720",
      "dependsOn": [
        "c8a369d2-7356-4344-855e-6c03b84104a4"
      ]
    },
    {
      "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c",
      "dependsOn": [
        "54eb5889-f339-47b5-866b-2967c8a9d5cb"
      ]
    },
    {
      "ref": "4746a1ce-01e3-4d44-b1a4-050a27056baf",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "16005a53-267e-4dd2-9785-2553fb756387",
      "dependsOn": [
        "8ba1555c-30b5-4785-90e8-7b938e4d802d"
      ]
    },
    {
      "ref": "903dc195-fbc6-4805-b389-0408eac82a50",
      "dependsOn": [
        "2972d5d6-52ce-4887-97c8-00797500170a"
      ]
    },
    {
      "ref": "f732f606-5f46-4d40-93e7-42f347748c34",
      "dependsOn": [
        "2f4f21d3-b5ef-453f-bc1a-ca53d64ee3a5"
      ]
    },
    {
      "ref": "126c99b1-f887-4e7d-92cd-f3dbd2120bf8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "68b32112-8ad2-474e-bb45-7f7914f3be60",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d366c2ce-f424-4724-b915-668c404e6234",
      "dependsOn": [
        "f8c590d1-4380-4bad-8d0e-353a7c07b500"
      ]
    },
    {
      "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a",
      "dependsOn": [
        "0515d63f-4c71-402d-ae00-a08da512267c"
      ]
    },
    {
      "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8",
      "dependsOn": [
        "67c71bce-76c2-45fd-8aff-043d53a7c468"
      ]
    },
    {
      "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8",
      "dependsOn": [
        "36756984-b8f4-4e2d-a0d9-a0cfbbbf1616"
      ]
    },
    {
      "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35",
      "dependsOn": [
        "ecbc34a0-34a6-4689-8c83-59807c126a01"
      ]
    },
    {
      "ref": "4956ce24-ff71-42f2-bcf4-c7c122ac5de1",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "8ada50a8-cb0f-4b11-82bf-c2abae87050c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc",
      "dependsOn": [
        "586e47b6-08f8-40c7-b53c-d24d28d432b0"
      ]
    },
    {
      "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd",
      "dependsOn": [
        "4fd0bc20-bc1a-4dd2-a2ec-cbb819817c64"
      ]
    },
    {
      "ref": "f1035c27-7835-4881-ad46-fbcd259dcf36",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55",
        "e1592250-0cf6-4c8d-b40c-0a06125e13e2"
      ]
    },
    {
      "ref": "26ed1e27-9ef8-436c-bb16-f3bc48556a12",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9d365d08-3b31-4aa5-a04c-773c369cacb2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a1384c4b-9b6d-49e2-9f9e-282540523c36",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b4c0f480-4c2e-48f6-8fd3-ff1ef3216c94",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a",
      "dependsOn": [
        "0d7ade69-6cc3-41ba-a74b-aecdd6478abc"
      ]
    },
    {
      "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9",
      "dependsOn": [
        "9a7f37d4-40c0-4b3b-9668-605ab8c01ff1"
      ]
    },
    {
      "ref": "e0202add-d435-424d-a381-bf7e699cde51",
      "dependsOn": [
        "e7565464-a675-4715-8e86-4acc8e6c6af6"
      ]
    },
    {
      "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4",
      "dependsOn": [
        "94196082-1302-4500-876b-acdddbd525ce"
      ]
    },
    {
      "ref": "7b63c3ff-a6e8-4662-b601-2007b8b996d5",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d0380940-f84e-45de-901e-2c33b401d277",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2d7d8566-f4f8-4e85-9b38-227346f01e00",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0",
      "dependsOn": [
        "921bcd7b-0617-49ee-8fe8-b6f641a81216"
      ]
    },
    {
      "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1",
      "dependsOn": [
        "b162ab6e-d317-4ebe-9997-08a5095b8e64"
      ]
    },
    {
      "ref": "045af516-5f24-4f5f-a101-235011fd3ae4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "67278b74-b007-4525-ab95-dba8c68bb561",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "64d5799d-ffef-4242-b348-553a875a3b1a",
      "dependsOn": [
        "fb825576-02cb-47e7-ba33-6e5aa2ae402d",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7",
      "dependsOn": [
        "869f4780-a17a-432e-99e1-dc16546847b8"
      ]
    },
    {
      "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6",
      "dependsOn": [
        "b3ac242a-2065-4ccc-82d8-c85af39e2315"
      ]
    },
    {
      "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4",
      "dependsOn": [
        "2b4af850-84bd-4f81-b4c0-6cdf8006d9a5"
      ]
    },
    {
      "ref": "6fb430dc-ebab-4d15-aee0-3ee7afdc2645",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2a26ad27-f204-4b29-9ba7-dd0433208289",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "da559dce-14f5-48cc-8aaf-cb1201501758",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "01c8613f-6462-4755-9b65-700753412bc4",
      "dependsOn": [
        "44999ff9-12e3-4fe2-a69d-6b94c04068fe"
      ]
    },
    {
      "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262",
      "dependsOn": [
        "3f0f22e1-ae70-4bca-a664-eec6a4c57c30"
      ]
    },
    {
      "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b",
      "dependsOn": [
        "6daa7bdf-bb60-44d1-bf7b-f6d9c011fb68"
      ]
    },
    {
      "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b",
      "dependsOn": [
        "33cf822e-eaaa-4915-82ea-0b5805de7378"
      ]
    },
    {
      "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4",
      "dependsOn": [
        "c282a119-5446-49d5-9fb6-45ce3bab836f"
      ]
    },
    {
      "ref": "68a5bffe-e060-4e54-a4c0-5de011172777",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c347227a-a1fd-4e3b-9d4d-f35e51022c75",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d",
      "dependsOn": [
        "2d452aba-7a02-4c7d-87e1-280bf8c59609"
      ]
    },
    {
      "ref": "69ad7d07-9053-47fd-9185-669c67e2055a",
      "dependsOn": [
        "68b21fb7-ec0a-4365-a668-9ed60d15a4db"
      ]
    },
    {
      "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8",
      "dependsOn": [
        "25aceb81-4ef5-4668-8bae-1c3decdac99c"
      ]
    },
    {
      "ref": "37330a26-b35a-44ca-9fb0-03e51cbc7045",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3d2203c9-122a-49e9-9bb5-61077c5ea0c4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "46d706e8-5430-4e0f-832d-6545a0cc22b7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d",
      "dependsOn": [
        "11472751-39a6-48a2-85cb-668590003034"
      ]
    },
    {
      "ref": "4087f86a-e003-4028-93db-09398778ede1",
      "dependsOn": [
        "4ce46489-7774-4440-a6eb-fd61a72fe9d5"
      ]
    },
    {
      "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c",
      "dependsOn": [
        "d29e18e6-f3b0-414d-9fcf-93014ef9c6a5"
      ]
    },
    {
      "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91",
      "dependsOn": [
        "92d92de0-9969-4d81-af37-7c3dedd248fc"
      ]
    },
    {
      "ref": "4e52c62f-321b-4f33-82fd-6e712a90d172",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "77f518f4-c28d-425a-a68f-9f7444f2d2a6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c340b466-22a4-4166-99ef-61a523f44f0d",
      "dependsOn": [
        "881aae18-844b-4d8f-bcff-b4c88bba26c9"
      ]
    },
    {
      "ref": "6e3144b1-0f25-45c8-9d23-0ec4262f2d59",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0adec78c-f181-49b2-b259-912204acfd7e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7a9cb339-2780-4c15-897a-087683786c23",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "cb2e8093-9430-49dc-82b5-a77388890c73",
      "dependsOn": [
        "d9145db0-4d46-447f-af19-a017b1233f19"
      ]
    },
    {
      "ref": "0f9b3731-296e-4f62-ac8a-27b4a4125eca",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5",
      "dependsOn": [
        "983def2f-aef9-4e9f-a95f-4c6c3fa906be"
      ]
    },
    {
      "ref": "90aa573a-0996-4e2c-802b-f847e30e4809",
      "dependsOn": [
        "6c3ed291-c06c-4d9d-a8e2-cbec41a064f3"
      ]
    },
    {
      "ref": "81befa31-1238-44e7-b42b-0333669f29c0",
      "dependsOn": [
        "fd3ab60f-940d-474a-8ab2-3c0333be33f3",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "013b6ff0-a611-435b-9dac-d61573401939",
      "dependsOn": [
        "5bfc506d-4ef3-4e70-887b-d4b02115a162"
      ]
    },
    {
      "ref": "0e29126d-2009-43c1-890b-63813c0c23f7",
      "dependsOn": [
        "525af50c-6f70-4d02-9569-c42f87296b97"
      ]
    },
    {
      "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4",
      "dependsOn": [
        "02f5c995-01be-47f7-aeb0-6501b1eda478"
      ]
    },
    {
      "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6",
      "dependsOn": [
        "c3d04040-caf7-4994-80f0-471d99c44907"
      ]
    },
    {
      "ref": "82553659-a2f1-40ac-bc98-be995101306e",
      "dependsOn": [
        "ac05e2b1-c52d-4c06-aa9e-55c3b0e95b96"
      ]
    },
    {
      "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0",
      "dependsOn": [
        "40450f58-390b-4cc2-9285-052e055e6300"
      ]
    },
    {
      "ref": "2e6f7c76-6585-4bbc-a83f-6e19eea06b13",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5d7ab366-9f60-4c89-a999-0f3a32d2851f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb",
      "dependsOn": [
        "5633222c-94d1-4318-b4e0-fc39b542a6f5"
      ]
    },
    {
      "ref": "93ed2686-2307-454a-88ce-4edc0f602820",
      "dependsOn": [
        "21f350c3-c22c-413d-b70b-5b1d8a63f12c"
      ]
    },
    {
      "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6",
      "dependsOn": [
        "907bf56d-1d81-45a8-93f9-c9cb553826be"
      ]
    },
    {
      "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760",
      "dependsOn": [
        "29cde003-4068-40f5-bd6a-2c824da49836"
      ]
    },
    {
      "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58",
      "dependsOn": [
        "f23e1bd2-30c9-4125-ae35-54c34fb1c7ec"
      ]
    },
    {
      "ref": "4e8751cd-10e0-4e03-bf00-1e0735e6dde5",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "687637ac-4932-41d8-bc2b-c5b0522c3486",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "728fac92-dc0f-4bd4-a5bb-27747a2d0948",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4513bb30-7232-4791-b6f5-14db554d7415",
      "dependsOn": [
        "300c8979-cfc0-442e-8a8d-89e22cb2c94c"
      ]
    },
    {
      "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c",
      "dependsOn": [
        "0c1ab5f8-e55b-40b7-94ef-d82ed54c2188"
      ]
    },
    {
      "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237",
      "dependsOn": [
        "21461112-71e7-45cc-aafa-d5666cf0e8c0"
      ]
    },
    {
      "ref": "017cea36-1184-48f2-a565-c4ef2f03a2ef",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0607c597-04a2-4afa-918f-7c7683a346dc",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "394dead1-88b9-4d51-a5e7-39d4d110278f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "49035b95-bef4-4a71-86de-25ab8c2b0fd5",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "665b0e52-b264-4ffb-8636-03dd05c89217",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55",
        "bd69e55b-b840-4672-99ed-0da45799cc85"
      ]
    },
    {
      "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda",
      "dependsOn": [
        "ec315413-3a82-4a12-b8f6-7335f3e7b0be"
      ]
    },
    {
      "ref": "304024b3-fb62-4d07-b19e-a188371d4595",
      "dependsOn": [
        "ae098a8f-0e1e-4c39-9b34-3ca29b3ace1f"
      ]
    },
    {
      "ref": "7765909b-bd21-4e07-8171-df0816ab90b7",
      "dependsOn": [
        "884bda62-9c61-4e8b-8224-0013ff8be244"
      ]
    },
    {
      "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de",
      "dependsOn": [
        "b723433f-2333-46e3-a4e9-8a3fc83ca10b"
      ]
    },
    {
      "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5",
      "dependsOn": [
        "727d8804-db6b-468d-b398-1742c0775897"
      ]
    },
    {
      "ref": "b68f8c12-de9b-4704-948c-e94f955a126f",
      "dependsOn": [
        "c7483525-ec57-459c-be6f-2f73148c7ab3"
      ]
    },
    {
      "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3",
      "dependsOn": [
        "875d5789-3708-4cd2-bd59-afcc96619f15"
      ]
    },
    {
      "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15",
      "dependsOn": [
        "b3427e51-232b-42dc-80dc-39cfdac7f1e4"
      ]
    },
    {
      "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd",
      "dependsOn": [
        "52ee3cbf-f110-4a11-9d22-76f565429316"
      ]
    },
    {
      "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975",
      "dependsOn": [
        "276340f9-d986-48cb-8019-1164c1678878"
      ]
    },
    {
      "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874",
      "dependsOn": [
        "91920184-fd77-4c8d-a24c-4a328fc5e744"
      ]
    },
    {
      "ref": "663e045b-b93d-4cce-b7ae-f9f3ae65a2f6",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "155fdb98-729b-4f7e-8614-eeeb475953d7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "600e854e-8913-4545-9159-796b809b43a2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "682bd4e6-1ad4-4ec1-8e48-a2ce39fb9e49",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d07e65ec-4509-45fc-9f4f-15bbc4050e98",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f",
      "dependsOn": [
        "660477af-d781-4f21-911e-2ab88dc9979c"
      ]
    },
    {
      "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf",
      "dependsOn": [
        "f890df34-8d69-44fd-9a6b-a3371c9e5241"
      ]
    },
    {
      "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878",
      "dependsOn": [
        "4b9cbed7-f688-461b-b881-8f8c99da6e80"
      ]
    },
    {
      "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75",
      "dependsOn": [
        "57009608-29ad-41ad-819b-14c3ee44641e"
      ]
    },
    {
      "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a",
      "dependsOn": [
        "dea06c63-68a2-4120-a9f3-ecb572683064"
      ]
    },
    {
      "ref": "3fc91083-e27e-449b-ab6f-0b311062a726",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "44c1685a-eed1-496e-baec-646f586920ad",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4a513490-9b4f-4fd5-ada5-698590cf995f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27",
      "dependsOn": [
        "7f169ce5-8112-4ddb-9eb5-f2110550fb66"
      ]
    },
    {
      "ref": "17208586-7e43-40ee-82a1-ecd052448176",
      "dependsOn": [
        "921485c6-4294-41d3-84f5-cf455ae6e398"
      ]
    },
    {
      "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9",
      "dependsOn": [
        "b5cfec75-ca5f-4674-9156-0b55e602778b"
      ]
    },
    {
      "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30",
      "dependsOn": [
        "b13b8b89-368e-40e3-ac3e-86779691c1e1"
      ]
    },
    {
      "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a",
      "dependsOn": [
        "5d7a6ae7-565b-4f23-b7aa-a01544b50085"
      ]
    },
    {
      "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e",
      "dependsOn": [
        "e27351c2-bac6-4674-904d-b828ae3b5780"
      ]
    },
    {
      "ref": "bfa0f56b-de84-4088-9ae6-92039c4c8d0b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "cef14346-674f-4275-a10d-c293409c1464",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1f65ac8b-e15f-49aa-b1bb-569a24bbeb08",
      "dependsOn": [
        "ea98e3b4-f08a-4a27-8726-030d5f469d37",
        "39cf6867-f3db-4d8f-81c0-215b663ef95d"
      ]
    },
    {
      "ref": "6123f157-9705-425d-929d-1a5e0a94fcfd",
      "dependsOn": [
        "ee618d9d-cff1-469a-a7f1-e76bd47ec8cc",
        "e243bf52-5976-4ea9-9330-e7565dac2cb8",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2db01ec5-f4da-4e5d-a302-83e9520fc3c8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "563deeb9-566c-473e-a801-137b599eba13",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6714ce38-099a-4020-b69e-4a774436e7fc",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5",
      "dependsOn": [
        "c954335b-5ef8-491d-8950-a26128ab99d8",
        "731c46d6-7488-42ce-991f-8c754e5e5e9c",
        "12cf3756-f75c-46f7-81d7-8f11ef802c96",
        "ed9e4d4b-451e-4918-8c7c-435729f175ec",
        "719739c2-c73e-4a84-b22b-6da6f59d3e27"
      ]
    },
    {
      "ref": "5405a809-8d71-4e23-b866-bf219cd0971d",
      "dependsOn": [
        "5c9ed054-b875-45d5-b28d-ca3e458dc363"
      ]
    },
    {
      "ref": "c1c60606-a500-40d3-8b89-0678f2957da7",
      "dependsOn": [
        "070bc172-c800-41ff-a6e5-a35ac12f91ab"
      ]
    },
    {
      "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7",
      "dependsOn": [
        "533ede75-297a-4797-b921-d9e0ab293622"
      ]
    },
    {
      "ref": "df690613-68bf-4e0d-99d1-8cc9f7041bf9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "000002b5-7ea4-49d0-b371-adcef5f96c3d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "08bb6fac-2d13-49ac-9b99-17e03fc0ab74",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1707178d-8b0e-448c-b12e-08c1ad39c301",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b7d7e6c5-4d26-47ea-81bd-b16194b6ba67",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86",
      "dependsOn": [
        "13e9ecac-c683-401c-80a1-60a68b01d49c"
      ]
    },
    {
      "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856",
      "dependsOn": [
        "d4f12ca9-878f-4763-9f85-ab6adf434971"
      ]
    },
    {
      "ref": "0710a46c-f332-4ce1-a71b-2d4a7d15ba93",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "228b8754-4f10-41ac-81f6-4480df2d9909",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d12c99c4-9bc5-4a08-973a-81f1a81673af",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d6f33100-e235-4b9f-8c22-6b539f1922e9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "fd390e27-b595-4d6d-94d6-8048270fb10e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "cfdc8540-39b8-4bdc-a2d7-a41ad87bca00",
      "dependsOn": [
        "1d581af4-6bc4-40e4-bc67-5662c4c01a1c"
      ]
    },
    {
      "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50",
      "dependsOn": [
        "66657252-310c-415d-844e-f9c00f064d4a"
      ]
    },
    {
      "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416",
      "dependsOn": [
        "124a4c5e-79e5-4286-8d9a-538c876b4f3a"
      ]
    },
    {
      "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d",
      "dependsOn": [
        "987b0d10-ca8d-43f9-bf50-ba9d584928f3"
      ]
    },
    {
      "ref": "6156cdf4-bbe4-4ec3-ba64-3f2740560145",
      "dependsOn": [
        "952e4272-60cd-4d7c-a3d3-459aa724ec9b",
        "88438639-05bb-4d34-a430-0fb44dd0d788",
        "cbca0615-fc2a-4306-8a4e-cf4d42a9e420",
        "a5ca71a9-62d6-4231-a9bc-1ae9c9992288",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be",
      "dependsOn": [
        "e37c64f2-9597-42a1-bb02-d681b927d6ed",
        "f25a862a-df0f-4590-9f32-697284765d57",
        "ef47ce7f-1279-4c08-82fa-7ff9140611ed",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7ee0f868-38cd-41d2-84a9-0b2f4783eacc",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d098b5a9-87b1-4dce-8940-29aaa70e071f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55",
        "cdff457f-b029-4ee2-b107-2fa1cb2b897f",
        "8c14b067-5bf7-43fa-8001-fa8284b36fd3"
      ]
    },
    {
      "ref": "d279cdc1-dbd3-4184-a8a2-7d75aea5e557",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "041782fd-db5b-4f84-88dc-4bc601b5270a",
      "dependsOn": [
        "8ba828da-a5d4-476e-b59e-338173bfaa4c",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf",
      "dependsOn": [
        "94bc29f1-9a06-4bf4-9341-25a2ff658afb"
      ]
    },
    {
      "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7",
      "dependsOn": [
        "2e7ddf90-ffb5-410a-858b-0c76527073ae"
      ]
    },
    {
      "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10",
      "dependsOn": [
        "b02def8c-d2e3-4960-91d0-2459a6dd71f1"
      ]
    },
    {
      "ref": "b953bdf0-bf13-4525-a812-de1e055467ab",
      "dependsOn": [
        "082e7c0e-cfb5-44ea-b831-dde591d903e5"
      ]
    },
    {
      "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95",
      "dependsOn": [
        "71f667d6-c9ec-4100-8102-f0eb2a4e0f30"
      ]
    },
    {
      "ref": "e0b556f5-9711-47b6-a945-63abbd79e839",
      "dependsOn": [
        "0d757aa2-7d57-438a-861c-35193f10caf9"
      ]
    },
    {
      "ref": "150f2450-b967-4ab9-82ce-9b1bcc5d9bce",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70",
      "dependsOn": [
        "28f87a4f-2e33-4225-92c1-262b419f20a6"
      ]
    },
    {
      "ref": "799087b6-a64a-4266-a576-ba517ecc96d5",
      "dependsOn": [
        "50a765b7-5116-4f5f-9ab2-2ae5f13b01e3"
      ]
    },
    {
      "ref": "b01024ca-8e60-47b9-b0d0-d2faa897d293",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1f29862e-de1f-45ef-9084-e969ed4e8fe7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4204bdaf-2f98-47d3-a5ea-934ba2b7121f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "524073a7-7ac3-490f-bd13-c7d9d1d0fdad",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7292e381-9d6f-405f-8788-7292fb77edb3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b",
      "dependsOn": [
        "79166f5b-b270-48de-b192-61a6987f63de"
      ]
    },
    {
      "ref": "248df14c-4480-48f1-98c1-9c0a1e34c4ed",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3b5a5f8a-9292-4c30-ad09-23146d7c9310",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b892c74e-0244-42e1-a9ae-a2c72d8d1675",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d5f78a87-1eb9-497b-86d2-923e55765c2a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55",
        "955d7516-00c6-4446-8dd3-396e4fd5019d",
        "d606b24b-2cbb-4e10-beb9-877b9731380f"
      ]
    },
    {
      "ref": "e199f85a-1424-43cd-b29e-e620347709cb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a",
      "dependsOn": [
        "7a9ac5ef-eb40-4c8b-9649-e0b905d75636"
      ]
    },
    {
      "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83",
      "dependsOn": [
        "eabf1a54-f000-4429-af25-0e7751f083cf"
      ]
    },
    {
      "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d",
      "dependsOn": [
        "129d16dc-963a-46a7-8d35-c30dc74bf5e5"
      ]
    },
    {
      "ref": "e3589a2a-620f-476c-acef-4df35a53adb8",
      "dependsOn": [
        "db71dab8-ddfd-47ed-9622-8d58be6e7718"
      ]
    },
    {
      "ref": "1f531a36-9c8d-4178-91bd-4297edc61d70",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6bc5ab44-6820-46a0-9946-2beb2389b486",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "eb4b5ddd-b298-48fa-8263-0467700610b0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ce007e2c-6e66-459f-a7c7-4d8278d32677",
      "dependsOn": [
        "7dbc2119-89f4-404a-aa5f-e073be8eff3e"
      ]
    },
    {
      "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1",
      "dependsOn": [
        "380e12c6-ccbb-4ae2-b1f7-b0e813cb156f"
      ]
    },
    {
      "ref": "20a12227-6079-417b-9827-5face6f82b59",
      "dependsOn": [
        "13d934ef-9207-42e9-bae4-99dab60b87af"
      ]
    },
    {
      "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168",
      "dependsOn": [
        "33886458-aa4b-40cb-a4cb-8c5a3d36ad9c"
      ]
    },
    {
      "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8",
      "dependsOn": [
        "821148f2-4c7b-4d05-9296-a28fea382ace"
      ]
    },
    {
      "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af",
      "dependsOn": [
        "c4ef31e8-0786-4c70-a2af-297e790f0d3b"
      ]
    },
    {
      "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6",
      "dependsOn": [
        "99fae0fa-21ac-4cf5-a5e7-7c15a2347736"
      ]
    },
    {
      "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0",
      "dependsOn": [
        "de9dbb5c-5e21-42ee-b07b-15947d0b6003"
      ]
    },
    {
      "ref": "3ba826c4-5e60-40fc-8fdd-c805a95cbbcb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107",
      "dependsOn": [
        "5161690f-3289-4c39-86e9-be272357559d"
      ]
    },
    {
      "ref": "4d06a0b7-5b8a-467a-8943-75a729864023",
      "dependsOn": [
        "1b51f551-0901-4425-bd02-4dd08d0bf5f9"
      ]
    },
    {
      "ref": "79121aa0-be21-469d-8262-3dba005b66ae",
      "dependsOn": [
        "8ca174ce-34ca-47a3-8ada-18a7f85d6232"
      ]
    },
    {
      "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f",
      "dependsOn": [
        "01ca7ad5-762c-4758-b203-c4c1a3da82b3"
      ]
    },
    {
      "ref": "a507105e-dc21-4b23-aae8-44213cbb314e",
      "dependsOn": [
        "dba52e41-1641-4f59-8d42-b9aa6b6557b3"
      ]
    },
    {
      "ref": "01ed9869-2fc6-4356-ba53-c90edb727fa7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4bcbacda-6ca3-47a4-9a5b-bd767d49cb5a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "68c0a52d-3b19-4657-b2d8-800e40706895",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4",
      "dependsOn": [
        "6ef58cd9-d31a-4488-9708-589789c8f8ac"
      ]
    },
    {
      "ref": "0c61ed58-9136-4b81-b9e1-8a53be691350",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1d8bcd9c-993d-4f03-892a-a095d225f0bb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "45e19610-fcd2-4cf9-b84f-1207b7a5bbac",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7943845c-187b-40eb-a881-62a102bfb617",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "91072551-6b25-4fe3-8aeb-f3de71197180",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f11f4d54-d6d7-4811-b7d6-bbdb2500a7bc",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1061aebb-69e2-4b52-8626-80596afa48da",
      "dependsOn": [
        "3896c01c-2764-46cd-9543-b4abce41ffd4"
      ]
    },
    {
      "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21",
      "dependsOn": [
        "6bd2fa35-0958-4f19-b59a-a3c8f989604a"
      ]
    },
    {
      "ref": "46a86fc3-e294-4953-8376-86d36b032f64",
      "dependsOn": [
        "353d15ce-0e80-4acc-b983-4d5b63b6ecd0"
      ]
    },
    {
      "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355",
      "dependsOn": [
        "022124a2-cd54-435a-b412-c698f7e86d14"
      ]
    },
    {
      "ref": "85b9dd90-4479-4f2d-8f80-753902a67fdb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d34ab30e-ab9d-444a-9f0b-b72b0e472a41",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f2d9026d-2ff1-4f58-a679-6e973a28bd8a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1b4702b6-ac84-47c7-acfa-6e3998b4777c",
      "dependsOn": [
        "b61a357a-d935-47ba-b3a5-8aa5ee52b41f"
      ]
    },
    {
      "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f",
      "dependsOn": [
        "4f79bb26-ebfe-4bf1-8dfe-cb6c1b64a9c9"
      ]
    },
    {
      "ref": "0ac3dcb5-fb9d-4a58-8e57-58c474cdeeb7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b4ddaf27-9bbb-436d-885e-9dac2dc2a1b7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089",
      "dependsOn": [
        "e4174b9f-f89d-4113-83f3-f88d8725051d"
      ]
    },
    {
      "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0",
      "dependsOn": [
        "ea8b2fb9-192a-45db-9962-bf934269d6dd"
      ]
    },
    {
      "ref": "0a031b03-ad03-4a9d-a8d8-cc3b0fbf5861",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1e9955f9-d678-49ae-aeb0-c72f101cb0c1",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "378436b1-a54f-4654-a0a9-2f3b7b9064f7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "454de516-cfe1-4889-b795-fa274eebeafc",
      "dependsOn": [
        "881888ab-e51d-4355-b3d5-3eccd52a1f94",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407",
      "dependsOn": [
        "3938a939-e06f-4603-988b-4a1d9802d9ee"
      ]
    },
    {
      "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2",
      "dependsOn": [
        "3df104aa-66d0-4b3b-b01f-8d9786aeeaee"
      ]
    },
    {
      "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c",
      "dependsOn": [
        "c5ec186d-2de5-4981-817d-4e7f4d14413c"
      ]
    },
    {
      "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e",
      "dependsOn": [
        "aafa1065-b729-4eaa-804e-e6aaef693195"
      ]
    },
    {
      "ref": "60917a88-7d03-4086-a4d3-50848aefb4de",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7b958777-fc99-4d6e-8a7d-6eed7c5e10b2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d2c7bee5-7ef9-4188-a8a0-679cf36a4ce3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "17cad429-2da5-42ad-8146-c841433fba88",
      "dependsOn": [
        "452d31bb-ca2d-475d-a0a4-58918c5cb259"
      ]
    },
    {
      "ref": "37665345-af4f-4243-b58a-d7f045290c8d",
      "dependsOn": [
        "8ec8b8c1-3c35-46fd-b927-ccc926935178"
      ]
    },
    {
      "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15",
      "dependsOn": [
        "4af00f2d-6ca3-4a08-80b9-3327c2e6aab4"
      ]
    },
    {
      "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed",
      "dependsOn": [
        "6e45cabb-32d9-4aa9-b53a-476bb86b1cd4"
      ]
    },
    {
      "ref": "e1e06893-88f8-40d1-98bb-a0e0052c0d7b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d4d56576-6d30-43a5-925c-ac343cabe244",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ff45a565-b989-41c9-ba42-88ec32386aeb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b",
      "dependsOn": [
        "f9c0c848-d0b0-427a-b95e-a177b59915a7",
        "d9c44480-0a4b-4020-8891-e4177c5e6eb6",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3602626e-d793-4371-9d01-4bea16003ee2",
      "dependsOn": [
        "6fe41d44-a3b2-45c2-a6a0-7751efa2d76e"
      ]
    },
    {
      "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8",
      "dependsOn": [
        "0fbe7052-7bfc-4a9e-bbba-efdceacb26c1"
      ]
    },
    {
      "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6",
      "dependsOn": [
        "ebd60de9-59bb-44ca-94fe-fa3df967df73"
      ]
    },
    {
      "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19",
      "dependsOn": [
        "5b979ee5-7309-4338-80fa-85025e8fd6d3"
      ]
    },
    {
      "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0",
      "dependsOn": [
        "d8cefe0f-a5f1-46ab-a937-4ed68a5c6097"
      ]
    },
    {
      "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766",
      "dependsOn": [
        "dd88f4ad-109e-4ddd-8f91-4f04d6fe9361"
      ]
    },
    {
      "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd",
      "dependsOn": [
        "15a0cae1-256a-47aa-b777-def09e949eaa"
      ]
    },
    {
      "ref": "1b3d49cd-9764-4172-b82a-399aee001ea3",
      "dependsOn": [
        "367b1218-4f1a-4db5-a865-c0d29603b45b"
      ]
    },
    {
      "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab",
      "dependsOn": [
        "18426329-cdde-4ba3-b2e1-2f4ac85e49d4"
      ]
    },
    {
      "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44",
      "dependsOn": [
        "1dc4427b-761c-45a1-848f-cb2551733e46"
      ]
    },
    {
      "ref": "f7224e46-7174-4145-8e10-4afad557280e",
      "dependsOn": [
        "0523efb4-11d5-4d63-ad8e-b175809f74a5",
        "a8178a38-8de5-495a-83ba-4d89a6524b9d",
        "bb812279-584c-41a8-984e-6e4eeefe2aa6",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "95f70a6c-46c4-44ca-b33b-3fa46ff797e2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4b53b9f1-4dff-40b4-9286-a9523ecff1f4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4c41e368-b432-4b6a-a733-16f6eb832a0f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "8bb3c5a5-f027-4ca5-a82f-6b6d5524d0e4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf",
      "dependsOn": [
        "01b53b28-a784-40bd-a240-dbd35631ad8c"
      ]
    },
    {
      "ref": "84d825ad-abf2-4a39-9b3e-d6ac88a92d7c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "960b59c0-a95e-4640-a68a-383a826f7771",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ca0e01e7-804d-4c8b-8730-2c21f9f1d765",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "035a466d-6f40-4144-8688-e39ed8ef969e",
      "dependsOn": [
        "3ba23c67-7974-43d0-bf79-83909698137d"
      ]
    },
    {
      "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73",
      "dependsOn": [
        "d43fe152-b6de-435a-b8b1-766f784e0ff1"
      ]
    },
    {
      "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2",
      "dependsOn": [
        "36fa5bfa-9f49-4b2a-9c33-8c6b3b142c80"
      ]
    },
    {
      "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc",
      "dependsOn": [
        "85195839-3758-4dcc-b696-026d04664fb3"
      ]
    },
    {
      "ref": "35c1ff16-98d2-4e9f-98a6-e84fc51c9405",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "884f91be-f505-4295-9bfc-be2712272a13",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc",
      "dependsOn": [
        "46bdefc4-1fe8-4a1c-bdb1-b497a459864a"
      ]
    },
    {
      "ref": "2e360864-663f-4d23-b14c-a77433dec78a",
      "dependsOn": [
        "3eb3ba4b-e7e9-41d6-b567-45efee86074a"
      ]
    },
    {
      "ref": "03a89f83-eb80-4755-860a-4d46c2378739",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a51c574f-e37f-4785-839a-5f75433aa2e2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22",
      "dependsOn": [
        "988a82cf-1f39-4dbc-993a-71b06d5d3bc5"
      ]
    },
    {
      "ref": "3ebc340b-f096-4902-9678-6e0d72315f15",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "653ab36a-638d-4d2a-af0c-c35f086a4a04",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "dd52cd6e-cbaa-4e8b-9d20-1c661034a39f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e",
      "dependsOn": [
        "82e58776-9a33-4141-9118-891e6ba2761e"
      ]
    },
    {
      "ref": "215dffff-26d6-4241-a532-4d5330df589b",
      "dependsOn": [
        "6f20b889-ecc3-4fab-9726-5fd48e5ec233"
      ]
    },
    {
      "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9",
      "dependsOn": [
        "3da5da6c-5597-4b9b-bbae-6df238f86103"
      ]
    },
    {
      "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d",
      "dependsOn": [
        "1dd86d97-4691-4816-9615-8b50cc84245b"
      ]
    },
    {
      "ref": "8815eaaf-e979-480d-94a0-a80a835675f3",
      "dependsOn": [
        "ac117ac4-8acf-42c0-84ac-7dd864b39a04"
      ]
    },
    {
      "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8",
      "dependsOn": [
        "13dc0e2b-2489-4316-9edc-f0fa04de92d4"
      ]
    },
    {
      "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3",
      "dependsOn": [
        "da2c1898-aaa4-4a7e-9492-892a67f3ca11"
      ]
    },
    {
      "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55",
        "f5f2877f-d7f4-4127-a7f4-42eb50a48be5"
      ]
    },
    {
      "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895",
      "dependsOn": [
        "2713b865-ba97-4838-b03e-530fa5327a57"
      ]
    },
    {
      "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9",
      "dependsOn": [
        "145e8ddf-3b5b-4e72-9d48-dd03af72f3ac"
      ]
    },
    {
      "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829",
      "dependsOn": [
        "3fb5cf2a-7040-4bb5-ae3e-6e4bdcba5b3b"
      ]
    },
    {
      "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318",
      "dependsOn": [
        "1614f998-226d-4d04-89de-5b98f23dca29"
      ]
    },
    {
      "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7",
      "dependsOn": [
        "76e9f51e-eca1-40a0-ad8f-2710a037c398"
      ]
    },
    {
      "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235",
      "dependsOn": [
        "663a8225-f97f-420f-96c3-f332cd987b43"
      ]
    },
    {
      "ref": "2ba0a19d-0af5-4f2f-9d63-8c8575120fdc",
      "dependsOn": [
        "3b62b011-01eb-44d4-bb8c-31bf37dda7d8",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "058aac02-1961-445c-ab39-5588a73f0bf5",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70",
      "dependsOn": [
        "b05aaa7a-7cc6-43e8-8b12-048baa0e0571"
      ]
    },
    {
      "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239",
      "dependsOn": [
        "74cf70fa-c981-43f3-b7d5-234d68a15538"
      ]
    },
    {
      "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f",
      "dependsOn": [
        "e5d883cb-4949-4665-87cf-f201710ccdf9"
      ]
    },
    {
      "ref": "85dd9f4d-0cbc-4541-acb2-d3b9b44e0972",
      "dependsOn": [
        "81a6b22e-facb-4a75-8c5b-0fb2593ac693",
        "473d208d-fe73-4a6c-98f6-f8f805927942",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "984a9e76-6fc3-47e4-9ea5-18c6fed3d60e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c029b294-89f7-4967-8653-775a36230324",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "e1b27813-8062-4294-8a33-5a294c8d3b30",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "eb13fa3c-118f-47a3-9671-ab52c025e8a7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1",
      "dependsOn": [
        "bfc093db-c0d5-4c44-a475-618df2a8154d"
      ]
    },
    {
      "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc",
      "dependsOn": [
        "81e7d503-c9ba-4ec2-9398-d565d019b77c"
      ]
    },
    {
      "ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea",
      "dependsOn": [
        "43b0f840-14bb-4e88-aa1a-103957d54490",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1f077ae7-18dc-4020-adfb-4e958e90ed6b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2ba5326e-4db3-4687-bf74-1f7151b41e18",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ad863a9c-50b3-4417-af59-77ddb6f333d8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "cb7fe145-617b-4715-bfc4-d44392dd2f13",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b",
      "dependsOn": [
        "72491bf5-a6e1-41e1-b70f-ca291a595e1e"
      ]
    },
    {
      "ref": "c0944f4a-7b17-42a8-b8fd-9669b725b9c7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1b9550ba-43fc-4e61-9e8a-581549da12ef",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "43a2bec0-8675-458e-8a52-118966f8e24e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a",
      "dependsOn": [
        "9b561a06-1ac9-4d06-822a-9ef34fad1cc3"
      ]
    },
    {
      "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22",
      "dependsOn": [
        "79fc7e9d-1be6-4bd6-ab6c-46f84bc9f05a"
      ]
    },
    {
      "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd",
      "dependsOn": [
        "0d740c24-34f2-47dd-ba19-94f0052125bb"
      ]
    },
    {
      "ref": "48329e94-0548-4475-9626-c61048289e1a",
      "dependsOn": [
        "79d39007-7988-4afe-a1f1-e55371a85461"
      ]
    },
    {
      "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a",
      "dependsOn": [
        "fc9d4bed-b77e-482e-a502-f13c2f6406bb"
      ]
    },
    {
      "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88",
      "dependsOn": [
        "1cbd086c-55b0-4a33-9e0d-180fb9285191"
      ]
    },
    {
      "ref": "22ba1ed8-0841-472c-9581-852a897b0fe0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "bb197d8f-92eb-4a69-8e1c-2f982c97fef3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe",
      "dependsOn": [
        "b9828792-1129-4b33-9e66-c55032c9a436"
      ]
    },
    {
      "ref": "9d0571d3-23bc-4307-874e-602e68d91e31",
      "dependsOn": [
        "e2250801-0be9-411d-ad1a-49325e19881a"
      ]
    },
    {
      "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8",
      "dependsOn": [
        "3a16d261-6073-4bcf-b588-6376bc33d0c7"
      ]
    },
    {
      "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0",
      "dependsOn": [
        "3a7381cf-5c70-49e8-85af-b58a005d3e66"
      ]
    },
    {
      "ref": "a5faf6b4-e734-4ba0-bba5-012263eace8d",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "dbc0325d-f8f2-4e2e-b164-3f3a3da4093a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b",
      "dependsOn": [
        "cd33f1b8-cff7-4a72-87aa-c8193e3d6d2b"
      ]
    },
    {
      "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93",
      "dependsOn": [
        "fa776110-86a0-41cb-9da6-79ddcd4661d9"
      ]
    },
    {
      "ref": "50f42a59-59a3-4532-91a5-f0e2bd4057e9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7",
      "dependsOn": [
        "f54ecaea-1561-40ed-8ad3-0ffff912e610"
      ]
    },
    {
      "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5",
      "dependsOn": [
        "fb27982e-e7b5-4acd-92b9-c67aa05b9a1d"
      ]
    },
    {
      "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca",
      "dependsOn": [
        "2cc9da07-5da6-4937-8774-c7fcad593e41"
      ]
    },
    {
      "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f",
      "dependsOn": [
        "e86f5e3a-26f8-4277-ac9c-857a2c89e4b3"
      ]
    },
    {
      "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e",
      "dependsOn": [
        "c7ea3f93-cd03-4f24-a6c0-837ba793379c"
      ]
    },
    {
      "ref": "40855a63-7302-4a22-ae16-6ea08c5cb38b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "73d9c2f6-f6a8-4d5d-b742-51fe62761b54",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "f28c062e-5123-4412-a4d2-d68466eacdee",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7",
      "dependsOn": [
        "a59d7d9d-2e57-485a-9097-a027af094ca7"
      ]
    },
    {
      "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89",
      "dependsOn": [
        "b61ea630-2cb9-4e75-9079-5540b21cbcec"
      ]
    },
    {
      "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098",
      "dependsOn": [
        "d8ece867-c61d-49dc-a5ab-83d017a25723"
      ]
    },
    {
      "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5",
      "dependsOn": [
        "23b11a4a-83fb-4626-bd70-ace652ab1552"
      ]
    },
    {
      "ref": "11b8c085-6b73-4753-8ac9-c74dadaa3bf9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "21bc2dca-9760-4754-82be-066b219e8fba",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "8bcc3bc4-05d3-43d2-a960-e9b88a2158f8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9b56b40b-f121-47fe-a43e-424285473e21",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "055c16be-5531-4353-ae5f-f775a604a2ac",
      "dependsOn": [
        "f98c2866-01cc-4c24-aa8a-41506ecb6be1"
      ]
    },
    {
      "ref": "121975b4-797c-4344-9a7f-1d363a2f2308",
      "dependsOn": [
        "478ffebf-6d20-43d4-b3d3-661c2bb58f15"
      ]
    },
    {
      "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66",
      "dependsOn": [
        "d161a0f2-ed56-447c-b0bf-eddc03e14188"
      ]
    },
    {
      "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f",
      "dependsOn": [
        "463b1c39-129f-42d1-9943-4e4c987747ee"
      ]
    },
    {
      "ref": "8b705ae5-a34b-471c-945f-f271ea68e517",
      "dependsOn": [
        "4f3138df-c8d8-4b26-9059-b63443ecc625"
      ]
    },
    {
      "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa",
      "dependsOn": [
        "6bd7b7d9-8de5-44da-ad58-36269d924e63"
      ]
    },
    {
      "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c",
      "dependsOn": [
        "48c53c22-606f-4edf-a723-d3a2c609f9a1"
      ]
    },
    {
      "ref": "5f919e69-4ceb-4a5c-b958-2ea26db58c86",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "ed269807-ec7b-4648-a1f8-9a8d8c2582fd",
      "dependsOn": [
        "1c7a2c6e-67f6-4f95-af75-7021340e04b6",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e",
      "dependsOn": [
        "5332b8aa-d033-40da-90ae-be6cb47e1310"
      ]
    },
    {
      "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db",
      "dependsOn": [
        "53ee835d-80a0-4af7-98ce-6497c9f597bd"
      ]
    },
    {
      "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385",
      "dependsOn": [
        "5a335cd7-5076-4175-8a19-9e146dc553ad"
      ]
    },
    {
      "ref": "1678ff77-c12a-43c9-a4e9-d6a0ea274ee0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3c7fbd8b-2ccf-49d1-80da-495164b9e28a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "08636125-47dd-48db-8dae-a1129f5c9016",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4eddb031-308d-40f7-b374-d821b9c28425",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe",
      "dependsOn": [
        "45061d71-fc41-40f2-9422-a60714a8b362"
      ]
    },
    {
      "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce",
      "dependsOn": [
        "b90568c3-3919-4283-8943-0ea133c8d556"
      ]
    },
    {
      "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa",
      "dependsOn": [
        "a4b4ba59-3f9a-4d2e-98e2-27ada2938188"
      ]
    },
    {
      "ref": "d84f327c-73f6-4790-a579-20b1e631e99c",
      "dependsOn": [
        "af5d0e4a-0172-447d-8367-f6c30367c21e"
      ]
    },
    {
      "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558",
      "dependsOn": [
        "3f71e96e-4f91-4492-86f0-c017db9a37de"
      ]
    },
    {
      "ref": "347d0bf9-1df2-48d1-9107-fa5670313175",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "25744fde-a647-435e-aa20-6a2f8baa8dd9",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2d7e0be1-e6a3-44c6-91c6-d164ef4d2361",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "2201e099-7447-4c74-801c-5d86b30c07a6",
      "dependsOn": [
        "5f87b46d-a3d4-4776-ad66-97bf586573f0"
      ]
    },
    {
      "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8",
      "dependsOn": [
        "bb5b3db4-9950-4f3b-b1e7-a604be82cb17"
      ]
    },
    {
      "ref": "3ba022dd-3e45-4df4-a3a8-a8e69ea32934",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5381a14f-f782-49a4-9c2b-f49ca15f6612",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5f84ff25-4fd6-4589-bf82-a4c6f22f3a28",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "649b45ad-b849-4d7e-ab45-979c16f2df76",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "71f05dcc-70f5-483d-a365-2c3524780ada",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d790579c-8036-41c8-99f7-8ee78ea5a1c3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a",
      "dependsOn": [
        "76712cee-33d3-49ee-bb8e-f7f1842b201f"
      ]
    },
    {
      "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9",
      "dependsOn": [
        "dea0a772-58b2-4b57-9a08-20e87bccd935"
      ]
    },
    {
      "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358",
      "dependsOn": [
        "b56c2f7d-e505-436b-8bbd-1e606925877f"
      ]
    },
    {
      "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5",
      "dependsOn": [
        "3ba69ae4-bd52-436d-85af-e36f212a79e3"
      ]
    },
    {
      "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3",
      "dependsOn": [
        "b7584104-40f2-4856-b5fc-d0151dd06075"
      ]
    },
    {
      "ref": "e0e06851-781f-4998-a975-813b6287c485",
      "dependsOn": [
        "e95c096d-ad82-47ca-927d-0b4b953408e7"
      ]
    },
    {
      "ref": "25f956f5-15ac-4ed4-bc6a-5ad1388c0c4e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "6aa38a78-ffb3-40bc-9c5f-18df3382d502",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1",
      "dependsOn": [
        "588a4d08-507a-444d-b5a3-514ad1b34d7e",
        "1933f416-ea35-434b-9a7c-7c7bee784868",
        "30c77dc3-b1bf-4715-be84-25bdfcf2487f",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "01b59f23-de1e-44d2-bb72-a01336f0c7ff",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5b5d391d-4e5e-45d9-8fa0-b9b5a2ac8f4f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "766157f8-66ca-41b6-bef7-662eb8273033",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7e3f09c1-0f76-40ba-9593-3d95965c3678",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d0be729d-07a3-40ba-a9bd-e4cb7ec428ab",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "38e4cda0-a94a-48e6-8e7f-d8a0cd9c34fa",
      "dependsOn": [
        "06145865-2540-4779-bcd1-15f200005bda"
      ]
    },
    {
      "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0",
      "dependsOn": [
        "08168e0e-93ad-4d2b-8074-719583a49cdf"
      ]
    },
    {
      "ref": "6c1cc9cb-78b6-4261-83cd-5f737674580b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581",
      "dependsOn": [
        "38ef042e-d7eb-4c99-a18a-8b1e00ca18f7"
      ]
    },
    {
      "ref": "47467983-a44a-4b1a-8956-19051a996111",
      "dependsOn": [
        "d5fa4712-44b0-4d24-8a73-576cb1b74ba7"
      ]
    },
    {
      "ref": "9911d254-fc7d-402e-a525-52503f750d32",
      "dependsOn": [
        "e93a6319-71f5-4052-a73e-cd9426396033"
      ]
    },
    {
      "ref": "210d7542-9c26-4c1f-afd0-f71b2a8ec3f4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "24ed1f77-0688-4d28-81fb-75339f77bc8c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "574a6230-d6e6-4674-84c5-7e532a0ec44b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "83947ba5-9878-4f54-9941-1279aa91f062",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "92c95cd8-ce64-441e-a31a-b47a3e14f821",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c",
      "dependsOn": [
        "0a92b2c5-7e9d-422f-9f42-19b397c1adff"
      ]
    },
    {
      "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3",
      "dependsOn": [
        "157093f7-f09b-4dcd-bf1c-69721402a50a"
      ]
    },
    {
      "ref": "42f37526-a806-4105-be92-ea6d72cd0af2",
      "dependsOn": [
        "7a41d766-1d9b-4a00-a3ba-72fca530c8a4"
      ]
    },
    {
      "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9",
      "dependsOn": [
        "0a2dd9fd-5f2e-4cbf-8882-767ecfee5379"
      ]
    },
    {
      "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7",
      "dependsOn": [
        "3cd87c2c-ba87-4091-81b9-b63f8ab791cc"
      ]
    },
    {
      "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b",
      "dependsOn": [
        "2aaae198-cd7b-4404-8172-8c07a188f907"
      ]
    },
    {
      "ref": "e424d27b-3524-4f98-9b24-108de83564ba",
      "dependsOn": [
        "f676e07d-ed0d-4aad-bb23-e21c801f2fbb"
      ]
    },
    {
      "ref": "0f624251-14df-45c1-afae-ab1ded7fecb1",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb",
      "dependsOn": [
        "f162bd1f-767e-4cb0-a3c4-355ac28e9008"
      ]
    },
    {
      "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56",
      "dependsOn": [
        "794ac274-3e3f-48d6-8b2a-aa6fc332e479"
      ]
    },
    {
      "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1",
      "dependsOn": [
        "14a6096c-f5f4-417b-bde1-61097bc1c230"
      ]
    },
    {
      "ref": "75e5f093-c8a4-4766-b57d-31428c6ed7a7",
      "dependsOn": [
        "c797382a-f009-4d01-8d92-a399929e9b5d",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "339b58f0-37e2-4844-96a4-6327616759d7",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "392814e2-ab6b-422c-8458-9808c4a23524",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9c4070df-5538-4531-9535-3a3f18fdacb8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778",
      "dependsOn": [
        "5b5e6b7c-3722-4389-abe9-1dc02e08a5b9"
      ]
    },
    {
      "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5",
      "dependsOn": [
        "700f4858-542b-4b91-b0b5-48c55c017dd7"
      ]
    },
    {
      "ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e",
      "dependsOn": [
        "cbd5c2ea-af30-43c8-88d8-b80edf68c558"
      ]
    },
    {
      "ref": "4eca0355-2c07-4674-aa93-4c683bc56192",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4ee1c5ee-20e0-4611-bfed-a9bbf84f10ef",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "54e1ed44-7ecd-4086-8d72-bc24ae6932cc",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b98b77e3-691d-4a22-8ce3-505d63cf0e27",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "edb607c3-12e1-4a91-83f8-f92ef0423039",
      "dependsOn": [
        "1d581af4-6bc4-40e4-bc67-5662c4c01a1c"
      ]
    },
    {
      "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c",
      "dependsOn": [
        "0d20d755-d0ed-4b34-b93b-16ae2ccd990d"
      ]
    },
    {
      "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8",
      "dependsOn": [
        "c57fd219-0f37-40f2-96dd-c59df870290e"
      ]
    },
    {
      "ref": "90a7e7d0-5d4f-4aaf-b4b0-aa69a86d8131",
      "dependsOn": [
        "5e730a23-e92d-423e-a8a9-88f8b7735cb3",
        "eeca640e-b720-48b8-bf85-29786bcbd6a4",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "dcedf751-77ec-480f-8473-8b8b4bebdb9c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b7cf3ed0-e692-429b-9995-0233a74c2740",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c3c5598c-95cb-47a6-90d1-179458208eca",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "e4fbfb3d-c934-4971-9fae-f89b6c9d73b4",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "def6f02b-77c3-408f-a6ad-20fa9a6932f4",
      "dependsOn": [
        "09713aec-edd9-4f69-a0f5-ad8e9561e9a5"
      ]
    },
    {
      "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9",
      "dependsOn": [
        "0d578627-e02f-4e44-a847-da0418ebb473"
      ]
    },
    {
      "ref": "bbe1535e-72b7-4fce-b309-88c2a11a384f",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b",
      "dependsOn": [
        "ffa71a88-a975-4a92-8a24-3b875816d4d1"
      ]
    },
    {
      "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b",
      "dependsOn": [
        "c7f561a3-3faf-4a66-997a-f2ad701e26cf"
      ]
    },
    {
      "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da",
      "dependsOn": [
        "1bb30056-4f21-4739-8ed9-122cc13fe81e"
      ]
    },
    {
      "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b",
      "dependsOn": [
        "a21eb115-ef67-48d9-bcad-7515889d7222"
      ]
    },
    {
      "ref": "19999c9d-4ad4-4c7b-9278-5d9ba533e1ce",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3fff1413-d994-4755-ac94-5fd10b5742ff",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "434e7e2f-1882-4871-bb3e-467461bd16f3",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4685d60b-de6a-44f1-b43d-073d5276e20b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837",
      "dependsOn": [
        "a8942adb-927f-4a97-b17f-2078dae5591b"
      ]
    },
    {
      "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a",
      "dependsOn": [
        "bd960ca9-6355-490f-a347-8a1fd64bba10"
      ]
    },
    {
      "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290",
      "dependsOn": [
        "ba0e9294-ca03-4fa6-8f03-861cf2c2facd"
      ]
    },
    {
      "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa",
      "dependsOn": [
        "0e7718e5-c512-4a67-8713-0c572930ab99"
      ]
    },
    {
      "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37",
      "dependsOn": [
        "a0ccbb30-9b45-4168-afff-ed61380f5ddc"
      ]
    },
    {
      "ref": "27b8dc41-090c-4541-8ca0-501c1e913963",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3a4b50ef-ee7e-400e-ba26-5468d633c1d2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "53010d9c-75c4-424b-8638-69869fad53f0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc",
      "dependsOn": [
        "89105a15-58b9-4846-ab83-0b74d5236226"
      ]
    },
    {
      "ref": "6ff68af7-b295-48db-a1d9-badfb50e0827",
      "dependsOn": [
        "7ca99322-de75-4f85-a78b-9f1a1961a6a1",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "0193309c-5d04-4bfa-98b2-d6060d13c284",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "36ecce89-1d99-4293-acdc-afc4b16c1f74",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d",
      "dependsOn": [
        "ab16b956-4a90-42d8-b077-5028e62666ce",
        "cd54e6d0-f208-46be-9c26-6fcdef278a84",
        "5ea1275a-a65b-4f52-8456-f64df4fe2709",
        "2f808b83-528d-48d2-bc09-2d00f9e76a78",
        "70f60432-3378-4c4d-9b54-fea176f70509"
      ]
    },
    {
      "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c",
      "dependsOn": [
        "4c654829-1f08-4fbb-950f-9c7545741387",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "56527af8-fa31-4bd8-b0d4-876c26f80f0b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "5d7d0fd8-a652-4080-b59d-632416eff550",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9f766e0e-f7fc-41d8-bd8b-e42fd558cb51",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a0ffaa0f-81ac-4d2e-84f1-3582743c76f2",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "b20ebf5b-7a83-4111-b676-6abc3ecc542a",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f",
      "dependsOn": [
        "06fa955c-7300-4e1b-a668-7dd1e72bce88"
      ]
    },
    {
      "ref": "3692ed62-82cb-42b5-8620-7975d1e50dff",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4d2a5794-afcd-4a82-b379-3729e7cecc4c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e",
      "dependsOn": [
        "a8dfb3e1-8aea-438a-ad15-b143ecb2a4ed",
        "06fb79f0-8929-4a40-ad27-0b63d1a1cd28",
        "5133a880-6d7a-4665-a575-0503ccea64c2",
        "e190916e-d98c-4c9a-a944-b0ab8fa780c2",
        "bf8283f2-bc46-4b2e-ac90-fbff74133508"
      ]
    },
    {
      "ref": "0a162311-dc40-4252-ae96-6edcf7911528",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1",
      "dependsOn": [
        "688ccafe-848f-4348-b4e0-75193a9d833a"
      ]
    },
    {
      "ref": "47576937-4e6c-473e-96b5-61b96494dacb",
      "dependsOn": [
        "ec101214-c46f-417a-8cdf-142a88395b06"
      ]
    },
    {
      "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e",
      "dependsOn": [
        "e236a483-877b-4a35-a3a5-fe9da6df979a",
        "8915d1d8-0773-4f81-af37-29b5c7d2690a",
        "7aa10eb4-a6fe-4f0a-ae3b-cef07338ca26",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c",
      "dependsOn": [
        "cdef7a1b-ece2-47a6-913b-937af22edb61"
      ]
    },
    {
      "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36",
      "dependsOn": [
        "9f03e280-52d4-4bd8-ad4d-34b520d9aa88"
      ]
    },
    {
      "ref": "fe68439f-7461-455d-9231-2d080f834b36",
      "dependsOn": [
        "a54306cd-2b79-4946-b771-318ee77aed5c"
      ]
    },
    {
      "ref": "860d14d1-9b1b-4d57-b30e-07c528229729",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "95693891-4051-4458-bb79-f2c042c960ee",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "42495f05-f540-441e-ac6c-43fd89748be1",
      "dependsOn": [
        "c1025292-66cc-4a2e-8fab-1fe9c0a426f4"
      ]
    },
    {
      "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3",
      "dependsOn": [
        "4e7364d9-3b60-40e8-91bb-41b047f7b671"
      ]
    },
    {
      "ref": "95d64b4b-8644-46ae-b068-3c862691529b",
      "dependsOn": [
        "57808831-6add-427f-8194-9a177c6718f6"
      ]
    },
    {
      "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576",
      "dependsOn": [
        "36aa2791-00d3-4dbb-b657-e75816e2618a"
      ]
    },
    {
      "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9",
      "dependsOn": [
        "a5f0062d-6bf0-4e3c-937e-72bdbee42289"
      ]
    },
    {
      "ref": "3aa752bf-b130-4409-bbe2-4671835d48bf",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d23fd5e3-aa8a-4aea-9b15-6aaa0d0255ee",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d77df6f8-8d35-43cf-bf10-5f939496caac",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "706d8743-143b-479b-9f9a-82deb5653ca3",
      "dependsOn": [
        "87c90878-5693-4a26-8b59-de1c104069a2"
      ]
    },
    {
      "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b",
      "dependsOn": [
        "93868e97-b5d0-47f1-9df3-ebdee1a7db5d"
      ]
    },
    {
      "ref": "26c0abd3-ea38-48bf-81a4-ab0b5c22acd0",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7c757f99-962b-4e82-8df3-26dc54e5c022",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "78857cd1-42e5-4737-8ee8-e4c4f3ff72c2",
      "dependsOn": [
        "1d581af4-6bc4-40e4-bc67-5662c4c01a1c"
      ]
    },
    {
      "ref": "4b51c6a6-330d-484b-80fb-457239059428",
      "dependsOn": [
        "811e0579-5938-428c-9b1e-0528e46caf85"
      ]
    },
    {
      "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e",
      "dependsOn": [
        "4f8826c8-5085-444c-bf7d-0746baee6429"
      ]
    },
    {
      "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88",
      "dependsOn": [
        "5b148268-fd6a-49b4-910a-730f33b60f47"
      ]
    },
    {
      "ref": "26f3286c-fbb6-4c4a-95cf-de6099be8582",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7c0fca56-56fd-42b2-8e2c-85a4bfd3e81e",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "a29d3707-fec6-458a-bf65-82a592aec319",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "fca4b817-6287-414e-aad6-686dd471efb5",
      "dependsOn": [
        "0213cf86-d802-4d18-a4e4-ffb66bae7281"
      ]
    },
    {
      "ref": "89bcbc9a-1471-4d09-99e9-180251156b36",
      "dependsOn": [
        "8e42bf39-d7b8-4646-be55-91a3abf99843",
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "1f644a0b-6ede-45d1-848c-270c79432824",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d2cfb273-326b-48af-8434-c4dc79659376",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a",
      "dependsOn": [
        "f80c5357-0ced-4eb5-93d1-876d499b8876"
      ]
    },
    {
      "ref": "233ef88e-4c48-442a-8dab-77003dfeae76",
      "dependsOn": [
        "beeb2052-5cc9-467c-adb7-dfc478072431"
      ]
    },
    {
      "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa",
      "dependsOn": [
        "b56e3148-331c-49ea-b3b0-265bd1e3f148"
      ]
    },
    {
      "ref": "adcd53b3-7ddc-4e20-b16a-62314c5f48ff",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8",
      "dependsOn": [
        "cbe42680-3fc1-4b22-9f82-205dc65a6df6"
      ]
    },
    {
      "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6",
      "dependsOn": [
        "e30162b2-fc94-4cad-9446-d38657267c0c"
      ]
    },
    {
      "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d",
      "dependsOn": [
        "79abca91-1839-4e53-bfe3-f806ae5d4c97"
      ]
    },
    {
      "ref": "30d9e97b-9e0f-44b8-83d0-86c0738030db",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "8f85807a-1c53-4468-ad63-624afba43424",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "9ecf6f64-41aa-47b6-a1ee-a582fc511f0c",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "d64d9791-0ab7-40cc-bf03-40e5d7f456d8",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb",
      "dependsOn": [
        "47c48075-5e85-41b8-bbfe-27d6ac422cd6"
      ]
    },
    {
      "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71",
      "dependsOn": [
        "80708387-f74c-4562-9770-50f4ebe32842"
      ]
    },
    {
      "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8",
      "dependsOn": [
        "ab455cd2-b625-4e8a-9947-c3571939d105"
      ]
    },
    {
      "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25",
      "dependsOn": [
        "ff51973a-17bc-439f-a532-b63ec4860e27"
      ]
    },
    {
      "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca",
      "dependsOn": [
        "28cd39ad-08ac-41ea-842d-62edaa1db2b6"
      ]
    },
    {
      "ref": "14b209fc-ad3c-47be-b0e3-a6afd280f096",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "38065d2b-00ef-4414-863c-d02ec5a0f5bb",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "922e894f-dd77-40b2-8eec-0a9099288c7b",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23",
      "dependsOn": [
        "b6634ac8-7da1-4a1f-b001-5a85dff2e0dc"
      ]
    },
    {
      "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de",
      "dependsOn": [
        "06837841-9214-4449-a4d3-e2fc59aface1"
      ]
    },
    {
      "ref": "73240837-973b-45f2-a839-707503c95693",
      "dependsOn": [
        "43b88476-290f-4f4d-8125-a8ca61184517"
      ]
    },
    {
      "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64",
      "dependsOn": [
        "d5d489d0-c32a-4d7f-875b-eaa57f26e134"
      ]
    },
    {
      "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd",
      "dependsOn": [
        "d1e3c823-38c8-4092-ad06-5ab43cda47e0"
      ]
    },
    {
      "ref": "c088bed4-44e7-4132-9248-d5764ca1787e",
      "dependsOn": [
        "f961ad1e-0783-42bc-92a9-ee7e2a5bfff7"
      ]
    },
    {
      "ref": "f19db424-574e-4e8b-8cce-a752bd13c089",
      "dependsOn": [
        "cc8fa288-3084-493d-9fe8-e89d22cf4b31"
      ]
    },
    {
      "ref": "27ef2646-9ca0-4a01-8850-86fcb6c67007",
      "dependsOn": [
        "8b26a210-5815-4915-85df-e9de790e9c55"
      ]
    },
    {
      "ref": "47d093b0-b683-4075-860b-4e9a4401baed",
      "dependsOn": [
        "2d577fdf-4af3-4699-b29f-afc9b1d60a33"
      ]
    },
    {
      "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c",
      "dependsOn": [
        "29bcc62b-11ac-4b19-9b0a-3c7d7d5fa445"
      ]
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "05185884-be2a-477b-a9e1-d4ce75dedb34",
      "id": "CVE-2023-53331",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: Check start of empty przs during init\n\nAfter commit 30696378f68a (\"pstore/ram: Do not treat empty buffers as\nvalid\"), initialization would assume a prz was valid after seeing that\nthe buffer_size is zero (regardless of the buffer start position). This\nunchecked start value means it could be outside the bounds of the buffer,\nleading to future access panics when written to:\n\n sysdump_panic_event+0x3b4/0x5b8\n atomic_notifier_call_chain+0x54/0x90\n panic+0x1c8/0x42c\n die+0x29c/0x2a8\n die_kernel_fault+0x68/0x78\n __do_kernel_fault+0x1c4/0x1e0\n do_bad_area+0x40/0x100\n do_translation_fault+0x68/0x80\n do_mem_abort+0x68/0xf8\n el1_da+0x1c/0xc0\n __raw_writeb+0x38/0x174\n __memcpy_toio+0x40/0xac\n persistent_ram_update+0x44/0x12c\n persistent_ram_write+0x1a8/0x1b8\n ramoops_pstore_write+0x198/0x1e8\n pstore_console_write+0x94/0xe0\n ...\n\nTo avoid this, also check if the prz start is 0 during the initialization\nphase. If not, the next prz sanity check case will discover it (start \u003e\nsize) and zap the buffer back to a sane state.\n\n[kees: update commit log with backtrace and clarifications]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c877d6df-fe48-46f8-acda-8c12f109a8ae",
      "id": "CVE-2025-21702",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npfifo_tail_enqueue: Drop new packet when sch-\u003elimit == 0\n\nExpected behaviour:\nIn case we reach scheduler's limit, pfifo_tail_enqueue() will drop a\npacket in scheduler's queue and decrease scheduler's qlen by one.\nThen, pfifo_tail_enqueue() enqueue new packet and increase\nscheduler's qlen by one. Finally, pfifo_tail_enqueue() return\n`NET_XMIT_CN` status code.\n\nWeird behaviour:\nIn case we set `sch-\u003elimit == 0` and trigger pfifo_tail_enqueue() on a\nscheduler that has no packet, the 'drop a packet' step will do nothing.\nThis means the scheduler's qlen still has value equal 0.\nThen, we continue to enqueue new packet and increase scheduler's qlen by\none. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by\none and return `NET_XMIT_CN` status code.\n\nThe problem is:\nLet's say we have two qdiscs: Qdisc_A and Qdisc_B.\n - Qdisc_A's type must have '-\u003egraft()' function to create parent/child relationship.\n   Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.\n - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.\n - Qdisc_B is configured to have `sch-\u003elimit == 0`.\n - Qdisc_A is configured to route the enqueued's packet to Qdisc_B.\n\nEnqueue packet through Qdisc_A will lead to:\n - hfsc_enqueue(Qdisc_A) -\u003e pfifo_tail_enqueue(Qdisc_B)\n - Qdisc_B-\u003eq.qlen += 1\n - pfifo_tail_enqueue() return `NET_XMIT_CN`\n - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` =\u003e hfsc_enqueue() don't increase qlen of Qdisc_A.\n\nThe whole process lead to a situation where Qdisc_A-\u003eq.qlen == 0 and Qdisc_B-\u003eq.qlen == 1.\nReplace 'hfsc' with other type (for example: 'drr') still lead to the same problem.\nThis violate the design where parent's qlen should equal to the sum of its childrens'qlen.\n\nBug impact: This issue can be used for user-\u003ekernel privilege escalation when it is reachable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a800cab-f28a-4fe0-814b-25a7b1086aa9",
      "id": "CVE-2025-21996",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()\n\nOn the off chance that command stream passed from userspace via\nioctl() call to radeon_vce_cs_parse() is weirdly crafted and\nfirst command to execute is to encode (case 0x03000001), the function\nin question will attempt to call radeon_vce_cs_reloc() with size\nargument that has not been properly initialized. Specifically, 'size'\nwill point to 'tmp' variable before the latter had a chance to be\nassigned any value.\n\nPlay it safe and init 'tmp' with 0, thus ensuring that\nradeon_vce_cs_reloc() will catch an early error in cases like these.\n\nFound by Linux Verification Center (linuxtesting.org) with static\nanalysis tool SVACE.\n\n(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5967f08c-18e3-4d87-8908-6b0b39bc4a65",
      "id": "CVE-2025-22025",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: put dl_stid if fail to queue dl_recall\n\nBefore calling nfsd4_run_cb to queue dl_recall to the callback_wq, we\nincrement the reference count of dl_stid.\nWe expect that after the corresponding work_struct is processed, the\nreference count of dl_stid will be decremented through the callback\nfunction nfsd4_cb_recall_release.\nHowever, if the call to nfsd4_run_cb fails, the incremented reference\ncount of dl_stid will not be decremented correspondingly, leading to the\nfollowing nfs4_stid leak:\nunreferenced object 0xffff88812067b578 (size 344):\n  comm \"nfsd\", pid 2761, jiffies 4295044002 (age 5541.241s)\n  hex dump (first 32 bytes):\n    01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff ff  ....kkkk........\n    00 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 ad 4e ad de  .kkkkkkk.....N..\n  backtrace:\n    kmem_cache_alloc+0x4b9/0x700\n    nfsd4_process_open1+0x34/0x300\n    nfsd4_open+0x2d1/0x9d0\n    nfsd4_proc_compound+0x7a2/0xe30\n    nfsd_dispatch+0x241/0x3e0\n    svc_process_common+0x5d3/0xcc0\n    svc_process+0x2a3/0x320\n    nfsd+0x180/0x2e0\n    kthread+0x199/0x1d0\n    ret_from_fork+0x30/0x50\n    ret_from_fork_asm+0x1b/0x30\nunreferenced object 0xffff8881499f4d28 (size 368):\n  comm \"nfsd\", pid 2761, jiffies 4295044005 (age 5541.239s)\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 30 4d 9f 49 81 88 ff ff  ........0M.I....\n    30 4d 9f 49 81 88 ff ff 20 00 00 00 01 00 00 00  0M.I.... .......\n  backtrace:\n    kmem_cache_alloc+0x4b9/0x700\n    nfs4_alloc_stid+0x29/0x210\n    alloc_init_deleg+0x92/0x2e0\n    nfs4_set_delegation+0x284/0xc00\n    nfs4_open_delegation+0x216/0x3f0\n    nfsd4_process_open2+0x2b3/0xee0\n    nfsd4_open+0x770/0x9d0\n    nfsd4_proc_compound+0x7a2/0xe30\n    nfsd_dispatch+0x241/0x3e0\n    svc_process_common+0x5d3/0xcc0\n    svc_process+0x2a3/0x320\n    nfsd+0x180/0x2e0\n    kthread+0x199/0x1d0\n    ret_from_fork+0x30/0x50\n    ret_from_fork_asm+0x1b/0x30\nFix it by checking the result of nfsd4_run_cb and call nfs4_put_stid if\nfail to queue dl_recall.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d292bea-cd25-444d-98dd-c8a001e52beb",
      "id": "CVE-2025-7937",
      "description": "Vulnerability in the Supermicro BMC IPMI firmware image authentication design",
      "affects": [
        {
          "ref": "665b0e52-b264-4ffb-8636-03dd05c89217"
        }
      ]
    },
    {
      "bom-ref": "e8d1b83d-dd4b-42b7-bd0f-f4f83713a054",
      "id": "BRLY-2025-023",
      "description": "Vulnerability in the Supermicro BMC IPMI firmware image authentication design",
      "affects": [
        {
          "ref": "665b0e52-b264-4ffb-8636-03dd05c89217"
        }
      ]
    },
    {
      "bom-ref": "5550fde6-1a4a-41fb-ab60-e2e34da97a3e",
      "id": "CVE-2023-52425",
      "description": "Denial of Service vulnerability in libexpat when parsing large tokens",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "0d869d8f-6014-46a6-8340-603064105faa",
      "id": "CVE-2024-5535",
      "description": "Buffer over-read in the `SSL_select_next_proto` function of OpenSSL",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "4744a11b-9831-4794-a968-eac2f7262708",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "045af516-5f24-4f5f-a101-235011fd3ae4"
        }
      ]
    },
    {
      "bom-ref": "c50d619e-a9bc-467c-ae94-b2c16d1e2478",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "01b59f23-de1e-44d2-bb72-a01336f0c7ff"
        }
      ]
    },
    {
      "bom-ref": "cf78c368-af6d-4950-91c3-c36a1929fb45",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "000002b5-7ea4-49d0-b371-adcef5f96c3d"
        }
      ]
    },
    {
      "bom-ref": "bd7812a1-e2e1-4d6e-bcd7-9147a65e1899",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0388c3cc-d1cf-4192-8e23-9ecde9786b42"
        }
      ]
    },
    {
      "bom-ref": "d110841f-abb4-4a88-9f33-871dbb23f342",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0156d3c5-ffcd-40e8-a171-b9225f9c09c6"
        }
      ]
    },
    {
      "bom-ref": "ce79185b-7688-4a7f-af18-c7325434bffb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "03a89f83-eb80-4755-860a-4d46c2378739"
        }
      ]
    },
    {
      "bom-ref": "865aeca1-2819-4985-b8ce-fd2600fd6286",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "017cea36-1184-48f2-a565-c4ef2f03a2ef"
        }
      ]
    },
    {
      "bom-ref": "f42149eb-5a3b-4589-af0a-8f2ad3066a2e",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "01ed9869-2fc6-4356-ba53-c90edb727fa7"
        }
      ]
    },
    {
      "bom-ref": "d885b35b-a54b-47bc-a4ec-5ebf08dc98c1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0013d7d5-27bc-421f-8a03-1cbdfbc2b374"
        }
      ]
    },
    {
      "bom-ref": "5c507035-3a51-40f6-b0ac-2e4ae8c02c5d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "014cdc4b-1031-4519-8fc6-da8b173c2149"
        }
      ]
    },
    {
      "bom-ref": "06f0828f-5e82-49eb-9262-490a5effa705",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "0013d7d5-27bc-421f-8a03-1cbdfbc2b374"
        }
      ]
    },
    {
      "bom-ref": "c6e9b644-489a-45c8-8fd5-2cf6e539e65c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0193309c-5d04-4bfa-98b2-d6060d13c284"
        }
      ]
    },
    {
      "bom-ref": "c01082e9-c94c-41bc-bcbd-d162c4634c7e",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "051974f1-fec9-47bb-bf52-04e55f301039"
        }
      ]
    },
    {
      "bom-ref": "d45fdeb9-36ee-4a64-ace0-dc638f7a70d7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "041782fd-db5b-4f84-88dc-4bc601b5270a"
        }
      ]
    },
    {
      "bom-ref": "5b601010-0812-433c-91de-f1ede55dbd7a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "94e531a5-3c8a-44be-b9eb-1de17c7fa8d5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "00209d57-f76f-4a38-9ba0-130e69390d92"
        }
      ]
    },
    {
      "bom-ref": "447ff72d-3770-478c-8360-7a97b1be0831",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "058aac02-1961-445c-ab39-5588a73f0bf5"
        }
      ]
    },
    {
      "bom-ref": "d0ac1885-dad9-4b79-838b-149a3d8b0c80",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "079358b7-675d-437e-ade2-375cda0e52f1"
        }
      ]
    },
    {
      "bom-ref": "6b9dd53d-3453-4d7c-8d6e-b22f787acf6a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "081b62e4-7f89-4050-adc7-ac68efa02920"
        }
      ]
    },
    {
      "bom-ref": "3c92bb61-598f-40e8-90ec-0d89e9fb959f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "07ee7806-7897-4489-94a8-46b69e4d9ebd"
        }
      ]
    },
    {
      "bom-ref": "2d0a1cac-a6cf-44bb-a4f8-4bc25bb0d278",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0710a46c-f332-4ce1-a71b-2d4a7d15ba93"
        }
      ]
    },
    {
      "bom-ref": "9e73d60c-58db-469e-be2f-c4003d7b3b6a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "08bb6fac-2d13-49ac-9b99-17e03fc0ab74"
        }
      ]
    },
    {
      "bom-ref": "d4ab03fb-ab1a-434e-a301-0f2f7e37ae60",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "08636125-47dd-48db-8dae-a1129f5c9016"
        }
      ]
    },
    {
      "bom-ref": "6b8cbc8a-c55c-4415-9b43-8a528566cf9c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0607c597-04a2-4afa-918f-7c7683a346dc"
        }
      ]
    },
    {
      "bom-ref": "a9b3a5be-b530-4161-beb5-dc6c325f18e9",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "08bc03a9-e542-47b3-916e-80900990a0f8"
        }
      ]
    },
    {
      "bom-ref": "7dc8ccde-81a3-4655-a14a-55874cf2017b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a"
        }
      ]
    },
    {
      "bom-ref": "5cf2beb4-3b42-4fb4-9db0-0e9c3c582ac5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a"
        }
      ]
    },
    {
      "bom-ref": "c6ccb81e-8e8e-44bc-bc08-b94df23b622d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a"
        }
      ]
    },
    {
      "bom-ref": "b974f9ca-8b03-475e-aeed-36fd80dca506",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a"
        }
      ]
    },
    {
      "bom-ref": "ce64188f-244c-4824-aaee-ea5d46da6b2b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e"
        }
      ]
    },
    {
      "bom-ref": "41e4987d-ab01-4ca9-992e-963f194fd091",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a"
        }
      ]
    },
    {
      "bom-ref": "dbdc7864-7dfe-4943-bb3c-71f59928c89b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0270bf04-1e6d-4d2d-9141-c3ac70a39c4a"
        }
      ]
    },
    {
      "bom-ref": "da90556f-5a9b-4366-a7aa-11bc7752d073",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc"
        }
      ]
    },
    {
      "bom-ref": "94b94feb-cceb-4f2a-80b8-a5276e1f3840",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc"
        }
      ]
    },
    {
      "bom-ref": "43ab38f6-a718-4f76-a6a6-beed35444ba8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc"
        }
      ]
    },
    {
      "bom-ref": "4f04e020-3686-47eb-97dc-63cc09970a27",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc"
        }
      ]
    },
    {
      "bom-ref": "9cc931cc-4bb8-4a37-a31d-d8179d57b45c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc"
        }
      ]
    },
    {
      "bom-ref": "4b912828-f16b-421b-a3e6-544b8cfb402b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "00b6402d-a807-4685-a61f-aa18aed70fdc"
        }
      ]
    },
    {
      "bom-ref": "51c803a5-73c2-4995-8b32-bb5e19cbeaab",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "013b6ff0-a611-435b-9dac-d61573401939"
        }
      ]
    },
    {
      "bom-ref": "03383e43-a324-47e5-8a0f-ee4426887b4a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "013b6ff0-a611-435b-9dac-d61573401939"
        }
      ]
    },
    {
      "bom-ref": "6a9324d6-675e-4192-bbfa-8b20142251eb",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "013b6ff0-a611-435b-9dac-d61573401939"
        }
      ]
    },
    {
      "bom-ref": "29370205-f2e4-4c02-aa7f-22bb704ade62",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "013b6ff0-a611-435b-9dac-d61573401939"
        }
      ]
    },
    {
      "bom-ref": "4cd3c36c-587c-42c2-a96b-42e6da531e98",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "013b6ff0-a611-435b-9dac-d61573401939"
        }
      ]
    },
    {
      "bom-ref": "1a79d1d1-9c04-4a68-853e-64b0cce1935b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "013b6ff0-a611-435b-9dac-d61573401939"
        }
      ]
    },
    {
      "bom-ref": "a745fb95-f670-47a4-abcf-dec2a494b1fd",
      "id": "CVE-2010-4756",
      "description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "4a008a30-9274-4ec9-9936-43f4a3d3c5ee",
      "id": "CVE-2022-39046",
      "description": "An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "e363b4ef-ec10-47e7-9a8f-9f5fd255141d",
      "id": "CVE-2023-0687",
      "description": "A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "98aa798b-7d06-4a42-aa11-dd5fe4f01a7a",
      "id": "CVE-2023-4527",
      "description": "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "45964074-3f78-4650-bb59-32015b8c9124",
      "id": "CVE-2023-4911",
      "description": "A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "86b6b3e5-e380-4c44-bc92-19da396e9495",
      "id": "CVE-2023-5156",
      "description": "A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "b2a029d7-0b32-428f-a150-1e271d99d602",
      "id": "CVE-2023-6246",
      "description": "A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "800adabe-f9bd-4652-b24a-447dae004491",
      "id": "CVE-2024-2961",
      "description": "The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "7a289d43-4d52-4193-a076-f89db53177be",
      "id": "CVE-2024-33599",
      "description": "nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "0a87a35b-0949-4468-bcf5-f3641e14450e",
      "id": "CVE-2024-33600",
      "description": "nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "bc542875-dd2c-4ff5-8a24-423b5a0340bc",
      "id": "CVE-2024-33601",
      "description": "nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "53d55dc6-45cb-4806-be55-80a4883cd1bd",
      "id": "CVE-2024-33602",
      "description": "nscd: netgroup cache assumes NSS callback uses in-buffer strings\n\nThe Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory\nwhen the NSS callback does not store all strings in the provided buffer.\nThe flaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "a7c40100-af23-4b84-bd00-9b5c5855f10d",
      "id": "CVE-2025-0395",
      "description": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "0cf01ab3-30e7-4d8d-8378-5aa95db333b1",
      "id": "CVE-2025-4802",
      "description": "Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).",
      "affects": [
        {
          "ref": "025795b1-0fb2-4e72-9a9f-74ce11f9143d"
        }
      ]
    },
    {
      "bom-ref": "87fc2c9d-e8cf-4a40-b058-b385c8883ce0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "035a466d-6f40-4144-8688-e39ed8ef969e"
        }
      ]
    },
    {
      "bom-ref": "c6e4411b-22c5-4984-a571-99df7aabc10b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "035a466d-6f40-4144-8688-e39ed8ef969e"
        }
      ]
    },
    {
      "bom-ref": "4fb326e3-ae73-4e59-b7a2-7a9fc2241cbc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "035a466d-6f40-4144-8688-e39ed8ef969e"
        }
      ]
    },
    {
      "bom-ref": "3e5384c3-a200-4d71-aaba-7ff3ca5a4604",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "035a466d-6f40-4144-8688-e39ed8ef969e"
        }
      ]
    },
    {
      "bom-ref": "7b0eb586-5e91-4422-9f66-9c2fbbc8369d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "035a466d-6f40-4144-8688-e39ed8ef969e"
        }
      ]
    },
    {
      "bom-ref": "63589c91-82fe-4b84-9ee9-98a7a8a6ad69",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "035a466d-6f40-4144-8688-e39ed8ef969e"
        }
      ]
    },
    {
      "bom-ref": "f9caa156-7aff-43e3-a7f5-66882f8ba09c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0a031b03-ad03-4a9d-a8d8-cc3b0fbf5861"
        }
      ]
    },
    {
      "bom-ref": "9bdb91e6-50f0-467c-bb92-b26ce52e8c8a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86"
        }
      ]
    },
    {
      "bom-ref": "7cb52b61-1b17-4d72-8fa8-cee1ca04cce3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86"
        }
      ]
    },
    {
      "bom-ref": "1447428f-7a31-487e-abaa-000c55729c3b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86"
        }
      ]
    },
    {
      "bom-ref": "dc45c520-5863-457d-93bb-4de363e7b25a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86"
        }
      ]
    },
    {
      "bom-ref": "f824b0a6-b7d8-4c9f-a076-db6a6b3d7407",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e"
        }
      ]
    },
    {
      "bom-ref": "af613ee6-4924-4d43-a6f8-8829f850ce01",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86"
        }
      ]
    },
    {
      "bom-ref": "9e02669e-bdcd-4f1d-8973-a04f983b5aa2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "02c8a856-3ba9-4c86-b3ed-6b6f70ae3e86"
        }
      ]
    },
    {
      "bom-ref": "f9ee7196-cbf6-4cdb-a7ff-308617e4b193",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0a162311-dc40-4252-ae96-6edcf7911528"
        }
      ]
    },
    {
      "bom-ref": "11cb35e6-f4d5-4dd4-90a3-3a976c608187",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0a3d8da3-4ce9-4342-91e8-62da6270598e"
        }
      ]
    },
    {
      "bom-ref": "461c2b99-3c88-48b8-a5d6-42e36d562582",
      "id": "CVE-2023-5678",
      "description": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "a90bc5f6-f6ea-4ddb-8cff-84140a53486c",
      "id": "CVE-2024-0727",
      "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "4e2028d8-dc27-4921-a12b-77d26fdc0fe4",
      "id": "CVE-2024-13176",
      "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "109e74a7-d239-419d-9bd8-238fb41d4f01",
      "id": "CVE-2024-2511",
      "description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "00e964d3-5825-4c45-a168-52139ded4b76",
      "id": "CVE-2024-4741",
      "description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "6092a94d-2a33-47f4-83e8-4a0e26c27422",
      "id": "CVE-2024-5535",
      "description": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "6b3c312d-e972-4efb-b88c-d9ada4e0b279",
      "id": "CVE-2024-9143",
      "description": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "acf16f46-4442-4104-9ca4-ca196877ee5f",
      "id": "CVE-2025-9230",
      "description": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "2b00bb63-cdbe-47e4-aa18-79f83ce8782a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "09d8c0da-87e6-4f65-a000-bb7109b2825d"
        }
      ]
    },
    {
      "bom-ref": "415474ea-a975-4736-a73e-5a12f87911e9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1"
        }
      ]
    },
    {
      "bom-ref": "ab8e90ff-6249-4e08-99d4-bf53220cff99",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1"
        }
      ]
    },
    {
      "bom-ref": "30a7800b-199e-4843-8ce0-3fffee0b5532",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1"
        }
      ]
    },
    {
      "bom-ref": "4d9d918e-8d4a-4fd2-8704-be9215a764e4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1"
        }
      ]
    },
    {
      "bom-ref": "2cd7cde3-935c-4ecb-907f-1e5579267253",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1"
        }
      ]
    },
    {
      "bom-ref": "2ec936c4-fe9a-4bd5-b7cc-4cf0369a71ac",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "066a38ac-aea9-4d54-a0b7-b230e8a3e9f1"
        }
      ]
    },
    {
      "bom-ref": "d36c88b6-40b8-4403-a648-f05ac11a21a1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "01c8613f-6462-4755-9b65-700753412bc4"
        }
      ]
    },
    {
      "bom-ref": "c40abb1e-b56f-4e32-a8a3-a93754da3a37",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "01c8613f-6462-4755-9b65-700753412bc4"
        }
      ]
    },
    {
      "bom-ref": "9f546cfb-5c8d-4546-9502-a5d18075d7b3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "01c8613f-6462-4755-9b65-700753412bc4"
        }
      ]
    },
    {
      "bom-ref": "eb2936fc-cad6-46a3-b881-c4d9bb3d76f7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "01c8613f-6462-4755-9b65-700753412bc4"
        }
      ]
    },
    {
      "bom-ref": "2c374eb9-88ca-4df4-b0a0-560a5ab5da81",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "01c8613f-6462-4755-9b65-700753412bc4"
        }
      ]
    },
    {
      "bom-ref": "73b80a9b-4c1f-4bf7-80ea-f3c849fe3d90",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "01c8613f-6462-4755-9b65-700753412bc4"
        }
      ]
    },
    {
      "bom-ref": "ede0a73a-3b86-4819-90e3-0686d86dc531",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92"
        }
      ]
    },
    {
      "bom-ref": "19750d9b-4c3d-4e78-8a00-b2b56e890c92",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92"
        }
      ]
    },
    {
      "bom-ref": "8999a0aa-3a5c-44da-b387-51860d782afa",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92"
        }
      ]
    },
    {
      "bom-ref": "4f2e24c7-ee69-49c3-967f-4905df07d3d6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92"
        }
      ]
    },
    {
      "bom-ref": "f110b109-5424-4736-a052-f490549854ec",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92"
        }
      ]
    },
    {
      "bom-ref": "b9d567ea-467b-4dd8-b8b4-948365ad93bf",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "04d6e54a-b33e-4cf7-acd8-d624c9d53a92"
        }
      ]
    },
    {
      "bom-ref": "b944cf9b-9fbe-425f-8fc9-24c69395bf4f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab"
        }
      ]
    },
    {
      "bom-ref": "9c55ee10-2ea6-4fa0-8cfd-fff9a8a061d7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab"
        }
      ]
    },
    {
      "bom-ref": "1ac40ebc-3c30-4372-95ea-fd3f60cbf485",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab"
        }
      ]
    },
    {
      "bom-ref": "6c591711-82ac-4050-bca9-c72eae8fbf87",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab"
        }
      ]
    },
    {
      "bom-ref": "3e58e98a-1c42-490c-895f-852e9d5ee480",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab"
        }
      ]
    },
    {
      "bom-ref": "1965c0b6-523e-4d9d-9d81-704cd724987c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "027d0fb7-d1d7-4a32-87f8-67a6373ea1ab"
        }
      ]
    },
    {
      "bom-ref": "f3d1540a-3e5c-4bae-9066-485d4328c3dc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0ac3dcb5-fb9d-4a58-8e57-58c474cdeeb7"
        }
      ]
    },
    {
      "bom-ref": "9030feba-5a3f-4d19-a6ae-96421721d6c8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e"
        }
      ]
    },
    {
      "bom-ref": "f0a30952-f25c-47ad-b7c8-61dc7b490f8e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e"
        }
      ]
    },
    {
      "bom-ref": "aa87248d-c392-432f-93a2-ce8b48061b9d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e"
        }
      ]
    },
    {
      "bom-ref": "94a6de67-91b8-4c47-8e3d-6efbb6d42954",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "07625e6c-6bee-47fb-84a5-39acf6aeff4e"
        }
      ]
    },
    {
      "bom-ref": "3de9c36b-c390-4778-a575-fd4174032a90",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0a281466-8705-4055-bf04-35d55241c8b7"
        }
      ]
    },
    {
      "bom-ref": "1266f6d2-2ab4-4d5e-a051-e5bba720b183",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0926069f-b569-4745-9218-4ade71f5a77e"
        }
      ]
    },
    {
      "bom-ref": "2c086c46-a322-43f1-8133-18aa64358b0c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0926069f-b569-4745-9218-4ade71f5a77e"
        }
      ]
    },
    {
      "bom-ref": "9dde8a79-9f6f-479e-bbee-a0b88c19ed4a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0926069f-b569-4745-9218-4ade71f5a77e"
        }
      ]
    },
    {
      "bom-ref": "af4e4a46-ab90-4bc1-872a-11a7decc9f85",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0926069f-b569-4745-9218-4ade71f5a77e"
        }
      ]
    },
    {
      "bom-ref": "258452b3-736b-4d8f-8eb7-f9e5f60aeca9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0926069f-b569-4745-9218-4ade71f5a77e"
        }
      ]
    },
    {
      "bom-ref": "a0e57a0e-ee7d-4af0-a272-b75bf207222b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0926069f-b569-4745-9218-4ade71f5a77e"
        }
      ]
    },
    {
      "bom-ref": "0679e3d4-ed45-4537-841f-f91b9c54c450",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a"
        }
      ]
    },
    {
      "bom-ref": "a170e471-71f6-4cd1-a9ea-fb99b97308d4",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a"
        }
      ]
    },
    {
      "bom-ref": "822da95b-79c8-47f9-8dfb-2dc3b796fb3d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a"
        }
      ]
    },
    {
      "bom-ref": "ef2b6401-b94f-4fa9-b7da-4925139b331e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a"
        }
      ]
    },
    {
      "bom-ref": "6c5f7001-9713-4384-bb36-28d40feeebd4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a"
        }
      ]
    },
    {
      "bom-ref": "bcb572ff-a55b-4c9d-bc66-bde88921fe9d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0718ba97-7648-4bcc-9b28-67cd546ef88a"
        }
      ]
    },
    {
      "bom-ref": "0ee7f8fe-cc38-41ed-a344-35952e1aa2ad",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0adec78c-f181-49b2-b259-912204acfd7e"
        }
      ]
    },
    {
      "bom-ref": "ed30ba71-e1a1-4ece-8fbb-93e26e44ff58",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b"
        }
      ]
    },
    {
      "bom-ref": "78739d24-a168-4da9-864e-db70ae0184a6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b"
        }
      ]
    },
    {
      "bom-ref": "7f5391f9-38a7-482f-8e55-6bd901149ee0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b"
        }
      ]
    },
    {
      "bom-ref": "be87e11e-eb95-4b48-97e7-d902dc1e25c8",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b"
        }
      ]
    },
    {
      "bom-ref": "39d90540-bd8a-4eb0-9924-4343edde8ddc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089"
        }
      ]
    },
    {
      "bom-ref": "0ca60023-d63b-467d-aa47-b16a2381abe2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b"
        }
      ]
    },
    {
      "bom-ref": "40528c1b-2f90-44a5-a195-34c310e11dc2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0027a5ee-df44-4799-9e69-4dd3feac193b"
        }
      ]
    },
    {
      "bom-ref": "aea72ebb-063d-45fc-826d-62d2bcb6c3ae",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "07654863-b5da-470d-899e-0d8f3f740f15"
        }
      ]
    },
    {
      "bom-ref": "eb269913-a3d5-4d44-97af-73ed729b0337",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "07654863-b5da-470d-899e-0d8f3f740f15"
        }
      ]
    },
    {
      "bom-ref": "67af6ebb-2afa-47cb-bcbe-354f6157b3d4",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "07654863-b5da-470d-899e-0d8f3f740f15"
        }
      ]
    },
    {
      "bom-ref": "2649c88e-b077-4a06-85ba-71ca1841d53a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "07654863-b5da-470d-899e-0d8f3f740f15"
        }
      ]
    },
    {
      "bom-ref": "0af39d74-f456-4c7b-b605-2dd012292f63",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "07654863-b5da-470d-899e-0d8f3f740f15"
        }
      ]
    },
    {
      "bom-ref": "18699451-6a99-440f-9dcb-6c7140e33096",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "07654863-b5da-470d-899e-0d8f3f740f15"
        }
      ]
    },
    {
      "bom-ref": "464928c9-57ac-47ce-82b8-c84ac4fcf967",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0c1cebbb-504e-4d61-8dce-42c941af1c11"
        }
      ]
    },
    {
      "bom-ref": "24d7d73f-1d96-4fac-a484-26485d96b242",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089"
        }
      ]
    },
    {
      "bom-ref": "47df54db-f8fa-48df-9f80-22e0293c566d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089"
        }
      ]
    },
    {
      "bom-ref": "04df23a1-ff25-40ba-8fcd-7baccfc33dc7",
      "id": "CVE-1999-0656",
      "description": "The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e197ed4-b883-458b-bac4-8ffe83564015",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089"
        }
      ]
    },
    {
      "bom-ref": "8e81a0fe-7d2d-4532-bc58-e7f4209362a5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089"
        }
      ]
    },
    {
      "bom-ref": "87400e8c-32b2-4db2-8a2e-638961040e29",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "07255f7e-d2ce-4017-9eaf-f26ae0c7e089"
        }
      ]
    },
    {
      "bom-ref": "e2515075-dbd9-4f37-a667-703c42308c46",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80"
        }
      ]
    },
    {
      "bom-ref": "13be9b70-264b-4266-81a0-1be9609a847e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80"
        }
      ]
    },
    {
      "bom-ref": "90b1e209-4bad-4843-8d4e-0ee94c54533f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80"
        }
      ]
    },
    {
      "bom-ref": "6e1a7db9-ef09-4810-8440-94bc94ec9de1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80"
        }
      ]
    },
    {
      "bom-ref": "7d0842df-bda1-47ba-b4dc-1e62e52d16ab",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80"
        }
      ]
    },
    {
      "bom-ref": "c5548e21-a830-47d1-a685-e0be565bb48e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "08b7282d-0a82-4b9d-9096-c329ee294b80"
        }
      ]
    },
    {
      "bom-ref": "b4e30dbd-e912-4a8d-b040-8b7419648c33",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0c29aff9-ce97-418c-9992-bb2a98cf586e"
        }
      ]
    },
    {
      "bom-ref": "7cc284db-9ff9-4f65-bd4c-e9e607573947",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a"
        }
      ]
    },
    {
      "bom-ref": "873e72a0-5932-4c17-b9f2-7a04137c3817",
      "id": "CVE-2019-3016",
      "description": "In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This problem is limit to the host running linux kernel 4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel CPUs cannot be ruled out.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65764eff-79cc-4291-83c9-328105e003d7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a"
        }
      ]
    },
    {
      "bom-ref": "83c046f9-38c4-4f44-88b6-5c291012a57f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a"
        }
      ]
    },
    {
      "bom-ref": "66cc9c5f-cad7-485f-8913-729d8da6dc8f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a"
        }
      ]
    },
    {
      "bom-ref": "92725dab-9526-42fe-8aa0-31cdce38e9fc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a"
        }
      ]
    },
    {
      "bom-ref": "d155d299-808c-44de-ac03-b756ab952388",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "029b962c-ce24-467e-b8a9-a1ea8803e83a"
        }
      ]
    },
    {
      "bom-ref": "739cd548-1ade-439c-acb9-c77914a29fd3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837"
        }
      ]
    },
    {
      "bom-ref": "b846326e-9b36-46a9-9af0-08c7ccfef333",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837"
        }
      ]
    },
    {
      "bom-ref": "bd2c865c-ff47-4c2c-b9fc-c41ce2fe3c8e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837"
        }
      ]
    },
    {
      "bom-ref": "1b1715c2-4040-40c6-a21f-d272d61d508d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837"
        }
      ]
    },
    {
      "bom-ref": "76ce84b1-cc59-4754-b969-904d2046d0fc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837"
        }
      ]
    },
    {
      "bom-ref": "a1961e31-d475-4763-83f0-5fb075a74d9d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "05b97c1b-e0d0-41b2-99a6-e4d88dbde837"
        }
      ]
    },
    {
      "bom-ref": "c640e090-fffd-4a8e-87fc-ffab68332998",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0d820543-237d-4819-a9d5-828987a295c4"
        }
      ]
    },
    {
      "bom-ref": "0a393579-8673-49c3-b0cc-0437b07bf4b6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0c61ed58-9136-4b81-b9e1-8a53be691350"
        }
      ]
    },
    {
      "bom-ref": "fda72bec-51ed-4f14-b779-27ae93581ba2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0ccb94a9-081f-4f35-9b3a-9e0a2fe18f2f"
        }
      ]
    },
    {
      "bom-ref": "e5b0f660-a258-438d-b28c-02b4549e6bbb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0f624251-14df-45c1-afae-ab1ded7fecb1"
        }
      ]
    },
    {
      "bom-ref": "0b97ce36-71b8-4e57-8288-6cb2713b4561",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "055c16be-5531-4353-ae5f-f775a604a2ac"
        }
      ]
    },
    {
      "bom-ref": "ae1db040-2802-4ee0-8db0-17dd192ed772",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "055c16be-5531-4353-ae5f-f775a604a2ac"
        }
      ]
    },
    {
      "bom-ref": "58e99ae0-31d4-4ee3-9755-afaa2736648a",
      "id": "CVE-2022-48755",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06\n\nJohan reported the below crash with test_bpf on ppc64 e5500:\n\n  test_bpf: #296 ALU_END_FROM_LE 64: 0x0123456789abcdef -\u003e 0x67452301 jited:1\n  Oops: Exception in kernel mode, sig: 4 [#1]\n  BE PAGE_SIZE=4K SMP NR_CPUS=24 QEMU e500\n  Modules linked in: test_bpf(+)\n  CPU: 0 PID: 76 Comm: insmod Not tainted 5.14.0-03771-g98c2059e008a-dirty #1\n  NIP:  8000000000061c3c LR: 80000000006dea64 CTR: 8000000000061c18\n  REGS: c0000000032d3420 TRAP: 0700   Not tainted (5.14.0-03771-g98c2059e008a-dirty)\n  MSR:  0000000080089000 \u003cEE,ME\u003e  CR: 88002822  XER: 20000000 IRQMASK: 0\n  \u003c...\u003e\n  NIP [8000000000061c3c] 0x8000000000061c3c\n  LR [80000000006dea64] .__run_one+0x104/0x17c [test_bpf]\n  Call Trace:\n   .__run_one+0x60/0x17c [test_bpf] (unreliable)\n   .test_bpf_init+0x6a8/0xdc8 [test_bpf]\n   .do_one_initcall+0x6c/0x28c\n   .do_init_module+0x68/0x28c\n   .load_module+0x2460/0x2abc\n   .__do_sys_init_module+0x120/0x18c\n   .system_call_exception+0x110/0x1b8\n   system_call_common+0xf0/0x210\n  --- interrupt: c00 at 0x101d0acc\n  \u003c...\u003e\n  ---[ end trace 47b2bf19090bb3d0 ]---\n\n  Illegal instruction\n\nThe illegal instruction turned out to be 'ldbrx' emitted for\nBPF_FROM_[L|B]E, which was only introduced in ISA v2.06. Guard use of\nthe same and implement an alternative approach for older processors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "490438cf-476c-448c-9708-04954f04b511",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "055c16be-5531-4353-ae5f-f775a604a2ac"
        }
      ]
    },
    {
      "bom-ref": "52c8f20c-fde7-4d61-a998-7834f12599a3",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "055c16be-5531-4353-ae5f-f775a604a2ac"
        }
      ]
    },
    {
      "bom-ref": "775c4d91-9c1b-4f13-9144-b33b7e87d767",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "055c16be-5531-4353-ae5f-f775a604a2ac"
        }
      ]
    },
    {
      "bom-ref": "484f433d-1fc2-4fcd-be55-0ecbd844087c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "055c16be-5531-4353-ae5f-f775a604a2ac"
        }
      ]
    },
    {
      "bom-ref": "0c573096-a3b6-4827-bd32-324cada2d77d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "043c00f0-9efe-4874-9448-f6912fde9681"
        }
      ]
    },
    {
      "bom-ref": "eb4bf098-b344-411a-9f49-f718a6a752c9",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "043c00f0-9efe-4874-9448-f6912fde9681"
        }
      ]
    },
    {
      "bom-ref": "977970f2-665d-4971-badd-5270fae9a03f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "043c00f0-9efe-4874-9448-f6912fde9681"
        }
      ]
    },
    {
      "bom-ref": "9aec9c40-f772-407f-ad30-78ed3b48aa0a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "043c00f0-9efe-4874-9448-f6912fde9681"
        }
      ]
    },
    {
      "bom-ref": "013793d6-aecd-4ae2-bda0-80291f2f0577",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "043c00f0-9efe-4874-9448-f6912fde9681"
        }
      ]
    },
    {
      "bom-ref": "f01594cf-66c9-4ce4-a0e1-0e880a95ee43",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "043c00f0-9efe-4874-9448-f6912fde9681"
        }
      ]
    },
    {
      "bom-ref": "1f290521-8c54-490c-8a71-2f292decda1b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22"
        }
      ]
    },
    {
      "bom-ref": "dec33eb7-3006-4ccf-9e47-5e5829fb269b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22"
        }
      ]
    },
    {
      "bom-ref": "e131949a-8384-4cc3-8771-e649f165d286",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22"
        }
      ]
    },
    {
      "bom-ref": "07a84553-af03-4282-85f1-ae6cdd578108",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22"
        }
      ]
    },
    {
      "bom-ref": "a23a2590-00bd-4774-931e-963543ef0148",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22"
        }
      ]
    },
    {
      "bom-ref": "c4a1faa2-c8a5-4a32-aec9-c79e4dcc43e1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0bf99f5e-a6df-4d14-aca5-9467b3674f22"
        }
      ]
    },
    {
      "bom-ref": "9b8f2b74-674c-4a49-83cb-06054c24d583",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "0f9b3731-296e-4f62-ac8a-27b4a4125eca"
        }
      ]
    },
    {
      "bom-ref": "2231d372-6bb5-453a-9cb1-400a35ecc878",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf"
        }
      ]
    },
    {
      "bom-ref": "8341c584-c62d-4609-8faf-af1ba90e6d65",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f"
        }
      ]
    },
    {
      "bom-ref": "82436952-e7c2-4659-975e-eaf22c01e4f1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f"
        }
      ]
    },
    {
      "bom-ref": "6554af0e-2409-4c1f-9455-ce7303e9547a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f"
        }
      ]
    },
    {
      "bom-ref": "70948e1a-312e-447a-9dc7-f5ec226f2907",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f"
        }
      ]
    },
    {
      "bom-ref": "c9b9c5e5-9094-48bd-8cef-892cd214d8c2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f"
        }
      ]
    },
    {
      "bom-ref": "cd3b08b8-93b2-4153-95aa-fadbde97acd0",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "07cfa0a5-2d85-4c8e-bcb3-7df8997c295f"
        }
      ]
    },
    {
      "bom-ref": "fa8a7984-8548-49c9-8b58-1b50da4c6862",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "11ee7e9f-ce1e-4da6-b707-1411208b099e"
        }
      ]
    },
    {
      "bom-ref": "cc181484-fe94-42d6-86a1-304b038e7edd",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "106b5736-663c-4853-89db-8002f8b37960"
        }
      ]
    },
    {
      "bom-ref": "e7a9f2fd-6b08-41ae-8e33-15d268e9b073",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "126c99b1-f887-4e7d-92cd-f3dbd2120bf8"
        }
      ]
    },
    {
      "bom-ref": "899a3110-90ed-4b36-9707-6c9f14daefa0",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "11b8c085-6b73-4753-8ac9-c74dadaa3bf9"
        }
      ]
    },
    {
      "bom-ref": "a980844d-c7be-4cf0-b95b-9533c570e236",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1398ff19-d3c1-4f1d-a7e2-571dc66a19d4"
        }
      ]
    },
    {
      "bom-ref": "e133dcc3-39df-4842-8d8b-3274faae8947",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "150f2450-b967-4ab9-82ce-9b1bcc5d9bce"
        }
      ]
    },
    {
      "bom-ref": "31a63f13-db19-4436-ad85-5026fbf5af01",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "14b209fc-ad3c-47be-b0e3-a6afd280f096"
        }
      ]
    },
    {
      "bom-ref": "bea20649-6540-4ee9-8307-180d9500b272",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895"
        }
      ]
    },
    {
      "bom-ref": "dfaecef8-54d4-429a-b7ef-f1e02896a93c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895"
        }
      ]
    },
    {
      "bom-ref": "612bd907-f044-4adb-974b-77c3a3e41475",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895"
        }
      ]
    },
    {
      "bom-ref": "5346bbf8-6f4d-4cad-b738-40fdcd1cfca6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895"
        }
      ]
    },
    {
      "bom-ref": "e7d59ca2-f739-43cb-b666-9cb79a9d060d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895"
        }
      ]
    },
    {
      "bom-ref": "a524fcfd-92ec-4ce2-8128-ebbf6e51e6b2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0bfa154d-09d6-45ae-867e-1f83ebd26895"
        }
      ]
    },
    {
      "bom-ref": "f2c0fda4-6880-4820-92f7-efe1fde6fd33",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "155fdb98-729b-4f7e-8614-eeeb475953d7"
        }
      ]
    },
    {
      "bom-ref": "ac8165cf-ba38-4e03-9429-989d807a1216",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf"
        }
      ]
    },
    {
      "bom-ref": "8783f805-e7c2-496b-88e1-14126dea8769",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf"
        }
      ]
    },
    {
      "bom-ref": "53507871-275c-4a8f-8a99-ddf9b976f02d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf"
        }
      ]
    },
    {
      "bom-ref": "da927487-7448-4db1-9076-a22d29c94d11",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf"
        }
      ]
    },
    {
      "bom-ref": "290b286c-0ad8-4376-8e88-3c83d29b7de6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "07cfd701-2347-4698-a4b3-325db10dc5bf"
        }
      ]
    },
    {
      "bom-ref": "10016f5e-bb0b-4090-9f97-64106701a5f2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e"
        }
      ]
    },
    {
      "bom-ref": "9a920277-e1b1-4a73-ade5-e747520120ce",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e"
        }
      ]
    },
    {
      "bom-ref": "2cd27cda-d936-4c10-862c-1b5cf2021764",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e"
        }
      ]
    },
    {
      "bom-ref": "a295144b-91a4-40cd-8c40-1a01b065c707",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e"
        }
      ]
    },
    {
      "bom-ref": "41c653fa-9d44-40de-b9a9-22da92c23514",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e"
        }
      ]
    },
    {
      "bom-ref": "70c04af7-eaba-4b59-9c27-e2413e27f548",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0d7e0cfc-0d9a-4971-81ee-f517b582c61e"
        }
      ]
    },
    {
      "bom-ref": "240989d9-5df3-4ea0-a268-eaa343f5218f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "160bd697-a285-498c-a5bb-5a22c784b734"
        }
      ]
    },
    {
      "bom-ref": "d7d1c8af-f5de-45f7-bf02-41cd4f800dee",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0e29126d-2009-43c1-890b-63813c0c23f7"
        }
      ]
    },
    {
      "bom-ref": "1ed7f201-81b3-414b-a829-a281da176995",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1678ff77-c12a-43c9-a4e9-d6a0ea274ee0"
        }
      ]
    },
    {
      "bom-ref": "a78f948e-0737-4399-bf34-b38aeb371d46",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "08075ef2-0533-4823-9167-5506cfb4ff87"
        }
      ]
    },
    {
      "bom-ref": "a889467b-ad58-4fc0-b5cf-5a23afd4fde2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "08075ef2-0533-4823-9167-5506cfb4ff87"
        }
      ]
    },
    {
      "bom-ref": "0a13186a-6a49-41f0-9fb4-f323d07eadde",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "08075ef2-0533-4823-9167-5506cfb4ff87"
        }
      ]
    },
    {
      "bom-ref": "74066bba-ad19-4727-aecf-fd9fe6653818",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "08075ef2-0533-4823-9167-5506cfb4ff87"
        }
      ]
    },
    {
      "bom-ref": "7333ede1-caf9-4bab-b39b-75b63fe40230",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "08075ef2-0533-4823-9167-5506cfb4ff87"
        }
      ]
    },
    {
      "bom-ref": "589166ce-e966-4c0f-8bb0-0535a92e4d47",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "08075ef2-0533-4823-9167-5506cfb4ff87"
        }
      ]
    },
    {
      "bom-ref": "cb254d33-26ce-4235-8b01-2d4eedd9a5ec",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c"
        }
      ]
    },
    {
      "bom-ref": "d337f184-c504-48ac-a689-0731fbb772c6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c"
        }
      ]
    },
    {
      "bom-ref": "caefee77-a3f4-4de4-b7ff-20433ece52d0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c"
        }
      ]
    },
    {
      "bom-ref": "33ea5ada-a04a-44d7-a1b5-9ac289f5f4da",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c"
        }
      ]
    },
    {
      "bom-ref": "0b3346ff-85dd-4216-b097-e4bc57876f8c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c"
        }
      ]
    },
    {
      "bom-ref": "50e9435a-9730-4f95-afbb-ebb1d59abd73",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "10ea472c-c23d-4053-8a6a-cd0bc9fb113c"
        }
      ]
    },
    {
      "bom-ref": "23f25626-11bc-474f-9a05-d0c478d746de",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1061aebb-69e2-4b52-8626-80596afa48da"
        }
      ]
    },
    {
      "bom-ref": "4af977a5-d3cd-4e97-8d5a-d16334928857",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1061aebb-69e2-4b52-8626-80596afa48da"
        }
      ]
    },
    {
      "bom-ref": "44b86352-1cad-4c8c-bf00-ecad2b66ebe9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1061aebb-69e2-4b52-8626-80596afa48da"
        }
      ]
    },
    {
      "bom-ref": "c0d8b99f-cc1d-4e47-aa80-011df1e777a6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1061aebb-69e2-4b52-8626-80596afa48da"
        }
      ]
    },
    {
      "bom-ref": "7392aa24-af2a-4eee-8f9e-c242be1fa2fe",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1061aebb-69e2-4b52-8626-80596afa48da"
        }
      ]
    },
    {
      "bom-ref": "ca58ac5d-78c4-4345-93ff-5eb0e2f65287",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1061aebb-69e2-4b52-8626-80596afa48da"
        }
      ]
    },
    {
      "bom-ref": "f3ac00f0-2fd2-43e8-8e8d-1e278d1f6ddb",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a"
        }
      ]
    },
    {
      "bom-ref": "141c9f68-b8b9-4404-9895-8a45009a0b8d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a"
        }
      ]
    },
    {
      "bom-ref": "2496011e-bf22-43a6-b606-d5921d6b8b7d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a"
        }
      ]
    },
    {
      "bom-ref": "1cc78e24-7472-40c9-a387-ab8a67ff846f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a"
        }
      ]
    },
    {
      "bom-ref": "1cdb79c9-cc7f-45a8-91c3-398f346c4e7e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a"
        }
      ]
    },
    {
      "bom-ref": "e53501e3-7258-4607-80ef-1684160a18a3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0c34ae7d-fc8c-4e42-8ddb-7cad5a55312a"
        }
      ]
    },
    {
      "bom-ref": "25032065-2bbc-44db-9958-8e1b5ee8927b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1707178d-8b0e-448c-b12e-08c1ad39c301"
        }
      ]
    },
    {
      "bom-ref": "c2dde021-4a12-4bf0-9709-a4b9fb40e399",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a"
        }
      ]
    },
    {
      "bom-ref": "78a06d2e-426f-4dc9-b4e3-e4573a5f97e2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a"
        }
      ]
    },
    {
      "bom-ref": "cda44b0e-394f-4daf-8028-fb85db740b0e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a"
        }
      ]
    },
    {
      "bom-ref": "5a5cccba-1c8f-4a8c-9cf9-210965b318d0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a"
        }
      ]
    },
    {
      "bom-ref": "2c25e5a5-7b68-4293-9fb5-1ff45469dec0",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a"
        }
      ]
    },
    {
      "bom-ref": "e0fb064b-fdc4-44b8-891c-e35a45fbd36e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0eeb2d4d-6acb-4dc0-ba97-3f5c95a3295a"
        }
      ]
    },
    {
      "bom-ref": "3802c12c-cdf9-4be2-91fb-8ba557e07d99",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1631d335-4e18-42de-9f8f-e4408789e416"
        }
      ]
    },
    {
      "bom-ref": "579dfef6-cd27-4110-84a8-e61e69b6302f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "178b9e94-06e4-4494-8356-44de72bd4f85"
        }
      ]
    },
    {
      "bom-ref": "ea1771ef-d42f-4aec-b057-bc672b505c13",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697"
        }
      ]
    },
    {
      "bom-ref": "a47bfb0b-2efe-4539-9d35-06eef63a3268",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697"
        }
      ]
    },
    {
      "bom-ref": "c6606c9b-829a-417c-9e04-bd3578181398",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697"
        }
      ]
    },
    {
      "bom-ref": "7bc2868c-c9df-4b13-a631-7bc0c01596af",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697"
        }
      ]
    },
    {
      "bom-ref": "2f4b5cfb-37ea-416e-852e-669dc8fbfb14",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a"
        }
      ]
    },
    {
      "bom-ref": "855aa043-2c99-455c-8a97-40cbddac2e48",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697"
        }
      ]
    },
    {
      "bom-ref": "2d503d58-59f2-40e8-9261-f3893bfb64a5",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0c4d3f1c-3458-4337-a12d-1cb45ddd7697"
        }
      ]
    },
    {
      "bom-ref": "82f44170-7eff-4a2f-8c3d-6ed8510b5537",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "17cf9bfe-aa5b-4c02-9505-bea6e020874c"
        }
      ]
    },
    {
      "bom-ref": "b59fcef0-6c34-40a2-a41e-71169946c7ac",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a"
        }
      ]
    },
    {
      "bom-ref": "bb7ac394-eb42-4997-a851-e0925664fe22",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a"
        }
      ]
    },
    {
      "bom-ref": "7a163f3e-d032-4c86-bb4d-d080dc27bb08",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a"
        }
      ]
    },
    {
      "bom-ref": "f5a2a529-1f7d-441f-92d1-28c51d64d488",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a"
        }
      ]
    },
    {
      "bom-ref": "15125b7c-ebc6-4e5a-bc12-ff1a07052edb",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0f135cc2-ef3b-43ab-baf2-40ff77170b4a"
        }
      ]
    },
    {
      "bom-ref": "338e049b-75dd-4aaf-9c56-7369f9293391",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7"
        }
      ]
    },
    {
      "bom-ref": "e4b1a6ce-0112-4556-8ac3-25bf65cc19ac",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7"
        }
      ]
    },
    {
      "bom-ref": "ef22f358-82c6-4cff-88bc-ccdb89c3b226",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7"
        }
      ]
    },
    {
      "bom-ref": "8c9313d6-7520-4700-98ca-1a4e120a638b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7"
        }
      ]
    },
    {
      "bom-ref": "8d46af2a-7547-49a5-98ea-e5c4d33f2f9e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7"
        }
      ]
    },
    {
      "bom-ref": "b161378c-efa9-4f6e-8eae-352fd72d1c62",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0e4c35bc-ea32-415c-9df6-6f8242d8c5b7"
        }
      ]
    },
    {
      "bom-ref": "978016f6-3f0a-4b01-ac7e-1f7fd2bb709f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "17d0ef31-cc74-4a84-9324-200d34dec3c2"
        }
      ]
    },
    {
      "bom-ref": "ae242887-b795-4a1e-8271-78b687dc7842",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "0e29126d-2009-43c1-890b-63813c0c23f7"
        }
      ]
    },
    {
      "bom-ref": "f58a1b43-e5d7-4a86-a55b-1420af6729fc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "0e29126d-2009-43c1-890b-63813c0c23f7"
        }
      ]
    },
    {
      "bom-ref": "0c1952b9-aee5-4297-8252-5341658ae23e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "0e29126d-2009-43c1-890b-63813c0c23f7"
        }
      ]
    },
    {
      "bom-ref": "3bdc810d-a598-4072-be6c-e02a25f4a09f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "0e29126d-2009-43c1-890b-63813c0c23f7"
        }
      ]
    },
    {
      "bom-ref": "0129ee75-3729-48f6-b4c4-e8c46b0c3e3d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "0e29126d-2009-43c1-890b-63813c0c23f7"
        }
      ]
    },
    {
      "bom-ref": "38b7f0ab-c1a6-4449-9426-b965e5d26ee6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "18da7bdc-27aa-4366-8e36-329c020d6240"
        }
      ]
    },
    {
      "bom-ref": "fe3461fa-2b26-4102-88bb-7adcaf4ec150",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21"
        }
      ]
    },
    {
      "bom-ref": "375bdf9a-8ab6-4957-bf0d-5a29bf2393f9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22"
        }
      ]
    },
    {
      "bom-ref": "c860e2b4-36d6-413b-8936-632fe6747e1e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22"
        }
      ]
    },
    {
      "bom-ref": "a7308377-b38a-4cdd-90d9-482687a7d72a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22"
        }
      ]
    },
    {
      "bom-ref": "dd6a071e-4164-47ef-a4d5-c458180873bb",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22"
        }
      ]
    },
    {
      "bom-ref": "0f26f365-9e1e-4ea2-92b3-9343a2200f01",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22"
        }
      ]
    },
    {
      "bom-ref": "f5f8aee4-45b0-4cd0-b92e-ba9a36038432",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "168bc92f-3c25-4af6-bd9f-f186c7f0fa22"
        }
      ]
    },
    {
      "bom-ref": "3555fa44-bf93-49b8-b507-fc22483784b0",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "19999c9d-4ad4-4c7b-9278-5d9ba533e1ce"
        }
      ]
    },
    {
      "bom-ref": "f49afc63-74dc-4ab4-88c2-e5a2629bd632",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda"
        }
      ]
    },
    {
      "bom-ref": "f56b5ccd-ae95-469e-8e3a-b5ecc9ad21ac",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda"
        }
      ]
    },
    {
      "bom-ref": "c811c31a-678e-4694-9696-bccbc86e157f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda"
        }
      ]
    },
    {
      "bom-ref": "82e7e378-ed2b-4502-bb4f-85e98772c199",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda"
        }
      ]
    },
    {
      "bom-ref": "556be3fe-2586-4b96-a59e-9aff75de3668",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda"
        }
      ]
    },
    {
      "bom-ref": "e446ffe4-dd2e-481a-896f-4bcaa95f9d12",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "16e47fe4-b545-43c6-b57a-6e32963d7eda"
        }
      ]
    },
    {
      "bom-ref": "f3e00398-5f99-4c2f-ac92-370636cd9ed8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27"
        }
      ]
    },
    {
      "bom-ref": "f86290e1-6233-4c98-ae5e-030f52709acc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27"
        }
      ]
    },
    {
      "bom-ref": "3b03ce05-34e3-4d5d-b3fd-45681dc99fe3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27"
        }
      ]
    },
    {
      "bom-ref": "8b2816be-2295-4437-bab8-f0986eb50d61",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27"
        }
      ]
    },
    {
      "bom-ref": "1a950ebe-d610-4778-87c1-fa5637cb22bc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27"
        }
      ]
    },
    {
      "bom-ref": "429dfd55-72da-40b8-9000-5a22c8d5bdc9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "15b97194-a760-4f08-97b0-1f57bfb36d27"
        }
      ]
    },
    {
      "bom-ref": "3a0bdfe9-613f-4f0e-b47f-09f3c3825ef0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "16005a53-267e-4dd2-9785-2553fb756387"
        }
      ]
    },
    {
      "bom-ref": "2677b8c9-cdcd-4d3b-8d4e-706f792e7099",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "16005a53-267e-4dd2-9785-2553fb756387"
        }
      ]
    },
    {
      "bom-ref": "1bffb7d8-de69-4914-869f-19573cf30f56",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "16005a53-267e-4dd2-9785-2553fb756387"
        }
      ]
    },
    {
      "bom-ref": "8e7b2a56-170c-42c1-a2f5-66716b08c237",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "16005a53-267e-4dd2-9785-2553fb756387"
        }
      ]
    },
    {
      "bom-ref": "42c108bb-47fb-466e-b6c5-12e4cfbd0202",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "16005a53-267e-4dd2-9785-2553fb756387"
        }
      ]
    },
    {
      "bom-ref": "3b450d9c-4fc4-49c1-a0da-495629878426",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "16005a53-267e-4dd2-9785-2553fb756387"
        }
      ]
    },
    {
      "bom-ref": "5bef5698-af49-4640-b016-3fc0201ab7ef",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1c308700-3aab-4d49-a900-48bc200e10d6"
        }
      ]
    },
    {
      "bom-ref": "70466aa6-6f0f-4d77-bbd8-2293e254f275",
      "id": "CVE-2022-3821",
      "description": "An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.",
      "affects": [
        {
          "ref": "1b4702b6-ac84-47c7-acfa-6e3998b4777c"
        }
      ]
    },
    {
      "bom-ref": "39acd7e0-8c15-44c9-a471-d975fede4de7",
      "id": "CVE-2022-4415",
      "description": "A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.",
      "affects": [
        {
          "ref": "1b4702b6-ac84-47c7-acfa-6e3998b4777c"
        }
      ]
    },
    {
      "bom-ref": "4de18793-a52e-4894-b764-a9ff30a89e80",
      "id": "CVE-2022-45873",
      "description": "systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.",
      "affects": [
        {
          "ref": "1b4702b6-ac84-47c7-acfa-6e3998b4777c"
        }
      ]
    },
    {
      "bom-ref": "96efb819-6e3c-4f4d-aa4d-2f670a97fb73",
      "id": "CVE-2025-4598",
      "description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
      "affects": [
        {
          "ref": "1b4702b6-ac84-47c7-acfa-6e3998b4777c"
        }
      ]
    },
    {
      "bom-ref": "4e55d4a7-3dab-4ee7-acd9-1a4aef7673e0",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1b9550ba-43fc-4e61-9e8a-581549da12ef"
        }
      ]
    },
    {
      "bom-ref": "7968c5a7-d9b2-470b-bcbf-fd427693e2f8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21"
        }
      ]
    },
    {
      "bom-ref": "288c49f3-9c83-4eb6-bff3-e6c166364260",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21"
        }
      ]
    },
    {
      "bom-ref": "a65c8e3d-2611-4aea-ac2e-2fa2511bd71b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21"
        }
      ]
    },
    {
      "bom-ref": "fc1e85b9-8222-4cfd-b9a1-e66c327a7eac",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21"
        }
      ]
    },
    {
      "bom-ref": "893fa80a-7da4-4c87-9716-0970d7842569",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "194e1a80-c4f6-4025-b129-dba4dc0b8e21"
        }
      ]
    },
    {
      "bom-ref": "82d94d9d-4263-451c-80a4-190c81c8d3ca",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "121975b4-797c-4344-9a7f-1d363a2f2308"
        }
      ]
    },
    {
      "bom-ref": "442a1552-9546-462e-bbd1-4e01eb07ddeb",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "121975b4-797c-4344-9a7f-1d363a2f2308"
        }
      ]
    },
    {
      "bom-ref": "27b6d8ba-aa9d-4929-a460-e7c8d447f423",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "121975b4-797c-4344-9a7f-1d363a2f2308"
        }
      ]
    },
    {
      "bom-ref": "8565b16a-e370-4c32-a7fa-8c2c0e7051d9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "121975b4-797c-4344-9a7f-1d363a2f2308"
        }
      ]
    },
    {
      "bom-ref": "b36814d5-57f8-40d4-979e-7fdd5fd83fe9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "121975b4-797c-4344-9a7f-1d363a2f2308"
        }
      ]
    },
    {
      "bom-ref": "15960e0a-5889-4d04-b21a-f5fbcc6db0c7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "121975b4-797c-4344-9a7f-1d363a2f2308"
        }
      ]
    },
    {
      "bom-ref": "3e1f0b1a-551d-4bf8-ab99-6e2c56706b6e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "17208586-7e43-40ee-82a1-ecd052448176"
        }
      ]
    },
    {
      "bom-ref": "3d962bc1-cb95-4212-900a-f4a27b518ef9",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "17208586-7e43-40ee-82a1-ecd052448176"
        }
      ]
    },
    {
      "bom-ref": "366f4915-8178-4fe8-96fd-a9165363cf79",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "17208586-7e43-40ee-82a1-ecd052448176"
        }
      ]
    },
    {
      "bom-ref": "37158426-8ce5-4100-84e0-2b5c51ce876a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "17208586-7e43-40ee-82a1-ecd052448176"
        }
      ]
    },
    {
      "bom-ref": "25d120e1-dcbf-4b72-9c2c-d03ba28a666f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "17208586-7e43-40ee-82a1-ecd052448176"
        }
      ]
    },
    {
      "bom-ref": "04ad041f-b7c5-4cf6-b3cf-88d57e19febd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "17208586-7e43-40ee-82a1-ecd052448176"
        }
      ]
    },
    {
      "bom-ref": "cb9ed21d-307d-4244-88f4-f8b22608b077",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db"
        }
      ]
    },
    {
      "bom-ref": "5b142aae-c824-4aee-90b3-35c1b5d3da90",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db"
        }
      ]
    },
    {
      "bom-ref": "0aeaeafb-f075-4520-8abd-20b81c47d014",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db"
        }
      ]
    },
    {
      "bom-ref": "51fc0306-3180-4f5e-ab76-c4aebb6a91a1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db"
        }
      ]
    },
    {
      "bom-ref": "cc03da99-0e09-455b-b495-1906cab24b13",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db"
        }
      ]
    },
    {
      "bom-ref": "71c2ae0b-ae38-4e2c-8e6f-5e0c10c22142",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "18af2599-3194-48c8-b757-de1ec8ffd9db"
        }
      ]
    },
    {
      "bom-ref": "64c632da-d139-46e0-b06b-60f84f4e25de",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1d8bcd9c-993d-4f03-892a-a095d225f0bb"
        }
      ]
    },
    {
      "bom-ref": "4bfe3277-544f-4cd2-842c-f450d0edcec3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3"
        }
      ]
    },
    {
      "bom-ref": "884689a1-4312-432b-9eeb-34079839c174",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3"
        }
      ]
    },
    {
      "bom-ref": "3eaa833f-16be-4a4e-8fd2-0ceac9de5d5b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3"
        }
      ]
    },
    {
      "bom-ref": "12dee451-6f55-4cd2-99cd-25208e12012f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3"
        }
      ]
    },
    {
      "bom-ref": "126c77d9-0e05-429b-967c-3124e6a048df",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3"
        }
      ]
    },
    {
      "bom-ref": "514a1da1-893f-47b9-9972-3128f845d324",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "130af279-e5bf-4f4f-a89b-784e442ae6e3"
        }
      ]
    },
    {
      "bom-ref": "a0e90884-74dd-46df-8e78-871f861b2d6a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1f077ae7-18dc-4020-adfb-4e958e90ed6b"
        }
      ]
    },
    {
      "bom-ref": "67d5e6ef-28e9-4302-860d-905c8422a333",
      "id": "CVE-2023-5678",
      "description": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "80dd979f-fdb5-4ae2-8b57-cfd953a5fcc3",
      "id": "CVE-2024-0727",
      "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "f404de4f-6a9c-49d3-bcfc-b6dd7cfac4ff",
      "id": "CVE-2024-13176",
      "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "5d9b78bc-ef93-4a5d-8f74-2adbc003e206",
      "id": "CVE-2024-2511",
      "description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "23768b30-a990-4a14-96f4-f81fdb563198",
      "id": "CVE-2024-4741",
      "description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "80e3c1d3-0646-4d80-bde3-c922db67962d",
      "id": "CVE-2024-5535",
      "description": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "99a72e24-e100-416d-999e-f0e4c5f1266b",
      "id": "CVE-2024-9143",
      "description": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "41fd1fc4-c16e-42bd-aa34-e2bf3a3e84ff",
      "id": "CVE-2025-9230",
      "description": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "09eae153-64e8-404b-82fb-667314ee4548",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1dac8d47-2298-419e-a829-4dcd2fcec2d4"
        }
      ]
    },
    {
      "bom-ref": "0424e6c5-446b-4896-a1bc-44452f97d3cf",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1e9955f9-d678-49ae-aeb0-c72f101cb0c1"
        }
      ]
    },
    {
      "bom-ref": "aaba9f76-5d11-45fa-a9c2-61420c35031c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a"
        }
      ]
    },
    {
      "bom-ref": "ca031df0-184a-4934-8929-3cf4d653d531",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1f29862e-de1f-45ef-9084-e969ed4e8fe7"
        }
      ]
    },
    {
      "bom-ref": "8e154e0b-a933-47b1-a15c-a20ada39034b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1f531a36-9c8d-4178-91bd-4297edc61d70"
        }
      ]
    },
    {
      "bom-ref": "db4ccd5c-1fd8-4f56-96dd-c0e064573bb7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1f644a0b-6ede-45d1-848c-270c79432824"
        }
      ]
    },
    {
      "bom-ref": "a1962e71-ee7a-4ff2-ae89-80d8ad578eb0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a"
        }
      ]
    },
    {
      "bom-ref": "9106d0c1-a09b-4507-8e5a-557861d246b2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a"
        }
      ]
    },
    {
      "bom-ref": "6d3e39f7-efb8-4402-b937-30b72be1c9e1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a"
        }
      ]
    },
    {
      "bom-ref": "3507e6da-2da4-4354-978e-b6f49cb2ce62",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a"
        }
      ]
    },
    {
      "bom-ref": "cd52a0c8-4ec0-42ac-a75c-913ca1cbed87",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "19a29b01-defe-4905-8bd0-0a499d3f0e7a"
        }
      ]
    },
    {
      "bom-ref": "178aecd9-133f-4b94-92d0-79798a0f4bca",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "17cad429-2da5-42ad-8146-c841433fba88"
        }
      ]
    },
    {
      "bom-ref": "afb12bea-b232-49a6-b65e-16fd1e23597a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "17cad429-2da5-42ad-8146-c841433fba88"
        }
      ]
    },
    {
      "bom-ref": "0c941e70-29f0-41c2-aff7-29dae26d5344",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "17cad429-2da5-42ad-8146-c841433fba88"
        }
      ]
    },
    {
      "bom-ref": "2e2f494a-4141-45f1-adee-5c63758d3850",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "17cad429-2da5-42ad-8146-c841433fba88"
        }
      ]
    },
    {
      "bom-ref": "939d09e3-0f99-4898-98c5-d7d16ee90e92",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "17cad429-2da5-42ad-8146-c841433fba88"
        }
      ]
    },
    {
      "bom-ref": "82b4462f-dabd-4ef8-9bd4-6f340c7c5e79",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "17cad429-2da5-42ad-8146-c841433fba88"
        }
      ]
    },
    {
      "bom-ref": "2556862f-2a58-4fe4-95d9-fb20d4f8a733",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf"
        }
      ]
    },
    {
      "bom-ref": "0d472348-8d73-4147-8d7c-a2cde98b0ef6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf"
        }
      ]
    },
    {
      "bom-ref": "e47fbe41-2119-4beb-80a1-495133aaeef4",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf"
        }
      ]
    },
    {
      "bom-ref": "d90e91af-d4a8-4308-b1ff-602ca6d9e709",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf"
        }
      ]
    },
    {
      "bom-ref": "448fbf24-7d85-420b-874e-5c99ffb36e66",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf"
        }
      ]
    },
    {
      "bom-ref": "30d61a7d-16f3-42ab-a016-2f015a862696",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "18d5d194-9f23-4af7-8764-82254a6a9cbf"
        }
      ]
    },
    {
      "bom-ref": "608c9042-791c-4f53-a8a4-56df303e6394",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1f390a51-ea22-45b7-9aec-a004695fed7a"
        }
      ]
    },
    {
      "bom-ref": "b64e3f97-0354-4925-a17a-4180d459c8df",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1"
        }
      ]
    },
    {
      "bom-ref": "38645bb0-728c-49aa-bd5c-b5f335d05694",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1"
        }
      ]
    },
    {
      "bom-ref": "69630cd9-32a9-42cb-80d1-e949993f549a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1"
        }
      ]
    },
    {
      "bom-ref": "4ba3d3cb-ad60-440a-9412-6470f1cc58f8",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1"
        }
      ]
    },
    {
      "bom-ref": "c982fad8-8673-45ed-aa4a-21c80c356ae5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1"
        }
      ]
    },
    {
      "bom-ref": "ba02e640-c935-4dcf-94a9-4f021148a40f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1db1adb2-e5ea-442b-a900-9fdd814010d1"
        }
      ]
    },
    {
      "bom-ref": "db1b6f55-f565-41fa-b38a-d324b874f88c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3"
        }
      ]
    },
    {
      "bom-ref": "b36b47a2-f754-4102-8bf7-d21b62b3398b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3"
        }
      ]
    },
    {
      "bom-ref": "7a914843-bac6-479d-8c2d-eb3e2c6eca98",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3"
        }
      ]
    },
    {
      "bom-ref": "69ddca0d-1c4b-45f6-915b-75c04c195ff7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3"
        }
      ]
    },
    {
      "bom-ref": "75750db5-60b7-448d-b159-5bd66e25dddd",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3"
        }
      ]
    },
    {
      "bom-ref": "649dfbbf-ba39-40fa-baea-3f3298a5d338",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1c90d2cb-991b-4d66-9643-0b69f09146e3"
        }
      ]
    },
    {
      "bom-ref": "bd8b0fa9-54f0-471f-9e71-d17eb1f6f949",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "1fb4ef3d-372c-4bf7-b074-0a814211c07b"
        }
      ]
    },
    {
      "bom-ref": "11e842be-1194-4fcb-a078-8ca4a2492fb1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4"
        }
      ]
    },
    {
      "bom-ref": "cba4d647-ee43-47e6-9805-305008f63bfe",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4"
        }
      ]
    },
    {
      "bom-ref": "67f16b2a-979f-4b54-9293-4f11bd2dec6d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4"
        }
      ]
    },
    {
      "bom-ref": "b1b73244-d67f-4b38-9a30-0267ba385d21",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4"
        }
      ]
    },
    {
      "bom-ref": "ed66974f-7a15-46c8-b642-a28b1f57e001",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4"
        }
      ]
    },
    {
      "bom-ref": "a12f29f7-2ef1-4b35-a83d-da66d6b1d31c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1c5a2091-64dd-48dd-b0f3-1e8f3f6398d4"
        }
      ]
    },
    {
      "bom-ref": "68a335a2-1482-4f47-a476-b82f145dca1d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "20a0188a-b608-42a4-8c9e-90d88b84f970"
        }
      ]
    },
    {
      "bom-ref": "ed5cc535-a1b6-495e-8f2b-e33e954cd899",
      "id": "CVE-2022-1304",
      "description": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.",
      "affects": [
        {
          "ref": "1f65ac8b-e15f-49aa-b1bb-569a24bbeb08"
        }
      ]
    },
    {
      "bom-ref": "1a1a7769-2b10-4fbe-85db-62463922ba26",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7"
        }
      ]
    },
    {
      "bom-ref": "4706a9d1-07d0-4ddc-88a6-202ab4b9c607",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7"
        }
      ]
    },
    {
      "bom-ref": "66336011-82c6-46ce-88e8-8bc16b4be696",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7"
        }
      ]
    },
    {
      "bom-ref": "78d58d84-102e-46b2-b8fb-88e0aab2c54e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7"
        }
      ]
    },
    {
      "bom-ref": "a52e2825-1283-4d61-83d4-00b86f3e75d2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7"
        }
      ]
    },
    {
      "bom-ref": "583d0db4-d48a-4917-9434-decb7fd79bb6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "19f133e0-ad6f-45a7-9cdf-ed4aac69b1a7"
        }
      ]
    },
    {
      "bom-ref": "b8a15d99-37ee-4f22-b152-bceaea11b9c4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "21bc2dca-9760-4754-82be-066b219e8fba"
        }
      ]
    },
    {
      "bom-ref": "22855f1d-d21f-4a10-bbce-dcdc95a628df",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "210d7542-9c26-4c1f-afd0-f71b2a8ec3f4"
        }
      ]
    },
    {
      "bom-ref": "ac284b2a-ab14-4feb-8863-11a5e1ee5f11",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "215433f0-d8bd-43b7-9c10-f0a8d62092bf"
        }
      ]
    },
    {
      "bom-ref": "738ea035-4f9f-432a-a547-c501b7b3375b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2284da3a-b5b3-4a04-bbee-f03aadae5dd6"
        }
      ]
    },
    {
      "bom-ref": "ed72911c-aa0d-434a-839a-0e34d3bb9df7",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9"
        }
      ]
    },
    {
      "bom-ref": "187e9228-8b60-448a-beef-9941e5346330",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9"
        }
      ]
    },
    {
      "bom-ref": "7c18877f-0e2c-4c27-bf99-3c45c6708f24",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9"
        }
      ]
    },
    {
      "bom-ref": "d785bb63-97a4-490d-80d3-db88dc716e49",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9"
        }
      ]
    },
    {
      "bom-ref": "a908fd93-93f4-4abc-87dc-ef9857888682",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9"
        }
      ]
    },
    {
      "bom-ref": "35196be7-a140-487c-94d9-394f0895b2f0",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1afa9de0-ac80-4ba3-819c-eccfdbd861b9"
        }
      ]
    },
    {
      "bom-ref": "6672cf18-084d-4bf4-83f2-79bbf18b6941",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1b72714a-3264-498a-94a3-34d3edb30be3"
        }
      ]
    },
    {
      "bom-ref": "f74e01a7-4029-40cf-8e01-1fe4d99a0aa9",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1b72714a-3264-498a-94a3-34d3edb30be3"
        }
      ]
    },
    {
      "bom-ref": "44b11216-5abb-4c00-9083-6115e729d8b9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1b72714a-3264-498a-94a3-34d3edb30be3"
        }
      ]
    },
    {
      "bom-ref": "d102c87b-bce9-40a1-b11d-aa5716e08fc6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1b72714a-3264-498a-94a3-34d3edb30be3"
        }
      ]
    },
    {
      "bom-ref": "66684a54-d1f4-41a3-a863-bf79ed4c7a80",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1b72714a-3264-498a-94a3-34d3edb30be3"
        }
      ]
    },
    {
      "bom-ref": "3d692e6b-f71b-4c06-899a-279c46f3d45a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1b72714a-3264-498a-94a3-34d3edb30be3"
        }
      ]
    },
    {
      "bom-ref": "0c1efd54-0553-4514-ab51-b7aa82bb0182",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "22ba1ed8-0841-472c-9581-852a897b0fe0"
        }
      ]
    },
    {
      "bom-ref": "960e3c8c-e89f-441a-a364-28bfb24820e4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137"
        }
      ]
    },
    {
      "bom-ref": "5bd0f089-8845-4d2f-94d9-9d866f412ad6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137"
        }
      ]
    },
    {
      "bom-ref": "f56a2b0d-7757-4d85-a602-00f762ceb382",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137"
        }
      ]
    },
    {
      "bom-ref": "88d5c5b5-55bd-453f-8a69-31e24b7a9b0a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137"
        }
      ]
    },
    {
      "bom-ref": "1ba60015-c382-4e42-8c7b-ee3d266deeb6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137"
        }
      ]
    },
    {
      "bom-ref": "da41c7a4-b87e-4bce-8b54-f154e5b1bab6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1ed8bd57-9051-4af6-b34e-2a598a76e137"
        }
      ]
    },
    {
      "bom-ref": "a6a5e850-1b52-4755-b6a7-ee9906aba2d8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "228b8754-4f10-41ac-81f6-4480df2d9909"
        }
      ]
    },
    {
      "bom-ref": "87895ed9-3c90-4df5-bcd1-ddbe071cada6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "248df14c-4480-48f1-98c1-9c0a1e34c4ed"
        }
      ]
    },
    {
      "bom-ref": "45bef679-35f1-4ee2-aef7-c212539a8f98",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262"
        }
      ]
    },
    {
      "bom-ref": "94b715d1-5a19-41b0-aa82-5c98c679b069",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262"
        }
      ]
    },
    {
      "bom-ref": "14ede7f4-591f-4bc8-87d2-c48e252a7a48",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262"
        }
      ]
    },
    {
      "bom-ref": "3da9c5ca-1d25-4c5f-9c60-24420ebed47b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262"
        }
      ]
    },
    {
      "bom-ref": "cd0a0d12-3b17-4e15-802d-e0f62e44684f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba"
        }
      ]
    },
    {
      "bom-ref": "54b29193-8b48-4ef7-a9ee-c28f48c2026d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262"
        }
      ]
    },
    {
      "bom-ref": "e97e2087-87b8-4120-9af3-94c1dcafc299",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1dbd5b60-81ff-40eb-92ec-4236a6398262"
        }
      ]
    },
    {
      "bom-ref": "2518d717-f14e-45ab-ab9f-52b9b4a3a913",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "24a79dec-acaa-4af0-8949-62b5ebe5744e"
        }
      ]
    },
    {
      "bom-ref": "ef488e67-ba55-44aa-b0b2-fa623f763a07",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "24f3189c-82dd-45d3-b6b5-f5cc1b3f433e"
        }
      ]
    },
    {
      "bom-ref": "9b201897-3e20-4617-a667-10587305a9b3",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "24f3189c-82dd-45d3-b6b5-f5cc1b3f433e"
        }
      ]
    },
    {
      "bom-ref": "cdea2eb5-93aa-4aa2-b831-e9d44eb79bce",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba"
        }
      ]
    },
    {
      "bom-ref": "bf121fb5-b82c-4ed3-99ff-49747f8fac38",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "24f3189c-82dd-45d3-b6b5-f5cc1b3f433e"
        }
      ]
    },
    {
      "bom-ref": "1e26ba4d-4c38-4e34-8c97-6eddd67e2aa5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2201e099-7447-4c74-801c-5d86b30c07a6"
        }
      ]
    },
    {
      "bom-ref": "35daef24-c3ee-4de6-8d07-058aac7469e6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2201e099-7447-4c74-801c-5d86b30c07a6"
        }
      ]
    },
    {
      "bom-ref": "a9a9b755-746d-4315-8fe5-cd593d892791",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2201e099-7447-4c74-801c-5d86b30c07a6"
        }
      ]
    },
    {
      "bom-ref": "eed1ba2f-5a78-434c-baff-68b15e3b5f4a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2201e099-7447-4c74-801c-5d86b30c07a6"
        }
      ]
    },
    {
      "bom-ref": "be59d168-c5c3-4745-8429-451263bd7778",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c"
        }
      ]
    },
    {
      "bom-ref": "9b810f7f-5158-4ae2-a199-80fefd73d00c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2201e099-7447-4c74-801c-5d86b30c07a6"
        }
      ]
    },
    {
      "bom-ref": "58b75fd2-42d6-4f8c-85a8-1b2ef91dc09e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2201e099-7447-4c74-801c-5d86b30c07a6"
        }
      ]
    },
    {
      "bom-ref": "8af551a8-9a9c-4eda-afcf-c77da600eba2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "25f956f5-15ac-4ed4-bc6a-5ad1388c0c4e"
        }
      ]
    },
    {
      "bom-ref": "0327f8a4-f75d-4b11-932e-e54f3580a73a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "26becd45-5529-44b3-8f72-967cba36d8e0"
        }
      ]
    },
    {
      "bom-ref": "e0599f70-38a2-4154-8e77-87566a2d7031",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "26c0abd3-ea38-48bf-81a4-ab0b5c22acd0"
        }
      ]
    },
    {
      "bom-ref": "df09021b-aa96-408e-995e-7a5d1b97de44",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "223872dd-ad8d-40d7-95ea-79528540093c"
        }
      ]
    },
    {
      "bom-ref": "499ae03b-af72-4133-b7a8-62e0f58a20ef",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "223872dd-ad8d-40d7-95ea-79528540093c"
        }
      ]
    },
    {
      "bom-ref": "3921e276-c7e0-4379-b727-6e17e6d2ee52",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "223872dd-ad8d-40d7-95ea-79528540093c"
        }
      ]
    },
    {
      "bom-ref": "d9987dd9-3a1d-47df-a9d1-8a263234942e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "223872dd-ad8d-40d7-95ea-79528540093c"
        }
      ]
    },
    {
      "bom-ref": "6220d677-433d-4eb6-8286-e480e5addb5a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "223872dd-ad8d-40d7-95ea-79528540093c"
        }
      ]
    },
    {
      "bom-ref": "7fe5f8f3-2469-481c-b297-60ac2c74bc4a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "223872dd-ad8d-40d7-95ea-79528540093c"
        }
      ]
    },
    {
      "bom-ref": "f5553d3a-b1d8-4f4c-95da-1beb9d09c1e6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "26ed1e27-9ef8-436c-bb16-f3bc48556a12"
        }
      ]
    },
    {
      "bom-ref": "32582385-1bde-46f4-a3c4-c5864c3fbfb7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "25744fde-a647-435e-aa20-6a2f8baa8dd9"
        }
      ]
    },
    {
      "bom-ref": "5106df28-3725-4a47-854c-2d3aa15e1352",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c"
        }
      ]
    },
    {
      "bom-ref": "32b133ae-ce85-491e-a23b-301b813a06f3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c"
        }
      ]
    },
    {
      "bom-ref": "fe3848a8-4677-4790-a865-1f638eac7e1f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c"
        }
      ]
    },
    {
      "bom-ref": "d12611fd-cc0e-412f-8bf2-28cae4ce9cab",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c"
        }
      ]
    },
    {
      "bom-ref": "9ec7817c-2178-44c0-93a3-fa7019338014",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c"
        }
      ]
    },
    {
      "bom-ref": "95fe5a26-194f-424b-b74b-e02fedc3f7d3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1f7921a1-3002-4745-ac78-40745e7a3d8c"
        }
      ]
    },
    {
      "bom-ref": "f8e19f62-c797-4e6b-9e38-86cce8a74e0e",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "24f4dd95-0a5e-4d41-a445-b2ff04194831"
        }
      ]
    },
    {
      "bom-ref": "21e4eb52-5bf6-4f63-9d8f-8d9ed4fc7c0e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba"
        }
      ]
    },
    {
      "bom-ref": "23174b2f-7b78-4b9c-8f08-88161c857bd9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba"
        }
      ]
    },
    {
      "bom-ref": "1f976510-7a09-44e5-bfc7-eb7a277b538f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba"
        }
      ]
    },
    {
      "bom-ref": "4f505d4a-d749-40da-8be2-8b5f38b0ff7d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "23ade486-3794-4c12-9a6a-bb4a645110ba"
        }
      ]
    },
    {
      "bom-ref": "c61f7a8f-22e5-4c5d-a211-79552598dc09",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "27b8dc41-090c-4541-8ca0-501c1e913963"
        }
      ]
    },
    {
      "bom-ref": "31c27df9-6aeb-46d8-8301-8b6a479a0f2f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c"
        }
      ]
    },
    {
      "bom-ref": "929af5a3-e007-41b8-9fd7-e8525ad83334",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c"
        }
      ]
    },
    {
      "bom-ref": "ecdd95a2-f27f-4c32-a038-13a1633855bd",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c"
        }
      ]
    },
    {
      "bom-ref": "217da657-e7f8-4c55-b1d0-9272231cd006",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c"
        }
      ]
    },
    {
      "bom-ref": "246d802d-bf53-48bf-a2f7-3718eed03061",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "1f54c888-dc0c-4e78-a282-335f1bc94f7c"
        }
      ]
    },
    {
      "bom-ref": "6b916a83-0511-49f0-a055-751a4ce7f00f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "26f3286c-fbb6-4c4a-95cf-de6099be8582"
        }
      ]
    },
    {
      "bom-ref": "a654ece2-4adc-4ac6-9ea9-be7c282443bc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07"
        }
      ]
    },
    {
      "bom-ref": "3c366490-aad5-4d62-a504-2cb3ca9243f5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2a26ad27-f204-4b29-9ba7-dd0433208289"
        }
      ]
    },
    {
      "bom-ref": "658e4383-fb93-48e9-ae3b-47d58e73e8ef",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "20a12227-6079-417b-9827-5face6f82b59"
        }
      ]
    },
    {
      "bom-ref": "c34d763d-d1e7-4f55-9dcc-3516de48996f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "20a12227-6079-417b-9827-5face6f82b59"
        }
      ]
    },
    {
      "bom-ref": "2578ffb5-8362-4801-ad03-8c3ec775a4aa",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "20a12227-6079-417b-9827-5face6f82b59"
        }
      ]
    },
    {
      "bom-ref": "c331bd6f-a738-4b9a-967a-17ac311818e3",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "20a12227-6079-417b-9827-5face6f82b59"
        }
      ]
    },
    {
      "bom-ref": "32340eb8-611c-4a98-9bae-adbd85609169",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "20a12227-6079-417b-9827-5face6f82b59"
        }
      ]
    },
    {
      "bom-ref": "da578c80-cf36-4f06-a8ea-4b2ea239758f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "20a12227-6079-417b-9827-5face6f82b59"
        }
      ]
    },
    {
      "bom-ref": "fa84576a-b290-4fc4-897c-2a9ffc4edd5c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b"
        }
      ]
    },
    {
      "bom-ref": "e40527a6-bfb2-4e8a-923b-3ae936781094",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b"
        }
      ]
    },
    {
      "bom-ref": "5be093a5-ae13-4cc3-89ff-77cbdcb9e75a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b"
        }
      ]
    },
    {
      "bom-ref": "77877f9c-4bde-41db-92ab-2a8e4825fb43",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b"
        }
      ]
    },
    {
      "bom-ref": "e6338125-9698-4a26-94df-09cf462336a8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b"
        }
      ]
    },
    {
      "bom-ref": "bf477543-9547-43d4-afab-837a9ed2a012",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2314e45b-f7cd-4f12-bed4-9c6086cb4f7b"
        }
      ]
    },
    {
      "bom-ref": "e4d4498e-96d1-4139-a5d9-715476909f06",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773"
        }
      ]
    },
    {
      "bom-ref": "3ada7eaf-afe0-4691-8f62-dba93c746762",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773"
        }
      ]
    },
    {
      "bom-ref": "657ed1f0-013b-4b92-875f-45c45ac3e891",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773"
        }
      ]
    },
    {
      "bom-ref": "2ce46445-4941-4012-a5c3-5ff5feeb6cd9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773"
        }
      ]
    },
    {
      "bom-ref": "f6dfe5b4-5966-4a93-801b-bbf580f55f1f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773"
        }
      ]
    },
    {
      "bom-ref": "bfe921ee-0e66-4611-b3ce-116803b977bc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2a2fe49c-d6a9-4def-b74e-5f26f8419773"
        }
      ]
    },
    {
      "bom-ref": "d85bbc6f-72d9-4fe2-8cb5-f77901bf892f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "27ef2646-9ca0-4a01-8850-86fcb6c67007"
        }
      ]
    },
    {
      "bom-ref": "76a8facb-0568-426c-8a22-882dc3f478c2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2ba5326e-4db3-4687-bf74-1f7151b41e18"
        }
      ]
    },
    {
      "bom-ref": "a0de550e-9468-4d66-bb7f-d51a2ccb44e1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2b72a4e1-2d47-4e11-98d5-d80443a61183"
        }
      ]
    },
    {
      "bom-ref": "83decfdc-9bfe-47a3-bb22-4602e7ca39b4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe"
        }
      ]
    },
    {
      "bom-ref": "3f1904f8-4835-4508-a078-8b871b5b3ef4",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe"
        }
      ]
    },
    {
      "bom-ref": "b26bdab0-a369-445c-9102-7f2f2fef6a5a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe"
        }
      ]
    },
    {
      "bom-ref": "c02a662b-9fa4-4142-b53b-6cd7070175ca",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe"
        }
      ]
    },
    {
      "bom-ref": "759e1e2d-5213-4199-975f-d05de6355b5b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe"
        }
      ]
    },
    {
      "bom-ref": "19342686-d46f-43c2-b02a-025db2a13d4a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2301b18c-448c-4063-bd59-c8333cd5d8fe"
        }
      ]
    },
    {
      "bom-ref": "56ed5d7f-d283-4659-8a13-fbaa595e1e6c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "215dffff-26d6-4241-a532-4d5330df589b"
        }
      ]
    },
    {
      "bom-ref": "f67f2e60-822e-418c-9f42-c0a274e5ec1b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "215dffff-26d6-4241-a532-4d5330df589b"
        }
      ]
    },
    {
      "bom-ref": "d45edfc8-79a6-43d5-ab6d-70ace388d416",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "215dffff-26d6-4241-a532-4d5330df589b"
        }
      ]
    },
    {
      "bom-ref": "7e8ba6b3-bd8d-4b52-8873-a50649a55547",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "215dffff-26d6-4241-a532-4d5330df589b"
        }
      ]
    },
    {
      "bom-ref": "df045c45-8f0d-40bd-bd7b-a3619fa63ec6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "215dffff-26d6-4241-a532-4d5330df589b"
        }
      ]
    },
    {
      "bom-ref": "bb79a928-9488-485f-a7db-13fe20b32650",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "215dffff-26d6-4241-a532-4d5330df589b"
        }
      ]
    },
    {
      "bom-ref": "80d27752-bfb2-4bf1-a397-209b287dfa37",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168"
        }
      ]
    },
    {
      "bom-ref": "6729ae37-21fb-4a28-bc1b-3cf3162680e5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168"
        }
      ]
    },
    {
      "bom-ref": "2ea7bbef-1aee-4a70-b694-d3bd69b09439",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168"
        }
      ]
    },
    {
      "bom-ref": "e68cf8cb-3237-4da5-a2a9-f6fccd94f7c5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168"
        }
      ]
    },
    {
      "bom-ref": "f6db884c-de9a-4849-8e4e-f1c3bd8d3177",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168"
        }
      ]
    },
    {
      "bom-ref": "4c60887e-472d-424e-b3d9-7dc1ed155adc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2b3d9f7d-445a-42dd-be69-fc9a1291c168"
        }
      ]
    },
    {
      "bom-ref": "30c725bd-629c-4381-8d1a-6972cfd45d68",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d"
        }
      ]
    },
    {
      "bom-ref": "5d033977-5adb-4a31-a9c2-a747ca9c888e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d"
        }
      ]
    },
    {
      "bom-ref": "26a3b42e-d076-4243-8684-9e3291c652ef",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d"
        }
      ]
    },
    {
      "bom-ref": "0ccfed36-73ec-47fe-b6b5-db5af756d368",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d"
        }
      ]
    },
    {
      "bom-ref": "6d08a822-4888-4e0d-bf38-dcb70a49b183",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d"
        }
      ]
    },
    {
      "bom-ref": "ebdb1c7b-f17d-45c9-8c48-5f4813fa6353",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2a7bff5f-2bb3-40bc-9263-99657db5b73d"
        }
      ]
    },
    {
      "bom-ref": "9595cec5-b37b-4f79-840d-2d285b96b269",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "233ef88e-4c48-442a-8dab-77003dfeae76"
        }
      ]
    },
    {
      "bom-ref": "fae11604-0854-48d1-99da-44667c6c90b3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "233ef88e-4c48-442a-8dab-77003dfeae76"
        }
      ]
    },
    {
      "bom-ref": "932f8256-726e-4b67-a37b-fe4776969f3e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "233ef88e-4c48-442a-8dab-77003dfeae76"
        }
      ]
    },
    {
      "bom-ref": "ca411323-4a77-47a9-953c-383b190fa17d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "233ef88e-4c48-442a-8dab-77003dfeae76"
        }
      ]
    },
    {
      "bom-ref": "61e48bbb-cdad-41e7-aab3-c8c2d468a970",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "233ef88e-4c48-442a-8dab-77003dfeae76"
        }
      ]
    },
    {
      "bom-ref": "3e48a00c-ee4e-45c9-bf80-43e49fdc749f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "233ef88e-4c48-442a-8dab-77003dfeae76"
        }
      ]
    },
    {
      "bom-ref": "fb48754b-4f1c-4542-b14d-efecef0a52b0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b"
        }
      ]
    },
    {
      "bom-ref": "39b6046a-508b-429a-9f72-86ba9aaa1f57",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b"
        }
      ]
    },
    {
      "bom-ref": "9bc63c9d-8ee6-40a6-b98f-2ccd4a8d2170",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b"
        }
      ]
    },
    {
      "bom-ref": "39f85c9e-1a55-4e0e-83b3-adf3cc5ca5bc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b"
        }
      ]
    },
    {
      "bom-ref": "701127a8-0617-47e5-b5d5-49b76d99a66b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b"
        }
      ]
    },
    {
      "bom-ref": "afc97353-5f0b-4867-898a-2359997ede0e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2c723aa7-c241-4fd5-9512-e99dcf57db6b"
        }
      ]
    },
    {
      "bom-ref": "15b982d4-86ff-4701-9ed9-6219bf37397f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2ba0a19d-0af5-4f2f-9d63-8c8575120fdc"
        }
      ]
    },
    {
      "bom-ref": "8bdf497d-048a-46db-8dbe-911c2a87aa03",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2e6f7c76-6585-4bbc-a83f-6e19eea06b13"
        }
      ]
    },
    {
      "bom-ref": "255c9a8d-6a4b-47a3-a014-156e86dd54d5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2db01ec5-f4da-4e5d-a302-83e9520fc3c8"
        }
      ]
    },
    {
      "bom-ref": "2857907a-5c41-4b75-abdd-8ecc51a28308",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2ea749b7-b527-46ee-8a50-c7db1928909b"
        }
      ]
    },
    {
      "bom-ref": "8a35a324-a44f-43b2-97f7-a35c752e96a6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2d7e0be1-e6a3-44c6-91c6-d164ef4d2361"
        }
      ]
    },
    {
      "bom-ref": "26e1b3e1-7ca6-4f23-afb7-7d2c96017181",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69"
        }
      ]
    },
    {
      "bom-ref": "e8408d4e-1170-47e5-9b1e-b8942390c6b6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69"
        }
      ]
    },
    {
      "bom-ref": "a715674e-35de-4615-a678-854974331d59",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69"
        }
      ]
    },
    {
      "bom-ref": "e407218b-4633-4378-b28e-4d8220adeb32",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69"
        }
      ]
    },
    {
      "bom-ref": "f30e1649-d7c1-4147-80ee-9f799809c2da",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69"
        }
      ]
    },
    {
      "bom-ref": "1d857dd4-054c-4bf2-9d9e-3a4ec2f52984",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2497c0f2-c4c4-413c-b981-ba9ad4b9bd69"
        }
      ]
    },
    {
      "bom-ref": "afad828f-941f-48f1-9485-4fc29e4f7fb8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6"
        }
      ]
    },
    {
      "bom-ref": "33833543-3489-4e25-86af-0edfe8cef6b2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6"
        }
      ]
    },
    {
      "bom-ref": "9ec8ed4d-a37b-48e6-96b4-a3e60bb45032",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6"
        }
      ]
    },
    {
      "bom-ref": "433eff79-46cb-4df9-9a3c-6279e4772055",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6"
        }
      ]
    },
    {
      "bom-ref": "45457735-995f-468d-9ea8-c4e14e916a9b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6"
        }
      ]
    },
    {
      "bom-ref": "bc0b1a9a-3b6b-4544-98d4-5f8becf1a9e2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "243460a2-9622-48f0-a3b0-8e4ef18e67a6"
        }
      ]
    },
    {
      "bom-ref": "728e33a0-358f-4934-a790-87d3f28c325a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2d7d8566-f4f8-4e85-9b38-227346f01e00"
        }
      ]
    },
    {
      "bom-ref": "d57da8b7-8679-4b3d-afa7-55c4ced9ce80",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3029968c-872f-4c3c-92d5-9d2366098294"
        }
      ]
    },
    {
      "bom-ref": "39258014-f76a-4d77-b96e-84037c7a77c3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "24a2e681-7476-4de9-990d-552c1774ba28"
        }
      ]
    },
    {
      "bom-ref": "8a243066-43ef-4855-bb95-b7ee74930460",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "24a2e681-7476-4de9-990d-552c1774ba28"
        }
      ]
    },
    {
      "bom-ref": "b032364b-8494-4cd2-89d6-bbb7c3ac5e53",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "24a2e681-7476-4de9-990d-552c1774ba28"
        }
      ]
    },
    {
      "bom-ref": "4420e650-a4cb-4d0f-b6cb-aa98669926bc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "24a2e681-7476-4de9-990d-552c1774ba28"
        }
      ]
    },
    {
      "bom-ref": "c5c6bdfe-be05-4d55-b2c4-8c1dfdb8917c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a"
        }
      ]
    },
    {
      "bom-ref": "28af63d9-55e1-45bb-9108-e17495dc4e77",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "24a2e681-7476-4de9-990d-552c1774ba28"
        }
      ]
    },
    {
      "bom-ref": "99a76474-52ff-4836-8a19-8599633e98d5",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "24a2e681-7476-4de9-990d-552c1774ba28"
        }
      ]
    },
    {
      "bom-ref": "158090c3-6d15-4598-8959-5faf09080711",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe"
        }
      ]
    },
    {
      "bom-ref": "97773a14-5ed4-4ee6-86e8-1f0023d8b721",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe"
        }
      ]
    },
    {
      "bom-ref": "16bebf8b-b4ce-4e0a-95d8-0d828225f92c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe"
        }
      ]
    },
    {
      "bom-ref": "0422b550-8841-4558-b1ac-8e43ca9b439c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe"
        }
      ]
    },
    {
      "bom-ref": "0b80cb5b-114b-4d63-bad8-de0bc506c34b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe"
        }
      ]
    },
    {
      "bom-ref": "7a3ae075-b6fb-4357-a9aa-648db96553b9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2a3a51c9-0ef0-43b3-a040-70c017be2bbe"
        }
      ]
    },
    {
      "bom-ref": "3b707a24-8c47-4120-bfc6-8bc76a85c133",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2f10b443-2ec4-4cee-ae0c-0ca0ff58764d"
        }
      ]
    },
    {
      "bom-ref": "e522db44-0a1e-456d-9ee6-9ab0007ca892",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a"
        }
      ]
    },
    {
      "bom-ref": "6ea490dc-9690-4141-a4e9-cab88a578ddc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a"
        }
      ]
    },
    {
      "bom-ref": "8a4dd080-c08c-434b-aba4-3dd80eab08b9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a"
        }
      ]
    },
    {
      "bom-ref": "b340127d-3cca-47eb-a62f-3bc79c60edc4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a"
        }
      ]
    },
    {
      "bom-ref": "7a0b4fd2-fbc2-4519-a361-701771cee418",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2f945333-fe95-4a80-9a0a-f2b2a6ee4e9a"
        }
      ]
    },
    {
      "bom-ref": "6c0610c4-a1c9-4606-bd02-c9f6153cbbfc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "99158702-3168-4133-b22f-b571eaff09ae",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "347d0bf9-1df2-48d1-9107-fa5670313175"
        }
      ]
    },
    {
      "bom-ref": "b8cbba9b-c773-4836-a5da-1997e25743f2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "5165f424-582e-4a80-996f-b510a3773c8f",
      "id": "CVE-2024-11053",
      "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "c6d1e0ee-1cdb-4045-ac0c-bbd1e7b141cd",
      "id": "CVE-2024-8096",
      "description": "When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "3a4c0f24-1e86-48bc-85c8-3039c899af6d",
      "id": "CVE-2024-9681",
      "description": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "a0ed4d9b-817e-4f69-b4c2-235a52088fb7",
      "id": "CVE-2025-0167",
      "description": "When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "1340b645-9ce1-4554-ac52-84c5ed2e84c8",
      "id": "CVE-2025-0725",
      "description": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "0186f29a-2f09-4b66-8fc1-6cc7cb0510a5",
      "id": "CVE-2025-10966",
      "description": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "86332aa4-1978-4c06-bbb1-47275376830c",
      "id": "CVE-2025-4947",
      "description": "libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "aa60e94b-71e7-424e-930b-e1d7f84a75dd",
      "id": "CVE-2025-5025",
      "description": "libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "513b205a-4223-4065-b6a1-78b178bf35e8",
      "id": "CVE-2025-9086",
      "description": "1. A cookie is set using the `secure` keyword for `https://target` \n 2. curl is redirected to or otherwise made to speak with `http://target` (same \n   hostname, but using clear text HTTP) using the same cookie set \n 3. The same cookie name is set - but with just a slash as path (`path=\\\"/\\\",`).\n   Since this site is not secure, the cookie *should* just be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "e15aed57-2983-4d3f-b6a3-02861d745cf8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "30af3494-869b-4724-aebc-fe68f4ba22d8"
        }
      ]
    },
    {
      "bom-ref": "f4add721-1833-4d2b-b57d-751548d4a73d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3297b825-fc9d-4b6e-af9e-7d0569721292"
        }
      ]
    },
    {
      "bom-ref": "5208cf94-1ac6-4d4b-a528-9c9839d58cc6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "30d9e97b-9e0f-44b8-83d0-86c0738030db"
        }
      ]
    },
    {
      "bom-ref": "740b7f82-340c-4322-9b12-ea69f0699230",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "35c1ff16-98d2-4e9f-98a6-e84fc51c9405"
        }
      ]
    },
    {
      "bom-ref": "fed8c27f-c4ad-4080-865a-22e4725263ab",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "35f7eca2-ccce-4611-a29a-fec82b985260"
        }
      ]
    },
    {
      "bom-ref": "3b7a3846-7f17-4e7e-b366-23cb2aaeb001",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1"
        }
      ]
    },
    {
      "bom-ref": "88d11948-1f4b-43ad-b454-2035f475f8c3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1"
        }
      ]
    },
    {
      "bom-ref": "cd6bd503-2bbe-44e2-8213-ffde1ec07106",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1"
        }
      ]
    },
    {
      "bom-ref": "0104463e-a45d-4ec1-bed8-76a3d0a1d8ff",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1"
        }
      ]
    },
    {
      "bom-ref": "cf110e29-b937-4ebf-85fc-cdf703c1f745",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9"
        }
      ]
    },
    {
      "bom-ref": "11e2fff7-744a-4533-81a6-4404949cf7ef",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1"
        }
      ]
    },
    {
      "bom-ref": "2b1c0b60-7da8-4a3a-b209-40f738c95117",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "288ce6a9-5cf1-46cc-abf0-760e0d9486d1"
        }
      ]
    },
    {
      "bom-ref": "9e929895-736d-4732-96c0-39d59d53f665",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "36ecce89-1d99-4293-acdc-afc4b16c1f74"
        }
      ]
    },
    {
      "bom-ref": "33579b03-a20c-4aad-af50-2d9d0e12bd31",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9"
        }
      ]
    },
    {
      "bom-ref": "80cbd8ae-e025-4150-a4b8-43bd9bcef0d7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9"
        }
      ]
    },
    {
      "bom-ref": "6e15b71b-1bbe-4363-a67a-1d4cf4b1af6d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9"
        }
      ]
    },
    {
      "bom-ref": "a049f82c-1963-48e0-8352-73e7f41a1b7b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9"
        }
      ]
    },
    {
      "bom-ref": "759e2c57-8da1-4a16-87bd-3fdba657362c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2beef19a-588d-4970-9ded-ac4d7e4dc6a9"
        }
      ]
    },
    {
      "bom-ref": "877d1302-f265-4f38-b51b-774772811060",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "37330a26-b35a-44ca-9fb0-03e51cbc7045"
        }
      ]
    },
    {
      "bom-ref": "72880770-35c2-482c-ad61-4c232ab57659",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3692ed62-82cb-42b5-8620-7975d1e50dff"
        }
      ]
    },
    {
      "bom-ref": "da12b5b9-97ca-4bea-bf34-37d6e578f76c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3768d45a-b444-4b01-9b0e-11b6551a3316"
        }
      ]
    },
    {
      "bom-ref": "1d317d59-39fa-463b-9159-5fa62a670f9f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d"
        }
      ]
    },
    {
      "bom-ref": "933abc6d-6c3d-400b-af0b-a437e63b99c0",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d"
        }
      ]
    },
    {
      "bom-ref": "32288df4-fe75-4dd2-9e9c-de92df81561e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d"
        }
      ]
    },
    {
      "bom-ref": "8fbd492e-bb31-464d-b97b-fda0c65f8736",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d"
        }
      ]
    },
    {
      "bom-ref": "406871f2-4c88-4014-922e-4749c5d87970",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d"
        }
      ]
    },
    {
      "bom-ref": "530e9429-2d5e-4b69-951f-90257722132c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "35b965e3-6836-4d68-8e5d-249ae30b8b0d"
        }
      ]
    },
    {
      "bom-ref": "b4bb4bc1-17db-4af5-a9f9-712b9048a7f0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6"
        }
      ]
    },
    {
      "bom-ref": "ce03481f-e49d-4830-898b-4a6d955824b1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6"
        }
      ]
    },
    {
      "bom-ref": "a8778096-bc54-4153-9959-f8dd602b3e43",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6"
        }
      ]
    },
    {
      "bom-ref": "e984dd6c-61fa-47c7-ba72-76c7ea64be47",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6"
        }
      ]
    },
    {
      "bom-ref": "45618e2d-1361-4b87-8efc-8b480b46e20a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6"
        }
      ]
    },
    {
      "bom-ref": "45741c8c-4345-4b75-be7f-47ee6f12d8e9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "33557717-fb93-4cba-9541-eba0bbc8a3f6"
        }
      ]
    },
    {
      "bom-ref": "dee5eddd-f347-46a2-acd1-422aa89a78d1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "378436b1-a54f-4654-a0a9-2f3b7b9064f7"
        }
      ]
    },
    {
      "bom-ref": "0a23a27b-7e47-4a69-b83e-fb2873536721",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf"
        }
      ]
    },
    {
      "bom-ref": "6201f99a-efd6-40ba-8a75-8b6fbb420201",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf"
        }
      ]
    },
    {
      "bom-ref": "c01048db-fe1c-453e-ac52-5e56dfed35c4",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf"
        }
      ]
    },
    {
      "bom-ref": "806a6180-1034-471f-86e8-8cd62ac167e3",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf"
        }
      ]
    },
    {
      "bom-ref": "db5252b0-5f56-4ad5-a48d-f396f789f8f6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf"
        }
      ]
    },
    {
      "bom-ref": "b08d2f71-6275-424c-bd82-d826562f5016",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "32e0d84c-2789-46f4-9ca4-129498c87caf"
        }
      ]
    },
    {
      "bom-ref": "3e76690c-9ec7-45af-892e-9c902c12b88c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "304024b3-fb62-4d07-b19e-a188371d4595"
        }
      ]
    },
    {
      "bom-ref": "b9b6c09f-5db9-47a4-bc9c-9f623b037b31",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "304024b3-fb62-4d07-b19e-a188371d4595"
        }
      ]
    },
    {
      "bom-ref": "db5d0d05-c057-4b7b-bd02-3a5c0361b2c9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "304024b3-fb62-4d07-b19e-a188371d4595"
        }
      ]
    },
    {
      "bom-ref": "70f04ef1-9303-4db2-addf-42f826ae8e07",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "304024b3-fb62-4d07-b19e-a188371d4595"
        }
      ]
    },
    {
      "bom-ref": "112494b1-bb1a-4e92-b56b-b9d4966dd7f7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "304024b3-fb62-4d07-b19e-a188371d4595"
        }
      ]
    },
    {
      "bom-ref": "2b9853f4-b154-452a-95d7-2aa0063fd1af",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "304024b3-fb62-4d07-b19e-a188371d4595"
        }
      ]
    },
    {
      "bom-ref": "7e00b145-55ad-419b-a282-39bad95e0f1f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07"
        }
      ]
    },
    {
      "bom-ref": "4b01e24d-8844-4e94-8045-8af494580729",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07"
        }
      ]
    },
    {
      "bom-ref": "a8b08886-40d8-4866-b762-d6931424708b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07"
        }
      ]
    },
    {
      "bom-ref": "49f19472-9393-44a2-8ac2-6025062adc50",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07"
        }
      ]
    },
    {
      "bom-ref": "d26e48a3-b836-4b79-8788-c3d179fcaebc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3218e47c-7c52-4464-bfcc-e249bdea8b07"
        }
      ]
    },
    {
      "bom-ref": "82469671-b733-48e4-bbdc-4f70e7f4e044",
      "id": "CVE-2022-42010",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.",
      "affects": [
        {
          "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d"
        }
      ]
    },
    {
      "bom-ref": "6a27143c-8591-41e8-b2aa-a0aa8c536a62",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae"
        }
      ]
    },
    {
      "bom-ref": "4b946027-3ca8-4d42-ab44-c23777506fba",
      "id": "CVE-2022-42011",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.",
      "affects": [
        {
          "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d"
        }
      ]
    },
    {
      "bom-ref": "bde214f9-7e9a-41c4-b066-ec91d31f051a",
      "id": "CVE-2022-42012",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.",
      "affects": [
        {
          "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d"
        }
      ]
    },
    {
      "bom-ref": "72507057-c5c4-4aab-9b2e-661444f04013",
      "id": "CVE-2023-34969",
      "description": "D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.",
      "affects": [
        {
          "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d"
        }
      ]
    },
    {
      "bom-ref": "04d165c8-86d7-4a24-94fc-c0f8f42eb6c6",
      "id": "CVE-2022-31212",
      "description": "An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.",
      "affects": [
        {
          "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d"
        }
      ]
    },
    {
      "bom-ref": "9afde91a-37af-4037-a1a3-55af6e60d8b9",
      "id": "CVE-2022-31213",
      "description": "An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.",
      "affects": [
        {
          "ref": "36c46d40-d57b-4daf-b06d-9fc087da666d"
        }
      ]
    },
    {
      "bom-ref": "7dcb0dd1-37d7-4e4a-8cd1-baf3bf376fc6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "2e360864-663f-4d23-b14c-a77433dec78a"
        }
      ]
    },
    {
      "bom-ref": "04c8842a-53aa-43c6-8631-bf1f3d009c90",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "2e360864-663f-4d23-b14c-a77433dec78a"
        }
      ]
    },
    {
      "bom-ref": "83404df0-d268-471c-9506-c4c2ab551e1d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "2e360864-663f-4d23-b14c-a77433dec78a"
        }
      ]
    },
    {
      "bom-ref": "e1289d6b-397b-4a90-9050-e246e7aa3ba6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "2e360864-663f-4d23-b14c-a77433dec78a"
        }
      ]
    },
    {
      "bom-ref": "d6755f1f-746b-4585-be1f-911b79454ebe",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "2e360864-663f-4d23-b14c-a77433dec78a"
        }
      ]
    },
    {
      "bom-ref": "4d315362-cf59-428f-b062-fbc245475063",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "2e360864-663f-4d23-b14c-a77433dec78a"
        }
      ]
    },
    {
      "bom-ref": "57c92cdf-fff2-4093-9ea7-bea4571864a2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167"
        }
      ]
    },
    {
      "bom-ref": "dcb00366-fd9a-4a47-8a38-13a963ac3d2e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167"
        }
      ]
    },
    {
      "bom-ref": "181066e7-16a5-4828-a419-b5f11b616e4a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167"
        }
      ]
    },
    {
      "bom-ref": "fedb694b-f6d7-44f9-82f8-155ea316e4f4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167"
        }
      ]
    },
    {
      "bom-ref": "d3a446b4-bfa6-4f10-b179-2dc4b9997738",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167"
        }
      ]
    },
    {
      "bom-ref": "169cea7b-6a8e-4827-970a-2b886c6ea656",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "30f0a968-3cd6-4592-a9bf-9d05128a3167"
        }
      ]
    },
    {
      "bom-ref": "9ba8ac70-1607-4ff3-8ea4-d4579047a86f",
      "id": "CVE-2022-25314",
      "description": "In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "a3e468d0-c839-407f-bed7-615919235168",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "339b58f0-37e2-4844-96a4-6327616759d7"
        }
      ]
    },
    {
      "bom-ref": "4023fd07-bbb3-4814-be2e-ba845d2afa64",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "392814e2-ab6b-422c-8458-9808c4a23524"
        }
      ]
    },
    {
      "bom-ref": "f77d422c-63a0-4629-8cc6-2b4aef5b95a6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "38065d2b-00ef-4414-863c-d02ec5a0f5bb"
        }
      ]
    },
    {
      "bom-ref": "fc835cbf-4994-4195-9dbc-b63da5e898b1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "352009de-affe-4229-a504-8bec9789a5e1"
        }
      ]
    },
    {
      "bom-ref": "e0490219-3ae5-42d7-935c-c03320954c0f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "352009de-affe-4229-a504-8bec9789a5e1"
        }
      ]
    },
    {
      "bom-ref": "f0979951-d028-4688-815f-0bd9f849fc47",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "352009de-affe-4229-a504-8bec9789a5e1"
        }
      ]
    },
    {
      "bom-ref": "aa94673b-ed0c-4251-9a96-efc67cc81126",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "352009de-affe-4229-a504-8bec9789a5e1"
        }
      ]
    },
    {
      "bom-ref": "278bf76f-be15-4392-9a9f-cd2f8c48efa2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "352009de-affe-4229-a504-8bec9789a5e1"
        }
      ]
    },
    {
      "bom-ref": "acc14292-39f1-478c-ad00-66136377998b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "352009de-affe-4229-a504-8bec9789a5e1"
        }
      ]
    },
    {
      "bom-ref": "f0818941-5fdf-4b87-a3d2-72dc9f03eaab",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "394dead1-88b9-4d51-a5e7-39d4d110278f"
        }
      ]
    },
    {
      "bom-ref": "80266d32-9bfb-4bbc-a890-a8dd01c5843c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3a4b50ef-ee7e-400e-ba26-5468d633c1d2"
        }
      ]
    },
    {
      "bom-ref": "9b355274-d7d7-476b-9207-241b32405a10",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "39eaefb2-5695-4868-b246-1d81766a35d2"
        }
      ]
    },
    {
      "bom-ref": "66f3f8d0-4aae-4d49-b950-014b37f0d4b3",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3a10d783-5d15-489f-9c54-fa16fbcf525f"
        }
      ]
    },
    {
      "bom-ref": "12e93bd1-d94a-42b5-8cf6-866b4f870337",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3a190b27-e968-4393-a29a-faeffd7e1b39"
        }
      ]
    },
    {
      "bom-ref": "3ff63d9d-1bc6-4d78-ab38-f6c21e8cc96b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3ba022dd-3e45-4df4-a3a8-a8e69ea32934"
        }
      ]
    },
    {
      "bom-ref": "a2b17cf8-5317-4cbc-a6ab-e8c9970f1536",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3aa752bf-b130-4409-bbe2-4671835d48bf"
        }
      ]
    },
    {
      "bom-ref": "f0ea1a22-aad7-4d84-9713-ca6905934c27",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3b5a5f8a-9292-4c30-ad09-23146d7c9310"
        }
      ]
    },
    {
      "bom-ref": "c02c51f8-1d1d-4d21-9c71-aae3690620d8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3ba826c4-5e60-40fc-8fdd-c805a95cbbcb"
        }
      ]
    },
    {
      "bom-ref": "69d5ef9d-bc88-4c2e-aef9-1daa3bc5cd07",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3c7fbd8b-2ccf-49d1-80da-495164b9e28a"
        }
      ]
    },
    {
      "bom-ref": "29ce5804-2ef0-411f-b1b3-27dd6da52b0e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a"
        }
      ]
    },
    {
      "bom-ref": "0ec9e86e-85d4-47ce-bebf-cc975d8c10fe",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a"
        }
      ]
    },
    {
      "bom-ref": "db0eb618-fc3e-4a80-8c14-39e3e087e729",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a"
        }
      ]
    },
    {
      "bom-ref": "9a4ea4df-4072-48b9-b293-3e236c0d6459",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a"
        }
      ]
    },
    {
      "bom-ref": "0f775699-5c3f-454d-8178-82976ed31488",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a"
        }
      ]
    },
    {
      "bom-ref": "2d1c403c-ee39-4911-bdb5-e7de7a75678b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "39a9a7f5-ca26-432e-90bb-5335966d170a"
        }
      ]
    },
    {
      "bom-ref": "35f19e11-123c-4a20-a3ed-eaca6a4d9171",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3602626e-d793-4371-9d01-4bea16003ee2"
        }
      ]
    },
    {
      "bom-ref": "163b5088-1e3c-4a75-842a-d450f9795280",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3602626e-d793-4371-9d01-4bea16003ee2"
        }
      ]
    },
    {
      "bom-ref": "cf7bb645-e3b7-43f4-a1a3-c36dd96a6d5d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3602626e-d793-4371-9d01-4bea16003ee2"
        }
      ]
    },
    {
      "bom-ref": "e9211d09-19b2-44cd-aff4-13d4bde722e3",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3602626e-d793-4371-9d01-4bea16003ee2"
        }
      ]
    },
    {
      "bom-ref": "f02f82ba-c6c9-49b3-b992-c87e029ded73",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3602626e-d793-4371-9d01-4bea16003ee2"
        }
      ]
    },
    {
      "bom-ref": "6198659c-1dd2-4e49-8747-c284b6ebb1b4",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3602626e-d793-4371-9d01-4bea16003ee2"
        }
      ]
    },
    {
      "bom-ref": "28e08185-a83e-4007-b88d-a58a66cd726d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "37665345-af4f-4243-b58a-d7f045290c8d"
        }
      ]
    },
    {
      "bom-ref": "5aecea9a-8e82-41dd-a8ef-34729576b68f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "37665345-af4f-4243-b58a-d7f045290c8d"
        }
      ]
    },
    {
      "bom-ref": "137de914-8c52-4a32-915f-4972f50273d3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "37665345-af4f-4243-b58a-d7f045290c8d"
        }
      ]
    },
    {
      "bom-ref": "5c0c3108-bfdd-4007-948a-de92c5027aa6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "37665345-af4f-4243-b58a-d7f045290c8d"
        }
      ]
    },
    {
      "bom-ref": "93037b78-c99b-4dcb-8127-95b6665509fe",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "37665345-af4f-4243-b58a-d7f045290c8d"
        }
      ]
    },
    {
      "bom-ref": "f1e14b84-2c72-4616-812f-33040675fba3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "37665345-af4f-4243-b58a-d7f045290c8d"
        }
      ]
    },
    {
      "bom-ref": "0e32c240-63c0-4bc7-b9c2-77508287d8e4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3d2203c9-122a-49e9-9bb5-61077c5ea0c4"
        }
      ]
    },
    {
      "bom-ref": "04ba01f2-da6a-419f-92d9-0cbd17576273",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5"
        }
      ]
    },
    {
      "bom-ref": "eb7bcd48-f51b-4008-abde-334857a0c803",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5"
        }
      ]
    },
    {
      "bom-ref": "d245b817-612b-4bf6-a04e-167c2073c514",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5"
        }
      ]
    },
    {
      "bom-ref": "1ca64fc5-d56b-46ac-bf94-206ff66f85e5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5"
        }
      ]
    },
    {
      "bom-ref": "58398125-55ec-4505-8412-301ab6f48a01",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5"
        }
      ]
    },
    {
      "bom-ref": "2e20739c-c585-4482-871b-6e09875d528b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "37e1056e-33e0-4667-b0bf-0056838bf2c5"
        }
      ]
    },
    {
      "bom-ref": "afacdfbd-cd2e-4eb4-a87f-ceceb7d312c2",
      "id": "CVE-2023-4408",
      "description": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "41bc6a46-f62c-410f-8151-2aeb1de7b622",
      "id": "CVE-2023-5517",
      "description": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect \u003cdomain\u003e;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "9f82e755-c301-4bbe-b4e1-be5ddb026514",
      "id": "CVE-2023-5679",
      "description": "A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "17071a7c-6d30-4688-a07d-c0a4ad8af09f",
      "id": "CVE-2023-5680",
      "description": "If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. \nThis issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "5a39df12-ef4b-4f27-9cae-a5bc2f8fc8e3",
      "id": "CVE-2024-0760",
      "description": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "0c12a27c-a418-483c-a199-9c1d801bbe64",
      "id": "CVE-2024-11187",
      "description": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "874bed3d-2b94-43b0-8370-7e1a31c35b71",
      "id": "CVE-2024-12705",
      "description": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "b9c7f222-4e56-40e5-b1f1-99c61f776dea",
      "id": "CVE-2024-1737",
      "description": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "e29cb5a8-6145-46f9-a735-658eb3632ca0",
      "id": "CVE-2024-1975",
      "description": "If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "3f25e91e-651c-4d22-9ae1-b914dd070f0f",
      "id": "CVE-2024-4076",
      "description": "Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "59337436-0b62-453e-ac25-8f107d387156",
      "id": "CVE-2025-40776",
      "description": "A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "2ca6106b-db92-45d2-92a4-ca5834791808",
      "id": "CVE-2025-40778",
      "description": "Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "387400be-e5ec-49ba-a56f-c2e4edc75f03",
      "id": "CVE-2025-40780",
      "description": "In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "8561a877-91df-42fc-af15-a08714874480",
      "id": "CVE-2025-8677",
      "description": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "10ed6e29-cf70-44ae-b35b-4dacb24208e6",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "f8cd8673-35ef-46b3-91bd-627e4de9e864",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3de5594f-6a9f-4559-8639-5df90e2324e1"
        }
      ]
    },
    {
      "bom-ref": "d97f0e86-4798-44dc-9543-9ef5a1127fb8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3e661179-3ba9-4e42-bbf8-b0a1b53140fa"
        }
      ]
    },
    {
      "bom-ref": "1a3eada8-f2b5-4fa6-a5a9-5e675a20de9d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "38994767-2a3b-4549-ab7c-599b8344c871"
        }
      ]
    },
    {
      "bom-ref": "ca65d50c-57f9-4130-ac75-593bd7f12101",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "38994767-2a3b-4549-ab7c-599b8344c871"
        }
      ]
    },
    {
      "bom-ref": "aa2e8524-2a81-44b9-b566-c8adec16868f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "38994767-2a3b-4549-ab7c-599b8344c871"
        }
      ]
    },
    {
      "bom-ref": "7c1e2825-f0e5-4ad5-a10f-2e51c460aff2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "38994767-2a3b-4549-ab7c-599b8344c871"
        }
      ]
    },
    {
      "bom-ref": "8dd912e3-154f-45a7-a6f8-a6b7a8a40ae7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "38994767-2a3b-4549-ab7c-599b8344c871"
        }
      ]
    },
    {
      "bom-ref": "316a2ea0-df21-4814-ba16-f03268e98112",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "38994767-2a3b-4549-ab7c-599b8344c871"
        }
      ]
    },
    {
      "bom-ref": "c8bf931b-a7dc-4009-9d58-9e8b58e566d6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1"
        }
      ]
    },
    {
      "bom-ref": "5fb1cf9c-38f0-4dc4-a89c-88d11da08acc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1"
        }
      ]
    },
    {
      "bom-ref": "9fd68b83-f922-4359-b746-cca8d7d9547e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1"
        }
      ]
    },
    {
      "bom-ref": "650b054b-a1c5-492a-a237-cedad777edc5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1"
        }
      ]
    },
    {
      "bom-ref": "688ceffe-a08b-403a-a524-86ec546c865c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1"
        }
      ]
    },
    {
      "bom-ref": "e7436566-412d-4014-ae9c-3b085a0a0d04",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3d2df0c9-af3e-41d2-8ede-a6107489bba1"
        }
      ]
    },
    {
      "bom-ref": "7d4b492a-2140-4644-8eab-f3c190d91ddf",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "40855a63-7302-4a22-ae16-6ea08c5cb38b"
        }
      ]
    },
    {
      "bom-ref": "34a203d2-5efb-42e4-a478-f7b0d7af52fe",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae"
        }
      ]
    },
    {
      "bom-ref": "3d26db1d-1932-4fe6-a678-6123850bf9f0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae"
        }
      ]
    },
    {
      "bom-ref": "20dded76-0514-4442-9976-33c533fb31cc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae"
        }
      ]
    },
    {
      "bom-ref": "fb7f4646-f2ae-4400-b046-400dd34e3a34",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae"
        }
      ]
    },
    {
      "bom-ref": "e017c7d0-9284-4c97-bb7d-bc272eb06026",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "39a7237e-66dd-4d40-befa-a317ad3815ae"
        }
      ]
    },
    {
      "bom-ref": "784c28bf-3760-4570-90c3-bbcedcceaf73",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3fc91083-e27e-449b-ab6f-0b311062a726"
        }
      ]
    },
    {
      "bom-ref": "a8734caa-4ecc-4b0a-a46f-18c982d94b96",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "51905219-d221-4808-be96-38fb2e471941"
        }
      ]
    },
    {
      "bom-ref": "47260ed3-4072-4cc3-bfc1-be4c16f7d84f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3ebc340b-f096-4902-9678-6e0d72315f15"
        }
      ]
    },
    {
      "bom-ref": "3d0f0a7e-c6f7-4040-b70d-d21ec7c85bfc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "3fff1413-d994-4755-ac94-5fd10b5742ff"
        }
      ]
    },
    {
      "bom-ref": "8d931fb2-01b5-49bc-8124-c49dc376f2fe",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "41079c4f-ca22-4850-96b7-c77080de7ee8"
        }
      ]
    },
    {
      "bom-ref": "6759f33f-9f79-4c96-9569-e310e81bf166",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb"
        }
      ]
    },
    {
      "bom-ref": "0a9cd5bf-5cd0-4f60-9508-ab5155b4592e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb"
        }
      ]
    },
    {
      "bom-ref": "f963649c-56c2-4b85-a101-f73a5a4acb8a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb"
        }
      ]
    },
    {
      "bom-ref": "7e966315-2161-431b-8870-354315db8aac",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb"
        }
      ]
    },
    {
      "bom-ref": "ea2b4847-7378-4369-abbe-9adcf7d68664",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb"
        }
      ]
    },
    {
      "bom-ref": "1e160d88-4e14-4ccd-88e7-a1add76e66ca",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3a50daf9-6f5f-49ba-99e0-7cfdc3a537bb"
        }
      ]
    },
    {
      "bom-ref": "389d7b15-fa82-4a25-b8d9-0aed2e921969",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23"
        }
      ]
    },
    {
      "bom-ref": "ec86a3b3-0e49-4f30-a6d5-c142b6b4bf1f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23"
        }
      ]
    },
    {
      "bom-ref": "c059232d-f472-412b-a1db-8800e1930871",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23"
        }
      ]
    },
    {
      "bom-ref": "440e0860-7ba3-4efb-85ae-566f2eee9d8c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23"
        }
      ]
    },
    {
      "bom-ref": "11772323-9a11-4de0-a27c-3f67fdbf1bf7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23"
        }
      ]
    },
    {
      "bom-ref": "0bcd36d5-67dc-4dde-8723-34a3d256369e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "39fb0758-e0cd-4e3a-b549-60c5bba64e23"
        }
      ]
    },
    {
      "bom-ref": "22406668-5f96-4737-b579-052a37217aa7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "24ed1f77-0688-4d28-81fb-75339f77bc8c"
        }
      ]
    },
    {
      "bom-ref": "47e36be4-0c72-4c81-a449-27f1e73576e5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4"
        }
      ]
    },
    {
      "bom-ref": "e3795de2-99a0-4345-a17a-04c2fdafde57",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55"
        }
      ]
    },
    {
      "bom-ref": "f82f91f4-b6ae-40e1-b8fc-776cdbbf45f9",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55"
        }
      ]
    },
    {
      "bom-ref": "c9fca56c-36eb-4d3e-802d-353b2b40d17b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55"
        }
      ]
    },
    {
      "bom-ref": "b0300a82-f9cb-46ab-8526-6096e68f6292",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55"
        }
      ]
    },
    {
      "bom-ref": "5b9a3950-debb-4c89-9d1b-d3f34f15330e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55"
        }
      ]
    },
    {
      "bom-ref": "842837ce-f5e4-45b3-a5c5-e3b6ebc27b16",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3cd8027b-0c49-4c7f-8c4a-9dfe674e2e55"
        }
      ]
    },
    {
      "bom-ref": "ecc90916-1bbb-47ce-91ef-6722c2d1727d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4204bdaf-2f98-47d3-a5ea-934ba2b7121f"
        }
      ]
    },
    {
      "bom-ref": "71230c86-ac70-4fb3-8c1e-cf6f2bafb17b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878"
        }
      ]
    },
    {
      "bom-ref": "21e33294-97f3-4637-a7c3-ffc40c89ebd0",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878"
        }
      ]
    },
    {
      "bom-ref": "23b7fdb9-bb60-469e-bd5d-a8475ffcc25f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878"
        }
      ]
    },
    {
      "bom-ref": "120b2525-5df2-4a9c-bcd7-53087f59f855",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878"
        }
      ]
    },
    {
      "bom-ref": "deeddf2d-0dce-41b9-8446-868c8f9ea52c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878"
        }
      ]
    },
    {
      "bom-ref": "9ed712c0-440d-4e93-bbfc-aacbdcbe94e9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3e55181e-a0c5-4f0f-aed3-d422b259e878"
        }
      ]
    },
    {
      "bom-ref": "f383f1a5-0c07-40b9-80b8-8f24be9c9a44",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "42e41f4d-6779-43d1-8ec5-364c205b8ca2"
        }
      ]
    },
    {
      "bom-ref": "a212e940-dc70-4c86-b25e-2932937f0c84",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0"
        }
      ]
    },
    {
      "bom-ref": "8a256060-0cfa-4990-951a-828b54c5f44e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0"
        }
      ]
    },
    {
      "bom-ref": "d1ba8669-1da6-4590-99ea-d6ec843e61e8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0"
        }
      ]
    },
    {
      "bom-ref": "a7a61598-aa74-4517-99a8-09c3af02c7a5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0"
        }
      ]
    },
    {
      "bom-ref": "08aa77fc-febd-435f-bc1b-4c0bc7e8f6e3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0"
        }
      ]
    },
    {
      "bom-ref": "5851552f-188c-4430-ad51-2270abff67c5",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3a377662-d2ec-4a85-b0d8-e6a924d8fac0"
        }
      ]
    },
    {
      "bom-ref": "6e9b09e7-e504-4e8e-85cf-2174f6e53877",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "434e7e2f-1882-4871-bb3e-467461bd16f3"
        }
      ]
    },
    {
      "bom-ref": "7bdf39db-de90-4f0b-bf7e-af04783c8b8b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664"
        }
      ]
    },
    {
      "bom-ref": "53f50523-e607-4269-b5bc-40141062bbf5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "435121a1-e638-470a-a496-0d1eb40a47a4"
        }
      ]
    },
    {
      "bom-ref": "d82fd561-245f-4aff-9fd3-19a406f9431a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c"
        }
      ]
    },
    {
      "bom-ref": "a8f3f1a7-0784-4e36-869e-b73a8cbfd605",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c"
        }
      ]
    },
    {
      "bom-ref": "aacf20c1-ddd0-4a59-bf05-3c3ea8d057c9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c"
        }
      ]
    },
    {
      "bom-ref": "f674044d-7aa1-4896-9ae5-88dfeb6da797",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c"
        }
      ]
    },
    {
      "bom-ref": "b8aafbea-3187-4294-9a06-5e8a636334c4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c"
        }
      ]
    },
    {
      "bom-ref": "a0b22868-3115-4fa6-a8bb-42811a5d149b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3d369482-8093-4a5b-bc2b-33ddd96d461c"
        }
      ]
    },
    {
      "bom-ref": "b5abb82b-1b58-4a4e-9996-05d83f4bd9fb",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44"
        }
      ]
    },
    {
      "bom-ref": "96024138-2773-4c74-bbac-98629ca2ffec",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44"
        }
      ]
    },
    {
      "bom-ref": "1188fb36-758e-439e-9a30-d69d19e735f1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44"
        }
      ]
    },
    {
      "bom-ref": "1186939e-b6ad-429c-9c58-7c53ac70c409",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44"
        }
      ]
    },
    {
      "bom-ref": "16028bda-e9f5-451e-b155-1ea73f67e8ac",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44"
        }
      ]
    },
    {
      "bom-ref": "16267cd2-737d-44d4-ab2e-38e65bea81ee",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4087ec3e-31c7-4f28-8124-bf39dc58aa44"
        }
      ]
    },
    {
      "bom-ref": "2c79b416-6193-44f6-9d0c-f6a9bff9d599",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "439cb71a-6dc7-4552-aaf8-92605d81d2e2"
        }
      ]
    },
    {
      "bom-ref": "095ba9f7-66cb-4cef-b136-ef164a24e0e0",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "43a2bec0-8675-458e-8a52-118966f8e24e"
        }
      ]
    },
    {
      "bom-ref": "b681ce5e-ebef-4f5c-a7ad-86dbcbb29690",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3f4db854-9960-4349-8711-50fda4c46b00"
        }
      ]
    },
    {
      "bom-ref": "ecb72a37-781a-4a96-a00a-51d4bf367c79",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "441ef7ff-2764-4faf-8d9f-d567404eae6c"
        }
      ]
    },
    {
      "bom-ref": "853dbc6a-d730-4d9c-b0df-4dd4e250986a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "44c1685a-eed1-496e-baec-646f586920ad"
        }
      ]
    },
    {
      "bom-ref": "e745a50d-c5a9-4f6f-a1c9-46fc0d7b624d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3f4db854-9960-4349-8711-50fda4c46b00"
        }
      ]
    },
    {
      "bom-ref": "92ae5132-fb0b-4eac-9c49-d7419540fb50",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3f4db854-9960-4349-8711-50fda4c46b00"
        }
      ]
    },
    {
      "bom-ref": "192bb225-7dbf-4683-baf2-e166ab6ed748",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3f4db854-9960-4349-8711-50fda4c46b00"
        }
      ]
    },
    {
      "bom-ref": "b7100608-14c4-4268-8649-d3dde125cd35",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3f4db854-9960-4349-8711-50fda4c46b00"
        }
      ]
    },
    {
      "bom-ref": "b01271dd-c292-4650-b394-df17003e3382",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3f4db854-9960-4349-8711-50fda4c46b00"
        }
      ]
    },
    {
      "bom-ref": "1143325c-6149-4d8a-8061-40162f06d0b8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a"
        }
      ]
    },
    {
      "bom-ref": "89145850-69ca-4668-bf19-693cec2812ed",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a"
        }
      ]
    },
    {
      "bom-ref": "d3c47745-77f4-4444-a4f9-f91c1104d82d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a"
        }
      ]
    },
    {
      "bom-ref": "d0b74664-0f4f-4b9b-9f18-2bdf87c2d698",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a"
        }
      ]
    },
    {
      "bom-ref": "31416d84-eb3f-4199-9faa-82c50ea196e8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a"
        }
      ]
    },
    {
      "bom-ref": "f611079b-b7c7-4063-904e-734d2c4acd6c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "41e8fd85-81cf-4779-a7ae-119e2f814b9a"
        }
      ]
    },
    {
      "bom-ref": "d11609df-4f0f-4d54-9318-3a5a97d13b63",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4087f86a-e003-4028-93db-09398778ede1"
        }
      ]
    },
    {
      "bom-ref": "d7eb7322-a87d-48d7-b571-5988678c1384",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4087f86a-e003-4028-93db-09398778ede1"
        }
      ]
    },
    {
      "bom-ref": "f0606987-df09-46d3-8275-16dfd5ce5a01",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4087f86a-e003-4028-93db-09398778ede1"
        }
      ]
    },
    {
      "bom-ref": "6bc63a9e-c9cc-42e3-a5f7-a249c764de3b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4087f86a-e003-4028-93db-09398778ede1"
        }
      ]
    },
    {
      "bom-ref": "05b8da18-6fbd-4940-b566-abac131c9753",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4087f86a-e003-4028-93db-09398778ede1"
        }
      ]
    },
    {
      "bom-ref": "19d93960-743a-42fc-a189-f36c7ea9a07e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4087f86a-e003-4028-93db-09398778ede1"
        }
      ]
    },
    {
      "bom-ref": "66412b23-2956-4f9e-a4fb-d2a035e116d1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb"
        }
      ]
    },
    {
      "bom-ref": "6866d07e-0bd0-4185-9441-d590e97aa7cf",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb"
        }
      ]
    },
    {
      "bom-ref": "5d6c6e48-2aa6-485b-983c-f48ab48997f1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb"
        }
      ]
    },
    {
      "bom-ref": "52c28d33-a03b-4796-9ee0-cdbbc33ebf04",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb"
        }
      ]
    },
    {
      "bom-ref": "52a4a6c0-5b14-4069-a206-55222e5dab56",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb"
        }
      ]
    },
    {
      "bom-ref": "bdbcbbb2-8688-49f7-b333-a11d096f6444",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "3fde8c74-738d-4953-89fd-692b06cbf8bb"
        }
      ]
    },
    {
      "bom-ref": "a7ffd0e0-7f89-43f1-af85-08736388bb4d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3"
        }
      ]
    },
    {
      "bom-ref": "ba81050f-dcc2-44d0-89d2-418cf268aa36",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3"
        }
      ]
    },
    {
      "bom-ref": "e3624d9e-b64e-4c1c-8d6c-e263402f36d1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3"
        }
      ]
    },
    {
      "bom-ref": "545a32cb-ef8d-44c9-ac9f-03b792b1856a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3"
        }
      ]
    },
    {
      "bom-ref": "d257d450-4ecc-47f4-927e-0ff24ad76ebc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3"
        }
      ]
    },
    {
      "bom-ref": "a2258746-628f-4c42-9184-5bb80b7aa615",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "41945a08-84fa-4d2b-bfbe-775bd897c0d3"
        }
      ]
    },
    {
      "bom-ref": "d7dfa3e5-05b9-44a3-9a93-1eb83729fd0a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581"
        }
      ]
    },
    {
      "bom-ref": "9404616a-5070-4c45-8573-f8eef4b7bfe1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581"
        }
      ]
    },
    {
      "bom-ref": "31bcd21b-d1f0-4135-9f17-9bda201ae21f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581"
        }
      ]
    },
    {
      "bom-ref": "be6c3c54-044c-4541-96e4-626cfe11c3a5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581"
        }
      ]
    },
    {
      "bom-ref": "73700b98-47bd-4cf0-b10a-621fd3fc4476",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581"
        }
      ]
    },
    {
      "bom-ref": "00ea9317-4f6c-454e-a145-0267b9717f04",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "40efea2f-217a-452b-8bd2-7a1051cc9581"
        }
      ]
    },
    {
      "bom-ref": "39ed7e76-2808-457f-8df4-5ce44be5534d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "46d706e8-5430-4e0f-832d-6545a0cc22b7"
        }
      ]
    },
    {
      "bom-ref": "8ca04134-fd09-4086-bb17-1149a68022e0",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c"
        }
      ]
    },
    {
      "bom-ref": "09953505-67c3-40f3-9f31-15dc82f589dc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "45e19610-fcd2-4cf9-b84f-1207b7a5bbac"
        }
      ]
    },
    {
      "bom-ref": "ccace97d-34a6-4e2d-b70c-162ff5bc17d4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "26d6f170-baad-49ad-85e7-793c95342ee0",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4746a1ce-01e3-4d44-b1a4-050a27056baf"
        }
      ]
    },
    {
      "bom-ref": "60fd9190-8241-42c4-9867-ec07902a6009",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "42495f05-f540-441e-ac6c-43fd89748be1"
        }
      ]
    },
    {
      "bom-ref": "db382c82-4f6a-4e89-8f8e-a5ce545288d8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "42495f05-f540-441e-ac6c-43fd89748be1"
        }
      ]
    },
    {
      "bom-ref": "25b26a35-fcc7-4037-829e-c3fce0711c01",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "42495f05-f540-441e-ac6c-43fd89748be1"
        }
      ]
    },
    {
      "bom-ref": "e97942b2-a770-4280-9ddc-259ba74639ce",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "42495f05-f540-441e-ac6c-43fd89748be1"
        }
      ]
    },
    {
      "bom-ref": "e9d02ecf-d8d7-46e1-bb24-6b02ac949132",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "42495f05-f540-441e-ac6c-43fd89748be1"
        }
      ]
    },
    {
      "bom-ref": "47bc9043-7b73-42b3-b179-506086bac0ce",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "42495f05-f540-441e-ac6c-43fd89748be1"
        }
      ]
    },
    {
      "bom-ref": "cddd603f-69ae-4dc9-9bcd-9267e943936a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4685d60b-de6a-44f1-b43d-073d5276e20b"
        }
      ]
    },
    {
      "bom-ref": "504b3ed0-25f9-4943-8a25-a7ddb3ee9fe1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1"
        }
      ]
    },
    {
      "bom-ref": "6a58fed2-5b10-4628-9de3-3651796deee2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107"
        }
      ]
    },
    {
      "bom-ref": "e2b9afc1-a412-43bc-b3bb-56bbaaec59d8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107"
        }
      ]
    },
    {
      "bom-ref": "4495fee1-f423-47bd-91ac-3204a7c5452c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107"
        }
      ]
    },
    {
      "bom-ref": "cd932b9b-8f0b-4578-bef1-638f6b6ddd2e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107"
        }
      ]
    },
    {
      "bom-ref": "2d22085d-9c51-402f-8725-5299e48202da",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107"
        }
      ]
    },
    {
      "bom-ref": "31dff0ea-3bfd-4abc-aba8-d0eb48e290fd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4415e9f5-6aa0-4676-b9fb-ff5485d70107"
        }
      ]
    },
    {
      "bom-ref": "d180247f-0eb5-4adf-9651-692e6e1519db",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "482604d2-b02c-4367-a3b7-eefee89464d2"
        }
      ]
    },
    {
      "bom-ref": "13a0e9ba-4400-4b4c-a7dc-db2786343c19",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd"
        }
      ]
    },
    {
      "bom-ref": "1cc4064e-6915-4b65-b9bf-221fad7af3d8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd"
        }
      ]
    },
    {
      "bom-ref": "13d1e32e-18fa-41d0-b229-49683b2b4fde",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd"
        }
      ]
    },
    {
      "bom-ref": "b4994553-1940-45b5-9dba-8e3f9248901d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd"
        }
      ]
    },
    {
      "bom-ref": "f2bb156d-fc81-4e29-8b76-08b51eeece4b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd"
        }
      ]
    },
    {
      "bom-ref": "c9d0d6fc-82a9-4ae7-959b-15c4cd87573c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "425c2696-464a-43a3-abc3-6d66414f9cdd"
        }
      ]
    },
    {
      "bom-ref": "810f8f4a-e6c2-4044-a18b-dbca11605fd8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "48329e94-0548-4475-9626-c61048289e1a"
        }
      ]
    },
    {
      "bom-ref": "e8fa1d3e-bca3-4c36-9df4-6f0e34b4eebe",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "48329e94-0548-4475-9626-c61048289e1a"
        }
      ]
    },
    {
      "bom-ref": "cdabfc8b-aca7-432c-a55c-eb783af9525f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "48329e94-0548-4475-9626-c61048289e1a"
        }
      ]
    },
    {
      "bom-ref": "3b6c3d36-18a0-4610-8dac-f13fa5c8de0f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "48329e94-0548-4475-9626-c61048289e1a"
        }
      ]
    },
    {
      "bom-ref": "5e097a74-9746-470b-91f0-7287347843ae",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "48329e94-0548-4475-9626-c61048289e1a"
        }
      ]
    },
    {
      "bom-ref": "e4de401d-f0db-4783-afcd-042c383e9be6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "48329e94-0548-4475-9626-c61048289e1a"
        }
      ]
    },
    {
      "bom-ref": "50b2373a-e60c-4536-b25d-16547d479798",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "42f37526-a806-4105-be92-ea6d72cd0af2"
        }
      ]
    },
    {
      "bom-ref": "a3745317-a627-4180-9f0b-892813a8c2fd",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "42f37526-a806-4105-be92-ea6d72cd0af2"
        }
      ]
    },
    {
      "bom-ref": "8bd944b7-44b8-4016-8628-5667ba32c50e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "42f37526-a806-4105-be92-ea6d72cd0af2"
        }
      ]
    },
    {
      "bom-ref": "61c6e6ac-c242-4af0-ab12-aabf0e0b5dd9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "42f37526-a806-4105-be92-ea6d72cd0af2"
        }
      ]
    },
    {
      "bom-ref": "3f049120-8b8a-4e72-9611-fc8c85cb2e7f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "42f37526-a806-4105-be92-ea6d72cd0af2"
        }
      ]
    },
    {
      "bom-ref": "bea1d334-eb98-413d-8ec3-8794fdf67fe3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "42f37526-a806-4105-be92-ea6d72cd0af2"
        }
      ]
    },
    {
      "bom-ref": "ab7ee00a-d9eb-4fc4-bec6-28b8a1d5f8f0",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "49035b95-bef4-4a71-86de-25ab8c2b0fd5"
        }
      ]
    },
    {
      "bom-ref": "e86758dd-177c-4940-acfb-1b99ddb55fba",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4956ce24-ff71-42f2-bcf4-c7c122ac5de1"
        }
      ]
    },
    {
      "bom-ref": "3cd4e553-0838-4a7d-a667-49b0e806c3d5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9"
        }
      ]
    },
    {
      "bom-ref": "bddeb9dd-0e6c-495e-81ef-e58d95997b5e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9"
        }
      ]
    },
    {
      "bom-ref": "08710cd7-0f69-4603-b547-f8860200fb6f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9"
        }
      ]
    },
    {
      "bom-ref": "61b01377-9dbe-41eb-b546-a0d4c174931b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9"
        }
      ]
    },
    {
      "bom-ref": "f21f170a-8496-4dd3-a5c5-8648491ed152",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9"
        }
      ]
    },
    {
      "bom-ref": "0befd0b6-87ac-49a3-b72a-bd5a91f30131",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "473810dd-e8de-458b-8aac-eb1e4c27f3f9"
        }
      ]
    },
    {
      "bom-ref": "8be3b698-755f-46f2-b468-55c5c60475aa",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407"
        }
      ]
    },
    {
      "bom-ref": "013ef525-afcc-4898-b456-2c659ae1aae2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407"
        }
      ]
    },
    {
      "bom-ref": "aa706f29-1372-4eeb-85ba-c2d599dda13c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407"
        }
      ]
    },
    {
      "bom-ref": "ed79c030-19b6-49bd-8b9e-a6e912d039d2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407"
        }
      ]
    },
    {
      "bom-ref": "f90ff626-5c15-4533-9f81-cde0e9fdb672",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407"
        }
      ]
    },
    {
      "bom-ref": "69f85c8c-f525-450d-9c00-2f61a6618a4b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "447bd9ea-d23e-41ac-9db5-99e8cc330407"
        }
      ]
    },
    {
      "bom-ref": "344d42be-234d-4051-b158-909b39e39e2b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "49c1d847-32ff-4a14-a82f-ed655ed74603"
        }
      ]
    },
    {
      "bom-ref": "b7bcf0c6-e346-4b30-b614-4800faf26f7b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4aefedb0-4e17-49a9-9c10-203bd7cb84fe"
        }
      ]
    },
    {
      "bom-ref": "a206c952-bca2-4ebf-a9b4-60a69d9b71d4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "47d093b0-b683-4075-860b-4e9a4401baed"
        }
      ]
    },
    {
      "bom-ref": "5c876cca-2d0f-4e27-9eeb-9f514aca18d5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "47d093b0-b683-4075-860b-4e9a4401baed"
        }
      ]
    },
    {
      "bom-ref": "ff0b4494-3c5b-4f1e-badc-6f7c36e57919",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "47d093b0-b683-4075-860b-4e9a4401baed"
        }
      ]
    },
    {
      "bom-ref": "552b7a9c-f775-47a9-a6af-7266dc69e6b1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "47d093b0-b683-4075-860b-4e9a4401baed"
        }
      ]
    },
    {
      "bom-ref": "c9d31b68-94b8-47bb-a990-be9d7fa970eb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "47d093b0-b683-4075-860b-4e9a4401baed"
        }
      ]
    },
    {
      "bom-ref": "f9c6a925-b140-4b5d-a8da-fe2ef12eecc9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "47d093b0-b683-4075-860b-4e9a4401baed"
        }
      ]
    },
    {
      "bom-ref": "4a85116f-6611-4e8f-bc43-23efdeabd046",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "44546e8a-104d-477d-ab63-86d8d84d323f"
        }
      ]
    },
    {
      "bom-ref": "c3e167dd-f0f6-484e-b8af-11068e3a2509",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "44546e8a-104d-477d-ab63-86d8d84d323f"
        }
      ]
    },
    {
      "bom-ref": "c6e1a2c4-d515-48ce-9676-50dca7ee795f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "44546e8a-104d-477d-ab63-86d8d84d323f"
        }
      ]
    },
    {
      "bom-ref": "16059ea5-f633-4c55-b82e-42b01a592cd2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "44546e8a-104d-477d-ab63-86d8d84d323f"
        }
      ]
    },
    {
      "bom-ref": "bf111c6e-23ce-4efc-a79d-9aa7a6c46e3a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "44546e8a-104d-477d-ab63-86d8d84d323f"
        }
      ]
    },
    {
      "bom-ref": "201e5243-6a89-4d46-bfbd-d8e60b921e6b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "44546e8a-104d-477d-ab63-86d8d84d323f"
        }
      ]
    },
    {
      "bom-ref": "7b7718a1-f058-48c8-be6b-d38b6b34334f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4513bb30-7232-4791-b6f5-14db554d7415"
        }
      ]
    },
    {
      "bom-ref": "e828638f-633c-45aa-a824-013fe045fb82",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4513bb30-7232-4791-b6f5-14db554d7415"
        }
      ]
    },
    {
      "bom-ref": "94a5e488-216d-46f8-a644-35d2639c0245",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4513bb30-7232-4791-b6f5-14db554d7415"
        }
      ]
    },
    {
      "bom-ref": "6dfd3e9f-6cde-42da-92d7-0e62c11a9b78",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4513bb30-7232-4791-b6f5-14db554d7415"
        }
      ]
    },
    {
      "bom-ref": "0b104238-2efb-4975-8501-0854c4756a6b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4513bb30-7232-4791-b6f5-14db554d7415"
        }
      ]
    },
    {
      "bom-ref": "8e649b06-5114-4f5c-9929-ec16449e5001",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4513bb30-7232-4791-b6f5-14db554d7415"
        }
      ]
    },
    {
      "bom-ref": "04b08a6d-c68c-4ee8-8b5d-3d9c6adca82f",
      "id": "CVE-2022-42010",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.",
      "affects": [
        {
          "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e"
        }
      ]
    },
    {
      "bom-ref": "d139a548-239a-4160-8e24-7e5ebad13916",
      "id": "CVE-2022-42011",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.",
      "affects": [
        {
          "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e"
        }
      ]
    },
    {
      "bom-ref": "1cb04961-2c0e-4b9c-80c9-945a245ce188",
      "id": "CVE-2022-42012",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.",
      "affects": [
        {
          "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e"
        }
      ]
    },
    {
      "bom-ref": "5df5477c-1d8e-4716-ba50-afa0d9438a86",
      "id": "CVE-2023-34969",
      "description": "D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.",
      "affects": [
        {
          "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e"
        }
      ]
    },
    {
      "bom-ref": "4663e429-5f30-40ee-aaff-cb909e4f1777",
      "id": "CVE-2022-31212",
      "description": "An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.",
      "affects": [
        {
          "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e"
        }
      ]
    },
    {
      "bom-ref": "01a28458-ff45-4c72-b289-420f54e59816",
      "id": "CVE-2022-31213",
      "description": "An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.",
      "affects": [
        {
          "ref": "4b260df9-54b6-4238-8fc5-3eced7a8397e"
        }
      ]
    },
    {
      "bom-ref": "4725365d-0a31-432d-85ef-eb746689b12b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559"
        }
      ]
    },
    {
      "bom-ref": "75f4494c-7cc3-4fdf-a684-787603ae3519",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559"
        }
      ]
    },
    {
      "bom-ref": "2297e17d-e455-4dfa-8c65-2df2959a8831",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559"
        }
      ]
    },
    {
      "bom-ref": "35248016-8132-4855-838d-ad0339a3f294",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559"
        }
      ]
    },
    {
      "bom-ref": "f487a9e6-d001-4542-bf3b-7346b3726c69",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559"
        }
      ]
    },
    {
      "bom-ref": "5d74c715-72c8-4967-9a8c-ad0b5e89a64f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "48cf91df-34d4-48dd-bcad-785bbcf37559"
        }
      ]
    },
    {
      "bom-ref": "b5f7f939-b16b-4f45-8214-51689141c2b2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4a513490-9b4f-4fd5-ada5-698590cf995f"
        }
      ]
    },
    {
      "bom-ref": "a8281026-dd32-4a6d-8f46-0f6d333918c1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4853f410-66f0-44f6-bdc3-f1dfe4c5ac1e"
        }
      ]
    },
    {
      "bom-ref": "80b46feb-19aa-4636-b5d2-9abbe1717168",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4bcbacda-6ca3-47a4-9a5b-bd767d49cb5a"
        }
      ]
    },
    {
      "bom-ref": "cf15e9e2-4200-4cab-8ad2-652e13decdc6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4bdac274-9fff-40e9-ad52-c75d8127488e"
        }
      ]
    },
    {
      "bom-ref": "0b0b52be-e9ca-4c00-a1d5-8034cdba525c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce"
        }
      ]
    },
    {
      "bom-ref": "5d74f672-23a1-43e0-a4d7-3acee3523018",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4b53b9f1-4dff-40b4-9286-a9523ecff1f4"
        }
      ]
    },
    {
      "bom-ref": "4ddbc579-6fdc-49a9-a5d3-958b50069f35",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce"
        }
      ]
    },
    {
      "bom-ref": "a173ae44-b13d-4b22-84f0-62bd4feffd97",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce"
        }
      ]
    },
    {
      "bom-ref": "e8675760-82e7-4ba9-bb68-7d4b7090a34c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce"
        }
      ]
    },
    {
      "bom-ref": "322745fb-8c0d-4144-ac71-3d481fbc7346",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce"
        }
      ]
    },
    {
      "bom-ref": "11316d54-1d90-4f02-b851-0d83dd084a8f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4585e883-24b3-4bcf-9e66-afe652c35dce"
        }
      ]
    },
    {
      "bom-ref": "6ed592dc-1eda-4f70-9e08-1d1e635b3045",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "47576937-4e6c-473e-96b5-61b96494dacb"
        }
      ]
    },
    {
      "bom-ref": "26817e6a-30f4-4cb4-8656-0a20ba17b8c2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "47576937-4e6c-473e-96b5-61b96494dacb"
        }
      ]
    },
    {
      "bom-ref": "e86a6f20-eaf0-4d27-90cf-aca3049a47c2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "47576937-4e6c-473e-96b5-61b96494dacb"
        }
      ]
    },
    {
      "bom-ref": "0f030928-4c12-4b5a-b752-cd8068f1febc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "47576937-4e6c-473e-96b5-61b96494dacb"
        }
      ]
    },
    {
      "bom-ref": "97a0d426-7a60-4f66-be19-cb90bc7e1e54",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "47576937-4e6c-473e-96b5-61b96494dacb"
        }
      ]
    },
    {
      "bom-ref": "79bda0a0-5469-47d1-8469-bd3b5eb3d492",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "47576937-4e6c-473e-96b5-61b96494dacb"
        }
      ]
    },
    {
      "bom-ref": "65d7bc12-29fa-4c4e-8b1a-7021af6939fa",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4caa45a8-604f-47b0-a4f4-f88a9e322b2e"
        }
      ]
    },
    {
      "bom-ref": "1e72f8c5-0f10-46e7-a496-18e53f8fefc5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4c797086-6591-4e50-9559-68c1bf62663b"
        }
      ]
    },
    {
      "bom-ref": "3d2e31bc-b870-4229-aa36-bd425379eebe",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4c41e368-b432-4b6a-a733-16f6eb832a0f"
        }
      ]
    },
    {
      "bom-ref": "3ff212b8-6dbb-4258-8ca9-6edcd852faf9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "46a86fc3-e294-4953-8376-86d36b032f64"
        }
      ]
    },
    {
      "bom-ref": "37af1d9b-5630-4c0e-a5a6-8173ec261fc6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "46a86fc3-e294-4953-8376-86d36b032f64"
        }
      ]
    },
    {
      "bom-ref": "ce9ccdd7-6a56-443a-bbd2-5e926a409878",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "46a86fc3-e294-4953-8376-86d36b032f64"
        }
      ]
    },
    {
      "bom-ref": "d98d5218-1646-4357-aa4f-98eb2ecf63ec",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "46a86fc3-e294-4953-8376-86d36b032f64"
        }
      ]
    },
    {
      "bom-ref": "bcaca6c1-5733-4830-9d80-5588003b3da4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "46a86fc3-e294-4953-8376-86d36b032f64"
        }
      ]
    },
    {
      "bom-ref": "aa386c58-d9a1-47a3-b7e3-41d0d9813e6a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "46a86fc3-e294-4953-8376-86d36b032f64"
        }
      ]
    },
    {
      "bom-ref": "3fa714c4-d306-49fb-9b7a-b8593933b2ae",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4e5403fa-c568-40f0-8185-188e9e1de442"
        }
      ]
    },
    {
      "bom-ref": "49ea8d39-2bea-4dda-b1ce-e3fd86a43548",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4e52c62f-321b-4f33-82fd-6e712a90d172"
        }
      ]
    },
    {
      "bom-ref": "c0470e07-eea2-4308-9ef0-fa95025b0512",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "47467983-a44a-4b1a-8956-19051a996111"
        }
      ]
    },
    {
      "bom-ref": "f6fdc32c-7d0c-4604-88fd-aef9a4b326e2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "47467983-a44a-4b1a-8956-19051a996111"
        }
      ]
    },
    {
      "bom-ref": "c40c3710-fa0c-4b64-bc2c-abdb5e301527",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "47467983-a44a-4b1a-8956-19051a996111"
        }
      ]
    },
    {
      "bom-ref": "256ee7a4-b310-4623-8869-1589effda63e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "47467983-a44a-4b1a-8956-19051a996111"
        }
      ]
    },
    {
      "bom-ref": "7f479a3c-a9a0-43d5-aa6e-22132e7d1f1d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "47467983-a44a-4b1a-8956-19051a996111"
        }
      ]
    },
    {
      "bom-ref": "41e47c2f-1625-4d51-8550-0ffa05ce36a1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "47467983-a44a-4b1a-8956-19051a996111"
        }
      ]
    },
    {
      "bom-ref": "53977723-e8da-469a-9a60-1d425f017146",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4eca0355-2c07-4674-aa93-4c683bc56192"
        }
      ]
    },
    {
      "bom-ref": "72d4fc4a-cbbd-4d4d-9818-b0b5f2c0cd3c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4e8751cd-10e0-4e03-bf00-1e0735e6dde5"
        }
      ]
    },
    {
      "bom-ref": "bf2f698d-4167-45a1-8748-0f9e031c4578",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4d2a5794-afcd-4a82-b379-3729e7cecc4c"
        }
      ]
    },
    {
      "bom-ref": "7f1ac056-1302-4672-bc38-ee1a154afb74",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4e99a9cf-91c0-48a2-8228-bc48a76a308d"
        }
      ]
    },
    {
      "bom-ref": "331eb2df-5195-4944-ad36-836816eee09f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9"
        }
      ]
    },
    {
      "bom-ref": "5688306b-40cc-4216-8ff2-0252c8ededb1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9"
        }
      ]
    },
    {
      "bom-ref": "0a582ec8-2f17-4cca-9faa-bb722ac13cea",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9"
        }
      ]
    },
    {
      "bom-ref": "85d8f008-b489-4b25-8ed0-8c03bfc4711a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9"
        }
      ]
    },
    {
      "bom-ref": "36f23c37-b747-44fc-8a7d-c5344675f2f1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9"
        }
      ]
    },
    {
      "bom-ref": "ed7f2886-5a2e-4e64-a35d-76393213beec",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4aff0fd0-0522-4095-b0cc-143ef83020c9"
        }
      ]
    },
    {
      "bom-ref": "55a57c77-cc58-49d6-8e70-02b6a4b72d1c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "50f42a59-59a3-4532-91a5-f0e2bd4057e9"
        }
      ]
    },
    {
      "bom-ref": "63a7159b-42fb-441d-94c5-32f9cdf56aa7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da"
        }
      ]
    },
    {
      "bom-ref": "f6576b65-e960-48bb-a7cd-b37268b4ecf6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4ee1c5ee-20e0-4611-bfed-a9bbf84f10ef"
        }
      ]
    },
    {
      "bom-ref": "8d71859a-db18-4d11-90c5-163846788bdc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "517a24c2-a53a-4d7a-9fbe-d4c85389e0df"
        }
      ]
    },
    {
      "bom-ref": "806dd832-b1e9-4dc9-a124-7039411ac713",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "4eddb031-308d-40f7-b374-d821b9c28425"
        }
      ]
    },
    {
      "bom-ref": "160efe0c-68fc-4660-9d94-27c97aafd2d9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71"
        }
      ]
    },
    {
      "bom-ref": "f07bd18d-b544-40a7-af7b-de33c06a28ed",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71"
        }
      ]
    },
    {
      "bom-ref": "b671eef8-bd13-4032-be84-2ce6f11dbaf2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71"
        }
      ]
    },
    {
      "bom-ref": "6c8db1c1-083e-4044-9a32-3ec1d06b72e7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71"
        }
      ]
    },
    {
      "bom-ref": "c0d1a4f5-5c3f-4845-a0f2-b8d20f990d0e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71"
        }
      ]
    },
    {
      "bom-ref": "600ba999-e456-4bd1-be54-14b7cf91e8ea",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "48d5e387-87b8-442b-992d-cb6f84c2bf71"
        }
      ]
    },
    {
      "bom-ref": "7e89e814-74c7-45bc-ae81-80199f990ed9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e"
        }
      ]
    },
    {
      "bom-ref": "3145e891-1a34-4546-b809-25b3d4cb1bed",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e"
        }
      ]
    },
    {
      "bom-ref": "5a89e270-27f2-4aec-b0e7-f679fb77c418",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e"
        }
      ]
    },
    {
      "bom-ref": "585874d5-7454-41d3-91e1-dc4accb13bd5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e"
        }
      ]
    },
    {
      "bom-ref": "39da78a2-80d0-4e4b-beaf-d3ea8711d7b3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e"
        }
      ]
    },
    {
      "bom-ref": "7600ecee-01e7-4e6b-9f05-c243db8fa39d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4a1fd372-4feb-49d7-b948-eb6a5c29412e"
        }
      ]
    },
    {
      "bom-ref": "feac0bbd-7808-4cda-a309-31f845d312ff",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5381a14f-f782-49a4-9c2b-f49ca15f6612"
        }
      ]
    },
    {
      "bom-ref": "c9b0439f-6875-4a88-a571-5464e427bca2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb"
        }
      ]
    },
    {
      "bom-ref": "e4fb07a4-1ac3-4e41-8dbf-078ce40cdf3c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "50b481cf-70c8-4db5-935d-3c58174ea93e"
        }
      ]
    },
    {
      "bom-ref": "2c0d0166-8fbe-4310-88e5-c6f4edccb2d8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66"
        }
      ]
    },
    {
      "bom-ref": "7686729f-ccb6-46af-9902-d7a90209f26c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66"
        }
      ]
    },
    {
      "bom-ref": "716218ac-709f-45b6-a527-8b59c890542d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66"
        }
      ]
    },
    {
      "bom-ref": "f38e81e6-acbc-4980-85ea-c2c018afad51",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66"
        }
      ]
    },
    {
      "bom-ref": "341cd6e7-0f13-4cd7-a9da-c11ef3cdf3a4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66"
        }
      ]
    },
    {
      "bom-ref": "03b19be9-f5aa-43d8-a172-ee31a3bf1e7b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4b451eb1-1556-49d7-ab44-31d50fb03c66"
        }
      ]
    },
    {
      "bom-ref": "7c4cf0c5-1b11-40ea-ac2b-a4d82887a066",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6"
        }
      ]
    },
    {
      "bom-ref": "13fe4c4a-d7ff-4ef4-8183-088d45e4b3da",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6"
        }
      ]
    },
    {
      "bom-ref": "6fe752d7-8cbf-42ab-9795-f1ef46ed15f3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6"
        }
      ]
    },
    {
      "bom-ref": "c9f03df4-05c5-405b-a7f3-4b179ffbd1a3",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6"
        }
      ]
    },
    {
      "bom-ref": "8fd1fe3a-0727-43ae-9998-12f048454dea",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6"
        }
      ]
    },
    {
      "bom-ref": "652d2a94-77e0-4624-9532-117560504646",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4a694955-46cf-4d32-92a3-813fb2d8f9c6"
        }
      ]
    },
    {
      "bom-ref": "5bfa466b-9eee-4aae-9ab5-70082f1bddfe",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "524073a7-7ac3-490f-bd13-c7d9d1d0fdad"
        }
      ]
    },
    {
      "bom-ref": "6ef8921b-c699-4031-85c6-78afcd40f9cb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "53010d9c-75c4-424b-8638-69869fad53f0"
        }
      ]
    },
    {
      "bom-ref": "5cae395c-a9dc-48b3-ba93-f631a25ea763",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da"
        }
      ]
    },
    {
      "bom-ref": "83ff682a-9200-4bdc-8b19-1ca77fec53e4",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da"
        }
      ]
    },
    {
      "bom-ref": "54cf0460-bd4a-49dd-8160-a4b7094460c4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da"
        }
      ]
    },
    {
      "bom-ref": "d7b13795-0b4c-4db5-af51-8cc09aec0af2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da"
        }
      ]
    },
    {
      "bom-ref": "b95de493-2896-4b77-b996-d2fd24e1dad3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4ef7a6ac-64c3-433d-8b08-ac280ba795da"
        }
      ]
    },
    {
      "bom-ref": "21c1b19f-94b7-44e1-ac21-1eebbcf8c396",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "553f3efc-3702-442a-89ad-d66b8ac18a01"
        }
      ]
    },
    {
      "bom-ref": "c422c5a6-8c33-4c75-b662-2de44aea403e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8"
        }
      ]
    },
    {
      "bom-ref": "4c26ab58-d7b9-4868-8676-0480a3c0a122",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8"
        }
      ]
    },
    {
      "bom-ref": "24c34eed-c578-4f48-8345-a04f49ab3118",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8"
        }
      ]
    },
    {
      "bom-ref": "19bb5bde-cc5a-41a9-b3ce-26d859d44ca1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8"
        }
      ]
    },
    {
      "bom-ref": "f276e6f3-ed7a-40a3-a86e-e94c0d235db4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8"
        }
      ]
    },
    {
      "bom-ref": "f102f23c-8b38-47a9-b93e-ef3024101dc7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4ccacb8f-34d3-4e9e-96a9-50deab62d6e8"
        }
      ]
    },
    {
      "bom-ref": "6d03ff85-c1c0-4bf1-9768-e9ec5de65314",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "54e1ed44-7ecd-4086-8d72-bc24ae6932cc"
        }
      ]
    },
    {
      "bom-ref": "9e326341-a094-4037-9bde-d9d2f2eea2b5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4d06a0b7-5b8a-467a-8943-75a729864023"
        }
      ]
    },
    {
      "bom-ref": "e5f41bc1-d8d7-4e38-a65f-f801a32c50fb",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4d06a0b7-5b8a-467a-8943-75a729864023"
        }
      ]
    },
    {
      "bom-ref": "a6d9d75c-5bba-4dbd-996b-19ea0b37ebf9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4d06a0b7-5b8a-467a-8943-75a729864023"
        }
      ]
    },
    {
      "bom-ref": "141cf9a0-95f6-4ec7-b028-14859ffac55c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4d06a0b7-5b8a-467a-8943-75a729864023"
        }
      ]
    },
    {
      "bom-ref": "d6c6db96-156e-40fb-8760-0f165c4e12d6",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7"
        }
      ]
    },
    {
      "bom-ref": "86b121c6-074d-45d1-9816-e1a6c29771da",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4d06a0b7-5b8a-467a-8943-75a729864023"
        }
      ]
    },
    {
      "bom-ref": "6d181d01-1805-4572-bfaf-6e6324e439b8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4d06a0b7-5b8a-467a-8943-75a729864023"
        }
      ]
    },
    {
      "bom-ref": "4b04b1c4-2075-46ba-bddb-471d9084e91f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "563deeb9-566c-473e-a801-137b599eba13"
        }
      ]
    },
    {
      "bom-ref": "c0204812-fbd4-4bb6-805e-2df6a64745bc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7"
        }
      ]
    },
    {
      "bom-ref": "9f88e6da-3d81-4d10-ae13-f46b04d70e44",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7"
        }
      ]
    },
    {
      "bom-ref": "027043c4-d5d8-429c-8813-7078672b2920",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7"
        }
      ]
    },
    {
      "bom-ref": "b9c16256-c3ba-4f88-9dc9-a44281626383",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7"
        }
      ]
    },
    {
      "bom-ref": "89a82d8a-27fa-4ca8-9b26-6dee0107a9f6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5541d43b-d125-4130-b0d6-5c72198a97f7"
        }
      ]
    },
    {
      "bom-ref": "38c7e59f-1084-4121-a555-43212cc209d8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5577e910-c742-4163-b07b-285c20307e49"
        }
      ]
    },
    {
      "bom-ref": "fe71c206-bef4-4155-aa41-37e29bd38477",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "56527af8-fa31-4bd8-b0d4-876c26f80f0b"
        }
      ]
    },
    {
      "bom-ref": "ad6dee92-41a5-4e5d-bc52-e113b1f595f2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30"
        }
      ]
    },
    {
      "bom-ref": "5a888b5e-87c2-430d-b66d-a2a8449c1b72",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30"
        }
      ]
    },
    {
      "bom-ref": "96d25010-4891-4c31-bd46-e7e109ff672c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30"
        }
      ]
    },
    {
      "bom-ref": "06e99b9a-db69-49ac-ab1d-88bd6cf180b4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30"
        }
      ]
    },
    {
      "bom-ref": "8f76fc70-b2f2-4c82-a41f-412419511be2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30"
        }
      ]
    },
    {
      "bom-ref": "2c8ddab1-96f9-465c-81d2-bd05a265cf86",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4dd217e4-6fc2-4bb2-945c-eaf384199f30"
        }
      ]
    },
    {
      "bom-ref": "02e8fb25-78a7-466b-b438-472a78ed7429",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5681e502-a3db-4269-a9cc-af9627cf5a7e"
        }
      ]
    },
    {
      "bom-ref": "1188ee69-0dc2-44c5-8072-838ee562d7cc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f"
        }
      ]
    },
    {
      "bom-ref": "501f3e47-ba62-4994-bfab-5848d0de1eb8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f"
        }
      ]
    },
    {
      "bom-ref": "414831a5-02ac-4603-ae07-da8a219ecb59",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f"
        }
      ]
    },
    {
      "bom-ref": "56e6c79c-c15d-4def-867c-f09d5836cb8a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f"
        }
      ]
    },
    {
      "bom-ref": "51aa44cc-e6ac-418c-93fa-f1a33e701ea8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f"
        }
      ]
    },
    {
      "bom-ref": "241a4e6a-cb44-47ca-a545-427916ca17ec",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4fdf0ba7-a93c-4dbc-a923-fe336b312f0f"
        }
      ]
    },
    {
      "bom-ref": "0d79be1a-5f75-4d50-885f-e6ec3fd2bdd3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2"
        }
      ]
    },
    {
      "bom-ref": "8dac5001-b070-4bbf-8cea-64c3fc043e7f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2"
        }
      ]
    },
    {
      "bom-ref": "9cc583c8-e82a-47c9-a1e2-7f2234c97cc6",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2"
        }
      ]
    },
    {
      "bom-ref": "321e6cca-8544-4acb-807e-34d5de024ce1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2"
        }
      ]
    },
    {
      "bom-ref": "ebbadbab-ae5b-4803-834a-655c49c014e8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2"
        }
      ]
    },
    {
      "bom-ref": "67004e90-7fc9-4246-8e39-676bc3bae750",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4fea6dc9-8c71-43a2-a67b-d5028408a4d2"
        }
      ]
    },
    {
      "bom-ref": "b122a159-b189-49f6-8543-52bbff37379c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "574a6230-d6e6-4674-84c5-7e532a0ec44b"
        }
      ]
    },
    {
      "bom-ref": "4425658a-987d-4430-861a-b03e51a77c51",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "58645350-32db-48b3-a582-f145aec556a3"
        }
      ]
    },
    {
      "bom-ref": "2c02feda-2929-4a56-8ef2-277b47011fa6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "51905219-d221-4808-be96-38fb2e471941"
        }
      ]
    },
    {
      "bom-ref": "fb91e65d-49f8-4f08-8eef-f8355ecc82a0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "51905219-d221-4808-be96-38fb2e471941"
        }
      ]
    },
    {
      "bom-ref": "9c0d9b2f-91cd-4e3e-8310-9af6f3f4f783",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "51905219-d221-4808-be96-38fb2e471941"
        }
      ]
    },
    {
      "bom-ref": "eea2243c-588e-4766-81d5-62878834702b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "51905219-d221-4808-be96-38fb2e471941"
        }
      ]
    },
    {
      "bom-ref": "b855ac2e-d716-497d-859f-a40a2fa04143",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "51905219-d221-4808-be96-38fb2e471941"
        }
      ]
    },
    {
      "bom-ref": "e3904c49-7782-47be-9353-32b76157d559",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd"
        }
      ]
    },
    {
      "bom-ref": "9fd59419-b4de-4808-aee8-d9b4f4544386",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd"
        }
      ]
    },
    {
      "bom-ref": "b273b8dc-b67b-4db2-bcf8-124990232a03",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd"
        }
      ]
    },
    {
      "bom-ref": "58b62371-86da-48fd-8bc3-ad7f74d912ca",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd"
        }
      ]
    },
    {
      "bom-ref": "5649f332-0883-4b21-9484-2b2f694dff55",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd"
        }
      ]
    },
    {
      "bom-ref": "49a6090f-66e1-4229-baa4-e61af55d414d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4f577540-c9c3-4e3f-97c6-caab5838b7bd"
        }
      ]
    },
    {
      "bom-ref": "a61a121c-bdf9-4b94-8c32-63ad871b1115",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5180a509-e080-439a-bec4-ff8c171f2062"
        }
      ]
    },
    {
      "bom-ref": "0e7db56a-29ea-4b01-bfb9-82ceacb02661",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5180a509-e080-439a-bec4-ff8c171f2062"
        }
      ]
    },
    {
      "bom-ref": "2ecf5544-7995-4a98-a622-9cc88624ba89",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5180a509-e080-439a-bec4-ff8c171f2062"
        }
      ]
    },
    {
      "bom-ref": "0a124f02-6ed3-4aea-8055-b925cf98478e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5180a509-e080-439a-bec4-ff8c171f2062"
        }
      ]
    },
    {
      "bom-ref": "875a7c99-7214-4d12-a073-4ffa1e92b3cb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5180a509-e080-439a-bec4-ff8c171f2062"
        }
      ]
    },
    {
      "bom-ref": "1973aa71-b88b-41f7-ad49-d7c647bb4e5a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5180a509-e080-439a-bec4-ff8c171f2062"
        }
      ]
    },
    {
      "bom-ref": "f594f775-caae-4cd5-b9de-0b6fe7c85511",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5405a809-8d71-4e23-b866-bf219cd0971d"
        }
      ]
    },
    {
      "bom-ref": "ed82a884-2c9c-4e46-a8f5-45be8d95c322",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5405a809-8d71-4e23-b866-bf219cd0971d"
        }
      ]
    },
    {
      "bom-ref": "665c9ae6-de2b-4037-8316-5496314d40b2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5405a809-8d71-4e23-b866-bf219cd0971d"
        }
      ]
    },
    {
      "bom-ref": "9fe70ce9-9fc2-41d8-8deb-c5a88e1b1bdd",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5405a809-8d71-4e23-b866-bf219cd0971d"
        }
      ]
    },
    {
      "bom-ref": "4140a546-b2e3-48ad-a1a7-ba8c89051170",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5405a809-8d71-4e23-b866-bf219cd0971d"
        }
      ]
    },
    {
      "bom-ref": "514b1eaf-72cc-4ffa-92b8-91349e011aba",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5405a809-8d71-4e23-b866-bf219cd0971d"
        }
      ]
    },
    {
      "bom-ref": "972a3f5b-301e-48d1-8e89-f5a556a5a434",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5b5d391d-4e5e-45d9-8fa0-b9b5a2ac8f4f"
        }
      ]
    },
    {
      "bom-ref": "5f6c876c-4029-47b8-a831-2cb965f9a225",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de"
        }
      ]
    },
    {
      "bom-ref": "5e16aa41-2cdd-4fe8-b428-e0a8beb68905",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5c577b17-21b3-4f7d-a5fd-6c774c0f8f56"
        }
      ]
    },
    {
      "bom-ref": "5ad529d8-394d-463a-8698-5c554f44395f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5d7ab366-9f60-4c89-a999-0f3a32d2851f"
        }
      ]
    },
    {
      "bom-ref": "ff129dbe-ddbe-4ef8-a15e-2e366c31c3f8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5d7d0fd8-a652-4080-b59d-632416eff550"
        }
      ]
    },
    {
      "bom-ref": "ab391e3d-b44d-48eb-8395-23f5d516d0e6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86"
        }
      ]
    },
    {
      "bom-ref": "7ff39454-e526-4a8d-9559-7e6aee03fa93",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86"
        }
      ]
    },
    {
      "bom-ref": "76894c26-9e44-4aaf-a0e4-c3dc142ebc00",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86"
        }
      ]
    },
    {
      "bom-ref": "d709e4e7-f557-4b77-883d-8cc154caf18a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86"
        }
      ]
    },
    {
      "bom-ref": "5b12a5a9-bf68-4890-ad79-857d4b9048a3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86"
        }
      ]
    },
    {
      "bom-ref": "4eb21a6a-5362-4eb0-9e6a-069c266610b2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "55358aa5-14bc-46d0-a9e3-e2c4a699ed86"
        }
      ]
    },
    {
      "bom-ref": "4aafcde3-eeeb-4d05-a998-ce22c96f054e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4"
        }
      ]
    },
    {
      "bom-ref": "8179ba1c-967d-4e6f-9ca1-bf25f923aad5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4"
        }
      ]
    },
    {
      "bom-ref": "432312ec-cd16-4c00-a4ee-da16fc682e21",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4"
        }
      ]
    },
    {
      "bom-ref": "337215d4-e4e4-456f-80ed-6f36b993e58c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4"
        }
      ]
    },
    {
      "bom-ref": "fdc2773d-642a-4dcf-86d2-4fa47d1ce469",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "572c924a-4ff6-45f0-8796-d5d4e5a73ae4"
        }
      ]
    },
    {
      "bom-ref": "cb8c2f5a-d6f6-4d30-8c02-84d64bdb9982",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664"
        }
      ]
    },
    {
      "bom-ref": "12c7d3e8-0c4f-4ff0-a6f7-154ee1802c65",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664"
        }
      ]
    },
    {
      "bom-ref": "e2af4291-9bcf-46c3-998c-1c57f9371b4d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664"
        }
      ]
    },
    {
      "bom-ref": "15cd1ab6-6925-42a2-8b44-ae811a304792",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664"
        }
      ]
    },
    {
      "bom-ref": "a545c00e-820d-4eac-9bcf-42cbdc5ea678",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "56e012a3-338a-4b29-81a8-fe87ab0ad664"
        }
      ]
    },
    {
      "bom-ref": "d6a26699-ed2b-4c0c-8981-33030fe4b100",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5f919e69-4ceb-4a5c-b958-2ea26db58c86"
        }
      ]
    },
    {
      "bom-ref": "b9449536-119f-43dc-b162-51d0f6f0b924",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5e232522-53a1-4dbb-a698-9734370df233"
        }
      ]
    },
    {
      "bom-ref": "89189e60-1f75-4037-95d5-e60d25c44cd2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "5f84ff25-4fd6-4589-bf82-a4c6f22f3a28"
        }
      ]
    },
    {
      "bom-ref": "f311d50c-b38a-405a-9ddb-21947c50662f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "600e854e-8913-4545-9159-796b809b43a2"
        }
      ]
    },
    {
      "bom-ref": "e83f3a2a-fef9-41aa-9ed2-df0a6b2b295c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "60917a88-7d03-4086-a4d3-50848aefb4de"
        }
      ]
    },
    {
      "bom-ref": "292cb0ab-a043-4bab-b217-3c0f514433b5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c"
        }
      ]
    },
    {
      "bom-ref": "27fc3b43-5d99-4c5e-8240-b0d1981cf6c3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c"
        }
      ]
    },
    {
      "bom-ref": "60bdd7f9-f5ca-4bc7-9084-dcdeb92550fc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c"
        }
      ]
    },
    {
      "bom-ref": "f02ced76-ebe5-4ac2-a866-9670ca33a165",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c"
        }
      ]
    },
    {
      "bom-ref": "32d4b6b7-7010-4d68-90e3-85fa8a7c0c3f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "59c64b7a-0298-49db-90a1-c11f5c7f572c"
        }
      ]
    },
    {
      "bom-ref": "4242b18e-8ff4-4113-90c0-f649b3a54928",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b"
        }
      ]
    },
    {
      "bom-ref": "3001c47f-8db7-4abd-bd7c-dab9971b3b27",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b"
        }
      ]
    },
    {
      "bom-ref": "f6c4593c-f73a-42b4-b996-9a70905c12d5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b"
        }
      ]
    },
    {
      "bom-ref": "06bd528b-52c5-49e2-93ac-56ba9379504a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b"
        }
      ]
    },
    {
      "bom-ref": "aea08e85-2135-4d14-b129-637edbc68663",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b"
        }
      ]
    },
    {
      "bom-ref": "37baade0-fdb3-40b6-a429-7ca50010aaed",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5791e738-a30d-48a2-9b86-03474ec2c92b"
        }
      ]
    },
    {
      "bom-ref": "88dfd207-4a4a-41ae-8c57-fdab0677d67b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1"
        }
      ]
    },
    {
      "bom-ref": "33988726-d6bb-4e18-a0b3-66874372fc4f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1"
        }
      ]
    },
    {
      "bom-ref": "8420b2ae-2d86-40b2-8b7b-c68b004511f5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1"
        }
      ]
    },
    {
      "bom-ref": "0e28d3cb-20bf-404a-9d44-c0c237668cbf",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1"
        }
      ]
    },
    {
      "bom-ref": "95370917-50e7-42b7-9325-e93ed539aeee",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "58d6cbf6-1e07-4f65-bcb7-823dd15bd4b1"
        }
      ]
    },
    {
      "bom-ref": "1f4772be-f96f-4577-bcf7-d9c502e175be",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc"
        }
      ]
    },
    {
      "bom-ref": "841e4425-ef92-46d6-97cd-ab17e018ec04",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc"
        }
      ]
    },
    {
      "bom-ref": "aa19d0e8-e198-4ad3-aee1-3c2f53489de1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc"
        }
      ]
    },
    {
      "bom-ref": "cdc8ff39-cd0f-41e4-b9da-d22e55fb7ed2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc"
        }
      ]
    },
    {
      "bom-ref": "be1c2637-39d9-45b5-8ad1-aff16d43930d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc"
        }
      ]
    },
    {
      "bom-ref": "1dd2cb13-ddb4-4caf-aa99-c38df19b7fee",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "565c4ffe-4b57-42f8-9324-e2d9d64629fc"
        }
      ]
    },
    {
      "bom-ref": "78cf0ff9-ad22-4366-acf2-12a0f8b9797c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb"
        }
      ]
    },
    {
      "bom-ref": "3e4ed0bd-684c-4035-a3d7-ba996941d1ec",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb"
        }
      ]
    },
    {
      "bom-ref": "add2a192-80fb-4357-90b4-3a0ff61db920",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb"
        }
      ]
    },
    {
      "bom-ref": "3c700ffc-3192-41b6-ab46-ae9e35622dcc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb"
        }
      ]
    },
    {
      "bom-ref": "57dffd64-c32e-43e6-b781-1aeac307879a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5a8c645d-c803-4526-b91c-a1027f39baeb"
        }
      ]
    },
    {
      "bom-ref": "251d8f30-2440-41d4-996a-363bba11cf54",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa"
        }
      ]
    },
    {
      "bom-ref": "fb8ab325-4b40-4172-b79c-a2ce8854996e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa"
        }
      ]
    },
    {
      "bom-ref": "dc821590-d6ab-44ab-8a36-16584ae3d2a8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa"
        }
      ]
    },
    {
      "bom-ref": "02fbd605-f9a7-4671-bc0a-c483017dec51",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa"
        }
      ]
    },
    {
      "bom-ref": "33bddbd4-cddf-41ee-a2c4-e68cf5bc6009",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa"
        }
      ]
    },
    {
      "bom-ref": "70794708-37e7-467b-b815-2a108d1ec7b2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5a2d0254-7197-44aa-8060-d4fe0f3818aa"
        }
      ]
    },
    {
      "bom-ref": "adccd3ea-6f9b-4c01-bea1-d59e80fd84fb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "61d70c14-333a-4441-8190-c768a6ace8e9"
        }
      ]
    },
    {
      "bom-ref": "d3fbcacc-f5b5-4237-9c91-57174a23cc69",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "60f70a68-0137-43d5-9894-5e016396a36c"
        }
      ]
    },
    {
      "bom-ref": "e223f1ad-4501-41d7-a29e-58eb9ba63b9b",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "64d5799d-ffef-4242-b348-553a875a3b1a"
        }
      ]
    },
    {
      "bom-ref": "10664905-80b6-477c-98fe-463fa943024c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "64d5799d-ffef-4242-b348-553a875a3b1a"
        }
      ]
    },
    {
      "bom-ref": "aa0e3d1e-16c3-4c6a-92e7-d1bbb46ae4e4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6123f157-9705-425d-929d-1a5e0a94fcfd"
        }
      ]
    },
    {
      "bom-ref": "7f51544a-2a68-4bfc-a7b4-dc5be69e3136",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de"
        }
      ]
    },
    {
      "bom-ref": "30c7427e-0a7c-4add-9989-45976e6b2045",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de"
        }
      ]
    },
    {
      "bom-ref": "380bf2b2-d089-407d-b7b4-410f3a5a88b9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de"
        }
      ]
    },
    {
      "bom-ref": "414b67ba-be9a-43ec-b412-d5d6f8f57fd5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de"
        }
      ]
    },
    {
      "bom-ref": "c4810742-0184-4ac3-8923-7b7ac8e17f3e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5806d3e5-2bf1-4869-bce1-7e4f497b57de"
        }
      ]
    },
    {
      "bom-ref": "ca4f7304-0bd1-40f0-a727-29b4afcb317b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f"
        }
      ]
    },
    {
      "bom-ref": "20b299c8-b641-4894-9d73-e930937c9e93",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f"
        }
      ]
    },
    {
      "bom-ref": "c4710a20-2027-4efb-bbbe-5a6769d3023d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f"
        }
      ]
    },
    {
      "bom-ref": "2910fec8-c18a-420b-adca-cc11643c7f7c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f"
        }
      ]
    },
    {
      "bom-ref": "e760d8af-d10f-4bb3-ab61-f2714e51d4cc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f"
        }
      ]
    },
    {
      "bom-ref": "932eee72-a8f7-4351-ad2a-ff1d5530f469",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5b5b107b-ab7a-44b7-afc6-25819bf6227f"
        }
      ]
    },
    {
      "bom-ref": "cffeed0e-6e08-4d1c-aae4-a75895f44415",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "649b45ad-b849-4d7e-ab45-979c16f2df76"
        }
      ]
    },
    {
      "bom-ref": "d4617958-0d4a-4f5a-8190-7b7420386450",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae"
        }
      ]
    },
    {
      "bom-ref": "124ed822-1f65-4b17-a126-70ee05e58af4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "663e045b-b93d-4cce-b7ae-f9f3ae65a2f6"
        }
      ]
    },
    {
      "bom-ref": "78cba1d5-bd2c-4b7c-93c7-758f9180c06c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4"
        }
      ]
    },
    {
      "bom-ref": "feed1559-8778-43a8-a5f9-4d076aa6a2a3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4"
        }
      ]
    },
    {
      "bom-ref": "4b7a8aa8-b831-4cc7-9e0c-6dfca36e6d37",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4"
        }
      ]
    },
    {
      "bom-ref": "35daa1f4-f424-41fa-9b03-0f793dcafef8",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4"
        }
      ]
    },
    {
      "bom-ref": "f731e091-f539-4efd-8b83-3a5fd090b033",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4"
        }
      ]
    },
    {
      "bom-ref": "de611aae-3c8c-4ac4-8d7f-49350da4933c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5bba614a-56dc-4bc7-9864-6a3e7edf59b4"
        }
      ]
    },
    {
      "bom-ref": "70bdf950-fa34-43b7-99af-14e28b04209d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "653ab36a-638d-4d2a-af0c-c35f086a4a04"
        }
      ]
    },
    {
      "bom-ref": "072c86aa-71f0-4a22-8dfe-638398d9fd36",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6714ce38-099a-4020-b69e-4a774436e7fc"
        }
      ]
    },
    {
      "bom-ref": "37e4902c-1583-4ef1-9e66-876c4eef83f7",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "5e232522-53a1-4dbb-a698-9734370df233"
        }
      ]
    },
    {
      "bom-ref": "58410c82-abef-4ba7-b1a5-955aa26a327e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "5e232522-53a1-4dbb-a698-9734370df233"
        }
      ]
    },
    {
      "bom-ref": "009abfb6-4526-4a75-9617-243f93889b2d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "5e232522-53a1-4dbb-a698-9734370df233"
        }
      ]
    },
    {
      "bom-ref": "91c1b9f9-eec9-4ed4-b959-a42c3324c6c3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "5e232522-53a1-4dbb-a698-9734370df233"
        }
      ]
    },
    {
      "bom-ref": "8b7a216a-7406-4d07-8735-80801c8dd19f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "5e232522-53a1-4dbb-a698-9734370df233"
        }
      ]
    },
    {
      "bom-ref": "55d65d84-df39-4295-a2aa-e7cedf80c16c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6325a7bd-9b3e-44ba-a1ef-31c2f628ec7c"
        }
      ]
    },
    {
      "bom-ref": "8ee1acaa-48d6-4275-abd3-03f05ab85e13",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "6156cdf4-bbe4-4ec3-ba64-3f2740560145"
        }
      ]
    },
    {
      "bom-ref": "1cf9dc58-00c7-4ae1-8087-baf35d09ba82",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6156cdf4-bbe4-4ec3-ba64-3f2740560145"
        }
      ]
    },
    {
      "bom-ref": "ebd343c6-5f56-470e-8922-0a0a0e557d24",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "68a5bffe-e060-4e54-a4c0-5de011172777"
        }
      ]
    },
    {
      "bom-ref": "e464e3f4-3c62-49fc-a28a-9cdc3714a487",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "67d10056-e5b3-46a1-be6e-d3e0d37f6dbd"
        }
      ]
    },
    {
      "bom-ref": "d55a38c1-1633-4d01-b4be-8ea84f95d7eb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92"
        }
      ]
    },
    {
      "bom-ref": "9a6233ea-4b1e-436e-925a-4dddbbe0a501",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "687637ac-4932-41d8-bc2b-c5b0522c3486"
        }
      ]
    },
    {
      "bom-ref": "ebe3bcd5-2a12-422c-8529-4631ed481ccd",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "68b32112-8ad2-474e-bb45-7f7914f3be60"
        }
      ]
    },
    {
      "bom-ref": "cb38a7d8-ea3c-49ee-bb9d-0c815c2be4bf",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "68c0a52d-3b19-4657-b2d8-800e40706895"
        }
      ]
    },
    {
      "bom-ref": "3ec3cd37-427f-40b1-84c2-a2fca214dcab",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "69e9d354-0b84-4cd0-96b6-5e66d52a3dda"
        }
      ]
    },
    {
      "bom-ref": "badb4fd1-1651-417b-b308-5ac361cc6eca",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "67278b74-b007-4525-ab95-dba8c68bb561"
        }
      ]
    },
    {
      "bom-ref": "4f9f5a1b-79f0-43b6-a098-3dc1003866d5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6aa38a78-ffb3-40bc-9c5f-18df3382d502"
        }
      ]
    },
    {
      "bom-ref": "28b3f89f-8b61-4a49-ad6f-beb0d402d835",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92"
        }
      ]
    },
    {
      "bom-ref": "121debc5-a392-4388-9ad1-d2daa9b8b94a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92"
        }
      ]
    },
    {
      "bom-ref": "94fbda41-2fca-4154-9218-bab2f4815457",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92"
        }
      ]
    },
    {
      "bom-ref": "52fbe48a-fc7b-4dee-b619-5fad30142f5a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92"
        }
      ]
    },
    {
      "bom-ref": "84d4fe6a-4ac7-4935-b5f0-7e23c62627dc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6097b0ed-510b-4e82-b7ec-46e05ad4ca92"
        }
      ]
    },
    {
      "bom-ref": "1ce8096f-0f27-4fdc-95f9-747708176eeb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6c1cc9cb-78b6-4261-83cd-5f737674580b"
        }
      ]
    },
    {
      "bom-ref": "3c3f15c1-5394-4e92-8295-79378ffff3e9",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6bc5ab44-6820-46a0-9946-2beb2389b486"
        }
      ]
    },
    {
      "bom-ref": "45d628b9-52c6-43c2-b0cf-2f864bf050ca",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6fb430dc-ebab-4d15-aee0-3ee7afdc2645"
        }
      ]
    },
    {
      "bom-ref": "defe0939-07d7-460b-a60f-ce99dba72020",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae"
        }
      ]
    },
    {
      "bom-ref": "ca1cd76d-fad0-4546-8e18-685a13bc2e48",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae"
        }
      ]
    },
    {
      "bom-ref": "ac5323e8-0f6d-4d5a-be53-f051c827d83a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae"
        }
      ]
    },
    {
      "bom-ref": "42584146-3601-4437-9bc4-6ebdd36e0fdb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae"
        }
      ]
    },
    {
      "bom-ref": "1b33fcd8-8432-4191-8fa5-662f01340dc4",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "618f71cb-342f-4e43-8d73-4c4f436f4dae"
        }
      ]
    },
    {
      "bom-ref": "a76085f0-ed10-4d3c-b035-ab994ac40110",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70"
        }
      ]
    },
    {
      "bom-ref": "3299fcea-ee8d-4f68-b0e4-a7611ec0d90d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70"
        }
      ]
    },
    {
      "bom-ref": "ac2b5b44-1853-403e-a2e1-0e379f67b70c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70"
        }
      ]
    },
    {
      "bom-ref": "80a92c90-792e-4623-bb3d-c6a4c9580b99",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70"
        }
      ]
    },
    {
      "bom-ref": "c444b3b1-082f-4e95-bbd0-62ad39c14eba",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70"
        }
      ]
    },
    {
      "bom-ref": "82dfaec5-1175-4d6b-b6ee-bbf39a5e806e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6ca67834-43cc-45ac-bcdc-c0354bc98c70"
        }
      ]
    },
    {
      "bom-ref": "3491c175-8197-4132-ac51-aa8f7a1506db",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "682bd4e6-1ad4-4ec1-8e48-a2ce39fb9e49"
        }
      ]
    },
    {
      "bom-ref": "6b9c264b-7a14-4ddb-b7f9-a72d7a1068f1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53"
        }
      ]
    },
    {
      "bom-ref": "bcb6adc2-eca3-408b-8f46-5324cb6e0154",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53"
        }
      ]
    },
    {
      "bom-ref": "c091c5e8-070b-43bc-8fa4-9a9d067aab1c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53"
        }
      ]
    },
    {
      "bom-ref": "91ba63db-929d-4292-83ed-77208d91687a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53"
        }
      ]
    },
    {
      "bom-ref": "a4214d6e-55e2-4797-8173-72557a6fdd25",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53"
        }
      ]
    },
    {
      "bom-ref": "3d078c6b-2602-4bce-b2e5-f616efda879e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6668e411-8add-4b76-95a5-34e69d7cfd53"
        }
      ]
    },
    {
      "bom-ref": "3dd0ec1c-2d06-4af7-a09b-c7375035df1a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6e3144b1-0f25-45c8-9d23-0ec4262f2d59"
        }
      ]
    },
    {
      "bom-ref": "97d341f4-6db5-4385-b211-b728cd251580",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5"
        }
      ]
    },
    {
      "bom-ref": "603b8d9f-d372-4760-a23a-0c5fe7b87f22",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5"
        }
      ]
    },
    {
      "bom-ref": "68577186-7b60-4377-aa10-637f6ddd507a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5"
        }
      ]
    },
    {
      "bom-ref": "360a4bfe-3651-48d3-b40d-a5c4d14a4a0f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5"
        }
      ]
    },
    {
      "bom-ref": "d3bf637f-5cd1-4419-9800-f3c95baa0522",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5"
        }
      ]
    },
    {
      "bom-ref": "7739ef34-d5af-4ad8-b031-76e59d040266",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "682c3105-0f1d-4735-becf-f4bc5fda40c5"
        }
      ]
    },
    {
      "bom-ref": "019a3518-52ad-4f12-a6eb-347ed04b7bac",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7292e381-9d6f-405f-8788-7292fb77edb3"
        }
      ]
    },
    {
      "bom-ref": "bad5866b-66f5-404f-ab46-6550df6f98b3",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "71f05dcc-70f5-483d-a365-2c3524780ada"
        }
      ]
    },
    {
      "bom-ref": "f2cb1a1d-e53c-451a-8561-32b3e80df2ea",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9"
        }
      ]
    },
    {
      "bom-ref": "11487469-dedd-4047-87c5-5cd94d8e965e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9"
        }
      ]
    },
    {
      "bom-ref": "1c05c130-7947-4842-a814-225ab7d771c9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9"
        }
      ]
    },
    {
      "bom-ref": "006ae6a7-6dcd-4a9c-9b27-999ab3229639",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9"
        }
      ]
    },
    {
      "bom-ref": "da6f1211-26ea-45d9-a0d9-602d2688308e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9"
        }
      ]
    },
    {
      "bom-ref": "d5dfa3be-0226-4c57-86e1-da8e3d5113f6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "64aab0b4-0305-4547-b19d-3a9c04b98ee9"
        }
      ]
    },
    {
      "bom-ref": "05251080-036b-4bbb-9583-4ed79e4344f0",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "6ff68af7-b295-48db-a1d9-badfb50e0827"
        }
      ]
    },
    {
      "bom-ref": "90a311dd-578c-4e77-900a-60c1edf5965c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "6ff68af7-b295-48db-a1d9-badfb50e0827"
        }
      ]
    },
    {
      "bom-ref": "44fd37aa-dd71-4a77-b5b1-8127fa6c7c26",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "728fac92-dc0f-4bd4-a5bb-27747a2d0948"
        }
      ]
    },
    {
      "bom-ref": "3707c271-d3aa-4d31-bfbd-468a7e52a984",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7160937d-149d-41a4-b43d-d735abcdac76"
        }
      ]
    },
    {
      "bom-ref": "f6c73cb7-0e0b-443d-a548-690a69a35faa",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603"
        }
      ]
    },
    {
      "bom-ref": "2fa5605c-c0a9-4e37-a00f-c8084308a136",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603"
        }
      ]
    },
    {
      "bom-ref": "45a3f46b-d090-45ae-a920-c97816eea721",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603"
        }
      ]
    },
    {
      "bom-ref": "a448b6b9-961c-4324-8395-909bdf5e0b9f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603"
        }
      ]
    },
    {
      "bom-ref": "1b34e62e-c3a0-4747-8c3a-e445ced6d04c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603"
        }
      ]
    },
    {
      "bom-ref": "ad4f54cb-7198-4ac2-be1c-9398eb021a61",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "72dd2bcf-1f19-41c3-bfc7-087b861df603"
        }
      ]
    },
    {
      "bom-ref": "8041ef0a-6e23-4d55-951a-debc3eaa1e30",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008"
        }
      ]
    },
    {
      "bom-ref": "736f0962-c18b-408f-9bf9-86f04ebc0f4e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008"
        }
      ]
    },
    {
      "bom-ref": "3bb1b533-1cfe-4dfa-843f-735b859343eb",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008"
        }
      ]
    },
    {
      "bom-ref": "67eb5fb6-a2e4-4e65-beaf-7b4bd7b6296d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008"
        }
      ]
    },
    {
      "bom-ref": "1ac74d77-49cc-4321-99df-0eff4ddcb909",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008"
        }
      ]
    },
    {
      "bom-ref": "6ffc7a94-a27f-4472-b15c-cab0188135c7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "72b81246-85a5-40bf-adef-42bcb7d8b008"
        }
      ]
    },
    {
      "bom-ref": "621164ac-d46e-4993-9b25-30a39972c793",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "74d00dc1-3619-42bd-946f-6f92ff366894"
        }
      ]
    },
    {
      "bom-ref": "69b89777-191f-47f9-a7e6-8378cfefde6f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "69ad7d07-9053-47fd-9185-669c67e2055a"
        }
      ]
    },
    {
      "bom-ref": "406224ee-ff02-48b9-b2c6-1cfa2e2a1230",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "69ad7d07-9053-47fd-9185-669c67e2055a"
        }
      ]
    },
    {
      "bom-ref": "11b7d2eb-83de-4a93-8ef3-b465c1374d2e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "69ad7d07-9053-47fd-9185-669c67e2055a"
        }
      ]
    },
    {
      "bom-ref": "2c5e595f-91e8-43d9-9b52-e3a592909673",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "69ad7d07-9053-47fd-9185-669c67e2055a"
        }
      ]
    },
    {
      "bom-ref": "9fc097e6-309f-4786-93b1-061eabbad890",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "69ad7d07-9053-47fd-9185-669c67e2055a"
        }
      ]
    },
    {
      "bom-ref": "2373ee63-16a3-45fc-a0c8-167022cf285f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "69ad7d07-9053-47fd-9185-669c67e2055a"
        }
      ]
    },
    {
      "bom-ref": "4c77c1f9-a3b7-4939-ae08-7e49ea9531a1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "73d4f2a2-10e6-4f19-a932-337cff8159a2"
        }
      ]
    },
    {
      "bom-ref": "b619e27e-75ad-4e88-a89d-891e9a9e7350",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "75e5f093-c8a4-4766-b57d-31428c6ed7a7"
        }
      ]
    },
    {
      "bom-ref": "d5b9db1d-6df8-4836-8092-10e1d57735aa",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "73d9c2f6-f6a8-4d5d-b742-51fe62761b54"
        }
      ]
    },
    {
      "bom-ref": "b26a34ed-4390-4164-a204-44a7dcb7df3e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "73240837-973b-45f2-a839-707503c95693"
        }
      ]
    },
    {
      "bom-ref": "53ef9da7-b9fa-46e8-b887-b3fa9e211f34",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "73240837-973b-45f2-a839-707503c95693"
        }
      ]
    },
    {
      "bom-ref": "e9fd233d-fd4b-43e9-ab87-b6ee205c2217",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "73240837-973b-45f2-a839-707503c95693"
        }
      ]
    },
    {
      "bom-ref": "b000bfec-9dd1-4381-aa10-6910b48e81ca",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "73240837-973b-45f2-a839-707503c95693"
        }
      ]
    },
    {
      "bom-ref": "280a9b39-d7fc-4be5-92a2-eabd5640b193",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "73240837-973b-45f2-a839-707503c95693"
        }
      ]
    },
    {
      "bom-ref": "1717a4c9-a46c-454f-b737-e01296ac2995",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "73240837-973b-45f2-a839-707503c95693"
        }
      ]
    },
    {
      "bom-ref": "fd46e721-3a7f-44eb-af4a-359231ca37ef",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "766157f8-66ca-41b6-bef7-662eb8273033"
        }
      ]
    },
    {
      "bom-ref": "72f63150-5409-419a-a964-1bb54fa653b0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb"
        }
      ]
    },
    {
      "bom-ref": "71853fa4-a1e5-422f-84b1-1a367a4da808",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb"
        }
      ]
    },
    {
      "bom-ref": "f9656a39-976b-4263-ba77-d2853bdc8867",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb"
        }
      ]
    },
    {
      "bom-ref": "986f6262-300d-4c9c-9444-3398af7f8a58",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "78857cd1-42e5-4737-8ee8-e4c4f3ff72c2"
        }
      ]
    },
    {
      "bom-ref": "4269488a-0900-4461-b61f-5a470c523d08",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb"
        }
      ]
    },
    {
      "bom-ref": "ac372f0f-cd34-4b2a-bbb2-79e128c2b7bf",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb"
        }
      ]
    },
    {
      "bom-ref": "050192a0-09eb-4075-baff-99c11e5459ad",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6cbf98c8-c4a1-4649-bcc2-5ca74fcbcadb"
        }
      ]
    },
    {
      "bom-ref": "e80a95da-3ac5-40d7-a749-badd54e37569",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2"
        }
      ]
    },
    {
      "bom-ref": "777ee2fc-9192-4f92-92a8-173bf90784c7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2"
        }
      ]
    },
    {
      "bom-ref": "0871d5db-1916-43e4-add6-4e8bc9d1d5fe",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2"
        }
      ]
    },
    {
      "bom-ref": "13c49741-7264-4c93-8c09-9b34ea2a595e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2"
        }
      ]
    },
    {
      "bom-ref": "326393d2-7310-4862-8fa6-f3849c1c7673",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2"
        }
      ]
    },
    {
      "bom-ref": "f442781d-9d9b-403f-9f8f-138935897a85",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6e6f8542-b81e-4458-ab3c-814ba42a6dc2"
        }
      ]
    },
    {
      "bom-ref": "a02c4e8d-2a51-415f-ab06-63ea10c9bdd9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340"
        }
      ]
    },
    {
      "bom-ref": "80669a0b-c1ad-42d1-a191-de13a2cc2767",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340"
        }
      ]
    },
    {
      "bom-ref": "e94aa695-eeae-409a-8b0b-609cc40f211d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340"
        }
      ]
    },
    {
      "bom-ref": "da617473-6ee1-4e59-89d5-a7611170c1c7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340"
        }
      ]
    },
    {
      "bom-ref": "5653c700-db9d-44c1-8533-f46c0bcc76e8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340"
        }
      ]
    },
    {
      "bom-ref": "b02e7e24-5c78-41cd-b803-0422acd0250a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "771f7aeb-dcac-4d9d-a50d-c8df73baa340"
        }
      ]
    },
    {
      "bom-ref": "a03a6f08-f6c4-4adb-a072-c1e5c89d2ce5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24"
        }
      ]
    },
    {
      "bom-ref": "3a6b3a7e-a4ab-4430-853f-e72d2e2a9e1c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24"
        }
      ]
    },
    {
      "bom-ref": "1b837ccb-853c-46e4-9786-407ee7dde617",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24"
        }
      ]
    },
    {
      "bom-ref": "f615e0bd-0f86-4519-adcc-a0819fdfdca5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24"
        }
      ]
    },
    {
      "bom-ref": "e7093b96-8ff2-4856-95a1-af29eac34bd6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24"
        }
      ]
    },
    {
      "bom-ref": "b609a482-49f7-476d-b7d4-5f392078dec8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "713bda82-ec82-4175-87c9-06cd5b49fa24"
        }
      ]
    },
    {
      "bom-ref": "6a48e9d3-d4b8-4d76-bcf1-eea10176f662",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f"
        }
      ]
    },
    {
      "bom-ref": "d16896a3-b47e-4aa5-b33b-c5b79f8da7df",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f"
        }
      ]
    },
    {
      "bom-ref": "563083a8-3b2f-4083-8833-0f41f7b828f9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f"
        }
      ]
    },
    {
      "bom-ref": "62ce8411-b865-40dc-9ae4-f1ccfb4d8fca",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f"
        }
      ]
    },
    {
      "bom-ref": "5fcc4160-81d6-495e-97ad-8101888a3fa9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f"
        }
      ]
    },
    {
      "bom-ref": "51a2ee30-b524-4b58-a45f-64fa2075eec2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6d579ef0-e20f-435b-aac5-2e3df85c7d6f"
        }
      ]
    },
    {
      "bom-ref": "c21f1d46-38ac-43b3-8796-1c4440d70981",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7881be8d-8361-4819-8f7f-2334593e0787"
        }
      ]
    },
    {
      "bom-ref": "ec293d6c-1bd3-434f-aed7-273769e33430",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "78857cd1-42e5-4737-8ee8-e4c4f3ff72c2"
        }
      ]
    },
    {
      "bom-ref": "69bc701f-6ae1-404b-a628-35093cb71774",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "78857cd1-42e5-4737-8ee8-e4c4f3ff72c2"
        }
      ]
    },
    {
      "bom-ref": "b44f4ced-184c-4596-b6f2-858189789f49",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7943845c-187b-40eb-a881-62a102bfb617"
        }
      ]
    },
    {
      "bom-ref": "19d49e9b-188b-46f8-afbc-2c0b63adf4f4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "77f518f4-c28d-425a-a68f-9f7444f2d2a6"
        }
      ]
    },
    {
      "bom-ref": "d5b506f7-a511-4cc3-ab3d-2912ca5c1598",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "6d84b148-22ea-4998-bf1f-c0145175970f"
        }
      ]
    },
    {
      "bom-ref": "850a9c0e-c3c4-4343-8a2a-f51405f9afde",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "6d84b148-22ea-4998-bf1f-c0145175970f"
        }
      ]
    },
    {
      "bom-ref": "63dd4d34-0f79-4aac-ba80-5e5c9763f740",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "6d84b148-22ea-4998-bf1f-c0145175970f"
        }
      ]
    },
    {
      "bom-ref": "75218e55-70a6-49d7-bd9f-6bf431e44995",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "6d84b148-22ea-4998-bf1f-c0145175970f"
        }
      ]
    },
    {
      "bom-ref": "f02cbba4-a820-440f-bcce-d4b146d99dc8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "6d84b148-22ea-4998-bf1f-c0145175970f"
        }
      ]
    },
    {
      "bom-ref": "f6244ef2-4614-4dbf-9e93-e881c849758e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "6d84b148-22ea-4998-bf1f-c0145175970f"
        }
      ]
    },
    {
      "bom-ref": "390e395b-d342-4472-bc2a-4713e6a007b3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b"
        }
      ]
    },
    {
      "bom-ref": "c1ceba7e-54a1-453b-9024-f18a0190a583",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b"
        }
      ]
    },
    {
      "bom-ref": "c8c1badd-1e55-45e5-9517-6d51be74f596",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b"
        }
      ]
    },
    {
      "bom-ref": "160728ce-74c3-4a39-b47e-2f31c4a6db0d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b"
        }
      ]
    },
    {
      "bom-ref": "b8cb8edf-0cc8-4279-8f77-7eb1e90d74df",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b"
        }
      ]
    },
    {
      "bom-ref": "473f7c06-27ea-4dd4-80b7-d43c83ae0f5a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "72edc313-5a70-4812-8b5f-c809bc108d2b"
        }
      ]
    },
    {
      "bom-ref": "3021760c-9bd9-4c0c-9b2a-bcfc19441d7d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257"
        }
      ]
    },
    {
      "bom-ref": "1004f8af-ffaa-4425-96a0-883067f662cc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257"
        }
      ]
    },
    {
      "bom-ref": "1b5afbfb-804f-47ae-a36d-558638b9ae35",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257"
        }
      ]
    },
    {
      "bom-ref": "03db3205-4811-41ca-b48b-001d001ef2f5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257"
        }
      ]
    },
    {
      "bom-ref": "ce80fdb3-0191-486e-adcc-955675a22c56",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257"
        }
      ]
    },
    {
      "bom-ref": "1edc0d2a-c626-415c-898f-c8f22d66fa01",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "79ad51ff-a7b4-4a59-9a27-a9701a14f257"
        }
      ]
    },
    {
      "bom-ref": "36e0708a-d041-4c98-ba52-4b4b43ff00d0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358"
        }
      ]
    },
    {
      "bom-ref": "01ab579e-21ac-4d0e-998f-678edb81c23a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358"
        }
      ]
    },
    {
      "bom-ref": "1dcb4ab7-f950-4581-a3f2-30419660951b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358"
        }
      ]
    },
    {
      "bom-ref": "14b06094-16c1-4fd1-8f3c-42f11a80159e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358"
        }
      ]
    },
    {
      "bom-ref": "0a86c9eb-a7a2-49ed-96ff-3b08518b62a0",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358"
        }
      ]
    },
    {
      "bom-ref": "93553c5f-20dd-458d-9e3d-c43d46868fca",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "777a2d2f-9779-44a9-9213-43eaf0a92358"
        }
      ]
    },
    {
      "bom-ref": "b4d650a6-359d-46c3-a98f-9c63931362f6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7b63c3ff-a6e8-4662-b601-2007b8b996d5"
        }
      ]
    },
    {
      "bom-ref": "a478fe04-7ff7-4d1f-8338-7212b22712eb",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c"
        }
      ]
    },
    {
      "bom-ref": "0d9b5f93-876d-4d17-a0aa-718f5e2f742e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c"
        }
      ]
    },
    {
      "bom-ref": "554d6880-2b2f-480b-a0b2-8bef2686c124",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c"
        }
      ]
    },
    {
      "bom-ref": "b69f46da-76f6-425d-b49d-0d00857ede66",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c"
        }
      ]
    },
    {
      "bom-ref": "1b1d29f2-3d7f-4222-9903-c7ae1d006480",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c"
        }
      ]
    },
    {
      "bom-ref": "3e3b0abb-0fad-4a70-b1c8-143d73a96b7a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "76c0466b-3235-42f7-af7b-fd898a286c6c"
        }
      ]
    },
    {
      "bom-ref": "f504f4b0-7d34-4380-9254-505158069e3a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "706d8743-143b-479b-9f9a-82deb5653ca3"
        }
      ]
    },
    {
      "bom-ref": "a9ff025f-3353-4f17-b984-6fcb21bbd96f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "706d8743-143b-479b-9f9a-82deb5653ca3"
        }
      ]
    },
    {
      "bom-ref": "9543d4c5-4c66-4966-95d3-b4c3fa19ac20",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "706d8743-143b-479b-9f9a-82deb5653ca3"
        }
      ]
    },
    {
      "bom-ref": "9f096ef0-8951-414f-94c7-1cabba207635",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "706d8743-143b-479b-9f9a-82deb5653ca3"
        }
      ]
    },
    {
      "bom-ref": "ee3ceff8-1185-40f1-beb7-47eb56228b8d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "706d8743-143b-479b-9f9a-82deb5653ca3"
        }
      ]
    },
    {
      "bom-ref": "54277e23-4d13-406d-a08a-4c0960cb5e62",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "706d8743-143b-479b-9f9a-82deb5653ca3"
        }
      ]
    },
    {
      "bom-ref": "baa33e31-7c0e-4fa9-9dda-cfb1889ed0bf",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7b958777-fc99-4d6e-8a7d-6eed7c5e10b2"
        }
      ]
    },
    {
      "bom-ref": "73493740-f548-438b-a338-f721ed68d6f7",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b"
        }
      ]
    },
    {
      "bom-ref": "0bb88dc2-bc9f-4841-8026-9d14f46107a8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b"
        }
      ]
    },
    {
      "bom-ref": "99cef3c5-6b67-4a4d-af81-e502544f7746",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b"
        }
      ]
    },
    {
      "bom-ref": "ee8373a2-90e0-42f5-862f-6e0ce884f02e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b"
        }
      ]
    },
    {
      "bom-ref": "69c5fc07-a7b4-413f-babe-e766a499274f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b"
        }
      ]
    },
    {
      "bom-ref": "815e14f3-2ec3-4b5c-abde-e382753b3625",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7360fb9f-76b6-4198-a6d8-da63a625f07b"
        }
      ]
    },
    {
      "bom-ref": "e5f6a8b5-6ba9-4d08-b62f-3854ae61961a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8"
        }
      ]
    },
    {
      "bom-ref": "5437a42f-68a8-4a02-90f8-1613f51b8f83",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8"
        }
      ]
    },
    {
      "bom-ref": "55d1bb73-db47-4157-8505-48e716d571b7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8"
        }
      ]
    },
    {
      "bom-ref": "7212aec2-e9c4-471d-b712-b30efe7ee96c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8"
        }
      ]
    },
    {
      "bom-ref": "40121a10-8bff-43bc-bf66-0e0a2a30ce45",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8"
        }
      ]
    },
    {
      "bom-ref": "c5624629-74d0-4c71-ae93-b8e20c96428b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7be32168-1e58-4ae4-a94f-5af9f80cf1a8"
        }
      ]
    },
    {
      "bom-ref": "961f4d7e-85c4-4f79-8b4b-9163dec5cbe7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7a9cb339-2780-4c15-897a-087683786c23"
        }
      ]
    },
    {
      "bom-ref": "41942076-2847-4184-84fe-f2f1587d1a32",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "73494d7f-a46c-435c-acaa-5250649c27f8"
        }
      ]
    },
    {
      "bom-ref": "daf8d5a7-cccd-4203-a6fa-680b0cefd3ca",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "73494d7f-a46c-435c-acaa-5250649c27f8"
        }
      ]
    },
    {
      "bom-ref": "6e45646a-8440-40f0-8114-2afaddfaee91",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "73494d7f-a46c-435c-acaa-5250649c27f8"
        }
      ]
    },
    {
      "bom-ref": "87bbd130-f59e-4309-ad9f-0464687f0ff9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "73494d7f-a46c-435c-acaa-5250649c27f8"
        }
      ]
    },
    {
      "bom-ref": "9a0d43f0-1fa9-4f61-8276-4d7f18a1acc5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "73494d7f-a46c-435c-acaa-5250649c27f8"
        }
      ]
    },
    {
      "bom-ref": "f5a1f7d5-bc39-4b33-919a-a27d707c7f88",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "73494d7f-a46c-435c-acaa-5250649c27f8"
        }
      ]
    },
    {
      "bom-ref": "49740f3d-deca-4d8d-874b-0d0c4d139a8f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7cd1f88c-97be-4ae2-86ab-1b09b9942f94"
        }
      ]
    },
    {
      "bom-ref": "bf4c7fec-27ed-486e-86f1-14484825a4f8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7c757f99-962b-4e82-8df3-26dc54e5c022"
        }
      ]
    },
    {
      "bom-ref": "614db370-68b7-4b72-a3be-f345ac085b2e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8"
        }
      ]
    },
    {
      "bom-ref": "daec6753-e3e9-4c76-a2c2-fe3fa8bcc02d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8"
        }
      ]
    },
    {
      "bom-ref": "fe4e6c31-9c17-43c8-abfd-1863350ac4fa",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8"
        }
      ]
    },
    {
      "bom-ref": "4102e461-f6e6-49bc-bf3b-c62173b645c6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8"
        }
      ]
    },
    {
      "bom-ref": "c04dc7ca-875c-4a8c-9b6a-8d4bffdc1ccd",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8"
        }
      ]
    },
    {
      "bom-ref": "a5036c49-849d-40f9-bd00-9bdffb05196f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "745cf386-6e2a-42d5-a0f6-7a3b9ce1bfb8"
        }
      ]
    },
    {
      "bom-ref": "425a9e6c-f772-414a-8ca3-c2bd26edca8b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7c0fca56-56fd-42b2-8e2c-85a4bfd3e81e"
        }
      ]
    },
    {
      "bom-ref": "b12fd2ee-6533-42f3-9767-19d4d35a5550",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7765909b-bd21-4e07-8171-df0816ab90b7"
        }
      ]
    },
    {
      "bom-ref": "26cfbf29-655a-4401-8f61-101f0bed75b6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7765909b-bd21-4e07-8171-df0816ab90b7"
        }
      ]
    },
    {
      "bom-ref": "c574549e-036a-4611-95a6-23fd2181b44a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7765909b-bd21-4e07-8171-df0816ab90b7"
        }
      ]
    },
    {
      "bom-ref": "55a12390-c58c-4bfc-b1a3-ac7ecb70cc06",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7765909b-bd21-4e07-8171-df0816ab90b7"
        }
      ]
    },
    {
      "bom-ref": "f4992945-d823-442c-81d0-1a12ae4a1d88",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7765909b-bd21-4e07-8171-df0816ab90b7"
        }
      ]
    },
    {
      "bom-ref": "647a4f20-1625-4091-bb19-4aa2175e998f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7765909b-bd21-4e07-8171-df0816ab90b7"
        }
      ]
    },
    {
      "bom-ref": "941342d3-a12b-4895-923c-4464e36ed9c1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2"
        }
      ]
    },
    {
      "bom-ref": "4231680f-2caa-439e-8f95-bf890825b489",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2"
        }
      ]
    },
    {
      "bom-ref": "56125b9d-8063-4cd2-ba8c-6df1b2f794d7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2"
        }
      ]
    },
    {
      "bom-ref": "c5bebc22-9a29-4f10-9045-4dc4cabdbd41",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2"
        }
      ]
    },
    {
      "bom-ref": "25965163-8724-4122-bdcf-2d6c5f52d0b7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2"
        }
      ]
    },
    {
      "bom-ref": "a5e19aa0-1771-457e-840f-2a1c4631532a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7730cb03-2217-42ff-9a22-aaeb6e3625d2"
        }
      ]
    },
    {
      "bom-ref": "acd00806-7c00-4040-b7e7-45ab69e95dbd",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "79121aa0-be21-469d-8262-3dba005b66ae"
        }
      ]
    },
    {
      "bom-ref": "c38befae-b1b0-4f6e-a2d5-f6f20b78dd1c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "79121aa0-be21-469d-8262-3dba005b66ae"
        }
      ]
    },
    {
      "bom-ref": "a303ca31-bcc6-41eb-aa5a-93288fbf1187",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "79121aa0-be21-469d-8262-3dba005b66ae"
        }
      ]
    },
    {
      "bom-ref": "12bb5c16-0152-4e96-8568-21cf36ebf1d1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "79121aa0-be21-469d-8262-3dba005b66ae"
        }
      ]
    },
    {
      "bom-ref": "f18e0dd6-9c02-41ac-a3cb-5d80f9e18dab",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "79121aa0-be21-469d-8262-3dba005b66ae"
        }
      ]
    },
    {
      "bom-ref": "2cbcf3b2-e281-4c64-9f82-c59f51633910",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "79121aa0-be21-469d-8262-3dba005b66ae"
        }
      ]
    },
    {
      "bom-ref": "823f19d6-291a-4af5-8dd3-197602ca9fbd",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d"
        }
      ]
    },
    {
      "bom-ref": "303e5606-3b76-4871-80cd-50366f5d5325",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d"
        }
      ]
    },
    {
      "bom-ref": "504e2051-06ba-4834-b2bb-032517676ec1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d"
        }
      ]
    },
    {
      "bom-ref": "6630b401-ab99-403e-b4c5-d5d0455875ef",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d"
        }
      ]
    },
    {
      "bom-ref": "7eaeed56-802f-47ab-b669-e74e18f9d40d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d"
        }
      ]
    },
    {
      "bom-ref": "b53f19f9-f705-41f1-8dc4-979e9879e9d9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "778d0609-cae5-4d3f-bb4e-568a62990c2d"
        }
      ]
    },
    {
      "bom-ref": "ce24ffb0-e53c-44b1-b121-c003345349be",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7e2439e6-25fc-4f28-b254-b487493c7d6c"
        }
      ]
    },
    {
      "bom-ref": "35b57df9-bb7b-4797-9881-b1da48ddfa31",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "c907a86b-6580-40d4-9799-96b5ad1945f4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7e3f09c1-0f76-40ba-9593-3d95965c3678"
        }
      ]
    },
    {
      "bom-ref": "bc49ed86-2b3c-4802-afe9-b1b4543b08be",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7ee0f868-38cd-41d2-84a9-0b2f4783eacc"
        }
      ]
    },
    {
      "bom-ref": "90402acf-fecb-4860-9179-f1cf88b0ceae",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce"
        }
      ]
    },
    {
      "bom-ref": "e9e63762-83d0-4847-9c5e-b485d7d811d6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce"
        }
      ]
    },
    {
      "bom-ref": "f7b63455-d2aa-40d1-a1ae-478618d4b5d2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce"
        }
      ]
    },
    {
      "bom-ref": "831ac7bf-8562-4acc-9aa3-2b2fdec32f54",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce"
        }
      ]
    },
    {
      "bom-ref": "e7dc05ea-2916-4f23-ace6-3eff54a68702",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce"
        }
      ]
    },
    {
      "bom-ref": "0ee6fb62-05e2-4f92-be90-2b63f685175b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "797962ea-e340-4cfc-9cfc-1f78e3f410ce"
        }
      ]
    },
    {
      "bom-ref": "2f895ecb-9070-4e61-9ca4-9efa3bf8171d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "7eed6dc3-61eb-4c15-8967-77a178230a43"
        }
      ]
    },
    {
      "bom-ref": "df7bf547-c3ce-486e-8526-76dd4166e1ac",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "811a5467-8fa0-46f0-a1b4-9f28c1d3640d"
        }
      ]
    },
    {
      "bom-ref": "adbb2dad-10d5-41d4-90f0-ab053484635e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7dda97d8-497d-466b-b2ef-6280badfe291"
        }
      ]
    },
    {
      "bom-ref": "03003cca-2bc7-43ca-938c-65814c4166bd",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7dda97d8-497d-466b-b2ef-6280badfe291"
        }
      ]
    },
    {
      "bom-ref": "1fd6c303-632a-4487-8fff-019dcbcf31fa",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7dda97d8-497d-466b-b2ef-6280badfe291"
        }
      ]
    },
    {
      "bom-ref": "4295a983-c766-4384-84aa-ac8c85ca59b7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7dda97d8-497d-466b-b2ef-6280badfe291"
        }
      ]
    },
    {
      "bom-ref": "5778e54b-20f3-4148-86e2-d6b5b16c03b1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7dda97d8-497d-466b-b2ef-6280badfe291"
        }
      ]
    },
    {
      "bom-ref": "fda3f7b2-43e3-4967-9c6f-d45d830ab88c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7dda97d8-497d-466b-b2ef-6280badfe291"
        }
      ]
    },
    {
      "bom-ref": "c0d43c4c-c85f-48a5-a845-cbd704981143",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "799087b6-a64a-4266-a576-ba517ecc96d5"
        }
      ]
    },
    {
      "bom-ref": "3f4c78ce-82cc-4f29-859d-80441ca2e062",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "799087b6-a64a-4266-a576-ba517ecc96d5"
        }
      ]
    },
    {
      "bom-ref": "5d469d21-ec5a-4c4b-8b34-60d697e613b1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "799087b6-a64a-4266-a576-ba517ecc96d5"
        }
      ]
    },
    {
      "bom-ref": "07dd5d1d-3bd9-4239-adbc-a5d9c4ead70e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "799087b6-a64a-4266-a576-ba517ecc96d5"
        }
      ]
    },
    {
      "bom-ref": "ddf16e2a-d130-4bb8-984f-4e8f8fc2dc1e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "799087b6-a64a-4266-a576-ba517ecc96d5"
        }
      ]
    },
    {
      "bom-ref": "9f77cea1-1e25-4ba9-a303-445626e5bca5",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "799087b6-a64a-4266-a576-ba517ecc96d5"
        }
      ]
    },
    {
      "bom-ref": "2fe9ae12-f4eb-44ac-988b-3cee8b4edb5d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "808994bb-0c1c-4ac7-bedb-134448854884"
        }
      ]
    },
    {
      "bom-ref": "b521e326-18c8-4d9e-b7ae-0edea168ef04",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44"
        }
      ]
    },
    {
      "bom-ref": "9d6d8ea3-ba67-45ba-a43b-e0d628203cdc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44"
        }
      ]
    },
    {
      "bom-ref": "eca95fc5-cc05-4bf3-9551-30d7bfe626d7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44"
        }
      ]
    },
    {
      "bom-ref": "e580cf5a-171b-4a93-9ebb-7d4a399e898a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44"
        }
      ]
    },
    {
      "bom-ref": "370734bc-db37-4c03-9a26-6b70ebf99027",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44"
        }
      ]
    },
    {
      "bom-ref": "7ae6bc13-9ce8-448a-89ce-dc12b997477d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7da751d0-1840-4c39-8259-3ad3e7ea0d44"
        }
      ]
    },
    {
      "bom-ref": "5381b315-c722-4524-82f2-77fce3bc8cf8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "83947ba5-9878-4f54-9941-1279aa91f062"
        }
      ]
    },
    {
      "bom-ref": "786f09ac-54d7-4f17-87ae-ab4b0818d476",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "84d825ad-abf2-4a39-9b3e-d6ac88a92d7c"
        }
      ]
    },
    {
      "bom-ref": "ab7068f7-89d6-4f2e-8768-81b5599dadbc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "81befa31-1238-44e7-b42b-0333669f29c0"
        }
      ]
    },
    {
      "bom-ref": "d9f20486-4053-40d2-8add-64d992158f67",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8"
        }
      ]
    },
    {
      "bom-ref": "c59fad98-5510-4b94-8049-f3350251e57f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8"
        }
      ]
    },
    {
      "bom-ref": "1a16d07a-5eb0-4af1-9c74-de0f2553eb4e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8"
        }
      ]
    },
    {
      "bom-ref": "f1d6b749-3f28-4192-831c-2de776e73351",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8"
        }
      ]
    },
    {
      "bom-ref": "67a9ea22-7530-457f-94dc-bc0c87b49465",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8"
        }
      ]
    },
    {
      "bom-ref": "fce5613d-d1c1-42d6-aab4-2a97fe9fe580",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7ddd80af-ecc0-4e67-a98d-c1bcd19181e8"
        }
      ]
    },
    {
      "bom-ref": "23684051-d4ec-433a-9008-da67c6adb384",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "85b716b5-46e1-4491-a4b9-666bdcb3fd2d"
        }
      ]
    },
    {
      "bom-ref": "4c7d16c9-e418-4bc9-99e8-3679f8e25493",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "842fee5c-1e26-49f2-b3ad-b7e78af8db4e"
        }
      ]
    },
    {
      "bom-ref": "2578a594-d04d-42fd-845f-80c86088a198",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "85b9dd90-4479-4f2d-8f80-753902a67fdb"
        }
      ]
    },
    {
      "bom-ref": "1a886df5-a9d0-4677-8820-14f356f3e449",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "86879e61-73b4-403f-84c5-310a91f84cae"
        }
      ]
    },
    {
      "bom-ref": "f5694de5-78dc-4178-a6f6-639d8b4c4fa0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e"
        }
      ]
    },
    {
      "bom-ref": "23e4f9b8-32e2-4f95-b13b-58cf589f4edc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e"
        }
      ]
    },
    {
      "bom-ref": "1028d176-59f3-4602-aa27-3c96892183ae",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e"
        }
      ]
    },
    {
      "bom-ref": "42b55156-12d3-4004-a55a-19a8dae69e3e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e"
        }
      ]
    },
    {
      "bom-ref": "3209d81d-d054-4a34-b1be-8aedc1c1fe15",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e"
        }
      ]
    },
    {
      "bom-ref": "a1ba2c32-c69f-4daf-a12f-3a36665e44c6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7cc227dd-e28c-4dd2-8d28-03902ce7080e"
        }
      ]
    },
    {
      "bom-ref": "29a8bfb1-c868-4d82-a4ee-3368bb381a58",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de"
        }
      ]
    },
    {
      "bom-ref": "acc5fae8-f0eb-42d2-b44b-7d9d6ba365f4",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de"
        }
      ]
    },
    {
      "bom-ref": "3f0d7017-5e8d-4e25-acc2-f038908285d3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de"
        }
      ]
    },
    {
      "bom-ref": "d45500ab-7f5c-46b5-89af-6b105bd9aed8",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de"
        }
      ]
    },
    {
      "bom-ref": "c56bb9ba-b9ad-4135-ab79-bc017f9994ea",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de"
        }
      ]
    },
    {
      "bom-ref": "f373cbcd-c7ea-45e2-baa3-4ee7e3ca182f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7db532c5-1e24-4e3e-9113-9bb19676a6de"
        }
      ]
    },
    {
      "bom-ref": "599ac8ad-0abd-4056-944a-2e3086519c77",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "78f103e6-9ad9-4970-af50-c9da7c0f3dae"
        }
      ]
    },
    {
      "bom-ref": "8e75f331-7875-44c1-b90d-58fd07f8194c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "86ec9671-8b26-4627-a019-16c9b0f017f6"
        }
      ]
    },
    {
      "bom-ref": "f46ba2bd-e295-47ab-90f5-5661c6a16a25",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "860d14d1-9b1b-4d57-b30e-07c528229729"
        }
      ]
    },
    {
      "bom-ref": "0f64bb44-cc09-4c23-b3dc-00473bcf6fea",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "87edd959-f5ee-4510-984a-de5e94b7f17a"
        }
      ]
    },
    {
      "bom-ref": "a66f5773-adc0-40e5-8411-12d12e465a18",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd"
        }
      ]
    },
    {
      "bom-ref": "3e4738c7-91b5-428f-9894-18d58d6d3e24",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd"
        }
      ]
    },
    {
      "bom-ref": "f3b30989-826d-4c17-9d85-f3c99517a838",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd"
        }
      ]
    },
    {
      "bom-ref": "7260f857-8bc3-4bc5-9e53-9297776f31a5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd"
        }
      ]
    },
    {
      "bom-ref": "05aae51a-a157-44e2-bbe2-2d7f6e05534a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd"
        }
      ]
    },
    {
      "bom-ref": "ebaeb72c-e4df-4be4-a41e-2b3885b766af",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7f4f31e4-ad85-43e9-9721-49577d4b2cdd"
        }
      ]
    },
    {
      "bom-ref": "83348852-204b-4e60-9855-06809650ae66",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5"
        }
      ]
    },
    {
      "bom-ref": "3f6f9911-87c2-4acb-b5e4-6588086ac234",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5"
        }
      ]
    },
    {
      "bom-ref": "5c1d9453-b7d7-491e-8bce-66cabcc56bbd",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5"
        }
      ]
    },
    {
      "bom-ref": "29dbe6e4-045e-4741-9202-02c4d889703d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5"
        }
      ]
    },
    {
      "bom-ref": "676034aa-f2d1-4892-be76-5c09661be54f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5"
        }
      ]
    },
    {
      "bom-ref": "f9fd0cbb-2991-4060-8cf6-7beb5db5b4c1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7fe6f281-6853-43d7-9db4-8407c11c3ee5"
        }
      ]
    },
    {
      "bom-ref": "7d5a9490-d11b-450f-92bb-e4efd6d91b65",
      "id": "CVE-2024-0760",
      "description": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "f0a8c69e-fb48-47a2-a53f-64b8b1182a8c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "25769a8f-b007-481f-8750-cc5a192ff17a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "85dd9f4d-0cbc-4541-acb2-d3b9b44e0972"
        }
      ]
    },
    {
      "bom-ref": "d37212c0-8e00-4e3c-b95f-cd5539574882",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8815eaaf-e979-480d-94a0-a80a835675f3"
        }
      ]
    },
    {
      "bom-ref": "aa4709d6-f31e-4530-a445-c913242ecb2e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8815eaaf-e979-480d-94a0-a80a835675f3"
        }
      ]
    },
    {
      "bom-ref": "97c96c50-1abd-4949-9ed4-d2855a83a53d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8815eaaf-e979-480d-94a0-a80a835675f3"
        }
      ]
    },
    {
      "bom-ref": "ec2cbcdd-979c-41c8-aac4-352e8d608a4b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8815eaaf-e979-480d-94a0-a80a835675f3"
        }
      ]
    },
    {
      "bom-ref": "2f799544-f4d4-4b0a-9fa6-86578fd50794",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8815eaaf-e979-480d-94a0-a80a835675f3"
        }
      ]
    },
    {
      "bom-ref": "c8156c50-3c3a-4989-a7f2-9250d32c53a6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8815eaaf-e979-480d-94a0-a80a835675f3"
        }
      ]
    },
    {
      "bom-ref": "2701a5c2-766d-42e9-93e7-2eb287725e00",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "8ada50a8-cb0f-4b11-82bf-c2abae87050c"
        }
      ]
    },
    {
      "bom-ref": "f86c5ef6-f909-4982-9b70-696444a4de77",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64"
        }
      ]
    },
    {
      "bom-ref": "bce83be6-a8d6-4837-b257-750b1d306dcb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "8bb3c5a5-f027-4ca5-a82f-6b6d5524d0e4"
        }
      ]
    },
    {
      "bom-ref": "995352f1-2cf6-4827-ad60-a34cf8ed7139",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f"
        }
      ]
    },
    {
      "bom-ref": "8b7bad68-906e-4005-a9e5-d3e7de1bf7d7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f"
        }
      ]
    },
    {
      "bom-ref": "8f7a8a9b-e4c1-4847-a08a-5ee452a4e396",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f"
        }
      ]
    },
    {
      "bom-ref": "8db8df5f-c1fe-4f28-9f2e-9b27cc915b2b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f"
        }
      ]
    },
    {
      "bom-ref": "450284e6-3ac0-4a8c-ba00-8bc340d12eb9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f"
        }
      ]
    },
    {
      "bom-ref": "16397397-39f1-4f04-bedf-4df7efb3f166",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "7ffdb95d-6d8b-4f10-a5ba-5f57da6dd06f"
        }
      ]
    },
    {
      "bom-ref": "a83b3672-696f-4e25-aaf9-6e763548d1ae",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8"
        }
      ]
    },
    {
      "bom-ref": "bf4bf793-412a-4b43-ae13-248425bac0ac",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8"
        }
      ]
    },
    {
      "bom-ref": "ffa1aefd-52e4-461b-8d48-0eb2c499b852",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8"
        }
      ]
    },
    {
      "bom-ref": "86ac1f62-0123-4313-a50b-a8da3a3ecd53",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8"
        }
      ]
    },
    {
      "bom-ref": "4816de14-aa1c-416e-a7f5-ceafbaa8f12f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8"
        }
      ]
    },
    {
      "bom-ref": "dbd16e60-0290-47a7-ad8f-2f5c5a451175",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "88e410c5-499f-4072-9b7e-af2c49b9f8b8"
        }
      ]
    },
    {
      "bom-ref": "9d045ce3-1ea3-405d-8cd6-537cd1ca594e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b"
        }
      ]
    },
    {
      "bom-ref": "32a846fa-4bf6-4c88-8300-66f85e1f90cc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b"
        }
      ]
    },
    {
      "bom-ref": "127e2931-f301-4d08-891f-e9160aa7baa1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b"
        }
      ]
    },
    {
      "bom-ref": "f92350c7-31e6-41f6-ac89-8f75479d8f80",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b"
        }
      ]
    },
    {
      "bom-ref": "e8e4bc04-0b95-4ed1-816a-2be4d854a8c8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b"
        }
      ]
    },
    {
      "bom-ref": "89fb1b81-28f2-4b86-b777-d064545cac25",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8bb58d72-67e4-417b-ae86-f9f645fb527b"
        }
      ]
    },
    {
      "bom-ref": "aa31ada2-f698-4455-ade2-c97d34ae6fa3",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "884f91be-f505-4295-9bfc-be2712272a13"
        }
      ]
    },
    {
      "bom-ref": "a17b5719-7375-4da6-ad52-bda67b498e20",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "82553659-a2f1-40ac-bc98-be995101306e"
        }
      ]
    },
    {
      "bom-ref": "08bb708b-d513-423b-a1da-a0fbff4ac069",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "82553659-a2f1-40ac-bc98-be995101306e"
        }
      ]
    },
    {
      "bom-ref": "e0c0b5ac-02e6-4086-9d57-d17c1deae724",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "82553659-a2f1-40ac-bc98-be995101306e"
        }
      ]
    },
    {
      "bom-ref": "962b45a0-6228-4343-b9c6-ed549f86a424",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "82553659-a2f1-40ac-bc98-be995101306e"
        }
      ]
    },
    {
      "bom-ref": "7fa73f8b-d7ce-481a-b641-7d1fac5494a7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "82553659-a2f1-40ac-bc98-be995101306e"
        }
      ]
    },
    {
      "bom-ref": "48ac3a1d-6e77-4b9c-b140-38f91e4ad2bd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "82553659-a2f1-40ac-bc98-be995101306e"
        }
      ]
    },
    {
      "bom-ref": "dc912dfa-cf17-4707-95f1-da0b4058aec5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "89f06a82-8aa0-426e-825c-b30b0fd62a66"
        }
      ]
    },
    {
      "bom-ref": "1b422f3e-ba52-4976-a80b-cb3f7df6ca6f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8"
        }
      ]
    },
    {
      "bom-ref": "6b8cfdda-8a54-421d-865d-9861b5883314",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8"
        }
      ]
    },
    {
      "bom-ref": "782764fd-d510-4814-a725-3b93457bd5f3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8"
        }
      ]
    },
    {
      "bom-ref": "e23793b7-d6b8-43c8-8ddc-98a1267effa6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8"
        }
      ]
    },
    {
      "bom-ref": "8c778170-6265-4562-bdda-d379ab1fdf40",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8"
        }
      ]
    },
    {
      "bom-ref": "532210fb-b005-4de1-827c-b342c497b2f8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8c7cd3da-0f73-48e5-b933-7a434d3643b8"
        }
      ]
    },
    {
      "bom-ref": "d54ab89c-714c-45f5-b552-46e39800b284",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7"
        }
      ]
    },
    {
      "bom-ref": "35c3260f-8fe1-4e6b-bfa3-c736c35f2cc2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7"
        }
      ]
    },
    {
      "bom-ref": "7be39dda-f1b0-42e1-81d5-c640d8355098",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7"
        }
      ]
    },
    {
      "bom-ref": "cc71a981-ccd9-4eff-ae1d-4b07c492f99d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7"
        }
      ]
    },
    {
      "bom-ref": "9d7190b1-43c0-44c1-9ff8-4c54a88c5eff",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7"
        }
      ]
    },
    {
      "bom-ref": "ee037f29-47d3-47c8-b31c-56e7812a48a8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "816fd62c-9f38-4b13-b540-8ee64d1041c7"
        }
      ]
    },
    {
      "bom-ref": "b2619867-068c-4918-839e-1207befe0cde",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "8bcc3bc4-05d3-43d2-a960-e9b88a2158f8"
        }
      ]
    },
    {
      "bom-ref": "9e9ecef0-413f-4fe6-aacc-8179becb77bc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75"
        }
      ]
    },
    {
      "bom-ref": "c3278825-a722-43e2-8068-ffdb7adee08e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75"
        }
      ]
    },
    {
      "bom-ref": "008bda3e-58ea-44bc-99ca-45a2693910fc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75"
        }
      ]
    },
    {
      "bom-ref": "34b0f27d-9be2-45e2-9a14-8e97c2b97bd6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75"
        }
      ]
    },
    {
      "bom-ref": "7cac5965-7eaf-4143-9c30-57442cca963e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64"
        }
      ]
    },
    {
      "bom-ref": "b12092f2-fe34-410a-af20-6c7c3d2b3882",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75"
        }
      ]
    },
    {
      "bom-ref": "92ed38b5-8a74-4dee-b9b2-a1462a14cfd7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8d3d92e3-2cc7-4c1a-b2b6-a7449f8aab75"
        }
      ]
    },
    {
      "bom-ref": "9cb10615-3835-4a06-a9dd-6ea3d7363919",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "665b0e52-b264-4ffb-8636-03dd05c89217"
        }
      ]
    },
    {
      "bom-ref": "66b46312-9217-4ea5-adea-8c7381642877",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64"
        }
      ]
    },
    {
      "bom-ref": "af6209c8-07cd-490b-8629-636116fa23b4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64"
        }
      ]
    },
    {
      "bom-ref": "8ffeb680-ae02-434d-93f8-0a1c3638d109",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64"
        }
      ]
    },
    {
      "bom-ref": "a6225f35-213e-4d8a-a6cd-086929f025b1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "82ef306a-b0ff-44a5-b4bb-b7a3c8b6ee64"
        }
      ]
    },
    {
      "bom-ref": "edba9cf3-26cc-46b8-a245-35dca252849a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e"
        }
      ]
    },
    {
      "bom-ref": "02a4614a-2946-41c6-9cd3-4a9512c36b4e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e"
        }
      ]
    },
    {
      "bom-ref": "d45a2713-5239-44b2-8b7f-c5546643abac",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e"
        }
      ]
    },
    {
      "bom-ref": "2b64e00b-8e46-4073-89e9-cf8a618a2124",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e"
        }
      ]
    },
    {
      "bom-ref": "dc935d0d-0841-42dd-a5c8-112c8fbc7c98",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e"
        }
      ]
    },
    {
      "bom-ref": "c652c618-2292-4f10-a096-82ae1b3d168a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "815406bf-4ba8-423f-9db1-c4e1ad99456e"
        }
      ]
    },
    {
      "bom-ref": "0ade74dd-02bb-46d3-a711-6657f7a7b4d7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea"
        }
      ]
    },
    {
      "bom-ref": "08d93867-2959-47eb-9b17-9c13ea6dc2d0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70"
        }
      ]
    },
    {
      "bom-ref": "e5f5c560-52af-4c55-b566-88cdddb79db7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70"
        }
      ]
    },
    {
      "bom-ref": "74c8862d-94bd-47e4-b303-2c2e23fcd6c5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70"
        }
      ]
    },
    {
      "bom-ref": "edfe22b9-e1d2-4660-a59a-cfc9ba774078",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70"
        }
      ]
    },
    {
      "bom-ref": "160d7a59-c441-4009-b36a-89cd006150f2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70"
        }
      ]
    },
    {
      "bom-ref": "97ea88bf-ca46-4462-aa9f-5ef3bd901b31",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "86c91669-4477-4eb1-84fa-3a8d6d429c70"
        }
      ]
    },
    {
      "bom-ref": "91b7d800-f582-4314-9fa5-15dc1204cfe6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "90a7e7d0-5d4f-4aaf-b4b0-aa69a86d8131"
        }
      ]
    },
    {
      "bom-ref": "d10c8dac-5d3b-4a56-a6cb-cca03ce6329b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "8f85807a-1c53-4468-ad63-624afba43424"
        }
      ]
    },
    {
      "bom-ref": "c910fbd8-d99c-4bb1-b31b-98ccaebd609c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "89bcbc9a-1471-4d09-99e9-180251156b36"
        }
      ]
    },
    {
      "bom-ref": "68b9912e-251e-4817-b87f-9713754ceef8",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "91251859-6fc3-46f4-9489-69a1e8a2c5a0"
        }
      ]
    },
    {
      "bom-ref": "c491e534-0bd5-47fc-bdc1-e6f5a1318463",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "91072551-6b25-4fe3-8aeb-f3de71197180"
        }
      ]
    },
    {
      "bom-ref": "27c66540-d1d7-4bc0-9b5b-6d95c291e0d4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5"
        }
      ]
    },
    {
      "bom-ref": "6c18ffc5-2952-4647-a104-13320960343d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5"
        }
      ]
    },
    {
      "bom-ref": "80adfcfa-85e0-43a1-8a64-f91515046de3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5"
        }
      ]
    },
    {
      "bom-ref": "4808748a-f039-462a-ba14-a940bfb435c6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5"
        }
      ]
    },
    {
      "bom-ref": "3c6043bc-235d-48a8-b939-f294ef9fd67c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "903dc195-fbc6-4805-b389-0408eac82a50"
        }
      ]
    },
    {
      "bom-ref": "1c92a39c-9790-4415-a738-b5f86e7f3e0a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5"
        }
      ]
    },
    {
      "bom-ref": "99b0673b-c208-4292-8dd4-94d027be5b51",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "87188d9e-b3c2-41be-9abd-37357aa80ef5"
        }
      ]
    },
    {
      "bom-ref": "e9811995-bc82-496c-833b-056d5362e952",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc"
        }
      ]
    },
    {
      "bom-ref": "088d8233-b42c-4c29-b2c6-d83d561e1ada",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc"
        }
      ]
    },
    {
      "bom-ref": "2244d9e6-6f1b-4c34-8a85-de1cbb6bcc76",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc"
        }
      ]
    },
    {
      "bom-ref": "e25dfcba-ec21-41a9-9ba4-a74fde0c1ea5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc"
        }
      ]
    },
    {
      "bom-ref": "60c6b89a-09ae-47d8-885b-d203b12d4416",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc"
        }
      ]
    },
    {
      "bom-ref": "4d55a68e-a995-4ae1-bcd9-29064acf9e32",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "87c4e231-3a60-4b21-9abf-72cf4dc2f7cc"
        }
      ]
    },
    {
      "bom-ref": "d4f452f1-b67a-47f1-a998-81812c3d8652",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "92c95cd8-ce64-441e-a31a-b47a3e14f821"
        }
      ]
    },
    {
      "bom-ref": "8f8df44f-5bb7-4d5f-9f11-595c3be7f31d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "90b758b1-46c9-412d-beaf-a9bb4dfeee17"
        }
      ]
    },
    {
      "bom-ref": "201dd2cd-4945-4435-842e-708b7adea9d6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "90aa573a-0996-4e2c-802b-f847e30e4809"
        }
      ]
    },
    {
      "bom-ref": "890fc916-7ff0-4b4b-a98c-486f1483ea4d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "922e894f-dd77-40b2-8eec-0a9099288c7b"
        }
      ]
    },
    {
      "bom-ref": "821a27ca-3035-4a51-9917-4162453f1d21",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "93c3162a-0e71-424a-9526-16ff29fe40e9"
        }
      ]
    },
    {
      "bom-ref": "cb1e74d1-2967-4ba6-98ab-be5b1ad6b776",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "90aa573a-0996-4e2c-802b-f847e30e4809"
        }
      ]
    },
    {
      "bom-ref": "cac21dda-e7c5-4c86-bbe7-8bab4fbe23a3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "90aa573a-0996-4e2c-802b-f847e30e4809"
        }
      ]
    },
    {
      "bom-ref": "31c7c08c-a8c9-4808-8bb3-4d5740ae9267",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "90aa573a-0996-4e2c-802b-f847e30e4809"
        }
      ]
    },
    {
      "bom-ref": "d13ae583-a102-44f1-8de7-847cb3be7b61",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "90aa573a-0996-4e2c-802b-f847e30e4809"
        }
      ]
    },
    {
      "bom-ref": "bed0a3d5-7277-4bca-8807-59f0ae704a24",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "90aa573a-0996-4e2c-802b-f847e30e4809"
        }
      ]
    },
    {
      "bom-ref": "62108fd5-33f6-4921-a30e-00f5dfb4bb10",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9567ef9a-29a5-43a5-9e33-f63a52a42f0f"
        }
      ]
    },
    {
      "bom-ref": "d11a32dd-20a9-4379-a789-aa713802c357",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "95693891-4051-4458-bb79-f2c042c960ee"
        }
      ]
    },
    {
      "bom-ref": "22acb364-f165-404a-992b-37826eca3699",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8b705ae5-a34b-471c-945f-f271ea68e517"
        }
      ]
    },
    {
      "bom-ref": "a8f9fcb3-80b7-4798-84c6-22e59c70d0f4",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8b705ae5-a34b-471c-945f-f271ea68e517"
        }
      ]
    },
    {
      "bom-ref": "12d6ac84-09da-432a-92da-8f25fafbdd44",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8b705ae5-a34b-471c-945f-f271ea68e517"
        }
      ]
    },
    {
      "bom-ref": "8ecf1317-5138-4e75-8f81-d728242d4ab4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8b705ae5-a34b-471c-945f-f271ea68e517"
        }
      ]
    },
    {
      "bom-ref": "bf5200ed-c1a7-4bd7-8705-8463bcc309f9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8b705ae5-a34b-471c-945f-f271ea68e517"
        }
      ]
    },
    {
      "bom-ref": "53d736e2-c157-4c75-b84b-aa7f1dab2d35",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8b705ae5-a34b-471c-945f-f271ea68e517"
        }
      ]
    },
    {
      "bom-ref": "ca5ec640-1ecd-4594-8576-5512609d8288",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a"
        }
      ]
    },
    {
      "bom-ref": "828c3d13-9d62-4943-b3fb-345bf55fe3e1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a"
        }
      ]
    },
    {
      "bom-ref": "c51f9a40-371e-4ace-a538-b520c56e5338",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a"
        }
      ]
    },
    {
      "bom-ref": "f12b35ac-f6d0-4c6f-89ab-6026e23cebde",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a"
        }
      ]
    },
    {
      "bom-ref": "ae05452d-30b0-47b4-887a-745b0a880fc4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a"
        }
      ]
    },
    {
      "bom-ref": "44f51cb2-0e76-4273-b77a-99e83c1c8276",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8f1608e0-8f3c-4c58-9f50-114394d6c07a"
        }
      ]
    },
    {
      "bom-ref": "88bedd8d-f677-4da2-a535-225d482604cf",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "916df323-ca44-43a5-86a8-78dcd088a77c"
        }
      ]
    },
    {
      "bom-ref": "6b048109-1aca-4bcb-a333-1ab26e1eec98",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "916df323-ca44-43a5-86a8-78dcd088a77c"
        }
      ]
    },
    {
      "bom-ref": "7838bb0b-1fe3-4ddb-bcdd-adac70c16c9a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "916df323-ca44-43a5-86a8-78dcd088a77c"
        }
      ]
    },
    {
      "bom-ref": "760f17da-f85f-4174-bde4-579eb8e88605",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "916df323-ca44-43a5-86a8-78dcd088a77c"
        }
      ]
    },
    {
      "bom-ref": "c8035e97-edc6-47d2-bd8b-578f7e4042f4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "916df323-ca44-43a5-86a8-78dcd088a77c"
        }
      ]
    },
    {
      "bom-ref": "eea6a6b6-ce4b-4af9-90b0-5f4b64c572eb",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "916df323-ca44-43a5-86a8-78dcd088a77c"
        }
      ]
    },
    {
      "bom-ref": "88d347a3-99cd-439e-bd41-b2b9e00936be",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "960b59c0-a95e-4640-a68a-383a826f7771"
        }
      ]
    },
    {
      "bom-ref": "f8ca6e51-dcf0-4879-bab6-7026503d6233",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "95f70a6c-46c4-44ca-b33b-3fa46ff797e2"
        }
      ]
    },
    {
      "bom-ref": "556b115a-1952-4066-bb26-29e01300f9f3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "903dc195-fbc6-4805-b389-0408eac82a50"
        }
      ]
    },
    {
      "bom-ref": "c5ecd8d9-c27c-407b-bcd0-eeb6fef5d481",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "903dc195-fbc6-4805-b389-0408eac82a50"
        }
      ]
    },
    {
      "bom-ref": "f53d7961-b0cf-4e40-80dd-6744213f1f16",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "903dc195-fbc6-4805-b389-0408eac82a50"
        }
      ]
    },
    {
      "bom-ref": "1a88d57d-e9bd-4f16-a4ff-981afe82f54b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "903dc195-fbc6-4805-b389-0408eac82a50"
        }
      ]
    },
    {
      "bom-ref": "594c7371-41fb-4814-a8ca-4f20bda7daf6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "903dc195-fbc6-4805-b389-0408eac82a50"
        }
      ]
    },
    {
      "bom-ref": "fbf3a703-2f95-4431-85c2-1a08941b2d47",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa"
        }
      ]
    },
    {
      "bom-ref": "05cca63a-bd84-4f07-99fd-145e7191727b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa"
        }
      ]
    },
    {
      "bom-ref": "d17c94cb-d3ba-43d0-b132-dac44016dd4c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa"
        }
      ]
    },
    {
      "bom-ref": "213d8218-1478-45ef-9c06-f80b853cc076",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa"
        }
      ]
    },
    {
      "bom-ref": "1c4696ad-504c-47dc-a576-da84cd528d23",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa"
        }
      ]
    },
    {
      "bom-ref": "5f0f487a-2ae7-40ff-9a39-0b0b2c595419",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "8f28944c-e7c7-4c5b-ad4e-863089b3cafa"
        }
      ]
    },
    {
      "bom-ref": "29cf58b4-b8ab-4dcb-99b0-052fd38b1406",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "984a9e76-6fc3-47e4-9ea5-18c6fed3d60e"
        }
      ]
    },
    {
      "bom-ref": "47d7b35e-efc0-4745-a19e-044fe189f45c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a"
        }
      ]
    },
    {
      "bom-ref": "8054e721-1624-46a3-bf9e-6c6b1fe1e90f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a"
        }
      ]
    },
    {
      "bom-ref": "d853e216-2bf9-4ac2-b4df-76ab40239a6d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a"
        }
      ]
    },
    {
      "bom-ref": "050a1f7c-5592-4c42-bd39-ece48a3cb531",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a"
        }
      ]
    },
    {
      "bom-ref": "5c65b148-9a12-4166-a05b-d23ecae859d6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a"
        }
      ]
    },
    {
      "bom-ref": "ac09a3d8-0983-4baa-b43b-3da5d37bafc5",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "91ecbf23-a226-4528-8fa7-3cb4c3eccf6a"
        }
      ]
    },
    {
      "bom-ref": "491c9d4a-23b3-4399-a214-ac28df2f4318",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f"
        }
      ]
    },
    {
      "bom-ref": "32afa800-68f7-47ca-b274-16a91fab927e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f"
        }
      ]
    },
    {
      "bom-ref": "74b56b74-c775-4085-8e53-0f30326d1ed8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f"
        }
      ]
    },
    {
      "bom-ref": "03da6d1c-6f59-484d-9153-471a3f15864a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f"
        }
      ]
    },
    {
      "bom-ref": "ec2b1a38-9ba0-4270-ab3d-40115b90b7f5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f"
        }
      ]
    },
    {
      "bom-ref": "e87dc9b6-ded6-4217-b1ab-fd506fbd068d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9445245c-750d-4d07-9cd8-b081263b8c8f"
        }
      ]
    },
    {
      "bom-ref": "6ccf759b-201b-4bce-9db1-be15d93f0733",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239"
        }
      ]
    },
    {
      "bom-ref": "e7d13c49-9427-4e18-970c-31b3f64854c6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239"
        }
      ]
    },
    {
      "bom-ref": "2925f774-6fdc-4568-9a90-a379ee7ef22e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239"
        }
      ]
    },
    {
      "bom-ref": "acf5fa5b-7863-42dd-a71d-128267cf4c3b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239"
        }
      ]
    },
    {
      "bom-ref": "6926bfd1-20ec-4f36-871a-55ac3a8c2721",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239"
        }
      ]
    },
    {
      "bom-ref": "7ab4b325-2dca-476d-af6b-6fdad2e245ad",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "921e1a74-1a63-456b-99cc-e2e2fdd8c239"
        }
      ]
    },
    {
      "bom-ref": "80781924-ba4c-43e9-b8c6-89af8230ce6b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "93ed2686-2307-454a-88ce-4edc0f602820"
        }
      ]
    },
    {
      "bom-ref": "62e65b64-eebb-4949-a9fe-12687005e294",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "93ed2686-2307-454a-88ce-4edc0f602820"
        }
      ]
    },
    {
      "bom-ref": "340cbc90-2c32-4030-baac-a3857b13c95b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "93ed2686-2307-454a-88ce-4edc0f602820"
        }
      ]
    },
    {
      "bom-ref": "24411fc6-236a-4936-ab64-fbfaf0a67d81",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "93ed2686-2307-454a-88ce-4edc0f602820"
        }
      ]
    },
    {
      "bom-ref": "0dace464-0147-4314-ae82-a17887b85bfa",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "93ed2686-2307-454a-88ce-4edc0f602820"
        }
      ]
    },
    {
      "bom-ref": "5a64d001-0a07-40f1-8e4e-b9c0774abcca",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "93ed2686-2307-454a-88ce-4edc0f602820"
        }
      ]
    },
    {
      "bom-ref": "b1da202d-d663-4c1e-a92a-d9bbed51cc59",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8"
        }
      ]
    },
    {
      "bom-ref": "c1940391-1747-4d35-bbfe-b321f4a9dbdf",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8"
        }
      ]
    },
    {
      "bom-ref": "79f166c0-630b-4cf3-ad8c-2f2683ce4551",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8"
        }
      ]
    },
    {
      "bom-ref": "433c46d2-e2f9-4397-a147-f91911d48ccc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8"
        }
      ]
    },
    {
      "bom-ref": "938e1f2f-7f42-4b6c-9015-d5f90905e3fa",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8"
        }
      ]
    },
    {
      "bom-ref": "9021426a-582f-475e-a1f8-1d88b573d4b7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "98b4936a-3ff6-4f13-9444-65939a1773c8"
        }
      ]
    },
    {
      "bom-ref": "52fba1c1-89a4-42d8-8339-e028302fc597",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd"
        }
      ]
    },
    {
      "bom-ref": "f2a5eef7-6dba-4596-9630-9fe0da579953",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd"
        }
      ]
    },
    {
      "bom-ref": "e2fab131-2461-4367-8a0b-16ed0e49a210",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd"
        }
      ]
    },
    {
      "bom-ref": "52e01a23-66e6-4cf0-a196-0ec1f0cc502c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd"
        }
      ]
    },
    {
      "bom-ref": "3df11a7f-2372-4b5e-9360-92cf03b88f2e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd"
        }
      ]
    },
    {
      "bom-ref": "2c766efe-79fd-4926-9bfa-0e65bea973e4",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "95258ac7-6bee-4b5f-8ee8-da5533b5f2dd"
        }
      ]
    },
    {
      "bom-ref": "b0b74f62-30b7-4437-8361-dec6155d38ab",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9352b053-8490-4cf1-881f-18e4629f373c"
        }
      ]
    },
    {
      "bom-ref": "008bce20-5548-47af-949f-552be8d62d78",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9352b053-8490-4cf1-881f-18e4629f373c"
        }
      ]
    },
    {
      "bom-ref": "c6c1abb8-24c3-4519-a524-0aa15e362679",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9352b053-8490-4cf1-881f-18e4629f373c"
        }
      ]
    },
    {
      "bom-ref": "70cdf209-2331-4d93-8714-f8f03ab41bbe",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9352b053-8490-4cf1-881f-18e4629f373c"
        }
      ]
    },
    {
      "bom-ref": "be0c902e-d373-40ea-b97a-344442078206",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9352b053-8490-4cf1-881f-18e4629f373c"
        }
      ]
    },
    {
      "bom-ref": "370170a8-8bcc-4f95-854a-3d033965b570",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9352b053-8490-4cf1-881f-18e4629f373c"
        }
      ]
    },
    {
      "bom-ref": "ff8f01e9-8c8d-4948-b4e1-b8f1564be116",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3"
        }
      ]
    },
    {
      "bom-ref": "55e03a35-86d1-4545-9980-722399d54631",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3"
        }
      ]
    },
    {
      "bom-ref": "0b732d62-5805-4265-9de5-bb2bb734d64c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3"
        }
      ]
    },
    {
      "bom-ref": "5971be6d-a4a3-49cd-8bce-4c5306809f6e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3"
        }
      ]
    },
    {
      "bom-ref": "5dd5e9be-d8e7-4cd8-ac58-6cb495ab0a37",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3"
        }
      ]
    },
    {
      "bom-ref": "1c921e05-eb28-4ed3-b6ab-028e4134fef6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "957d5d62-181e-4389-b2d4-f9a8fb8063f3"
        }
      ]
    },
    {
      "bom-ref": "675f3ec2-760a-4250-b9c8-e1b39741b762",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c"
        }
      ]
    },
    {
      "bom-ref": "48ef1530-769d-4bbe-81ea-9e5bcc4414fa",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c"
        }
      ]
    },
    {
      "bom-ref": "fbca9b56-da13-4bc9-8051-5735901e5a4d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c"
        }
      ]
    },
    {
      "bom-ref": "1bcedc2c-d9d1-46d6-a27e-34d9d5753076",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c"
        }
      ]
    },
    {
      "bom-ref": "426b154b-7922-4d4b-b640-576a0682212d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c"
        }
      ]
    },
    {
      "bom-ref": "3310ff1b-3577-4a06-8ae1-4dce8fd79845",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "94fbc5be-c39e-468b-bfbc-8a78cb63147c"
        }
      ]
    },
    {
      "bom-ref": "6a3d44af-ac4f-421c-ae28-16387bf2ed55",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "95d64b4b-8644-46ae-b068-3c862691529b"
        }
      ]
    },
    {
      "bom-ref": "29acb699-4b53-42de-98b4-6eea01650f7b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "95d64b4b-8644-46ae-b068-3c862691529b"
        }
      ]
    },
    {
      "bom-ref": "c8924b43-959a-47cc-9905-18dbc628bae5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "95d64b4b-8644-46ae-b068-3c862691529b"
        }
      ]
    },
    {
      "bom-ref": "30949ab2-e667-48ee-82f2-0e946e23c061",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "95d64b4b-8644-46ae-b068-3c862691529b"
        }
      ]
    },
    {
      "bom-ref": "c0184f4a-7288-41b2-a60b-e33db6df7aab",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "95d64b4b-8644-46ae-b068-3c862691529b"
        }
      ]
    },
    {
      "bom-ref": "0e8bc05f-e4a2-4279-8d14-cfebe45fe7fd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "95d64b4b-8644-46ae-b068-3c862691529b"
        }
      ]
    },
    {
      "bom-ref": "4f675ed8-3420-4d7a-8e7a-b8adb70ade19",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9641d376-2f72-4925-867a-a1fff4dfe991"
        }
      ]
    },
    {
      "bom-ref": "21a3a748-f02b-4bad-a8b5-a9880624e9ba",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9641d376-2f72-4925-867a-a1fff4dfe991"
        }
      ]
    },
    {
      "bom-ref": "e70b7a88-ba97-4505-99a7-4beae949ab9a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9641d376-2f72-4925-867a-a1fff4dfe991"
        }
      ]
    },
    {
      "bom-ref": "164a6bf7-11b7-40ea-bde5-bae79519b149",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9641d376-2f72-4925-867a-a1fff4dfe991"
        }
      ]
    },
    {
      "bom-ref": "aa93316b-c570-4726-b808-fca4bed39ff2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9641d376-2f72-4925-867a-a1fff4dfe991"
        }
      ]
    },
    {
      "bom-ref": "112e270f-75a1-422d-a186-1b08292a1e8d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9641d376-2f72-4925-867a-a1fff4dfe991"
        }
      ]
    },
    {
      "bom-ref": "708c0924-679b-4c23-95ed-f6a781752458",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9c4070df-5538-4531-9535-3a3f18fdacb8"
        }
      ]
    },
    {
      "bom-ref": "be306dfd-85f1-4dcf-9adc-60dc1ebd1aa6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355"
        }
      ]
    },
    {
      "bom-ref": "b2a7d00b-df4c-441c-94d1-f2dbeff9c8a2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355"
        }
      ]
    },
    {
      "bom-ref": "6fdf5392-e7e5-48d3-b35c-9f06e74e782e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355"
        }
      ]
    },
    {
      "bom-ref": "83b07ef7-9a6e-4107-933f-30b5581fd72b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355"
        }
      ]
    },
    {
      "bom-ref": "15dc209f-88dd-4de5-a3a2-3f1b97c31317",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355"
        }
      ]
    },
    {
      "bom-ref": "31ff9e1d-79ca-444b-84ba-3422b02109ae",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9b1cdb85-bd95-4cc3-9d18-7e563094c355"
        }
      ]
    },
    {
      "bom-ref": "486c6ca9-b812-481a-95b4-164c19bb9a16",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca"
        }
      ]
    },
    {
      "bom-ref": "3a744e2b-ab8d-4243-a53b-096894b7af11",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca"
        }
      ]
    },
    {
      "bom-ref": "cb01c7b4-e833-4117-8066-5d6bed7aaf53",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca"
        }
      ]
    },
    {
      "bom-ref": "75f728d8-e55e-4ea3-81f4-00b462050152",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca"
        }
      ]
    },
    {
      "bom-ref": "01ff10f1-d1f2-487d-a869-7076f17e6052",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca"
        }
      ]
    },
    {
      "bom-ref": "d27e2c46-3fe2-4a3e-a9ec-a6c9a3677820",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "95e1cdb7-37c8-4805-ab3b-79440521b0ca"
        }
      ]
    },
    {
      "bom-ref": "282f3425-d189-49b2-a611-547cc0ebb692",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "5042cb98-efb0-4f87-a7d8-f237e81296b0",
      "id": "CVE-2023-4408",
      "description": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "3b6399e3-e3f3-422c-ba14-8ac761480b04",
      "id": "CVE-2023-5517",
      "description": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect \u003cdomain\u003e;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "a9ed01b8-33fb-477e-9307-784ab44a69b4",
      "id": "CVE-2023-5679",
      "description": "A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "818d4edb-973d-41ff-8d9f-44bc9111c22e",
      "id": "CVE-2023-5680",
      "description": "If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. \nThis issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "2a36ae21-96c1-44fa-a18b-c23e14d85798",
      "id": "CVE-2024-0760",
      "description": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "290d4a63-ee5d-41be-abbb-eeceee40776e",
      "id": "CVE-2024-11187",
      "description": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "3ffcba31-7537-414f-af9d-032360c9d12e",
      "id": "CVE-2024-12705",
      "description": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "260df9c5-884f-4732-afe5-1f81459c84b1",
      "id": "CVE-2024-1737",
      "description": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "9e7cdce3-57d9-4099-8bbd-5062d2bc2cbd",
      "id": "CVE-2024-1975",
      "description": "If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "f1aa09bd-fe1a-457e-9e80-5c8d504332a7",
      "id": "CVE-2024-4076",
      "description": "Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "0e410e61-22c6-45c2-841f-09846ec9104f",
      "id": "CVE-2025-40776",
      "description": "A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "b975788f-abcc-490d-97cb-2ee7acf7aa86",
      "id": "CVE-2025-40778",
      "description": "Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "748411a3-c104-4cd8-bf9b-bd60ddeb4319",
      "id": "CVE-2025-40780",
      "description": "In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "f7fa40f8-4026-447b-8a8b-b721fd88e71f",
      "id": "CVE-2025-8677",
      "description": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "9afb4bc5-c5b1-465b-b9f9-446a6975db30",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "99bc5f7d-5b87-4167-85be-ed144a5673be"
        }
      ]
    },
    {
      "bom-ref": "5599cddf-a75f-44ac-b796-bfd4e3d98794",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290"
        }
      ]
    },
    {
      "bom-ref": "a2c89d4e-1db1-46a8-94f7-ac017799f9c2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290"
        }
      ]
    },
    {
      "bom-ref": "1952e0a0-0646-4de5-b0e6-a42b71b0a3b9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290"
        }
      ]
    },
    {
      "bom-ref": "4d55fffa-ccea-4bea-adcc-97a73803f47f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290"
        }
      ]
    },
    {
      "bom-ref": "ef4a6a40-0905-4db9-a37c-4873c2d7bff7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290"
        }
      ]
    },
    {
      "bom-ref": "2bf83f7e-6627-48dd-bd37-d95e4c53f197",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9b4219f2-f1bf-4345-b824-ce3630a23290"
        }
      ]
    },
    {
      "bom-ref": "bad143a7-596d-4b30-804f-7814a18dfa71",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9a1e088c-0b54-4b7e-b814-8d01eb28204b"
        }
      ]
    },
    {
      "bom-ref": "ab752391-2bcb-43a3-9a72-b9e591df4609",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9d365d08-3b31-4aa5-a04c-773c369cacb2"
        }
      ]
    },
    {
      "bom-ref": "6092a35c-452c-411e-b82e-dc5815e96503",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9b56b40b-f121-47fe-a43e-424285473e21"
        }
      ]
    },
    {
      "bom-ref": "37400b75-727d-4979-930d-923b7a5de202",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10"
        }
      ]
    },
    {
      "bom-ref": "3e697853-19b1-46df-9a5c-ab85cccd997d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10"
        }
      ]
    },
    {
      "bom-ref": "b3a4fd22-26ad-4371-a5e1-44f445890cff",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10"
        }
      ]
    },
    {
      "bom-ref": "ac4c4c90-7e16-45f9-b2c1-b0fde8524eda",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10"
        }
      ]
    },
    {
      "bom-ref": "21601ef3-c7c5-45d7-b94c-d692f484f7df",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10"
        }
      ]
    },
    {
      "bom-ref": "0bc7300c-78b1-4a27-8393-3aec185f48e1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "96610d69-2cc1-4fda-a5ae-83bb3fb14f10"
        }
      ]
    },
    {
      "bom-ref": "c6d86eb8-286d-47fd-aa9c-8c8f63fa3d96",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9ecf6f64-41aa-47b6-a1ee-a582fc511f0c"
        }
      ]
    },
    {
      "bom-ref": "47238e9d-0f90-43bc-a683-9918d11b640b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a"
        }
      ]
    },
    {
      "bom-ref": "95aa1223-ecdb-4e95-91a4-363b55e4a670",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a"
        }
      ]
    },
    {
      "bom-ref": "c3c3c7c6-0a97-40c2-93cb-71b2108a3ab8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a"
        }
      ]
    },
    {
      "bom-ref": "325901ec-46a6-4b15-a9d2-55585a2d3a25",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a"
        }
      ]
    },
    {
      "bom-ref": "07279a6f-d4ae-48e1-acba-475f47c42627",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a"
        }
      ]
    },
    {
      "bom-ref": "34a2e6be-81c0-4275-9b86-104a03c159e6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "982f17d9-b696-4dc4-97e9-acce9ed21c7a"
        }
      ]
    },
    {
      "bom-ref": "9bc32c16-a35e-4971-b135-0361758c16fc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a"
        }
      ]
    },
    {
      "bom-ref": "e3903019-f5d1-498c-b659-c463382aaeb2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a"
        }
      ]
    },
    {
      "bom-ref": "7b476c67-1f3d-491d-9d02-920a8e53a959",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a"
        }
      ]
    },
    {
      "bom-ref": "76dfd0e0-b7f2-4648-b9f7-4e9bea301063",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a"
        }
      ]
    },
    {
      "bom-ref": "d2ecde84-8d14-4b4c-818b-14f52837d338",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a"
        }
      ]
    },
    {
      "bom-ref": "6df53d66-f401-4d5e-bd9c-aa299a92c7df",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9da14493-aa82-4a35-b590-b60c33a38b2a"
        }
      ]
    },
    {
      "bom-ref": "419742fe-65f2-4cbb-b351-927acf681b29",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9911d254-fc7d-402e-a525-52503f750d32"
        }
      ]
    },
    {
      "bom-ref": "2b0ea067-cb27-434a-bb1c-02503cc38480",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9911d254-fc7d-402e-a525-52503f750d32"
        }
      ]
    },
    {
      "bom-ref": "e65e2b21-c2b8-4ab1-aa20-505ab99ca44d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9911d254-fc7d-402e-a525-52503f750d32"
        }
      ]
    },
    {
      "bom-ref": "e2c002f8-7298-4bd4-a0b4-42b1e18c9b6a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9911d254-fc7d-402e-a525-52503f750d32"
        }
      ]
    },
    {
      "bom-ref": "56c7697b-d18b-4bce-9f2e-90c501d594f6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9911d254-fc7d-402e-a525-52503f750d32"
        }
      ]
    },
    {
      "bom-ref": "a1dd3eee-0f23-47cf-827d-aed3abadb8dd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9911d254-fc7d-402e-a525-52503f750d32"
        }
      ]
    },
    {
      "bom-ref": "356d33e4-b3b4-4af4-afd3-216dc572a268",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "9f766e0e-f7fc-41d8-bd8b-e42fd558cb51"
        }
      ]
    },
    {
      "bom-ref": "c82185db-d928-44ac-bf74-9f5a911725e6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a0b27aee-efd0-4e9a-9b63-f0797cb3fc2f"
        }
      ]
    },
    {
      "bom-ref": "fb8d40f5-c9b0-4954-ba63-5a423d552e00",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6"
        }
      ]
    },
    {
      "bom-ref": "49e39070-b343-4d5d-863d-a69663f5b1c6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6"
        }
      ]
    },
    {
      "bom-ref": "85547509-66f2-4e3c-850f-91ff639816fb",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6"
        }
      ]
    },
    {
      "bom-ref": "0eb854d1-f025-400c-8a25-fde401f945aa",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6"
        }
      ]
    },
    {
      "bom-ref": "e0194153-427c-4667-b17a-5a034abd3efe",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6"
        }
      ]
    },
    {
      "bom-ref": "9f177a8d-9d26-4bbd-b0f6-66fd4e44d465",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "99372590-f5bb-46b2-9c7a-eaf77d21c3d6"
        }
      ]
    },
    {
      "bom-ref": "0dcff4f6-e3ae-4a33-a1b6-89284e825ec0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6"
        }
      ]
    },
    {
      "bom-ref": "e3b6fa21-3762-4451-927c-68a5534b8bf1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6"
        }
      ]
    },
    {
      "bom-ref": "b2b6c66e-5e60-4e1f-8578-83cd33770055",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6"
        }
      ]
    },
    {
      "bom-ref": "61ee2bef-5779-4e70-ad24-2f3567ac1abc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6"
        }
      ]
    },
    {
      "bom-ref": "1bd87847-9adc-4881-b7c9-6679bcd1c772",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6"
        }
      ]
    },
    {
      "bom-ref": "6734d49b-c7ff-426c-80b4-737725246ef0",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9a41130a-e561-4499-a2fd-aea4ad3e3cd6"
        }
      ]
    },
    {
      "bom-ref": "4ea48fc6-a659-49db-838c-8e0384f739a0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e"
        }
      ]
    },
    {
      "bom-ref": "d119d4fd-ce11-4779-8578-574883edfd83",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e"
        }
      ]
    },
    {
      "bom-ref": "6b53ec18-c53f-4ff8-b257-eea6a8a822d4",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e"
        }
      ]
    },
    {
      "bom-ref": "9de1c85d-af3a-4ebe-80ba-4ac1621a0151",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e"
        }
      ]
    },
    {
      "bom-ref": "0da72d94-5bb4-45ae-a8f9-a27d952e91a2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e"
        }
      ]
    },
    {
      "bom-ref": "17974ce4-b389-4d1a-8895-5ebb49b04ca7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9eab9ccd-f9aa-4e0e-b044-7b8dd9fe597e"
        }
      ]
    },
    {
      "bom-ref": "8d2744c7-6e15-4b7a-85ac-6cd4f0ed811a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b"
        }
      ]
    },
    {
      "bom-ref": "b60eda01-b267-4455-97e9-f95f7d8a39b1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b"
        }
      ]
    },
    {
      "bom-ref": "dbbef54c-08ce-4755-809f-93a07b8cdba8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b"
        }
      ]
    },
    {
      "bom-ref": "734173f4-76f9-4c66-9bd8-eec10ef88ecc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b"
        }
      ]
    },
    {
      "bom-ref": "79bee174-6e24-4ef7-b47f-a0fdf7b9a8aa",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b"
        }
      ]
    },
    {
      "bom-ref": "d6bec167-f89d-4a90-89c4-87f7cd6ac80a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9b2f7954-c8a2-43c7-a330-fe0f6db2c24b"
        }
      ]
    },
    {
      "bom-ref": "8e9cef32-8ffd-41a8-a076-5451f9e2362b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a0e8af23-3b6a-4598-aef6-b59d96fe91c9"
        }
      ]
    },
    {
      "bom-ref": "7c02fa3a-7061-487e-95a0-ee283721f8ae",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a0ffaa0f-81ac-4d2e-84f1-3582743c76f2"
        }
      ]
    },
    {
      "bom-ref": "81a9b1e8-100f-4abd-90ec-57eb16547658",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911"
        }
      ]
    },
    {
      "bom-ref": "39404ab1-b2bc-4eaf-97e4-5303c5b5f374",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911"
        }
      ]
    },
    {
      "bom-ref": "24707599-e0f2-423b-a71d-3e56e1c58f10",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911"
        }
      ]
    },
    {
      "bom-ref": "3f6bcd87-2855-4962-884a-6a0c258ad869",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911"
        }
      ]
    },
    {
      "bom-ref": "d8c8996d-e349-45f1-b5b3-7dc157b95dfe",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911"
        }
      ]
    },
    {
      "bom-ref": "2f18b72d-709f-45e3-8d3c-2a4085262e95",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9a4d4993-8b3d-4613-ada6-47ac6698b911"
        }
      ]
    },
    {
      "bom-ref": "1d7290fb-93ad-4730-9631-96b41da797f8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8"
        }
      ]
    },
    {
      "bom-ref": "961d6fe1-36ae-44c8-a10d-cf42b15c2711",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8"
        }
      ]
    },
    {
      "bom-ref": "d40101df-2222-4415-87d0-500df9559f32",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8"
        }
      ]
    },
    {
      "bom-ref": "9403f3d5-8351-407b-bf1d-6ba19640f963",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8"
        }
      ]
    },
    {
      "bom-ref": "863bcf7c-453c-4efd-a83d-9cc932bfe571",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8"
        }
      ]
    },
    {
      "bom-ref": "ae0ccc2a-3040-41f1-ad51-cdc0fa7f80e5",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a18520f5-71d6-4e93-8038-52dd684f3cb8"
        }
      ]
    },
    {
      "bom-ref": "0051ccbb-8f34-4271-920a-f8e0af587038",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9"
        }
      ]
    },
    {
      "bom-ref": "ccfbfacf-9662-48cf-be27-e917822d13c6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9"
        }
      ]
    },
    {
      "bom-ref": "c0fc16ff-0f88-4006-b7f6-a6271ef2a30b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9"
        }
      ]
    },
    {
      "bom-ref": "bb7ea7ba-2450-4974-9143-cd279c03fbc6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9"
        }
      ]
    },
    {
      "bom-ref": "8eb4024b-9f2f-4f86-96d3-9c7133837c41",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9"
        }
      ]
    },
    {
      "bom-ref": "2d9b107e-361a-4789-b566-a570cfd7f1bf",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9c80b756-0bf7-450f-922e-d106bbd0e3e9"
        }
      ]
    },
    {
      "bom-ref": "c464a4c0-6851-44c6-af59-136b6e810b5e",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a29d3707-fec6-458a-bf65-82a592aec319"
        }
      ]
    },
    {
      "bom-ref": "e8f6bd43-c0a6-4bb6-aa6d-07d550c6fa2c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a1229573-300b-45d7-894f-327e56c12b36"
        }
      ]
    },
    {
      "bom-ref": "423c008c-8012-4cf0-9b78-0b2cd8ff0772",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a1e45924-4db2-401a-a590-9a331ee90c58"
        }
      ]
    },
    {
      "bom-ref": "88255d2a-27e9-4fed-b9b7-67f277bb1c52",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a1384c4b-9b6d-49e2-9f9e-282540523c36"
        }
      ]
    },
    {
      "bom-ref": "db069ee5-6a68-469e-91b9-2280c7b3336e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576"
        }
      ]
    },
    {
      "bom-ref": "fb174329-b072-4b1d-bcbf-58dae06b1bfe",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576"
        }
      ]
    },
    {
      "bom-ref": "2c38ae18-6ebb-4d7c-abc9-8f7f6ea0105a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576"
        }
      ]
    },
    {
      "bom-ref": "bf79bcd8-bd5d-40f0-9330-b42970892268",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576"
        }
      ]
    },
    {
      "bom-ref": "49be192c-bcb8-487e-aebb-785d8afab850",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576"
        }
      ]
    },
    {
      "bom-ref": "184d8670-d9ea-47e5-8cb9-e25ba75560a7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9f4d2dc2-ffc5-43f7-bd13-a7f5e0f07576"
        }
      ]
    },
    {
      "bom-ref": "312a2ad5-ea86-4aea-955e-853c4267376a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9"
        }
      ]
    },
    {
      "bom-ref": "ffe77e2e-fd0b-4067-be0c-53911c91825c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9"
        }
      ]
    },
    {
      "bom-ref": "24a2e82c-623b-456c-b7e2-229b86a3770e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9"
        }
      ]
    },
    {
      "bom-ref": "e3132738-b95f-4374-baff-baea034901cc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9"
        }
      ]
    },
    {
      "bom-ref": "6098145d-e5a0-4c04-a009-ceaef113b1ac",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9"
        }
      ]
    },
    {
      "bom-ref": "d01790c5-be9e-434a-82da-25bca1679e92",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a0d4adfc-bb3b-4b4b-bed4-6a77409564d9"
        }
      ]
    },
    {
      "bom-ref": "64edbaad-3a1c-4a8e-a109-cde3a328825f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0"
        }
      ]
    },
    {
      "bom-ref": "a22e9b59-c366-491a-b37d-f459f8bb5c87",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0"
        }
      ]
    },
    {
      "bom-ref": "f480954b-4d81-46d8-b9a1-249196819f81",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0"
        }
      ]
    },
    {
      "bom-ref": "e97b8c97-865a-48c3-a557-dff3f40e9d67",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0"
        }
      ]
    },
    {
      "bom-ref": "901af651-f07b-466a-a46a-f023060d8f6c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0"
        }
      ]
    },
    {
      "bom-ref": "770366f6-8fca-48dc-9644-3e712a3911a2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9c34ecbd-76ee-4bda-a0ae-efa70a118fc0"
        }
      ]
    },
    {
      "bom-ref": "75463388-4afc-413f-9d12-5457e2b69167",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a51c574f-e37f-4785-839a-5f75433aa2e2"
        }
      ]
    },
    {
      "bom-ref": "1e15e7b8-d8a3-47a7-92fc-468a4e10550f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9d0571d3-23bc-4307-874e-602e68d91e31"
        }
      ]
    },
    {
      "bom-ref": "97f83086-0201-49fa-a79e-64d26a745373",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9d0571d3-23bc-4307-874e-602e68d91e31"
        }
      ]
    },
    {
      "bom-ref": "0e5a46fa-2587-45d2-9a0a-b38427088436",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9d0571d3-23bc-4307-874e-602e68d91e31"
        }
      ]
    },
    {
      "bom-ref": "44eaa2c2-0adc-4c14-81d2-3be835d6530a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9d0571d3-23bc-4307-874e-602e68d91e31"
        }
      ]
    },
    {
      "bom-ref": "59c83572-2c97-44a3-a06e-6f42ea284278",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9d0571d3-23bc-4307-874e-602e68d91e31"
        }
      ]
    },
    {
      "bom-ref": "d115afb2-6eeb-40d6-b5c5-80d70527eb8d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9d0571d3-23bc-4307-874e-602e68d91e31"
        }
      ]
    },
    {
      "bom-ref": "62810a93-6ac8-482c-a049-9d5dcf80465b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a5faf6b4-e734-4ba0-bba5-012263eace8d"
        }
      ]
    },
    {
      "bom-ref": "b0e063a1-6b03-41a4-a646-850fdb07a18a",
      "id": "CVE-2015-5276",
      "description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
      "affects": [
        {
          "ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235"
        }
      ]
    },
    {
      "bom-ref": "36453c30-046c-4c0c-bb92-e22ae4e4624e",
      "id": "CVE-2018-12886",
      "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.",
      "affects": [
        {
          "ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235"
        }
      ]
    },
    {
      "bom-ref": "13ca21a6-500c-4d55-87de-1c7d3326c443",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235"
        }
      ]
    },
    {
      "bom-ref": "faf77d13-6254-4805-8d34-dd16ee1a3edf",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235"
        }
      ]
    },
    {
      "bom-ref": "be35030b-c194-47e1-989f-39d16a3bd7e9",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a60dda21-0ef0-4e90-b67c-4a3701db7235"
        }
      ]
    },
    {
      "bom-ref": "414dc703-54b5-4497-9900-85d948848047",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a7ff2c22-6c1d-4bdf-b550-0a4d88220730"
        }
      ]
    },
    {
      "bom-ref": "08f7e11a-866b-4bdc-94cf-1d8c95a4e46a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f"
        }
      ]
    },
    {
      "bom-ref": "b0f2896b-1290-44fc-8bd0-fac9698111a8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f"
        }
      ]
    },
    {
      "bom-ref": "7410d042-2abc-45f1-9921-23aaa54a7551",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f"
        }
      ]
    },
    {
      "bom-ref": "2f5ecffc-db2e-450b-8a34-384f7bbf92dc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f"
        }
      ]
    },
    {
      "bom-ref": "7d0bab77-df70-4a5b-a85e-45f323548543",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2"
        }
      ]
    },
    {
      "bom-ref": "57557dd7-bd8b-44f1-a5d7-916be59ae9f1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f"
        }
      ]
    },
    {
      "bom-ref": "c749cf3e-70e1-4525-9506-3394d65c0cad",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "9da0eed6-71f6-4b30-8190-3f7e4be0113f"
        }
      ]
    },
    {
      "bom-ref": "67a5d4df-6485-4ca3-999e-126627cb250c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "a90a9701-67ec-4c0a-9909-7c20db1b3c0c"
        }
      ]
    },
    {
      "bom-ref": "98d80e6b-4bae-4cf3-af57-0fe3883593e6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2"
        }
      ]
    },
    {
      "bom-ref": "28b7978a-7a8a-4799-8a2d-b04672f6215f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2"
        }
      ]
    },
    {
      "bom-ref": "769d3cd1-1fbb-4d3b-a023-82e3e16e2c64",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2"
        }
      ]
    },
    {
      "bom-ref": "924573ec-ef61-4424-ab05-1fbbeaf05541",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2"
        }
      ]
    },
    {
      "bom-ref": "555e5793-23c2-4d89-bd87-bde1059a0c19",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a0b9ed95-8ace-4cf4-8f60-e0dbadf2a9c2"
        }
      ]
    },
    {
      "bom-ref": "80c68dbb-e486-4066-b327-42276216580a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a181f788-e771-4dc2-9759-7cb24875069e"
        }
      ]
    },
    {
      "bom-ref": "2175b7de-4a56-4ef3-9d9a-61297cacc787",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a181f788-e771-4dc2-9759-7cb24875069e"
        }
      ]
    },
    {
      "bom-ref": "79b42175-4cbe-4535-b898-ae41649e5827",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a181f788-e771-4dc2-9759-7cb24875069e"
        }
      ]
    },
    {
      "bom-ref": "a0e38fcd-0075-47a8-bdc1-44a427f0001a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a181f788-e771-4dc2-9759-7cb24875069e"
        }
      ]
    },
    {
      "bom-ref": "48df35f1-ae9b-4bf9-b24e-fcb142e17ec0",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a181f788-e771-4dc2-9759-7cb24875069e"
        }
      ]
    },
    {
      "bom-ref": "55cff92f-5f2d-4f7f-ab3f-f999025bd322",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a181f788-e771-4dc2-9759-7cb24875069e"
        }
      ]
    },
    {
      "bom-ref": "c5eb72fe-6f19-409d-85a5-b603ff058116",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051"
        }
      ]
    },
    {
      "bom-ref": "d30935ca-bfbf-4b83-848d-bc1e0623e5bc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051"
        }
      ]
    },
    {
      "bom-ref": "b6db515c-ac90-414b-b3e4-6f35999f99de",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051"
        }
      ]
    },
    {
      "bom-ref": "e213d81f-afe1-4563-a55b-e068db16fccd",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051"
        }
      ]
    },
    {
      "bom-ref": "b1ee1ccb-c5e4-4f01-af98-00686bbb7169",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051"
        }
      ]
    },
    {
      "bom-ref": "fd0aee9b-4e5f-45f3-b6c9-7bbc2319413d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a1d6ba1b-f903-4b36-81aa-7e20b3f2b051"
        }
      ]
    },
    {
      "bom-ref": "67ecd513-58ed-4f88-b0ba-54d7aac4fc9b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "aa30cf2b-7ebe-40f6-8d82-22c2da95e5a1"
        }
      ]
    },
    {
      "bom-ref": "f4a25b9b-00a5-4c0b-890d-0813f4915e25",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0"
        }
      ]
    },
    {
      "bom-ref": "cbd68272-284f-4c4a-9896-29c5a9c1ab90",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0"
        }
      ]
    },
    {
      "bom-ref": "c38d8d13-1d87-4ee9-8a9a-272035056bfe",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0"
        }
      ]
    },
    {
      "bom-ref": "6aba6d0d-64a3-488c-a146-1093a5693b97",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0"
        }
      ]
    },
    {
      "bom-ref": "40912db0-6d19-457d-bdce-e566b72b4db1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0"
        }
      ]
    },
    {
      "bom-ref": "a1e95a89-07b6-47e6-ad1d-db785dd112f3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a24a2c88-b3d4-4774-9965-81e5af1d23c0"
        }
      ]
    },
    {
      "bom-ref": "015b80db-77bf-47bf-8af0-4fec419af404",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a507105e-dc21-4b23-aae8-44213cbb314e"
        }
      ]
    },
    {
      "bom-ref": "7656bfa5-a5bd-4c2e-9744-e395b418f066",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a507105e-dc21-4b23-aae8-44213cbb314e"
        }
      ]
    },
    {
      "bom-ref": "aa5ec444-a974-4999-81d6-d6d57b9e9772",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a507105e-dc21-4b23-aae8-44213cbb314e"
        }
      ]
    },
    {
      "bom-ref": "04a8fd8d-5aaf-49f2-b083-2523e2160bc8",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a507105e-dc21-4b23-aae8-44213cbb314e"
        }
      ]
    },
    {
      "bom-ref": "5f73aede-e43c-4cc7-861b-35252f66734c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a507105e-dc21-4b23-aae8-44213cbb314e"
        }
      ]
    },
    {
      "bom-ref": "f723c250-c5c3-4654-8662-1ce9560dc09d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a507105e-dc21-4b23-aae8-44213cbb314e"
        }
      ]
    },
    {
      "bom-ref": "b5867e01-fdd9-481b-8088-dac274789d80",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "cdf894c3-32c4-4827-8bf8-2995c38c4165",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385"
        }
      ]
    },
    {
      "bom-ref": "3231de40-84f7-4c52-9481-4a5b029bcbed",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385"
        }
      ]
    },
    {
      "bom-ref": "448f1f28-ff6c-4f67-bc1f-2037efe505ed",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385"
        }
      ]
    },
    {
      "bom-ref": "82421bae-25a5-42f8-ad46-d1f4d8af274b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6"
        }
      ]
    },
    {
      "bom-ref": "6ce80e36-3ca9-47d3-a657-8bc049ee0030",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385"
        }
      ]
    },
    {
      "bom-ref": "e92855a3-a4d9-4b0b-8808-b5de5295cee2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385"
        }
      ]
    },
    {
      "bom-ref": "41be8767-de07-4923-9a1d-f8f61e12f051",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a2e4ab23-446e-4f69-a75b-58f4e0ad7385"
        }
      ]
    },
    {
      "bom-ref": "afb5ef4d-7d97-4a88-b395-badcec810670",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15"
        }
      ]
    },
    {
      "bom-ref": "eab25673-1035-4507-b6bf-54991a5afb89",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15"
        }
      ]
    },
    {
      "bom-ref": "19206815-e6cc-4179-a3ab-0b18b714919e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15"
        }
      ]
    },
    {
      "bom-ref": "f96eca8e-501b-40ab-9a55-f53f0d0b3f20",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15"
        }
      ]
    },
    {
      "bom-ref": "adf6c587-3622-4d5b-94b5-902e8a677b1f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15"
        }
      ]
    },
    {
      "bom-ref": "471286d0-d204-4bcb-9f12-c411b1768183",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a4dc67c2-6657-4cc6-b003-5953240f7e15"
        }
      ]
    },
    {
      "bom-ref": "25e48e46-ec09-4917-9605-013a6adc0b08",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79"
        }
      ]
    },
    {
      "bom-ref": "ecdbcd08-8e41-4e35-8827-d299cfc44f8d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79"
        }
      ]
    },
    {
      "bom-ref": "fa013c5b-5b0d-4a71-b71e-81858828e83f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79"
        }
      ]
    },
    {
      "bom-ref": "39a86eb3-f152-4a7c-8022-0b6c6455a90c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79"
        }
      ]
    },
    {
      "bom-ref": "1804bd15-2b25-4ef1-878d-1b96de956edf",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79"
        }
      ]
    },
    {
      "bom-ref": "839aa9e2-4b8d-4ac1-9720-dff8e35a8141",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a2eb5966-b94c-4f30-8b77-040ff6abcd79"
        }
      ]
    },
    {
      "bom-ref": "62ac586f-d54b-47b2-950e-5b007eb2f096",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b"
        }
      ]
    },
    {
      "bom-ref": "03ba1bf4-4ebc-4afd-aca6-11d231ca700c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b"
        }
      ]
    },
    {
      "bom-ref": "820d3599-21be-4cd1-bfd0-6cf5cb10b92c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b"
        }
      ]
    },
    {
      "bom-ref": "f844d949-55a1-40b8-bf0d-10b5ca12d114",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b"
        }
      ]
    },
    {
      "bom-ref": "f2689a30-e35c-453b-8147-70bef5579b15",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b"
        }
      ]
    },
    {
      "bom-ref": "11316e7c-204a-4eb9-8712-a0c2f32ac254",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a5d4ec8e-47d3-4dff-bca1-79e9079acb7b"
        }
      ]
    },
    {
      "bom-ref": "b1413159-02b2-401b-a1cb-3ed857769d66",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89"
        }
      ]
    },
    {
      "bom-ref": "66853509-3ac5-4678-8f58-0e075a4560d4",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89"
        }
      ]
    },
    {
      "bom-ref": "9e7b6d67-8474-437f-8491-78be5cb0630a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89"
        }
      ]
    },
    {
      "bom-ref": "3c0e0c0c-28c9-49bf-a456-c4fccb33f79d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89"
        }
      ]
    },
    {
      "bom-ref": "1e36682d-e3bd-44d5-a0d6-ef1612195211",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89"
        }
      ]
    },
    {
      "bom-ref": "6250d62c-c63f-4eef-be43-c38c29e56035",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a8f65aae-2d8b-4f90-97c5-8806cfe0ce89"
        }
      ]
    },
    {
      "bom-ref": "6b606979-df81-4b82-8447-4e22eae67ddb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ad863a9c-50b3-4417-af59-77ddb6f333d8"
        }
      ]
    },
    {
      "bom-ref": "40258e3d-5efb-4828-b3ce-7f1e56a3b330",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "adcd53b3-7ddc-4e20-b16a-62314c5f48ff"
        }
      ]
    },
    {
      "bom-ref": "2f78657d-4e2a-406b-8920-79cbd9bee64b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83"
        }
      ]
    },
    {
      "bom-ref": "099ae64d-c6b7-45bb-8f83-bc8f1fb36fc7",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83"
        }
      ]
    },
    {
      "bom-ref": "0c015635-4ce5-4e4f-810f-035768467af9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83"
        }
      ]
    },
    {
      "bom-ref": "12e0fd08-5c95-4f35-95a3-94a7a4296781",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83"
        }
      ]
    },
    {
      "bom-ref": "56f9dca7-bb64-4ee5-ab6d-68d82d0d3ec7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83"
        }
      ]
    },
    {
      "bom-ref": "23464fc1-a220-4277-b6d1-54f4d5676a2f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a80ed5dd-8157-4d00-a434-b8eabbd18a83"
        }
      ]
    },
    {
      "bom-ref": "f5c535ec-84ac-4e5f-9b5f-4211f5d730aa",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ada55a9e-2a4f-4d7f-ad20-21fa6b71f98a"
        }
      ]
    },
    {
      "bom-ref": "bfef794c-d196-40f4-87a7-5cefd3c1fa8e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25"
        }
      ]
    },
    {
      "bom-ref": "ecbe7f51-24a1-4893-b90e-efa1f20f69d2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25"
        }
      ]
    },
    {
      "bom-ref": "e8969a58-10ab-49d8-bc83-11cfd7c241be",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25"
        }
      ]
    },
    {
      "bom-ref": "55100c6b-5c1b-4c4f-8b93-664126bad75e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25"
        }
      ]
    },
    {
      "bom-ref": "43b7a972-01c3-4ea1-82f9-c849928a580f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19"
        }
      ]
    },
    {
      "bom-ref": "fba6fa1e-fe0d-4080-b94a-4398d6c75858",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25"
        }
      ]
    },
    {
      "bom-ref": "5764f12c-af60-442f-bb88-65b063d3036a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a85cd4e0-9d79-495b-a0b5-877ba28cce25"
        }
      ]
    },
    {
      "bom-ref": "f38cc704-333b-4a37-b912-8cc5ac298e1b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9"
        }
      ]
    },
    {
      "bom-ref": "8bdd3584-5fb1-4144-8d78-e852dfa73ff6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9"
        }
      ]
    },
    {
      "bom-ref": "5d631692-443e-40a7-b69e-e3a497768732",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9"
        }
      ]
    },
    {
      "bom-ref": "b41baefd-b59e-4606-bc0b-4b40147cff25",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9"
        }
      ]
    },
    {
      "bom-ref": "3dab2354-5458-4e9e-a902-f92a2e2952ed",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9"
        }
      ]
    },
    {
      "bom-ref": "3e706009-318d-4433-a9c3-525bb0555cba",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a97f9f4b-ebdc-4b6b-a50a-389417b707a9"
        }
      ]
    },
    {
      "bom-ref": "6aeee038-1913-4122-b48c-f3f6883b6b90",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6"
        }
      ]
    },
    {
      "bom-ref": "c1894dc1-6aa8-4141-9a06-aa5e42590fdf",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6"
        }
      ]
    },
    {
      "bom-ref": "528cb0d7-5547-49ea-bef1-797895a782cb",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6"
        }
      ]
    },
    {
      "bom-ref": "0a5ce347-5a3e-4edc-b1f9-10d925c46b6d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6"
        }
      ]
    },
    {
      "bom-ref": "e6de6eb9-b1cb-45b9-91df-167ed19c3cae",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "a946e7c6-4d07-48a3-b5ef-2d03783ecca6"
        }
      ]
    },
    {
      "bom-ref": "eae721c0-b49e-41a5-bcc7-a857ccf3c620",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc"
        }
      ]
    },
    {
      "bom-ref": "9cbd3925-dcb3-4cf4-9242-9eee1bc2ad5f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc"
        }
      ]
    },
    {
      "bom-ref": "ad35c52c-66a0-4921-8ef5-92cb7d27bdc7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc"
        }
      ]
    },
    {
      "bom-ref": "7a277e60-99b3-4829-8a89-127458ab1346",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc"
        }
      ]
    },
    {
      "bom-ref": "73d270a8-076f-44c3-918e-e9692027d97b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc"
        }
      ]
    },
    {
      "bom-ref": "b3bfbe1a-59ad-45c6-94a2-28a5861bbd08",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "aa19ea1b-2fe8-437a-93d1-b80d5d003ddc"
        }
      ]
    },
    {
      "bom-ref": "2b9e3be6-552a-42c4-94e8-d79d7367d206",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b01024ca-8e60-47b9-b0d0-d2faa897d293"
        }
      ]
    },
    {
      "bom-ref": "536bf7f1-4e9a-45db-9fbc-f706d5617d4f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19"
        }
      ]
    },
    {
      "bom-ref": "1ed88cfb-725a-4c36-a006-f8e6ba2a440b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19"
        }
      ]
    },
    {
      "bom-ref": "d32f2b02-967b-47b4-90c4-9d57681db4ca",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19"
        }
      ]
    },
    {
      "bom-ref": "da5c32d3-2e78-4451-afb6-ee24090ed25c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19"
        }
      ]
    },
    {
      "bom-ref": "9c18fc20-38cf-4e72-ad97-d3dc8af247d0",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "aa80dda6-9ed2-42fb-9a53-216c8a81bc19"
        }
      ]
    },
    {
      "bom-ref": "4c804418-08a5-40e5-9781-5efafb5846cc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c"
        }
      ]
    },
    {
      "bom-ref": "7be776b7-ffea-44db-a9c6-e2ea13bed719",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c"
        }
      ]
    },
    {
      "bom-ref": "5ac08782-fcdf-4845-8e53-bc7dfc77f0b5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c"
        }
      ]
    },
    {
      "bom-ref": "6d15875d-c15e-4605-9ab6-68cdadec6606",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c"
        }
      ]
    },
    {
      "bom-ref": "cf72efd2-699e-4cdb-9b1b-6fd8230e0455",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c"
        }
      ]
    },
    {
      "bom-ref": "82f2edf8-b7a8-4510-a2a2-a3695b9e243b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "aae84e5c-1e5c-4fda-ad61-31a182691d3c"
        }
      ]
    },
    {
      "bom-ref": "9ed62715-592a-403e-8d49-0015de67b292",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b230030d-d54d-4dc3-aee6-da0d6508f2e3"
        }
      ]
    },
    {
      "bom-ref": "a38e96cb-0058-421f-ad6f-057666b0e764",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb"
        }
      ]
    },
    {
      "bom-ref": "8f6b424d-efca-43aa-999d-a56f2d3e5009",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb"
        }
      ]
    },
    {
      "bom-ref": "a09f6682-43cc-4ff6-9bc3-813df97011aa",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb"
        }
      ]
    },
    {
      "bom-ref": "f29931d1-2b7a-40be-86e1-affbe4fa8391",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb"
        }
      ]
    },
    {
      "bom-ref": "c2d2ec3d-b473-4ecb-8385-96eb9304443e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb"
        }
      ]
    },
    {
      "bom-ref": "8735726c-3c97-4b6a-8caf-d452ec04bc84",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ab6b2c94-3046-435d-bfc0-196777b2a1eb"
        }
      ]
    },
    {
      "bom-ref": "f774dc9e-c089-45f9-b694-aed3e9f56ca0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd"
        }
      ]
    },
    {
      "bom-ref": "b4317c83-eca1-4391-945f-a32b78c98fa9",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd"
        }
      ]
    },
    {
      "bom-ref": "a556d052-305a-460c-98e1-3f109a0f8a87",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd"
        }
      ]
    },
    {
      "bom-ref": "18681c7e-d78f-4af6-931f-6e756ce8f07f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd"
        }
      ]
    },
    {
      "bom-ref": "29f6f32e-dc66-4748-bc0a-5a2a1931f567",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd"
        }
      ]
    },
    {
      "bom-ref": "2233d462-8fa3-457b-8250-f5ff81f4ab57",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ae1fd514-21a3-4771-b5d0-060e156cbdcd"
        }
      ]
    },
    {
      "bom-ref": "d22f5c84-39af-4639-bb40-32fe2ebf4da3",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b4275499-f15d-49dc-b484-93104fed5baf"
        }
      ]
    },
    {
      "bom-ref": "5f8819f3-5815-4721-b9b3-106b5139a3b1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0"
        }
      ]
    },
    {
      "bom-ref": "8be75c13-b445-42eb-b975-e6f4f92094e1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0"
        }
      ]
    },
    {
      "bom-ref": "3d596527-bc19-4376-af07-f3e0778eaaa7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0"
        }
      ]
    },
    {
      "bom-ref": "6a2ba5e2-6af8-4e56-a28f-03893833b30b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0"
        }
      ]
    },
    {
      "bom-ref": "d0ebe9e0-e811-4a8f-80c5-aca5e23e0430",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0"
        }
      ]
    },
    {
      "bom-ref": "2385b45a-27ce-40eb-b5b3-4c7a1a8017dd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ace02164-d4f0-4093-ad34-2ead2f48baf0"
        }
      ]
    },
    {
      "bom-ref": "3299e822-201a-4173-adf4-f0932bfbd2de",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e"
        }
      ]
    },
    {
      "bom-ref": "1aac05e3-34bc-4963-9321-0f21d691c0fc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e"
        }
      ]
    },
    {
      "bom-ref": "fb312648-d41a-403c-8293-2b4ab17a4a64",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e"
        }
      ]
    },
    {
      "bom-ref": "8f987dff-8228-489a-a6a4-6d5a39560029",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e"
        }
      ]
    },
    {
      "bom-ref": "bb21960e-7f11-4715-9222-815a29adfbf4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e"
        }
      ]
    },
    {
      "bom-ref": "5e7e7427-0436-46d9-843a-b9c56469a499",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "abbe3c9c-9aa7-47d3-8f78-d8b016055c9e"
        }
      ]
    },
    {
      "bom-ref": "6355d62d-f916-45ac-83b7-4ac7ce9b94dc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ab814ba6-5e19-494a-8708-cc646f468e32"
        }
      ]
    },
    {
      "bom-ref": "915f7865-38c0-4edd-aa82-de67018041ad",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ab814ba6-5e19-494a-8708-cc646f468e32"
        }
      ]
    },
    {
      "bom-ref": "0d81e5e4-721e-4d95-8e4b-bf76b1ddafe1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ab814ba6-5e19-494a-8708-cc646f468e32"
        }
      ]
    },
    {
      "bom-ref": "5b74ef9e-42a6-436c-a4ac-123bc7dde577",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ab814ba6-5e19-494a-8708-cc646f468e32"
        }
      ]
    },
    {
      "bom-ref": "44ba822f-f9dc-45ef-a6dd-b9bbca29bf96",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ab814ba6-5e19-494a-8708-cc646f468e32"
        }
      ]
    },
    {
      "bom-ref": "3eced67d-8b02-4d0c-8ed1-6bf989cad7f7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ab814ba6-5e19-494a-8708-cc646f468e32"
        }
      ]
    },
    {
      "bom-ref": "6990ce45-308f-4fb3-862e-42a00e391935",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b4c0f480-4c2e-48f6-8fd3-ff1ef3216c94"
        }
      ]
    },
    {
      "bom-ref": "27272110-73a4-4b35-b43f-469c8fbdbabc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b4ddaf27-9bbb-436d-885e-9dac2dc2a1b7"
        }
      ]
    },
    {
      "bom-ref": "b7c98048-c3c2-45a9-8ff6-aa2cf2a2cf59",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b4f88db1-d32d-4017-ba0a-620d39c745b8"
        }
      ]
    },
    {
      "bom-ref": "a2ca4671-d95d-4a9e-ae0e-3a5506811957",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93"
        }
      ]
    },
    {
      "bom-ref": "eb1a9e7f-1e0a-4c70-98cf-57256601bcdb",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93"
        }
      ]
    },
    {
      "bom-ref": "d177792e-b8db-41db-9eb2-362d56db1946",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93"
        }
      ]
    },
    {
      "bom-ref": "47922c1b-41f0-475e-bdda-bcd323ad698b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93"
        }
      ]
    },
    {
      "bom-ref": "6476678e-f59b-4dd4-b817-3cff311ff791",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93"
        }
      ]
    },
    {
      "bom-ref": "bee1b18c-0a7b-4cef-8100-ee33fcb2be2d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ad34b5d9-93b9-4817-93ca-8e187e5dae93"
        }
      ]
    },
    {
      "bom-ref": "5224977d-d5df-469b-a875-4f6072601604",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0"
        }
      ]
    },
    {
      "bom-ref": "a8e1d9eb-fd45-4dd9-b966-6283c0227179",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449"
        }
      ]
    },
    {
      "bom-ref": "7e2fe0bc-3ebe-42b1-ba37-62b509df8663",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0"
        }
      ]
    },
    {
      "bom-ref": "0e76627c-3fcb-45fd-bc39-22bdaddc4454",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449"
        }
      ]
    },
    {
      "bom-ref": "2390030e-b76d-4ded-950b-2d7e60480dc1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0"
        }
      ]
    },
    {
      "bom-ref": "6d251c6c-53ce-4fa1-aeed-a572a03f24ea",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b6153afa-d58a-4a17-af0a-1846a8bee489"
        }
      ]
    },
    {
      "bom-ref": "a15c103d-00bf-4a9a-a0f7-526cb5117bc5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449"
        }
      ]
    },
    {
      "bom-ref": "8e84a3d4-b231-43b0-bc90-f7e9bc531706",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0"
        }
      ]
    },
    {
      "bom-ref": "2c7fb683-e510-4333-b655-bb0f8967b6d3",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449"
        }
      ]
    },
    {
      "bom-ref": "ccc76f5e-672b-4512-9e77-f80f9ae04ab5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0"
        }
      ]
    },
    {
      "bom-ref": "98e6b3a1-35fd-460f-b727-60a96af1b96d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449"
        }
      ]
    },
    {
      "bom-ref": "86de08f0-abe6-435f-8b68-6c8ca9ac4e9f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ae4047e7-7db4-4a63-a2ac-e3a6efe9b8f0"
        }
      ]
    },
    {
      "bom-ref": "ae55559b-52e5-43cd-9fab-d073b1645eed",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "af10ccbd-4d29-41aa-93ca-a7928167c449"
        }
      ]
    },
    {
      "bom-ref": "8b356eb1-f644-48c5-9dac-bd6f3e830b2a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8"
        }
      ]
    },
    {
      "bom-ref": "deb7a6ba-c995-4e56-be91-260678b951cc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8"
        }
      ]
    },
    {
      "bom-ref": "d61b3c58-4f73-4a32-9b40-7edcae75cc99",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8"
        }
      ]
    },
    {
      "bom-ref": "27a7a017-957d-45f7-9829-749ee49e364c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8"
        }
      ]
    },
    {
      "bom-ref": "c6dcd2ad-f93a-4f8e-bb1a-218497188d27",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8"
        }
      ]
    },
    {
      "bom-ref": "b76d6ce8-9c94-4344-bb6d-c40459860710",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "af36a67c-2602-43fc-91aa-8311e2d173e8"
        }
      ]
    },
    {
      "bom-ref": "789c3d52-03d2-4a1d-a4ff-90692536c488",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6"
        }
      ]
    },
    {
      "bom-ref": "81b1a021-aee7-4075-b4fd-6935465e531a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6"
        }
      ]
    },
    {
      "bom-ref": "1ac4324d-2ac0-46ec-8a7c-2d55df456b0a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6"
        }
      ]
    },
    {
      "bom-ref": "3c3e5bd9-db7d-42ed-9f23-b2c7fdf8a601",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6"
        }
      ]
    },
    {
      "bom-ref": "4f18494a-8e78-44b5-b7cd-7e8d0c7190bd",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6"
        }
      ]
    },
    {
      "bom-ref": "5a9ee3f8-89bd-4043-87f5-7cce6d60a62f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b0d7a47d-f74c-4cce-a60c-199c28c181d6"
        }
      ]
    },
    {
      "bom-ref": "efe6dee8-87d1-4d90-9070-1fe1297286b3",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b79d7167-5789-4a80-b122-aae3ff1dec1e"
        }
      ]
    },
    {
      "bom-ref": "8c1b0b22-3b24-4301-9b21-2f12b8717221",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b7d7e6c5-4d26-47ea-81bd-b16194b6ba67"
        }
      ]
    },
    {
      "bom-ref": "99c5e8d6-cd2e-4143-be83-056c87f14711",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b7cf3ed0-e692-429b-9995-0233a74c2740"
        }
      ]
    },
    {
      "bom-ref": "2ca9ae83-883a-43ac-ba47-f9e725a5a04c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b892c74e-0244-42e1-a9ae-a2c72d8d1675"
        }
      ]
    },
    {
      "bom-ref": "2360daed-eda9-4b81-81be-030530ee7f84",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38"
        }
      ]
    },
    {
      "bom-ref": "59764e38-0905-414a-80fe-4d49707142c1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38"
        }
      ]
    },
    {
      "bom-ref": "345c9564-ca66-4219-aceb-4f563834a861",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38"
        }
      ]
    },
    {
      "bom-ref": "dd76828a-3de4-45dc-ac1a-ef9d8b3175d1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38"
        }
      ]
    },
    {
      "bom-ref": "3201cbf7-42c3-467b-9769-103dec0b6459",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38"
        }
      ]
    },
    {
      "bom-ref": "3ca8c041-fad8-4f1a-aa7f-3ef67f10c6e7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b3004026-1f69-4a58-bce8-f1c479b92c38"
        }
      ]
    },
    {
      "bom-ref": "8b0edb93-a593-4be0-84a5-a23144695ef9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0"
        }
      ]
    },
    {
      "bom-ref": "b6049136-e5c6-4c05-a294-113bc151df49",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0"
        }
      ]
    },
    {
      "bom-ref": "ff6b9b7f-1630-454a-8c3a-30e170a54433",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0"
        }
      ]
    },
    {
      "bom-ref": "66daecef-41ef-4529-9a2e-bdd3ba8cc9d6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0"
        }
      ]
    },
    {
      "bom-ref": "e54dc919-c547-43f8-a7ec-17a11e76f21e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0"
        }
      ]
    },
    {
      "bom-ref": "c26599ed-b9aa-421b-b0ed-c999d387f1f3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b2bdd466-afc9-4a4e-a454-0d505bdcafc0"
        }
      ]
    },
    {
      "bom-ref": "7769d52a-acc9-4fb5-a5e9-757b9a57374f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa"
        }
      ]
    },
    {
      "bom-ref": "1c3ff587-1914-4ea9-84ad-6244d3ff36cb",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa"
        }
      ]
    },
    {
      "bom-ref": "74d35c04-f266-467c-8e01-cd884215443e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa"
        }
      ]
    },
    {
      "bom-ref": "57614739-31f9-4d9f-80e2-8dd08ffb68c0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa"
        }
      ]
    },
    {
      "bom-ref": "7e9c01b5-aced-40f8-abb5-32cce9f19759",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa"
        }
      ]
    },
    {
      "bom-ref": "941d79e9-78ea-49a3-9ddb-a7bbeee6cef9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b2f2de05-8b9a-4040-a0f0-555b4f9a86fa"
        }
      ]
    },
    {
      "bom-ref": "bf4a942f-5be7-46c2-8e4b-a7a58f8e2934",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b98b77e3-691d-4a22-8ce3-505d63cf0e27"
        }
      ]
    },
    {
      "bom-ref": "3c05c8d1-1c73-4831-9f1a-8ee1fbbe86ff",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5"
        }
      ]
    },
    {
      "bom-ref": "a233ddf4-251b-46c6-a90d-2baf957d694c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5"
        }
      ]
    },
    {
      "bom-ref": "34c35bb0-9e06-4cf5-b41b-4582a8bb19a8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5"
        }
      ]
    },
    {
      "bom-ref": "20241d1b-c1dd-42d8-88f9-3d5901255e81",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5"
        }
      ]
    },
    {
      "bom-ref": "f078d47d-c215-47e8-aaad-9be9c3d66dcc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610"
        }
      ]
    },
    {
      "bom-ref": "7f8dabab-fea2-47f8-a9d7-733925c147eb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5"
        }
      ]
    },
    {
      "bom-ref": "b74763c3-25b0-4221-84be-fe3feb3d8a90",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b3b2b5c2-a8d1-4192-a750-4f54c169a6e5"
        }
      ]
    },
    {
      "bom-ref": "7541a73e-50c6-41af-964e-aca1a6e16cd5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b9933717-74b1-4ddb-ae42-abd579dae73a"
        }
      ]
    },
    {
      "bom-ref": "567be692-fee1-4503-8a65-6bfa76f1c302",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "bb197d8f-92eb-4a69-8e1c-2f982c97fef3"
        }
      ]
    },
    {
      "bom-ref": "db3781a2-f6b1-405a-91bc-17760362aed5",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "bbe1535e-72b7-4fce-b309-88c2a11a384f"
        }
      ]
    },
    {
      "bom-ref": "a9896ee1-2ba9-4d6c-8a69-2a4a2f882b3c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9"
        }
      ]
    },
    {
      "bom-ref": "db14e81c-33a5-401e-9cf5-140e55b38d32",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9"
        }
      ]
    },
    {
      "bom-ref": "f3d018e4-c902-432b-a5b3-a0c57be85e62",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9"
        }
      ]
    },
    {
      "bom-ref": "bb715d8c-3061-4018-82f5-44568feeea08",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9"
        }
      ]
    },
    {
      "bom-ref": "38934962-8941-4f4c-af88-e86a7fa50db6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9"
        }
      ]
    },
    {
      "bom-ref": "ae34917f-ae76-4b36-a246-62f219412f49",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b56e4155-7937-49dd-b951-4e24bd0d3cb9"
        }
      ]
    },
    {
      "bom-ref": "6d51c96a-522f-4bb6-8898-75945cf7ea99",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "bfa0f56b-de84-4088-9ae6-92039c4c8d0b"
        }
      ]
    },
    {
      "bom-ref": "73c10fc7-c158-487a-962a-4619761323ed",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f"
        }
      ]
    },
    {
      "bom-ref": "ca042f74-a504-4e6b-ac4e-53d05beb6a08",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f"
        }
      ]
    },
    {
      "bom-ref": "09a31368-57a0-4591-9b2d-451f6750ba77",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f"
        }
      ]
    },
    {
      "bom-ref": "04b3e35b-1988-48cc-b6a9-3da47c8b74bf",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f"
        }
      ]
    },
    {
      "bom-ref": "c4ca6024-ace7-4c75-b662-4081c1e500ac",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f"
        }
      ]
    },
    {
      "bom-ref": "3af200a1-788a-45e5-9068-b778f7ab18a3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b59d245c-2c82-4e4d-aeb1-6e0115b0ae7f"
        }
      ]
    },
    {
      "bom-ref": "47a5a064-f519-4a6f-be59-c94e4695aa2b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c029b294-89f7-4967-8653-775a36230324"
        }
      ]
    },
    {
      "bom-ref": "18ee3f85-d573-4d31-8d26-12406fe6ac84",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c0944f4a-7b17-42a8-b8fd-9669b725b9c7"
        }
      ]
    },
    {
      "bom-ref": "70e994c5-cde4-4ab4-9ffd-5228e1b5fd75",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766"
        }
      ]
    },
    {
      "bom-ref": "c2e601b9-fc59-45bf-b79a-dd91fc942601",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766"
        }
      ]
    },
    {
      "bom-ref": "e93d1beb-a42c-445b-8596-5a492147c824",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766"
        }
      ]
    },
    {
      "bom-ref": "30bf3b5c-fb56-4c75-b353-0bc7d7528fdf",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766"
        }
      ]
    },
    {
      "bom-ref": "fd79aa9f-69da-49a6-9326-9bbf2031ff75",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766"
        }
      ]
    },
    {
      "bom-ref": "bb1716b4-ec7a-4c37-967f-9865c292832c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b6c1dc24-29e2-4c0d-96db-e554cce91766"
        }
      ]
    },
    {
      "bom-ref": "4d972b97-4ee4-4759-b4ee-fc25930c562d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa"
        }
      ]
    },
    {
      "bom-ref": "b631430c-c420-4bd0-95c6-35f0d1b6f45c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa"
        }
      ]
    },
    {
      "bom-ref": "a3a4bf25-6f2d-405b-bfa2-c36b1ac66b6b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa"
        }
      ]
    },
    {
      "bom-ref": "523b643f-0c8c-43ae-acfe-47c968748c54",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa"
        }
      ]
    },
    {
      "bom-ref": "a34142fc-2f2c-4ea2-b2ff-c4062c4c0b1a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa"
        }
      ]
    },
    {
      "bom-ref": "1bab34b7-04e8-470c-b661-d52571b0e5e6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b6edbe70-2545-4515-bd73-732b99afa8fa"
        }
      ]
    },
    {
      "bom-ref": "0e0e6dae-0df3-45ed-94a9-239ddfa6bffe",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b"
        }
      ]
    },
    {
      "bom-ref": "4e35f83e-135d-4681-bb10-c739de6eb48d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b"
        }
      ]
    },
    {
      "bom-ref": "8089f7d6-1621-4348-9318-8b4e02cb821f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b"
        }
      ]
    },
    {
      "bom-ref": "363a814a-ffdf-4a84-bbf8-16db6ac2cca5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b"
        }
      ]
    },
    {
      "bom-ref": "d15c62c1-fb1f-4952-9554-accd57fdc291",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b"
        }
      ]
    },
    {
      "bom-ref": "e557328c-b69b-438d-8528-1c4c0fd6e27a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b5d5d4cc-17c5-41cc-af33-073aae55ae5b"
        }
      ]
    },
    {
      "bom-ref": "3c4f5f57-23e1-4e81-89c3-36093c8d5482",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b68f8c12-de9b-4704-948c-e94f955a126f"
        }
      ]
    },
    {
      "bom-ref": "9bd8823b-6275-46c9-baec-47793d8ebe08",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b68f8c12-de9b-4704-948c-e94f955a126f"
        }
      ]
    },
    {
      "bom-ref": "a7487ae1-4fb8-43ae-adb6-b5cd5fd3b8ac",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b68f8c12-de9b-4704-948c-e94f955a126f"
        }
      ]
    },
    {
      "bom-ref": "781ba3c2-07c6-4116-8242-859353acd8ab",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b68f8c12-de9b-4704-948c-e94f955a126f"
        }
      ]
    },
    {
      "bom-ref": "30a61a1b-a82a-41d2-8cc6-518a29700d8b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b68f8c12-de9b-4704-948c-e94f955a126f"
        }
      ]
    },
    {
      "bom-ref": "ee67bcd3-2c87-412b-937f-1db28b6c16b2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b68f8c12-de9b-4704-948c-e94f955a126f"
        }
      ]
    },
    {
      "bom-ref": "cdd7035d-36e6-42fa-be8d-5673f000ecc3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c"
        }
      ]
    },
    {
      "bom-ref": "871f0c58-ddab-4358-a415-3d13f2e55cd8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c"
        }
      ]
    },
    {
      "bom-ref": "10b69128-c18b-43c7-ac1e-b11a7d89f8ef",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c"
        }
      ]
    },
    {
      "bom-ref": "c1dff03a-e83d-4e02-9b1e-ac324629440a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c"
        }
      ]
    },
    {
      "bom-ref": "1d59d08b-d241-4978-9a49-2f1621df6dce",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c"
        }
      ]
    },
    {
      "bom-ref": "fe2c2739-99e9-42a7-b868-2e09efcde0af",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b9819efc-6932-4b3f-a856-4a483ed6fe5c"
        }
      ]
    },
    {
      "bom-ref": "1b7bb57f-8afc-40c2-bd23-daf2e9515e41",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b953bdf0-bf13-4525-a812-de1e055467ab"
        }
      ]
    },
    {
      "bom-ref": "be3b4536-ede9-42b3-8af4-ae53ed568642",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b953bdf0-bf13-4525-a812-de1e055467ab"
        }
      ]
    },
    {
      "bom-ref": "0c2d55c2-e66a-4586-8976-831a14fa5c90",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "b953bdf0-bf13-4525-a812-de1e055467ab"
        }
      ]
    },
    {
      "bom-ref": "1012fa13-c11e-4899-b9d0-8b7a195edb40",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b953bdf0-bf13-4525-a812-de1e055467ab"
        }
      ]
    },
    {
      "bom-ref": "860bf470-32d3-40cc-9d0b-e751320ee37d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b953bdf0-bf13-4525-a812-de1e055467ab"
        }
      ]
    },
    {
      "bom-ref": "14be2187-b250-4339-8035-8b19d5819dd6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b953bdf0-bf13-4525-a812-de1e055467ab"
        }
      ]
    },
    {
      "bom-ref": "8f93860b-f370-4ed1-aef5-bc95f818f9cc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50"
        }
      ]
    },
    {
      "bom-ref": "64b614dc-3d87-4189-af00-3a0ae9260e3e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50"
        }
      ]
    },
    {
      "bom-ref": "90d19d86-6d54-4c4e-9508-63816ed2f34e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50"
        }
      ]
    },
    {
      "bom-ref": "5bc3b4f9-fbd7-4d73-a0e2-01b01da88b78",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50"
        }
      ]
    },
    {
      "bom-ref": "49554e95-9be7-4277-a1a3-fd3cd21d0bb7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50"
        }
      ]
    },
    {
      "bom-ref": "b3cf2353-e5b8-448a-8842-976608e7aa07",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "baa16630-71fa-4aa8-8d19-f53fdeec1a50"
        }
      ]
    },
    {
      "bom-ref": "d6a7094b-baa8-4734-a581-6c1068c6a0bc",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c29c735a-db0f-42ad-8ac7-5064c5fe3183"
        }
      ]
    },
    {
      "bom-ref": "eaf08139-18c7-44a2-8232-404f754ee0c0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610"
        }
      ]
    },
    {
      "bom-ref": "6794eeb7-4424-487b-a692-6203fc7e7145",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610"
        }
      ]
    },
    {
      "bom-ref": "a161d3d8-19d1-47b4-b5a5-9340c49b24ba",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610"
        }
      ]
    },
    {
      "bom-ref": "6b8feb00-f7bb-48da-9894-8d106c31fad1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610"
        }
      ]
    },
    {
      "bom-ref": "d76e786f-b3fe-4f5e-af0a-80dfc7b4aad1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "b9eb78f9-1ad4-42cc-8751-b6dd184e8610"
        }
      ]
    },
    {
      "bom-ref": "1975ca4f-4f41-4433-8ee9-7d5063e7f9a8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b"
        }
      ]
    },
    {
      "bom-ref": "2669cc2e-4547-45a6-8c08-f69bd934272e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b"
        }
      ]
    },
    {
      "bom-ref": "1de10f7f-dd0d-4d47-b4aa-35e6a3254e7e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b"
        }
      ]
    },
    {
      "bom-ref": "0d1617b0-295b-40e7-bf15-3b3469dd6aa0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b"
        }
      ]
    },
    {
      "bom-ref": "73327ce3-39c8-43f0-839b-0952f6a77603",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b"
        }
      ]
    },
    {
      "bom-ref": "d4b9f325-92d0-4e5c-a6af-169c14adfd43",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "bf5b3482-515d-429a-9a3f-b78bb4e35e8b"
        }
      ]
    },
    {
      "bom-ref": "bb280bdf-d1ed-472c-86ff-e05e88759b50",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c088bed4-44e7-4132-9248-d5764ca1787e"
        }
      ]
    },
    {
      "bom-ref": "1901f41c-84ca-4ac1-99cb-b147526ceedf",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c088bed4-44e7-4132-9248-d5764ca1787e"
        }
      ]
    },
    {
      "bom-ref": "8998a05b-5e17-459c-84b3-89bb7db518c7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c088bed4-44e7-4132-9248-d5764ca1787e"
        }
      ]
    },
    {
      "bom-ref": "bb486eae-0b9e-4d6a-8a42-6767dd300627",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c088bed4-44e7-4132-9248-d5764ca1787e"
        }
      ]
    },
    {
      "bom-ref": "c0a5caac-ea9f-4a0c-9015-638615b66017",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c088bed4-44e7-4132-9248-d5764ca1787e"
        }
      ]
    },
    {
      "bom-ref": "20f157e1-dcc6-495d-9bc3-39ff5f2d5ae2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c088bed4-44e7-4132-9248-d5764ca1787e"
        }
      ]
    },
    {
      "bom-ref": "5b493ed2-4f10-4585-95be-53427a7a5efb",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c2de6ead-6dbb-4f6f-b629-38dfe2de2b51"
        }
      ]
    },
    {
      "bom-ref": "37efdd2f-70b7-4558-85f7-0732fd63db70",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c347227a-a1fd-4e3b-9d4d-f35e51022c75"
        }
      ]
    },
    {
      "bom-ref": "cc213110-28a5-430b-a957-532f80f6e343",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c"
        }
      ]
    },
    {
      "bom-ref": "23445b40-c164-473a-ac8b-ad3c826befdc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c"
        }
      ]
    },
    {
      "bom-ref": "76608ff2-bfbf-4661-975b-31e34e44ec3a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c"
        }
      ]
    },
    {
      "bom-ref": "55eb62c5-874c-416e-8e32-f71ebd2c4cc5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c"
        }
      ]
    },
    {
      "bom-ref": "ec74e486-c197-417d-8321-7d33f10751a3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62"
        }
      ]
    },
    {
      "bom-ref": "16fb68ca-6f7a-492a-8674-a10b9ebcd991",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c"
        }
      ]
    },
    {
      "bom-ref": "db93663c-592c-47db-a7cc-a2d8fecc8796",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c0399c53-25b0-42cf-a8b2-2f943f26a15c"
        }
      ]
    },
    {
      "bom-ref": "1ac0d412-6bbe-4227-8bcc-b09357925987",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af"
        }
      ]
    },
    {
      "bom-ref": "c3310610-1ed1-4f87-81bb-87b6def7a4e1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af"
        }
      ]
    },
    {
      "bom-ref": "4ad46463-96a1-4b80-8ad5-45e684a88bf0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af"
        }
      ]
    },
    {
      "bom-ref": "59e8c999-061e-47b1-aaf6-e4c9a09904bf",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af"
        }
      ]
    },
    {
      "bom-ref": "8122cf0b-57db-45ca-add1-e5ebd7f8e717",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af"
        }
      ]
    },
    {
      "bom-ref": "c83f7351-52b8-4015-a8a4-0fb653225729",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c0a3d819-c47b-4c73-80be-6287eb4664af"
        }
      ]
    },
    {
      "bom-ref": "5d9b0743-d343-4a0d-b7cb-85ab0c8e760a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73"
        }
      ]
    },
    {
      "bom-ref": "30a6e7c4-4c12-43ec-8187-19e21a68a1c2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73"
        }
      ]
    },
    {
      "bom-ref": "8eb16579-7c17-4d12-97d5-bfae97dc8d93",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73"
        }
      ]
    },
    {
      "bom-ref": "fa7d6609-d1f6-4af1-9f43-d0720047f7d1",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73"
        }
      ]
    },
    {
      "bom-ref": "1f3ba6ad-5480-4211-a6f5-21c684af99eb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73"
        }
      ]
    },
    {
      "bom-ref": "4c56b14b-be0e-4618-b202-787ca880cf12",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c0cad2bc-cb53-45cf-bbd2-a5907a7d9f73"
        }
      ]
    },
    {
      "bom-ref": "8800f690-1145-47dd-b753-0540d7e0c91d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c3c5598c-95cb-47a6-90d1-179458208eca"
        }
      ]
    },
    {
      "bom-ref": "fddc871e-2f41-4ee7-b037-6f23b5e304b0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62"
        }
      ]
    },
    {
      "bom-ref": "06c47052-4529-4998-bac1-bd0b6bad37ac",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62"
        }
      ]
    },
    {
      "bom-ref": "279df004-269d-4ec0-9106-af89daab9806",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62"
        }
      ]
    },
    {
      "bom-ref": "a4154236-6ac1-4d53-9293-4b87628f4e30",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62"
        }
      ]
    },
    {
      "bom-ref": "f6cc36ef-9c44-40cc-b45d-1f8fd0b9ac12",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c0af2c0e-5223-463e-b5c3-aa89e4e86e62"
        }
      ]
    },
    {
      "bom-ref": "eca00c78-74bf-42ca-b2bb-6c039c1d7f52",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006"
        }
      ]
    },
    {
      "bom-ref": "feb2c35d-56b8-4dcd-9271-a51202751e13",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006"
        }
      ]
    },
    {
      "bom-ref": "de9b2d77-b16a-44e5-832b-a91164f50992",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006"
        }
      ]
    },
    {
      "bom-ref": "1cdcf227-c301-4c6c-b117-27975232ecab",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006"
        }
      ]
    },
    {
      "bom-ref": "6c46bcc4-b3ab-49d2-9004-cc599e8e6710",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006"
        }
      ]
    },
    {
      "bom-ref": "68a156ce-6d5b-41d0-a529-9f381e32f0f8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c0c4dae6-812f-4cc1-81d0-a1221a0b8006"
        }
      ]
    },
    {
      "bom-ref": "524f7e9e-d02d-48d2-892d-2c42755fb41b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c"
        }
      ]
    },
    {
      "bom-ref": "3ca2381a-6b60-446d-94de-9fb735396a05",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c"
        }
      ]
    },
    {
      "bom-ref": "13e0274d-2d52-41cf-bbf5-95b217e6eed7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c"
        }
      ]
    },
    {
      "bom-ref": "3c64965b-25f5-4bc2-af22-50b951ffb496",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c"
        }
      ]
    },
    {
      "bom-ref": "a26cc940-7003-43d6-af08-2dccb6fdbca0",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c"
        }
      ]
    },
    {
      "bom-ref": "8077cfcc-fd65-4dfa-98d6-c56d4c6754e1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c0ce12d1-a233-4401-97e0-891ba8b0a18c"
        }
      ]
    },
    {
      "bom-ref": "3020a4b4-4d88-4eb1-bdff-b99c8434eabb",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3"
        }
      ]
    },
    {
      "bom-ref": "64868325-4585-46c1-b2c4-3a829dd9c85e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3"
        }
      ]
    },
    {
      "bom-ref": "75ea4871-2f27-4654-9e09-b716dc1d60c9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3"
        }
      ]
    },
    {
      "bom-ref": "3ded90dd-3ccb-4d64-8561-4e631f0fe561",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3"
        }
      ]
    },
    {
      "bom-ref": "db248b75-a756-43bd-9dde-66051378c896",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3"
        }
      ]
    },
    {
      "bom-ref": "9dcbb9d7-34ed-420e-a4a4-6ff4cc2c0495",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c1b053db-d186-4ef9-9f5e-8ba395c50cc3"
        }
      ]
    },
    {
      "bom-ref": "8d898e83-5397-4167-af89-1e58bb6f37dd",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c769f00b-982e-442a-97a1-08de103eecab"
        }
      ]
    },
    {
      "bom-ref": "ec1dc1a8-d39c-4322-8303-2870df2c608a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73"
        }
      ]
    },
    {
      "bom-ref": "5166b44d-d4e8-4d1c-b4eb-fc0293c95991",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73"
        }
      ]
    },
    {
      "bom-ref": "f7f52c0c-494a-4554-bc25-a42bc3f02abb",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73"
        }
      ]
    },
    {
      "bom-ref": "d10c1d3a-f36d-423b-b2e9-11cf66743b81",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73"
        }
      ]
    },
    {
      "bom-ref": "9a2194a8-49cd-4525-895a-42773ee7aded",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73"
        }
      ]
    },
    {
      "bom-ref": "05a7b572-96d5-4f79-86e2-5b1bf8ab3b79",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c108228e-ebf8-4954-8fc2-0bc7b3b12c73"
        }
      ]
    },
    {
      "bom-ref": "90bbbb14-3b8a-4ef7-9b86-181b4bdfea05",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c1c60606-a500-40d3-8b89-0678f2957da7"
        }
      ]
    },
    {
      "bom-ref": "8baf3602-ae3c-4043-815e-b65ff695d5d5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c1c60606-a500-40d3-8b89-0678f2957da7"
        }
      ]
    },
    {
      "bom-ref": "f063d13b-2774-46d5-a18d-406aa656a978",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c1c60606-a500-40d3-8b89-0678f2957da7"
        }
      ]
    },
    {
      "bom-ref": "b0f63559-c7d0-4b9b-ac21-ed448e01f46e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c1c60606-a500-40d3-8b89-0678f2957da7"
        }
      ]
    },
    {
      "bom-ref": "5b5daf55-ebbf-44b1-9644-dc19d532d757",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c1c60606-a500-40d3-8b89-0678f2957da7"
        }
      ]
    },
    {
      "bom-ref": "7089e6a7-f4dc-4265-8789-6f7d9752cc1d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c1c60606-a500-40d3-8b89-0678f2957da7"
        }
      ]
    },
    {
      "bom-ref": "235b22fd-4aca-499e-90bb-e19781a80558",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c913a3d7-d016-4463-b95c-91266511e1b2"
        }
      ]
    },
    {
      "bom-ref": "00272a57-cd4d-431c-b5c1-558352372f61",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160"
        }
      ]
    },
    {
      "bom-ref": "d5bace00-819c-4bef-89ea-08ace98783c5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160"
        }
      ]
    },
    {
      "bom-ref": "0ce6c37b-e50c-4b21-b568-66a2ef91459b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160"
        }
      ]
    },
    {
      "bom-ref": "9855ce03-d0e1-4209-80a9-d9e330cb9093",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160"
        }
      ]
    },
    {
      "bom-ref": "f6ec8401-81a5-471b-b99a-96a67521ea2b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160"
        }
      ]
    },
    {
      "bom-ref": "100def4c-d0d4-490b-87b1-961a9ab00462",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c21d93fe-6be9-4d33-91c4-606ccd43a160"
        }
      ]
    },
    {
      "bom-ref": "b4a07405-3f01-4287-b7a5-44b1703e2860",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "c9a63b90-b88a-405a-95a3-94ac90a8efc7"
        }
      ]
    },
    {
      "bom-ref": "d8d806ce-0df3-4aba-ad6b-42d9ffc67e7c",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "c9a63b90-b88a-405a-95a3-94ac90a8efc7"
        }
      ]
    },
    {
      "bom-ref": "3ce01ba2-5392-4404-8ca8-97eed071c83d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237"
        }
      ]
    },
    {
      "bom-ref": "38d34475-acd2-4f3d-a2d2-16422d68cd02",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237"
        }
      ]
    },
    {
      "bom-ref": "33ced612-3122-4d7c-b8a1-c4393dded83b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237"
        }
      ]
    },
    {
      "bom-ref": "dec88ed8-b1b8-42f5-9f63-2ebad72e47bf",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237"
        }
      ]
    },
    {
      "bom-ref": "a23c803f-7ed0-4bed-a5b4-51498c365e32",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237"
        }
      ]
    },
    {
      "bom-ref": "ef7f97d4-cbbe-478e-bc4b-d8445287fe3b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c2742ebd-c743-49f0-9e6d-cc8b5f736237"
        }
      ]
    },
    {
      "bom-ref": "cb89a991-7b83-4b7e-a2e8-e4896f659b60",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ca0e01e7-804d-4c8b-8730-2c21f9f1d765"
        }
      ]
    },
    {
      "bom-ref": "deea1611-39bb-4f60-a34c-dc3d32440371",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "cb7fe145-617b-4715-bfc4-d44392dd2f13"
        }
      ]
    },
    {
      "bom-ref": "0e6a3d0b-c215-4d80-83bd-eda7350c9e59",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "cb6804a5-5e21-4a7e-9478-d1290662de52"
        }
      ]
    },
    {
      "bom-ref": "1b6c0c6d-0a73-4ac8-99b1-f5d8521058b2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c340b466-22a4-4166-99ef-61a523f44f0d"
        }
      ]
    },
    {
      "bom-ref": "4f6b9785-f4cb-4d6f-b85e-b3440bffd3ab",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c340b466-22a4-4166-99ef-61a523f44f0d"
        }
      ]
    },
    {
      "bom-ref": "bd5a406c-69a7-409f-a76a-7f66c2cf0f65",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c340b466-22a4-4166-99ef-61a523f44f0d"
        }
      ]
    },
    {
      "bom-ref": "c41175ee-bf27-4d36-895d-de4fe63802df",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c340b466-22a4-4166-99ef-61a523f44f0d"
        }
      ]
    },
    {
      "bom-ref": "1e332c77-5dfc-475a-8e0e-dcdec431cc59",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c340b466-22a4-4166-99ef-61a523f44f0d"
        }
      ]
    },
    {
      "bom-ref": "5f5196d3-4ae4-43f6-b3de-a11be9707f0e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c340b466-22a4-4166-99ef-61a523f44f0d"
        }
      ]
    },
    {
      "bom-ref": "e9807525-3360-4cc2-a235-9dd5d07a6a26",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7"
        }
      ]
    },
    {
      "bom-ref": "cb6d63d7-35a6-4bd2-acab-4fab16897cf0",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7"
        }
      ]
    },
    {
      "bom-ref": "734f7fb6-2f44-4e1c-8e42-f3d6d65fdcf0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7"
        }
      ]
    },
    {
      "bom-ref": "cb9bf2bb-d24d-400c-a5b9-46255966ac23",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7"
        }
      ]
    },
    {
      "bom-ref": "4d78ebaa-e9d6-4edc-ba5c-3a0c984e4397",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7"
        }
      ]
    },
    {
      "bom-ref": "f1c81e82-08f1-4c5f-91b3-c678531eb2b9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c4596a8a-8c64-4fb9-8f41-53ce6e7953d7"
        }
      ]
    },
    {
      "bom-ref": "f7314f7b-6963-468a-b6ec-a8eb58bc7651",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829"
        }
      ]
    },
    {
      "bom-ref": "fa4e6265-c297-4ed9-a084-ee62ef4a8fcf",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829"
        }
      ]
    },
    {
      "bom-ref": "24f8af12-d427-4579-8ff9-752c7a10ec4c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829"
        }
      ]
    },
    {
      "bom-ref": "1f3a57a8-6fce-4e43-889a-dbe2e6d8dd35",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829"
        }
      ]
    },
    {
      "bom-ref": "ca16499f-0052-45c0-8459-310623724fc8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829"
        }
      ]
    },
    {
      "bom-ref": "1bca769b-184f-47dd-bc37-dac590f25158",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c67b5b68-ade4-4034-81a8-d788dd1bd829"
        }
      ]
    },
    {
      "bom-ref": "dfcca4ee-658b-49e8-8ee5-1f45fc164264",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3"
        }
      ]
    },
    {
      "bom-ref": "04f45298-ff6f-4bfa-ab0b-3a6448d74059",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3"
        }
      ]
    },
    {
      "bom-ref": "d9423e3d-1e06-4d6e-9d1f-5d61f0afb015",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3"
        }
      ]
    },
    {
      "bom-ref": "8d8ee15e-18e5-4c61-96fe-893dbe3ae9ef",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3"
        }
      ]
    },
    {
      "bom-ref": "03b72e4c-3441-4784-a291-93fc92d2caed",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3"
        }
      ]
    },
    {
      "bom-ref": "b0360a49-c3dc-497a-b58f-2918bca7f8cf",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c3c66873-2ae3-49b4-a205-f4d3d0e3dfa3"
        }
      ]
    },
    {
      "bom-ref": "fe2285e2-fcec-489b-af6a-3b1635b02176",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778"
        }
      ]
    },
    {
      "bom-ref": "76b128f2-d777-4d6f-9be3-197190c6e7e3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778"
        }
      ]
    },
    {
      "bom-ref": "e9686db2-3d25-4bd4-b689-dacf2ac2a47f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778"
        }
      ]
    },
    {
      "bom-ref": "a50f12c2-fb1a-4024-9bd6-e1ac3e6b115f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778"
        }
      ]
    },
    {
      "bom-ref": "fc06a046-7ac6-495f-ab54-507d3d963b0a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778"
        }
      ]
    },
    {
      "bom-ref": "2cf6ac25-9740-470e-a22a-a656c45efa88",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c5f73049-31e1-45a1-a75b-6bcbaf6ba778"
        }
      ]
    },
    {
      "bom-ref": "6196250e-4abb-454c-a52c-39e30af05c36",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198"
        }
      ]
    },
    {
      "bom-ref": "97b40871-807e-4fae-bbb3-f3f1808c6ab2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198"
        }
      ]
    },
    {
      "bom-ref": "9aca0a6b-cb14-4b9d-9170-def535211824",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198"
        }
      ]
    },
    {
      "bom-ref": "221499ec-45b3-412d-8e48-0219fa446fa0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198"
        }
      ]
    },
    {
      "bom-ref": "57027da9-0b34-464e-9889-9126ee415a3e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198"
        }
      ]
    },
    {
      "bom-ref": "c0943add-502e-47ed-a2c0-1b5f31439fd7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c5cb65f3-d5bf-4699-8489-c5a753b1d198"
        }
      ]
    },
    {
      "bom-ref": "59f8029c-298d-4f24-8202-731089db9245",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd"
        }
      ]
    },
    {
      "bom-ref": "29f5458d-31ea-4e71-9218-3f9ea0b0d45a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd"
        }
      ]
    },
    {
      "bom-ref": "a6eb9571-5ba2-484f-b65b-fcc6c6536b14",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd"
        }
      ]
    },
    {
      "bom-ref": "8e46cc95-74ff-4ecc-8b81-1babd217cdab",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd"
        }
      ]
    },
    {
      "bom-ref": "03c7a628-ced3-4438-96e4-6cc25a9f7db5",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd"
        }
      ]
    },
    {
      "bom-ref": "dbd22717-ddbb-48fc-bc84-e0b451f1531c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c4fa6c9d-3cf8-441c-ad64-03ec2af3fcdd"
        }
      ]
    },
    {
      "bom-ref": "8799e968-d8c9-42a4-93ff-0b6c8b9b9c49",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0"
        }
      ]
    },
    {
      "bom-ref": "c06af2df-acb0-493c-ba45-3812f9e1d113",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0"
        }
      ]
    },
    {
      "bom-ref": "54a81349-cc5c-4379-8dd8-7909e79a54d5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0"
        }
      ]
    },
    {
      "bom-ref": "befa578d-035f-49b3-a8da-7afa6afccf26",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0"
        }
      ]
    },
    {
      "bom-ref": "8795e559-5050-4da5-a562-f62b7631a386",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0"
        }
      ]
    },
    {
      "bom-ref": "e8ec086d-517c-416b-a655-b33f2860ea83",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "c75b43ea-4e0f-4401-8f75-5f9115440ae0"
        }
      ]
    },
    {
      "bom-ref": "322a0173-1a9c-4974-9c24-1fa708eb7b8b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "cdb635fe-c7a6-4bfb-bd30-e6c57979a149"
        }
      ]
    },
    {
      "bom-ref": "fafb38bf-c703-47ca-ac82-22747cc178ca",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9"
        }
      ]
    },
    {
      "bom-ref": "d7cdeac8-b6c1-49a1-bda7-34dc9365bc3a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9"
        }
      ]
    },
    {
      "bom-ref": "45aa259e-2c78-4162-ae16-bbd6aca80edc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9"
        }
      ]
    },
    {
      "bom-ref": "cbea86dd-c54e-4a20-b59c-ff8a8876538d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9"
        }
      ]
    },
    {
      "bom-ref": "dc46b0d9-9381-49fa-becf-1b9d79f1af30",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402"
        }
      ]
    },
    {
      "bom-ref": "c96d8179-fdf1-4ac8-8fa3-fd08c7f3a7fa",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9"
        }
      ]
    },
    {
      "bom-ref": "f1c6fc1f-c091-472c-b8d2-b0cb11d1cff9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ca6c8a2a-6531-4608-81e7-5a8c74876bc9"
        }
      ]
    },
    {
      "bom-ref": "81343245-896e-40d1-ba89-833aba356a67",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8"
        }
      ]
    },
    {
      "bom-ref": "08243a5d-7af5-4bec-b724-e80a2982e35c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8"
        }
      ]
    },
    {
      "bom-ref": "d7863e44-f023-4db6-b396-4f2e4ea4b13b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8"
        }
      ]
    },
    {
      "bom-ref": "dca51cda-6043-443d-8934-9ead31885ac0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8"
        }
      ]
    },
    {
      "bom-ref": "d91d15c0-72cc-44f5-bc5c-595f30c10e25",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8"
        }
      ]
    },
    {
      "bom-ref": "969a7eae-b2af-42a8-a92d-1ff0938ae766",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cae0f4b1-fe29-4baf-bc17-a731f01101a8"
        }
      ]
    },
    {
      "bom-ref": "daea903f-3c86-4a0b-818e-fedb54889a81",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cb2e8093-9430-49dc-82b5-a77388890c73"
        }
      ]
    },
    {
      "bom-ref": "39a7040f-54ed-4c7d-969e-436b9ad0fab5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cb2e8093-9430-49dc-82b5-a77388890c73"
        }
      ]
    },
    {
      "bom-ref": "77c6e574-9f34-430e-af55-f9f3169e870a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cb2e8093-9430-49dc-82b5-a77388890c73"
        }
      ]
    },
    {
      "bom-ref": "b60b97a7-bab7-4063-9227-1ccf99b926dc",
      "id": "CVE-2018-25032",
      "description": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
      "affects": [
        {
          "ref": "2e324721-9240-4849-bf53-109c02c29de0"
        }
      ]
    },
    {
      "bom-ref": "56ea544b-5ade-44e4-8bbc-bb9a1e13d16c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cb2e8093-9430-49dc-82b5-a77388890c73"
        }
      ]
    },
    {
      "bom-ref": "0c49f52e-9568-4a7a-af06-6d398ed0874d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cb2e8093-9430-49dc-82b5-a77388890c73"
        }
      ]
    },
    {
      "bom-ref": "0c4692e5-63fd-4d87-be9a-04b9dec8feb8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cb2e8093-9430-49dc-82b5-a77388890c73"
        }
      ]
    },
    {
      "bom-ref": "ec1359e2-6fa0-406b-b694-c70d5f45aef4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f"
        }
      ]
    },
    {
      "bom-ref": "6b1454ed-672f-4378-b99e-8abff59e391e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f"
        }
      ]
    },
    {
      "bom-ref": "4001f59a-34ab-4886-a0de-92c4ba890197",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f"
        }
      ]
    },
    {
      "bom-ref": "491f57e6-38da-4182-981e-e2d0bc8aedde",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f"
        }
      ]
    },
    {
      "bom-ref": "98f8e954-9819-4bc2-84d6-e43a763101bd",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f"
        }
      ]
    },
    {
      "bom-ref": "21ff780a-65d3-4c35-ba1a-43c616a79140",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cb88310b-e9a2-4492-a836-1d0cab4eda8f"
        }
      ]
    },
    {
      "bom-ref": "a4b52bde-db03-4b92-a1c4-380e72ffd952",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8"
        }
      ]
    },
    {
      "bom-ref": "762ed63c-3482-4ec0-a3e1-259b938f87be",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8"
        }
      ]
    },
    {
      "bom-ref": "c03b8c54-fe2a-4edc-bf90-e246e19f8bd1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8"
        }
      ]
    },
    {
      "bom-ref": "b140e23e-f41c-4da4-a7cb-e1700f1d4587",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8"
        }
      ]
    },
    {
      "bom-ref": "cf9eade4-2ea0-4a02-966a-9ad47b433946",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8"
        }
      ]
    },
    {
      "bom-ref": "aa34f83d-c0dc-4209-b005-b9cbd7ce095b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cbb9bb19-f567-48ba-8e77-46f573503cd8"
        }
      ]
    },
    {
      "bom-ref": "01972ab6-612e-476e-a520-27543ca7da60",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa"
        }
      ]
    },
    {
      "bom-ref": "45cea280-f2b2-400c-8897-a4790b9a5ebd",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa"
        }
      ]
    },
    {
      "bom-ref": "43069c0a-662e-4ecc-b775-3746845a8e36",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa"
        }
      ]
    },
    {
      "bom-ref": "490cc2a9-a0b4-4318-8488-00f578795383",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa"
        }
      ]
    },
    {
      "bom-ref": "559ed9de-9bb0-40cc-88dd-c97db33b42c3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa"
        }
      ]
    },
    {
      "bom-ref": "162d88e5-9590-432a-b427-f8be76d2e7e3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ccbf7fae-5b82-4e9a-8680-bc6a7d973aaa"
        }
      ]
    },
    {
      "bom-ref": "6c9718fa-24aa-4aa3-ab93-0364c4078784",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "cef14346-674f-4275-a10d-c293409c1464"
        }
      ]
    },
    {
      "bom-ref": "6dfb0a1f-b49c-4692-b349-2b628f61f856",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402"
        }
      ]
    },
    {
      "bom-ref": "7dd70b0e-34da-4574-b280-ba77937f6e31",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402"
        }
      ]
    },
    {
      "bom-ref": "ae8dd627-38d9-41d5-830c-241de3ff10e2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402"
        }
      ]
    },
    {
      "bom-ref": "d20df682-732d-40e0-afe3-33b2aff65e9a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402"
        }
      ]
    },
    {
      "bom-ref": "ded644e2-263a-4966-9cd3-cd4c572c4dcc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cbca2402-ce70-478d-a11f-f831b2b4e402"
        }
      ]
    },
    {
      "bom-ref": "dbe5a5d0-0058-4c63-b9dd-72a867c71f66",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10"
        }
      ]
    },
    {
      "bom-ref": "1ed35c2c-0c27-451b-bd49-1c1a9b278ffe",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10"
        }
      ]
    },
    {
      "bom-ref": "814bd0ce-d0b9-4813-82cf-c1d1f6795b98",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10"
        }
      ]
    },
    {
      "bom-ref": "05e7146e-bd43-4307-b73e-9af27f20c5a2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10"
        }
      ]
    },
    {
      "bom-ref": "d4888113-d828-4969-946c-6db0a1d68f5b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10"
        }
      ]
    },
    {
      "bom-ref": "877e14be-87be-4684-bad5-42e9fbb9deeb",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ccec8c86-73e3-4ed6-9a38-54d576651c10"
        }
      ]
    },
    {
      "bom-ref": "cdd45849-b829-4edf-bcab-071622e40016",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371"
        }
      ]
    },
    {
      "bom-ref": "8e09a74f-bf72-43af-b38e-f141ecd62657",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371"
        }
      ]
    },
    {
      "bom-ref": "e4ac724b-76d5-4472-861b-8223171c3aaf",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371"
        }
      ]
    },
    {
      "bom-ref": "50ff9b58-a859-45df-b752-b7d9ca795081",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371"
        }
      ]
    },
    {
      "bom-ref": "3b2a285d-c285-4ecb-9209-ab4ebac0a1df",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371"
        }
      ]
    },
    {
      "bom-ref": "b629d54f-846a-4f18-b35a-d08df3916253",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cc0d1f80-9683-4c0b-8eef-03f81c259371"
        }
      ]
    },
    {
      "bom-ref": "c2641845-cf01-43d1-a5e2-53341aa6855b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d07e65ec-4509-45fc-9f4f-15bbc4050e98"
        }
      ]
    },
    {
      "bom-ref": "52c29505-5df7-46bc-8508-4d54a4621ace",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cd7acea7-231a-4728-af9a-548a94e64cde"
        }
      ]
    },
    {
      "bom-ref": "04eec851-6cab-47f4-be72-1ba55355816b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cd7acea7-231a-4728-af9a-548a94e64cde"
        }
      ]
    },
    {
      "bom-ref": "ce59f9c3-d905-4836-a175-d887756f58a7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cd7acea7-231a-4728-af9a-548a94e64cde"
        }
      ]
    },
    {
      "bom-ref": "7b1a99db-9637-43cc-be17-b33a7c9dded7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cd7acea7-231a-4728-af9a-548a94e64cde"
        }
      ]
    },
    {
      "bom-ref": "af7011cd-5ddb-4125-96b6-9cbb52f14d6b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cd7acea7-231a-4728-af9a-548a94e64cde"
        }
      ]
    },
    {
      "bom-ref": "736cead4-7aae-4e48-916f-ff512372f77a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cd7acea7-231a-4728-af9a-548a94e64cde"
        }
      ]
    },
    {
      "bom-ref": "bf54780e-3fd5-4b66-90e6-242f5c0eaf44",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "cfdc8540-39b8-4bdc-a2d7-a41ad87bca00"
        }
      ]
    },
    {
      "bom-ref": "4790bff2-69cf-48ca-8741-c2b6ea3fa23a",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "cfdc8540-39b8-4bdc-a2d7-a41ad87bca00"
        }
      ]
    },
    {
      "bom-ref": "2b7f4a95-bd77-46f0-8862-7c73de4aa012",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "cfdc8540-39b8-4bdc-a2d7-a41ad87bca00"
        }
      ]
    },
    {
      "bom-ref": "322d6831-dba2-47d8-bbe6-9dbf19b8204b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d0380940-f84e-45de-901e-2c33b401d277"
        }
      ]
    },
    {
      "bom-ref": "39616cf5-01da-4208-9b46-12001ecaf805",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4"
        }
      ]
    },
    {
      "bom-ref": "0e8c7791-d943-491a-bfe6-a902b866deb6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4"
        }
      ]
    },
    {
      "bom-ref": "cbbfde6e-a8a1-47e2-a651-9ec813011732",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4"
        }
      ]
    },
    {
      "bom-ref": "1bbf333b-9f9c-41d9-ada2-135308f9b899",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4"
        }
      ]
    },
    {
      "bom-ref": "363cb842-f50e-40b8-9f94-d7ae1eca8b82",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4"
        }
      ]
    },
    {
      "bom-ref": "3e90006e-7969-4541-ad60-c10bd37464f8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cd9a54e7-926b-4cb6-ad75-de82d87830c4"
        }
      ]
    },
    {
      "bom-ref": "e8af16a8-168b-456e-a319-d7869e2a4df8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24"
        }
      ]
    },
    {
      "bom-ref": "572b5e58-ae80-4f47-a061-0e562f0936b8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24"
        }
      ]
    },
    {
      "bom-ref": "a7998f07-0207-43cb-b655-cd4d0d90e8d4",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24"
        }
      ]
    },
    {
      "bom-ref": "d30292b4-a4b5-43f4-93e1-cf7811a502aa",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24"
        }
      ]
    },
    {
      "bom-ref": "08de56a0-0a84-404b-b41f-d3203d5e71e7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24"
        }
      ]
    },
    {
      "bom-ref": "90048d38-4167-4059-b297-b9f8ac6af943",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cd9299b1-751e-466d-8570-2bec7e3b8c24"
        }
      ]
    },
    {
      "bom-ref": "e37be86e-820f-4a7e-853f-d7facb506145",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "4197a8b5-4c50-478a-bd43-fcdc1de61f80",
      "id": "CVE-2024-0727",
      "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "feedf05e-1aab-4549-b92b-9966b9322314",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d0a32d66-ca9c-4131-b7c2-ed9f27e76d0c"
        }
      ]
    },
    {
      "bom-ref": "a2a17e82-494b-4133-a6c8-e9f44421c5d7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d0be729d-07a3-40ba-a9bd-e4cb7ec428ab"
        }
      ]
    },
    {
      "bom-ref": "08e31a95-9d46-433e-a89e-3c6394b9a3df",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d12c99c4-9bc5-4a08-973a-81f1a81673af"
        }
      ]
    },
    {
      "bom-ref": "b2c0e650-4625-4ca2-8003-8b9c624376de",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d098b5a9-87b1-4dce-8940-29aaa70e071f"
        }
      ]
    },
    {
      "bom-ref": "d2a5d937-81ce-4060-a7ac-083bb9956c12",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b"
        }
      ]
    },
    {
      "bom-ref": "795c2e1e-d965-4fdc-a1a1-0f2003d99584",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b"
        }
      ]
    },
    {
      "bom-ref": "f5f74a3d-4200-42c1-91c7-2867fb531fbd",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b"
        }
      ]
    },
    {
      "bom-ref": "b1d23cab-8c64-49f7-9c96-547c49fdc320",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b"
        }
      ]
    },
    {
      "bom-ref": "98239118-86ae-42f0-8c0f-4453026fd3f7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b"
        }
      ]
    },
    {
      "bom-ref": "cc0248f7-fcc9-463f-b8c3-3f9878c632cd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cea7a4a4-a2ec-4783-9f36-151de16bef2b"
        }
      ]
    },
    {
      "bom-ref": "fac39d32-3fab-4c36-8050-7312d00c1826",
      "id": "CVE-2022-3821",
      "description": "An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.",
      "affects": [
        {
          "ref": "ce007e2c-6e66-459f-a7c7-4d8278d32677"
        }
      ]
    },
    {
      "bom-ref": "0e47e4b9-1837-4084-99ca-1ddeedf7ceb7",
      "id": "CVE-2022-4415",
      "description": "A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.",
      "affects": [
        {
          "ref": "ce007e2c-6e66-459f-a7c7-4d8278d32677"
        }
      ]
    },
    {
      "bom-ref": "37fb18f5-9a42-443a-b37c-b9199f090aee",
      "id": "CVE-2022-45873",
      "description": "systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.",
      "affects": [
        {
          "ref": "ce007e2c-6e66-459f-a7c7-4d8278d32677"
        }
      ]
    },
    {
      "bom-ref": "2509f1b4-b226-4468-a6ec-011836d8d719",
      "id": "CVE-2025-4598",
      "description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
      "affects": [
        {
          "ref": "ce007e2c-6e66-459f-a7c7-4d8278d32677"
        }
      ]
    },
    {
      "bom-ref": "e9520959-b40f-4458-bfb9-800157da013e",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d2c7bee5-7ef9-4188-a8a0-679cf36a4ce3"
        }
      ]
    },
    {
      "bom-ref": "5490ee6f-c1b5-48e6-a2c2-3b16bf146535",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d34ab30e-ab9d-444a-9f0b-b72b0e472a41"
        }
      ]
    },
    {
      "bom-ref": "6a0537fb-673b-4115-bb79-4a4507f3d040",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d279cdc1-dbd3-4184-a8a2-7d75aea5e557"
        }
      ]
    },
    {
      "bom-ref": "bf7f4ca6-5f9d-46db-ae53-4aee621597a3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8"
        }
      ]
    },
    {
      "bom-ref": "a425f60c-89c7-474a-8769-ae79834aba9e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8"
        }
      ]
    },
    {
      "bom-ref": "0e97c7c7-7fb9-49da-a19a-927a4b6991ed",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8"
        }
      ]
    },
    {
      "bom-ref": "ac6c6785-f299-4383-94e0-566a3b8ac53e",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8"
        }
      ]
    },
    {
      "bom-ref": "1633a300-d138-4292-adba-77353650c4b9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8"
        }
      ]
    },
    {
      "bom-ref": "072c3f4a-810b-4729-a01a-ed1170dea58a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ce166668-1f42-4ad0-bc7d-abfd9e52d7f8"
        }
      ]
    },
    {
      "bom-ref": "b0a226b6-8b80-45bc-88a8-571af9e0fbd7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d23fd5e3-aa8a-4aea-9b15-6aaa0d0255ee"
        }
      ]
    },
    {
      "bom-ref": "88eba8c3-98d9-4a55-988f-49773b10eb8d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d2cfb273-326b-48af-8434-c4dc79659376"
        }
      ]
    },
    {
      "bom-ref": "e9bf0620-4418-4fe5-b659-54a6b703533b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d3f85aed-275e-4c2e-a2c7-13cfb423b5d6"
        }
      ]
    },
    {
      "bom-ref": "1df4a9b1-688d-46c2-ad0e-660301ac81dd",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95"
        }
      ]
    },
    {
      "bom-ref": "031cefb2-4308-4401-8191-3f57b71809ff",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95"
        }
      ]
    },
    {
      "bom-ref": "0af109c3-47ab-4505-b37c-9084d1e4cbf1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95"
        }
      ]
    },
    {
      "bom-ref": "6a1a0e12-465d-4515-88e9-ebddf776334d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95"
        }
      ]
    },
    {
      "bom-ref": "ee86757f-4c4c-4fc5-98b3-e64995c0a15b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95"
        }
      ]
    },
    {
      "bom-ref": "0134c0cb-44ee-446d-8ff1-747a78b84d5d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cf950ca1-5240-4b19-8482-b11bbed98c95"
        }
      ]
    },
    {
      "bom-ref": "8dd158e5-af5e-4adf-a97f-d2edc3f0cddf",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5"
        }
      ]
    },
    {
      "bom-ref": "aa64cea6-da65-494c-ba23-9101f601119d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5"
        }
      ]
    },
    {
      "bom-ref": "82b2f864-2f8b-42f6-9df8-f79d6d86c319",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5"
        }
      ]
    },
    {
      "bom-ref": "cb526582-7e2b-4997-97b2-0694f72c9751",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5"
        }
      ]
    },
    {
      "bom-ref": "094fcedf-40f1-42c5-af1a-03afba448279",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5"
        }
      ]
    },
    {
      "bom-ref": "f71905be-19a1-4bfb-b293-7f7a001fe7d4",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cf211d00-d3a6-439a-aecb-25627eb37ee5"
        }
      ]
    },
    {
      "bom-ref": "23cb6a9e-9ddb-4d86-a269-1cc50290f5b1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb"
        }
      ]
    },
    {
      "bom-ref": "a09fd9f9-9877-48ee-955c-6cf86881baad",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb"
        }
      ]
    },
    {
      "bom-ref": "79c0506a-5f83-4275-9369-656ba111f50b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb"
        }
      ]
    },
    {
      "bom-ref": "77b5b3e0-7c3a-42be-a95c-a615ab555017",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb"
        }
      ]
    },
    {
      "bom-ref": "1371bf07-bdba-44ce-ba19-ce3b96db5bcf",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb"
        }
      ]
    },
    {
      "bom-ref": "034c0d38-7306-4201-b1c5-b8fb7a12868c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d031b2ee-1e47-4a62-a0fb-2c84f1357aeb"
        }
      ]
    },
    {
      "bom-ref": "249e54ba-d83b-40f8-af52-15b19ed9aabf",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318"
        }
      ]
    },
    {
      "bom-ref": "14391d17-f6aa-4594-80f8-5790e58cf8be",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318"
        }
      ]
    },
    {
      "bom-ref": "016d6995-3bd6-4edd-8692-6b41104da2d0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318"
        }
      ]
    },
    {
      "bom-ref": "eb6555b9-ed6b-45b2-b663-0189f15dbfe0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318"
        }
      ]
    },
    {
      "bom-ref": "1f3c5ca4-9e04-4466-a8a5-9e528dda2cfc",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318"
        }
      ]
    },
    {
      "bom-ref": "ebc18b44-31ad-4c85-bced-054dbac713bb",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cf7dc051-bc03-4031-9d2e-453ebf37c318"
        }
      ]
    },
    {
      "bom-ref": "abe36a5e-163e-4369-8b48-60bb17f931b8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583"
        }
      ]
    },
    {
      "bom-ref": "62e98141-16a9-4e5d-bb37-17e71bd7c882",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583"
        }
      ]
    },
    {
      "bom-ref": "a6e3dbac-5b01-4ab2-a703-308a6d85331f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583"
        }
      ]
    },
    {
      "bom-ref": "d4ff7d62-31ad-4273-8e2b-a0941e535c07",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583"
        }
      ]
    },
    {
      "bom-ref": "f82b4959-dead-4a94-acb4-76076878d02d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583"
        }
      ]
    },
    {
      "bom-ref": "1ff3b6b8-f992-439c-8442-296eb573982d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "cfc835d6-5ffa-4d5d-b83a-1dfc07910583"
        }
      ]
    },
    {
      "bom-ref": "ac070e02-6f32-43a4-bea4-72da6cd79f9e",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d4d56576-6d30-43a5-925c-ac343cabe244"
        }
      ]
    },
    {
      "bom-ref": "7bd0a94b-50f9-4c8d-8a1b-54e5aaa0058b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d64d9791-0ab7-40cc-bf03-40e5d7f456d8"
        }
      ]
    },
    {
      "bom-ref": "350b7a3d-3f8f-4d11-9497-dfa722b70837",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d5f78a87-1eb9-497b-86d2-923e55765c2a"
        }
      ]
    },
    {
      "bom-ref": "3c7845fa-32bb-43d7-8119-ed6514cbe0c1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d6f33100-e235-4b9f-8c22-6b539f1922e9"
        }
      ]
    },
    {
      "bom-ref": "cf240cae-c058-4c86-8725-78860dd75b25",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e"
        }
      ]
    },
    {
      "bom-ref": "fb29193d-04c0-4ebd-976f-b417be7432b8",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e"
        }
      ]
    },
    {
      "bom-ref": "2e1a6447-c959-4314-b2f5-cfb8a584fb2f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e"
        }
      ]
    },
    {
      "bom-ref": "ab7ce888-6eed-4a3e-8041-cd9a20abf8d8",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e"
        }
      ]
    },
    {
      "bom-ref": "43c91373-a71a-4dec-86f7-63ff5fdd71cd",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e"
        }
      ]
    },
    {
      "bom-ref": "6ef14b06-a0f2-4084-90e2-92059ef03891",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d2411f01-ac8d-4f9d-baea-71907b16ca1e"
        }
      ]
    },
    {
      "bom-ref": "62e956bd-8f30-4d60-bfa1-d83f8cff42a2",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d77df6f8-8d35-43cf-bf10-5f939496caac"
        }
      ]
    },
    {
      "bom-ref": "7dcfbc98-7a6d-4124-93c0-d32ec9ce12d9",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d790579c-8036-41c8-99f7-8ee78ea5a1c3"
        }
      ]
    },
    {
      "bom-ref": "92f3773d-d5d5-49e8-988d-6c017d294bb6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa"
        }
      ]
    },
    {
      "bom-ref": "d5c96014-a4ab-46f0-8b37-af008fa831fe",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa"
        }
      ]
    },
    {
      "bom-ref": "227c2bd7-c022-49df-8586-2e97a3099dff",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa"
        }
      ]
    },
    {
      "bom-ref": "b100bb5d-f8d3-41d9-9c5d-abc4352621e7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa"
        }
      ]
    },
    {
      "bom-ref": "d8aeed91-101d-4fbd-91fe-b761f57c3514",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa"
        }
      ]
    },
    {
      "bom-ref": "7a4d44f8-a222-45e5-8815-3df205c64655",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d3fe8bf1-1c9a-4f47-86bf-0d95fe04e3fa"
        }
      ]
    },
    {
      "bom-ref": "3dacf82d-cf5d-462d-90cc-4622de704f01",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff"
        }
      ]
    },
    {
      "bom-ref": "575768fa-275e-45a7-9c81-cc19997c0663",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff"
        }
      ]
    },
    {
      "bom-ref": "06e5847f-bcf5-42a1-9c17-93c3bf257fd8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff"
        }
      ]
    },
    {
      "bom-ref": "c984e6da-9c8c-4650-ada3-567aa5faf234",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff"
        }
      ]
    },
    {
      "bom-ref": "ff46ae98-0222-4fb6-8a81-717cdf27943c",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff"
        }
      ]
    },
    {
      "bom-ref": "ca61259c-f107-42aa-922f-79cc642bc819",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d3db215b-7ecd-4f28-89ac-e425e72432ff"
        }
      ]
    },
    {
      "bom-ref": "a7a99a1d-cdca-4e99-a77e-d482883300f4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760"
        }
      ]
    },
    {
      "bom-ref": "f78ca4fb-8871-45db-9336-287c43f50786",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760"
        }
      ]
    },
    {
      "bom-ref": "084edb23-a70b-41f2-b8df-e10695923410",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760"
        }
      ]
    },
    {
      "bom-ref": "4a3f08d7-1e09-4876-b073-7ac7b2ae8b0c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760"
        }
      ]
    },
    {
      "bom-ref": "e195c539-a9c6-4ce3-868e-cf130819d576",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760"
        }
      ]
    },
    {
      "bom-ref": "f77489f3-51b9-4128-a5a1-375a50450041",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d36e9c82-1356-4dfb-a21c-0010945ed760"
        }
      ]
    },
    {
      "bom-ref": "0c9e9a1c-ba24-47db-93dd-f76b922c9e77",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d366c2ce-f424-4724-b915-668c404e6234"
        }
      ]
    },
    {
      "bom-ref": "63183df9-7daf-4c47-b8fa-7d91a7d6a195",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d366c2ce-f424-4724-b915-668c404e6234"
        }
      ]
    },
    {
      "bom-ref": "08085b93-8b9f-40cb-adc5-9ca127bbeaca",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d366c2ce-f424-4724-b915-668c404e6234"
        }
      ]
    },
    {
      "bom-ref": "d11efb7e-438f-4d3e-9db3-2582e48ba9ad",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d366c2ce-f424-4724-b915-668c404e6234"
        }
      ]
    },
    {
      "bom-ref": "c752e356-bc7b-40f8-a7f5-8c6024ad62d1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d366c2ce-f424-4724-b915-668c404e6234"
        }
      ]
    },
    {
      "bom-ref": "f8316bcc-cbb3-45d1-92c3-2273927faa2f",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d366c2ce-f424-4724-b915-668c404e6234"
        }
      ]
    },
    {
      "bom-ref": "ad647a64-3861-4f01-96b5-2087afb6320c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36"
        }
      ]
    },
    {
      "bom-ref": "2817c361-00a1-4600-8d19-44c658d2dbc2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36"
        }
      ]
    },
    {
      "bom-ref": "9ccceadb-4c3e-4397-8e40-7d8eea8c1b5b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36"
        }
      ]
    },
    {
      "bom-ref": "a916e7db-1599-48c0-9b8c-b1df6a70f5dd",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36"
        }
      ]
    },
    {
      "bom-ref": "520afb25-32cf-4c86-b7c7-2fbdd83b8b3e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36"
        }
      ]
    },
    {
      "bom-ref": "6c7fc959-c013-4237-a2cb-1ec78b0022d9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d34dcb2e-a5fb-46ca-b3d7-42b1e0e77d36"
        }
      ]
    },
    {
      "bom-ref": "2aea64b1-908e-4c10-865e-39714aff06e7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "d7cc4974-fa80-4c7a-985c-d21e01b28340"
        }
      ]
    },
    {
      "bom-ref": "145e1845-febe-4572-a025-cc5524b495ca",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "da559dce-14f5-48cc-8aaf-cb1201501758"
        }
      ]
    },
    {
      "bom-ref": "3ee13f39-9940-4df0-96ab-d8b02f701689",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "da430bfe-2e8b-423f-9d88-bd19781c8772"
        }
      ]
    },
    {
      "bom-ref": "11e1c93b-5657-4b0d-adac-837941618f0f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146"
        }
      ]
    },
    {
      "bom-ref": "dbb7236a-43db-4e46-aaf1-dc755f48e9e3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146"
        }
      ]
    },
    {
      "bom-ref": "2425b529-d6a1-49ec-b9aa-ee23fe316b34",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146"
        }
      ]
    },
    {
      "bom-ref": "2778c564-6d23-472b-9bdc-859c2303fc67",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146"
        }
      ]
    },
    {
      "bom-ref": "c6af2e21-c3a6-4249-a591-88e11a6d1648",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146"
        }
      ]
    },
    {
      "bom-ref": "d63908c2-f9a1-4997-adda-83e5160ca0fd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d8915ce7-52a7-45a9-a92d-fbffabde7146"
        }
      ]
    },
    {
      "bom-ref": "32c4849e-4475-4ae2-a3a4-d050e21ef1ca",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a"
        }
      ]
    },
    {
      "bom-ref": "443fa13b-cfec-41ca-92ae-b2a43abd565d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a"
        }
      ]
    },
    {
      "bom-ref": "f1871bb2-2fb7-4581-826f-0cf9ce489b96",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a"
        }
      ]
    },
    {
      "bom-ref": "0bfc5cca-b89e-4988-a3a8-075cb0d8d639",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a"
        }
      ]
    },
    {
      "bom-ref": "3b5e8889-08c8-44bb-ab77-549b90dcbece",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a"
        }
      ]
    },
    {
      "bom-ref": "3408df58-7710-4afe-bc7e-328f1008ee04",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d46ad2e1-3ba4-4e7b-a919-c3dfb2e70e3a"
        }
      ]
    },
    {
      "bom-ref": "831a3826-af97-48aa-94f0-29cf23051950",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4"
        }
      ]
    },
    {
      "bom-ref": "e46182f7-8ecf-4c46-b1e0-ba2d22c0e537",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4"
        }
      ]
    },
    {
      "bom-ref": "61decce9-9309-4e4d-9b09-05754f795420",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4"
        }
      ]
    },
    {
      "bom-ref": "211eb785-a245-418e-bc03-58c1a91227a9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4"
        }
      ]
    },
    {
      "bom-ref": "efc24a61-808d-49d6-afab-0e64e8399607",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4"
        }
      ]
    },
    {
      "bom-ref": "b7b00581-fe43-45d6-a94e-f44d681ac81c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d4b6ff03-4be1-43af-b5df-3652cf6b28f4"
        }
      ]
    },
    {
      "bom-ref": "0a8bb0f9-34c9-41db-99e5-9056906147b3",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6"
        }
      ]
    },
    {
      "bom-ref": "23b8b625-528d-4e51-9c83-8c6da1fe1df4",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6"
        }
      ]
    },
    {
      "bom-ref": "5f331542-e822-448b-b9da-bde53665b0d2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6"
        }
      ]
    },
    {
      "bom-ref": "f8a3c8d8-78da-466b-b0e6-3960ae48ec02",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6"
        }
      ]
    },
    {
      "bom-ref": "2188c02d-7736-46d8-a5c7-90b95855b313",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6"
        }
      ]
    },
    {
      "bom-ref": "002d4d35-24d4-4d76-a9f7-1084c2962f02",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d51ea832-e847-4dee-9d6f-7a4b7f5d4aa6"
        }
      ]
    },
    {
      "bom-ref": "d5f87862-daac-4af1-b2b1-96feca4947f0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8"
        }
      ]
    },
    {
      "bom-ref": "552134c8-5702-4b42-94b0-dcf005ac83d2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8"
        }
      ]
    },
    {
      "bom-ref": "08ce4457-84ea-45af-88ee-2239f3c1c1b1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8"
        }
      ]
    },
    {
      "bom-ref": "4b06bb34-9e71-48fc-913b-f484deebd3e2",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8"
        }
      ]
    },
    {
      "bom-ref": "5e8d4f5d-04c3-42b1-8ca0-40133ce3c86f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8"
        }
      ]
    },
    {
      "bom-ref": "04e95f7a-316f-478d-8f36-7ccbc82c3302",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d5c1c7d3-f9e9-4e18-9ee4-51b06a0c5de8"
        }
      ]
    },
    {
      "bom-ref": "8a700d17-3d74-4fb8-b00a-83946dcadced",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098"
        }
      ]
    },
    {
      "bom-ref": "a707e6b7-a88f-4bd8-ac5a-0ebdc7243e60",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098"
        }
      ]
    },
    {
      "bom-ref": "a9b4746a-774f-4953-9814-864da476ba67",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098"
        }
      ]
    },
    {
      "bom-ref": "4865c452-f0a3-45b7-a9c3-3ccc005ccb7d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098"
        }
      ]
    },
    {
      "bom-ref": "454776dd-de1d-46f5-a26a-2c9efbbdbed7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098"
        }
      ]
    },
    {
      "bom-ref": "29785bd6-323c-4b3d-ba05-0714e2a53193",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d6c2b2ca-3a99-4ed4-8a2c-d89971fbb098"
        }
      ]
    },
    {
      "bom-ref": "4dd2c231-0828-4038-adb5-f6090821fb90",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "dbc0325d-f8f2-4e2e-b164-3f3a3da4093a"
        }
      ]
    },
    {
      "bom-ref": "c8622d85-8080-41a2-8e18-366690a3a307",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91"
        }
      ]
    },
    {
      "bom-ref": "c5ab5ee9-2a46-48f5-beb8-0854261c4ffd",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91"
        }
      ]
    },
    {
      "bom-ref": "91cf7480-fdce-4fcf-813b-56785dbccbc1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91"
        }
      ]
    },
    {
      "bom-ref": "03edee6d-1e66-4674-9b83-cc89f95702ef",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91"
        }
      ]
    },
    {
      "bom-ref": "074f499f-dc7d-4cf9-aced-6887bbad2d15",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91"
        }
      ]
    },
    {
      "bom-ref": "7d17d5d6-07c9-4a78-a96b-bdf2eba56d74",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "db9638f1-b03a-4810-a85e-48d1492b8c91"
        }
      ]
    },
    {
      "bom-ref": "35c36b5d-96e2-49ca-a0f1-49c2963259cd",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "dcedf751-77ec-480f-8473-8b8b4bebdb9c"
        }
      ]
    },
    {
      "bom-ref": "7ee57ffa-93e5-49af-b4ef-1b7b5abed390",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "dc8906ca-4c9e-4f74-bd46-82d23e92413a"
        }
      ]
    },
    {
      "bom-ref": "a1f222bb-dac8-4d52-9ee1-689e687d1486",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e"
        }
      ]
    },
    {
      "bom-ref": "e398dbfd-503f-4dbb-97e3-b2b4e10ba991",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e"
        }
      ]
    },
    {
      "bom-ref": "0e0bf694-c065-4f1b-916a-a50a29b04d33",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e"
        }
      ]
    },
    {
      "bom-ref": "3958746b-7c2b-4498-be51-eccb94686501",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e"
        }
      ]
    },
    {
      "bom-ref": "c262e382-b5fc-4ee4-a629-cb999677d954",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e"
        }
      ]
    },
    {
      "bom-ref": "5c0db088-d1ce-4b2a-8206-f2d4c5562fd1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d7af1990-ff7e-477f-8a91-65f82768ed1e"
        }
      ]
    },
    {
      "bom-ref": "c0ab20b7-b681-4b46-b7c3-50815b33bb8c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3"
        }
      ]
    },
    {
      "bom-ref": "4401ceaa-e29d-452b-8abf-a820a2e8fff1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3"
        }
      ]
    },
    {
      "bom-ref": "537a16e8-a941-40d5-904a-44cac79e1a13",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3"
        }
      ]
    },
    {
      "bom-ref": "315c81b0-a921-480a-8d74-fe0ada9c97c6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3"
        }
      ]
    },
    {
      "bom-ref": "7f30add3-75b9-441c-adfd-38b7a2f75dde",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3"
        }
      ]
    },
    {
      "bom-ref": "950edc68-a0ac-41da-84b5-b99116fe972c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d7c20da2-7385-47d7-abb2-6f90ce252bd3"
        }
      ]
    },
    {
      "bom-ref": "919fec4f-47a7-4a4e-aaec-b17c9af125ef",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8"
        }
      ]
    },
    {
      "bom-ref": "574d5534-fa2e-4f30-8ed6-43ad3b8ba657",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8"
        }
      ]
    },
    {
      "bom-ref": "b23d8b14-8d4c-4d55-9653-961b265ab74e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8"
        }
      ]
    },
    {
      "bom-ref": "cc2b9bb3-0185-4138-afb9-f871a67442a7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8"
        }
      ]
    },
    {
      "bom-ref": "22b2bdaf-567d-4c42-90f2-c1787bbf9b09",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8"
        }
      ]
    },
    {
      "bom-ref": "c86315a7-acd7-4d73-a336-d1a07cbbffd2",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d8479b3a-c35c-41e4-90f2-6b7d81cfecb8"
        }
      ]
    },
    {
      "bom-ref": "31a674c6-e840-4208-a85a-52e63df0ffe6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d84f327c-73f6-4790-a579-20b1e631e99c"
        }
      ]
    },
    {
      "bom-ref": "bb9a9545-4a46-4f6f-8df3-60c71246e0dc",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d84f327c-73f6-4790-a579-20b1e631e99c"
        }
      ]
    },
    {
      "bom-ref": "6cd7c4ce-28dc-47cb-86d7-de69f208a03a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d84f327c-73f6-4790-a579-20b1e631e99c"
        }
      ]
    },
    {
      "bom-ref": "06308e98-2958-4518-8d2a-ed9cad18cf7b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d84f327c-73f6-4790-a579-20b1e631e99c"
        }
      ]
    },
    {
      "bom-ref": "f7610d75-0675-479c-b5d5-ba37b48d5fb7",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d84f327c-73f6-4790-a579-20b1e631e99c"
        }
      ]
    },
    {
      "bom-ref": "083dfe69-f57f-489c-8865-0b345813aa20",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d84f327c-73f6-4790-a579-20b1e631e99c"
        }
      ]
    },
    {
      "bom-ref": "9f1de15a-9011-4c84-a261-37422f7b745f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "dd52cd6e-cbaa-4e8b-9d20-1c661034a39f"
        }
      ]
    },
    {
      "bom-ref": "55267fbc-71ba-4149-98d0-a0a567267aed",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58"
        }
      ]
    },
    {
      "bom-ref": "69a402b9-9431-4174-a0c6-923fcb81833b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58"
        }
      ]
    },
    {
      "bom-ref": "86c9e494-00b2-4aa4-aa87-c3155e595159",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58"
        }
      ]
    },
    {
      "bom-ref": "c07ad93d-2bb4-4d66-9150-7ab3bf591d3a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58"
        }
      ]
    },
    {
      "bom-ref": "f7c518b7-d28a-4cab-956c-05a2cb5e218b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e"
        }
      ]
    },
    {
      "bom-ref": "edd003cb-fc21-45c8-9489-e66509165af1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58"
        }
      ]
    },
    {
      "bom-ref": "a5746dc8-1158-45f7-b5d0-429ee83ebbed",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dd76d9e0-2a32-4b36-ac56-d775341bdf58"
        }
      ]
    },
    {
      "bom-ref": "a4314553-0e86-4802-926c-77ffa0ee3ec5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f"
        }
      ]
    },
    {
      "bom-ref": "2af94cc3-08d3-4df4-b3ae-e7a218eecdd6",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f"
        }
      ]
    },
    {
      "bom-ref": "45c5f4cc-aa07-49e9-be69-e63dbc83afec",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f"
        }
      ]
    },
    {
      "bom-ref": "515b976f-1c9a-4350-bb50-5687b1daddc7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f"
        }
      ]
    },
    {
      "bom-ref": "41b927c1-eb39-44de-a0dc-658bbdb4698f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f"
        }
      ]
    },
    {
      "bom-ref": "100405d4-b1ca-4727-86d9-a2d5e194dee0",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "d9831296-77a0-421d-beb1-cab91b2d1b0f"
        }
      ]
    },
    {
      "bom-ref": "98d0e242-65ac-4402-82b8-3b7b1b09cf07",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3"
        }
      ]
    },
    {
      "bom-ref": "9f060508-14ef-4f49-85e3-bcbb16b55ecf",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3"
        }
      ]
    },
    {
      "bom-ref": "afea8abf-9b6c-44ba-8dcb-c9e95bd1baf5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3"
        }
      ]
    },
    {
      "bom-ref": "3d2b6e12-1d3d-4f51-b658-e3361664d32f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3"
        }
      ]
    },
    {
      "bom-ref": "f6d05c1b-84f3-4c56-91ae-e0593a521cce",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3"
        }
      ]
    },
    {
      "bom-ref": "1af16c85-8553-45d4-b464-4838ac89cb54",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "da601a53-4a0b-410a-9d60-0147894ec6f3"
        }
      ]
    },
    {
      "bom-ref": "9ade9ab2-978b-4af9-afe6-080aedb1230f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "deb08eda-003b-402d-9187-25db3e073225"
        }
      ]
    },
    {
      "bom-ref": "80469ba5-7695-4b76-b6a4-39f5735a3d8d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e"
        }
      ]
    },
    {
      "bom-ref": "46e66e09-39ab-4b22-a1d7-67a61c40d2ec",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e"
        }
      ]
    },
    {
      "bom-ref": "736f2ac8-4c0f-4923-90fa-9a6340833acc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e"
        }
      ]
    },
    {
      "bom-ref": "ffb36f95-bd33-4022-8d99-3afaa515d38f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e"
        }
      ]
    },
    {
      "bom-ref": "96e96ce5-e840-4b9f-81e5-c08d394ce3d4",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "db6ac9ba-fc50-4ac4-843e-068348264f5e"
        }
      ]
    },
    {
      "bom-ref": "6a149061-888f-4682-b347-f6fca5e65351",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a"
        }
      ]
    },
    {
      "bom-ref": "d7c0a0b3-0cff-4db1-8c7d-02e6b606e919",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a"
        }
      ]
    },
    {
      "bom-ref": "7425129c-1c9d-48ba-92c8-f8468c326fd9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a"
        }
      ]
    },
    {
      "bom-ref": "897a8979-5877-49c3-ab2e-6ae3ca1da4d0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a"
        }
      ]
    },
    {
      "bom-ref": "4bf51ba8-d275-43ad-a258-f3e08a59d564",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a"
        }
      ]
    },
    {
      "bom-ref": "da2eb6d0-8d97-4964-9b91-9e4a5ce566ef",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "db86165a-76cb-475b-922f-2ba4b79bd29a"
        }
      ]
    },
    {
      "bom-ref": "e49683c2-0021-4032-94b4-612cf473f339",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "defff098-222a-46cb-81e0-fe21e13f0928"
        }
      ]
    },
    {
      "bom-ref": "2d490962-36e6-49cb-929d-c78b6e102919",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5"
        }
      ]
    },
    {
      "bom-ref": "f1ebab79-424e-46e8-9700-fb6924da1fbd",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5"
        }
      ]
    },
    {
      "bom-ref": "1b9dd5a0-c927-4700-af76-b7be9292b939",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5"
        }
      ]
    },
    {
      "bom-ref": "180b8b4c-944e-4ce5-beaf-e124e86eeb5f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5"
        }
      ]
    },
    {
      "bom-ref": "52bef4ee-7a55-4c96-918a-4116e2471633",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5"
        }
      ]
    },
    {
      "bom-ref": "a3e3ee50-8b4c-40e7-8801-2c3c81348804",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dec7fe1a-7e05-49ec-8d5e-34f68d6c11d5"
        }
      ]
    },
    {
      "bom-ref": "b7ae9519-a79c-430b-9cdd-f796efed390e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d"
        }
      ]
    },
    {
      "bom-ref": "b0998868-c75c-4f00-a500-181e87ef8717",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d"
        }
      ]
    },
    {
      "bom-ref": "1082e37b-4162-4044-9afd-d5d03e51076f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d"
        }
      ]
    },
    {
      "bom-ref": "d903500b-38aa-47f9-8f2d-98f4efc5f3ef",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d"
        }
      ]
    },
    {
      "bom-ref": "f174148b-a22b-430a-b527-5472e86c534b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d"
        }
      ]
    },
    {
      "bom-ref": "22363c40-c737-4195-a1c5-4845d3b09e54",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "db9c1254-a9bf-4e24-a0ce-a8458a01a70d"
        }
      ]
    },
    {
      "bom-ref": "1e53d8af-d347-410c-a0c4-50d59ef1f8b5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5"
        }
      ]
    },
    {
      "bom-ref": "694e69fa-2df9-4db2-b820-c67e1f265263",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5"
        }
      ]
    },
    {
      "bom-ref": "792db517-e60a-4dd4-9f1a-46c506e7f8ed",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5"
        }
      ]
    },
    {
      "bom-ref": "ef300704-37ea-456b-b44b-9f9bf7102162",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5"
        }
      ]
    },
    {
      "bom-ref": "63c4f215-ec20-4868-a3c0-c6f92c0ee7f2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5"
        }
      ]
    },
    {
      "bom-ref": "f8225bd7-4e37-46f2-a2cb-f5712c567dcc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dba15a6b-cb63-4e14-991d-0eacc1321ad5"
        }
      ]
    },
    {
      "bom-ref": "8168a528-2225-4718-8154-23a6fd40cfac",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b"
        }
      ]
    },
    {
      "bom-ref": "d2a9ba61-c3e5-431e-84b3-97847d31be83",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b"
        }
      ]
    },
    {
      "bom-ref": "44b8ffe6-4b04-4297-b44d-cde8ee1625e1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b"
        }
      ]
    },
    {
      "bom-ref": "875c3444-dc28-4e25-b129-e214aa22af3c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b"
        }
      ]
    },
    {
      "bom-ref": "dab40f82-dd71-4f88-80fc-640d83b0b1c9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b"
        }
      ]
    },
    {
      "bom-ref": "8b609ae1-3dc8-43da-a0e8-17028070e100",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dc6d4243-9d3e-4bdd-90e2-49d6dd417a7b"
        }
      ]
    },
    {
      "bom-ref": "2e97fec2-dd9e-4957-a090-88c170dee43d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "df690613-68bf-4e0d-99d1-8cc9f7041bf9"
        }
      ]
    },
    {
      "bom-ref": "ca30cb19-fe75-4de0-939c-9504a9f1acf7",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c"
        }
      ]
    },
    {
      "bom-ref": "99d41135-cc16-42d0-a942-8fcdab3009fa",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c"
        }
      ]
    },
    {
      "bom-ref": "169c138c-f60b-446f-bc1e-95032d98b8c0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c"
        }
      ]
    },
    {
      "bom-ref": "3058f980-cb24-410e-a310-c8097bf3572d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c"
        }
      ]
    },
    {
      "bom-ref": "6669c353-ce82-4f72-8db6-c928f1c3f9a6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c"
        }
      ]
    },
    {
      "bom-ref": "3650c723-4a23-46b0-96da-af9504f45741",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dbf2a839-9cd1-4ce4-adb0-285c323ce54c"
        }
      ]
    },
    {
      "bom-ref": "9585a53f-119a-42af-8993-7237f9102230",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0"
        }
      ]
    },
    {
      "bom-ref": "dc9c2196-fc57-4896-b8d2-394ace746446",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0"
        }
      ]
    },
    {
      "bom-ref": "067094e0-e5b2-4f9f-a54c-21e07911dd84",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0"
        }
      ]
    },
    {
      "bom-ref": "c19f14eb-928e-45ba-99df-aa683ddfb86d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0"
        }
      ]
    },
    {
      "bom-ref": "73a1a24a-7132-4661-aca8-882f28ed71f0",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0"
        }
      ]
    },
    {
      "bom-ref": "1fd6840e-d0f2-4378-a987-3e2944725a7e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dcd48a38-28ae-40ac-b285-82a05adb60f0"
        }
      ]
    },
    {
      "bom-ref": "caf5870b-cfa9-4a02-a2f4-d0986b6ced0b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9"
        }
      ]
    },
    {
      "bom-ref": "9f85b1ca-3ec1-4c68-b307-13700778d87e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9"
        }
      ]
    },
    {
      "bom-ref": "05be370d-e3cf-47ec-be25-a914ab8fec7b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9"
        }
      ]
    },
    {
      "bom-ref": "5ff64539-cb3e-404f-9842-6f66211e67bc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9"
        }
      ]
    },
    {
      "bom-ref": "1e0cdfef-7fb4-4879-b671-9d14b6d865a6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9"
        }
      ]
    },
    {
      "bom-ref": "d560e9ef-640e-4a68-bfd1-87e45542f467",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dcfe3644-e5ef-44ce-ba31-908993521fd9"
        }
      ]
    },
    {
      "bom-ref": "7b5b6029-0993-4ac9-ae1c-f8db9d6378d6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c"
        }
      ]
    },
    {
      "bom-ref": "ba895a3d-d0db-4bb1-97eb-15a9bcde9e57",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c"
        }
      ]
    },
    {
      "bom-ref": "b2f6cb65-c3b1-45e0-8167-baddb8f17c7c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c"
        }
      ]
    },
    {
      "bom-ref": "69e89c44-43a5-4c94-b61d-83e1b2bed101",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c"
        }
      ]
    },
    {
      "bom-ref": "d2afbe0e-5a40-4abf-b790-42dc422744d3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c"
        }
      ]
    },
    {
      "bom-ref": "5dce6e3c-c12b-45a4-b43e-d0ff361f0872",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e08515ba-09cf-47c1-a794-3d3d9157cd2c"
        }
      ]
    },
    {
      "bom-ref": "dd470b3c-9e56-4b4a-b201-83c7acaa437f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e0202add-d435-424d-a381-bf7e699cde51"
        }
      ]
    },
    {
      "bom-ref": "3e8aa749-88e5-4a4d-b187-9eb0460033cd",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e0202add-d435-424d-a381-bf7e699cde51"
        }
      ]
    },
    {
      "bom-ref": "a5a7d086-c9e5-4572-913e-bd2ec034a00d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e0202add-d435-424d-a381-bf7e699cde51"
        }
      ]
    },
    {
      "bom-ref": "8accc46c-0137-420f-a204-1da5cfdfefbc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e0202add-d435-424d-a381-bf7e699cde51"
        }
      ]
    },
    {
      "bom-ref": "d79899fd-497e-4e20-b965-5373669a8b85",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e0202add-d435-424d-a381-bf7e699cde51"
        }
      ]
    },
    {
      "bom-ref": "e7d237bd-f1a8-49ac-9dac-7e5ba25d1d86",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e0202add-d435-424d-a381-bf7e699cde51"
        }
      ]
    },
    {
      "bom-ref": "dece352b-6da6-4cb5-aee7-56224bb62835",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e0ee0b1b-cc7f-442f-8179-0664f6517192"
        }
      ]
    },
    {
      "bom-ref": "4fe959e6-453a-4f2e-88d8-2fdf13f0e14c",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e199f85a-1424-43cd-b29e-e620347709cb"
        }
      ]
    },
    {
      "bom-ref": "99e8252e-af71-4c3f-a32a-388b62b5a40a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e157ef5d-1e26-4ac8-8a25-909a31f27708"
        }
      ]
    },
    {
      "bom-ref": "dfe491aa-dc4d-4f77-9e84-28951bf02bfc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d"
        }
      ]
    },
    {
      "bom-ref": "f062b7e7-aa5e-46d0-bf88-89f0190702ed",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d"
        }
      ]
    },
    {
      "bom-ref": "0d0e765b-530b-4046-9b7c-a64ff962f4fc",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d"
        }
      ]
    },
    {
      "bom-ref": "711ae061-1073-4c35-9026-567f14d81cc9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d"
        }
      ]
    },
    {
      "bom-ref": "6b466e86-10d4-44d0-a46f-ba7d960ea86f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d"
        }
      ]
    },
    {
      "bom-ref": "a9a8d25f-1d17-47c9-8363-544cdb3fc872",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "dd9728b0-adf5-4380-be4d-36363a8e7b2d"
        }
      ]
    },
    {
      "bom-ref": "1d7982af-12d6-41e8-abb0-774831800b32",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed"
        }
      ]
    },
    {
      "bom-ref": "d92b7359-8228-4408-9a75-7b9be475e56d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed"
        }
      ]
    },
    {
      "bom-ref": "019e7e60-5ead-4863-b198-e795f8fa4e47",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed"
        }
      ]
    },
    {
      "bom-ref": "c90e9b88-b06e-4074-8992-62ac099e5db5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed"
        }
      ]
    },
    {
      "bom-ref": "79a17619-00ff-417a-b844-231156c14bc4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed"
        }
      ]
    },
    {
      "bom-ref": "f527773a-977f-4800-abf7-86746ddf1015",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "de2c3649-47ce-41d0-8a35-18dee658d4ed"
        }
      ]
    },
    {
      "bom-ref": "3cf1e26c-6c47-4ad4-aff6-4eeabeee2dbc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a"
        }
      ]
    },
    {
      "bom-ref": "ba615684-862a-4789-810a-4e4160a5d04a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a"
        }
      ]
    },
    {
      "bom-ref": "8945a80d-eb82-44f8-b5fe-14303a0ab8b2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a"
        }
      ]
    },
    {
      "bom-ref": "3c8422b7-0ae6-4298-a85f-22ec715320d0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a"
        }
      ]
    },
    {
      "bom-ref": "0c812811-2c20-4113-9e7f-88350595bf8e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a"
        }
      ]
    },
    {
      "bom-ref": "fcdefc0e-0285-4f12-8f7a-97cdbb9ff3e7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "de3f8668-2cab-46da-b06d-7f2144a29e3a"
        }
      ]
    },
    {
      "bom-ref": "60835055-adfc-43af-91df-d7fbb6091fab",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e1b27813-8062-4294-8a33-5a294c8d3b30"
        }
      ]
    },
    {
      "bom-ref": "f66f05b9-74be-4ae0-92e4-d83da7285453",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e1e06893-88f8-40d1-98bb-a0e0052c0d7b"
        }
      ]
    },
    {
      "bom-ref": "7ac19ca9-e3ae-4b33-be6a-af65ec091b8b",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e36d5195-d17c-45c0-8d86-0a1680dcf17f"
        }
      ]
    },
    {
      "bom-ref": "47236387-0897-435f-b30b-90eb474ea027",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856"
        }
      ]
    },
    {
      "bom-ref": "fe1e270c-d4ab-4151-9619-40d9719d8168",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856"
        }
      ]
    },
    {
      "bom-ref": "707db0ac-8b46-4d3b-8c2f-3be21e39689f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856"
        }
      ]
    },
    {
      "bom-ref": "44a38097-f901-4630-9e99-4f7f3a3e3af9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856"
        }
      ]
    },
    {
      "bom-ref": "d9824274-71dd-4fed-8cb4-5f8b78be6dbb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856"
        }
      ]
    },
    {
      "bom-ref": "410d71b4-5853-4cc5-b833-8082241317ac",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e16f5f64-ddee-464e-a248-a1617fcaa856"
        }
      ]
    },
    {
      "bom-ref": "0b06d6ba-36b6-46fc-813c-91cf41352010",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd"
        }
      ]
    },
    {
      "bom-ref": "d5a0b269-cb6e-4038-8b69-c033eede9e10",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd"
        }
      ]
    },
    {
      "bom-ref": "59541d7d-6ec5-47c8-9659-95dd21051262",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd"
        }
      ]
    },
    {
      "bom-ref": "f7ab79f7-72b7-4723-be49-836180bdc2d5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd"
        }
      ]
    },
    {
      "bom-ref": "0135651b-87d7-4544-83db-c68dd19445ac",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd"
        }
      ]
    },
    {
      "bom-ref": "5027a0aa-90cd-4492-a00a-d979d293dc2e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "df26774b-3d75-4db3-a2a4-a31a966e67dd"
        }
      ]
    },
    {
      "bom-ref": "1817c8a6-a0d0-45b3-8522-7ef6cc5c4799",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15"
        }
      ]
    },
    {
      "bom-ref": "ff3bc0bf-3fc4-456e-886a-5f37797a7259",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15"
        }
      ]
    },
    {
      "bom-ref": "62dc7ef0-bfcf-4472-98d2-885b050d1596",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15"
        }
      ]
    },
    {
      "bom-ref": "db523d33-31c4-4669-96e8-e9364e72c363",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15"
        }
      ]
    },
    {
      "bom-ref": "039e709d-aa0b-45eb-bda6-a6957bf312ff",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15"
        }
      ]
    },
    {
      "bom-ref": "639b54c4-ca42-4654-bf9e-7671337d2dfd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "df7400a9-1152-40f6-9cfc-9584c1d90b15"
        }
      ]
    },
    {
      "bom-ref": "13248dfb-1441-4e1a-885e-b0175a8f75b6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37"
        }
      ]
    },
    {
      "bom-ref": "7bc29e27-8acd-4d42-be0d-b435211e00a3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37"
        }
      ]
    },
    {
      "bom-ref": "b160fa20-2d45-46dc-91f7-adbff3df3ee3",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37"
        }
      ]
    },
    {
      "bom-ref": "6f0198fd-5d36-4260-b0d1-ab3558fbc7aa",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37"
        }
      ]
    },
    {
      "bom-ref": "6b101093-c0b8-4fce-9256-6660b799559a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37"
        }
      ]
    },
    {
      "bom-ref": "10c8cf74-0011-4254-bd89-1e8656de724c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e1cd5ec3-221b-42c2-b46d-8b15aaba2d37"
        }
      ]
    },
    {
      "bom-ref": "6e6a25e1-73e8-4641-b015-e39d3f1cf755",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "e4fbfb3d-c934-4971-9fae-f89b6c9d73b4"
        }
      ]
    },
    {
      "bom-ref": "4ce1a95c-421b-4142-9e28-8a040672e341",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc"
        }
      ]
    },
    {
      "bom-ref": "acdfd620-2663-4746-a96a-b980f31e53fa",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc"
        }
      ]
    },
    {
      "bom-ref": "47ecea2c-cb39-411f-98bb-46d43ee57b73",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc"
        }
      ]
    },
    {
      "bom-ref": "9d7a556b-62ab-4d23-8813-611909daffe7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc"
        }
      ]
    },
    {
      "bom-ref": "341d9efb-fa2c-40a5-bad3-47ab49865fa3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc"
        }
      ]
    },
    {
      "bom-ref": "a38f66a8-f88b-46b1-a764-7ba9f71446ca",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e04de3fe-85eb-4214-8968-0d5aa67848dc"
        }
      ]
    },
    {
      "bom-ref": "d4030ee2-f8ca-4d5b-8635-2efc22f16cd9",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e0b556f5-9711-47b6-a945-63abbd79e839"
        }
      ]
    },
    {
      "bom-ref": "0ddd4f20-18b2-4176-8c6d-faed701355ec",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e0b556f5-9711-47b6-a945-63abbd79e839"
        }
      ]
    },
    {
      "bom-ref": "a46b1785-ba9a-40fe-a03b-8945f2bd298f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e0b556f5-9711-47b6-a945-63abbd79e839"
        }
      ]
    },
    {
      "bom-ref": "691eb0fc-b695-4263-a705-89f7bc98277a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e0b556f5-9711-47b6-a945-63abbd79e839"
        }
      ]
    },
    {
      "bom-ref": "5578217e-7fe3-4d68-a37a-dcd37d6cd529",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e0b556f5-9711-47b6-a945-63abbd79e839"
        }
      ]
    },
    {
      "bom-ref": "320ca41a-5e20-47e2-8371-e5a0ae0acbe8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e0b556f5-9711-47b6-a945-63abbd79e839"
        }
      ]
    },
    {
      "bom-ref": "ddf0da5e-c870-43c7-ab33-ba4970a715c2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49"
        }
      ]
    },
    {
      "bom-ref": "8381a052-7f9f-4257-9c97-67096c0f8b62",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49"
        }
      ]
    },
    {
      "bom-ref": "4a7ecb0f-5d4b-4cbd-be7c-a0366059002c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49"
        }
      ]
    },
    {
      "bom-ref": "2ad757a6-fa7f-4b67-a400-350ecf7a129f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49"
        }
      ]
    },
    {
      "bom-ref": "6fd14934-9f25-42e8-b2c8-6bd205630190",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49"
        }
      ]
    },
    {
      "bom-ref": "7076ec3e-1f16-4aa5-98af-94b71a909735",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e0c49ab0-0595-4b4a-8256-420ff255ec49"
        }
      ]
    },
    {
      "bom-ref": "24195c5b-8a36-4cde-be6a-4fa2dc78fd03",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e0e06851-781f-4998-a975-813b6287c485"
        }
      ]
    },
    {
      "bom-ref": "b9f6ab04-a060-4be0-a558-bfbb23bf341d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e0e06851-781f-4998-a975-813b6287c485"
        }
      ]
    },
    {
      "bom-ref": "61991f72-c854-4f44-b02e-3a0d80f7df2a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e0e06851-781f-4998-a975-813b6287c485"
        }
      ]
    },
    {
      "bom-ref": "fdc151af-b735-48a4-ac75-4a6ba16616d7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e0e06851-781f-4998-a975-813b6287c485"
        }
      ]
    },
    {
      "bom-ref": "a1ee5c28-7fa1-430a-a1c9-124c4d21326e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e0e06851-781f-4998-a975-813b6287c485"
        }
      ]
    },
    {
      "bom-ref": "6b5d462b-9e00-4edd-a640-17b23d2ead6a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e0e06851-781f-4998-a975-813b6287c485"
        }
      ]
    },
    {
      "bom-ref": "f38b0d6f-0bc7-40ed-b199-b4ad86d642ec",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "eb13fa3c-118f-47a3-9671-ab52c025e8a7"
        }
      ]
    },
    {
      "bom-ref": "69657e22-dbf2-48af-9262-475e0dce15b6",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "eb4b5ddd-b298-48fa-8263-0467700610b0"
        }
      ]
    },
    {
      "bom-ref": "acffb098-6095-48c5-a483-e2a02f196535",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "fd5ee7d4-97c1-4fbe-bf76-1a0d95c7575a",
      "id": "CVE-2023-4408",
      "description": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "004ffe47-d8b4-413c-8645-e6e60dad70cb",
      "id": "CVE-2024-12705",
      "description": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "21b1cc48-21c0-40b6-b43d-144196baae96",
      "id": "CVE-2023-5517",
      "description": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect \u003cdomain\u003e;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "145d5376-8262-4929-b2c5-8732b9acf0a7",
      "id": "CVE-2023-5679",
      "description": "A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "f3678444-63f0-4d89-b712-387e534a7a17",
      "id": "CVE-2023-5680",
      "description": "If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. \nThis issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "479d1260-6bc1-4af9-b282-21bb3214bbcb",
      "id": "CVE-2024-0760",
      "description": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "866caf76-9990-485f-b058-954cd3ec5a58",
      "id": "CVE-2024-11187",
      "description": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "3ef57481-565d-4ee9-b45e-f3bc0a2d30a6",
      "id": "CVE-2025-21664",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: make get_first_thin use rcu-safe list first function\n\nThe documentation in rculist.h explains the absence of list_empty_rcu()\nand cautions programmers against relying on a list_empty() -\u003e\nlist_first() sequence in RCU safe code.  This is because each of these\nfunctions performs its own READ_ONCE() of the list head.  This can lead\nto a situation where the list_empty() sees a valid list entry, but the\nsubsequent list_first() sees a different view of list head state after a\nmodification.\n\nIn the case of dm-thin, this author had a production box crash from a GP\nfault in the process_deferred_bios path.  This function saw a valid list\nhead in get_first_thin() but when it subsequently dereferenced that and\nturned it into a thin_c, it got the inside of the struct pool, since the\nlist was now empty and referring to itself.  The kernel on which this\noccurred printed both a warning about a refcount_t being saturated, and\na UBSAN error for an out-of-bounds cpuid access in the queued spinlock,\nprior to the fault itself.  When the resulting kdump was examined, it\nwas possible to see another thread patiently waiting in thin_dtr's\nsynchronize_rcu.\n\nThe thin_dtr call managed to pull the thin_c out of the active thins\nlist (and have it be the last entry in the active_thins list) at just\nthe wrong moment which lead to this crash.\n\nFortunately, the fix here is straight forward.  Switch get_first_thin()\nfunction to use list_first_or_null_rcu() which performs just a single\nREAD_ONCE() and returns NULL if the list is already empty.\n\nThis was run against the devicemapper test suite's thin-provisioning\nsuites for delete and suspend and no regressions were observed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7dbe9cab-f0dc-4de3-aebb-4ab25a5043c1",
      "id": "CVE-2024-1737",
      "description": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "b0ca76b8-155b-484d-9621-25ff4a4bf99c",
      "id": "CVE-2024-1975",
      "description": "If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "155332d6-ed75-4a4c-81cb-e93e986ed9e1",
      "id": "CVE-2024-4076",
      "description": "Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "b0583220-0b40-4b3a-bcf6-f5a73ed75eb9",
      "id": "CVE-2025-40776",
      "description": "A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "8662aa86-4127-45b6-8c03-24a52e39bac9",
      "id": "CVE-2025-40778",
      "description": "Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "d67800cf-e173-4cd4-814b-f24f62a66da8",
      "id": "CVE-2024-38608",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix netif state handling\n\nmlx5e_suspend cleans resources only if netif_device_present() returns\ntrue. However, mlx5e_resume changes the state of netif, via\nmlx5e_nic_enable, only if reg_state == NETREG_REGISTERED.\nIn the below case, the above leads to NULL-ptr Oops[1] and memory\nleaks:\n\nmlx5e_probe\n _mlx5e_resume\n  mlx5e_attach_netdev\n   mlx5e_nic_enable  \u003c-- netdev not reg, not calling netif_device_attach()\n  register_netdev \u003c-- failed for some reason.\nERROR_FLOW:\n _mlx5e_suspend \u003c-- netif_device_present return false, resources aren't freed :(\n\nHence, clean resources in this case as well.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: 0010 [#1] SMP\nCPU: 2 PID: 9345 Comm: test-ovs-ct-gen Not tainted 6.5.0_for_upstream_min_debug_2023_09_05_16_01 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at0xffffffffffffffd6.\nRSP: 0018:ffff888178aaf758 EFLAGS: 00010246\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x20/0x60\n ? page_fault_oops+0x14c/0x3c0\n ? exc_page_fault+0x75/0x140\n ? asm_exc_page_fault+0x22/0x30\n notifier_call_chain+0x35/0xb0\n blocking_notifier_call_chain+0x3d/0x60\n mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core]\n mlx5_core_uplink_netdev_event_replay+0x3e/0x60 [mlx5_core]\n mlx5_mdev_netdev_track+0x53/0x60 [mlx5_ib]\n mlx5_ib_roce_init+0xc3/0x340 [mlx5_ib]\n __mlx5_ib_add+0x34/0xd0 [mlx5_ib]\n mlx5r_probe+0xe1/0x210 [mlx5_ib]\n ? auxiliary_match_id+0x6a/0x90\n auxiliary_bus_probe+0x38/0x80\n ? driver_sysfs_add+0x51/0x80\n really_probe+0xc9/0x3e0\n ? driver_probe_device+0x90/0x90\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x1e/0x90\n __device_attach_driver+0x7d/0x100\n bus_for_each_drv+0x80/0xd0\n __device_attach+0xbc/0x1f0\n bus_probe_device+0x86/0xa0\n device_add+0x637/0x840\n __auxiliary_device_add+0x3b/0xa0\n add_adev+0xc9/0x140 [mlx5_core]\n mlx5_rescan_drivers_locked+0x22a/0x310 [mlx5_core]\n mlx5_register_device+0x53/0xa0 [mlx5_core]\n mlx5_init_one_devl_locked+0x5c4/0x9c0 [mlx5_core]\n mlx5_init_one+0x3b/0x60 [mlx5_core]\n probe_one+0x44c/0x730 [mlx5_core]\n local_pci_probe+0x3e/0x90\n pci_device_probe+0xbf/0x210\n ? kernfs_create_link+0x5d/0xa0\n ? sysfs_do_create_link_sd+0x60/0xc0\n really_probe+0xc9/0x3e0\n ? driver_probe_device+0x90/0x90\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x1e/0x90\n __device_attach_driver+0x7d/0x100\n bus_for_each_drv+0x80/0xd0\n __device_attach+0xbc/0x1f0\n pci_bus_add_device+0x54/0x80\n pci_iov_add_virtfn+0x2e6/0x320\n sriov_enable+0x208/0x420\n mlx5_core_sriov_configure+0x9e/0x200 [mlx5_core]\n sriov_numvfs_store+0xae/0x1a0\n kernfs_fop_write_iter+0x10c/0x1a0\n vfs_write+0x291/0x3c0\n ksys_write+0x5f/0xe0\n do_syscall_64+0x3d/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n CR2: 0000000000000000\n ---[ end trace 0000000000000000  ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6abe5b0f-8e4f-43e5-bbd5-b67e1bb328e2",
      "id": "CVE-2024-39474",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\n\ncommit a421ef303008 (\"mm: allow !GFP_KERNEL allocations for kvmalloc\")\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\ndd544141b9eb (\"vmalloc: back off when the current task is OOM-killed\").  A\npossible scenario is as follows:\n\nprocess-a\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\n    __vmalloc_area_node()\n        vm_area_alloc_pages()\n\t\t--\u003e oom-killer send SIGKILL to process-a\n        if (fatal_signal_pending(current)) break;\n--\u003e return NULL;\n\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\nif __GFP_NOFAIL set.\n\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\n-\u003e oom-killer sends signal to process\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\n\n[65731.259685] [T32454] Call trace:\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\n[65731.259734] [T32454]  show_stack+0x18/0x24\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\n[65731.259781] [T32454]  dump_stack+0x18/0x38\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\n[65731.260047] [T32454]  notify_die+0x114/0x198\n[65731.260073] [T32454]  die+0xf4/0x5b4\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\n\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\n--\u003e be-\u003edecompressed_pages = kvcalloc(be-\u003enr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\n\tkernel panic by NULL pointer dereference.\n\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\n[65731.260339] [T32454]  read_pages+0x170/0xadc\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\n[65731.260509] [T32454]  el0_da+0x44/0x94\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69a89623-192d-4f53-92a1-e9cca4724c67",
      "id": "CVE-2024-41000",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock/ioctl: prefer different overflow check\n\nRunning syzkaller with the newly reintroduced signed integer overflow\nsanitizer shows this report:\n\n[   62.982337] ------------[ cut here ]------------\n[   62.985692] cgroup: Invalid name\n[   62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46\n[   62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1\n[   62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long'\n[   62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1\n[   62.999369] random: crng reseeded on system resumption\n[   63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000)\n[   63.000668] CPU: 0 PID: 7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1\n[   63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   63.000682] Call Trace:\n[   63.000686]  \u003cTASK\u003e\n[   63.000731]  dump_stack_lvl+0x93/0xd0\n[   63.000919]  __get_user_pages+0x903/0xd30\n[   63.001030]  __gup_longterm_locked+0x153e/0x1ba0\n[   63.001041]  ? _raw_read_unlock_irqrestore+0x17/0x50\n[   63.001072]  ? try_get_folio+0x29c/0x2d0\n[   63.001083]  internal_get_user_pages_fast+0x1119/0x1530\n[   63.001109]  iov_iter_extract_pages+0x23b/0x580\n[   63.001206]  bio_iov_iter_get_pages+0x4de/0x1220\n[   63.001235]  iomap_dio_bio_iter+0x9b6/0x1410\n[   63.001297]  __iomap_dio_rw+0xab4/0x1810\n[   63.001316]  iomap_dio_rw+0x45/0xa0\n[   63.001328]  ext4_file_write_iter+0xdde/0x1390\n[   63.001372]  vfs_write+0x599/0xbd0\n[   63.001394]  ksys_write+0xc8/0x190\n[   63.001403]  do_syscall_64+0xd4/0x1b0\n[   63.001421]  ? arch_exit_to_user_mode_prepare+0x3a/0x60\n[   63.001479]  entry_SYSCALL_64_after_hwframe+0x6f/0x77\n[   63.001535] RIP: 0033:0x7f7fd3ebf539\n[   63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\n[   63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[   63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539\n[   63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004\n[   63.001595] RBP: 00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000\n[   63.001599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[   63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15: 00007ffd415ad2b8\n...\n[   63.018142] ---[ end trace ]---\n\nHistorically, the signed integer overflow sanitizer did not work in the\nkernel due to its interaction with `-fwrapv` but this has since been\nchanged [1] in the newest version of Clang; It was re-enabled in the\nkernel with Commit 557f8c582a9ba8ab (\"ubsan: Reintroduce signed overflow\nsanitizer\").\n\nLet's rework this overflow checking logic to not actually perform an\noverflow during the check itself, thus avoiding the UBSAN splat.\n\n[1]: https://github.com/llvm/llvm-project/pull/82432",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "caaf2709-7b21-4621-9f9c-3874ce45c325",
      "id": "CVE-2025-40780",
      "description": "In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "a1bc61e6-4b04-434b-a5ec-62963efa10bd",
      "id": "CVE-2025-8677",
      "description": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "1e71f910-d3bf-4276-bdc1-2d730385528a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ed5586b6-2176-4eba-9c63-a33fb8131adc"
        }
      ]
    },
    {
      "bom-ref": "17221948-f98b-45f1-a8a6-03bbe8321e10",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35"
        }
      ]
    },
    {
      "bom-ref": "7847e794-ff4c-4d2a-b6d0-ac522152125a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35"
        }
      ]
    },
    {
      "bom-ref": "681f5e01-db2c-43fb-9073-f8a0252b1137",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35"
        }
      ]
    },
    {
      "bom-ref": "948e0711-224b-483d-adcd-7d20ed95a2fc",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35"
        }
      ]
    },
    {
      "bom-ref": "a00de827-f49d-4768-9027-c7b554bd767e",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35"
        }
      ]
    },
    {
      "bom-ref": "17fa4647-27aa-45f3-bdba-33357a894562",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e83b1c9a-5072-49d1-9bf5-c2cb58cf7d35"
        }
      ]
    },
    {
      "bom-ref": "092682c7-3d65-40c8-bbc9-7a9176723d1f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ef7021a0-9d59-4a0a-92ec-24eac3e68b59"
        }
      ]
    },
    {
      "bom-ref": "0d6f8ddc-e406-4059-8530-325ec48c1832",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "ed269807-ec7b-4648-a1f8-9a8d8c2582fd"
        }
      ]
    },
    {
      "bom-ref": "58c4bb82-d068-4320-9a38-3979515cfcc4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ed269807-ec7b-4648-a1f8-9a8d8c2582fd"
        }
      ]
    },
    {
      "bom-ref": "8ae5c5c5-b34a-47e3-9c56-ee1dc1dbfece",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558"
        }
      ]
    },
    {
      "bom-ref": "1ec31a09-dee7-4d49-9bf6-bc84effac0c2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558"
        }
      ]
    },
    {
      "bom-ref": "7674ee71-986e-4544-a070-0c17537432ff",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558"
        }
      ]
    },
    {
      "bom-ref": "07dd972d-67b8-46bd-8252-01ff17cb9db9",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558"
        }
      ]
    },
    {
      "bom-ref": "6a89d8cd-868f-4cdc-bca2-7921cfa93b79",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558"
        }
      ]
    },
    {
      "bom-ref": "8fbfb4f2-262d-404c-ac50-e609279f9bc1",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e2702cd6-56ca-49b9-8c66-ed6e2aa5d558"
        }
      ]
    },
    {
      "bom-ref": "3a0c60a4-1009-4230-b8de-decb51e6bda6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e3589a2a-620f-476c-acef-4df35a53adb8"
        }
      ]
    },
    {
      "bom-ref": "7ae04f43-7940-49c7-8808-f37ee0ea298e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e3589a2a-620f-476c-acef-4df35a53adb8"
        }
      ]
    },
    {
      "bom-ref": "617fd1ae-e1d2-43e6-b7d8-4ff4f471677c",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e3589a2a-620f-476c-acef-4df35a53adb8"
        }
      ]
    },
    {
      "bom-ref": "4c2d2fa7-86ad-459e-b589-f4909e3b3d1b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e3589a2a-620f-476c-acef-4df35a53adb8"
        }
      ]
    },
    {
      "bom-ref": "51e7ffc7-edca-46e2-a04c-d5a506f6254d",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e3589a2a-620f-476c-acef-4df35a53adb8"
        }
      ]
    },
    {
      "bom-ref": "941131bd-67c3-4e9a-8a45-d2de6920c761",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e3589a2a-620f-476c-acef-4df35a53adb8"
        }
      ]
    },
    {
      "bom-ref": "5690aab6-bdda-4e4f-ba4e-96441a4689a8",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc"
        }
      ]
    },
    {
      "bom-ref": "f8ddffa0-463c-4e4c-be72-4dfeb49a1cde",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc"
        }
      ]
    },
    {
      "bom-ref": "45016377-ab88-45df-9866-3de92b25e622",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc"
        }
      ]
    },
    {
      "bom-ref": "9bf1a125-e683-432a-90f4-48becd2fe520",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc"
        }
      ]
    },
    {
      "bom-ref": "bf869743-2b24-437f-be93-bc56392d4113",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc"
        }
      ]
    },
    {
      "bom-ref": "eea54cf4-c868-4fdc-addb-be5f31ee6762",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e3836da5-c9ed-4aaf-bc54-54262146a9fc"
        }
      ]
    },
    {
      "bom-ref": "50d7459b-0579-4405-bafb-215964b95c4f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e424d27b-3524-4f98-9b24-108de83564ba"
        }
      ]
    },
    {
      "bom-ref": "369151ec-fda0-4236-bedb-2020d25b3242",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e424d27b-3524-4f98-9b24-108de83564ba"
        }
      ]
    },
    {
      "bom-ref": "b8ba53cb-890a-4015-950c-90ae6e9bca14",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e424d27b-3524-4f98-9b24-108de83564ba"
        }
      ]
    },
    {
      "bom-ref": "8ed997eb-7a77-49ad-a18f-dd32d2adbc10",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e424d27b-3524-4f98-9b24-108de83564ba"
        }
      ]
    },
    {
      "bom-ref": "af012446-d647-4c03-8d0e-b4ab19aff8c9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e424d27b-3524-4f98-9b24-108de83564ba"
        }
      ]
    },
    {
      "bom-ref": "b9522460-4d22-492f-b3f4-1501b81b5e4a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e424d27b-3524-4f98-9b24-108de83564ba"
        }
      ]
    },
    {
      "bom-ref": "6947fae9-7792-4084-b708-d7cb0c0546c6",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381"
        }
      ]
    },
    {
      "bom-ref": "004b0406-7ddb-46f7-b4b8-c2f7ed02846c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381"
        }
      ]
    },
    {
      "bom-ref": "b1f8b536-1191-4d51-9d9f-df050b8a70ad",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381"
        }
      ]
    },
    {
      "bom-ref": "564cd55f-ac95-4fe1-82b5-ec8b27297d0c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381"
        }
      ]
    },
    {
      "bom-ref": "ec976bc6-8bb9-4412-b639-d8ada174bcb3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381"
        }
      ]
    },
    {
      "bom-ref": "8a47c2f5-4856-47e9-836a-d0dbbb6ca8e7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ef60c25c-0064-4b95-b1c4-85eaf8091381"
        }
      ]
    },
    {
      "bom-ref": "1197cd1b-e0e5-429c-8df0-de60e2cd5ec5",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8"
        }
      ]
    },
    {
      "bom-ref": "e7e24775-11c2-4572-9738-f0cc4f9c1bb5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8"
        }
      ]
    },
    {
      "bom-ref": "b30aa7b9-0446-4318-ae46-203397b76bc6",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8"
        }
      ]
    },
    {
      "bom-ref": "180b4532-2293-4432-b230-0fcdbf9c97aa",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8"
        }
      ]
    },
    {
      "bom-ref": "034d6a6b-752c-4f6b-90e9-ad299629d133",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8"
        }
      ]
    },
    {
      "bom-ref": "b740babd-034f-4d47-a269-f352f0d95356",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e4d94f50-a0e7-4a62-a241-f1bc965f8fa8"
        }
      ]
    },
    {
      "bom-ref": "2d186e8a-626a-433c-ae05-baa4aa7f055e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88"
        }
      ]
    },
    {
      "bom-ref": "4a5fbed8-5a1c-4421-8e0a-d6d34237b9f5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88"
        }
      ]
    },
    {
      "bom-ref": "96976c97-e598-480d-a6e5-6d1c8436404f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88"
        }
      ]
    },
    {
      "bom-ref": "412ab2d6-3d5b-48e9-b276-c8948b8317b5",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88"
        }
      ]
    },
    {
      "bom-ref": "dea13878-9227-4dbc-93b4-7ced5c157686",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88"
        }
      ]
    },
    {
      "bom-ref": "9a3b2003-dffa-4598-9158-edd441a345c9",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e9e4a57d-12b9-4f4d-8115-b0111aa75b88"
        }
      ]
    },
    {
      "bom-ref": "d20f9229-258f-45ab-a6a5-34058233c037",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014"
        }
      ]
    },
    {
      "bom-ref": "cf10c155-41bc-4083-84ad-b7e3ce3a5276",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014"
        }
      ]
    },
    {
      "bom-ref": "c226b85a-6e3d-4fe0-85e6-c73b070734eb",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014"
        }
      ]
    },
    {
      "bom-ref": "f4b1fe6f-1371-4418-b5ab-0684bc0ea796",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014"
        }
      ]
    },
    {
      "bom-ref": "1a0d4abd-243a-4e4d-9145-ffbdfd70bd46",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014"
        }
      ]
    },
    {
      "bom-ref": "37e30c8c-baca-431c-a00d-f573b5d1b1fd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e38b6b2f-05f8-4384-9b1c-1bfac511a014"
        }
      ]
    },
    {
      "bom-ref": "a2713984-76bd-44eb-a611-f97f395aadaa",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3"
        }
      ]
    },
    {
      "bom-ref": "cd8c3652-8161-4b7f-ae2b-cc354b9be58b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3"
        }
      ]
    },
    {
      "bom-ref": "73493689-9e88-4b9c-ab27-89d067e9f6ef",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3"
        }
      ]
    },
    {
      "bom-ref": "5bf67ee6-2946-45ad-b204-5689aa472c10",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3"
        }
      ]
    },
    {
      "bom-ref": "c793b934-bbc7-49d0-b847-d351e01902ab",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3"
        }
      ]
    },
    {
      "bom-ref": "aa8c96af-8e4b-4f5c-99a7-061213d70380",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f0213a24-fc13-49d4-aa98-b7e53aaffdc3"
        }
      ]
    },
    {
      "bom-ref": "af4bcf47-eec0-4786-aee8-e14d66647162",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e7821334-9f92-4c55-b715-6ebe70115720"
        }
      ]
    },
    {
      "bom-ref": "57da4574-d616-40b6-927f-9d3c68a30977",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e7821334-9f92-4c55-b715-6ebe70115720"
        }
      ]
    },
    {
      "bom-ref": "5b7af1a6-91dc-428c-af2f-fe3a465ca78f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e7821334-9f92-4c55-b715-6ebe70115720"
        }
      ]
    },
    {
      "bom-ref": "86860cb9-4683-42b3-bd84-76cd2be07f57",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e7821334-9f92-4c55-b715-6ebe70115720"
        }
      ]
    },
    {
      "bom-ref": "a3bcee32-6e2a-4dad-9c65-7a26ce2ce083",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e7821334-9f92-4c55-b715-6ebe70115720"
        }
      ]
    },
    {
      "bom-ref": "d2e10628-2734-490b-9908-c5aac949d8ae",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e7821334-9f92-4c55-b715-6ebe70115720"
        }
      ]
    },
    {
      "bom-ref": "4353b1b6-1f04-4bc3-9180-1c30bec900d1",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f1c15227-653c-4937-bc2a-289b0bab098c"
        }
      ]
    },
    {
      "bom-ref": "8905d491-20d8-4595-9573-0946a11c4470",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f1035c27-7835-4881-ad46-fbcd259dcf36"
        }
      ]
    },
    {
      "bom-ref": "9ea87376-0ac4-4ca8-bdb9-4375177bf82c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c"
        }
      ]
    },
    {
      "bom-ref": "c66d048c-93b4-4c61-8f22-8dacffae4d0d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c"
        }
      ]
    },
    {
      "bom-ref": "73a1eb7c-d490-4575-933f-ccbc489376bb",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c"
        }
      ]
    },
    {
      "bom-ref": "9caa17fd-9761-49a6-afa1-b39b188134e0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c"
        }
      ]
    },
    {
      "bom-ref": "5f462510-e1c7-4656-883e-91da0cdc22d1",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c"
        }
      ]
    },
    {
      "bom-ref": "6090ce82-db5c-404c-98e7-d6250bc308a8",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ea126ced-35fa-4877-8cf0-a77111208b0c"
        }
      ]
    },
    {
      "bom-ref": "b0d755ee-5e38-4cf8-a57e-e30840f8859d",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2"
        }
      ]
    },
    {
      "bom-ref": "05fc1274-6aee-4661-a7c1-3b12f47827df",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2"
        }
      ]
    },
    {
      "bom-ref": "fa33575c-7297-4dcd-ab5b-9af5992551b2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2"
        }
      ]
    },
    {
      "bom-ref": "ad0a4c69-0f4d-43c8-bb9d-3f29b8cadd1c",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2"
        }
      ]
    },
    {
      "bom-ref": "39ff4c58-1b62-4864-964c-2ce698106926",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2"
        }
      ]
    },
    {
      "bom-ref": "dc081d53-f830-48f0-bc3e-383620847f55",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "e9ecf447-3c54-4eb5-805a-bb9354b5f1a2"
        }
      ]
    },
    {
      "bom-ref": "1eccd4d6-3345-4e1d-a521-08d80a7d833a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416"
        }
      ]
    },
    {
      "bom-ref": "c78cd131-7823-4aae-a48e-cce4497156a1",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416"
        }
      ]
    },
    {
      "bom-ref": "edcdaabc-4fc1-495d-8b69-e38231824328",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416"
        }
      ]
    },
    {
      "bom-ref": "e4dfe0b5-68a2-4faa-a63f-94df41b327f6",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416"
        }
      ]
    },
    {
      "bom-ref": "e5523d0c-00fa-4e86-ac31-7858830a8df8",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416"
        }
      ]
    },
    {
      "bom-ref": "14ae7a3b-8162-45d4-9514-9af50ce80c59",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f0fb2d37-23f8-42a7-9aaa-77a35a6aa416"
        }
      ]
    },
    {
      "bom-ref": "a836c018-71e3-498c-ae12-c9a60a99e05d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f11f4d54-d6d7-4811-b7d6-bbdb2500a7bc"
        }
      ]
    },
    {
      "bom-ref": "e5862992-ee72-46db-8d61-3ec667ca0f65",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7"
        }
      ]
    },
    {
      "bom-ref": "2ee30966-0326-43bc-8b56-6fcd026edf0d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7"
        }
      ]
    },
    {
      "bom-ref": "ac229f0a-ab17-4317-b457-d0de76ec7faf",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7"
        }
      ]
    },
    {
      "bom-ref": "7a0bfddb-4549-4081-aad6-bd6883f709bb",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7"
        }
      ]
    },
    {
      "bom-ref": "71ac5286-c99d-40f6-835b-77d3e0b9873b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7"
        }
      ]
    },
    {
      "bom-ref": "88b28272-742a-4e65-b5a6-d7353f9ad5c7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "eb20e045-eddc-41ff-b309-ca054af6b1a7"
        }
      ]
    },
    {
      "bom-ref": "b283ce2f-d89d-4635-8867-9583871d7f22",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f28c062e-5123-4412-a4d2-d68466eacdee"
        }
      ]
    },
    {
      "bom-ref": "b1d50f8b-faeb-4e6a-8972-b9717546efe7",
      "id": "CVE-2021-47441",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: thermal: Fix out-of-bounds memory accesses\n\nCurrently, mlxsw allows cooling states to be set above the maximum\ncooling state supported by the driver:\n\n # cat /sys/class/thermal/thermal_zone2/cdev0/type\n mlxsw_fan\n # cat /sys/class/thermal/thermal_zone2/cdev0/max_state\n 10\n # echo 18 \u003e /sys/class/thermal/thermal_zone2/cdev0/cur_state\n # echo $?\n 0\n\nThis results in out-of-bounds memory accesses when thermal state\ntransition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the\ntransition table is accessed with a too large index (state) [1].\n\nAccording to the thermal maintainer, it is the responsibility of the\ndriver to reject such operations [2].\n\nTherefore, return an error when the state to be set exceeds the maximum\ncooling state supported by the driver.\n\nTo avoid dead code, as suggested by the thermal maintainer [3],\npartially revert commit a421ce088ac8 (\"mlxsw: core: Extend cooling\ndevice with cooling levels\") that tried to interpret these invalid\ncooling states (above the maximum) in a special way. The cooling levels\narray is not removed in order to prevent the fans going below 20% PWM,\nwhich would cause them to get stuck at 0% PWM.\n\n[1]\nBUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290\nRead of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5\n\nCPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122\nHardware name: Mellanox Technologies Ltd. \"MSN2410-CB2FO\"/\"SA000874\", BIOS 4.6.5 03/08/2016\nWorkqueue: events_freezable_power_ thermal_zone_device_check\nCall Trace:\n dump_stack_lvl+0x8b/0xb3\n print_address_description.constprop.0+0x1f/0x140\n kasan_report.cold+0x7f/0x11b\n thermal_cooling_device_stats_update+0x271/0x290\n __thermal_cdev_update+0x15e/0x4e0\n thermal_cdev_update+0x9f/0xe0\n step_wise_throttle+0x770/0xee0\n thermal_zone_device_update+0x3f6/0xdf0\n process_one_work+0xa42/0x1770\n worker_thread+0x62f/0x13e0\n kthread+0x3ee/0x4e0\n ret_from_fork+0x1f/0x30\n\nAllocated by task 1:\n kasan_save_stack+0x1b/0x40\n __kasan_kmalloc+0x7c/0x90\n thermal_cooling_device_setup_sysfs+0x153/0x2c0\n __thermal_cooling_device_register.part.0+0x25b/0x9c0\n thermal_cooling_device_register+0xb3/0x100\n mlxsw_thermal_init+0x5c5/0x7e0\n __mlxsw_core_bus_device_register+0xcb3/0x19c0\n mlxsw_core_bus_device_register+0x56/0xb0\n mlxsw_pci_probe+0x54f/0x710\n local_pci_probe+0xc6/0x170\n pci_device_probe+0x2b2/0x4d0\n really_probe+0x293/0xd10\n __driver_probe_device+0x2af/0x440\n driver_probe_device+0x51/0x1e0\n __driver_attach+0x21b/0x530\n bus_for_each_dev+0x14c/0x1d0\n bus_add_driver+0x3ac/0x650\n driver_register+0x241/0x3d0\n mlxsw_sp_module_init+0xa2/0x174\n do_one_initcall+0xee/0x5f0\n kernel_init_freeable+0x45a/0x4de\n kernel_init+0x1f/0x210\n ret_from_fork+0x1f/0x30\n\nThe buggy address belongs to the object at ffff8881052f7800\n which belongs to the cache kmalloc-1k of size 1024\nThe buggy address is located 1016 bytes inside of\n 1024-byte region [ffff8881052f7800, ffff8881052f7c00)\nThe buggy address belongs to the page:\npage:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0\nhead:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x200000000010200(slab|head|node=0|zone=2)\nraw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0\nraw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                                                                ^\n ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\n[2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb2f98db-8f87-47c8-852c-4bca189af622",
      "id": "CVE-2023-4408",
      "description": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "67093a9d-f527-4c12-85e1-6c6a12ccd90c",
      "id": "CVE-2023-5517",
      "description": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect \u003cdomain\u003e;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "34e2da06-44bd-4e17-a53e-ef12aff7feca",
      "id": "CVE-2023-5679",
      "description": "A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "3b88578d-4057-4f11-8904-f318c3bb5b77",
      "id": "CVE-2023-5680",
      "description": "If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. \nThis issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "3716cec8-6b1e-4bc1-a6ff-2d70ae0eba79",
      "id": "CVE-2024-0760",
      "description": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "f4fd9ca9-8e3a-478c-af2b-32e60d95fdf8",
      "id": "CVE-2024-11187",
      "description": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "6f9167ec-3881-43d7-82c0-1714af199893",
      "id": "CVE-2024-12705",
      "description": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "2270d56b-8fee-4d0a-9376-d4700fbaef7b",
      "id": "CVE-2024-1737",
      "description": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "a9289774-0444-4c18-816d-e3dc8bd15144",
      "id": "CVE-2024-1975",
      "description": "If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "82be7fc7-8a81-4250-8806-84dba9dca9a9",
      "id": "CVE-2024-4076",
      "description": "Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "07fea236-a5c5-4e82-b9f2-df9fbda25470",
      "id": "CVE-2025-40776",
      "description": "A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "8aa479f9-3435-4a8b-a95c-773278b07471",
      "id": "CVE-2025-40778",
      "description": "Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "0fcebc59-a8c3-410d-b923-7c765daa2b4b",
      "id": "CVE-2025-40780",
      "description": "In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "211aa167-2929-4891-8213-f704b71ae7b1",
      "id": "CVE-2025-8677",
      "description": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "2304915f-0354-4598-a2de-d508a3ce865d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "8cdad1cd-dbba-4172-b0a2-62cb6b9efbbb",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "f26b46c0-97c4-4c0e-82af-892e5570e2af"
        }
      ]
    },
    {
      "bom-ref": "8755de46-d2c5-4e7a-8f78-7f05c2ff856f",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f2d9026d-2ff1-4f58-a679-6e973a28bd8a"
        }
      ]
    },
    {
      "bom-ref": "f5265467-983c-4f7f-b45c-afe8ef31cf6a",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f3b26259-c9de-405f-90c0-efa955b0bdd3"
        }
      ]
    },
    {
      "bom-ref": "104ed3a8-92f1-42e9-a3d6-d8fca4ed2aac",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568"
        }
      ]
    },
    {
      "bom-ref": "96fc578f-6c50-4d47-91f0-292c33370224",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568"
        }
      ]
    },
    {
      "bom-ref": "77d3060d-a7c9-4fd8-9eb3-0a678ac5af66",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568"
        }
      ]
    },
    {
      "bom-ref": "2cd6d4c8-4d33-4fc1-a5a6-ba8c7475e16d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568"
        }
      ]
    },
    {
      "bom-ref": "958cf485-f52b-489a-ae22-a58e4a02aad2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568"
        }
      ]
    },
    {
      "bom-ref": "6f24a7b2-9097-4cc9-9957-ac2a0d24de2b",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "edb79ed9-db2d-411e-8d0c-ca5d0df2d568"
        }
      ]
    },
    {
      "bom-ref": "6b636b94-d475-4490-a5ad-e8410d724104",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "0d5f4ac9-8065-49b0-baa5-0e58bb63ae06",
      "id": "CVE-2023-4408",
      "description": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "25d364be-6aae-410c-9361-f080a74338cb",
      "id": "CVE-2023-5517",
      "description": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect \u003cdomain\u003e;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "02ec480f-c938-46c9-9fbb-f1c489f74713",
      "id": "CVE-2023-5679",
      "description": "A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "ce60a2c4-4c7b-4a42-b31e-daebd455ff5b",
      "id": "CVE-2023-5680",
      "description": "If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. \nThis issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "bccedc39-ad42-4055-8074-4d5ecab44ef6",
      "id": "CVE-2024-0760",
      "description": "A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. \nThis issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "3691e311-ca13-4752-a57b-5101b0a54f8c",
      "id": "CVE-2024-11187",
      "description": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "efe87514-8dc9-46d2-a416-60e27187bf6e",
      "id": "CVE-2024-12705",
      "description": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "809f79c9-28e4-4aa2-bae0-8c91cc2a1c42",
      "id": "CVE-2024-1737",
      "description": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "c3a81b5d-a97b-426b-b1ca-6a8ec8bfe81f",
      "id": "CVE-2024-1975",
      "description": "If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "75a82aff-cd3c-421c-8780-26c23ddc5cfc",
      "id": "CVE-2024-4076",
      "description": "Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "7a6ee946-6b78-40cb-a37e-ea980fbf3f72",
      "id": "CVE-2025-40776",
      "description": "A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "cd038920-b7cb-452a-b725-5a43ee1d7406",
      "id": "CVE-2025-40778",
      "description": "Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "eff43474-6a04-41f2-bbfd-4311b054ca41",
      "id": "CVE-2025-40780",
      "description": "In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "d94f3192-1505-4998-b7e2-2f9db8a3e11c",
      "id": "CVE-2025-8677",
      "description": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "6aa140b3-815a-4f64-ab96-0fff12dfb7b6",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "f7224e46-7174-4145-8e10-4afad557280e"
        }
      ]
    },
    {
      "bom-ref": "3192d762-1158-45c5-8ddc-28873c6b21c4",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88"
        }
      ]
    },
    {
      "bom-ref": "9ad5d649-a4a2-4da6-aa14-d7f10683591c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88"
        }
      ]
    },
    {
      "bom-ref": "feb10918-344b-4418-9581-c55458348ce1",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88"
        }
      ]
    },
    {
      "bom-ref": "24877722-c62f-482e-a86b-cc5c58eedc5a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88"
        }
      ]
    },
    {
      "bom-ref": "c3406609-3483-4bec-8cdd-57c1379859c9",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88"
        }
      ]
    },
    {
      "bom-ref": "d22b977c-c68d-45f2-ab88-4ba28339cbad",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f05f97f1-4ccd-4a5c-99a1-115188fb5a88"
        }
      ]
    },
    {
      "bom-ref": "54de154a-9fcb-4dce-aedc-5372010ec62b",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0"
        }
      ]
    },
    {
      "bom-ref": "4a7e0c00-c7db-487e-beb7-a506468aff2e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0"
        }
      ]
    },
    {
      "bom-ref": "1be4905b-304f-4ad1-9e39-bc2d9249e8d9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0"
        }
      ]
    },
    {
      "bom-ref": "bbbc403d-82eb-47b9-8134-a930fbb990dd",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0"
        }
      ]
    },
    {
      "bom-ref": "1650aae9-7c07-4d18-bfaf-f276284da1f3",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0"
        }
      ]
    },
    {
      "bom-ref": "cd390996-3104-46f7-8e96-f0649cb7f9ec",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f061aadb-c55f-42e0-9d47-d2c0cae92bb0"
        }
      ]
    },
    {
      "bom-ref": "a4fa18bc-188a-4370-b0a2-0060afea8f3c",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235"
        }
      ]
    },
    {
      "bom-ref": "802be619-c144-4195-a32f-74ebcb0acf17",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235"
        }
      ]
    },
    {
      "bom-ref": "e23ff677-1471-41e9-9f15-7620345b362b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235"
        }
      ]
    },
    {
      "bom-ref": "c53505e2-56b1-4b72-a00d-a6a1bd033eae",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235"
        }
      ]
    },
    {
      "bom-ref": "f3452459-d036-48a0-a242-d35384e72cb6",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235"
        }
      ]
    },
    {
      "bom-ref": "dde58c88-081e-4e7d-a78b-b59638280dae",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f1866f89-fc5b-4ef8-b6ca-c94e34278235"
        }
      ]
    },
    {
      "bom-ref": "85733a30-96b3-4589-9c20-9b53fbb1127f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca"
        }
      ]
    },
    {
      "bom-ref": "a8a8cd7d-b8cb-4d3c-8acc-6741bd1bc7b3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca"
        }
      ]
    },
    {
      "bom-ref": "1a7d8fca-c073-4d1c-a704-573dd69531ba",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca"
        }
      ]
    },
    {
      "bom-ref": "1efa97a4-60e8-4df6-8fa4-48654a21f63a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca"
        }
      ]
    },
    {
      "bom-ref": "5e19cee6-b723-4319-ad2f-532a5926ae1b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca"
        }
      ]
    },
    {
      "bom-ref": "e1210e85-bd9a-4f5b-bd7b-5a74e85b9ee6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f0dea834-5373-42c9-876c-d1c1c4bfddca"
        }
      ]
    },
    {
      "bom-ref": "7b1a9ddc-6d6a-4c56-962d-9f74cf36ed6f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56"
        }
      ]
    },
    {
      "bom-ref": "a404d36c-eec9-4669-9c5f-2ab0c41a4294",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56"
        }
      ]
    },
    {
      "bom-ref": "b5b1cb36-67aa-4525-999c-7340cd1d2c3e",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56"
        }
      ]
    },
    {
      "bom-ref": "7eb01e59-9780-4067-8b51-5dc5cd8f401a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56"
        }
      ]
    },
    {
      "bom-ref": "3e64f16a-5e8c-40e1-8bae-642e6d1f0a8f",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56"
        }
      ]
    },
    {
      "bom-ref": "1be09004-c26d-4122-8fb7-4eabbbd8234d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f0cb8d34-995d-4bf7-ad42-d8cabfff0a56"
        }
      ]
    },
    {
      "bom-ref": "027523ed-b810-4b7c-9c13-f31b16d20ae0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc"
        }
      ]
    },
    {
      "bom-ref": "c37bacfd-8a97-45c5-8f0a-97785086754a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc"
        }
      ]
    },
    {
      "bom-ref": "87e5ea94-2a15-4f61-9bf1-c873ff1bfc92",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc"
        }
      ]
    },
    {
      "bom-ref": "895ab0b3-419c-4a0c-9b4a-03d5e33fd98a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc"
        }
      ]
    },
    {
      "bom-ref": "6791729e-81f4-4d26-927a-f1796c24ef4a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc"
        }
      ]
    },
    {
      "bom-ref": "6eb332fb-4ccd-4a54-b92d-9745915ba9fd",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fa527c66-dc6d-422c-8f26-d9026896f9fc"
        }
      ]
    },
    {
      "bom-ref": "a887eacb-38ae-4845-84d9-2c02d399c85f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4"
        }
      ]
    },
    {
      "bom-ref": "f3765289-c735-4091-9d5f-a1926cddf1f3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4"
        }
      ]
    },
    {
      "bom-ref": "e4c7b322-2cb3-4711-8150-5f3f1d6c7884",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4"
        }
      ]
    },
    {
      "bom-ref": "6b11509c-d6d9-4346-8f1e-88c2892d4ab0",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4"
        }
      ]
    },
    {
      "bom-ref": "e5bcfe47-5b35-4998-a415-2e1d6bd97915",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4"
        }
      ]
    },
    {
      "bom-ref": "1ae4229b-89db-40d5-9126-3ca418bee70d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f2193013-094f-4b9a-a7bf-16335acb7ce4"
        }
      ]
    },
    {
      "bom-ref": "80b3e27f-8026-4382-9cee-394b19ba76d3",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "fd390e27-b595-4d6d-94d6-8048270fb10e"
        }
      ]
    },
    {
      "bom-ref": "bd88c108-03e4-487f-be3b-07da1cd7b628",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6"
        }
      ]
    },
    {
      "bom-ref": "c93e7851-7592-46f1-8ae0-488baead4b3a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6"
        }
      ]
    },
    {
      "bom-ref": "8a3ece8d-a56c-479b-85e9-61f0119b61b2",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6"
        }
      ]
    },
    {
      "bom-ref": "5df69104-b7fc-48b0-8c93-c68d2c6f0af7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6"
        }
      ]
    },
    {
      "bom-ref": "4289963b-24dd-4bcc-83d1-4984ad219008",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6"
        }
      ]
    },
    {
      "bom-ref": "b07a4bd5-6e77-46c1-9036-20cee17a8b5c",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f5b7e260-4046-479b-879f-011ceb3cb7f6"
        }
      ]
    },
    {
      "bom-ref": "14eea9ed-7934-415c-9ce5-a01f94cd64dd",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f19db424-574e-4e8b-8cce-a752bd13c089"
        }
      ]
    },
    {
      "bom-ref": "97cb61a1-4355-4102-9b21-66081eb777a2",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f19db424-574e-4e8b-8cce-a752bd13c089"
        }
      ]
    },
    {
      "bom-ref": "96da8f6a-7f18-4682-90de-a9765341b140",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f19db424-574e-4e8b-8cce-a752bd13c089"
        }
      ]
    },
    {
      "bom-ref": "07a3816c-e0be-4b3d-913d-fd3629b418e4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f19db424-574e-4e8b-8cce-a752bd13c089"
        }
      ]
    },
    {
      "bom-ref": "156a52bc-4c7c-4fd0-ab0a-777a40994f17",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f19db424-574e-4e8b-8cce-a752bd13c089"
        }
      ]
    },
    {
      "bom-ref": "42838e31-d978-47ae-bd0e-021c8618788e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f19db424-574e-4e8b-8cce-a752bd13c089"
        }
      ]
    },
    {
      "bom-ref": "413e6ef7-0cd7-4317-8a24-4334cacfa6b2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5"
        }
      ]
    },
    {
      "bom-ref": "c7cdadf7-ca2c-486b-babc-d120e783761c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5"
        }
      ]
    },
    {
      "bom-ref": "35f8df72-b188-44bf-b3b8-e7556850f593",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5"
        }
      ]
    },
    {
      "bom-ref": "cb4869e0-abcf-480a-b1bb-f17e8ff82d4d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5"
        }
      ]
    },
    {
      "bom-ref": "833fd067-17df-4c89-80ac-9e93943808ea",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5"
        }
      ]
    },
    {
      "bom-ref": "67d79862-99fe-4838-a716-778013c7d8c7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f3c72fcd-048f-4d71-b869-16ea3807e9f5"
        }
      ]
    },
    {
      "bom-ref": "ccd2c5f4-aba8-40cf-8378-caf0d3d31ef9",
      "id": "CVE-2007-2768",
      "description": "OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "83d71681-3c3c-456d-a193-cbe21350ffc6",
      "id": "CVE-2008-3844",
      "description": "Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known.",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "d7be259e-374a-4fc2-8be2-b46cd87b2091",
      "id": "CVE-2023-51767",
      "description": "OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "d91f7bf5-d443-45e3-abcf-5653f7e56555",
      "id": "CVE-2025-26466",
      "description": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "4408bc93-2e09-4680-a25b-f74702dc492d",
      "id": "CVE-2025-32728",
      "description": "In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "3da4aaf8-7ea5-459f-ac9b-4a8149a9dabe",
      "id": "CVE-2025-61984",
      "description": "ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "cffaccc1-977d-4f37-a337-f3cb834c405e",
      "id": "CVE-2025-61985",
      "description": "ssh in OpenSSH before 10.1 allows the '\\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "43974971-f8f2-42b7-bb40-4d5d13fc5b3d",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "f99749b0-7588-45a8-8b83-29b636561732"
        }
      ]
    },
    {
      "bom-ref": "25d57f23-f7a8-4134-a5b9-266c64628ce0",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d"
        }
      ]
    },
    {
      "bom-ref": "e70f3af1-920c-4568-add9-79bf2caac8de",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d"
        }
      ]
    },
    {
      "bom-ref": "6cdf9be5-e65f-4694-894b-2663578fef07",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d"
        }
      ]
    },
    {
      "bom-ref": "fb549d20-0204-402f-ae29-c587cd566929",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d"
        }
      ]
    },
    {
      "bom-ref": "ccfb77c7-b158-4853-bab3-ef7134b7aa53",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d"
        }
      ]
    },
    {
      "bom-ref": "0d489e5d-1d17-404c-a612-924a1b1694ec",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fd5e68e1-a061-4f5b-bc5f-1017194bff9d"
        }
      ]
    },
    {
      "bom-ref": "e78aa422-9297-4798-81fb-274bdd36179a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f4a76330-86e1-408d-9f00-081174fac482"
        }
      ]
    },
    {
      "bom-ref": "367827f7-b4ee-46dd-a36a-c429e2d679e3",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f4a76330-86e1-408d-9f00-081174fac482"
        }
      ]
    },
    {
      "bom-ref": "d2b68746-de39-4674-b3b8-615de565b1d7",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f4a76330-86e1-408d-9f00-081174fac482"
        }
      ]
    },
    {
      "bom-ref": "4f975f6f-d213-4f6c-b63e-880bb85863c7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f4a76330-86e1-408d-9f00-081174fac482"
        }
      ]
    },
    {
      "bom-ref": "0392f5f2-d9f7-43f9-81bc-e9b2d7d09ffe",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f4a76330-86e1-408d-9f00-081174fac482"
        }
      ]
    },
    {
      "bom-ref": "31ebd3ff-376d-4448-a7ae-9a4469a00d52",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f4a76330-86e1-408d-9f00-081174fac482"
        }
      ]
    },
    {
      "bom-ref": "303e4ead-16fd-4961-bfcf-88c04c0a9d71",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "ff45a565-b989-41c9-ba42-88ec32386aeb"
        }
      ]
    },
    {
      "bom-ref": "34ed67e7-4d4b-4cc8-b2c9-acd5e196ef5e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e"
        }
      ]
    },
    {
      "bom-ref": "15bad095-a79d-44dd-8596-0db7f5518e44",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e"
        }
      ]
    },
    {
      "bom-ref": "9ddef3fd-d495-4beb-b7ef-b1e9fef95e5b",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e"
        }
      ]
    },
    {
      "bom-ref": "d3fcac4d-27a0-4ded-8736-7574b560d466",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e"
        }
      ]
    },
    {
      "bom-ref": "9d84ec88-5ad0-4638-9fb8-1c367c353827",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e"
        }
      ]
    },
    {
      "bom-ref": "6474682c-8715-4d17-a4fd-a9863bce05ad",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fea33f75-989c-4e39-b15e-bd15bb12e60e"
        }
      ]
    },
    {
      "bom-ref": "c2498c28-bf19-41f1-aa9a-74e04ac8301a",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be"
        }
      ]
    },
    {
      "bom-ref": "71975584-40eb-4ea2-82ce-a4a19c897f4e",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be"
        }
      ]
    },
    {
      "bom-ref": "a3d80d42-31a6-482b-9da1-9e80361055f5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be"
        }
      ]
    },
    {
      "bom-ref": "aa3ab7b2-efa5-486a-91d2-655b9f64c4fe",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be"
        }
      ]
    },
    {
      "bom-ref": "f2e8a718-ad42-4048-86eb-8a1b7a33a6da",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be"
        }
      ]
    },
    {
      "bom-ref": "8c6a2fe2-e082-4c6d-b831-f7c0affa97b6",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fc0fd10f-41fe-4ba7-a0ad-5a2ea0e408be"
        }
      ]
    },
    {
      "bom-ref": "9453b3c7-7971-401f-af1e-164ac753dcaa",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7"
        }
      ]
    },
    {
      "bom-ref": "bcae2b3a-8141-434a-abf8-c6d6f98eee92",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7"
        }
      ]
    },
    {
      "bom-ref": "e560c088-4690-4daf-bff3-35409dca7db9",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7"
        }
      ]
    },
    {
      "bom-ref": "47c81b82-ac8a-4ee8-a444-e44b110a715a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7"
        }
      ]
    },
    {
      "bom-ref": "f33a03a5-28d3-48d7-922c-7b454f87f88a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7"
        }
      ]
    },
    {
      "bom-ref": "f980bccb-905d-411f-a155-01e4d6d3e24d",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f68877a8-233f-47cc-a6da-8f11f60a29a7"
        }
      ]
    },
    {
      "bom-ref": "0d3800c4-9542-4513-bb64-b95e7723217e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f732f606-5f46-4d40-93e7-42f347748c34"
        }
      ]
    },
    {
      "bom-ref": "b7c95e11-3439-46c2-be98-ad97dd570728",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f732f606-5f46-4d40-93e7-42f347748c34"
        }
      ]
    },
    {
      "bom-ref": "34382a22-3dcf-4461-9c51-a5326288dc1f",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f732f606-5f46-4d40-93e7-42f347748c34"
        }
      ]
    },
    {
      "bom-ref": "1471d1a9-fca0-4e5d-986a-90c39ea08807",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f732f606-5f46-4d40-93e7-42f347748c34"
        }
      ]
    },
    {
      "bom-ref": "ab672d19-99f8-4f68-999d-f732431f1418",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f732f606-5f46-4d40-93e7-42f347748c34"
        }
      ]
    },
    {
      "bom-ref": "6ab8d099-0fd7-4d91-9019-eaa78fc06d01",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f732f606-5f46-4d40-93e7-42f347748c34"
        }
      ]
    },
    {
      "bom-ref": "7020f7ba-d3c9-4610-b070-ad8c9d2e9bdb",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86"
        }
      ]
    },
    {
      "bom-ref": "1ae06e2c-94b7-4b54-a856-48a7f53c61a5",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86"
        }
      ]
    },
    {
      "bom-ref": "59451ad4-57da-48e7-a306-71e8088e25da",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86"
        }
      ]
    },
    {
      "bom-ref": "99360df3-5bd6-43dd-8454-3956638d340b",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86"
        }
      ]
    },
    {
      "bom-ref": "2191927d-b80e-4cba-8774-a7fd8698dd86",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86"
        }
      ]
    },
    {
      "bom-ref": "03960b11-5312-4c9d-b2fd-f6bef96f6960",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "f87e4e89-6583-4064-89c8-d30462cfbf86"
        }
      ]
    },
    {
      "bom-ref": "0b05fd12-fff4-4455-b800-decdb01b068e",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975"
        }
      ]
    },
    {
      "bom-ref": "260d312b-6b67-497a-9ec8-0d61d85dd987",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975"
        }
      ]
    },
    {
      "bom-ref": "ea7419b3-bea6-49f4-83cf-3d6051a09fd8",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975"
        }
      ]
    },
    {
      "bom-ref": "e7327fd7-9596-4aa7-9cad-535337bd43fb",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975"
        }
      ]
    },
    {
      "bom-ref": "02f9c9b9-cf0d-4aaa-a13f-d145420d5fc2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975"
        }
      ]
    },
    {
      "bom-ref": "e5b48a64-9a75-42ed-9273-25b8ffa91483",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fa802a89-62fc-40b2-bd51-b8d2f77dc975"
        }
      ]
    },
    {
      "bom-ref": "e1badcd4-7ac0-46b9-8940-d9b8da554a31",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fca4b817-6287-414e-aad6-686dd471efb5"
        }
      ]
    },
    {
      "bom-ref": "7d52ee2b-fa58-4a76-9763-b8d58c49218b",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fca4b817-6287-414e-aad6-686dd471efb5"
        }
      ]
    },
    {
      "bom-ref": "d6606512-1986-4e4c-9535-54a78ae357f0",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fca4b817-6287-414e-aad6-686dd471efb5"
        }
      ]
    },
    {
      "bom-ref": "4d792951-641c-4402-a106-fcce60e69b6d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fca4b817-6287-414e-aad6-686dd471efb5"
        }
      ]
    },
    {
      "bom-ref": "6ac16fa1-0f70-45f6-ae50-f53071872e78",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fca4b817-6287-414e-aad6-686dd471efb5"
        }
      ]
    },
    {
      "bom-ref": "9688eafe-4b06-4a2b-9883-9fbd4a6075ca",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fca4b817-6287-414e-aad6-686dd471efb5"
        }
      ]
    },
    {
      "bom-ref": "8151e117-3cc5-40d6-b21a-72f5bda56099",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d"
        }
      ]
    },
    {
      "bom-ref": "566e4408-a864-4848-81f2-9796781c8b6d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d"
        }
      ]
    },
    {
      "bom-ref": "6a1223d3-8146-4bc4-89c6-ee6cd57411b5",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d"
        }
      ]
    },
    {
      "bom-ref": "93e0bb8d-7df7-4bf2-88db-da1694aa6a1a",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d"
        }
      ]
    },
    {
      "bom-ref": "e73c7ec9-6833-45a9-adf0-4a9aeda5b1e2",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d"
        }
      ]
    },
    {
      "bom-ref": "4224343d-93c2-4e35-a881-78175b133f8a",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "facb56a6-fd9e-4e63-bd22-654408bd7e7d"
        }
      ]
    },
    {
      "bom-ref": "f40322b6-0f3b-4c87-81d9-386a668a03dc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c"
        }
      ]
    },
    {
      "bom-ref": "e3a5e40c-4de3-450c-9cf5-afcd7e829466",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c"
        }
      ]
    },
    {
      "bom-ref": "b6d11bd0-104f-4830-a1b5-47e9362be535",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c"
        }
      ]
    },
    {
      "bom-ref": "95de10ef-c223-44a8-a7b7-48f9233defc4",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c"
        }
      ]
    },
    {
      "bom-ref": "81dc8006-d8ef-4efb-9f1c-b9c02412c2c4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c"
        }
      ]
    },
    {
      "bom-ref": "ab866e5d-92ad-43ea-a28f-30c09371cc47",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fd6ae539-816d-4184-adf5-2b1a094bc67c"
        }
      ]
    },
    {
      "bom-ref": "0a1c717c-f989-4105-bfee-9ddc952dee17",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fe68439f-7461-455d-9231-2d080f834b36"
        }
      ]
    },
    {
      "bom-ref": "5d810cc2-65e0-4841-88d1-d76a327a412a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fe68439f-7461-455d-9231-2d080f834b36"
        }
      ]
    },
    {
      "bom-ref": "e5af4ed8-30c0-441e-a767-96a1ced40e5a",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fe68439f-7461-455d-9231-2d080f834b36"
        }
      ]
    },
    {
      "bom-ref": "c3d35f71-cf88-411a-be16-590ee12bc30d",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fe68439f-7461-455d-9231-2d080f834b36"
        }
      ]
    },
    {
      "bom-ref": "d543cff3-9f4e-41ff-82d0-01871db0821b",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fe68439f-7461-455d-9231-2d080f834b36"
        }
      ]
    },
    {
      "bom-ref": "efbde0d3-aae1-424b-a6d7-035d078b4805",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fe68439f-7461-455d-9231-2d080f834b36"
        }
      ]
    },
    {
      "bom-ref": "e6f2698a-fb30-493a-bb00-2fd4ad27d7d1",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874"
        }
      ]
    },
    {
      "bom-ref": "b14dfd02-ff7c-4be9-8522-d080881bbb3a",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874"
        }
      ]
    },
    {
      "bom-ref": "97da2c36-9a2c-47f8-b96e-cf5e1509397d",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874"
        }
      ]
    },
    {
      "bom-ref": "274fae48-94fb-470e-aa18-7f07df353298",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874"
        }
      ]
    },
    {
      "bom-ref": "a284711d-c632-4d36-a171-7d5cc800c6ba",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874"
        }
      ]
    },
    {
      "bom-ref": "4349b45a-1fb7-44cd-beaa-82929d4c5df3",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ff37dd9c-2627-4444-bb3f-b6d701f3e874"
        }
      ]
    },
    {
      "bom-ref": "e69d36f3-4e3f-4821-aa74-bb731176e50f",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ff411469-d04c-4300-88e7-692680278435"
        }
      ]
    },
    {
      "bom-ref": "3b51086d-39c3-4dc7-9c0b-c28733192b5f",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ff411469-d04c-4300-88e7-692680278435"
        }
      ]
    },
    {
      "bom-ref": "21324010-52d5-4634-8b42-4e0ccd0e0274",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ff411469-d04c-4300-88e7-692680278435"
        }
      ]
    },
    {
      "bom-ref": "523d3bbb-e4d5-44ad-aa24-140cdbae2d36",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ff411469-d04c-4300-88e7-692680278435"
        }
      ]
    },
    {
      "bom-ref": "4484c250-5e32-4852-b06a-98239d70abe4",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ff411469-d04c-4300-88e7-692680278435"
        }
      ]
    },
    {
      "bom-ref": "120af9b2-648f-43a8-9437-d2109f36a501",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ff411469-d04c-4300-88e7-692680278435"
        }
      ]
    },
    {
      "bom-ref": "81c5df85-c72c-4de1-8d2e-06623ede62c2",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1"
        }
      ]
    },
    {
      "bom-ref": "65206bb0-03ee-41a4-9735-1b5928600388",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1"
        }
      ]
    },
    {
      "bom-ref": "bfbf6532-2fd5-40ca-bda7-6cbd2a455eae",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1"
        }
      ]
    },
    {
      "bom-ref": "75749153-fa47-443b-809e-d33659beb249",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1"
        }
      ]
    },
    {
      "bom-ref": "a0ac40aa-3821-435e-b889-f5639fff7a28",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1"
        }
      ]
    },
    {
      "bom-ref": "8c6dcd56-5fdb-47df-891c-971c671886d7",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "ffe85aa6-22e2-440f-bf40-2301108252b1"
        }
      ]
    },
    {
      "bom-ref": "3ec0033a-1641-4fb5-a4a5-51eb931fbddc",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1"
        }
      ]
    },
    {
      "bom-ref": "d3bc0fca-038c-4282-b4dd-8f3bb25b774d",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1"
        }
      ]
    },
    {
      "bom-ref": "68a57757-8bbf-4225-8a8e-0419bb844110",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1"
        }
      ]
    },
    {
      "bom-ref": "cf05e20f-73ce-4516-b1c6-babbacd1e97f",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1"
        }
      ]
    },
    {
      "bom-ref": "a6c6f39f-1f83-47aa-a605-260d6ffd2deb",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1"
        }
      ]
    },
    {
      "bom-ref": "59eb3596-4aad-4313-862b-e4c06b6e7a9e",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "fede6f49-724e-4f38-a53d-cabbe264adf1"
        }
      ]
    },
    {
      "bom-ref": "992ff5d4-d392-44be-a7ac-bc0b0a0ed5ae",
      "id": "CVE-2020-24586",
      "description": "The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5ca7e47-65c9-4b79-9632-ede3c152432f",
      "id": "CVE-2020-36311",
      "description": "An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "18648f7f-4948-4f74-9601-f32ca57032bc",
      "id": "CVE-2021-37159",
      "description": "hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b954812-2834-49a7-8f70-db5ec1d9bb35",
      "id": "CVE-2021-47083",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: fix global-out-of-bounds issue\n\nWhen eint virtual eint number is greater than gpio number,\nit maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4afd70c0-18df-4ce5-a934-02f367f90d65",
      "id": "CVE-2021-47232",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: fix Use-after-Free, hold skb ref while in use\n\nThis patch fixes a Use-after-Free found by the syzbot.\n\nThe problem is that a skb is taken from the per-session skb queue,\nwithout incrementing the ref count. This leads to a Use-after-Free if\nthe skb is taken concurrently from the session queue due to a CTS.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de1fc392-d867-4ac8-bb3b-7fc30d6f43bc",
      "id": "CVE-2021-47252",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Avoid WARN_ON timing related checks\n\nThe soft/batadv interface for a queued OGM can be changed during the time\nthe OGM was queued for transmission and when the OGM is actually\ntransmitted by the worker.\n\nBut WARN_ON must be used to denote kernel bugs and not to print simple\nwarnings. A warning can simply be printed using pr_warn.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d12c0e8-a90c-4801-bf41-155e99414399",
      "id": "CVE-2021-47350",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: Fix lockup on kernel exec fault\n\nThe powerpc kernel is not prepared to handle exec faults from kernel.\nEspecially, the function is_exec_fault() will return 'false' when an\nexec fault is taken by kernel, because the check is based on reading\ncurrent-\u003ethread.regs-\u003etrap which contains the trap from user.\n\nFor instance, when provoking a LKDTM EXEC_USERSPACE test,\ncurrent-\u003ethread.regs-\u003etrap is set to SYSCALL trap (0xc00), and\nthe fault taken by the kernel is not seen as an exec fault by\nset_access_flags_filter().\n\nCommit d7df2443cd5f (\"powerpc/mm: Fix spurious segfaults on radix\nwith autonuma\") made it clear and handled it properly. But later on\ncommit d3ca587404b3 (\"powerpc/mm: Fix reporting of kernel execute\nfaults\") removed that handling, introducing test based on error_code.\nAnd here is the problem, because on the 603 all upper bits of SRR1\nget cleared when the TLB instruction miss handler bails out to ISI.\n\nUntil commit cbd7e6ca0210 (\"powerpc/fault: Avoid heavy\nsearch_exception_tables() verification\"), an exec fault from kernel\nat a userspace address was indirectly caught by the lack of entry for\nthat address in the exception tables. But after that commit the\nkernel mainly relies on KUAP or on core mm handling to catch wrong\nuser accesses. Here the access is not wrong, so mm handles it.\nIt is a minor fault because PAGE_EXEC is not set,\nset_access_flags_filter() should set PAGE_EXEC and voila.\nBut as is_exec_fault() returns false as explained in the beginning,\nset_access_flags_filter() bails out without setting PAGE_EXEC flag,\nwhich leads to a forever minor exec fault.\n\nAs the kernel is not prepared to handle such exec faults, the thing to\ndo is to fire in bad_kernel_fault() for any exec fault taken by the\nkernel, as it was prior to commit d3ca587404b3.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "05399378-397b-4ca0-a921-ed7c3cf81c91",
      "id": "CVE-2021-47373",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Fix potential VPE leak on error\n\nIn its_vpe_irq_domain_alloc, when its_vpe_init() returns an error,\nthere is an off-by-one in the number of VPEs to be freed.\n\nFix it by simply passing the number of VPEs allocated, which is the\nindex of the loop iterating over the VPEs.\n\n[maz: fixed commit message]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "afa42262-f7c4-4fa3-9591-996072781eae",
      "id": "CVE-2021-47428",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: fix program check interrupt emergency stack path\n\nEmergency stack path was jumping into a 3: label inside the\n__GEN_COMMON_BODY macro for the normal path after it had finished,\nrather than jumping over it. By a small miracle this is the correct\nplace to build up a new interrupt frame with the existing stack\npointer, so things basically worked okay with an added weird looking\n700 trap frame on top (which had the wrong -\u003enip so it didn't decode\nbug messages either).\n\nFix this by avoiding using numeric labels when jumping over non-trivial\nmacros.\n\nBefore:\n\n LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV\n Modules linked in:\n CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637\n NIP:  7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0\n REGS: c0000000fffb3a50 TRAP: 0700   Not tainted\n MSR:  9000000000021031 \u003cSF,HV,ME,IR,DR,LE\u003e  CR: 00000700  XER: 20040000\n CFAR: c0000000000098b0 IRQMASK: 0\n GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000\n GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299\n GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8\n GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001\n GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8\n GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158\n GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300\n GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80\n NIP [7265677368657265] 0x7265677368657265\n LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10\n Call Trace:\n [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable)\n --- interrupt: 700 at decrementer_common_virt+0xb8/0x230\n NIP:  c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0\n REGS: c0000000fffb3d60 TRAP: 0700   Not tainted\n MSR:  9000000000021031 \u003cSF,HV,ME,IR,DR,LE\u003e  CR: 22424282  XER: 20040000\n CFAR: c0000000000098b0 IRQMASK: 0\n GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000\n GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299\n GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8\n GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001\n GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8\n GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158\n GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300\n GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80\n NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230\n LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10\n --- interrupt: 700\n Instruction dump:\n XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n ---[ end trace 6d28218e0cc3c949 ]---\n\nAfter:\n\n ------------[ cut here ]------------\n kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491!\n Oops: Exception in kernel mode, sig: 5 [#1]\n LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV\n Modules linked in:\n CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638\n NIP:  c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0\n REGS: c0000000fffb3d60 TRAP: 0700   Not tainted\n MSR:  9000000000021031 \u003cSF,HV,ME,IR,DR,LE\u003e  CR: 24482227  XER: 00040000\n CFAR: c0000000000098b0 IRQMASK: 0\n GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868\n GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009\n GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c\n GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00\n GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90\n GPR20: 00000000100eed90 00000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51772bc1-940f-4a05-bf43-85299492b903",
      "id": "CVE-2021-47492",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, thp: bail out early in collapse_file for writeback page\n\nCurrently collapse_file does not explicitly check PG_writeback, instead,\npage_has_private and try_to_release_page are used to filter writeback\npages.  This does not work for xfs with blocksize equal to or larger\nthan pagesize, because in such case xfs has no page-\u003eprivate.\n\nThis makes collapse_file bail out early for writeback page.  Otherwise,\nxfs end_page_writeback will panic as follows.\n\n  page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32\n  aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:\"libtest.so\"\n  flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback)\n  raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8\n  raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000\n  page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u \u003c= 127u))\n  page-\u003emem_cgroup:ffff0000c3e9a000\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/mm.h:1212!\n  Internal error: Oops - BUG: 0 [#1] SMP\n  Modules linked in:\n  BUG: Bad page state in process khugepaged  pfn:84ef32\n   xfs(E)\n  page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32\n   libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ...\n  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ...\n  pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)\n  Call trace:\n    end_page_writeback+0x1c0/0x214\n    iomap_finish_page_writeback+0x13c/0x204\n    iomap_finish_ioend+0xe8/0x19c\n    iomap_writepage_end_bio+0x38/0x50\n    bio_endio+0x168/0x1ec\n    blk_update_request+0x278/0x3f0\n    blk_mq_end_request+0x34/0x15c\n    virtblk_request_done+0x38/0x74 [virtio_blk]\n    blk_done_softirq+0xc4/0x110\n    __do_softirq+0x128/0x38c\n    __irq_exit_rcu+0x118/0x150\n    irq_exit+0x1c/0x30\n    __handle_domain_irq+0x8c/0xf0\n    gic_handle_irq+0x84/0x108\n    el1_irq+0xcc/0x180\n    arch_cpu_idle+0x18/0x40\n    default_idle_call+0x4c/0x1a0\n    cpuidle_idle_call+0x168/0x1e0\n    do_idle+0xb4/0x104\n    cpu_startup_entry+0x30/0x9c\n    secondary_start_kernel+0x104/0x180\n  Code: d4210000 b0006161 910c8021 94013f4d (d4210000)\n  ---[ end trace 4a88c6a074082f8c ]---\n  Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "088676db-7fb6-4cc0-bdbb-5b3350b5d8e0",
      "id": "CVE-2021-47640",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kasan: Fix early region not updated correctly\n\nThe shadow's page table is not updated when PTE_RPN_SHIFT is 24\nand PAGE_SHIFT is 12. It not only causes false positives but\nalso false negative as shown the following text.\n\nFix it by bringing the logic of kasan_early_shadow_page_entry here.\n\n1. False Positive:\n==================================================================\nBUG: KASAN: vmalloc-out-of-bounds in pcpu_alloc+0x508/0xa50\nWrite of size 16 at addr f57f3be0 by task swapper/0/1\n\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-12267-gdebe436e77c7 #1\nCall Trace:\n[c80d1c20] [c07fe7b8] dump_stack_lvl+0x4c/0x6c (unreliable)\n[c80d1c40] [c02ff668] print_address_description.constprop.0+0x88/0x300\n[c80d1c70] [c02ff45c] kasan_report+0x1ec/0x200\n[c80d1cb0] [c0300b20] kasan_check_range+0x160/0x2f0\n[c80d1cc0] [c03018a4] memset+0x34/0x90\n[c80d1ce0] [c0280108] pcpu_alloc+0x508/0xa50\n[c80d1d40] [c02fd7bc] __kmem_cache_create+0xfc/0x570\n[c80d1d70] [c0283d64] kmem_cache_create_usercopy+0x274/0x3e0\n[c80d1db0] [c2036580] init_sd+0xc4/0x1d0\n[c80d1de0] [c00044a0] do_one_initcall+0xc0/0x33c\n[c80d1eb0] [c2001624] kernel_init_freeable+0x2c8/0x384\n[c80d1ef0] [c0004b14] kernel_init+0x24/0x170\n[c80d1f10] [c001b26c] ret_from_kernel_thread+0x5c/0x64\n\nMemory state around the buggy address:\n f57f3a80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n f57f3b00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\u003ef57f3b80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                                               ^\n f57f3c00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n f57f3c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n==================================================================\n\n2. False Negative (with KASAN tests):\n==================================================================\nBefore fix:\n    ok 45 - kmalloc_double_kzfree\n    # vmalloc_oob: EXPECTATION FAILED at lib/test_kasan.c:1039\n    KASAN failure expected in \"((volatile char *)area)[3100]\", but none occurred\n    not ok 46 - vmalloc_oob\n    not ok 1 - kasan\n\n==================================================================\nAfter fix:\n    ok 1 - kasan",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb701969-8ca4-41a7-a79c-d9d3b4e3bd87",
      "id": "CVE-2021-47669",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: vxcan: vxcan_xmit: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the canfd_frame cfd which aliases skb memory is accessed\nafter the netif_rx_ni().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8cd9288-dc31-4894-8b66-398dd09c64f4",
      "id": "CVE-2022-2785",
      "description": "There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d29f141-64f3-488e-8660-cd3848b31cd8",
      "id": "CVE-2022-48644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: avoid disabling offload when it was never enabled\n\nIn an incredibly strange API design decision, qdisc-\u003edestroy() gets\ncalled even if qdisc-\u003einit() never succeeded, not exclusively since\ncommit 87b60cfacf9f (\"net_sched: fix error recovery at qdisc creation\"),\nbut apparently also earlier (in the case of qdisc_create_dflt()).\n\nThe taprio qdisc does not fully acknowledge this when it attempts full\noffload, because it starts off with q-\u003eflags = TAPRIO_FLAGS_INVALID in\ntaprio_init(), then it replaces q-\u003eflags with TCA_TAPRIO_ATTR_FLAGS\nparsed from netlink (in taprio_change(), tail called from taprio_init()).\n\nBut in taprio_destroy(), we call taprio_disable_offload(), and this\ndetermines what to do based on FULL_OFFLOAD_IS_ENABLED(q-\u003eflags).\n\nBut looking at the implementation of FULL_OFFLOAD_IS_ENABLED()\n(a bitwise check of bit 1 in q-\u003eflags), it is invalid to call this macro\non q-\u003eflags when it contains TAPRIO_FLAGS_INVALID, because that is set\nto U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on\nan invalid set of flags.\n\nAs a result, it is possible to crash the kernel if user space forces an\nerror between setting q-\u003eflags = TAPRIO_FLAGS_INVALID, and the calling\nof taprio_enable_offload(). This is because drivers do not expect the\noffload to be disabled when it was never enabled.\n\nThe error that we force here is to attach taprio as a non-root qdisc,\nbut instead as child of an mqprio root qdisc:\n\n$ tc qdisc add dev swp0 root handle 1: \\\n\tmqprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0\n$ tc qdisc replace dev swp0 parent 1:1 \\\n\ttaprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \\\n\tsched-entry S 0x7f 990000 sched-entry S 0x80 100000 \\\n\tflags 0x0 clockid CLOCK_TAI\nUnable to handle kernel paging request at virtual address fffffffffffffff8\n[fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 96000004 [#1] PREEMPT SMP\nCall trace:\n taprio_dump+0x27c/0x310\n vsc9959_port_setup_tc+0x1f4/0x460\n felix_port_setup_tc+0x24/0x3c\n dsa_slave_setup_tc+0x54/0x27c\n taprio_disable_offload.isra.0+0x58/0xe0\n taprio_destroy+0x80/0x104\n qdisc_create+0x240/0x470\n tc_modify_qdisc+0x1fc/0x6b0\n rtnetlink_rcv_msg+0x12c/0x390\n netlink_rcv_skb+0x5c/0x130\n rtnetlink_rcv+0x1c/0x2c\n\nFix this by keeping track of the operations we made, and undo the\noffload only if we actually did it.\n\nI've added \"bool offloaded\" inside a 4 byte hole between \"int clockid\"\nand \"atomic64_t picos_per_byte\". Now the first cache line looks like\nbelow:\n\n$ pahole -C taprio_sched net/sched/sch_taprio.o\nstruct taprio_sched {\n        struct Qdisc * *           qdiscs;               /*     0     8 */\n        struct Qdisc *             root;                 /*     8     8 */\n        u32                        flags;                /*    16     4 */\n        enum tk_offsets            tk_offset;            /*    20     4 */\n        int                        clockid;              /*    24     4 */\n        bool                       offloaded;            /*    28     1 */\n\n        /* XXX 3 bytes hole, try to pack */\n\n        atomic64_t                 picos_per_byte;       /*    32     0 */\n\n        /* XXX 8 bytes hole, try to pack */\n\n        spinlock_t                 current_entry_lock;   /*    40     0 */\n\n        /* XXX 8 bytes hole, try to pack */\n\n        struct sched_entry *       current_entry;        /*    48     8 */\n        struct sched_gate_list *   oper_sched;           /*    56     8 */\n        /* --- cacheline 1 boundary (64 bytes) --- */",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30acef7f-c130-4b9a-ba81-71765bba4a94",
      "id": "CVE-2022-48759",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev\n\nstruct rpmsg_ctrldev contains a struct cdev. The current code frees\nthe rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the\ncdev is a managed object, therefore its release is not predictable\nand the rpmsg_ctrldev could be freed before the cdev is entirely\nreleased, as in the backtrace below.\n\n[   93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c\n[   93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0\n[   93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v\n[   93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G    B             5.4.163-lockdep #26\n[   93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT)\n[   93.730055] Workqueue: events kobject_delayed_cleanup\n[   93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO)\n[   93.740216] pc : debug_print_object+0x13c/0x1b0\n[   93.744890] lr : debug_print_object+0x13c/0x1b0\n[   93.749555] sp : ffffffacf5bc7940\n[   93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000\n[   93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000\n[   93.763916] x25: ffffffd0734f856c x24: dfffffd000000000\n[   93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0\n[   93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0\n[   93.780338] x19: ffffffd075199100 x18: 00000000000276e0\n[   93.785814] x17: 0000000000000000 x16: dfffffd000000000\n[   93.791291] x15: ffffffffffffffff x14: 6e6968207473696c\n[   93.796768] x13: 0000000000000000 x12: ffffffd075e2b000\n[   93.802244] x11: 0000000000000001 x10: 0000000000000000\n[   93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900\n[   93.813200] x7 : 0000000000000000 x6 : 0000000000000000\n[   93.818676] x5 : 0000000000000080 x4 : 0000000000000000\n[   93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001\n[   93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061\n[   93.835104] Call trace:\n[   93.837644]  debug_print_object+0x13c/0x1b0\n[   93.841963]  __debug_check_no_obj_freed+0x25c/0x3c0\n[   93.846987]  debug_check_no_obj_freed+0x18/0x20\n[   93.851669]  slab_free_freelist_hook+0xbc/0x1e4\n[   93.856346]  kfree+0xfc/0x2f4\n[   93.859416]  rpmsg_ctrldev_release_device+0x78/0xb8\n[   93.864445]  device_release+0x84/0x168\n[   93.868310]  kobject_cleanup+0x12c/0x298\n[   93.872356]  kobject_delayed_cleanup+0x10/0x18\n[   93.876948]  process_one_work+0x578/0x92c\n[   93.881086]  worker_thread+0x804/0xcf8\n[   93.884963]  kthread+0x2a8/0x314\n[   93.888303]  ret_from_fork+0x10/0x18\n\nThe cdev_device_add/del() API was created to address this issue (see\ncommit '233ed09d7fda (\"chardev: add helper function to register char\ndevs with a struct device\")'), use it instead of cdev add/del().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d531072f-8653-4768-91f5-eb3b16bfbbf8",
      "id": "CVE-2022-48902",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not WARN_ON() if we have PageError set\n\nWhenever we do any extent buffer operations we call\nassert_eb_page_uptodate() to complain loudly if we're operating on an\nnon-uptodate page.  Our overnight tests caught this warning earlier this\nweek\n\n  WARNING: CPU: 1 PID: 553508 at fs/btrfs/extent_io.c:6849 assert_eb_page_uptodate+0x3f/0x50\n  CPU: 1 PID: 553508 Comm: kworker/u4:13 Tainted: G        W         5.17.0-rc3+ #564\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  Workqueue: btrfs-cache btrfs_work_helper\n  RIP: 0010:assert_eb_page_uptodate+0x3f/0x50\n  RSP: 0018:ffffa961440a7c68 EFLAGS: 00010246\n  RAX: 0017ffffc0002112 RBX: ffffe6e74453f9c0 RCX: 0000000000001000\n  RDX: ffffe6e74467c887 RSI: ffffe6e74453f9c0 RDI: ffff8d4c5efc2fc0\n  RBP: 0000000000000d56 R08: ffff8d4d4a224000 R09: 0000000000000000\n  R10: 00015817fa9d1ef0 R11: 000000000000000c R12: 00000000000007b1\n  R13: ffff8d4c5efc2fc0 R14: 0000000001500000 R15: 0000000001cb1000\n  FS:  0000000000000000(0000) GS:ffff8d4dbbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007ff31d3448d8 CR3: 0000000118be8004 CR4: 0000000000370ee0\n  Call Trace:\n\n   extent_buffer_test_bit+0x3f/0x70\n   free_space_test_bit+0xa6/0xc0\n   load_free_space_tree+0x1f6/0x470\n   caching_thread+0x454/0x630\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? lock_release+0x1f0/0x2d0\n   btrfs_work_helper+0xf2/0x3e0\n   ? lock_release+0x1f0/0x2d0\n   ? finish_task_switch.isra.0+0xf9/0x3a0\n   process_one_work+0x26d/0x580\n   ? process_one_work+0x580/0x580\n   worker_thread+0x55/0x3b0\n   ? process_one_work+0x580/0x580\n   kthread+0xf0/0x120\n   ? kthread_complete_and_exit+0x20/0x20\n   ret_from_fork+0x1f/0x30\n\nThis was partially fixed by c2e39305299f01 (\"btrfs: clear extent buffer\nuptodate when we fail to write it\"), however all that fix did was keep\nus from finding extent buffers after a failed writeout.  It didn't keep\nus from continuing to use a buffer that we already had found.\n\nIn this case we're searching the commit root to cache the block group,\nso we can start committing the transaction and switch the commit root\nand then start writing.  After the switch we can look up an extent\nbuffer that hasn't been written yet and start processing that block\ngroup.  Then we fail to write that block out and clear Uptodate on the\npage, and then we start spewing these errors.\n\nNormally we're protected by the tree lock to a certain degree here.  If\nwe read a block we have that block read locked, and we block the writer\nfrom locking the block before we submit it for the write.  However this\nisn't necessarily fool proof because the read could happen before we do\nthe submit_bio and after we locked and unlocked the extent buffer.\n\nAlso in this particular case we have path-\u003eskip_locking set, so that\nwon't save us here.  We'll simply get a block that was valid when we\nread it, but became invalid while we were using it.\n\nWhat we really want is to catch the case where we've \"read\" a block but\nit's not marked Uptodate.  On read we ClearPageError(), so if we're\n!Uptodate and !Error we know we didn't do the right thing for reading\nthe page.\n\nFix this by checking !Uptodate \u0026\u0026 !Error, this way we will not complain\nif our buffer gets invalidated while we're using it, and we'll maintain\nthe spirit of the check which is to make sure we have a fully in-cache\nblock while we're messing with it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "44a38634-ad0b-4a1b-8430-45d7e322e8ef",
      "id": "CVE-2022-49123",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: Fix frames flush failure caused by deadlock\n\nWe are seeing below warnings:\n\nkernel: [25393.301506] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0\nkernel: [25398.421509] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0\nkernel: [25398.421831] ath11k_pci 0000:01:00.0: dropping mgmt frame for vdev 0, is_started 0\n\nthis means ath11k fails to flush mgmt. frames because wmi_mgmt_tx_work\nhas no chance to run in 5 seconds.\n\nBy setting /proc/sys/kernel/hung_task_timeout_secs to 20 and increasing\nATH11K_FLUSH_TIMEOUT to 50 we get below warnings:\n\nkernel: [  120.763160] INFO: task wpa_supplicant:924 blocked for more than 20 seconds.\nkernel: [  120.763169]       Not tainted 5.10.90 #12\nkernel: [  120.763177] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nkernel: [  120.763186] task:wpa_supplicant  state:D stack:    0 pid:  924 ppid:     1 flags:0x000043a0\nkernel: [  120.763201] Call Trace:\nkernel: [  120.763214]  __schedule+0x785/0x12fa\nkernel: [  120.763224]  ? lockdep_hardirqs_on_prepare+0xe2/0x1bb\nkernel: [  120.763242]  schedule+0x7e/0xa1\nkernel: [  120.763253]  schedule_timeout+0x98/0xfe\nkernel: [  120.763266]  ? run_local_timers+0x4a/0x4a\nkernel: [  120.763291]  ath11k_mac_flush_tx_complete+0x197/0x2b1 [ath11k 13c3a9bf37790f4ac8103b3decf7ab4008ac314a]\nkernel: [  120.763306]  ? init_wait_entry+0x2e/0x2e\nkernel: [  120.763343]  __ieee80211_flush_queues+0x167/0x21f [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763378]  __ieee80211_recalc_idle+0x105/0x125 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763411]  ieee80211_recalc_idle+0x14/0x27 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763441]  ieee80211_free_chanctx+0x77/0xa2 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763473]  __ieee80211_vif_release_channel+0x100/0x131 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763540]  ieee80211_vif_release_channel+0x66/0x81 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763572]  ieee80211_destroy_auth_data+0xa3/0xe6 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763612]  ieee80211_mgd_deauth+0x178/0x29b [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763654]  cfg80211_mlme_deauth+0x1a8/0x22c [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763697]  nl80211_deauthenticate+0xfa/0x123 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763715]  genl_rcv_msg+0x392/0x3c2\nkernel: [  120.763750]  ? nl80211_associate+0x432/0x432 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763782]  ? nl80211_associate+0x432/0x432 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763802]  ? genl_rcv+0x36/0x36\nkernel: [  120.763814]  netlink_rcv_skb+0x89/0xf7\nkernel: [  120.763829]  genl_rcv+0x28/0x36\nkernel: [  120.763840]  netlink_unicast+0x179/0x24b\nkernel: [  120.763854]  netlink_sendmsg+0x393/0x401\nkernel: [  120.763872]  sock_sendmsg+0x72/0x76\nkernel: [  120.763886]  ____sys_sendmsg+0x170/0x1e6\nkernel: [  120.763897]  ? copy_msghdr_from_user+0x7a/0xa2\nkernel: [  120.763914]  ___sys_sendmsg+0x95/0xd1\nkernel: [  120.763940]  __sys_sendmsg+0x85/0xbf\nkernel: [  120.763956]  do_syscall_64+0x43/0x55\nkernel: [  120.763966]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\nkernel: [  120.763977] RIP: 0033:0x79089f3fcc83\nkernel: [  120.763986] RSP: 002b:00007ffe604f0508 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nkernel: [  120.763997] RAX: ffffffffffffffda RBX: 000059b40e987690 RCX: 000079089f3fcc83\nkernel: [  120.764006] RDX: 0000000000000000 RSI: 00007ffe604f0558 RDI: 0000000000000009\nkernel: [  120.764014] RBP: 00007ffe604f0540 R08: 0000000000000004 R09: 0000000000400000\nkernel: [  120.764023] R10: 00007ffe604f0638 R11: 0000000000000246 R12: 000059b40ea04980\nkernel: [  120.764032] R13: 00007ffe604\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "44b4bb5c-5cac-49f4-9b27-9b12a93a3e5d",
      "id": "CVE-2022-49267",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: use sysfs_emit() instead of sprintf()\n\nsprintf() (still used in the MMC core for the sysfs output) is vulnerable\nto the buffer overflow.  Use the new-fangled sysfs_emit() instead.\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14582e2e-5970-4180-b274-477eae178dca",
      "id": "CVE-2022-49465",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-throttle: Set BIO_THROTTLED when bio has been throttled\n\n1.In current process, all bio will set the BIO_THROTTLED flag\nafter __blk_throtl_bio().\n\n2.If bio needs to be throttled, it will start the timer and\nstop submit bio directly. Bio will submit in\nblk_throtl_dispatch_work_fn() when the timer expires.But in\nthe current process, if bio is throttled. The BIO_THROTTLED\nwill be set to bio after timer start. If the bio has been\ncompleted, it may cause use-after-free blow.\n\nBUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70\nRead of size 2 at addr ffff88801b8902d4 by task fio/26380\n\n dump_stack+0x9b/0xce\n print_address_description.constprop.6+0x3e/0x60\n kasan_report.cold.9+0x22/0x3a\n blk_throtl_bio+0x12f0/0x2c70\n submit_bio_checks+0x701/0x1550\n submit_bio_noacct+0x83/0xc80\n submit_bio+0xa7/0x330\n mpage_readahead+0x380/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nAllocated by task 26380:\n kasan_save_stack+0x19/0x40\n __kasan_kmalloc.constprop.2+0xc1/0xd0\n kmem_cache_alloc+0x146/0x440\n mempool_alloc+0x125/0x2f0\n bio_alloc_bioset+0x353/0x590\n mpage_alloc+0x3b/0x240\n do_mpage_readpage+0xddf/0x1ef0\n mpage_readahead+0x264/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 0:\n kasan_save_stack+0x19/0x40\n kasan_set_track+0x1c/0x30\n kasan_set_free_info+0x1b/0x30\n __kasan_slab_free+0x111/0x160\n kmem_cache_free+0x94/0x460\n mempool_free+0xd6/0x320\n bio_free+0xe0/0x130\n bio_put+0xab/0xe0\n bio_endio+0x3a6/0x5d0\n blk_update_request+0x590/0x1370\n scsi_end_request+0x7d/0x400\n scsi_io_completion+0x1aa/0xe50\n scsi_softirq_done+0x11b/0x240\n blk_mq_complete_request+0xd4/0x120\n scsi_mq_done+0xf0/0x200\n virtscsi_vq_done+0xbc/0x150\n vring_interrupt+0x179/0x390\n __handle_irq_event_percpu+0xf7/0x490\n handle_irq_event_percpu+0x7b/0x160\n handle_irq_event+0xcc/0x170\n handle_edge_irq+0x215/0xb20\n common_interrupt+0x60/0x120\n asm_common_interrupt+0x1e/0x40\n\nFix this by move BIO_THROTTLED set into the queue_lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9bbfc7f-78c2-43e6-9aa6-a28f673c3856",
      "id": "CVE-2022-49523",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: disable spectral scan during spectral deinit\n\nWhen ath11k modules are removed using rmmod with spectral scan enabled,\ncrash is observed. Different crash trace is observed for each crash.\n\nSend spectral scan disable WMI command to firmware before cleaning\nthe spectral dbring in the spectral_deinit API to avoid this crash.\n\ncall trace from one of the crash observed:\n[ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008\n[ 1252.882722] pgd = 0f42e886\n[ 1252.890955] [00000008] *pgd=00000000\n[ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM\n[ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0\n[ 1253.115261] Hardware name: Generic DT based system\n[ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k]\n[ 1253.125940] LR is at 0x88e31017\n[ 1253.132448] pc : [\u003c7f9387b8\u003e]    lr : [\u003c88e31017\u003e]    psr: a0000193\n[ 1253.135488] sp : 80d01bc8  ip : 00000001  fp : 970e0000\n[ 1253.141737] r10: 88e31000  r9 : 970ec000  r8 : 00000080\n[ 1253.146946] r7 : 94734040  r6 : a0000113  r5 : 00000057  r4 : 00000000\n[ 1253.152159] r3 : e18cb694  r2 : 00000217  r1 : 1df1f000  r0 : 00000001\n[ 1253.158755] Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user\n[ 1253.165266] Control: 10c0383d  Table: 5e71006a  DAC: 00000055\n[ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141)\n[ 1253.458055] [\u003c7f9387b8\u003e] (ath11k_spectral_process_data [ath11k]) from [\u003c7f917fdc\u003e] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k])\n[ 1253.466139] [\u003c7f917fdc\u003e] (ath11k_dbring_buffer_release_event [ath11k]) from [\u003c7f8ea3c4\u003e] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k])\n[ 1253.478807] [\u003c7f8ea3c4\u003e] (ath11k_wmi_tlv_op_rx [ath11k]) from [\u003c7f8fe868\u003e] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k])\n[ 1253.490699] [\u003c7f8fe868\u003e] (ath11k_htc_rx_completion_handler [ath11k]) from [\u003c7f91308c\u003e] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k])\n[ 1253.502386] [\u003c7f91308c\u003e] (ath11k_ce_per_engine_service [ath11k]) from [\u003c7f9a4198\u003e] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci])\n[ 1253.514811] [\u003c7f9a4198\u003e] (ath11k_pci_ce_tasklet [ath11k_pci]) from [\u003c8032227c\u003e] (tasklet_action_common.constprop.2+0x64/0xe8)\n[ 1253.526476] [\u003c8032227c\u003e] (tasklet_action_common.constprop.2) from [\u003c803021e8\u003e] (__do_softirq+0x130/0x2d0)\n[ 1253.537756] [\u003c803021e8\u003e] (__do_softirq) from [\u003c80322610\u003e] (irq_exit+0xcc/0xe8)\n[ 1253.547304] [\u003c80322610\u003e] (irq_exit) from [\u003c8036a4a4\u003e] (__handle_domain_irq+0x60/0xb4)\n[ 1253.554428] [\u003c8036a4a4\u003e] (__handle_domain_irq) from [\u003c805eb348\u003e] (gic_handle_irq+0x4c/0x90)\n[ 1253.562321] [\u003c805eb348\u003e] (gic_handle_irq) from [\u003c80301a78\u003e] (__irq_svc+0x58/0x8c)\n\nTested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5ab12f4-a7be-40f0-aae5-e594fd521c69",
      "id": "CVE-2022-49611",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/speculation: Fill RSB on vmexit for IBRS\n\nPrevent RSB underflow/poisoning attacks with RSB.  While at it, add a\nbunch of comments to attempt to document the current state of tribal\nknowledge about RSB attacks and what exactly is being mitigated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d28475f-12e2-40d2-af59-5db6f90a9723",
      "id": "CVE-2022-50024",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-axi-dmac: do not print NULL LLI during error\n\nDuring debugging we have seen an issue where axi_chan_dump_lli()\nis passed a NULL LLI pointer which ends up causing an OOPS due\nto trying to get fields from it. Simply print NULL LLI and exit\nto avoid this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ddd3eaf5-2756-45cc-b69d-58a03b38d6cb",
      "id": "CVE-2022-50210",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,\ncpu_max_bits_warn() generates a runtime warning similar as below while\nwe show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[    3.052463] ------------[ cut here ]------------\n[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[    3.070072] Modules linked in: efivarfs autofs4\n[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[    3.084034] Hardware name: Loongson Loongson-3A4000-7A1000-1w-V0.1-CRB/Loongson-LS3A4000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27\n[    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[    3.195868]         ...\n[    3.199917] Call Trace:\n[    3.203941] [\u003c98000000002086d8\u003e] show_stack+0x38/0x14c\n[    3.210666] [\u003c9800000000cf846c\u003e] dump_stack_lvl+0x60/0x88\n[    3.217625] [\u003c980000000023d268\u003e] __warn+0xd0/0x100\n[    3.223958] [\u003c9800000000cf3c90\u003e] warn_slowpath_fmt+0x7c/0xcc\n[    3.231150] [\u003c9800000000210220\u003e] show_cpuinfo+0x5e8/0x5f0\n[    3.238080] [\u003c98000000004f578c\u003e] seq_read_iter+0x354/0x4b4\n[    3.245098] [\u003c98000000004c2e90\u003e] new_sync_read+0x17c/0x1c4\n[    3.252114] [\u003c98000000004c5174\u003e] vfs_read+0x138/0x1d0\n[    3.258694] [\u003c98000000004c55f8\u003e] ksys_read+0x70/0x100\n[    3.265265] [\u003c9800000000cfde9c\u003e] do_syscall+0x7c/0x94\n[    3.271820] [\u003c9800000000202fe4\u003e] handle_syscall+0xc4/0x160\n[    3.281824] ---[ end trace 8b484262b4b8c24c ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72b9e35f-adf8-42de-b691-616067299361",
      "id": "CVE-2022-50241",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix use-after-free on source server when doing inter-server copy\n\nUse-after-free occurred when the laundromat tried to free expired\ncpntf_state entry on the s2s_cp_stateids list after inter-server\ncopy completed. The sc_cp_list that the expired copy state was\ninserted on was already freed.\n\nWhen COPY completes, the Linux client normally sends LOCKU(lock_state x),\nFREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.\nThe nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state\nfrom the s2s_cp_stateids list before freeing the lock state's stid.\n\nHowever, sometimes the CLOSE was sent before the FREE_STATEID request.\nWhen this happens, the nfsd4_close_open_stateid call from nfsd4_close\nfrees all lock states on its st_locks list without cleaning up the copy\nstate on the sc_cp_list list. When the time the FREE_STATEID arrives the\nserver returns BAD_STATEID since the lock state was freed. This causes\nthe use-after-free error to occur when the laundromat tries to free\nthe expired cpntf_state.\n\nThis patch adds a call to nfs4_free_cpntf_statelist in\nnfsd4_close_open_stateid to clean up the copy state before calling\nfree_ol_stateid_reaplist to free the lock state's stid on the reaplist.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c92b0b5f-8ecb-436d-9f9c-26e5c8822b08",
      "id": "CVE-2022-50309",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "828c4ebc-1d17-4824-9456-63d513e947b9",
      "id": "CVE-2022-50392",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe()\n\nThe node returned by of_parse_phandle() with refcount incremented,\nof_node_put() needs be called when finish using it. So add it in the\nerror path in mt8183_mt6358_ts3a227_max98357_dev_probe().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "515b268b-a2e5-4617-849a-9d09b719e480",
      "id": "CVE-2023-26545",
      "description": "In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96d3c637-0c8e-4413-80da-50e2c30f106f",
      "id": "CVE-2023-35828",
      "description": "An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87f25a9c-3fdc-4702-be7b-4b499c145c9c",
      "id": "CVE-2023-40283",
      "description": "An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6fc8a86c-a086-4fdf-80a5-e79dc9f40eaa",
      "id": "CVE-2023-52578",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: use DEV_STATS_INC()\n\nsyzbot/KCSAN reported data-races in br_handle_frame_finish() [1]\nThis function can run from multiple cpus without mutual exclusion.\n\nAdopt SMP safe DEV_STATS_INC() to update dev-\u003estats fields.\n\nHandles updates to dev-\u003estats.tx_dropped while we are at it.\n\n[1]\nBUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish\n\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\nrun_ksoftirqd+0x17/0x20 kernel/softirq.c:921\nsmpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\ndo_softirq+0x5e/0x90 kernel/softirq.c:454\n__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381\n__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]\n_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210\nspin_unlock_bh include/linux/spinlock.h:396 [inline]\nbatadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356\nbatadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560\nprocess_one_work kernel/workqueue.c:2630 [inline]\nprocess_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703\nworker_thread+0x525/0x730 kernel/workqueue.c:2784\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n\nvalue changed: 0x00000000000d7190 -\u003e 0x00000000000d7191\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77fff56f-453d-4a7b-a5f4-acbb61925e2b",
      "id": "CVE-2023-52751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in smb2_query_info_compound()\n\nThe following UAF was triggered when running fstests generic/072 with\nKASAN enabled against Windows Server 2022 and mount options\n'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm'\n\n  BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs]\n  Read of size 8 at addr ffff888014941048 by task xfs_io/27534\n\n  CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n  Call Trace:\n   dump_stack_lvl+0x4a/0x80\n   print_report+0xcf/0x650\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? __phys_addr+0x46/0x90\n   kasan_report+0xda/0x110\n   ? smb2_query_info_compound+0x423/0x6d0 [cifs]\n   ? smb2_query_info_compound+0x423/0x6d0 [cifs]\n   smb2_query_info_compound+0x423/0x6d0 [cifs]\n   ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs]\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? __stack_depot_save+0x39/0x480\n   ? kasan_save_stack+0x33/0x60\n   ? kasan_set_track+0x25/0x30\n   ? ____kasan_slab_free+0x126/0x170\n   smb2_queryfs+0xc2/0x2c0 [cifs]\n   ? __pfx_smb2_queryfs+0x10/0x10 [cifs]\n   ? __pfx___lock_acquire+0x10/0x10\n   smb311_queryfs+0x210/0x220 [cifs]\n   ? __pfx_smb311_queryfs+0x10/0x10 [cifs]\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? __lock_acquire+0x480/0x26c0\n   ? lock_release+0x1ed/0x640\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? do_raw_spin_unlock+0x9b/0x100\n   cifs_statfs+0x18c/0x4b0 [cifs]\n   statfs_by_dentry+0x9b/0xf0\n   fd_statfs+0x4e/0xb0\n   __do_sys_fstatfs+0x7f/0xe0\n   ? __pfx___do_sys_fstatfs+0x10/0x10\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? lockdep_hardirqs_on_prepare+0x136/0x200\n   ? srso_alias_return_thunk+0x5/0x7f\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n  Allocated by task 27534:\n   kasan_save_stack+0x33/0x60\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x8f/0xa0\n   open_cached_dir+0x71b/0x1240 [cifs]\n   smb2_query_info_compound+0x5c3/0x6d0 [cifs]\n   smb2_queryfs+0xc2/0x2c0 [cifs]\n   smb311_queryfs+0x210/0x220 [cifs]\n   cifs_statfs+0x18c/0x4b0 [cifs]\n   statfs_by_dentry+0x9b/0xf0\n   fd_statfs+0x4e/0xb0\n   __do_sys_fstatfs+0x7f/0xe0\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n  Freed by task 27534:\n   kasan_save_stack+0x33/0x60\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2b/0x50\n   ____kasan_slab_free+0x126/0x170\n   slab_free_freelist_hook+0xd0/0x1e0\n   __kmem_cache_free+0x9d/0x1b0\n   open_cached_dir+0xff5/0x1240 [cifs]\n   smb2_query_info_compound+0x5c3/0x6d0 [cifs]\n   smb2_queryfs+0xc2/0x2c0 [cifs]\n\nThis is a race between open_cached_dir() and cached_dir_lease_break()\nwhere the cache entry for the open directory handle receives a lease\nbreak while creating it.  And before returning from open_cached_dir(),\nwe put the last reference of the new @cfid because of\n!@cfid-\u003ehas_lease.\n\nBesides the UAF, while running xfstests a lot of missed lease breaks\nhave been noticed in tests that run several concurrent statfs(2) calls\non those cached fids\n\n  CIFS: VFS: \\\\w22-root1.gandalf.test No task to wake, unknown frame...\n  CIFS: VFS: \\\\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1...\n  CIFS: VFS: \\\\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108\n  CIFS: VFS: Dump pending requests:\n  CIFS: VFS: \\\\w22-root1.gandalf.test No task to wake, unknown frame...\n  CIFS: VFS: \\\\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1...\n  CIFS: VFS: \\\\w22-root1.gandalf.test smb buf 000000005aa7316e len 108\n  ...\n\nTo fix both, in open_cached_dir() ensure that @cfid-\u003ehas_lease is set\nright before sending out compounded request so that any potential\nlease break will be get processed by demultiplex thread while we're\nstill caching @cfid.  And, if open failed for some reason, re-check\n@cfid-\u003ehas_lease to decide whether or not put lease reference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0c439b7-e2f6-44b7-8e2e-12993d876b61",
      "id": "CVE-2023-53134",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Avoid order-5 memory allocation for TPA data\n\nThe driver needs to keep track of all the possible concurrent TPA (GRO/LRO)\ncompletions on the aggregation ring.  On P5 chips, the maximum number\nof concurrent TPA is 256 and the amount of memory we allocate is order-5\non systems using 4K pages.  Memory allocation failure has been reported:\n\nNetworkManager: page allocation failure: order:5, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1\nCPU: 15 PID: 2995 Comm: NetworkManager Kdump: loaded Not tainted 5.10.156 #1\nHardware name: Dell Inc. PowerEdge R660/0M1CC5, BIOS 0.2.25 08/12/2022\nCall Trace:\n dump_stack+0x57/0x6e\n warn_alloc.cold.120+0x7b/0xdd\n ? _cond_resched+0x15/0x30\n ? __alloc_pages_direct_compact+0x15f/0x170\n __alloc_pages_slowpath.constprop.108+0xc58/0xc70\n __alloc_pages_nodemask+0x2d0/0x300\n kmalloc_order+0x24/0xe0\n kmalloc_order_trace+0x19/0x80\n bnxt_alloc_mem+0x1150/0x15c0 [bnxt_en]\n ? bnxt_get_func_stat_ctxs+0x13/0x60 [bnxt_en]\n __bnxt_open_nic+0x12e/0x780 [bnxt_en]\n bnxt_open+0x10b/0x240 [bnxt_en]\n __dev_open+0xe9/0x180\n __dev_change_flags+0x1af/0x220\n dev_change_flags+0x21/0x60\n do_setlink+0x35c/0x1100\n\nInstead of allocating this big chunk of memory and dividing it up for the\nconcurrent TPA instances, allocate each small chunk separately for each\nTPA instance.  This will reduce it to order-0 allocations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8046a385-b8e6-4919-b69d-df8d9a931792",
      "id": "CVE-2023-53225",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: Don't skip cleanup in remove's error path\n\nReturning early in a platform driver's remove callback is wrong. In this\ncase the dma resources are not released in the error path. this is never\nretried later and so this is a permanent leak. To fix this, only skip\nhardware disabling if waking the device fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "061bc001-b540-408b-a6f3-192614329b1e",
      "id": "CVE-2023-53355",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: pi433: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.  This requires saving off the root directory dentry to make\ncreation of individual device subdirectories easier.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b264eb0c-c714-4fb7-aa0b-5bc0d21ff6db",
      "id": "CVE-2023-53395",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer\n\nACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5\n\nAccording to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode.\n\nWhen ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed.\n\n=============================================================\nUBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpi_operand_object *[9]'\nCPU: 37 PID: 1678 Comm: cat Not tainted\n6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k\nHW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace:\n dump_backtrace+0xe0/0x130\n show_stack+0x20/0x60\n dump_stack_lvl+0x68/0x84\n dump_stack+0x18/0x34\n ubsan_epilogue+0x10/0x50\n __ubsan_handle_out_of_bounds+0x80/0x90\n acpi_ds_exec_end_op+0x1bc/0x6d8\n acpi_ps_parse_loop+0x57c/0x618\n acpi_ps_parse_aml+0x1e0/0x4b4\n acpi_ps_execute_method+0x24c/0x2b8\n acpi_ns_evaluate+0x3a8/0x4bc\n acpi_evaluate_object+0x15c/0x37c\n acpi_evaluate_integer+0x54/0x15c\n show_power+0x8c/0x12c [acpi_power_meter]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef17fe8c-02a7-4550-a353-28370f07c563",
      "id": "CVE-2023-53414",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: snic: Fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b89f496-1f68-4307-b6f0-4728f0fd3857",
      "id": "CVE-2023-6536",
      "description": "A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a868a2dc-f32d-4fff-ae9a-53cc07eb473d",
      "id": "CVE-2024-26589",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject variable offset alu on PTR_TO_FLOW_KEYS\n\nFor PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off\nfor validation. However, variable offset ptr alu is not prohibited\nfor this ptr kind. So the variable offset is not checked.\n\nThe following prog is accepted:\n\n  func#0 @0\n  0: R1=ctx() R10=fp0\n  0: (bf) r6 = r1                       ; R1=ctx() R6_w=ctx()\n  1: (79) r7 = *(u64 *)(r6 +144)        ; R6_w=ctx() R7_w=flow_keys()\n  2: (b7) r8 = 1024                     ; R8_w=1024\n  3: (37) r8 /= 1                       ; R8_w=scalar()\n  4: (57) r8 \u0026= 1024                    ; R8_w=scalar(smin=smin32=0,\n  smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))\n  5: (0f) r7 += r8\n  mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1\n  mark_precise: frame0: regs=r8 stack= before 4: (57) r8 \u0026= 1024\n  mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1\n  mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024\n  6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off\n  =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,\n  var_off=(0x0; 0x400))\n  6: (79) r0 = *(u64 *)(r7 +0)          ; R0_w=scalar()\n  7: (95) exit\n\nThis prog loads flow_keys to r7, and adds the variable offset r8\nto r7, and finally causes out-of-bounds access:\n\n  BUG: unable to handle page fault for address: ffffc90014c80038\n  [...]\n  Call Trace:\n   \u003cTASK\u003e\n   bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]\n   __bpf_prog_run include/linux/filter.h:651 [inline]\n   bpf_prog_run include/linux/filter.h:658 [inline]\n   bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]\n   bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991\n   bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359\n   bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]\n   __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475\n   __do_sys_bpf kernel/bpf/syscall.c:5561 [inline]\n   __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]\n   __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nFix this by rejecting ptr alu with variable offset on flow_keys.\nApplying the patch rejects the program with \"R7 pointer arithmetic\non flow_keys prohibited\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fafa812-7cd7-439f-a092-5bf8f48e8e39",
      "id": "CVE-2024-26733",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: Prevent overflow in arp_req_get().\n\nsyzkaller reported an overflown write in arp_req_get(). [0]\n\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh-\u003eha to struct arpreq.arp_ha.sa_data.\n\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\n\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it's\nnot a problem.\n\nHowever, when dev-\u003eaddr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\n\nTo avoid the overflow, let's limit the max length of memcpy().\n\nNote that commit b5f0de6df6dc (\"net: dev: Convert sa_data to flexible\narray in struct sockaddr\") just silenced syzkaller.\n\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \"r-\u003earp_ha.sa_data\" at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb \u003c0f\u003e 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8773e6cf-1b65-4e8d-9222-4c4af2341549",
      "id": "CVE-2024-26949",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: Fix NULL pointer dereference when get power limit\n\nBecause powerplay_table initialization is skipped under\nsriov case, We check and set default lower and upper OD\nvalue if powerplay_table is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa7f9e6b-d12b-48b8-9abb-e88a90b74137",
      "id": "CVE-2024-35984",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: smbus: fix NULL function pointer dereference\n\nBaruch reported an OOPS when using the designware controller as target\nonly. Target-only modes break the assumption of one transfer function\nalways being available. Fix this by always checking the pointer in\n__i2c_transfer.\n\n[wsa: dropped the simplification in core-smbus to avoid theoretical regressions]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "652bda51-9d88-40fd-83ce-164f72675bc7",
      "id": "CVE-2024-36029",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdhci-msm: pervent access to suspended controller\n\nGeneric sdhci code registers LED device and uses host-\u003eruntime_suspended\nflag to protect access to it. The sdhci-msm driver doesn't set this flag,\nwhich causes a crash when LED is accessed while controller is runtime\nsuspended. Fix this by setting the flag correctly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb64e058-a249-49db-bb19-639a79b75a32",
      "id": "CVE-2024-36974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP\n\nIf one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided,\ntaprio_parse_mqprio_opt() must validate it, or userspace\ncan inject arbitrary data to the kernel, the second time\ntaprio_change() is called.\n\nFirst call (with valid attributes) sets dev-\u003enum_tc\nto a non zero value.\n\nSecond call (with arbitrary mqprio attributes)\nreturns early from taprio_parse_mqprio_opt()\nand bad things can happen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57c976e1-aae7-43f2-b654-a2dd344f7823",
      "id": "CVE-2024-38599",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: prevent xattr node from overflowing the eraseblock\n\nAdd a check to make sure that the requested xattr node size is no larger\nthan the eraseblock minus the cleanmarker.\n\nUnlike the usual inode nodes, the xattr nodes aren't split into parts\nand spread across multiple eraseblocks, which means that a xattr node\nmust not occupy more than one eraseblock. If the requested xattr value is\ntoo large, the xattr node can spill onto the next eraseblock, overwriting\nthe nodes and causing errors such as:\n\njffs2: argh. node added in wrong place at 0x0000b050(2)\njffs2: nextblock 0x0000a000, expected at 0000b00c\njffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050,\nread=0xfc892c93, calc=0x000000\njffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed\nat 0x01e00c. {848f,2fc4,0fef511f,59a3d171}\njffs2: Node at 0x0000000c with length 0x00001044 would run over the\nend of the erase block\njffs2: Perhaps the file system was created with the wrong erase size?\njffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found\nat 0x00000010: 0x1044 instead\n\nThis breaks the filesystem and can lead to KASAN crashes such as:\n\nBUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0\nRead of size 4 at addr ffff88802c31e914 by task repro/830\nCPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS Arch Linux 1.16.3-1-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xc4/0x620\n ? __virt_addr_valid+0x308/0x5b0\n kasan_report+0xc1/0xf0\n ? jffs2_sum_add_kvec+0x125e/0x15d0\n ? jffs2_sum_add_kvec+0x125e/0x15d0\n jffs2_sum_add_kvec+0x125e/0x15d0\n jffs2_flash_direct_writev+0xa8/0xd0\n jffs2_flash_writev+0x9c9/0xef0\n ? __x64_sys_setxattr+0xc4/0x160\n ? do_syscall_64+0x69/0x140\n ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [...]\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0441af39-27ba-4be4-8220-9a7a877e27ff",
      "id": "CVE-2024-42074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp: add a null check for chip_pdev structure\n\nWhen acp platform device creation is skipped, chip-\u003echip_pdev value will\nremain NULL. Add NULL check for chip-\u003echip_pdev structure in\nsnd_acp_resume() function to avoid null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4a106771-40f3-4673-aa0e-0ddba87c42fd",
      "id": "CVE-2024-47692",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: return -EINVAL when namelen is 0\n\nWhen we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may\nresult in namelen being 0, which will cause memdup_user() to return\nZERO_SIZE_PTR.\nWhen we access the name.data that has been assigned the value of\nZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is\ntriggered.\n\n[ T1205] ==================================================================\n[ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260\n[ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205\n[ T1205]\n[ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406\n[ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014\n[ T1205] Call Trace:\n[ T1205]  dump_stack+0x9a/0xd0\n[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260\n[ T1205]  __kasan_report.cold+0x34/0x84\n[ T1205]  ? nfs4_client_to_reclaim+0xe9/0x260\n[ T1205]  kasan_report+0x3a/0x50\n[ T1205]  nfs4_client_to_reclaim+0xe9/0x260\n[ T1205]  ? nfsd4_release_lockowner+0x410/0x410\n[ T1205]  cld_pipe_downcall+0x5ca/0x760\n[ T1205]  ? nfsd4_cld_tracking_exit+0x1d0/0x1d0\n[ T1205]  ? down_write_killable_nested+0x170/0x170\n[ T1205]  ? avc_policy_seqno+0x28/0x40\n[ T1205]  ? selinux_file_permission+0x1b4/0x1e0\n[ T1205]  rpc_pipe_write+0x84/0xb0\n[ T1205]  vfs_write+0x143/0x520\n[ T1205]  ksys_write+0xc9/0x170\n[ T1205]  ? __ia32_sys_read+0x50/0x50\n[ T1205]  ? ktime_get_coarse_real_ts64+0xfe/0x110\n[ T1205]  ? ktime_get_coarse_real_ts64+0xa2/0x110\n[ T1205]  do_syscall_64+0x33/0x40\n[ T1205]  entry_SYSCALL_64_after_hwframe+0x67/0xd1\n[ T1205] RIP: 0033:0x7fdbdb761bc7\n[ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 514\n[ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7\n[ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008\n[ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001\n[ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b\n[ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000\n[ T1205] ==================================================================\n\nFix it by checking namelen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ca6aebc1-6519-42a0-9e84-9c5c36fff257",
      "id": "CVE-2024-49863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/scsi: null-ptr-dereference in vhost_scsi_get_req()\n\nSince commit 3f8ca2e115e5 (\"vhost/scsi: Extract common handling code\nfrom control queue handler\") a null pointer dereference bug can be\ntriggered when guest sends an SCSI AN request.\n\nIn vhost_scsi_ctl_handle_vq(), `vc.target` is assigned with\n`\u0026v_req.tmf.lun[1]` within a switch-case block and is then passed to\nvhost_scsi_get_req() which extracts `vc-\u003ereq` and `tpg`. However, for\na `VIRTIO_SCSI_T_AN_*` request, tpg is not required, so `vc.target` is\nset to NULL in this branch. Later, in vhost_scsi_get_req(),\n`vc-\u003etarget` is dereferenced without being checked, leading to a null\npointer dereference bug. This bug can be triggered from guest.\n\nWhen this bug occurs, the vhost_worker process is killed while holding\n`vq-\u003emutex` and the corresponding tpg will remain occupied\nindefinitely.\n\nBelow is the KASAN report:\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 PID: 840 Comm: poc Not tainted 6.10.0+ #1\nHardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS\n1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:vhost_scsi_get_req+0x165/0x3a0\nCode: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 02 00 00\n48 b8 00 00 00 00 00 fc ff df 4d 8b 65 30 4c 89 e2 48 c1 ea 03 \u003c0f\u003e b6\n04 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 be 01 00 00\nRSP: 0018:ffff888017affb50 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffff88801b000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8\nRBP: ffff888017affb80 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff888017affc88 R14: ffff888017affd1c R15: ffff888017993000\nFS:  000055556e076500(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200027c0 CR3: 0000000010ed0004 CR4: 0000000000370ef0\nCall Trace:\n \u003cTASK\u003e\n ? show_regs+0x86/0xa0\n ? die_addr+0x4b/0xd0\n ? exc_general_protection+0x163/0x260\n ? asm_exc_general_protection+0x27/0x30\n ? vhost_scsi_get_req+0x165/0x3a0\n vhost_scsi_ctl_handle_vq+0x2a4/0xca0\n ? __pfx_vhost_scsi_ctl_handle_vq+0x10/0x10\n ? __switch_to+0x721/0xeb0\n ? __schedule+0xda5/0x5710\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_lock+0x82/0xf0\n vhost_scsi_ctl_handle_kick+0x52/0x90\n vhost_run_work_list+0x134/0x1b0\n vhost_task_fn+0x121/0x350\n...\n \u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---\n\nLet's add a check in vhost_scsi_get_req.\n\n[whitespace fixes]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cfbbc3c-78bd-408c-9f74-507045d08dbc",
      "id": "CVE-2024-49935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe kernel occasionally crashes in cpumask_clear_cpu(), which is called\nwithin exit_round_robin(), because when executing clear_bit(nr, addr) with\nnr set to 0xffffffff, the address calculation may cause misalignment within\nthe memory, leading to access to an invalid memory address.\n\n----------\nBUG: unable to handle kernel paging request at ffffffffe0740618\n        ...\nCPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G           OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1\n        ...\nRIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]\nCode: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 \u003cf0\u003e 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31\nRSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202\nRAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\nRBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e\nR13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e\nFS:  0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ? acpi_pad_add+0x120/0x120 [acpi_pad]\n kthread+0x10b/0x130\n ? set_kthread_struct+0x50/0x50\n ret_from_fork+0x1f/0x40\n        ...\nCR2: ffffffffe0740618\n\ncrash\u003e dis -lr ffffffffc0726923\n        ...\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114\n0xffffffffc0726918 \u003cpower_saving_thread+776\u003e:\tmov    %r12d,%r12d\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325\n0xffffffffc072691b \u003cpower_saving_thread+779\u003e:\tmov    -0x3f8d7de0(,%r12,4),%eax\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80\n0xffffffffc0726923 \u003cpower_saving_thread+787\u003e:\tlock btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 \u003cpad_busy_cpus_bits\u003e\n\ncrash\u003e px tsk_in_cpu[14]\n$66 = 0xffffffff\n\ncrash\u003e px 0xffffffffc072692c+0x19cf4\n$99 = 0xffffffffc0740620\n\ncrash\u003e sym 0xffffffffc0740620\nffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]\n\ncrash\u003e px pad_busy_cpus_bits[0]\n$42 = 0xfffc0\n----------\n\nTo fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling\ncpumask_clear_cpu() in exit_round_robin(), just as it is done in\nround_robin_cpu().\n\n[ rjw: Subject edit, avoid updates to the same value ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d66a3cd-b592-41e5-be66-0eb197d2d777",
      "id": "CVE-2024-49952",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: prevent nf_skb_duplicated corruption\n\nsyzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write\nper-cpu variable nf_skb_duplicated in an unsafe way [1].\n\nDisabling preemption as hinted by the splat is not enough,\nwe have to disable soft interrupts as well.\n\n[1]\nBUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316\n caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87\nCPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:93 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n  check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49\n  nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87\n  nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30\n  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n  nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288\n  nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626\n  nf_hook+0x2c4/0x450 include/linux/netfilter.h:269\n  NF_HOOK_COND include/linux/netfilter.h:302 [inline]\n  ip_output+0x185/0x230 net/ipv4/ip_output.c:433\n  ip_local_out net/ipv4/ip_output.c:129 [inline]\n  ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495\n  udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981\n  udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597\n  ___sys_sendmsg net/socket.c:2651 [inline]\n  __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737\n  __do_sys_sendmmsg net/socket.c:2766 [inline]\n  __se_sys_sendmmsg net/socket.c:2763 [inline]\n  __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f4ce4f7def9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133\nRAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9\nRDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006\nRBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d08c2e6-d444-48ae-b05a-98c5cd337366",
      "id": "CVE-2024-50237",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: do not pass a stopped vif to the driver in .get_txpower\n\nAvoid potentially crashing in the driver because of uninitialized private data",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9296c15c-dd0c-4b4e-a423-5813a89c3e3b",
      "id": "CVE-2024-53089",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Mark hrtimer to expire in hard interrupt context\n\nLike commit 2c0d278f3293f (\"KVM: LAPIC: Mark hrtimer to expire in hard\ninterrupt context\") and commit 9090825fa9974 (\"KVM: arm/arm64: Let the\ntimer expire in hardirq context on RT\"), On PREEMPT_RT enabled kernels\nunmarked hrtimers are moved into soft interrupt expiry mode by default.\nThen the timers are canceled from an preempt-notifier which is invoked\nwith disabled preemption which is not allowed on PREEMPT_RT.\n\nThe timer callback is short so in could be invoked in hard-IRQ context.\nSo let the timer expire on hard-IRQ context even on -RT.\n\nThis fix a \"scheduling while atomic\" bug for PREEMPT_RT enabled kernels:\n\n BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002\n Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns\n CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G        W          6.12.0-rc2+ #1774\n Tainted: [W]=WARN\n Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022\n Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000\n         90000001167475a0 0000000000000000 90000001167475a8 9000000005644830\n         90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001\n         0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140\n         00000000000003fe 0000000000000001 000000000000000d 0000000000000003\n         0000000000000030 00000000000003f3 000000000790c000 9000000116747830\n         90000000057ef000 0000000000000000 9000000005644830 0000000000000004\n         0000000000000000 90000000057f4b58 0000000000000001 9000000116747868\n         900000000451b600 9000000005644830 9000000003a13998 0000000010000020\n         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d\n         ...\n Call Trace:\n [\u003c9000000003a13998\u003e] show_stack+0x38/0x180\n [\u003c9000000004e3ea34\u003e] dump_stack_lvl+0x84/0xc0\n [\u003c9000000003a71708\u003e] __schedule_bug+0x48/0x60\n [\u003c9000000004e45734\u003e] __schedule+0x1114/0x1660\n [\u003c9000000004e46040\u003e] schedule_rtlock+0x20/0x60\n [\u003c9000000004e4e330\u003e] rtlock_slowlock_locked+0x3f0/0x10a0\n [\u003c9000000004e4f038\u003e] rt_spin_lock+0x58/0x80\n [\u003c9000000003b02d68\u003e] hrtimer_cancel_wait_running+0x68/0xc0\n [\u003c9000000003b02e30\u003e] hrtimer_cancel+0x70/0x80\n [\u003cffff80000235eb70\u003e] kvm_restore_timer+0x50/0x1a0 [kvm]\n [\u003cffff8000023616c8\u003e] kvm_arch_vcpu_load+0x68/0x2a0 [kvm]\n [\u003cffff80000234c2d4\u003e] kvm_sched_in+0x34/0x60 [kvm]\n [\u003c9000000003a749a0\u003e] finish_task_switch.isra.0+0x140/0x2e0\n [\u003c9000000004e44a70\u003e] __schedule+0x450/0x1660\n [\u003c9000000004e45cb0\u003e] schedule+0x30/0x180\n [\u003cffff800002354c70\u003e] kvm_vcpu_block+0x70/0x120 [kvm]\n [\u003cffff800002354d80\u003e] kvm_vcpu_halt+0x60/0x3e0 [kvm]\n [\u003cffff80000235b194\u003e] kvm_handle_gspr+0x3f4/0x4e0 [kvm]\n [\u003cffff80000235f548\u003e] kvm_handle_exit+0x1c8/0x260 [kvm]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79a2c4b9-7390-4bec-83b7-da504771b20b",
      "id": "CVE-2024-53100",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: tcp: avoid race between queue_lock lock and destroy\n\nCommit 76d54bf20cdc (\"nvme-tcp: don't access released socket during\nerror recovery\") added a mutex_lock() call for the queue-\u003equeue_lock\nin nvme_tcp_get_address(). However, the mutex_lock() races with\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\n\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:__mutex_lock+0xcf0/0x1220\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u003c0f\u003e 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\nFS:  00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? __warn.cold+0x5b/0x1af\n ? __mutex_lock+0xcf0/0x1220\n ? report_bug+0x1ec/0x390\n ? handle_bug+0x3c/0x80\n ? exc_invalid_op+0x13/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? __mutex_lock+0xcf0/0x1220\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx___mutex_lock+0x10/0x10\n ? __lock_acquire+0xd6a/0x59e0\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\n dev_attr_show+0x42/0x80\n ? __asan_memset+0x1f/0x40\n sysfs_kf_seq_show+0x1f0/0x370\n seq_read_iter+0x2cb/0x1130\n ? rw_verify_area+0x3b1/0x590\n ? __mutex_lock+0x433/0x1220\n vfs_read+0x6a6/0xa20\n ? lockdep_hardirqs_on+0x78/0x100\n ? __pfx_vfs_read+0x10/0x10\n ksys_read+0xf7/0x1d0\n ? __pfx_ksys_read+0x10/0x10\n ? __x64_sys_openat+0x105/0x1d0\n do_syscall_64+0x93/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? __pfx_ksys_read+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? do_syscall_64+0x9f/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f9713f55cfa\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c4a1d13-e6d9-4175-b0cf-5318e6228ed7",
      "id": "CVE-2024-53220",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to account dirty data in __get_secs_required()\n\nIt will trigger system panic w/ testcase in [1]:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2752!\nRIP: 0010:new_curseg+0xc81/0x2110\nCall Trace:\n f2fs_allocate_data_block+0x1c91/0x4540\n do_write_page+0x163/0xdf0\n f2fs_outplace_write_data+0x1aa/0x340\n f2fs_do_write_data_page+0x797/0x2280\n f2fs_write_single_data_page+0x16cd/0x2190\n f2fs_write_cache_pages+0x994/0x1c80\n f2fs_write_data_pages+0x9cc/0xea0\n do_writepages+0x194/0x7a0\n filemap_fdatawrite_wbc+0x12b/0x1a0\n __filemap_fdatawrite_range+0xbb/0xf0\n file_write_and_wait_range+0xa1/0x110\n f2fs_do_sync_file+0x26f/0x1c50\n f2fs_sync_file+0x12b/0x1d0\n vfs_fsync_range+0xfa/0x230\n do_fsync+0x3d/0x80\n __x64_sys_fsync+0x37/0x50\n x64_sys_call+0x1e88/0x20d0\n do_syscall_64+0x4b/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe root cause is if checkpoint_disabling and lfs_mode are both on,\nit will trigger OPU for all overwritten data, it may cost more free\nsegment than expected, so f2fs must account those data correctly to\ncalculate cosumed free segments later, and return ENOSPC earlier to\navoid run out of free segment during block allocation.\n\n[1] https://lore.kernel.org/fstests/20241015025106.3203676-1-chao@kernel.org/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a618c6e-c4c0-4382-b7b8-1f1fdaff9479",
      "id": "CVE-2024-56581",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: ref-verify: fix use-after-free after invalid ref action\n\nAt btrfs_ref_tree_mod() after we successfully inserted the new ref entry\n(local variable 'ref') into the respective block entry's rbtree (local\nvariable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,\nwe error out and free the ref entry without removing it from the block\nentry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call\nbtrfs_free_ref_cache(), which iterates over all block entries and then\ncalls free_block_entry() for each one, and there we will trigger a\nuse-after-free when we are called against the block entry to which we\nadded the freed ref entry to its rbtree, since the rbtree still points\nto the block entry, as we didn't remove it from the rbtree before freeing\nit in the error path at btrfs_ref_tree_mod(). Fix this by removing the\nnew ref entry from the rbtree before freeing it.\n\nSyzbot report this with the following stack traces:\n\n   BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615\n      __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523\n      update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512\n      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594\n      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754\n      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116\n      btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314\n      btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]\n      btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23\n      btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482\n      btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293\n      vfs_unlink+0x365/0x650 fs/namei.c:4469\n      do_unlinkat+0x4ae/0x830 fs/namei.c:4533\n      __do_sys_unlinkat fs/namei.c:4576 [inline]\n      __se_sys_unlinkat fs/namei.c:4569 [inline]\n      __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569\n      do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n      do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n      entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   BTRFS error (device loop0 state EA):   Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1\n      __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521\n      update_ref_for_cow+0x96a/0x11f0\n      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594\n      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754\n      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116\n      btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411\n      __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030\n      btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]\n      __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137\n      __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171\n      btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313\n      prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586\n      relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611\n      btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081\n      btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377\n      __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161\n      btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538\n   BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615\n      __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523\n      update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512\n      btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594\n      btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754\n      btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116\n      btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411\n      __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030\n      btrfs_update_delayed_i\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7b967af-b6a6-405a-a8ca-3d921c09835a",
      "id": "CVE-2024-57931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: ignore unknown extended permissions\n\nWhen evaluating extended permissions, ignore unknown permissions instead\nof calling BUG(). This commit ensures that future permissions can be\nadded without interfering with older kernels.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f9dfcf7c-0b41-4b74-9065-32e85ac453e7",
      "id": "CVE-2024-58071",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: prevent adding a device which is already a team device lower\n\nPrevent adding a device which is already a team device lower,\ne.g. adding veth0 if vlan1 was already added and veth0 is a lower of\nvlan1.\n\nThis is not useful in practice and can lead to recursive locking:\n\n$ ip link add veth0 type veth peer name veth1\n$ ip link set veth0 up\n$ ip link set veth1 up\n$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1\n$ ip link add team0 type team\n$ ip link set veth0.1 down\n$ ip link set veth0.1 master team0\nteam0: Port device veth0.1 added\n$ ip link set veth0 down\n$ ip link set veth0 master team0\n\n============================================\nWARNING: possible recursive locking detected\n6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted\n--------------------------------------------\nip/7684 is trying to acquire lock:\nffff888016848e00 (team-\u003eteam_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n\nbut task is already holding lock:\nffff888016848e00 (team-\u003eteam_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977)\n\nother info that might help us debug this:\nPossible unsafe locking scenario:\n\nCPU0\n----\nlock(team-\u003eteam_lock_key);\nlock(team-\u003eteam_lock_key);\n\n*** DEADLOCK ***\n\nMay be due to missing lock nesting notation\n\n2 locks held by ip/7684:\n\nstack backtrace:\nCPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl (lib/dump_stack.c:122)\nprint_deadlock_bug.cold (kernel/locking/lockdep.c:3040)\n__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226)\n? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548)\nlock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2))\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? lock_acquire (kernel/locking/lockdep.c:5822)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\n? fib_sync_up (net/ipv4/fib_semantics.c:2167)\n? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\nteam_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)\nnotifier_call_chain (kernel/notifier.c:85)\ncall_netdevice_notifiers_info (net/core/dev.c:1996)\n__dev_notify_flags (net/core/dev.c:8993)\n? __dev_change_flags (net/core/dev.c:8975)\ndev_change_flags (net/core/dev.c:9027)\nvlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470)\n? br_device_event (net/bridge/br.c:143)\nnotifier_call_chain (kernel/notifier.c:85)\ncall_netdevice_notifiers_info (net/core/dev.c:1996)\ndev_open (net/core/dev.c:1519 net/core/dev.c:1505)\nteam_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977)\n? __pfx_team_add_slave (drivers/net/team/team_core.c:1972)\ndo_set_master (net/core/rtnetlink.c:2917)\ndo_setlink.isra.0 (net/core/rtnetlink.c:3117)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32eddc5b-bae2-4380-98b5-668bf911b7c6",
      "id": "CVE-2025-21765",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU protection in ip6_default_advmss()\n\nip6_default_advmss() needs rcu protection to make\nsure the net structure it reads does not disappear.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c596626-538d-478a-9eb6-5568cf5d10c5",
      "id": "CVE-2025-21985",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bound accesses\n\n[WHAT \u0026 HOW]\nhpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),\nbut location can have size up to 6. As a result, it is necessary to\ncheck location against MAX_HPO_DP2_ENCODERS.\n\nSimiliarly, disp_cfg_stream_location can be used as an array index which\nshould be 0..5, so the ASSERT's conditions should be less without equal.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d97f4517-02e8-4800-b0d5-b11381332692",
      "id": "CVE-2025-37991",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix double SIGFPE crash\n\nCamm noticed that on parisc a SIGFPE exception will crash an application with\na second SIGFPE in the signal handler.  Dave analyzed it, and it happens\nbecause glibc uses a double-word floating-point store to atomically update\nfunction descriptors. As a result of lazy binding, we hit a floating-point\nstore in fpe_func almost immediately.\n\nWhen the T bit is set, an assist exception trap occurs when when the\nco-processor encounters *any* floating-point instruction except for a double\nstore of register %fr0.  The latter cancels all pending traps.  Let's fix this\nby clearing the Trap (T) bit in the FP status register before returning to the\nsignal handler in userspace.\n\nThe issue can be reproduced with this test program:\n\nroot@parisc:~# cat fpe.c\n\nstatic void fpe_func(int sig, siginfo_t *i, void *v) {\n        sigset_t set;\n        sigemptyset(\u0026set);\n        sigaddset(\u0026set, SIGFPE);\n        sigprocmask(SIG_UNBLOCK, \u0026set, NULL);\n        printf(\"GOT signal %d with si_code %ld\\n\", sig, i-\u003esi_code);\n}\n\nint main() {\n        struct sigaction action = {\n                .sa_sigaction = fpe_func,\n                .sa_flags = SA_RESTART|SA_SIGINFO };\n        sigaction(SIGFPE, \u0026action, 0);\n        feenableexcept(FE_OVERFLOW);\n        return printf(\"%lf\\n\",1.7976931348623158E308*1.7976931348623158E308);\n}\n\nroot@parisc:~# gcc fpe.c -lm\nroot@parisc:~# ./a.out\n Floating point exception\n\nroot@parisc:~# strace -f ./a.out\n execve(\"./a.out\", [\"./a.out\"], 0xf9ac7034 /* 20 vars */) = 0\n getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0\n ...\n rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0\n --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} ---\n --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} ---\n +++ killed by SIGFPE +++\n Floating point exception",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "226cfb07-af26-4260-9d70-ec79c247472e",
      "id": "CVE-2025-38135",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: Fix potential null-ptr-deref in mlb_usio_probe()\n\ndevm_ioremap() can return NULL on error. Currently, mlb_usio_probe()\ndoes not check for this case, which could result in a NULL pointer\ndereference.\n\nAdd NULL check after devm_ioremap() to prevent this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0d11c64-c518-4efc-a17b-b04233f033d2",
      "id": "CVE-2025-38666",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: Fix use-after-free in AARP proxy probe\n\nThe AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe,\nreleases the aarp_lock, sleeps, then re-acquires the lock.  During that\nwindow an expire timer thread (__aarp_expire_timer) can remove and\nkfree() the same entry, leading to a use-after-free.\n\nrace condition:\n\n         cpu 0                          |            cpu 1\n    atalk_sendmsg()                     |   atif_proxy_probe_device()\n    aarp_send_ddp()                     |   aarp_proxy_probe_network()\n    mod_timer()                         |   lock(aarp_lock) // LOCK!!\n    timeout around 200ms                |   alloc(aarp_entry)\n    and then call                       |   proxies[hash] = aarp_entry\n    aarp_expire_timeout()               |   aarp_send_probe()\n                                        |   unlock(aarp_lock) // UNLOCK!!\n    lock(aarp_lock) // LOCK!!           |   msleep(100);\n    __aarp_expire_timer(\u0026proxies[ct])   |\n    free(aarp_entry)                    |\n    unlock(aarp_lock) // UNLOCK!!       |\n                                        |   lock(aarp_lock) // LOCK!!\n                                        |   UAF aarp_entry !!\n\n==================================================================\nBUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493\nRead of size 4 at addr ffff8880123aa360 by task repro/13278\n\nCPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full)\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc1/0x630 mm/kasan/report.c:521\n kasan_report+0xca/0x100 mm/kasan/report.c:634\n aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493\n atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]\n atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857\n atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818\n sock_do_ioctl+0xdc/0x260 net/socket.c:1190\n sock_ioctl+0x239/0x6a0 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nAllocated:\n aarp_alloc net/appletalk/aarp.c:382 [inline]\n aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468\n atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]\n atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857\n atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818\n\nFreed:\n kfree+0x148/0x4d0 mm/slub.c:4841\n __aarp_expire net/appletalk/aarp.c:90 [inline]\n __aarp_expire_timer net/appletalk/aarp.c:261 [inline]\n aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317\n\nThe buggy address belongs to the object at ffff8880123aa300\n which belongs to the cache kmalloc-192 of size 192\nThe buggy address is located 96 bytes inside of\n freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0)\n\nMemory state around the buggy address:\n ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                                       ^\n ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb6b672b-b9ad-4680-b217-2172358ee580",
      "id": "CVE-2020-24588",
      "description": "The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "809645eb-25a8-4478-b3b3-f5acd8dbd067",
      "id": "CVE-2020-36788",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: avoid a use-after-free when BO init fails\n\nnouveau_bo_init() is backed by ttm_bo_init() and ferries its return code\nback to the caller. On failures, ttm_bo_init() invokes the provided\ndestructor which should de-initialize and free the memory.\n\nThus, when nouveau_bo_init() returns an error the gem object has already\nbeen released and the memory freed by nouveau_bo_del_ttm().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94072fdd-e4cc-4a13-a99a-16acc0c415c1",
      "id": "CVE-2021-29646",
      "description": "An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59fb6317-d932-40f9-b4e1-ac06ec45cc1b",
      "id": "CVE-2021-30178",
      "description": "An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7df05da2-bb58-4117-a89f-4b6f04bfb8e2",
      "id": "CVE-2021-45480",
      "description": "An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1489e55b-f347-4050-9749-b251a5890f87",
      "id": "CVE-2021-46989",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: prevent corruption in shrinking truncate\n\nI believe there are some issues introduced by commit 31651c607151\n(\"hfsplus: avoid deadlock on file truncation\")\n\nHFS+ has extent records which always contains 8 extents.  In case the\nfirst extent record in catalog file gets full, new ones are allocated from\nextents overflow file.\n\nIn case shrinking truncate happens to middle of an extent record which\nlocates in extents overflow file, the logic in hfsplus_file_truncate() was\nchanged so that call to hfs_brec_remove() is not guarded any more.\n\nRight action would be just freeing the extents that exceed the new size\ninside extent record by calling hfsplus_free_extents(), and then check if\nthe whole extent record should be removed.  However since the guard\n(blk_cnt \u003e start) is now after the call to hfs_brec_remove(), this has\nunfortunate effect that the last matching extent record is removed\nunconditionally.\n\nTo reproduce this issue, create a file which has at least 10 extents, and\nthen perform shrinking truncate into middle of the last extent record, so\nthat the number of remaining extents is not under or divisible by 8.  This\ncauses the last extent record (8 extents) to be removed totally instead of\ntruncating into middle of it.  Thus this causes corruption, and lost data.\n\nFix for this is simply checking if the new truncated end is below the\nstart of this extent record, making it safe to remove the full extent\nrecord.  However call to hfs_brec_remove() can't be moved to it's previous\nplace since we're dropping -\u003etree_lock and it can cause a race condition\nand the cached info being invalidated possibly corrupting the node data.\n\nAnother issue is related to this one.  When entering into the block\n(blk_cnt \u003e start) we are not holding the -\u003etree_lock.  We break out from\nthe loop not holding the lock, but hfs_find_exit() does unlock it.  Not\nsure if it's possible for someone else to take the lock under our feet,\nbut it can cause hard to debug errors and premature unlocking.  Even if\nthere's no real risk of it, the locking should still always be kept in\nbalance.  Thus taking the lock now just before the check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4811b9e1-c781-4370-83a5-0a901026fc47",
      "id": "CVE-2021-47256",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/memory-failure: make sure wait for page writeback in memory_failure\n\nOur syzkaller trigger the \"BUG_ON(!list_empty(\u0026inode-\u003ei_wb_list))\" in\nclear_inode:\n\n  kernel BUG at fs/inode.c:519!\n  Internal error: Oops - BUG: 0 [#1] SMP\n  Modules linked in:\n  Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7)\n  CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95\n  Hardware name: linux,dummy-virt (DT)\n  pstate: 80000005 (Nzcv daif -PAN -UAO)\n  pc : clear_inode+0x280/0x2a8\n  lr : clear_inode+0x280/0x2a8\n  Call trace:\n    clear_inode+0x280/0x2a8\n    ext4_clear_inode+0x38/0xe8\n    ext4_free_inode+0x130/0xc68\n    ext4_evict_inode+0xb20/0xcb8\n    evict+0x1a8/0x3c0\n    iput+0x344/0x460\n    do_unlinkat+0x260/0x410\n    __arm64_sys_unlinkat+0x6c/0xc0\n    el0_svc_common+0xdc/0x3b0\n    el0_svc_handler+0xf8/0x160\n    el0_svc+0x10/0x218\n  Kernel panic - not syncing: Fatal exception\n\nA crash dump of this problem show that someone called __munlock_pagevec\nto clear page LRU without lock_page: do_mmap -\u003e mmap_region -\u003e do_munmap\n-\u003e munlock_vma_pages_range -\u003e __munlock_pagevec.\n\nAs a result memory_failure will call identify_page_state without\nwait_on_page_writeback.  And after truncate_error_page clear the mapping\nof this page.  end_page_writeback won't call sb_clear_inode_writeback to\nclear inode-\u003ei_wb_list.  That will trigger BUG_ON in clear_inode!\n\nFix it by checking PageWriteback too to help determine should we skip\nwait_on_page_writeback.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7052b4e5-5fa7-4b83-a248-eccf01527d6a",
      "id": "CVE-2021-47618",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9170/1: fix panic when kasan and kprobe are enabled\n\narm32 uses software to simulate the instruction replaced\nby kprobe. some instructions may be simulated by constructing\nassembly functions. therefore, before executing instruction\nsimulation, it is necessary to construct assembly function\nexecution environment in C language through binding registers.\nafter kasan is enabled, the register binding relationship will\nbe destroyed, resulting in instruction simulation errors and\ncausing kernel panic.\n\nthe kprobe emulate instruction function is distributed in three\nfiles: actions-common.c actions-arm.c actions-thumb.c, so disable\nKASAN when compiling these files.\n\nfor example, use kprobe insert on cap_capable+20 after kasan\nenabled, the cap_capable assembly code is as follows:\n\u003ccap_capable\u003e:\ne92d47f0\tpush\t{r4, r5, r6, r7, r8, r9, sl, lr}\ne1a05000\tmov\tr5, r0\ne280006c\tadd\tr0, r0, #108    ; 0x6c\ne1a04001\tmov\tr4, r1\ne1a06002\tmov\tr6, r2\ne59fa090\tldr\tsl, [pc, #144]  ;\nebfc7bf8\tbl\tc03aa4b4 \u003c__asan_load4\u003e\ne595706c\tldr\tr7, [r5, #108]  ; 0x6c\ne2859014\tadd\tr9, r5, #20\n......\nThe emulate_ldr assembly code after enabling kasan is as follows:\nc06f1384 \u003cemulate_ldr\u003e:\ne92d47f0\tpush\t{r4, r5, r6, r7, r8, r9, sl, lr}\ne282803c\tadd\tr8, r2, #60     ; 0x3c\ne1a05000\tmov\tr5, r0\ne7e37855\tubfx\tr7, r5, #16, #4\ne1a00008\tmov\tr0, r8\ne1a09001\tmov\tr9, r1\ne1a04002\tmov\tr4, r2\nebf35462\tbl\tc03c6530 \u003c__asan_load4\u003e\ne357000f\tcmp\tr7, #15\ne7e36655\tubfx\tr6, r5, #12, #4\ne205a00f\tand\tsl, r5, #15\n0a000001\tbeq\tc06f13bc \u003cemulate_ldr+0x38\u003e\ne0840107\tadd\tr0, r4, r7, lsl #2\nebf3545c\tbl\tc03c6530 \u003c__asan_load4\u003e\ne084010a\tadd\tr0, r4, sl, lsl #2\nebf3545a\tbl\tc03c6530 \u003c__asan_load4\u003e\ne2890010\tadd\tr0, r9, #16\nebf35458\tbl\tc03c6530 \u003c__asan_load4\u003e\ne5990010\tldr\tr0, [r9, #16]\ne12fff30\tblx\tr0\ne356000f\tcm\tr6, #15\n1a000014\tbne\tc06f1430 \u003cemulate_ldr+0xac\u003e\ne1a06000\tmov\tr6, r0\ne2840040\tadd\tr0, r4, #64     ; 0x40\n......\n\nwhen running in emulate_ldr to simulate the ldr instruction, panic\noccurred, and the log is as follows:\nUnable to handle kernel NULL pointer dereference at virtual address\n00000090\npgd = ecb46400\n[00000090] *pgd=2e0fa003, *pmd=00000000\nInternal error: Oops: 206 [#1] SMP ARM\nPC is at cap_capable+0x14/0xb0\nLR is at emulate_ldr+0x50/0xc0\npsr: 600d0293 sp : ecd63af8  ip : 00000004  fp : c0a7c30c\nr10: 00000000  r9 : c30897f4  r8 : ecd63cd4\nr7 : 0000000f  r6 : 0000000a  r5 : e59fa090  r4 : ecd63c98\nr3 : c06ae294  r2 : 00000000  r1 : b7611300  r0 : bf4ec008\nFlags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user\nControl: 32c5387d  Table: 2d546400  DAC: 55555555\nProcess bash (pid: 1643, stack limit = 0xecd60190)\n(cap_capable) from (kprobe_handler+0x218/0x340)\n(kprobe_handler) from (kprobe_trap_handler+0x24/0x48)\n(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364)\n(do_undefinstr) from (__und_svc_finish+0x0/0x30)\n(__und_svc_finish) from (cap_capable+0x18/0xb0)\n(cap_capable) from (cap_vm_enough_memory+0x38/0x48)\n(cap_vm_enough_memory) from\n(security_vm_enough_memory_mm+0x48/0x6c)\n(security_vm_enough_memory_mm) from\n(copy_process.constprop.5+0x16b4/0x25c8)\n(copy_process.constprop.5) from (_do_fork+0xe8/0x55c)\n(_do_fork) from (SyS_clone+0x1c/0x24)\n(SyS_clone) from (__sys_trace_return+0x0/0x10)\nCode: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c6c7f3d-3342-4c73-aaec-268988428326",
      "id": "CVE-2022-29581",
      "description": "Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e8feb4a-0f41-4715-bc8b-6f61d1b358e9",
      "id": "CVE-2022-3303",
      "description": "A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa8a66a5-a493-4a61-9de4-3c40911bebb2",
      "id": "CVE-2022-45934",
      "description": "An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6e4f9e2-00d6-4757-a0b5-50ee8b73884d",
      "id": "CVE-2022-48710",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix a possible null pointer dereference\n\nIn radeon_fp_native_mode(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.\n\nThe failure status of drm_cvt_mode() on the other path is checked too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06a44153-f3ed-4790-b810-e3025fe6cbc7",
      "id": "CVE-2022-48919",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix double free race when mount fails in cifs_get_root()\n\nWhen cifs_get_root() fails during cifs_smb3_do_mount() we call\ndeactivate_locked_super() which eventually will call delayed_free() which\nwill free the context.\nIn this situation we should not proceed to enter the out: section in\ncifs_smb3_do_mount() and free the same resources a second time.\n\n[Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0\n\n[Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G           OE     5.17.0-rc3+ #4\n[Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019\n[Thu Feb 10 12:59:06 2022] Call Trace:\n[Thu Feb 10 12:59:06 2022]  \u003cIRQ\u003e\n[Thu Feb 10 12:59:06 2022]  dump_stack_lvl+0x5d/0x78\n[Thu Feb 10 12:59:06 2022]  print_address_description.constprop.0+0x24/0x150\n[Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022]  kasan_report.cold+0x7d/0x117\n[Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022]  __asan_load8+0x86/0xa0\n[Thu Feb 10 12:59:06 2022]  rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022]  rcu_core+0x547/0xca0\n[Thu Feb 10 12:59:06 2022]  ? call_rcu+0x3c0/0x3c0\n[Thu Feb 10 12:59:06 2022]  ? __this_cpu_preempt_check+0x13/0x20\n[Thu Feb 10 12:59:06 2022]  ? lock_is_held_type+0xea/0x140\n[Thu Feb 10 12:59:06 2022]  rcu_core_si+0xe/0x10\n[Thu Feb 10 12:59:06 2022]  __do_softirq+0x1d4/0x67b\n[Thu Feb 10 12:59:06 2022]  __irq_exit_rcu+0x100/0x150\n[Thu Feb 10 12:59:06 2022]  irq_exit_rcu+0xe/0x30\n[Thu Feb 10 12:59:06 2022]  sysvec_hyperv_stimer0+0x9d/0xc0\n...\n[Thu Feb 10 12:59:07 2022] Freed by task 58179:\n[Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50\n[Thu Feb 10 12:59:07 2022]  kasan_set_track+0x25/0x30\n[Thu Feb 10 12:59:07 2022]  kasan_set_free_info+0x24/0x40\n[Thu Feb 10 12:59:07 2022]  ____kasan_slab_free+0x137/0x170\n[Thu Feb 10 12:59:07 2022]  __kasan_slab_free+0x12/0x20\n[Thu Feb 10 12:59:07 2022]  slab_free_freelist_hook+0xb3/0x1d0\n[Thu Feb 10 12:59:07 2022]  kfree+0xcd/0x520\n[Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0x149/0xbe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]\n[Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140\n[Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0\n[Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210\n[Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0\n[Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n[Thu Feb 10 12:59:07 2022] Last potentially related work creation:\n[Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50\n[Thu Feb 10 12:59:07 2022]  __kasan_record_aux_stack+0xb6/0xc0\n[Thu Feb 10 12:59:07 2022]  kasan_record_aux_stack_noalloc+0xb/0x10\n[Thu Feb 10 12:59:07 2022]  call_rcu+0x76/0x3c0\n[Thu Feb 10 12:59:07 2022]  cifs_umount+0xce/0xe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  cifs_kill_sb+0xc8/0xe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  deactivate_locked_super+0x5d/0xd0\n[Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0xab9/0xbe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]\n[Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140\n[Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0\n[Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210\n[Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0\n[Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37b60d20-ef96-4734-b567-dc411282f996",
      "id": "CVE-2022-49084",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: confirm skb is allocated before using\n\nqede_build_skb() assumes build_skb() always works and goes straight\nto skb_reserve(). However, build_skb() can fail under memory pressure.\nThis results in a kernel panic because the skb to reserve is NULL.\n\nAdd a check in case build_skb() failed to allocate and return NULL.\n\nThe NULL return is handled correctly in callers to qede_build_skb().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c0bfa3ab-de39-4c9b-a740-a236e908c376",
      "id": "CVE-2022-49215",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix race at socket teardown\n\nFix a race in the xsk socket teardown code that can lead to a NULL pointer\ndereference splat. The current xsk unbind code in xsk_unbind_dev() starts by\nsetting xs-\u003estate to XSK_UNBOUND, sets xs-\u003edev to NULL and then waits for any\nNAPI processing to terminate using synchronize_net(). After that, the release\ncode starts to tear down the socket state and free allocated memory.\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000c0\n  PGD 8000000932469067 P4D 8000000932469067 PUD 0\n  Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 25 PID: 69132 Comm: grpcpp_sync_ser Tainted: G          I       5.16.0+ #2\n  Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.2.10 03/09/2015\n  RIP: 0010:__xsk_sendmsg+0x2c/0x690\n  [...]\n  RSP: 0018:ffffa2348bd13d50 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff8d5fc632d258\n  RDX: 0000000000400000 RSI: ffffa2348bd13e10 RDI: ffff8d5fc5489800\n  RBP: ffffa2348bd13db0 R08: 0000000000000000 R09: 00007ffffffff000\n  R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d5fc5489800\n  R13: ffff8d5fcb0f5140 R14: ffff8d5fcb0f5140 R15: 0000000000000000\n  FS:  00007f991cff9400(0000) GS:ffff8d6f1f700000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000000000c0 CR3: 0000000114888005 CR4: 00000000001706e0\n  Call Trace:\n  \u003cTASK\u003e\n  ? aa_sk_perm+0x43/0x1b0\n  xsk_sendmsg+0xf0/0x110\n  sock_sendmsg+0x65/0x70\n  __sys_sendto+0x113/0x190\n  ? debug_smp_processor_id+0x17/0x20\n  ? fpregs_assert_state_consistent+0x23/0x50\n  ? exit_to_user_mode_prepare+0xa5/0x1d0\n  __x64_sys_sendto+0x29/0x30\n  do_syscall_64+0x3b/0xc0\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThere are two problems with the current code. First, setting xs-\u003edev to NULL\nbefore waiting for all users to stop using the socket is not correct. The\nentry to the data plane functions xsk_poll(), xsk_sendmsg(), and xsk_recvmsg()\nare all guarded by a test that xs-\u003estate is in the state XSK_BOUND and if not,\nit returns right away. But one process might have passed this test but still\nhave not gotten to the point in which it uses xs-\u003edev in the code. In this\ninterim, a second process executing xsk_unbind_dev() might have set xs-\u003edev to\nNULL which will lead to a crash for the first process. The solution here is\njust to get rid of this NULL assignment since it is not used anymore. Before\ncommit 42fddcc7c64b (\"xsk: use state member for socket synchronization\"),\nxs-\u003edev was the gatekeeper to admit processes into the data plane functions,\nbut it was replaced with the state variable xs-\u003estate in the aforementioned\ncommit.\n\nThe second problem is that synchronize_net() does not wait for any process in\nxsk_poll(), xsk_sendmsg(), or xsk_recvmsg() to complete, which means that the\nstate they rely on might be cleaned up prematurely. This can happen when the\nnotifier gets called (at driver unload for example) as it uses xsk_unbind_dev().\nSolve this by extending the RCU critical region from just the ndo_xsk_wakeup\nto the whole functions mentioned above, so that both the test of xs-\u003estate ==\nXSK_BOUND and the last use of any member of xs is covered by the RCU critical\nsection. This will guarantee that when synchronize_net() completes, there will\nbe no processes left executing xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() and\nstate can be cleaned up safely. Note that we need to drop the RCU lock for the\nskb xmit path as it uses functions that might sleep. Due to this, we have to\nretest the xs-\u003estate after we grab the mutex that protects the skb xmit code\nfrom, among a number of things, an xsk_unbind_dev() being executed from the\nnotifier at the same time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19629a17-df7d-4ebd-b5dc-1892282918e8",
      "id": "CVE-2022-49373",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd  missing of_node_put() in some error paths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71577a2f-9db7-4218-8cdf-3b50dc968303",
      "id": "CVE-2022-49635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/selftests: fix subtraction overflow bug\n\nOn some machines hole_end can be small enough to cause subtraction\noverflow. On the other side (addr + 2 * min_alignment) can overflow\nin case of mock tests. This patch should handle both cases.\n\n(cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4f1274d-b63f-4f1e-bf4b-9a18b8bff72a",
      "id": "CVE-2022-49678",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.\n\nIn brcmstb_init_sram, it pass dn to of_address_to_resource(),\nof_address_to_resource() will call of_find_device_by_node() to take\nreference, so we should release the reference returned by\nof_find_matching_node().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87d29627-703f-4cbe-961f-835e498d7e94",
      "id": "CVE-2022-49838",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear out_curr if all frag chunks of current msg are pruned\n\nA crash was reported by Zhen Chen:\n\n  list_del corruption, ffffa035ddf01c18-\u003enext is NULL\n  WARNING: CPU: 1 PID: 250682 at lib/list_debug.c:49 __list_del_entry_valid+0x59/0xe0\n  RIP: 0010:__list_del_entry_valid+0x59/0xe0\n  Call Trace:\n   sctp_sched_dequeue_common+0x17/0x70 [sctp]\n   sctp_sched_fcfs_dequeue+0x37/0x50 [sctp]\n   sctp_outq_flush_data+0x85/0x360 [sctp]\n   sctp_outq_uncork+0x77/0xa0 [sctp]\n   sctp_cmd_interpreter.constprop.0+0x164/0x1450 [sctp]\n   sctp_side_effects+0x37/0xe0 [sctp]\n   sctp_do_sm+0xd0/0x230 [sctp]\n   sctp_primitive_SEND+0x2f/0x40 [sctp]\n   sctp_sendmsg_to_asoc+0x3fa/0x5c0 [sctp]\n   sctp_sendmsg+0x3d5/0x440 [sctp]\n   sock_sendmsg+0x5b/0x70\n\nand in sctp_sched_fcfs_dequeue() it dequeued a chunk from stream\nout_curr outq while this outq was empty.\n\nNormally stream-\u003eout_curr must be set to NULL once all frag chunks of\ncurrent msg are dequeued, as we can see in sctp_sched_dequeue_done().\nHowever, in sctp_prsctp_prune_unsent() as it is not a proper dequeue,\nsctp_sched_dequeue_done() is not called to do this.\n\nThis patch is to fix it by simply setting out_curr to NULL when the\nlast frag chunk of current msg is dequeued from out_curr stream in\nsctp_prsctp_prune_unsent().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38a38f35-b4fb-4762-add0-f881dc99a8c2",
      "id": "CVE-2022-49938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix small mempool leak in SMB2_negotiate()\n\nIn some cases of failure (dialect mismatches) in SMB2_negotiate(), after\nthe request is sent, the checks would return -EIO when they should be\nrather setting rc = -EIO and jumping to neg_exit to free the response\nbuffer from mempool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb6d27bc-63ec-4c21-bfd9-cb2c4fb04d38",
      "id": "CVE-2022-50034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3 fix use-after-free at workaround 2\n\nBUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac\n\ncdns3_wa2_remove_old_request()\n{\n\t...\n\tkfree(priv_req-\u003erequest.buf);\n\tcdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, \u0026priv_req-\u003erequest);\n\tlist_del_init(\u0026priv_req-\u003elist);\n\t^^^ use after free\n\t...\n}\n\ncdns3_gadget_ep_free_request() free the space pointed by priv_req,\nbut priv_req is used in the following list_del_init().\n\nThis patch move list_del_init() before cdns3_gadget_ep_free_request().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9a16ff8-c5ad-456a-913f-f88c40d8e95a",
      "id": "CVE-2022-50143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nintel_th: Fix a resource leak in an error handling path\n\nIf an error occurs after calling 'pci_alloc_irq_vectors()',\n'pci_free_irq_vectors()' must be called as already done in the remove\nfunction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e475d7c-ce88-484a-ab3f-5dcbf52b0b4a",
      "id": "CVE-2022-50259",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix race in sock_map_free()\n\nsock_map_free() calls release_sock(sk) without owning a reference\non the socket. This can cause use-after-free as syzbot found [1]\n\nJakub Sitnicki already took care of a similar issue\nin sock_hash_free() in commit 75e68e5bf2c7 (\"bpf, sockhash:\nSynchronize delete from bucket list on map free\")\n\n[1]\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 0 PID: 3785 at lib/refcount.c:31 refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31\nModules linked in:\nCPU: 0 PID: 3785 Comm: kworker/u4:6 Not tainted 6.1.0-rc7-syzkaller-00103-gef4d3ea40565 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nWorkqueue: events_unbound bpf_map_free_deferred\nRIP: 0010:refcount_warn_saturate+0x17c/0x1a0 lib/refcount.c:31\nCode: 68 8b 31 c0 e8 75 71 15 fd 0f 0b e9 64 ff ff ff e8 d9 6e 4e fd c6 05 62 9c 3d 0a 01 48 c7 c7 80 bb 68 8b 31 c0 e8 54 71 15 fd \u003c0f\u003e 0b e9 43 ff ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a2 fe ff\nRSP: 0018:ffffc9000456fb60 EFLAGS: 00010246\nRAX: eae59bab72dcd700 RBX: 0000000000000004 RCX: ffff8880207057c0\nRDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000\nRBP: 0000000000000004 R08: ffffffff816fdabd R09: fffff520008adee5\nR10: fffff520008adee5 R11: 1ffff920008adee4 R12: 0000000000000004\nR13: dffffc0000000000 R14: ffff88807b1c6c00 R15: 1ffff1100f638dcf\nFS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b30c30000 CR3: 000000000d08e000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\n__refcount_dec include/linux/refcount.h:344 [inline]\nrefcount_dec include/linux/refcount.h:359 [inline]\n__sock_put include/net/sock.h:779 [inline]\ntcp_release_cb+0x2d0/0x360 net/ipv4/tcp_output.c:1092\nrelease_sock+0xaf/0x1c0 net/core/sock.c:3468\nsock_map_free+0x219/0x2c0 net/core/sock_map.c:356\nprocess_one_work+0x81c/0xd10 kernel/workqueue.c:2289\nworker_thread+0xb14/0x1330 kernel/workqueue.c:2436\nkthread+0x266/0x300 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88b58609-a2ca-43ad-b8c5-3b5bcc849408",
      "id": "CVE-2022-50335",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: set req refcount to zero to avoid uninitialized usage\n\nWhen a new request is allocated, the refcount will be zero if it is\nreused, but if the request is newly allocated from slab, it is not fully\ninitialized before being added to idr.\n\nIf the p9_read_work got a response before the refcount initiated. It will\nuse a uninitialized req, which will result in a bad request data struct.\n\nHere is the logs from syzbot.\n\nCorrupted memory at 0xffff88807eade00b [ 0xff 0x07 0x00 0x00 0x00 0x00\n0x00 0x00 . . . . . . . . ] (in kfence-#110):\n p9_fcall_fini net/9p/client.c:248 [inline]\n p9_req_put net/9p/client.c:396 [inline]\n p9_req_put+0x208/0x250 net/9p/client.c:390\n p9_client_walk+0x247/0x540 net/9p/client.c:1165\n clone_fid fs/9p/fid.h:21 [inline]\n v9fs_fid_xattr_set+0xe4/0x2b0 fs/9p/xattr.c:118\n v9fs_xattr_set fs/9p/xattr.c:100 [inline]\n v9fs_xattr_handler_set+0x6f/0x120 fs/9p/xattr.c:159\n __vfs_setxattr+0x119/0x180 fs/xattr.c:182\n __vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:216\n __vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:277\n vfs_setxattr+0x143/0x340 fs/xattr.c:309\n setxattr+0x146/0x160 fs/xattr.c:617\n path_setxattr+0x197/0x1c0 fs/xattr.c:636\n __do_sys_setxattr fs/xattr.c:652 [inline]\n __se_sys_setxattr fs/xattr.c:648 [inline]\n __ia32_sys_setxattr+0xc0/0x160 fs/xattr.c:648\n do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178\n do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203\n entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\nBelow is a similar scenario, the scenario in the syzbot log looks more\ncomplicated than this one, but this patch can fix it.\n\n     T21124                   p9_read_work\n======================== second trans =================================\np9_client_walk\n  p9_client_rpc\n    p9_client_prepare_req\n      p9_tag_alloc\n        req = kmem_cache_alloc(p9_req_cache, GFP_NOFS);\n        tag = idr_alloc\n        \u003c\u003c preempted \u003e\u003e\n        req-\u003etc.tag = tag;\n                            /* req-\u003e[refcount/tag] == uninitialized */\n                            m-\u003erreq = p9_tag_lookup(m-\u003eclient, m-\u003erc.tag);\n                              /* increments uninitalized refcount */\n\n        refcount_set(\u0026req-\u003erefcount, 2);\n                            /* cb drops one ref */\n                            p9_client_cb(req)\n                            /* reader thread drops its ref:\n                               request is incorrectly freed */\n                            p9_req_put(req)\n    /* use after free and ref underflow */\n    p9_req_put(req)\n\nTo fix it, we can initialize the refcount to zero before add to idr.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32c865ec-c44f-4575-b729-fcec82a2e7e2",
      "id": "CVE-2023-45871",
      "description": "An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf79565e-2f2f-4ffa-8b4b-93be33f67753",
      "id": "CVE-2023-52586",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n    parameter of dpu_encoder_phys.\n    -Switch from atomic refcnt to a simple int counter as mutex has\n    now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f2f7074-aa2b-467e-a736-d90fce17015f",
      "id": "CVE-2023-52599",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in diNewExt\n\n[Syz report]\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2\nindex -878706688 is out of range for type 'struct iagctl[128]'\nCPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\n diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360\n diAllocExt fs/jfs/jfs_imap.c:1949 [inline]\n diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666\n diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587\n ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56\n jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225\n vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106\n do_mkdirat+0x264/0x3a0 fs/namei.c:4129\n __do_sys_mkdir fs/namei.c:4149 [inline]\n __se_sys_mkdir fs/namei.c:4147 [inline]\n __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\nRIP: 0033:0x7fcb7e6a0b57\nCode: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053\nRAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57\nRDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140\nRBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n\n[Analysis]\nWhen the agstart is too large, it can cause agno overflow.\n\n[Fix]\nAfter obtaining agno, if the value is invalid, exit the subsequent process.\n\n\nModified the test from agno \u003e MAXAG to agno \u003e= MAXAG based on linux-next\nreport by kernel test robot (Dan Carpenter).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1449edcf-26ca-467b-aa81-a362b6a82740",
      "id": "CVE-2023-52737",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lock the inode in shared mode before starting fiemap\n\nCurrently fiemap does not take the inode's lock (VFS lock), it only locks\na file range in the inode's io tree. This however can lead to a deadlock\nif we have a concurrent fsync on the file and fiemap code triggers a fault\nwhen accessing the user space buffer with fiemap_fill_next_extent(). The\ndeadlock happens on the inode's i_mmap_lock semaphore, which is taken both\nby fsync and btrfs_page_mkwrite(). This deadlock was recently reported by\nsyzbot and triggers a trace like the following:\n\n   task:syz-executor361 state:D stack:20264 pid:5668  ppid:5119   flags:0x00004004\n   Call Trace:\n    \u003cTASK\u003e\n    context_switch kernel/sched/core.c:5293 [inline]\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\n    wait_on_state fs/btrfs/extent-io-tree.c:707 [inline]\n    wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751\n    lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742\n    find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488\n    writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863\n    __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174\n    extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091\n    extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211\n    do_writepages+0x3c3/0x680 mm/page-writeback.c:2581\n    filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388\n    __filemap_fdatawrite_range mm/filemap.c:421 [inline]\n    filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439\n    btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline]\n    start_ordered_ops fs/btrfs/file.c:1737 [inline]\n    btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839\n    generic_write_sync include/linux/fs.h:2885 [inline]\n    btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684\n    call_write_iter include/linux/fs.h:2189 [inline]\n    new_sync_write fs/read_write.c:491 [inline]\n    vfs_write+0x7dc/0xc50 fs/read_write.c:584\n    ksys_write+0x177/0x2a0 fs/read_write.c:637\n    do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n    entry_SYSCALL_64_after_hwframe+0x63/0xcd\n   RIP: 0033:0x7f7d4054e9b9\n   RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n   RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9\n   RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006\n   RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000\n   R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69\n   R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8\n    \u003c/TASK\u003e\n   INFO: task syz-executor361:5697 blocked for more than 145 seconds.\n         Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0\n   \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n   task:syz-executor361 state:D stack:21216 pid:5697  ppid:5119   flags:0x00004004\n   Call Trace:\n    \u003cTASK\u003e\n    context_switch kernel/sched/core.c:5293 [inline]\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\n    rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095\n    __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260\n    btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526\n    do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947\n    wp_page_shared+0x15e/0x380 mm/memory.c:3295\n    handle_pte_fault mm/memory.c:4949 [inline]\n    __handle_mm_fault mm/memory.c:5073 [inline]\n    handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219\n    do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428\n    handle_page_fault arch/x86/mm/fault.c:1519 [inline]\n    exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575\n    asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570\n   RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233\n   Code: 74 0a 89 (...)\n   RSP: 0018:ffffc9000570f330 EFLAGS: 000502\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "adb7e4a2-648d-4506-b576-a2874b8aedcd",
      "id": "CVE-2023-53148",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix igb_down hung on surprise removal\n\nIn a setup where a Thunderbolt hub connects to Ethernet and a display\nthrough USB Type-C, users may experience a hung task timeout when they\nremove the cable between the PC and the Thunderbolt hub.\nThis is because the igb_down function is called multiple times when\nthe Thunderbolt hub is unplugged. For example, the igb_io_error_detected\ntriggers the first call, and the igb_remove triggers the second call.\nThe second call to igb_down will block at napi_synchronize.\nHere's the call trace:\n    __schedule+0x3b0/0xddb\n    ? __mod_timer+0x164/0x5d3\n    schedule+0x44/0xa8\n    schedule_timeout+0xb2/0x2a4\n    ? run_local_timers+0x4e/0x4e\n    msleep+0x31/0x38\n    igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    __igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    __dev_close_many+0x95/0xec\n    dev_close_many+0x6e/0x103\n    unregister_netdevice_many+0x105/0x5b1\n    unregister_netdevice_queue+0xc2/0x10d\n    unregister_netdev+0x1c/0x23\n    igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    pci_device_remove+0x3f/0x9c\n    device_release_driver_internal+0xfe/0x1b4\n    pci_stop_bus_device+0x5b/0x7f\n    pci_stop_bus_device+0x30/0x7f\n    pci_stop_bus_device+0x30/0x7f\n    pci_stop_and_remove_bus_device+0x12/0x19\n    pciehp_unconfigure_device+0x76/0xe9\n    pciehp_disable_slot+0x6e/0x131\n    pciehp_handle_presence_or_link_change+0x7a/0x3f7\n    pciehp_ist+0xbe/0x194\n    irq_thread_fn+0x22/0x4d\n    ? irq_thread+0x1fd/0x1fd\n    irq_thread+0x17b/0x1fd\n    ? irq_forced_thread_fn+0x5f/0x5f\n    kthread+0x142/0x153\n    ? __irq_get_irqchip_state+0x46/0x46\n    ? kthread_associate_blkcg+0x71/0x71\n    ret_from_fork+0x1f/0x30\n\nIn this case, igb_io_error_detected detaches the network interface\nand requests a PCIE slot reset, however, the PCIE reset callback is\nnot being invoked and thus the Ethernet connection breaks down.\nAs the PCIE error in this case is a non-fatal one, requesting a\nslot reset can be avoided.\nThis patch fixes the task hung issue and preserves Ethernet\nconnection by ignoring non-fatal PCIE errors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fdaa6b0-cd0f-4ca6-aa67-3f6ab4f47336",
      "id": "CVE-2023-53231",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: Fix detection of atomic context\n\nCurrent check for atomic context is not sufficient as\nz_erofs_decompressqueue_endio can be called under rcu lock\nfrom blk_mq_flush_plug_list(). See the stacktrace [1]\n\nIn such case we should hand off the decompression work for async\nprocessing rather than trying to do sync decompression in current\ncontext. Patch fixes the detection by checking for\nrcu_read_lock_any_held() and while at it use more appropriate\n!in_task() check than in_atomic().\n\nBackground: Historically erofs would always schedule a kworker for\ndecompression which would incur the scheduling cost regardless of\nthe context. But z_erofs_decompressqueue_endio() may not always\nbe in atomic context and we could actually benefit from doing the\ndecompression in z_erofs_decompressqueue_endio() if we are in\nthread context, for example when running with dm-verity.\nThis optimization was later added in patch [2] which has shown\nimprovement in performance benchmarks.\n\n==============================================\n[1] Problem stacktrace\n[name:core\u0026]BUG: sleeping function called from invalid context at kernel/locking/mutex.c:291\n[name:core\u0026]in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1615, name: CpuMonitorServi\n[name:core\u0026]preempt_count: 0, expected: 0\n[name:core\u0026]RCU nest depth: 1, expected: 0\nCPU: 7 PID: 1615 Comm: CpuMonitorServi Tainted: G S      W  OE      6.1.25-android14-5-maybe-dirty-mainline #1\nHardware name: MT6897 (DT)\nCall trace:\n dump_backtrace+0x108/0x15c\n show_stack+0x20/0x30\n dump_stack_lvl+0x6c/0x8c\n dump_stack+0x20/0x48\n __might_resched+0x1fc/0x308\n __might_sleep+0x50/0x88\n mutex_lock+0x2c/0x110\n z_erofs_decompress_queue+0x11c/0xc10\n z_erofs_decompress_kickoff+0x110/0x1a4\n z_erofs_decompressqueue_endio+0x154/0x180\n bio_endio+0x1b0/0x1d8\n __dm_io_complete+0x22c/0x280\n clone_endio+0xe4/0x280\n bio_endio+0x1b0/0x1d8\n blk_update_request+0x138/0x3a4\n blk_mq_plug_issue_direct+0xd4/0x19c\n blk_mq_flush_plug_list+0x2b0/0x354\n __blk_flush_plug+0x110/0x160\n blk_finish_plug+0x30/0x4c\n read_pages+0x2fc/0x370\n page_cache_ra_unbounded+0xa4/0x23c\n page_cache_ra_order+0x290/0x320\n do_sync_mmap_readahead+0x108/0x2c0\n filemap_fault+0x19c/0x52c\n __do_fault+0xc4/0x114\n handle_mm_fault+0x5b4/0x1168\n do_page_fault+0x338/0x4b4\n do_translation_fault+0x40/0x60\n do_mem_abort+0x60/0xc8\n el0_da+0x4c/0xe0\n el0t_64_sync_handler+0xd4/0xfc\n el0t_64_sync+0x1a0/0x1a4\n\n[2] Link: https://lore.kernel.org/all/20210317035448.13921-1-huangjianan@oppo.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3618e5f4-7995-422f-9b2c-811b8c11b8da",
      "id": "CVE-2023-53318",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrecordmcount: Fix memory leaks in the uwrite function\n\nCommon realloc mistake: 'file_append' nulled but not freed upon failure",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "302c48d8-efad-4218-9b89-c04efb979036",
      "id": "CVE-2023-53402",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/printk/index.c: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a320295e-bf3e-4a93-862d-9fd56b3906e4",
      "id": "CVE-2024-26647",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'\n\nIn link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc'\nwas dereferenced in a DC_LOGGER_INIT(dsc-\u003ectx-\u003elogger); before the 'dsc'\nNULL pointer check.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see line 903)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be76b950-cafe-4dab-a77e-eba1465b50fb",
      "id": "CVE-2024-26938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()\n\nIf we have no VBT, or the VBT didn't declare the encoder\nin question, we won't have the 'devdata' for the encoder.\nInstead of oopsing just bail early.\n\nWe won't be able to tell whether the port is DP++ or not,\nbut so be it.\n\n(cherry picked from commit 26410896206342c8a80d2b027923e9ee7d33b733)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7de7b012-51b9-4589-90cb-018ff8cb0fcd",
      "id": "CVE-2024-27044",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'\n\nThe 'stream' pointer is used in dcn10_set_output_transfer_func() before\nthe check if 'stream' is NULL.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fe99a29-0337-41f8-914e-64f6c89b8a19",
      "id": "CVE-2024-35809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/PM: Drain runtime-idle callbacks before driver removal\n\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\n\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn't really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\n\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\n\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\n\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3fb961ff-0382-4a94-bc03-a51a4b3319fb",
      "id": "CVE-2024-42162",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv-\u003estats_report-\u003estats array.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b9aed56-804a-4ddc-81f2-7a8b1220a2b6",
      "id": "CVE-2024-46777",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Avoid excessive partition lengths\n\nAvoid mounting filesystems where the partition would overflow the\n32-bits used for block number. Also refuse to mount filesystems where\nthe partition length is so large we cannot safely index bits in a\nblock bitmap.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f750497-8a26-41c6-9dfd-05058a1075be",
      "id": "CVE-2024-46855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_socket: fix sk refcount leaks\n\nWe must put 'sk' reference before returning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e369bc37-2afd-4ded-9561-35a8bf6ae7ed",
      "id": "CVE-2024-49926",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()\n\nFor kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is\ndefined as NR_CPUS instead of the number of possible cpus, this\nwill cause the following system panic:\n\nsmpboot: Allowing 4 CPUs, 0 hotplug CPUs\n...\nsetup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1\n...\nBUG: unable to handle page fault for address: ffffffff9911c8c8\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W\n6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6\nRIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0\nRSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082\nCR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0\nCall Trace:\n\u003cTASK\u003e\n? __die+0x23/0x80\n? page_fault_oops+0xa4/0x180\n? exc_page_fault+0x152/0x180\n? asm_exc_page_fault+0x26/0x40\n? rcu_tasks_need_gpcb+0x25d/0x2c0\n? __pfx_rcu_tasks_kthread+0x40/0x40\nrcu_tasks_one_gp+0x69/0x180\nrcu_tasks_kthread+0x94/0xc0\nkthread+0xe8/0x140\n? __pfx_kthread+0x40/0x40\nret_from_fork+0x34/0x80\n? __pfx_kthread+0x40/0x40\nret_from_fork_asm+0x1b/0x80\n\u003c/TASK\u003e\n\nConsidering that there may be holes in the CPU numbers, use the\nmaximum possible cpu number, instead of nr_cpu_ids, for configuring\nenqueue and dequeue limits.\n\n[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df640a52-718d-4145-9408-9c6d544ff508",
      "id": "CVE-2024-49973",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nr8169: add tally counter fields added with RTL8125\n\nRTL8125 added fields to the tally counter, what may result in the chip\ndma'ing these new fields to unallocated memory. Therefore make sure\nthat the allocated memory area is big enough to hold all of the\ntally counter values, even if we use only parts of it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f038d31-2beb-4d26-9fef-b3694ca1c2ee",
      "id": "CVE-2024-53181",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: vector: Do not use drvdata in release\n\nThe drvdata is not available in release. Let's just use container_of()\nto get the vector_device instance. Otherwise, removing a vector device\nwill result in a crash:\n\nRIP: 0033:vector_device_release+0xf/0x50\nRSP: 00000000e187bc40  EFLAGS: 00010202\nRAX: 0000000060028f61 RBX: 00000000600f1baf RCX: 00000000620074e0\nRDX: 000000006220b9c0 RSI: 0000000060551c80 RDI: 0000000000000000\nRBP: 00000000e187bc50 R08: 00000000603ad594 R09: 00000000e187bb70\nR10: 000000000000135a R11: 00000000603ad422 R12: 00000000623ae028\nR13: 000000006287a200 R14: 0000000062006d30 R15: 00000000623700b6\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 UID: 0 PID: 16 Comm: kworker/0:1 Not tainted 6.12.0-rc6-g59b723cd2adb #1\nWorkqueue: events mc_work_proc\nStack:\n 60028f61 623ae028 e187bc80 60276fcd\n 6220b9c0 603f5820 623ae028 00000000\n e187bcb0 603a2bcd 623ae000 62370010\nCall Trace:\n [\u003c60028f61\u003e] ? vector_device_release+0x0/0x50\n [\u003c60276fcd\u003e] device_release+0x70/0xba\n [\u003c603a2bcd\u003e] kobject_put+0xba/0xe7\n [\u003c60277265\u003e] put_device+0x19/0x1c\n [\u003c60281266\u003e] platform_device_put+0x26/0x29\n [\u003c60281e5f\u003e] platform_device_unregister+0x2c/0x2e\n [\u003c60029422\u003e] vector_remove+0x52/0x58\n [\u003c60031316\u003e] ? mconsole_reply+0x0/0x50\n [\u003c600310c8\u003e] mconsole_remove+0x160/0x1cc\n [\u003c603b19f4\u003e] ? strlen+0x0/0x15\n [\u003c60066611\u003e] ? __dequeue_entity+0x1a9/0x206\n [\u003c600666a7\u003e] ? set_next_entity+0x39/0x63\n [\u003c6006666e\u003e] ? set_next_entity+0x0/0x63\n [\u003c60038fa6\u003e] ? um_set_signals+0x0/0x43\n [\u003c6003070c\u003e] mc_work_proc+0x77/0x91\n [\u003c60057664\u003e] process_scheduled_works+0x1b3/0x2dd\n [\u003c60055f32\u003e] ? assign_work+0x0/0x58\n [\u003c60057f0a\u003e] worker_thread+0x1e9/0x293\n [\u003c6005406f\u003e] ? set_pf_worker+0x0/0x64\n [\u003c6005d65d\u003e] ? arch_local_irq_save+0x0/0x2d\n [\u003c6005d748\u003e] ? kthread_exit+0x0/0x3a\n [\u003c60057d21\u003e] ? worker_thread+0x0/0x293\n [\u003c6005dbf1\u003e] kthread+0x126/0x12b\n [\u003c600219c5\u003e] new_thread_handler+0x85/0xb6",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a3ff4bf-d13a-4bd6-b8b1-0deb3c14a74f",
      "id": "CVE-2021-32399",
      "description": "net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c8521f0-34f0-4ea3-8a30-c05c281fc117",
      "id": "CVE-2024-56746",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()\n\nWhen information such as info-\u003escreen_base is not ready, calling\nsh7760fb_free_mem() does not release memory correctly. Call\ndma_free_coherent() instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c14638b-c094-49e3-b5b5-64497c0be803",
      "id": "CVE-2024-57996",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: don't allow 1 packet limit\n\nThe current implementation does not work correctly with a limit of\n1. iproute2 actually checks for this and this patch adds the check in\nkernel as well.\n\nThis fixes the following syzkaller reported crash:\n\nUBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6\nindex 65535 is out of range for type 'struct sfq_head[128]'\nCPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n  __dump_stack lib/dump_stack.c:79 [inline]\n  dump_stack+0x125/0x19f lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:148 [inline]\n  __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347\n  sfq_link net/sched/sch_sfq.c:210 [inline]\n  sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238\n  sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500\n  sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525\n  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026\n  tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319\n  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026\n  dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296\n  netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]\n  dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362\n  __dev_close_many+0x214/0x350 net/core/dev.c:1468\n  dev_close_many+0x207/0x510 net/core/dev.c:1506\n  unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738\n  unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695\n  unregister_netdevice include/linux/netdevice.h:2893 [inline]\n  __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689\n  tun_detach drivers/net/tun.c:705 [inline]\n  tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640\n  __fput+0x203/0x840 fs/file_table.c:280\n  task_work_run+0x129/0x1b0 kernel/task_work.c:185\n  exit_task_work include/linux/task_work.h:33 [inline]\n  do_exit+0x5ce/0x2200 kernel/exit.c:931\n  do_group_exit+0x144/0x310 kernel/exit.c:1046\n  __do_sys_exit_group kernel/exit.c:1057 [inline]\n  __se_sys_exit_group kernel/exit.c:1055 [inline]\n  __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055\n do_syscall_64+0x6c/0xd0\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7fe5e7b52479\nCode: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.\nRSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479\nRDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000\nRBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0\nR13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270\n\nThe crash can be also be reproduced with the following (with a tc\nrecompiled to allow for sfq limits of 1):\n\ntc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s\n../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1\nifconfig dummy0 up\nping -I dummy0 -f -c2 -W0.1 8.8.8.8\nsleep 1\n\nScenario that triggers the crash:\n\n* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1\n\n* TBF dequeues: it peeks from SFQ which moves the packet to the\n  gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so\n  it schedules itself for later.\n\n* the second packet is sent and TBF tries to queues it to SFQ. qdisc\n  qlen is now 2 and because the SFQ limit is 1 the packet is dropped\n  by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,\n  however q-\u003etail is not NULL.\n\nAt this point, assuming no more packets are queued, when sch_dequeue\nruns again it will decrement the qlen for the current empty slot\ncausing an underflow and the subsequent out of bounds access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2862c408-f21b-474f-8a32-e4e5ce6c3731",
      "id": "CVE-2025-21969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n\nAfter the hci sync command releases l2cap_conn, the hci receive data work\nqueue references the released l2cap_conn when sending to the upper layer.\nAdd hci dev lock to the hci receive data work queue to synchronize the two.\n\n[1]\nBUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\nRead of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837\n\nCPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: hci1 hci_rx_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]\n l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\n l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]\n l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]\n l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817\n hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]\n hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nAllocated by task 5837:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n kmalloc_noprof include/linux/slab.h:901 [inline]\n kzalloc_noprof include/linux/slab.h:1037 [inline]\n l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860\n l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726\n hci_event_func net/bluetooth/hci_event.c:7473 [inline]\n hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525\n hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nFreed by task 54:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2353 [inline]\n slab_free mm/slub.c:4613 [inline]\n kfree+0x196/0x430 mm/slub.c:4761\n l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266\n hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fe967af-7ef6-4060-a67d-8b0abc6a9960",
      "id": "CVE-2025-22071",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak in spufs_create_context()\n\nLeak fixes back in 2008 missed one case - if we are trying to set affinity\nand spufs_mkdir() fails, we need to drop the reference to neighbor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "164b16c3-d82a-4ee1-a78c-3431c9b9c871",
      "id": "CVE-2025-38194",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check that raw node were preallocated before writing summary\n\nSyzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault\ninjection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't\ncheck return value of jffs2_prealloc_raw_node_refs and simply lets any\nerror propagate into jffs2_sum_write_data, which eventually calls\njffs2_link_node_ref in order to link the summary to an expectedly allocated\nnode.\n\nkernel BUG at fs/jffs2/nodelist.c:592!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592\nCall Trace:\n \u003cTASK\u003e\n jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]\n jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874\n jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388\n jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301\n generic_perform_write+0x314/0x5d0 mm/filemap.c:3856\n __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973\n generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005\n call_write_iter include/linux/fs.h:2265 [inline]\n do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10c/0x170 fs/splice.c:950\n splice_direct_to_actor+0x337/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFix this issue by checking return value of jffs2_prealloc_raw_node_refs\nbefore calling jffs2_sum_write_data.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8de87b6e-57c5-4a9f-9e7f-07e4d4429e7c",
      "id": "CVE-2025-38222",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: inline: fix len overflow in ext4_prepare_inline_data\n\nWhen running the following code on an ext4 filesystem with inline_data\nfeature enabled, it will lead to the bug below.\n\n        fd = open(\"file1\", O_RDWR | O_CREAT | O_TRUNC, 0666);\n        ftruncate(fd, 30);\n        pwrite(fd, \"a\", 1, (1UL \u003c\u003c 40) + 5UL);\n\nThat happens because write_begin will succeed as when\next4_generic_write_inline_data calls ext4_prepare_inline_data, pos + len\nwill be truncated, leading to ext4_prepare_inline_data parameter to be 6\ninstead of 0x10000000006.\n\nThen, later when write_end is called, we hit:\n\n        BUG_ON(pos + len \u003e EXT4_I(inode)-\u003ei_inline_size);\n\nat ext4_write_inline_data.\n\nFix it by using a loff_t type for the len parameter in\next4_prepare_inline_data instead of an unsigned int.\n\n[   44.545164] ------------[ cut here ]------------\n[   44.545530] kernel BUG at fs/ext4/inline.c:240!\n[   44.545834] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[   44.546172] CPU: 3 UID: 0 PID: 343 Comm: test Not tainted 6.15.0-rc2-00003-g9080916f4863 #45 PREEMPT(full)  112853fcebfdb93254270a7959841d2c6aa2c8bb\n[   44.546523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   44.546523] RIP: 0010:ext4_write_inline_data+0xfe/0x100\n[   44.546523] Code: 3c 0e 48 83 c7 48 48 89 de 5b 41 5c 41 5d 41 5e 41 5f 5d e9 e4 fa 43 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 0b \u003c0f\u003e 0b 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 49\n[   44.546523] RSP: 0018:ffffb342008b79a8 EFLAGS: 00010216\n[   44.546523] RAX: 0000000000000001 RBX: ffff9329c579c000 RCX: 0000010000000006\n[   44.546523] RDX: 000000000000003c RSI: ffffb342008b79f0 RDI: ffff9329c158e738\n[   44.546523] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\n[   44.546523] R10: 00007ffffffff000 R11: ffffffff9bd0d910 R12: 0000006210000000\n[   44.546523] R13: fffffc7e4015e700 R14: 0000010000000005 R15: ffff9329c158e738\n[   44.546523] FS:  00007f4299934740(0000) GS:ffff932a60179000(0000) knlGS:0000000000000000\n[   44.546523] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   44.546523] CR2: 00007f4299a1ec90 CR3: 0000000002886002 CR4: 0000000000770eb0\n[   44.546523] PKRU: 55555554\n[   44.546523] Call Trace:\n[   44.546523]  \u003cTASK\u003e\n[   44.546523]  ext4_write_inline_data_end+0x126/0x2d0\n[   44.546523]  generic_perform_write+0x17e/0x270\n[   44.546523]  ext4_buffered_write_iter+0xc8/0x170\n[   44.546523]  vfs_write+0x2be/0x3e0\n[   44.546523]  __x64_sys_pwrite64+0x6d/0xc0\n[   44.546523]  do_syscall_64+0x6a/0xf0\n[   44.546523]  ? __wake_up+0x89/0xb0\n[   44.546523]  ? xas_find+0x72/0x1c0\n[   44.546523]  ? next_uptodate_folio+0x317/0x330\n[   44.546523]  ? set_pte_range+0x1a6/0x270\n[   44.546523]  ? filemap_map_pages+0x6ee/0x840\n[   44.546523]  ? ext4_setattr+0x2fa/0x750\n[   44.546523]  ? do_pte_missing+0x128/0xf70\n[   44.546523]  ? security_inode_post_setattr+0x3e/0xd0\n[   44.546523]  ? ___pte_offset_map+0x19/0x100\n[   44.546523]  ? handle_mm_fault+0x721/0xa10\n[   44.546523]  ? do_user_addr_fault+0x197/0x730\n[   44.546523]  ? do_syscall_64+0x76/0xf0\n[   44.546523]  ? arch_exit_to_user_mode_prepare+0x1e/0x60\n[   44.546523]  ? irqentry_exit_to_user_mode+0x79/0x90\n[   44.546523]  entry_SYSCALL_64_after_hwframe+0x55/0x5d\n[   44.546523] RIP: 0033:0x7f42999c6687\n[   44.546523] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 \u003c5b\u003e c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff\n[   44.546523] RSP: 002b:00007ffeae4a7930 EFLAGS: 00000202 ORIG_RAX: 0000000000000012\n[   44.546523] RAX: ffffffffffffffda RBX: 00007f4299934740 RCX: 00007f42999c6687\n[   44.546523] RDX: 0000000000000001 RSI: 000055ea6149200f RDI: 0000000000000003\n[   44.546523] RBP: 00007ffeae4a79a0 R08: 0000000000000000 R09: 0000000000000000\n[   44.546523] R10: 0000010000000005 R11: 0000000000000202 R12: 0000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e220a3d-7c27-4c19-92bc-8613b15e7707",
      "id": "CVE-2025-38250",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix use-after-free in vhci_flush()\n\nsyzbot reported use-after-free in vhci_flush() without repro. [0]\n\nFrom the splat, a thread close()d a vhci file descriptor while\nits device was being used by iotcl() on another thread.\n\nOnce the last fd refcnt is released, vhci_release() calls\nhci_unregister_dev(), hci_free_dev(), and kfree() for struct\nvhci_data, which is set to hci_dev-\u003edev-\u003edriver_data.\n\nThe problem is that there is no synchronisation after unlinking\nhdev from hci_dev_list in hci_unregister_dev().  There might be\nanother thread still accessing the hdev which was fetched before\nthe unlink operation.\n\nWe can use SRCU for such synchronisation.\n\nLet's run hci_dev_reset() under SRCU and wait for its completion\nin hci_unregister_dev().\n\nAnother option would be to restore hci_dev-\u003edestruct(), which was\nremoved in commit 587ae086f6e4 (\"Bluetooth: Remove unused\nhci-destruct cb\").  However, this would not be a good solution, as\nwe should not run hci_unregister_dev() while there are in-flight\nioctl() requests, which could lead to another data-race KCSAN splat.\n\nNote that other drivers seem to have the same problem, for exmaple,\nvirtbt_remove().\n\n[0]:\nBUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]\nBUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937\nRead of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718\n\nCPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xd2/0x2b0 mm/kasan/report.c:521\n kasan_report+0x118/0x150 mm/kasan/report.c:634\n skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]\n skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937\n skb_queue_purge include/linux/skbuff.h:3368 [inline]\n vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69\n hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline]\n hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592\n sock_do_ioctl+0xd9/0x300 net/socket.c:1190\n sock_ioctl+0x576/0x790 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fcf5b98e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929\nRDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009\nRBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528\n \u003c/TASK\u003e\n\nAllocated by task 6535:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635\n misc_open+0x2bc/0x330 drivers/char/misc.c:161\n chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414\n do_dentry_open+0xdf0/0x1970 fs/open.c:964\n vfs_open+0x3b/0x340 fs/open.c:1094\n do_open fs/namei.c:3887 [inline]\n path_openat+0x2ee5/0x3830 fs/name\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd5355f2-1353-4a2e-95ef-d2e8b79274fa",
      "id": "CVE-2025-38457",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Abort __tc_modify_qdisc if parent class does not exist\n\nLion's patch [1] revealed an ancient bug in the qdisc API.\nWhenever a user creates/modifies a qdisc specifying as a parent another\nqdisc, the qdisc API will, during grafting, detect that the user is\nnot trying to attach to a class and reject. However grafting is\nperformed after qdisc_create (and thus the qdiscs' init callback) is\nexecuted. In qdiscs that eventually call qdisc_tree_reduce_backlog\nduring init or change (such as fq, hhf, choke, etc), an issue\narises. For example, executing the following commands:\n\nsudo tc qdisc add dev lo root handle a: htb default 2\nsudo tc qdisc add dev lo parent a: handle beef fq\n\nQdiscs such as fq, hhf, choke, etc unconditionally invoke\nqdisc_tree_reduce_backlog() in their control path init() or change() which\nthen causes a failure to find the child class; however, that does not stop\nthe unconditional invocation of the assumed child qdisc's qlen_notify with\na null class. All these qdiscs make the assumption that class is non-null.\n\nThe solution is ensure that qdisc_leaf() which looks up the parent\nclass, and is invoked prior to qdisc_create(), should return failure on\nnot finding the class.\nIn this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the\nparentid doesn't correspond to a class, so that we can detect it\nearlier on and abort before qdisc_create is called.\n\n[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f9aafff-dcd3-480f-9df8-703cd62d0a0c",
      "id": "CVE-2020-25284",
      "description": "The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "681aab27-dc63-4ef0-86f2-7464bea00306",
      "id": "CVE-2020-29661",
      "description": "A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d163d84e-32f5-4c18-bb4c-decb328b45b6",
      "id": "CVE-2024-31076",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline\n\nThe absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of\ninterrupt affinity reconfiguration via procfs. Instead, the change is\ndeferred until the next instance of the interrupt being triggered on the\noriginal CPU.\n\nWhen the interrupt next triggers on the original CPU, the new affinity is\nenforced within __irq_move_irq(). A vector is allocated from the new CPU,\nbut the old vector on the original CPU remains and is not immediately\nreclaimed. Instead, apicd-\u003emove_in_progress is flagged, and the reclaiming\nprocess is delayed until the next trigger of the interrupt on the new CPU.\n\nUpon the subsequent triggering of the interrupt on the new CPU,\nirq_complete_move() adds a task to the old CPU's vector_cleanup list if it\nremains online. Subsequently, the timer on the old CPU iterates over its\nvector_cleanup list, reclaiming old vectors.\n\nHowever, a rare scenario arises if the old CPU is outgoing before the\ninterrupt triggers again on the new CPU.\n\nIn that case irq_force_complete_move() is not invoked on the outgoing CPU\nto reclaim the old apicd-\u003eprev_vector because the interrupt isn't currently\naffine to the outgoing CPU, and irq_needs_fixup() returns false. Even\nthough __vector_schedule_cleanup() is later called on the new CPU, it\ndoesn't reclaim apicd-\u003eprev_vector; instead, it simply resets both\napicd-\u003emove_in_progress and apicd-\u003eprev_vector to 0.\n\nAs a result, the vector remains unreclaimed in vector_matrix, leading to a\nCPU vector leak.\n\nTo address this issue, move the invocation of irq_force_complete_move()\nbefore the irq_needs_fixup() call to reclaim apicd-\u003eprev_vector, if the\ninterrupt is currently or used to be affine to the outgoing CPU.\n\nAdditionally, reclaim the vector in __vector_schedule_cleanup() as well,\nfollowing a warning message, although theoretically it should never see\napicd-\u003emove_in_progress with apicd-\u003eprev_cpu pointing to an offline CPU.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de24a253-a591-4c08-851c-df498c4e56f8",
      "id": "CVE-2021-3773",
      "description": "A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7e912a1-3337-4899-986f-7ee83075dea9",
      "id": "CVE-2021-46933",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.\n\nffs_data_clear is indirectly called from both ffs_fs_kill_sb and\nffs_ep0_release, so it ends up being called twice when userland closes ep0\nand then unmounts f_fs.\nIf userland provided an eventfd along with function's USB descriptors, it\nends up calling eventfd_ctx_put as many times, causing a refcount\nunderflow.\nNULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.\n\nAlso, set epfiles to NULL right after de-allocating it, for readability.\n\nFor completeness, ffs_data_clear actually ends up being called thrice, the\nlast call being before the whole ffs structure gets freed, so when this\nspecific sequence happens there is a second underflow happening (but not\nbeing reported):\n\n/sys/kernel/debug/tracing# modprobe usb_f_fs\n/sys/kernel/debug/tracing# echo ffs_data_clear \u003e set_ftrace_filter\n/sys/kernel/debug/tracing# echo function \u003e current_tracer\n/sys/kernel/debug/tracing# echo 1 \u003e tracing_on\n(setup gadget, run and kill function userland process, teardown gadget)\n/sys/kernel/debug/tracing# echo 0 \u003e tracing_on\n/sys/kernel/debug/tracing# cat trace\n smartcard-openp-436     [000] .....  1946.208786: ffs_data_clear \u003c-ffs_data_closed\n smartcard-openp-431     [000] .....  1946.279147: ffs_data_clear \u003c-ffs_data_closed\n smartcard-openp-431     [000] .n...  1946.905512: ffs_data_clear \u003c-ffs_data_put\n\nWarning output corresponding to above trace:\n[ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c\n[ 1946.293094] refcount_t: underflow; use-after-free.\n[ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E)\n[ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G         C OE     5.15.0-1-rpi #1  Debian 5.15.3-1\n[ 1946.417950] Hardware name: BCM2835\n[ 1946.425442] Backtrace:\n[ 1946.432048] [\u003cc08d60a0\u003e] (dump_backtrace) from [\u003cc08d62ec\u003e] (show_stack+0x20/0x24)\n[ 1946.448226]  r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c\n[ 1946.458412] [\u003cc08d62cc\u003e] (show_stack) from [\u003cc08d9ae0\u003e] (dump_stack+0x28/0x30)\n[ 1946.470380] [\u003cc08d9ab8\u003e] (dump_stack) from [\u003cc0123500\u003e] (__warn+0xe8/0x154)\n[ 1946.482067]  r5:c04a948c r4:c0a71dc8\n[ 1946.490184] [\u003cc0123418\u003e] (__warn) from [\u003cc08d6948\u003e] (warn_slowpath_fmt+0xa0/0xe4)\n[ 1946.506758]  r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04\n[ 1946.517070] [\u003cc08d68ac\u003e] (warn_slowpath_fmt) from [\u003cc04a948c\u003e] (refcount_warn_saturate+0x110/0x15c)\n[ 1946.535309]  r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0\n[ 1946.546708] [\u003cc04a937c\u003e] (refcount_warn_saturate) from [\u003cc0380134\u003e] (eventfd_ctx_put+0x48/0x74)\n[ 1946.564476] [\u003cc03800ec\u003e] (eventfd_ctx_put) from [\u003cbf5464e8\u003e] (ffs_data_clear+0xd0/0x118 [usb_f_fs])\n[ 1946.582664]  r5:c3b84c00 r4:c2695b00\n[ 1946.590668] [\u003cbf546418\u003e] (ffs_data_clear [usb_f_fs]) from [\u003cbf547cc0\u003e] (ffs_data_closed+0x9c/0x150 [usb_f_fs])\n[ 1946.609608]  r5:bf54d014 r4:c2695b00\n[ 1946.617522] [\u003cbf547c24\u003e] (ffs_data_closed [usb_f_fs]) from [\u003cbf547da0\u003e] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs])\n[ 1946.636217]  r7:c0dfcb\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10912e30-4f96-40ed-bbbb-df4003cc845f",
      "id": "CVE-2021-47191",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724]    program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995]  dump_stack+0x108/0x15f\n[ 3813.847524]  print_address_description+0xa5/0x372\n[ 3813.848243]  kasan_report.cold+0x236/0x2a8\n[ 3813.849439]  check_memory_region+0x240/0x270\n[ 3813.850094]  memcpy+0x30/0x80\n[ 3813.850553]  sg_copy_buffer+0x157/0x1e0\n[ 3813.853032]  sg_copy_from_buffer+0x13/0x20\n[ 3813.853660]  fill_from_dev_buffer+0x135/0x370\n[ 3813.854329]  resp_readcap16+0x1ac/0x280\n[ 3813.856917]  schedule_resp+0x41f/0x1630\n[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329]  scsi_request_fn+0xd8e/0x1710\n[ 3813.863946]  __blk_run_queue+0x10b/0x230\n[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637]  sg_write+0x6c8/0xef0\n[ 3813.878853]  __vfs_write+0xe4/0x800\n[ 3813.883487]  vfs_write+0x17b/0x530\n[ 3813.884008]  ksys_write+0x103/0x270\n[ 3813.886268]  __x64_sys_write+0x77/0xc0\n[ 3813.886841]  do_syscall_64+0x106/0x360\n[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)='./file0\\x00', 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, \u0026(0x7f0000000000)='fd/3\\x00')\nopen_by_handle_at(r1, \u0026(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(\u0026(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, \u0026(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74943983-2cdb-40bc-8848-3b336b4b34f1",
      "id": "CVE-2021-47656",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\n\nWhen we mount a jffs2 image, assume that the first few blocks of\nthe image are normal and contain at least one xattr-related inode,\nbut the next block is abnormal. As a result, an error is returned\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\ncalled in jffs2_build_filesystem() and then again in\njffs2_do_fill_super().\n\nFinally we can observe the following report:\n ==================================================================\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\n Read of size 8 at addr ffff8881243384e0 by task mount/719\n\n Call Trace:\n  dump_stack+0x115/0x16b\n  jffs2_clear_xattr_subsystem+0x95/0x6ac\n  jffs2_do_fill_super+0x84f/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n  mtd_get_sb+0x254/0x400\n  mtd_get_sb_by_nr+0x4f/0xd0\n  get_tree_mtd+0x498/0x840\n  jffs2_get_tree+0x25/0x30\n  vfs_get_tree+0x8d/0x2e0\n  path_mount+0x50f/0x1e50\n  do_mount+0x107/0x130\n  __se_sys_mount+0x1c5/0x2f0\n  __x64_sys_mount+0xc7/0x160\n  do_syscall_64+0x45/0x70\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n Allocated by task 719:\n  kasan_save_stack+0x23/0x60\n  __kasan_kmalloc.constprop.0+0x10b/0x120\n  kasan_slab_alloc+0x12/0x20\n  kmem_cache_alloc+0x1c0/0x870\n  jffs2_alloc_xattr_ref+0x2f/0xa0\n  jffs2_scan_medium.cold+0x3713/0x4794\n  jffs2_do_mount_fs.cold+0xa7/0x2253\n  jffs2_do_fill_super+0x383/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n Freed by task 719:\n  kmem_cache_free+0xcc/0x7b0\n  jffs2_free_xattr_ref+0x78/0x98\n  jffs2_clear_xattr_subsystem+0xa1/0x6ac\n  jffs2_do_mount_fs.cold+0x5e6/0x2253\n  jffs2_do_fill_super+0x383/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n The buggy address belongs to the object at ffff8881243384b8\n  which belongs to the cache jffs2_xattr_ref of size 48\n The buggy address is located 40 bytes inside of\n  48-byte region [ffff8881243384b8, ffff8881243384e8)\n [...]\n ==================================================================\n\nThe triggering of the BUG is shown in the following stack:\n-----------------------------------------------------------\njffs2_fill_super\n  jffs2_do_fill_super\n    jffs2_do_mount_fs\n      jffs2_build_filesystem\n        jffs2_scan_medium\n          jffs2_scan_eraseblock        \u003c--- ERROR\n        jffs2_clear_xattr_subsystem    \u003c--- free\n    jffs2_clear_xattr_subsystem        \u003c--- free again\n-----------------------------------------------------------\n\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\nbe executed. If the error is returned by jffs2_build_filesystem(), the\njffs2_clear_xattr_subsystem() also does not need to be executed again.\nSo move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root'\nto fix this UAF problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f68f2174-47c5-4162-ae7d-c33bf05b5a57",
      "id": "CVE-2022-48702",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()\n\nThe voice allocator sometimes begins allocating from near the end of the\narray and then wraps around, however snd_emu10k1_pcm_channel_alloc()\naccesses the newly allocated voices as if it never wrapped around.\n\nThis results in out of bounds access if the first voice has a high enough\nindex so that first_voice + requested_voice_count \u003e NUM_G (64).\nThe more voices are requested, the more likely it is for this to occur.\n\nThis was initially discovered using PipeWire, however it can be reproduced\nby calling aplay multiple times with 16 channels:\naplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero\n\nUBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40\nindex 65 is out of range for type 'snd_emu10k1_voice [64]'\nCPU: 1 PID: 31977 Comm: aplay Tainted: G        W IOE      6.0.0-rc2-emu10k1+ #7\nHardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002    07/22/2010\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x49/0x63\ndump_stack+0x10/0x16\nubsan_epilogue+0x9/0x3f\n__ubsan_handle_out_of_bounds.cold+0x44/0x49\nsnd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1]\nsnd_pcm_hw_params+0x29f/0x600 [snd_pcm]\nsnd_pcm_common_ioctl+0x188/0x1410 [snd_pcm]\n? exit_to_user_mode_prepare+0x35/0x170\n? do_syscall_64+0x69/0x90\n? syscall_exit_to_user_mode+0x26/0x50\n? do_syscall_64+0x69/0x90\n? exit_to_user_mode_prepare+0x35/0x170\nsnd_pcm_ioctl+0x27/0x40 [snd_pcm]\n__x64_sys_ioctl+0x95/0xd0\ndo_syscall_64+0x5c/0x90\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\nentry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e440481-9466-4c28-84c9-56148fc59dfc",
      "id": "CVE-2022-48946",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix preallocation discarding at indirect extent boundary\n\nWhen preallocation extent is the first one in the extent block, the\ncode would corrupt extent tree header instead. Fix the problem and use\nudf_delete_aext() for deleting extent to avoid some code duplication.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e732abe6-b232-42fe-9cdc-06cef4ed75e3",
      "id": "CVE-2022-49069",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw\n\n[Why]\nBelow general protection fault observed when WebGL Aquarium is run for\nlonger duration. If drm debug logs are enabled and set to 0x1f then the\nissue is observed within 10 minutes of run.\n\n[  100.717056] general protection fault, probably for non-canonical address 0x2d33302d32323032: 0000 [#1] PREEMPT SMP NOPTI\n[  100.727921] CPU: 3 PID: 1906 Comm: DrmThread Tainted: G        W         5.15.30 #12 d726c6a2d6ebe5cf9223931cbca6892f916fe18b\n[  100.754419] RIP: 0010:CalculateSwathWidth+0x1f7/0x44f\n[  100.767109] Code: 00 00 00 f2 42 0f 11 04 f0 48 8b 85 88 00 00 00 f2 42 0f 10 04 f0 48 8b 85 98 00 00 00 f2 42 0f 11 04 f0 48 8b 45 10 0f 57 c0 \u003cf3\u003e 42 0f 2a 04 b0 0f 57 c9 f3 43 0f 2a 0c b4 e8 8c e2 f3 ff 48 8b\n[  100.781269] RSP: 0018:ffffa9230079eeb0 EFLAGS: 00010246\n[  100.812528] RAX: 2d33302d32323032 RBX: 0000000000000500 RCX: 0000000000000000\n[  100.819656] RDX: 0000000000000001 RSI: ffff99deb712c49c RDI: 0000000000000000\n[  100.826781] RBP: ffffa9230079ef50 R08: ffff99deb712460c R09: ffff99deb712462c\n[  100.833907] R10: ffff99deb7124940 R11: ffff99deb7124d70 R12: ffff99deb712ae44\n[  100.841033] R13: 0000000000000001 R14: 0000000000000000 R15: ffffa9230079f0a0\n[  100.848159] FS:  00007af121212640(0000) GS:ffff99deba780000(0000) knlGS:0000000000000000\n[  100.856240] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  100.861980] CR2: 0000209000fe1000 CR3: 000000011b18c000 CR4: 0000000000350ee0\n[  100.869106] Call Trace:\n[  100.871555]  \u003cTASK\u003e\n[  100.873655]  ? asm_sysvec_reschedule_ipi+0x12/0x20\n[  100.878449]  CalculateSwathAndDETConfiguration+0x1a3/0x6dd\n[  100.883937]  dml31_ModeSupportAndSystemConfigurationFull+0x2ce4/0x76da\n[  100.890467]  ? kallsyms_lookup_buildid+0xc8/0x163\n[  100.895173]  ? kallsyms_lookup_buildid+0xc8/0x163\n[  100.899874]  ? __sprint_symbol+0x80/0x135\n[  100.903883]  ? dm_update_plane_state+0x3f9/0x4d2\n[  100.908500]  ? symbol_string+0xb7/0xde\n[  100.912250]  ? number+0x145/0x29b\n[  100.915566]  ? vsnprintf+0x341/0x5ff\n[  100.919141]  ? desc_read_finalized_seq+0x39/0x87\n[  100.923755]  ? update_load_avg+0x1b9/0x607\n[  100.927849]  ? compute_mst_dsc_configs_for_state+0x7d/0xd5b\n[  100.933416]  ? fetch_pipe_params+0xa4d/0xd0c\n[  100.937686]  ? dc_fpu_end+0x3d/0xa8\n[  100.941175]  dml_get_voltage_level+0x16b/0x180\n[  100.945619]  dcn30_internal_validate_bw+0x10e/0x89b\n[  100.950495]  ? dcn31_validate_bandwidth+0x68/0x1fc\n[  100.955285]  ? resource_build_scaling_params+0x98b/0xb8c\n[  100.960595]  ? dcn31_validate_bandwidth+0x68/0x1fc\n[  100.965384]  dcn31_validate_bandwidth+0x9a/0x1fc\n[  100.970001]  dc_validate_global_state+0x238/0x295\n[  100.974703]  amdgpu_dm_atomic_check+0x9c1/0xbce\n[  100.979235]  ? _printk+0x59/0x73\n[  100.982467]  drm_atomic_check_only+0x403/0x78b\n[  100.986912]  drm_mode_atomic_ioctl+0x49b/0x546\n[  100.991358]  ? drm_ioctl+0x1c1/0x3b3\n[  100.994936]  ? drm_atomic_set_property+0x92a/0x92a\n[  100.999725]  drm_ioctl_kernel+0xdc/0x149\n[  101.003648]  drm_ioctl+0x27f/0x3b3\n[  101.007051]  ? drm_atomic_set_property+0x92a/0x92a\n[  101.011842]  amdgpu_drm_ioctl+0x49/0x7d\n[  101.015679]  __se_sys_ioctl+0x7c/0xb8\n[  101.015685]  do_syscall_64+0x5f/0xb8\n[  101.015690]  ? __irq_exit_rcu+0x34/0x96\n\n[How]\nIt calles populate_dml_pipes which uses doubles to initialize.\nAdding FPU protection avoids context switch and probable loss of vba context\nas there is potential contention while drm debug logs are enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c00cebbe-d8d0-417a-ba59-d59c7483d6bf",
      "id": "CVE-2022-49397",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: qcom-qmp: fix struct clk leak on probe errors\n\nMake sure to release the pipe clock reference in case of a late probe\nerror (e.g. probe deferral).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d86f863-8336-4e3b-aa96-06a2c6210398",
      "id": "CVE-2022-49723",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/reset: Fix error_state_read ptr + offset use\n\nFix our pointer offset usage in error_state_read\nwhen there is no i915_gpu_coredump but buf offset\nis non-zero.\n\nThis fixes a kernel page fault can happen when\nmultiple tests are running concurrently in a loop\nand one is producing engine resets and consuming\nthe i915 error_state dump while the other is\nforcing full GT resets. (takes a while to trigger).\n\nThe dmesg call trace:\n\n[ 5590.803000] BUG: unable to handle page fault for address:\n               ffffffffa0b0e000\n[ 5590.803009] #PF: supervisor read access in kernel mode\n[ 5590.803013] #PF: error_code(0x0000) - not-present page\n[ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067\n               PTE 0\n[ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U\n                    5.17.0-rc5-ups69-guc-err-capt-rev6+ #136\n[ 5590.803033] Hardware name: Intel Corporation Alder Lake Client\n                    Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00.\n                    3031.A02.2201171222\t01/17/2022\n[ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10\n[ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1\n                     48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3\n                     66 0f 1f 44 00 00 48 89 f8 48 89 d1 \u003cf3\u003e a4\n                     c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20\n                     72 7e 40 38 fe\n[ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282\n[ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00\n               RCX: 0000000000000f8f\n[ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000\n               RDI: ffff888107ee9071\n[ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001\n               R09: 0000000000000001\n[ 5590.803069] R10: 0000000000000001 R11: 0000000000000002\n               R12: 0000000000000019\n[ 5590.803073] R13: 0000000000174fff R14: 0000000000001000\n               R15: ffff888107ee9000\n[ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000)\n               knlGS:0000000000000000\n[ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004\n               CR4: 0000000000770ee0\n[ 5590.803089] PKRU: 55555554\n[ 5590.803091] Call Trace:\n[ 5590.803093] \u003cTASK\u003e\n[ 5590.803096] error_state_read+0xa1/0xd0 [i915]\n[ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0\n[ 5590.803180] new_sync_read+0x116/0x1a0\n[ 5590.803185] vfs_read+0x114/0x1b0\n[ 5590.803189] ksys_read+0x63/0xe0\n[ 5590.803193] do_syscall_64+0x38/0xc0\n[ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 5590.803201] RIP: 0033:0x7f62aaea5912\n[ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05\n                     19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25\n                     18 00 00 00 85 c0 75 10 0f 05 \u003c48\u003e 3d 00 f0 ff\n                     ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24\n[ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246\n               ORIG_RAX: 0000000000000000\n[ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000\n               RCX: 00007f62aaea5912\n[ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f\n               RDI: 0000000000000006\n[ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010\n               R09: 0000000000101000\n[ 5590.803229] R10: 0000000000000001 R11: 0000000000000246\n               R12: 0000000000000006\n[ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010\n               R15: 0000000000200000\n[ 5590.803238] \u003c/TASK\u003e\n[ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper\n                        drm_kms_helper syscopyarea sysfillrect sysimgblt\n                        fb_sys_fops prime_numbers nfnetlink br_netfilter\n                        overlay mei_pxp mei_hdcp x86_pkg_temp_thermal\n                        coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel\n        \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4686f157-5029-4901-8666-aaf4c332e8df",
      "id": "CVE-2022-49872",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: fix panic on frag_list with mixed head alloc types\n\nSince commit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when\nsplitting gso_size mangled skb having linear-headed frag_list\"), it is\nallowed to change gso_size of a GRO packet. However, that commit assumes\nthat \"checking the first list_skb member suffices; i.e if either of the\nlist_skb members have non head_frag head, then the first one has too\".\n\nIt turns out this assumption does not hold. We've seen BUG_ON being hit\nin skb_segment when skbs on the frag_list had differing head_frag with\nthe vmxnet3 driver. This happens because __netdev_alloc_skb and\n__napi_alloc_skb can return a skb that is page backed or kmalloced\ndepending on the requested size. As the result, the last small skb in\nthe GRO packet can be kmalloced.\n\nThere are three different locations where this can be fixed:\n\n(1) We could check head_frag in GRO and not allow GROing skbs with\n    different head_frag. However, that would lead to performance\n    regression on normal forward paths with unmodified gso_size, where\n    !head_frag in the last packet is not a problem.\n\n(2) Set a flag in bpf_skb_net_grow and bpf_skb_net_shrink indicating\n    that NETIF_F_SG is undesirable. That would need to eat a bit in\n    sk_buff. Furthermore, that flag can be unset when all skbs on the\n    frag_list are page backed. To retain good performance,\n    bpf_skb_net_grow/shrink would have to walk the frag_list.\n\n(3) Walk the frag_list in skb_segment when determining whether\n    NETIF_F_SG should be cleared. This of course slows things down.\n\nThis patch implements (3). To limit the performance impact in\nskb_segment, the list is walked only for skbs with SKB_GSO_DODGY set\nthat have gso_size changed. Normal paths thus will not hit it.\n\nWe could check only the last skb but since we need to walk the whole\nlist anyway, let's stay on the safe side.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19d443f0-335a-47f6-b1d1-4df2515b3436",
      "id": "CVE-2022-49937",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mceusb: Use new usb_control_msg_*() routines\n\nAutomatic kernel fuzzing led to a WARN about invalid pipe direction in\nthe mceusb driver:\n\n------------[ cut here ]------------\nusb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 40\nWARNING: CPU: 0 PID: 2465 at drivers/usb/core/urb.c:410\nusb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410\nModules linked in:\nCPU: 0 PID: 2465 Comm: kworker/0:2 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410\nCode: 7c 24 40 e8 ac 23 91 fd 48 8b 7c 24 40 e8 b2 70 1b ff 45 89 e8\n44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 a0 30 a9 86 e8 48 07 11 02 \u003c0f\u003e 0b\ne9 1c f0 ff ff e8 7e 23 91 fd 0f b6 1d 63 22 83 05 31 ff 41\nRSP: 0018:ffffc900032becf0 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff8881100f3058 RCX: 0000000000000000\nRDX: ffffc90004961000 RSI: ffff888114c6d580 RDI: fffff52000657d90\nRBP: ffff888105ad90f0 R08: ffffffff812c3638 R09: 0000000000000000\nR10: 0000000000000005 R11: ffffed1023504ef1 R12: ffff888105ad9000\nR13: 0000000000000040 R14: 0000000080000380 R15: ffff88810ba96500\nFS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffe810bda58 CR3: 000000010b720000 CR4: 0000000000350ef0\nCall Trace:\n\u003cTASK\u003e\nusb_start_wait_urb+0x101/0x4c0 drivers/usb/core/message.c:58\nusb_internal_control_msg drivers/usb/core/message.c:102 [inline]\nusb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153\nmceusb_gen1_init drivers/media/rc/mceusb.c:1431 [inline]\nmceusb_dev_probe+0x258e/0x33f0 drivers/media/rc/mceusb.c:1807\n\nThe reason for the warning is clear enough; the driver sends an\nunusual read request on endpoint 0 but does not set the USB_DIR_IN bit\nin the bRequestType field.\n\nMore importantly, the whole situation can be avoided and the driver\nsimplified by converting it over to the relatively new\nusb_control_msg_recv() and usb_control_msg_send() routines.  That's\nwhat this fix does.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9031aab0-949f-4786-95cc-7bb3f82b3a6f",
      "id": "CVE-2022-49983",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: Set the DMA mask for the udmabuf device (v2)\n\nIf the DMA mask is not set explicitly, the following warning occurs\nwhen the userspace tries to access the dma-buf via the CPU as\nreported by syzbot here:\n\nWARNING: CPU: 1 PID: 3595 at kernel/dma/mapping.c:188\n__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188\nModules linked in:\nCPU: 0 PID: 3595 Comm: syz-executor249 Not tainted\n5.17.0-rc2-syzkaller-00316-g0457e5153e0e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nRIP: 0010:__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188\nCode: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 71 4c 8b 3d c0\n83 b5 0d e9 db fe ff ff e8 b6 0f 13 00 0f 0b e8 af 0f 13 00 \u003c0f\u003e 0b 45\n   31 e4 e9 54 ff ff ff e8 a0 0f 13 00 49 8d 7f 50 48 b8 00\nRSP: 0018:ffffc90002a07d68 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88807e25e2c0 RSI: ffffffff81649e91 RDI: ffff88801b848408\nRBP: ffff88801b848000 R08: 0000000000000002 R09: ffff88801d86c74f\nR10: ffffffff81649d72 R11: 0000000000000001 R12: 0000000000000002\nR13: ffff88801d86c680 R14: 0000000000000001 R15: 0000000000000000\nFS:  0000555556e30300(0000) GS:ffff8880b9d00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200000cc CR3: 000000001d74a000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n dma_map_sgtable+0x70/0xf0 kernel/dma/mapping.c:264\n get_sg_table.isra.0+0xe0/0x160 drivers/dma-buf/udmabuf.c:72\n begin_cpu_udmabuf+0x130/0x1d0 drivers/dma-buf/udmabuf.c:126\n dma_buf_begin_cpu_access+0xfd/0x1d0 drivers/dma-buf/dma-buf.c:1164\n dma_buf_ioctl+0x259/0x2b0 drivers/dma-buf/dma-buf.c:363\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f62fcf530f9\nCode: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89\nf7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\nf0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffe3edab9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f62fcf530f9\nRDX: 0000000020000200 RSI: 0000000040086200 RDI: 0000000000000006\nRBP: 00007f62fcf170e0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f62fcf17170\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e\n\nv2: Dont't forget to deregister if DMA mask setup fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87a58ac2-5833-4221-b5b9-d156e53f8604",
      "id": "CVE-2022-50114",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: 9p: fix refcount leak in p9_read_work() error handling\n\np9_req_put need to be called when m-\u003erreq-\u003erc.sdata is NULL to avoid\ntemporary refcount leak.\n\n[Dominique: commit wording adjustments, p9_req_put argument fixes for rebase]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54d5a71d-3b7a-47dd-95ca-1abfa2ba07bd",
      "id": "CVE-2024-35931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Skip do PCI error slot reset during RAS recovery\n\nWhy:\n    The PCI error slot reset maybe triggered after inject ue to UMC multi times, this\n    caused system hang.\n    [  557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume\n    [  557.373718] [drm] PCIE GART of 512M enabled.\n    [  557.373722] [drm] PTB located at 0x0000031FED700000\n    [  557.373788] [drm] VRAM is lost due to GPU reset!\n    [  557.373789] [drm] PSP is resuming...\n    [  557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset\n    [  557.547067] [drm] PCI error: detected callback, state(1)!!\n    [  557.547069] [drm] No support for XGMI hive yet...\n    [  557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter\n    [  557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations\n    [  557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered\n    [  557.610492] [drm] PCI error: slot reset callback!!\n    ...\n    [  560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded!\n    [  560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded!\n    [  560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI\n    [  560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G           OE     5.15.0-91-generic #101-Ubuntu\n    [  560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023\n    [  560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu]\n    [  560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\n    [  560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff \u003c48\u003e 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00\n    [  560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202\n    [  560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0\n    [  560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010\n    [  560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08\n    [  560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000\n    [  560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000\n    [  560.803889] FS:  0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000\n    [  560.812973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    [  560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0\n    [  560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    [  560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n    [  560.843444] PKRU: 55555554\n    [  560.846480] Call Trace:\n    [  560.849225]  \u003cTASK\u003e\n    [  560.851580]  ? show_trace_log_lvl+0x1d6/0x2ea\n    [  560.856488]  ? show_trace_log_lvl+0x1d6/0x2ea\n    [  560.861379]  ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\n    [  560.867778]  ? show_regs.part.0+0x23/0x29\n    [  560.872293]  ? __die_body.cold+0x8/0xd\n    [  560.876502]  ? die_addr+0x3e/0x60\n    [  560.880238]  ? exc_general_protection+0x1c5/0x410\n    [  560.885532]  ? asm_exc_general_protection+0x27/0x30\n    [  560.891025]  ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu]\n    [  560.898323]  amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu]\n    [  560.904520]  process_one_work+0x228/0x3d0\nHow:\n    In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected\n    all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95e033e7-6c92-469b-94d0-7b23ffe28c89",
      "id": "CVE-2022-50249",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: of: Fix refcount leak bug in of_get_ddr_timings()\n\nWe should add the of_node_put() when breaking out of\nfor_each_child_of_node() as it will automatically increase\nand decrease the refcount.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33827f60-c382-44e5-9a9e-d925f99eb6d2",
      "id": "CVE-2022-50286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline\n\nWhen converting files with inline data to extents, delayed allocations\nmade on a file system created with both the bigalloc and inline options\ncan result in invalid extent status cache content, incorrect reserved\ncluster counts, kernel memory leaks, and potential kernel panics.\n\nWith bigalloc, the code that determines whether a block must be\ndelayed allocated searches the extent tree to see if that block maps\nto a previously allocated cluster.  If not, the block is delayed\nallocated, and otherwise, it isn't.  However, if the inline option is\nalso used, and if the file containing the block is marked as able to\nstore data inline, there isn't a valid extent tree associated with\nthe file.  The current code in ext4_clu_mapped() calls\next4_find_extent() to search the non-existent tree for a previously\nallocated cluster anyway, which typically finds nothing, as desired.\nHowever, a side effect of the search can be to cache invalid content\nfrom the non-existent tree (garbage) in the extent status tree,\nincluding bogus entries in the pending reservation tree.\n\nTo fix this, avoid searching the extent tree when allocating blocks\nfor bigalloc + inline files that are being converted from inline to\nextent mapped.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f786fa7-8baf-4fe2-bead-f211b64141d5",
      "id": "CVE-2022-50396",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix memory leak in tcindex_set_parms\n\nSyzkaller reports a memory leak as follows:\n====================================\nBUG: memory leak\nunreferenced object 0xffff88810c287f00 (size 256):\n  comm \"syz-executor105\", pid 3600, jiffies 4294943292 (age 12.990s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff814cf9f0\u003e] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046\n    [\u003cffffffff839c9e07\u003e] kmalloc include/linux/slab.h:576 [inline]\n    [\u003cffffffff839c9e07\u003e] kmalloc_array include/linux/slab.h:627 [inline]\n    [\u003cffffffff839c9e07\u003e] kcalloc include/linux/slab.h:659 [inline]\n    [\u003cffffffff839c9e07\u003e] tcf_exts_init include/net/pkt_cls.h:250 [inline]\n    [\u003cffffffff839c9e07\u003e] tcindex_set_parms+0xa7/0xbe0 net/sched/cls_tcindex.c:342\n    [\u003cffffffff839caa1f\u003e] tcindex_change+0xdf/0x120 net/sched/cls_tcindex.c:553\n    [\u003cffffffff8394db62\u003e] tc_new_tfilter+0x4f2/0x1100 net/sched/cls_api.c:2147\n    [\u003cffffffff8389e91c\u003e] rtnetlink_rcv_msg+0x4dc/0x5d0 net/core/rtnetlink.c:6082\n    [\u003cffffffff839eba67\u003e] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2540\n    [\u003cffffffff839eab87\u003e] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n    [\u003cffffffff839eab87\u003e] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345\n    [\u003cffffffff839eb046\u003e] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921\n    [\u003cffffffff8383e796\u003e] sock_sendmsg_nosec net/socket.c:714 [inline]\n    [\u003cffffffff8383e796\u003e] sock_sendmsg+0x56/0x80 net/socket.c:734\n    [\u003cffffffff8383eb08\u003e] ____sys_sendmsg+0x178/0x410 net/socket.c:2482\n    [\u003cffffffff83843678\u003e] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536\n    [\u003cffffffff838439c5\u003e] __sys_sendmmsg+0x105/0x330 net/socket.c:2622\n    [\u003cffffffff83843c14\u003e] __do_sys_sendmmsg net/socket.c:2651 [inline]\n    [\u003cffffffff83843c14\u003e] __se_sys_sendmmsg net/socket.c:2648 [inline]\n    [\u003cffffffff83843c14\u003e] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2648\n    [\u003cffffffff84605fd5\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    [\u003cffffffff84605fd5\u003e] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n    [\u003cffffffff84800087\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n====================================\n\nKernel uses tcindex_change() to change an existing\nfilter properties.\n\nYet the problem is that, during the process of changing,\nif `old_r` is retrieved from `p-\u003eperfect`, then\nkernel uses tcindex_alloc_perfect_hash() to newly\nallocate filter results, uses tcindex_filter_result_init()\nto clear the old filter result, without destroying\nits tcf_exts structure, which triggers the above memory leak.\n\nTo be more specific, there are only two source for the `old_r`,\naccording to the tcindex_lookup(). `old_r` is retrieved from\n`p-\u003eperfect`, or `old_r` is retrieved from `p-\u003eh`.\n\n  * If `old_r` is retrieved from `p-\u003eperfect`, kernel uses\ntcindex_alloc_perfect_hash() to newly allocate the\nfilter results. Then `r` is assigned with `cp-\u003eperfect + handle`,\nwhich is newly allocated. So condition `old_r \u0026\u0026 old_r != r` is\ntrue in this situation, and kernel uses tcindex_filter_result_init()\nto clear the old filter result, without destroying\nits tcf_exts structure\n\n  * If `old_r` is retrieved from `p-\u003eh`, then `p-\u003eperfect` is NULL\naccording to the tcindex_lookup(). Considering that `cp-\u003eh`\nis directly copied from `p-\u003eh` and `p-\u003eperfect` is NULL,\n`r` is assigned with `tcindex_lookup(cp, handle)`, whose value\nshould be the same as `old_r`, so condition `old_r \u0026\u0026 old_r != r`\nis false in this situation, kernel ignores using\ntcindex_filter_result_init() to clear the old filter result.\n\nSo only when `old_r` is retrieved from `p-\u003eperfect` does kernel use\ntcindex_filter_result_init() to clear the old filter result, which\ntriggers the above memory leak.\n\nConsidering that there already exists a tc_filter_wq workqueue\nto destroy the old tcindex_d\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d971a732-e00f-4791-9de3-af9771ed2f18",
      "id": "CVE-2023-0045",
      "description": "The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176.\n\nWe recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae0010e4-d039-412b-9ea8-a4fcdd91fdbf",
      "id": "CVE-2023-34256",
      "description": "An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated \"When modifying the block device while it is mounted by the filesystem\" access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2dde4968-0bc7-40d1-be2e-e87da7fd9a6b",
      "id": "CVE-2023-52508",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()\n\nThe nvme_fc_fcp_op structure describing an AEN operation is initialized with a\nnull request structure pointer. An FC LLDD may make a call to\nnvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation.\n\nAdd validation of the request structure pointer before dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ac6aacd-d089-4538-a5e4-b365cae78df1",
      "id": "CVE-2023-52639",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: vsie: fix race during shadow creation\n\nRight now it is possible to see gmap-\u003eprivate being zero in\nkvm_s390_vsie_gmap_notifier resulting in a crash.  This is due to the\nfact that we add gmap-\u003eprivate == kvm after creation:\n\nstatic int acquire_gmap_shadow(struct kvm_vcpu *vcpu,\n                               struct vsie_page *vsie_page)\n{\n[...]\n        gmap = gmap_shadow(vcpu-\u003earch.gmap, asce, edat);\n        if (IS_ERR(gmap))\n                return PTR_ERR(gmap);\n        gmap-\u003eprivate = vcpu-\u003ekvm;\n\nLet children inherit the private field of the parent.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "22902a66-9d11-4232-bdb8-5fb8729e529b",
      "id": "CVE-2023-52690",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/powernv: Add a null pointer check to scom_debug_init_one()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.\nAdd a null pointer check, and release 'ent' to avoid memory leaks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bbf7802e-33bd-47a5-8fa6-ec379bce4fa4",
      "id": "CVE-2023-52808",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs\n\nIf init debugfs failed during device registration due to memory allocation\nfailure, debugfs_remove_recursive() is called, after which debugfs_dir is\nnot set to NULL. debugfs_remove_recursive() will be called again during\ndevice removal. As a result, illegal pointer is accessed.\n\n[ 1665.467244] hisi_sas_v3_hw 0000:b4:02.0: failed to init debugfs!\n...\n[ 1669.836708] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0\n[ 1669.872669] pc : down_write+0x24/0x70\n[ 1669.876315] lr : down_write+0x1c/0x70\n[ 1669.879961] sp : ffff000036f53a30\n[ 1669.883260] x29: ffff000036f53a30 x28: ffffa027c31549f8\n[ 1669.888547] x27: ffffa027c3140000 x26: 0000000000000000\n[ 1669.893834] x25: ffffa027bf37c270 x24: ffffa027bf37c270\n[ 1669.899122] x23: ffff0000095406b8 x22: ffff0000095406a8\n[ 1669.904408] x21: 0000000000000000 x20: ffffa027bf37c310\n[ 1669.909695] x19: 00000000000000a0 x18: ffff8027dcd86f10\n[ 1669.914982] x17: 0000000000000000 x16: 0000000000000000\n[ 1669.920268] x15: 0000000000000000 x14: ffffa0274014f870\n[ 1669.925555] x13: 0000000000000040 x12: 0000000000000228\n[ 1669.930842] x11: 0000000000000020 x10: 0000000000000bb0\n[ 1669.936129] x9 : ffff000036f537f0 x8 : ffff80273088ca10\n[ 1669.941416] x7 : 000000000000001d x6 : 00000000ffffffff\n[ 1669.946702] x5 : ffff000008a36310 x4 : ffff80273088be00\n[ 1669.951989] x3 : ffff000009513e90 x2 : 0000000000000000\n[ 1669.957276] x1 : 00000000000000a0 x0 : ffffffff00000001\n[ 1669.962563] Call trace:\n[ 1669.965000]  down_write+0x24/0x70\n[ 1669.968301]  debugfs_remove_recursive+0x5c/0x1b0\n[ 1669.972905]  hisi_sas_debugfs_exit+0x24/0x30 [hisi_sas_main]\n[ 1669.978541]  hisi_sas_v3_remove+0x130/0x150 [hisi_sas_v3_hw]\n[ 1669.984175]  pci_device_remove+0x48/0xd8\n[ 1669.988082]  device_release_driver_internal+0x1b4/0x250\n[ 1669.993282]  device_release_driver+0x28/0x38\n[ 1669.997534]  pci_stop_bus_device+0x84/0xb8\n[ 1670.001611]  pci_stop_and_remove_bus_device_locked+0x24/0x40\n[ 1670.007244]  remove_store+0xfc/0x140\n[ 1670.010802]  dev_attr_store+0x44/0x60\n[ 1670.014448]  sysfs_kf_write+0x58/0x80\n[ 1670.018095]  kernfs_fop_write+0xe8/0x1f0\n[ 1670.022000]  __vfs_write+0x60/0x190\n[ 1670.025472]  vfs_write+0xac/0x1c0\n[ 1670.028771]  ksys_write+0x6c/0xd8\n[ 1670.032071]  __arm64_sys_write+0x24/0x30\n[ 1670.035977]  el0_svc_common+0x78/0x130\n[ 1670.039710]  el0_svc_handler+0x38/0x78\n[ 1670.043442]  el0_svc+0x8/0xc\n\nTo fix this, set debugfs_dir to NULL after debugfs_remove_recursive().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "828cc6ee-36a7-4f24-a5db-3448d9f61a75",
      "id": "CVE-2023-52906",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mpls: Fix warning during failed attribute validation\n\nThe 'TCA_MPLS_LABEL' attribute is of 'NLA_U32' type, but has a\nvalidation type of 'NLA_VALIDATE_FUNCTION'. This is an invalid\ncombination according to the comment above 'struct nla_policy':\n\n\"\nMeaning of `validate' field, use via NLA_POLICY_VALIDATE_FN:\n   NLA_BINARY           Validation function called for the attribute.\n   All other            Unused - but note that it's a union\n\"\n\nThis can trigger the warning [1] in nla_get_range_unsigned() when\nvalidation of the attribute fails. Despite being of 'NLA_U32' type, the\nassociated 'min'/'max' fields in the policy are negative as they are\naliased by the 'validate' field.\n\nFix by changing the attribute type to 'NLA_BINARY' which is consistent\nwith the above comment and all other users of NLA_POLICY_VALIDATE_FN().\nAs a result, move the length validation to the validation function.\n\nNo regressions in MPLS tests:\n\n # ./tdc.py -f tc-tests/actions/mpls.json\n [...]\n # echo $?\n 0\n\n[1]\nWARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118\nnla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117\nModules linked in:\nCPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014\nRIP: 0010:nla_get_range_unsigned+0x1d8/0x1e0 lib/nlattr.c:117\n[...]\nCall Trace:\n \u003cTASK\u003e\n __netlink_policy_dump_write_attr+0x23d/0x990 net/netlink/policy.c:310\n netlink_policy_dump_write_attr+0x22/0x30 net/netlink/policy.c:411\n netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline]\n netlink_ack+0x546/0x760 net/netlink/af_netlink.c:2506\n netlink_rcv_skb+0x1b7/0x240 net/netlink/af_netlink.c:2546\n rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:6109\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n ____sys_sendmsg+0x38f/0x500 net/socket.c:2482\n ___sys_sendmsg net/socket.c:2536 [inline]\n __sys_sendmsg+0x197/0x230 net/socket.c:2565\n __do_sys_sendmsg net/socket.c:2574 [inline]\n __se_sys_sendmsg net/socket.c:2572 [inline]\n __x64_sys_sendmsg+0x42/0x50 net/socket.c:2572\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae055453-536e-43a5-8878-eea8341479a2",
      "id": "CVE-2023-53246",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL\n\nWhen compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount\nis NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to\nS_AUTOMOUNT and corresponding dentry flags is retained regardless of\nCONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in\nVFS follow_automount() when traversing a DFS referral link:\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   __traverse_mounts+0xb5/0x220\n   ? cifs_revalidate_mapping+0x65/0xc0 [cifs]\n   step_into+0x195/0x610\n   ? lookup_fast+0xe2/0xf0\n   path_lookupat+0x64/0x140\n   filename_lookup+0xc2/0x140\n   ? __create_object+0x299/0x380\n   ? kmem_cache_alloc+0x119/0x220\n   ? user_path_at_empty+0x31/0x50\n   user_path_at_empty+0x31/0x50\n   __x64_sys_chdir+0x2a/0xd0\n   ? exit_to_user_mode_prepare+0xca/0x100\n   do_syscall_64+0x42/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nThis fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler\nwhen CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to\navoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This\napproach was chosen as it provides more control over the error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "933af0fb-171c-439f-bd1f-1ccb2140d242",
      "id": "CVE-2024-25739",
      "description": "create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi-\u003eleb_size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef8bfcd2-c50f-4c6b-a770-e1fea814befd",
      "id": "CVE-2024-26841",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Update cpu_sibling_map when disabling nonboot CPUs\n\nUpdate cpu_sibling_map when disabling nonboot CPUs by defining \u0026 calling\nclear_cpu_sibling_map(), otherwise we get such errors on SMT systems:\n\njump label: negative count!\nWARNING: CPU: 6 PID: 45 at kernel/jump_label.c:263 __static_key_slow_dec_cpuslocked+0xec/0x100\nCPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340\npc 90000000004c302c ra 90000000004c302c tp 90000001005bc000 sp 90000001005bfd20\na0 000000000000001b a1 900000000224c278 a2 90000001005bfb58 a3 900000000224c280\na4 900000000224c278 a5 90000001005bfb50 a6 0000000000000001 a7 0000000000000001\nt0 ce87a4763eb5234a t1 ce87a4763eb5234a t2 0000000000000000 t3 0000000000000000\nt4 0000000000000006 t5 0000000000000000 t6 0000000000000064 t7 0000000000001964\nt8 000000000009ebf6 u0 9000000001f2a068 s9 0000000000000000 s0 900000000246a2d8\ns1 ffffffffffffffff s2 ffffffffffffffff s3 90000000021518c0 s4 0000000000000040\ns5 9000000002151058 s6 9000000009828e40 s7 00000000000000b4 s8 0000000000000006\n   ra: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100\n  ERA: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100\n CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n PRMD: 00000004 (PPLV0 +PIE -PWE)\n EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n ECFG: 00071c1c (LIE=2-4,10-12 VS=7)\nESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)\n PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV)\nCPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340\nStack : 0000000000000000 900000000203f258 900000000179afc8 90000001005bc000\n        90000001005bf980 0000000000000000 90000001005bf988 9000000001fe0be0\n        900000000224c280 900000000224c278 90000001005bf8c0 0000000000000001\n        0000000000000001 ce87a4763eb5234a 0000000007f38000 90000001003f8cc0\n        0000000000000000 0000000000000006 0000000000000000 4c206e6f73676e6f\n        6f4c203a656d616e 000000000009ec99 0000000007f38000 0000000000000000\n        900000000214b000 9000000001fe0be0 0000000000000004 0000000000000000\n        0000000000000107 0000000000000009 ffffffffffafdabe 00000000000000b4\n        0000000000000006 90000000004c302c 9000000000224528 00005555939a0c7c\n        00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n        ...\nCall Trace:\n[\u003c9000000000224528\u003e] show_stack+0x48/0x1a0\n[\u003c900000000179afc8\u003e] dump_stack_lvl+0x78/0xa0\n[\u003c9000000000263ed0\u003e] __warn+0x90/0x1a0\n[\u003c90000000017419b8\u003e] report_bug+0x1b8/0x280\n[\u003c900000000179c564\u003e] do_bp+0x264/0x420\n[\u003c90000000004c302c\u003e] __static_key_slow_dec_cpuslocked+0xec/0x100\n[\u003c90000000002b4d7c\u003e] sched_cpu_deactivate+0x2fc/0x300\n[\u003c9000000000266498\u003e] cpuhp_invoke_callback+0x178/0x8a0\n[\u003c9000000000267f70\u003e] cpuhp_thread_fun+0xf0/0x240\n[\u003c90000000002a117c\u003e] smpboot_thread_fn+0x1dc/0x2e0\n[\u003c900000000029a720\u003e] kthread+0x140/0x160\n[\u003c9000000000222288\u003e] ret_from_kernel_thread+0xc/0xa4",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0a63d03-9f16-40b5-b3f8-2d178715a677",
      "id": "CVE-2024-26962",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape\n\nFor raid456, if reshape is still in progress, then IO across reshape\nposition will wait for reshape to make progress. However, for dm-raid,\nin following cases reshape will never make progress hence IO will hang:\n\n1) the array is read-only;\n2) MD_RECOVERY_WAIT is set;\n3) MD_RECOVERY_FROZEN is set;\n\nAfter commit c467e97f079f (\"md/raid6: use valid sector values to determine\nif an I/O should wait on the reshape\") fix the problem that IO across\nreshape position doesn't wait for reshape, the dm-raid test\nshell/lvconvert-raid-reshape.sh start to hang:\n\n[root@fedora ~]# cat /proc/979/stack\n[\u003c0\u003e] wait_woken+0x7d/0x90\n[\u003c0\u003e] raid5_make_request+0x929/0x1d70 [raid456]\n[\u003c0\u003e] md_handle_request+0xc2/0x3b0 [md_mod]\n[\u003c0\u003e] raid_map+0x2c/0x50 [dm_raid]\n[\u003c0\u003e] __map_bio+0x251/0x380 [dm_mod]\n[\u003c0\u003e] dm_submit_bio+0x1f0/0x760 [dm_mod]\n[\u003c0\u003e] __submit_bio+0xc2/0x1c0\n[\u003c0\u003e] submit_bio_noacct_nocheck+0x17f/0x450\n[\u003c0\u003e] submit_bio_noacct+0x2bc/0x780\n[\u003c0\u003e] submit_bio+0x70/0xc0\n[\u003c0\u003e] mpage_readahead+0x169/0x1f0\n[\u003c0\u003e] blkdev_readahead+0x18/0x30\n[\u003c0\u003e] read_pages+0x7c/0x3b0\n[\u003c0\u003e] page_cache_ra_unbounded+0x1ab/0x280\n[\u003c0\u003e] force_page_cache_ra+0x9e/0x130\n[\u003c0\u003e] page_cache_sync_ra+0x3b/0x110\n[\u003c0\u003e] filemap_get_pages+0x143/0xa30\n[\u003c0\u003e] filemap_read+0xdc/0x4b0\n[\u003c0\u003e] blkdev_read_iter+0x75/0x200\n[\u003c0\u003e] vfs_read+0x272/0x460\n[\u003c0\u003e] ksys_read+0x7a/0x170\n[\u003c0\u003e] __x64_sys_read+0x1c/0x30\n[\u003c0\u003e] do_syscall_64+0xc6/0x230\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74\n\nThis is because reshape can't make progress.\n\nFor md/raid, the problem doesn't exist because register new sync_thread\ndoesn't rely on the IO to be done any more:\n\n1) If array is read-only, it can switch to read-write by ioctl/sysfs;\n2) md/raid never set MD_RECOVERY_WAIT;\n3) If MD_RECOVERY_FROZEN is set, mddev_suspend() doesn't hold\n   'reconfig_mutex', hence it can be cleared and reshape can continue by\n   sysfs api 'sync_action'.\n\nHowever, I'm not sure yet how to avoid the problem in dm-raid yet. This\npatch on the one hand make sure raid_message() can't change\nsync_thread() through raid_message() after presuspend(), on the other\nhand detect the above 3 cases before wait for IO do be done in\ndm_suspend(), and let dm-raid requeue those IO.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74491de7-ac5c-4e31-818e-6026474300b6",
      "id": "CVE-2024-35910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: properly terminate timers for kernel sockets\n\nWe had various syzbot reports about tcp timers firing after\nthe corresponding netns has been dismantled.\n\nFortunately Josef Bacik could trigger the issue more often,\nand could test a patch I wrote two years ago.\n\nWhen TCP sockets are closed, we call inet_csk_clear_xmit_timers()\nto 'stop' the timers.\n\ninet_csk_clear_xmit_timers() can be called from any context,\nincluding when socket lock is held.\nThis is the reason it uses sk_stop_timer(), aka del_timer().\nThis means that ongoing timers might finish much later.\n\nFor user sockets, this is fine because each running timer\nholds a reference on the socket, and the user socket holds\na reference on the netns.\n\nFor kernel sockets, we risk that the netns is freed before\ntimer can complete, because kernel sockets do not hold\nreference on the netns.\n\nThis patch adds inet_csk_clear_xmit_timers_sync() function\nthat using sk_stop_timer_sync() to make sure all timers\nare terminated before the kernel socket is released.\nModules using kernel sockets close them in their netns exit()\nhandler.\n\nAlso add sock_not_owned_by_me() helper to get LOCKDEP\nsupport : inet_csk_clear_xmit_timers_sync() must not be called\nwhile socket lock is held.\n\nIt is very possible we can revert in the future commit\n3a58f13a881e (\"net: rds: acquire refcount on TCP sockets\")\nwhich attempted to solve the issue in rds only.\n(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)\n\nWe probably can remove the check_net() tests from\ntcp_out_of_resources() and __tcp_close() in the future.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0935d147-416b-4db4-b635-bad919b4df47",
      "id": "CVE-2024-36968",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()\n\nl2cap_le_flowctl_init() can cause both div-by-zero and an integer\noverflow since hdev-\u003ele_mtu may not fall in the valid range.\n\nMove MTU from hci_dev to hci_conn to validate MTU and stop the connection\nprocess earlier if MTU is invalid.\nAlso, add a missing validation in read_buffer_size() and make it return\nan error value if the validation fails.\nNow hci_conn_add() returns ERR_PTR() as it can fail due to the both a\nkzalloc failure and invalid MTU value.\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G        W          6.9.0-rc5+ #20\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nWorkqueue: hci0 hci_rx_work\nRIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547\nCode: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c\n89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 \u003c66\u003e f7 f3 89 c3 ff c3 4d 8d\nb7 88 00 00 00 4c 89 f0 48 c1 e8 03 42\nRSP: 0018:ffff88810bc0f858 EFLAGS: 00010246\nRAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f\nRBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa\nR10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084\nR13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000\nFS:  0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline]\n l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline]\n l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline]\n l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809\n l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506\n hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline]\n hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335\n worker_thread+0x926/0xe70 kernel/workqueue.c:3416\n kthread+0x2e3/0x380 kernel/kthread.c:388\n ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\nModules linked in:\n---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81ce1322-52e2-48c1-82de-8065fd83a89c",
      "id": "CVE-2024-39473",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension\n\nIf a process module does not have base config extension then the same\nformat applies to all of it's inputs and the process-\u003ebase_config_ext is\nNULL, causing NULL dereference when specifically crafted topology and\nsequences used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e14c7879-8e7d-4fb4-9782-cb861855d776",
      "id": "CVE-2024-41017",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: don't walk off the end of ealist\n\nAdd a check before visiting the members of ea to\nmake sure each ea stays within the ealist.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56df9df1-977e-4792-afe4-124f03b29bc5",
      "id": "CVE-2024-41070",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()\n\nAl reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group().\n\nIt looks up `stt` from tablefd, but then continues to use it after doing\nfdput() on the returned fd. After the fdput() the tablefd is free to be\nclosed by another thread. The close calls kvm_spapr_tce_release() and\nthen release_spapr_tce_table() (via call_rcu()) which frees `stt`.\n\nAlthough there are calls to rcu_read_lock() in\nkvm_spapr_tce_attach_iommu_group() they are not sufficient to prevent\nthe UAF, because `stt` is used outside the locked regions.\n\nWith an artifcial delay after the fdput() and a userspace program which\ntriggers the race, KASAN detects the UAF:\n\n  BUG: KASAN: slab-use-after-free in kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]\n  Read of size 4 at addr c000200027552c30 by task kvm-vfio/2505\n  CPU: 54 PID: 2505 Comm: kvm-vfio Not tainted 6.10.0-rc3-next-20240612-dirty #1\n  Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV\n  Call Trace:\n    dump_stack_lvl+0xb4/0x108 (unreliable)\n    print_report+0x2b4/0x6ec\n    kasan_report+0x118/0x2b0\n    __asan_load4+0xb8/0xd0\n    kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]\n    kvm_vfio_set_attr+0x524/0xac0 [kvm]\n    kvm_device_ioctl+0x144/0x240 [kvm]\n    sys_ioctl+0x62c/0x1810\n    system_call_exception+0x190/0x440\n    system_call_vectored_common+0x15c/0x2ec\n  ...\n  Freed by task 0:\n   ...\n   kfree+0xec/0x3e0\n   release_spapr_tce_table+0xd4/0x11c [kvm]\n   rcu_core+0x568/0x16a0\n   handle_softirqs+0x23c/0x920\n   do_softirq_own_stack+0x6c/0x90\n   do_softirq_own_stack+0x58/0x90\n   __irq_exit_rcu+0x218/0x2d0\n   irq_exit+0x30/0x80\n   arch_local_irq_restore+0x128/0x230\n   arch_local_irq_enable+0x1c/0x30\n   cpuidle_enter_state+0x134/0x5cc\n   cpuidle_enter+0x6c/0xb0\n   call_cpuidle+0x7c/0x100\n   do_idle+0x394/0x410\n   cpu_startup_entry+0x60/0x70\n   start_secondary+0x3fc/0x410\n   start_secondary_prolog+0x10/0x14\n\nFix it by delaying the fdput() until `stt` is no longer in use, which\nis effectively the entire function. To keep the patch minimal add a call\nto fdput() at each of the existing return paths. Future work can convert\nthe function to goto or __cleanup style cleanup.\n\nWith the fix in place the test case no longer triggers the UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0d8ed6d-44d8-425a-9dba-089083dfc586",
      "id": "CVE-2024-42118",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not return negative stream id for array\n\n[WHY]\nresource_stream_to_stream_idx returns an array index and it return -1\nwhen not found; however, -1 is not a valid array index number.\n\n[HOW]\nWhen this happens, call ASSERT(), and return a zero instead.\n\nThis fixes an OVERRUN and an NEGATIVE_RETURNS issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "50acd287-8621-4f1e-8588-591846cdab6c",
      "id": "CVE-2024-44957",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: privcmd: Switch from mutex to spinlock for irqfds\n\nirqfd_wakeup() gets EPOLLHUP, when it is called by\neventfd_release() by way of wake_up_poll(\u0026ctx-\u003ewqh, EPOLLHUP), which\ngets called under spin_lock_irqsave(). We can't use a mutex here as it\nwill lead to a deadlock.\n\nFix it by switching over to a spin lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9932a7d0-dd14-4139-83b8-948a84ca68c5",
      "id": "CVE-2024-47661",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid overflow from uint32_t to uint8_t\n\n[WHAT \u0026 HOW]\ndmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned\n0xFFFF. Fix it by changing it to uint8_t with value of 0xFF.\n\nThis fixes 2 INTEGER_OVERFLOW issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bda53c56-51cd-42f7-9262-380a0d9a12a4",
      "id": "CVE-2024-47693",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/core: Fix ib_cache_setup_one error flow cleanup\n\nWhen ib_cache_update return an error, we exit ib_cache_setup_one\ninstantly with no proper cleanup, even though before this we had\nalready successfully done gid_table_setup_one, that results in\nthe kernel WARN below.\n\nDo proper cleanup using gid_table_cleanup_one before returning\nthe err in order to fix the issue.\n\nWARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0\nModules linked in:\nCPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:gid_table_release_one+0x181/0x1a0\nCode: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff \u003c0f\u003e 0b 4c 8b 75 30 e9 54 ff ff ff 48 8    3 c4 10 5b 5d 41 5c 41 5d 41\nRSP: 0018:ffffc90002b835b0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527\nRDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001\nRBP: ffff8881011b3d00 R08: ffff88810b3abe00 R09: 205d303839303631\nR10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001\nR13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001\nFS:  00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? show_regs+0x94/0xa0\n ? __warn+0x9e/0x1c0\n ? gid_table_release_one+0x181/0x1a0\n ? report_bug+0x1f9/0x340\n ? gid_table_release_one+0x181/0x1a0\n ? handle_bug+0xa2/0x110\n ? exc_invalid_op+0x31/0xa0\n ? asm_exc_invalid_op+0x16/0x20\n ? __warn_printk+0xc7/0x180\n ? __warn_printk+0xd4/0x180\n ? gid_table_release_one+0x181/0x1a0\n ib_device_release+0x71/0xe0\n ? __pfx_ib_device_release+0x10/0x10\n device_release+0x44/0xd0\n kobject_put+0x135/0x3d0\n put_device+0x20/0x30\n rxe_net_add+0x7d/0xa0\n rxe_newlink+0xd7/0x190\n nldev_newlink+0x1b0/0x2a0\n ? __pfx_nldev_newlink+0x10/0x10\n rdma_nl_rcv_msg+0x1ad/0x2e0\n rdma_nl_rcv_skb.constprop.0+0x176/0x210\n netlink_unicast+0x2de/0x400\n netlink_sendmsg+0x306/0x660\n __sock_sendmsg+0x110/0x120\n ____sys_sendmsg+0x30e/0x390\n ___sys_sendmsg+0x9b/0xf0\n ? kstrtouint+0x6e/0xa0\n ? kstrtouint_from_user+0x7c/0xb0\n ? get_pid_task+0xb0/0xd0\n ? proc_fail_nth_write+0x5b/0x140\n ? __fget_light+0x9a/0x200\n ? preempt_count_add+0x47/0xa0\n __sys_sendmsg+0x61/0xd0\n do_syscall_64+0x50/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c5a56a9-b781-4db2-b0a5-70fc5b3da901",
      "id": "CVE-2024-53095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free of network namespace.\n\nRecently, we got a customer report that CIFS triggers oops while\nreconnecting to a server.  [0]\n\nThe workload runs on Kubernetes, and some pods mount CIFS servers\nin non-root network namespaces.  The problem rarely happened, but\nit was always while the pod was dying.\n\nThe root cause is wrong reference counting for network namespace.\n\nCIFS uses kernel sockets, which do not hold refcnt of the netns that\nthe socket belongs to.  That means CIFS must ensure the socket is\nalways freed before its netns; otherwise, use-after-free happens.\n\nThe repro steps are roughly:\n\n  1. mount CIFS in a non-root netns\n  2. drop packets from the netns\n  3. destroy the netns\n  4. unmount CIFS\n\nWe can reproduce the issue quickly with the script [1] below and see\nthe splat [2] if CONFIG_NET_NS_REFCNT_TRACKER is enabled.\n\nWhen the socket is TCP, it is hard to guarantee the netns lifetime\nwithout holding refcnt due to async timers.\n\nLet's hold netns refcnt for each socket as done for SMC in commit\n9744d2bf1976 (\"smc: Fix use-after-free in tcp_write_timer_handler().\").\n\nNote that we need to move put_net() from cifs_put_tcp_session() to\nclean_demultiplex_info(); otherwise, __sock_create() still could touch a\nfreed netns while cifsd tries to reconnect from cifs_demultiplex_thread().\n\nAlso, maybe_get_net() cannot be put just before __sock_create() because\nthe code is not under RCU and there is a small chance that the same\naddress happened to be reallocated to another netns.\n\n[0]:\nCIFS: VFS: \\\\XXXXXXXXXXX has not responded in 15 seconds. Reconnecting...\nCIFS: Serverclose failed 4 times, giving up\nUnable to handle kernel paging request at virtual address 14de99e461f84a07\nMem abort info:\n  ESR = 0x0000000096000004\n  EC = 0x25: DABT (current EL), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x04: level 0 translation fault\nData abort info:\n  ISV = 0, ISS = 0x00000004\n  CM = 0, WnR = 0\n[14de99e461f84a07] address between user and kernel address ranges\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in: cls_bpf sch_ingress nls_utf8 cifs cifs_arc4 cifs_md4 dns_resolver tcp_diag inet_diag veth xt_state xt_connmark nf_conntrack_netlink xt_nat xt_statistic xt_MASQUERADE xt_mark xt_addrtype ipt_REJECT nf_reject_ipv4 nft_chain_nat nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment nft_compat nf_tables nfnetlink overlay nls_ascii nls_cp437 sunrpc vfat fat aes_ce_blk aes_ce_cipher ghash_ce sm4_ce_cipher sm4 sm3_ce sm3 sha3_ce sha512_ce sha512_arm64 sha1_ce ena button sch_fq_codel loop fuse configfs dmi_sysfs sha2_ce sha256_arm64 dm_mirror dm_region_hash dm_log dm_mod dax efivarfs\nCPU: 5 PID: 2690970 Comm: cifsd Not tainted 6.1.103-109.184.amzn2023.aarch64 #1\nHardware name: Amazon EC2 r7g.4xlarge/, BIOS 1.0 11/1/2018\npstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : fib_rules_lookup+0x44/0x238\nlr : __fib_lookup+0x64/0xbc\nsp : ffff8000265db790\nx29: ffff8000265db790 x28: 0000000000000000 x27: 000000000000bd01\nx26: 0000000000000000 x25: ffff000b4baf8000 x24: ffff00047b5e4580\nx23: ffff8000265db7e0 x22: 0000000000000000 x21: ffff00047b5e4500\nx20: ffff0010e3f694f8 x19: 14de99e461f849f7 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000000 x13: 0000000000000000 x12: 3f92800abd010002\nx11: 0000000000000001 x10: ffff0010e3f69420 x9 : ffff800008a6f294\nx8 : 0000000000000000 x7 : 0000000000000006 x6 : 0000000000000000\nx5 : 0000000000000001 x4 : ffff001924354280 x3 : ffff8000265db7e0\nx2 : 0000000000000000 x1 : ffff0010e3f694f8 x0 : ffff00047b5e4500\nCall trace:\n fib_rules_lookup+0x44/0x238\n __fib_lookup+0x64/0xbc\n ip_route_output_key_hash_rcu+0x2c4/0x398\n ip_route_output_key_hash+0x60/0x8c\n tcp_v4_connect+0x290/0x488\n __inet_stream_connect+0x108/0x3d0\n inet_stream_connect+0x50/0x78\n kernel_connect+0x6c/0xac\n generic_ip_conne\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f414695-e413-4620-a71c-2622f64dae4d",
      "id": "CVE-2024-53135",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN\n\nHide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support\nfor virtualizing Intel PT via guest/host mode unless BROKEN=y.  There are\nmyriad bugs in the implementation, some of which are fatal to the guest,\nand others which put the stability and health of the host at risk.\n\nFor guest fatalities, the most glaring issue is that KVM fails to ensure\ntracing is disabled, and *stays* disabled prior to VM-Enter, which is\nnecessary as hardware disallows loading (the guest's) RTIT_CTL if tracing\nis enabled (enforced via a VMX consistency check).  Per the SDM:\n\n  If the logical processor is operating with Intel PT enabled (if\n  IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the \"load\n  IA32_RTIT_CTL\" VM-entry control must be 0.\n\nOn the host side, KVM doesn't validate the guest CPUID configuration\nprovided by userspace, and even worse, uses the guest configuration to\ndecide what MSRs to save/load at VM-Enter and VM-Exit.  E.g. configuring\nguest CPUID to enumerate more address ranges than are supported in hardware\nwill result in KVM trying to passthrough, save, and load non-existent MSRs,\nwhich generates a variety of WARNs, ToPA ERRORs in the host, a potential\ndeadlock, etc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ec41059-6b75-4903-b7dc-e4aad36ae70e",
      "id": "CVE-2024-53168",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix one UAF issue caused by sunrpc kernel tcp socket\n\nBUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0\nRead of size 1 at addr ffff888111f322cd by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x68/0xa0\n print_address_description.constprop.0+0x2c/0x3d0\n print_report+0xb4/0x270\n kasan_report+0xbd/0xf0\n tcp_write_timer_handler+0x156/0x3e0\n tcp_write_timer+0x66/0x170\n call_timer_fn+0xfb/0x1d0\n __run_timers+0x3f8/0x480\n run_timer_softirq+0x9b/0x100\n handle_softirqs+0x153/0x390\n __irq_exit_rcu+0x103/0x120\n irq_exit_rcu+0xe/0x20\n sysvec_apic_timer_interrupt+0x76/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\nRIP: 0010:default_idle+0xf/0x20\nCode: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90\n 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 \u003cfa\u003e c3 cc cc cc\n cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90\nRSP: 0018:ffffffffa2007e28 EFLAGS: 00000242\nRAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f\nRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d\nR10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000\nR13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0\n default_idle_call+0x6b/0xa0\n cpuidle_idle_call+0x1af/0x1f0\n do_idle+0xbc/0x130\n cpu_startup_entry+0x33/0x40\n rest_init+0x11f/0x210\n start_kernel+0x39a/0x420\n x86_64_start_reservations+0x18/0x30\n x86_64_start_kernel+0x97/0xa0\n common_startup_64+0x13e/0x141\n \u003c/TASK\u003e\n\nAllocated by task 595:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_slab_alloc+0x87/0x90\n kmem_cache_alloc_noprof+0x12b/0x3f0\n copy_net_ns+0x94/0x380\n create_new_namespaces+0x24c/0x500\n unshare_nsproxy_namespaces+0x75/0xf0\n ksys_unshare+0x24e/0x4f0\n __x64_sys_unshare+0x1f/0x30\n do_syscall_64+0x70/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 100:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x54/0x70\n kmem_cache_free+0x156/0x5d0\n cleanup_net+0x5d3/0x670\n process_one_work+0x776/0xa90\n worker_thread+0x2e2/0x560\n kthread+0x1a8/0x1f0\n ret_from_fork+0x34/0x60\n ret_from_fork_asm+0x1a/0x30\n\nReproduction script:\n\nmkdir -p /mnt/nfsshare\nmkdir -p /mnt/nfs/netns_1\nmkfs.ext4 /dev/sdb\nmount /dev/sdb /mnt/nfsshare\nsystemctl restart nfs-server\nchmod 777 /mnt/nfsshare\nexportfs -i -o rw,no_root_squash *:/mnt/nfsshare\n\nip netns add netns_1\nip link add name veth_1_peer type veth peer veth_1\nifconfig veth_1_peer 11.11.0.254 up\nip link set veth_1 netns netns_1\nip netns exec netns_1 ifconfig veth_1 11.11.0.1\n\nip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \\\n\t--tcp-flags FIN FIN  -j DROP\n\n(note: In my environment, a DESTROY_CLIENTID operation is always sent\n immediately, breaking the nfs tcp connection.)\nip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \\\n\t11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1\n\nip netns del netns_1\n\nThe reason here is that the tcp socket in netns_1 (nfs side) has been\nshutdown and closed (done in xs_destroy), but the FIN message (with ack)\nis discarded, and the nfsd side keeps sending retransmission messages.\nAs a result, when the tcp sock in netns_1 processes the received message,\nit sends the message (FIN message) in the sending queue, and the tcp timer\nis re-established. When the network namespace is deleted, the net structure\naccessed by tcp's timer handler function causes problems.\n\nTo fix this problem, let's hold netns refcnt for the tcp kernel socket as\ndone in other modules. This is an ugly hack which can easily be backported\nto earlier kernels. A proper fix which cleans up the interfaces will\nfollow, but may not be so easy to backport.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c5005af-ba7c-41d6-99f0-d270663de257",
      "id": "CVE-2024-56566",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: Avoid list corruption when removing a slab from the full list\n\nBoot with slub_debug=UFPZ.\n\nIf allocated object failed in alloc_consistency_checks, all objects of\nthe slab will be marked as used, and then the slab will be removed from\nthe partial list.\n\nWhen an object belonging to the slab got freed later, the remove_full()\nfunction is called. Because the slab is neither on the partial list nor\non the full list, it eventually lead to a list corruption (actually a\nlist poison being detected).\n\nSo we need to mark and isolate the slab page with metadata corruption,\ndo not put it back in circulation.\n\nBecause the debug caches avoid all the fastpaths, reusing the frozen bit\nto mark slab page with metadata corruption seems to be fine.\n\n[ 4277.385669] list_del corruption, ffffea00044b3e50-\u003enext is LIST_POISON1 (dead000000000100)\n[ 4277.387023] ------------[ cut here ]------------\n[ 4277.387880] kernel BUG at lib/list_debug.c:56!\n[ 4277.388680] invalid opcode: 0000 [#1] PREEMPT SMP PTI\n[ 4277.389562] CPU: 5 PID: 90 Comm: kworker/5:1 Kdump: loaded Tainted: G           OE      6.6.1-1 #1\n[ 4277.392113] Workqueue: xfs-inodegc/vda1 xfs_inodegc_worker [xfs]\n[ 4277.393551] RIP: 0010:__list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.394518] Code: 48 91 82 e8 37 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 28 49 91 82 e8 26 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 58 49 91\n[ 4277.397292] RSP: 0018:ffffc90000333b38 EFLAGS: 00010082\n[ 4277.398202] RAX: 000000000000004e RBX: ffffea00044b3e50 RCX: 0000000000000000\n[ 4277.399340] RDX: 0000000000000002 RSI: ffffffff828f8715 RDI: 00000000ffffffff\n[ 4277.400545] RBP: ffffea00044b3e40 R08: 0000000000000000 R09: ffffc900003339f0\n[ 4277.401710] R10: 0000000000000003 R11: ffffffff82d44088 R12: ffff888112cf9910\n[ 4277.402887] R13: 0000000000000001 R14: 0000000000000001 R15: ffff8881000424c0\n[ 4277.404049] FS:  0000000000000000(0000) GS:ffff88842fd40000(0000) knlGS:0000000000000000\n[ 4277.405357] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4277.406389] CR2: 00007f2ad0b24000 CR3: 0000000102a3a006 CR4: 00000000007706e0\n[ 4277.407589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 4277.408780] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 4277.410000] PKRU: 55555554\n[ 4277.410645] Call Trace:\n[ 4277.411234]  \u003cTASK\u003e\n[ 4277.411777]  ? die+0x32/0x80\n[ 4277.412439]  ? do_trap+0xd6/0x100\n[ 4277.413150]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.414158]  ? do_error_trap+0x6a/0x90\n[ 4277.414948]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.415915]  ? exc_invalid_op+0x4c/0x60\n[ 4277.416710]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.417675]  ? asm_exc_invalid_op+0x16/0x20\n[ 4277.418482]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.419466]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.420410]  free_to_partial_list+0x515/0x5e0\n[ 4277.421242]  ? xfs_iext_remove+0x41a/0xa10 [xfs]\n[ 4277.422298]  xfs_iext_remove+0x41a/0xa10 [xfs]\n[ 4277.423316]  ? xfs_inodegc_worker+0xb4/0x1a0 [xfs]\n[ 4277.424383]  xfs_bmap_del_extent_delay+0x4fe/0x7d0 [xfs]\n[ 4277.425490]  __xfs_bunmapi+0x50d/0x840 [xfs]\n[ 4277.426445]  xfs_itruncate_extents_flags+0x13a/0x490 [xfs]\n[ 4277.427553]  xfs_inactive_truncate+0xa3/0x120 [xfs]\n[ 4277.428567]  xfs_inactive+0x22d/0x290 [xfs]\n[ 4277.429500]  xfs_inodegc_worker+0xb4/0x1a0 [xfs]\n[ 4277.430479]  process_one_work+0x171/0x340\n[ 4277.431227]  worker_thread+0x277/0x390\n[ 4277.431962]  ? __pfx_worker_thread+0x10/0x10\n[ 4277.432752]  kthread+0xf0/0x120\n[ 4277.433382]  ? __pfx_kthread+0x10/0x10\n[ 4277.434134]  ret_from_fork+0x2d/0x50\n[ 4277.434837]  ? __pfx_kthread+0x10/0x10\n[ 4277.435566]  ret_from_fork_asm+0x1b/0x30\n[ 4277.436280]  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d109df8-193d-4b59-a9b9-97194fe533e2",
      "id": "CVE-2024-56587",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: class: Protect brightness_show() with led_cdev-\u003eled_access mutex\n\nThere is NULL pointer issue observed if from Process A where hid device\nbeing added which results in adding a led_cdev addition and later a\nanother call to access of led_cdev attribute from Process B can result\nin NULL pointer issue.\n\nUse mutex led_cdev-\u003eled_access to protect access to led-\u003ecdev and its\nattribute inside brightness_show() and max_brightness_show() and also\nupdate the comment for mutex that it should be used to protect the led\nclass device fields.\n\n\tProcess A \t\t\t\tProcess B\n\n kthread+0x114\n worker_thread+0x244\n process_scheduled_works+0x248\n uhid_device_add_worker+0x24\n hid_add_device+0x120\n device_add+0x268\n bus_probe_device+0x94\n device_initial_probe+0x14\n __device_attach+0xfc\n bus_for_each_drv+0x10c\n __device_attach_driver+0x14c\n driver_probe_device+0x3c\n __driver_probe_device+0xa0\n really_probe+0x190\n hid_device_probe+0x130\n ps_probe+0x990\n ps_led_register+0x94\n devm_led_classdev_register_ext+0x58\n led_classdev_register_ext+0x1f8\n device_create_with_groups+0x48\n device_create_groups_vargs+0xc8\n device_add+0x244\n kobject_uevent+0x14\n kobject_uevent_env[jt]+0x224\n mutex_unlock[jt]+0xc4\n __mutex_unlock_slowpath+0xd4\n wake_up_q+0x70\n try_to_wake_up[jt]+0x48c\n preempt_schedule_common+0x28\n __schedule+0x628\n __switch_to+0x174\n\t\t\t\t\t\tel0t_64_sync+0x1a8/0x1ac\n\t\t\t\t\t\tel0t_64_sync_handler+0x68/0xbc\n\t\t\t\t\t\tel0_svc+0x38/0x68\n\t\t\t\t\t\tdo_el0_svc+0x1c/0x28\n\t\t\t\t\t\tel0_svc_common+0x80/0xe0\n\t\t\t\t\t\tinvoke_syscall+0x58/0x114\n\t\t\t\t\t\t__arm64_sys_read+0x1c/0x2c\n\t\t\t\t\t\tksys_read+0x78/0xe8\n\t\t\t\t\t\tvfs_read+0x1e0/0x2c8\n\t\t\t\t\t\tkernfs_fop_read_iter+0x68/0x1b4\n\t\t\t\t\t\tseq_read_iter+0x158/0x4ec\n\t\t\t\t\t\tkernfs_seq_show+0x44/0x54\n\t\t\t\t\t\tsysfs_kf_seq_show+0xb4/0x130\n\t\t\t\t\t\tdev_attr_show+0x38/0x74\n\t\t\t\t\t\tbrightness_show+0x20/0x4c\n\t\t\t\t\t\tdualshock4_led_get_brightness+0xc/0x74\n\n[ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n[ 3313.874301][ T4013] Mem abort info:\n[ 3313.874303][ T4013]   ESR = 0x0000000096000006\n[ 3313.874305][ T4013]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 3313.874307][ T4013]   SET = 0, FnV = 0\n[ 3313.874309][ T4013]   EA = 0, S1PTW = 0\n[ 3313.874311][ T4013]   FSC = 0x06: level 2 translation fault\n[ 3313.874313][ T4013] Data abort info:\n[ 3313.874314][ T4013]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000\n[ 3313.874316][ T4013]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 3313.874318][ T4013]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000\n..\n\n[ 3313.874332][ T4013] Dumping ftrace buffer:\n[ 3313.874334][ T4013]    (ftrace buffer empty)\n..\n..\n[ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader\n[ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74\n[ 3313.874653][ T4013] lr : led_update_brightness+0x38/0x60\n[ 3313.874656][ T4013] sp : ffffffc0b910bbd0\n..\n..\n[ 3313.874685][ T4013] Call trace:\n[ 3313.874687][ T4013]  dualshock4_led_get_brightness+0xc/0x74\n[ 3313.874690][ T4013]  brightness_show+0x20/0x4c\n[ 3313.874692][ T4013]  dev_attr_show+0x38/0x74\n[ 3313.874696][ T4013]  sysfs_kf_seq_show+0xb4/0x130\n[ 3313.874700][ T4013]  kernfs_seq_show+0x44/0x54\n[ 3313.874703][ T4013]  seq_read_iter+0x158/0x4ec\n[ 3313.874705][ T4013]  kernfs_fop_read_iter+0x68/0x1b4\n[ 3313.874708][ T4013]  vfs_read+0x1e0/0x2c8\n[ 3313.874711][ T4013]  ksys_read+0x78/0xe8\n[ 3313.874714][ T4013]  __arm64_sys_read+0x1c/0x2c\n[ 3313.874718][ T4013]  invoke_syscall+0x58/0x114\n[ 3313.874721][ T4013]  el0_svc_common+0x80/0xe0\n[ 3313.874724][ T4013]  do_el0_svc+0x1c/0x28\n[ 3313.874727][ T4013]  el0_svc+0x38/0x68\n[ 3313.874730][ T4013]  el0t_64_sync_handler+0x68/0xbc\n[ 3313.874732][ T4013]  el0t_64_sync+0x1a8/0x1ac",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "594a46c0-dbfb-4fa1-8f75-04ed4678a386",
      "id": "CVE-2024-56647",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix icmp host relookup triggering ip_rt_bug\n\narp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:\n\nWARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20\nModules linked in:\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:ip_rt_bug+0x14/0x20\nCall Trace:\n \u003cIRQ\u003e\n ip_send_skb+0x14/0x40\n __icmp_send+0x42d/0x6a0\n ipv4_link_failure+0xe2/0x1d0\n arp_error_report+0x3c/0x50\n neigh_invalidate+0x8d/0x100\n neigh_timer_handler+0x2e1/0x330\n call_timer_fn+0x21/0x120\n __run_timer_base.part.0+0x1c9/0x270\n run_timer_softirq+0x4c/0x80\n handle_softirqs+0xac/0x280\n irq_exit_rcu+0x62/0x80\n sysvec_apic_timer_interrupt+0x77/0x90\n\nThe script below reproduces this scenario:\nip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \\\n\tdir out priority 0 ptype main flag localok icmp\nip l a veth1 type veth\nip a a 192.168.141.111/24 dev veth0\nip l s veth0 up\nping 192.168.141.155 -c 1\n\nicmp_route_lookup() create input routes for locally generated packets\nwhile xfrm relookup ICMP traffic.Then it will set input route\n(dst-\u003eout = ip_rt_bug) to skb for DESTUNREACH.\n\nFor ICMP err triggered by locally generated packets, dst-\u003edev of output\nroute is loopback. Generally, xfrm relookup verification is not required\non loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1).\n\nSkip icmp relookup for locally generated packets to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ff52afc-c85e-4937-84ee-ada1e3b26ae6",
      "id": "CVE-2024-57974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Deal with race between UDP socket address change and rehash\n\nIf a UDP socket changes its local address while it's receiving\ndatagrams, as a result of connect(), there is a period during which\na lookup operation might fail to find it, after the address is changed\nbut before the secondary hash (port and address) and the four-tuple\nhash (local and remote ports and addresses) are updated.\n\nSecondary hash chains were introduced by commit 30fff9231fad (\"udp:\nbind() optimisation\") and, as a result, a rehash operation became\nneeded to make a bound socket reachable again after a connect().\n\nThis operation was introduced by commit 719f835853a9 (\"udp: add\nrehash on connect()\") which isn't however a complete fix: the\nsocket will be found once the rehashing completes, but not while\nit's pending.\n\nThis is noticeable with a socat(1) server in UDP4-LISTEN mode, and a\nclient sending datagrams to it. After the server receives the first\ndatagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to\nthe address of the sender, in order to set up a directed flow.\n\nNow, if the client, running on a different CPU thread, happens to\nsend a (subsequent) datagram while the server's socket changes its\naddress, but is not rehashed yet, this will result in a failed\nlookup and a port unreachable error delivered to the client, as\napparent from the following reproducer:\n\n  LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4))\n  dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in\n\n  while :; do\n  \ttaskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026\n  \tsleep 0.1 || sleep 1\n  \ttaskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null\n  \twait\n  done\n\nwhere the client will eventually get ECONNREFUSED on a write()\n(typically the second or third one of a given iteration):\n\n  2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused\n\nThis issue was first observed as a seldom failure in Podman's tests\nchecking UDP functionality while using pasta(1) to connect the\ncontainer's network namespace, which leads us to a reproducer with\nthe lookup error resulting in an ICMP packet on a tap device:\n\n  LOCAL_ADDR=\"$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == \"global\").local')\"\n\n  while :; do\n  \t./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026\n  \tsleep 0.2 || sleep 1\n  \tsocat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null\n  \twait\n  \tcmp tmp.in tmp.out\n  done\n\nOnce this fails:\n\n  tmp.in tmp.out differ: char 8193, line 29\n\nwe can finally have a look at what's going on:\n\n  $ tshark -r pasta.pcap\n      1   0.000000           :: ? ff02::16     ICMPv6 110 Multicast Listener Report Message v2\n      2   0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      3   0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      4   0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      5   0.168827 c6:47:05:8d:dc:04 ? Broadcast    ARP 42 Who has 88.198.0.161? Tell 88.198.0.164\n      6   0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55\n      7   0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      8   0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable)\n      9   0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     10   0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     11   0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096\n     12   0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0\n\nOn the third datagram received, the network namespace of the container\ninitiates an ARP lookup to deliver the ICMP message.\n\nIn another variant of this reproducer, starting the client with:\n\n  strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,tru\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e422acd9-082f-43c7-a567-d0bf33450d15",
      "id": "CVE-2025-21735",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Add bounds checking in nci_hci_create_pipe()\n\nThe \"pipe\" variable is a u8 which comes from the network.  If it's more\nthan 127, then it results in memory corruption in the caller,\nnci_hci_connect_gate().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5229eba5-76d2-497b-b68d-9dfc7dc6fc4a",
      "id": "CVE-2025-21959",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()\n\nSince commit b36e4523d4d5 (\"netfilter: nf_conncount: fix garbage\ncollection confirm race\"), `cpu` and `jiffies32` were introduced to\nthe struct nf_conncount_tuple.\n\nThe commit made nf_conncount_add() initialize `conn-\u003ecpu` and\n`conn-\u003ejiffies32` when allocating the struct.\nIn contrast, count_tree() was not changed to initialize them.\n\nBy commit 34848d5c896e (\"netfilter: nf_conncount: Split insert and\ntraversal\"), count_tree() was split and the relevant allocation\ncode now resides in insert_tree().\nInitialize `conn-\u003ecpu` and `conn-\u003ejiffies32` in insert_tree().\n\nBUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]\nBUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\n find_or_evict net/netfilter/nf_conncount.c:117 [inline]\n __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\n count_tree net/netfilter/nf_conncount.c:438 [inline]\n nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\n ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669\n __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline]\n __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983\n __netif_receive_skb_list net/core/dev.c:6035 [inline]\n netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126\n netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178\n xdp_recv_frames net/bpf/test_run.c:280 [inline]\n xdp_test_run_batch net/bpf/test_run.c:361 [inline]\n bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390\n bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316\n bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813\n __do_sys_bpf kernel/bpf/syscall.c:5902 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5900 [inline]\n __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900\n ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358\n do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387\n do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4121 [inline]\n slab_alloc_node mm/slub.c:4164 [inline]\n kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171\n insert_tree net/netfilter/nf_conncount.c:372 [inline]\n count_tree net/netfilter/nf_conncount.c:450 [inline]\n nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\n ip_list_rcv+0x9ef/0xa40 net/ip\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d629707-df42-4ed5-bb58-4e832a1b065e",
      "id": "CVE-2025-37852",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()\n\nAdd error handling to propagate amdgpu_cgs_create_device() failures\nto the caller. When amdgpu_cgs_create_device() fails, release hwmgr\nand return -ENOMEM to prevent null pointer dereference.\n\n[v1]-\u003e[v2]: Change error code from -EINVAL to -ENOMEM. Free hwmgr.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29d8032a-679f-4ae0-80f4-069885808a7a",
      "id": "CVE-2025-38096",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: don't warn when if there is a FW error\n\niwl_trans_reclaim is warning if it is called when the FW is not alive.\nBut if it is called when there is a pending restart, i.e. after a FW\nerror, there is no need to warn, instead - return silently.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3efc49d-f943-418d-a60b-c12921731dbf",
      "id": "CVE-2025-38624",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: pnv_php: Clean up allocated IRQs on unplug\n\nWhen the root of a nested PCIe bridge configuration is unplugged, the\npnv_php driver leaked the allocated IRQ resources for the child bridges'\nhotplug event notifications, resulting in a panic.\n\nFix this by walking all child buses and deallocating all its IRQ resources\nbefore calling pci_hp_remove_devices().\n\nAlso modify the lifetime of the workqueue at struct pnv_php_slot::wq so\nthat it is only destroyed in pnv_php_free_slot(), instead of\npnv_php_disable_irq(). This is required since pnv_php_disable_irq() will\nnow be called by workers triggered by hot unplug interrupts, so the\nworkqueue needs to stay allocated.\n\nThe abridged kernel panic that occurs without this patch is as follows:\n\n  WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c\n  CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2\n  Call Trace:\n   msi_device_data_release+0x34/0x9c (unreliable)\n   release_nodes+0x64/0x13c\n   devres_release_all+0xc0/0x140\n   device_del+0x2d4/0x46c\n   pci_destroy_dev+0x5c/0x194\n   pci_hp_remove_devices+0x90/0x128\n   pci_hp_remove_devices+0x44/0x128\n   pnv_php_disable_slot+0x54/0xd4\n   power_write_file+0xf8/0x18c\n   pci_slot_attr_store+0x40/0x5c\n   sysfs_kf_write+0x64/0x78\n   kernfs_fop_write_iter+0x1b0/0x290\n   vfs_write+0x3bc/0x50c\n   ksys_write+0x84/0x140\n   system_call_exception+0x124/0x230\n   system_call_vectored_common+0x15c/0x2ec\n\n[bhelgaas: tidy comments]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "464e7a88-d697-493f-9e60-29d820c7ad8c",
      "id": "CVE-2021-28660",
      "description": "rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the -\u003essid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff47c3bd-19be-41c4-97a9-34d79567e3ca",
      "id": "CVE-2021-4204",
      "description": "An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d4c135d-cd19-4230-be42-b1e6b80b1fae",
      "id": "CVE-2021-42739",
      "description": "The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e44bf73d-b245-4903-92bb-600d25629ae2",
      "id": "CVE-2021-47169",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'\n\nIn 'rp2_probe', the driver registers 'rp2_uart_interrupt' then calls\n'rp2_fw_cb' through 'request_firmware_nowait'. In 'rp2_fw_cb', if the\nfirmware don't exists, function just return without initializing ports\nof 'rp2_card'. But now the interrupt handler function has been\nregistered, and when an interrupt comes, 'rp2_uart_interrupt' may access\nthose ports then causing NULL pointer dereference or other bugs.\n\nBecause the driver does some initialization work in 'rp2_fw_cb', in\norder to make the driver ready to handle interrupts, 'request_firmware'\nshould be used instead of asynchronous 'request_firmware_nowait'.\n\nThis report reveals it:\n\nINFO: trying to register non-static key.\nthe code is fine but needs lockdep annotation.\nturning off the locking correctness validator.\nCPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-\ngc9ba5276e321-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xec/0x156 lib/dump_stack.c:118\n assign_lock_key kernel/locking/lockdep.c:727 [inline]\n register_lock_class+0x14e5/0x1ba0 kernel/locking/lockdep.c:753\n __lock_acquire+0x187/0x3750 kernel/locking/lockdep.c:3303\n lock_acquire+0x124/0x340 kernel/locking/lockdep.c:3907\n __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]\n _raw_spin_lock+0x32/0x50 kernel/locking/spinlock.c:144\n spin_lock include/linux/spinlock.h:329 [inline]\n rp2_ch_interrupt drivers/tty/serial/rp2.c:466 [inline]\n rp2_asic_interrupt.isra.9+0x15d/0x990 drivers/tty/serial/rp2.c:493\n rp2_uart_interrupt+0x49/0xe0 drivers/tty/serial/rp2.c:504\n __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149\n handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189\n handle_irq_event+0xac/0x140 kernel/irq/handle.c:206\n handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725\n generic_handle_irq_desc include/linux/irqdesc.h:155 [inline]\n handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87\n do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247\n common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670\n \u003c/IRQ\u003e\nRIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61\nCode: 00 00 55 be 04 00 00 00 48 c7 c7 00 c2 2f 8c 48 89 e5 e8 fb 31 e7 f8\n8b 05 75 af 8d 03 85 c0 7e 07 0f 00 2d 8a 61 65 00 fb f4 \u003c5d\u003e c3 90 90 90\n90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41\nRSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde\nRAX: 0000000000000000 RBX: ffffffff8bde7e48 RCX: ffffffff88a21285\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2fc200\nRBP: ffff88806b71fcc8 R08: fffffbfff185f840 R09: fffffbfff185f840\nR10: 0000000000000001 R11: fffffbfff185f840 R12: 0000000000000002\nR13: ffffffff8bea18a0 R14: 0000000000000000 R15: 0000000000000000\n arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]\n default_idle+0x6f/0x360 arch/x86/kernel/process.c:557\n arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548\n default_idle_call+0x3b/0x60 kernel/sched/idle.c:93\n cpuidle_idle_call kernel/sched/idle.c:153 [inline]\n do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263\n cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369\n start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271\n secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nPGD 8000000056d27067 P4D 8000000056d27067 PUD 56d28067 PMD 0\nOops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-\ngc9ba5276e321-prebuilt.qemu.org 04/01/2014\nRIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]\nRIP: 0010:rp2_ch_interrupt drivers/tty/serial/rp2.c:472 [inline]\nRIP: 0010:rp2_asic_interrupt.isra.9+0x181/0x990 drivers/tty/serial/rp2.c:\n493\nCo\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa2373fb-d5b1-4262-a3d8-17702890fb70",
      "id": "CVE-2021-47246",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix page reclaim for dead peer hairpin\n\nWhen adding a hairpin flow, a firmware-side send queue is created for\nthe peer net device, which claims some host memory pages for its\ninternal ring buffer. If the peer net device is removed/unbound before\nthe hairpin flow is deleted, then the send queue is not destroyed which\nleads to a stack trace on pci device remove:\n\n[ 748.005230] mlx5_core 0000:08:00.2: wait_func:1094:(pid 12985): MANAGE_PAGES(0x108) timeout. Will cause a leak of a command resource\n[ 748.005231] mlx5_core 0000:08:00.2: reclaim_pages:514:(pid 12985): failed reclaiming pages: err -110\n[ 748.001835] mlx5_core 0000:08:00.2: mlx5_reclaim_root_pages:653:(pid 12985): failed reclaiming pages (-110) for func id 0x0\n[ 748.002171] ------------[ cut here ]------------\n[ 748.001177] FW pages counter is 4 after reclaiming all pages\n[ 748.001186] WARNING: CPU: 1 PID: 12985 at drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c:685 mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core]                      [  +0.002771] Modules linked in: cls_flower mlx5_ib mlx5_core ptp pps_core act_mirred sch_ingress openvswitch nsh xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm ib_uverbs ib_core overlay fuse [last unloaded: pps_core]\n[ 748.007225] CPU: 1 PID: 12985 Comm: tee Not tainted 5.12.0+ #1\n[ 748.001376] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[ 748.002315] RIP: 0010:mlx5_reclaim_startup_pages+0x34b/0x460 [mlx5_core]\n[ 748.001679] Code: 28 00 00 00 0f 85 22 01 00 00 48 81 c4 b0 00 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 40 cc 19 a1 e8 9f 71 0e e2 \u003c0f\u003e 0b e9 30 ff ff ff 48 c7 c7 a0 cc 19 a1 e8 8c 71 0e e2 0f 0b e9\n[ 748.003781] RSP: 0018:ffff88815220faf8 EFLAGS: 00010286\n[ 748.001149] RAX: 0000000000000000 RBX: ffff8881b4900280 RCX: 0000000000000000\n[ 748.001445] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102a441f51\n[ 748.001614] RBP: 00000000000032b9 R08: 0000000000000001 R09: ffffed1054a15ee8\n[ 748.001446] R10: ffff8882a50af73b R11: ffffed1054a15ee7 R12: fffffbfff07c1e30\n[ 748.001447] R13: dffffc0000000000 R14: ffff8881b492cba8 R15: 0000000000000000\n[ 748.001429] FS:  00007f58bd08b580(0000) GS:ffff8882a5080000(0000) knlGS:0000000000000000\n[ 748.001695] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 748.001309] CR2: 000055a026351740 CR3: 00000001d3b48006 CR4: 0000000000370ea0\n[ 748.001506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 748.001483] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 748.001654] Call Trace:\n[ 748.000576]  ? mlx5_satisfy_startup_pages+0x290/0x290 [mlx5_core]\n[ 748.001416]  ? mlx5_cmd_teardown_hca+0xa2/0xd0 [mlx5_core]\n[ 748.001354]  ? mlx5_cmd_init_hca+0x280/0x280 [mlx5_core]\n[ 748.001203]  mlx5_function_teardown+0x30/0x60 [mlx5_core]\n[ 748.001275]  mlx5_uninit_one+0xa7/0xc0 [mlx5_core]\n[ 748.001200]  remove_one+0x5f/0xc0 [mlx5_core]\n[ 748.001075]  pci_device_remove+0x9f/0x1d0\n[ 748.000833]  device_release_driver_internal+0x1e0/0x490\n[ 748.001207]  unbind_store+0x19f/0x200\n[ 748.000942]  ? sysfs_file_ops+0x170/0x170\n[ 748.001000]  kernfs_fop_write_iter+0x2bc/0x450\n[ 748.000970]  new_sync_write+0x373/0x610\n[ 748.001124]  ? new_sync_read+0x600/0x600\n[ 748.001057]  ? lock_acquire+0x4d6/0x700\n[ 748.000908]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n[ 748.001126]  ? fd_install+0x1c9/0x4d0\n[ 748.000951]  vfs_write+0x4d0/0x800\n[ 748.000804]  ksys_write+0xf9/0x1d0\n[ 748.000868]  ? __x64_sys_read+0xb0/0xb0\n[ 748.000811]  ? filp_open+0x50/0x50\n[ 748.000919]  ? syscall_enter_from_user_mode+0x1d/0x50\n[ 748.001223]  do_syscall_64+0x3f/0x80\n[ 748.000892]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 748.00\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35c26cb1-c6d7-4256-b662-18e8247c4bf2",
      "id": "CVE-2021-47262",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message\n\nUse the __string() machinery provided by the tracing subystem to make a\ncopy of the string literals consumed by the \"nested VM-Enter failed\"\ntracepoint.  A complete copy is necessary to ensure that the tracepoint\ncan't outlive the data/memory it consumes and deference stale memory.\n\nBecause the tracepoint itself is defined by kvm, if kvm-intel and/or\nkvm-amd are built as modules, the memory holding the string literals\ndefined by the vendor modules will be freed when the module is unloaded,\nwhereas the tracepoint and its data in the ring buffer will live until\nkvm is unloaded (or \"indefinitely\" if kvm is built-in).\n\nThis bug has existed since the tracepoint was added, but was recently\nexposed by a new check in tracing to detect exactly this type of bug.\n\n  fmt: '%s%s\n  ' current_buffer: ' vmx_dirty_log_t-140127  [003] ....  kvm_nested_vmenter_failed: '\n  WARNING: CPU: 3 PID: 140134 at kernel/trace/trace.c:3759 trace_check_vprintf+0x3be/0x3e0\n  CPU: 3 PID: 140134 Comm: less Not tainted 5.13.0-rc1-ce2e73ce600a-req #184\n  Hardware name: ASUS Q87M-E/Q87M-E, BIOS 1102 03/03/2014\n  RIP: 0010:trace_check_vprintf+0x3be/0x3e0\n  Code: \u003c0f\u003e 0b 44 8b 4c 24 1c e9 a9 fe ff ff c6 44 02 ff 00 49 8b 97 b0 20\n  RSP: 0018:ffffa895cc37bcb0 EFLAGS: 00010282\n  RAX: 0000000000000000 RBX: ffffa895cc37bd08 RCX: 0000000000000027\n  RDX: 0000000000000027 RSI: 00000000ffffdfff RDI: ffff9766cfad74f8\n  RBP: ffffffffc0a041d4 R08: ffff9766cfad74f0 R09: ffffa895cc37bad8\n  R10: 0000000000000001 R11: 0000000000000001 R12: ffffffffc0a041d4\n  R13: ffffffffc0f4dba8 R14: 0000000000000000 R15: ffff976409f2c000\n  FS:  00007f92fa200740(0000) GS:ffff9766cfac0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000559bd11b0000 CR3: 000000019fbaa002 CR4: 00000000001726e0\n  Call Trace:\n   trace_event_printf+0x5e/0x80\n   trace_raw_output_kvm_nested_vmenter_failed+0x3a/0x60 [kvm]\n   print_trace_line+0x1dd/0x4e0\n   s_show+0x45/0x150\n   seq_read_iter+0x2d5/0x4c0\n   seq_read+0x106/0x150\n   vfs_read+0x98/0x180\n   ksys_read+0x5f/0xe0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7cc51cb-94d4-426d-a429-80dfb4898e39",
      "id": "CVE-2021-47302",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Fix use-after-free error during reset\n\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\n\nFailure to do so can cause invalid memory accesses. If igc_poll() runs\nwhile the controller is being reset this can lead to the driver try to\nfree a skb that was already freed.\n\nLog message:\n\n [  101.525242] refcount_t: underflow; use-after-free.\n [  101.525251] WARNING: CPU: 1 PID: 646 at lib/refcount.c:28 refcount_warn_saturate+0xab/0xf0\n [  101.525259] Modules linked in: sch_etf(E) sch_mqprio(E) rfkill(E) intel_rapl_msr(E) intel_rapl_common(E)\n x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) binfmt_misc(E) kvm_intel(E) kvm(E) irqbypass(E) crc32_pclmul(E)\n ghash_clmulni_intel(E) aesni_intel(E) mei_wdt(E) libaes(E) crypto_simd(E) cryptd(E) glue_helper(E) snd_hda_codec_hdmi(E)\n rapl(E) intel_cstate(E) snd_hda_intel(E) snd_intel_dspcfg(E) sg(E) soundwire_intel(E) intel_uncore(E) at24(E)\n soundwire_generic_allocation(E) iTCO_wdt(E) soundwire_cadence(E) intel_pmc_bxt(E) serio_raw(E) snd_hda_codec(E)\n iTCO_vendor_support(E) watchdog(E) snd_hda_core(E) snd_hwdep(E) snd_soc_core(E) snd_compress(E) snd_pcsp(E)\n soundwire_bus(E) snd_pcm(E) evdev(E) snd_timer(E) mei_me(E) snd(E) soundcore(E) mei(E) configfs(E) ip_tables(E) x_tables(E)\n autofs4(E) ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) sd_mod(E) t10_pi(E) crc_t10dif(E) crct10dif_generic(E)\n i915(E) ahci(E) libahci(E) ehci_pci(E) igb(E) xhci_pci(E) ehci_hcd(E)\n [  101.525303]  drm_kms_helper(E) dca(E) xhci_hcd(E) libata(E) crct10dif_pclmul(E) cec(E) crct10dif_common(E) tsn(E) igc(E)\n e1000e(E) ptp(E) i2c_i801(E) crc32c_intel(E) psmouse(E) i2c_algo_bit(E) i2c_smbus(E) scsi_mod(E) lpc_ich(E) pps_core(E)\n usbcore(E) drm(E) button(E) video(E)\n [  101.525318] CPU: 1 PID: 646 Comm: irq/37-enp7s0-T Tainted: G            E     5.10.30-rt37-tsn1-rt-ipipe #ipipe\n [  101.525320] Hardware name: SIEMENS AG SIMATIC IPC427D/A5E31233588, BIOS V17.02.09 03/31/2017\n [  101.525322] RIP: 0010:refcount_warn_saturate+0xab/0xf0\n [  101.525325] Code: 05 31 48 44 01 01 e8 f0 c6 42 00 0f 0b c3 80 3d 1f 48 44 01 00 75 90 48 c7 c7 78 a8 f3 a6 c6 05 0f 48\n 44 01 01 e8 d1 c6 42 00 \u003c0f\u003e 0b c3 80 3d fe 47 44 01 00 0f 85 6d ff ff ff 48 c7 c7 d0 a8 f3\n [  101.525327] RSP: 0018:ffffbdedc0917cb8 EFLAGS: 00010286\n [  101.525329] RAX: 0000000000000000 RBX: ffff98fd6becbf40 RCX: 0000000000000001\n [  101.525330] RDX: 0000000000000001 RSI: ffffffffa6f2700c RDI: 00000000ffffffff\n [  101.525332] RBP: ffff98fd6becc14c R08: ffffffffa7463d00 R09: ffffbdedc0917c50\n [  101.525333] R10: ffffffffa74c3578 R11: 0000000000000034 R12: 00000000ffffff00\n [  101.525335] R13: ffff98fd6b0b1000 R14: 0000000000000039 R15: ffff98fd6be35c40\n [  101.525337] FS:  0000000000000000(0000) GS:ffff98fd6e240000(0000) knlGS:0000000000000000\n [  101.525339] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [  101.525341] CR2: 00007f34135a3a70 CR3: 0000000150210003 CR4: 00000000001706e0\n [  101.525343] Call Trace:\n [  101.525346]  sock_wfree+0x9c/0xa0\n [  101.525353]  unix_destruct_scm+0x7b/0xa0\n [  101.525358]  skb_release_head_state+0x40/0x90\n [  101.525362]  skb_release_all+0xe/0x30\n [  101.525364]  napi_consume_skb+0x57/0x160\n [  101.525367]  igc_poll+0xb7/0xc80 [igc]\n [  101.525376]  ? sched_clock+0x5/0x10\n [  101.525381]  ? sched_clock_cpu+0xe/0x100\n [  101.525385]  net_rx_action+0x14c/0x410\n [  101.525388]  __do_softirq+0xe9/0x2f4\n [  101.525391]  __local_bh_enable_ip+0xe3/0x110\n [  101.525395]  ? irq_finalize_oneshot.part.47+0xe0/0xe0\n [  101.525398]  irq_forced_thread_fn+0x6a/0x80\n [  101.525401]  irq_thread+0xe8/0x180\n [  101.525403]  ? wake_threads_waitq+0x30/0x30\n [  101.525406]  ? irq_thread_check_affinity+0xd0/0xd0\n [  101.525408]  kthread+0x183/0x1a0\n [  101.525412]  ? kthread_park+0x80/0x80\n [  101.525415]  ret_from_fork+0x22/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f99f992c-d555-4dab-875a-4106e36b3fac",
      "id": "CVE-2021-47325",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation\n\nThe reference counting issue happens in several exception handling paths\nof arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the\nfunction forgets to decrease the refcount of \"smmu\" increased by\narm_smmu_rpm_get(), causing a refcount leak.\n\nFix this issue by jumping to \"out\" label when those error scenarios\noccur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "529754ed-f230-47ba-8be0-8eca3aa91d38",
      "id": "CVE-2021-47368",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nenetc: Fix illegal access when reading affinity_hint\n\nirq_set_affinity_hit() stores a reference to the cpumask_t\nparameter in the irq descriptor, and that reference can be\naccessed later from irq_affinity_hint_proc_show(). Since\nthe cpu_mask parameter passed to irq_set_affinity_hit() has\nonly temporary storage (it's on the stack memory), later\naccesses to it are illegal. Thus reads from the corresponding\nprocfs affinity_hint file can result in paging request oops.\n\nThe issue is fixed by the get_cpu_mask() helper, which provides\na permanent storage for the cpumask_t parameter.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c831609-8259-412a-ae75-ef819afb930d",
      "id": "CVE-2021-47414",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Flush current cpu icache before other cpus\n\nOn SiFive Unmatched, I recently fell onto the following BUG when booting:\n\n[    0.000000] ftrace: allocating 36610 entries in 144 pages\n[    0.000000] Oops - illegal instruction [#1]\n[    0.000000] Modules linked in:\n[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.1+ #5\n[    0.000000] Hardware name: SiFive HiFive Unmatched A00 (DT)\n[    0.000000] epc : riscv_cpuid_to_hartid_mask+0x6/0xae\n[    0.000000]  ra : __sbi_rfence_v02+0xc8/0x10a\n[    0.000000] epc : ffffffff80007240 ra : ffffffff80009964 sp : ffffffff81803e10\n[    0.000000]  gp : ffffffff81a1ea70 tp : ffffffff8180f500 t0 : ffffffe07fe30000\n[    0.000000]  t1 : 0000000000000004 t2 : 0000000000000000 s0 : ffffffff81803e60\n[    0.000000]  s1 : 0000000000000000 a0 : ffffffff81a22238 a1 : ffffffff81803e10\n[    0.000000]  a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000\n[    0.000000]  a5 : 0000000000000000 a6 : ffffffff8000989c a7 : 0000000052464e43\n[    0.000000]  s2 : ffffffff81a220c8 s3 : 0000000000000000 s4 : 0000000000000000\n[    0.000000]  s5 : 0000000000000000 s6 : 0000000200000100 s7 : 0000000000000001\n[    0.000000]  s8 : ffffffe07fe04040 s9 : ffffffff81a22c80 s10: 0000000000001000\n[    0.000000]  s11: 0000000000000004 t3 : 0000000000000001 t4 : 0000000000000008\n[    0.000000]  t5 : ffffffcf04000808 t6 : ffffffe3ffddf188\n[    0.000000] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000002\n[    0.000000] [\u003cffffffff80007240\u003e] riscv_cpuid_to_hartid_mask+0x6/0xae\n[    0.000000] [\u003cffffffff80009474\u003e] sbi_remote_fence_i+0x1e/0x26\n[    0.000000] [\u003cffffffff8000b8f4\u003e] flush_icache_all+0x12/0x1a\n[    0.000000] [\u003cffffffff8000666c\u003e] patch_text_nosync+0x26/0x32\n[    0.000000] [\u003cffffffff8000884e\u003e] ftrace_init_nop+0x52/0x8c\n[    0.000000] [\u003cffffffff800f051e\u003e] ftrace_process_locs.isra.0+0x29c/0x360\n[    0.000000] [\u003cffffffff80a0e3c6\u003e] ftrace_init+0x80/0x130\n[    0.000000] [\u003cffffffff80a00f8c\u003e] start_kernel+0x5c4/0x8f6\n[    0.000000] ---[ end trace f67eb9af4d8d492b ]---\n[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!\n[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---\n\nWhile ftrace is looping over a list of addresses to patch, it always failed\nwhen patching the same function: riscv_cpuid_to_hartid_mask. Looking at the\nbacktrace, the illegal instruction is encountered in this same function.\nHowever, patch_text_nosync, after patching the instructions, calls\nflush_icache_range. But looking at what happens in this function:\n\nflush_icache_range -\u003e flush_icache_all\n                   -\u003e sbi_remote_fence_i\n                   -\u003e __sbi_rfence_v02\n                   -\u003e riscv_cpuid_to_hartid_mask\n\nThe icache and dcache of the current cpu are never synchronized between the\npatching of riscv_cpuid_to_hartid_mask and calling this same function.\n\nSo fix this by flushing the current cpu's icache before asking for the other\ncpus to do the same.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a7e6e00-7bb8-4bc0-80b3-1d5d21c9d1a7",
      "id": "CVE-2021-47588",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsit: do not call ipip6_dev_free() from sit_init_net()\n\nipip6_dev_free is sit dev-\u003epriv_destructor, already called\nby register_netdevice() if something goes wrong.\n\nAlternative would be to make ipip6_dev_free() robust against\nmultiple invocations, but other drivers do not implement this\nstrategy.\n\nsyzbot reported:\n\ndst_release underflow\nWARNING: CPU: 0 PID: 5059 at net/core/dst.c:173 dst_release+0xd8/0xe0 net/core/dst.c:173\nModules linked in:\nCPU: 1 PID: 5059 Comm: syz-executor.4 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:dst_release+0xd8/0xe0 net/core/dst.c:173\nCode: 4c 89 f2 89 d9 31 c0 5b 41 5e 5d e9 da d5 44 f9 e8 1d 90 5f f9 c6 05 87 48 c6 05 01 48 c7 c7 80 44 99 8b 31 c0 e8 e8 67 29 f9 \u003c0f\u003e 0b eb 85 0f 1f 40 00 53 48 89 fb e8 f7 8f 5f f9 48 83 c3 a8 48\nRSP: 0018:ffffc9000aa5faa0 EFLAGS: 00010246\nRAX: d6894a925dd15a00 RBX: 00000000ffffffff RCX: 0000000000040000\nRDX: ffffc90005e19000 RSI: 000000000003ffff RDI: 0000000000040000\nRBP: 0000000000000000 R08: ffffffff816a1f42 R09: ffffed1017344f2c\nR10: ffffed1017344f2c R11: 0000000000000000 R12: 0000607f462b1358\nR13: 1ffffffff1bfd305 R14: ffffe8ffffcb1358 R15: dffffc0000000000\nFS:  00007f66c71a2700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f88aaed5058 CR3: 0000000023e0f000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n dst_cache_destroy+0x107/0x1e0 net/core/dst_cache.c:160\n ipip6_dev_free net/ipv6/sit.c:1414 [inline]\n sit_init_net+0x229/0x550 net/ipv6/sit.c:1936\n ops_init+0x313/0x430 net/core/net_namespace.c:140\n setup_net+0x35b/0x9d0 net/core/net_namespace.c:326\n copy_net_ns+0x359/0x5c0 net/core/net_namespace.c:470\n create_new_namespaces+0x4ce/0xa00 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0x11e/0x180 kernel/nsproxy.c:226\n ksys_unshare+0x57d/0xb50 kernel/fork.c:3075\n __do_sys_unshare kernel/fork.c:3146 [inline]\n __se_sys_unshare kernel/fork.c:3144 [inline]\n __x64_sys_unshare+0x34/0x40 kernel/fork.c:3144\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f66c882ce99\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f66c71a2168 EFLAGS: 00000246 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 00007f66c893ff60 RCX: 00007f66c882ce99\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000048040200\nRBP: 00007f66c8886ff1 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fff6634832f R14: 00007f66c71a2300 R15: 0000000000022000\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "974b01d9-6654-4886-8a5e-b1ab20eac2ea",
      "id": "CVE-2022-0185",
      "description": "A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1fbda7a-0e6a-4426-a19a-e19d1226a495",
      "id": "CVE-2022-26490",
      "description": "st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88173b17-04f6-4511-83e2-f21a1d439787",
      "id": "CVE-2022-2991",
      "description": "A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa243db9-3ec7-418a-9c6f-6a1a5ea693b1",
      "id": "CVE-2022-4095",
      "description": "A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "765a837f-d082-4a81-b619-c0476e171f0e",
      "id": "CVE-2022-48744",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Avoid field-overflowing memcpy()\n\nIn preparation for FORTIFY_SOURCE performing compile-time and run-time\nfield bounds checking for memcpy(), memmove(), and memset(), avoid\nintentionally writing across neighboring fields.\n\nUse flexible arrays instead of zero-element arrays (which look like they\nare always overflowing) and split the cross-field memcpy() into two halves\nthat can be appropriately bounds-checked by the compiler.\n\nWe were doing:\n\n\t#define ETH_HLEN  14\n\t#define VLAN_HLEN  4\n\t...\n\t#define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)\n\t...\n        struct mlx5e_tx_wqe      *wqe  = mlx5_wq_cyc_get_wqe(wq, pi);\n\t...\n        struct mlx5_wqe_eth_seg  *eseg = \u0026wqe-\u003eeth;\n        struct mlx5_wqe_data_seg *dseg = wqe-\u003edata;\n\t...\n\tmemcpy(eseg-\u003einline_hdr.start, xdptxd-\u003edata, MLX5E_XDP_MIN_INLINE);\n\ntarget is wqe-\u003eeth.inline_hdr.start (which the compiler sees as being\n2 bytes in size), but copying 18, intending to write across start\n(really vlan_tci, 2 bytes). The remaining 16 bytes get written into\nwqe-\u003edata[0], covering byte_count (4 bytes), lkey (4 bytes), and addr\n(8 bytes).\n\nstruct mlx5e_tx_wqe {\n        struct mlx5_wqe_ctrl_seg   ctrl;                 /*     0    16 */\n        struct mlx5_wqe_eth_seg    eth;                  /*    16    16 */\n        struct mlx5_wqe_data_seg   data[];               /*    32     0 */\n\n        /* size: 32, cachelines: 1, members: 3 */\n        /* last cacheline: 32 bytes */\n};\n\nstruct mlx5_wqe_eth_seg {\n        u8                         swp_outer_l4_offset;  /*     0     1 */\n        u8                         swp_outer_l3_offset;  /*     1     1 */\n        u8                         swp_inner_l4_offset;  /*     2     1 */\n        u8                         swp_inner_l3_offset;  /*     3     1 */\n        u8                         cs_flags;             /*     4     1 */\n        u8                         swp_flags;            /*     5     1 */\n        __be16                     mss;                  /*     6     2 */\n        __be32                     flow_table_metadata;  /*     8     4 */\n        union {\n                struct {\n                        __be16     sz;                   /*    12     2 */\n                        u8         start[2];             /*    14     2 */\n                } inline_hdr;                            /*    12     4 */\n                struct {\n                        __be16     type;                 /*    12     2 */\n                        __be16     vlan_tci;             /*    14     2 */\n                } insert;                                /*    12     4 */\n                __be32             trailer;              /*    12     4 */\n        };                                               /*    12     4 */\n\n        /* size: 16, cachelines: 1, members: 9 */\n        /* last cacheline: 16 bytes */\n};\n\nstruct mlx5_wqe_data_seg {\n        __be32                     byte_count;           /*     0     4 */\n        __be32                     lkey;                 /*     4     4 */\n        __be64                     addr;                 /*     8     8 */\n\n        /* size: 16, cachelines: 1, members: 3 */\n        /* last cacheline: 16 bytes */\n};\n\nSo, split the memcpy() so the compiler can reason about the buffer\nsizes.\n\n\"pahole\" shows no size nor member offset changes to struct mlx5e_tx_wqe\nnor struct mlx5e_umr_wqe. \"objdump -d\" shows no meaningful object\ncode changes (i.e. only source line number induced differences and\noptimizations).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fad7678a-0450-45f8-b01c-f4cd43970da4",
      "id": "CVE-2022-48912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: fix use-after-free in __nf_register_net_hook()\n\nWe must not dereference @new_hooks after nf_hook_mutex has been released,\nbecause other threads might have freed our allocated hooks already.\n\nBUG: KASAN: use-after-free in nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline]\nBUG: KASAN: use-after-free in hooks_validate net/netfilter/core.c:171 [inline]\nBUG: KASAN: use-after-free in __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438\nRead of size 2 at addr ffff88801c1a8000 by task syz-executor237/4430\n\nCPU: 1 PID: 4430 Comm: syz-executor237 Not tainted 5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline]\n hooks_validate net/netfilter/core.c:171 [inline]\n __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438\n nf_register_net_hook+0x114/0x170 net/netfilter/core.c:571\n nf_register_net_hooks+0x59/0xc0 net/netfilter/core.c:587\n nf_synproxy_ipv6_init+0x85/0xe0 net/netfilter/nf_synproxy_core.c:1218\n synproxy_tg6_check+0x30d/0x560 net/ipv6/netfilter/ip6t_SYNPROXY.c:81\n xt_check_target+0x26c/0x9e0 net/netfilter/x_tables.c:1038\n check_target net/ipv6/netfilter/ip6_tables.c:530 [inline]\n find_check_entry.constprop.0+0x7f1/0x9e0 net/ipv6/netfilter/ip6_tables.c:573\n translate_table+0xc8b/0x1750 net/ipv6/netfilter/ip6_tables.c:735\n do_replace net/ipv6/netfilter/ip6_tables.c:1153 [inline]\n do_ip6t_set_ctl+0x56e/0xb90 net/ipv6/netfilter/ip6_tables.c:1639\n nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101\n ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1024\n rawv6_setsockopt+0xd3/0x6a0 net/ipv6/raw.c:1084\n __sys_setsockopt+0x2db/0x610 net/socket.c:2180\n __do_sys_setsockopt net/socket.c:2191 [inline]\n __se_sys_setsockopt net/socket.c:2188 [inline]\n __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f65a1ace7d9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f65a1a7f308 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f65a1ace7d9\nRDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003\nRBP: 00007f65a1b574c8 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000000 R11: 0000000000000246 R12: 00007f65a1b55130\nR13: 00007f65a1b574c0 R14: 00007f65a1b24090 R15: 0000000000022000\n \u003c/TASK\u003e\n\nThe buggy address belongs to the page:\npage:ffffea0000706a00 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c1a8\nflags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)\nraw: 00fff00000000000 ffffea0001c1b108 ffffea000046dd08 0000000000000000\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\npage_owner tracks the page as freed\npage last allocated via order 2, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 4430, ts 1061781545818, free_ts 1061791488993\n prep_new_page mm/page_alloc.c:2434 [inline]\n get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165\n __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389\n __alloc_pages_node include/linux/gfp.h:572 [inline]\n alloc_pages_node include/linux/gfp.h:595 [inline]\n kmalloc_large_node+0x62/0x130 mm/slub.c:4438\n __kmalloc_node+0x35a/0x4a0 mm/slub.\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de086121-2a0e-43d1-b630-971f1598b94c",
      "id": "CVE-2022-49409",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug_on in __es_tree_search\n\nHulk Robot reported a BUG_ON:\n==================================================================\nkernel BUG at fs/ext4/extents_status.c:199!\n[...]\nRIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline]\nRIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217\n[...]\nCall Trace:\n ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766\n ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561\n ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964\n ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384\n ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567\n ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980\n ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031\n ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257\n v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63\n v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82\n vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368\n dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490\n ext4_quota_enable fs/ext4/super.c:6137 [inline]\n ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163\n ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754\n mount_bdev+0x2e9/0x3b0 fs/super.c:1158\n mount_fs+0x4b/0x1e4 fs/super.c:1261\n[...]\n==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\next4_fill_super\n ext4_enable_quotas\n  ext4_quota_enable\n   ext4_iget\n    __ext4_iget\n     ext4_ext_check_inode\n      ext4_ext_check\n       __ext4_ext_check\n        ext4_valid_extent_entries\n         Check for overlapping extents does't take effect\n   dquot_enable\n    vfs_load_quota_inode\n     v2_check_quota_file\n      v2_read_header\n       ext4_quota_read\n        ext4_bread\n         ext4_getblk\n          ext4_map_blocks\n           ext4_ext_map_blocks\n            ext4_find_extent\n             ext4_cache_extents\n              ext4_es_cache_extent\n               ext4_es_cache_extent\n                __es_tree_search\n                 ext4_es_end\n                  BUG_ON(es-\u003ees_lblk + es-\u003ees_len \u003c es-\u003ees_lblk)\n\nThe error ext4 extents is as follows:\n0af3 0300 0400 0000 00000000    extent_header\n00000000 0100 0000 12000000     extent1\n00000000 0100 0000 18000000     extent2\n02000000 0400 0000 14000000     extent3\n\nIn the ext4_valid_extent_entries function,\nif prev is 0, no error is returned even if lblock\u003c=prev.\nThis was intended to skip the check on the first extent, but\nin the error image above, prev=0+1-1=0 when checking the second extent,\nso even though lblock\u003c=prev, the function does not return an error.\nAs a result, bug_ON occurs in __es_tree_search and the system panics.\n\nTo solve this problem, we only need to check that:\n1. The lblock of the first extent is not less than 0.\n2. The lblock of the next extent  is not less than\n   the next block of the previous extent.\nThe same applies to extent_idx.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b59a2604-7688-4069-bef1-80a68cd276af",
      "id": "CVE-2022-49443",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlist: fix a data-race around ep-\u003erdllist\n\nep_poll() first calls ep_events_available() with no lock held and checks\nif ep-\u003erdllist is empty by list_empty_careful(), which reads\nrdllist-\u003eprev.  Thus all accesses to it need some protection to avoid\nstore/load-tearing.\n\nNote INIT_LIST_HEAD_RCU() already has the annotation for both prev\nand next.\n\nCommit bf3b9f6372c4 (\"epoll: Add busy poll support to epoll with socket\nfds.\") added the first lockless ep_events_available(), and commit\nc5a282e9635e (\"fs/epoll: reduce the scope of wq lock in epoll_wait()\")\nmade some ep_events_available() calls lockless and added single call under\na lock, finally commit e59d3c64cba6 (\"epoll: eliminate unnecessary lock\nfor zero timeout\") made the last ep_events_available() lockless.\n\nBUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait\n\nwrite to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:\n INIT_LIST_HEAD include/linux/list.h:38 [inline]\n list_splice_init include/linux/list.h:492 [inline]\n ep_start_scan fs/eventpoll.c:622 [inline]\n ep_send_events fs/eventpoll.c:1656 [inline]\n ep_poll fs/eventpoll.c:1806 [inline]\n do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nread to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:\n list_empty_careful include/linux/list.h:329 [inline]\n ep_events_available fs/eventpoll.c:381 [inline]\n ep_poll fs/eventpoll.c:1797 [inline]\n do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nvalue changed: 0xffff88810480c7d0 -\u003e 0xffff888103c15098\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G        W         5.17.0-rc7-syzkaller-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f2c4cc3-6ed9-404a-93c1-7dcbc058edfd",
      "id": "CVE-2022-49481",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt\n\nof_node_get() returns a node with refcount incremented.\nCalling of_node_put() to drop the reference when not needed anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b270eb9-8c24-4d7a-8450-14cae6844f2f",
      "id": "CVE-2022-49519",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath10k: skip ath10k_halt during suspend for driver state RESTARTING\n\nDouble free crash is observed when FW recovery(caused by wmi\ntimeout/crash) is followed by immediate suspend event. The FW recovery\nis triggered by ath10k_core_restart() which calls driver clean up via\nath10k_halt(). When the suspend event occurs between the FW recovery,\nthe restart worker thread is put into frozen state until suspend completes.\nThe suspend event triggers ath10k_stop() which again triggers ath10k_halt()\nThe double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be\ncalled twice(Note: ath10k_htt_rx_alloc was not called by restart worker\nthread because of its frozen state), causing the crash.\n\nTo fix this, during the suspend flow, skip call to ath10k_halt() in\nath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING.\nAlso, for driver state ATH10K_STATE_RESTARTING, call\nath10k_wait_for_suspend() in ath10k_stop(). This is because call to\nath10k_wait_for_suspend() is skipped later in\n[ath10k_halt() \u003e ath10k_core_stop()] for the driver state\nATH10K_STATE_RESTARTING.\n\nThe frozen restart worker thread will be cancelled during resume when the\ndevice comes out of suspend.\n\nBelow is the crash stack for reference:\n\n[  428.469167] ------------[ cut here ]------------\n[  428.469180] kernel BUG at mm/slub.c:4150!\n[  428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[  428.469219] Workqueue: events_unbound async_run_entry_fn\n[  428.469230] RIP: 0010:kfree+0x319/0x31b\n[  428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246\n[  428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000\n[  428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000\n[  428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000\n[  428.469276] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  428.469285] Call Trace:\n[  428.469295]  ? dma_free_attrs+0x5f/0x7d\n[  428.469320]  ath10k_core_stop+0x5b/0x6f\n[  428.469336]  ath10k_halt+0x126/0x177\n[  428.469352]  ath10k_stop+0x41/0x7e\n[  428.469387]  drv_stop+0x88/0x10e\n[  428.469410]  __ieee80211_suspend+0x297/0x411\n[  428.469441]  rdev_suspend+0x6e/0xd0\n[  428.469462]  wiphy_suspend+0xb1/0x105\n[  428.469483]  ? name_show+0x2d/0x2d\n[  428.469490]  dpm_run_callback+0x8c/0x126\n[  428.469511]  ? name_show+0x2d/0x2d\n[  428.469517]  __device_suspend+0x2e7/0x41b\n[  428.469523]  async_suspend+0x1f/0x93\n[  428.469529]  async_run_entry_fn+0x3d/0xd1\n[  428.469535]  process_one_work+0x1b1/0x329\n[  428.469541]  worker_thread+0x213/0x372\n[  428.469547]  kthread+0x150/0x15f\n[  428.469552]  ? pr_cont_work+0x58/0x58\n[  428.469558]  ? kthread_blkcg+0x31/0x31\n\nTested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "53c666c2-7cca-4ddc-af70-c84a747d854c",
      "id": "CVE-2022-49637",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix a data-race around sysctl_fib_sync_mem.\n\nWhile reading sysctl_fib_sync_mem, it can be changed concurrently.\nSo, we need to add READ_ONCE() to avoid a data-race.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e93501b4-0873-4dab-8269-6023c4c8fedb",
      "id": "CVE-2022-49646",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix queue selection for mesh/OCB interfaces\n\nWhen using iTXQ, the code assumes that there is only one vif queue for\nbroadcast packets, using the BE queue. Allowing non-BE queue marking\nviolates that assumption and txq-\u003eac == skb_queue_mapping is no longer\nguaranteed. This can cause issues with queue handling in the driver and\nalso causes issues with the recent ATF change, resulting in an AQL\nunderflow warning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63e49e71-1469-4cb3-acca-e745c912522b",
      "id": "CVE-2022-49700",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: add missing TID updates on slab deactivation\n\nThe fastpath in slab_alloc_node() assumes that c-\u003eslab is stable as long as\nthe TID stays the same. However, two places in __slab_alloc() currently\ndon't update the TID when deactivating the CPU slab.\n\nIf multiple operations race the right way, this could lead to an object\ngetting lost; or, in an even more unlikely situation, it could even lead to\nan object being freed onto the wrong slab's freelist, messing up the\n`inuse` counter and eventually causing a page to be freed to the page\nallocator while it still contains slab objects.\n\n(I haven't actually tested these cases though, this is just based on\nlooking at the code. Writing testcases for this stuff seems like it'd be\na pain...)\n\nThe race leading to state inconsistency is (all operations on the same CPU\nand kmem_cache):\n\n - task A: begin do_slab_free():\n    - read TID\n    - read pcpu freelist (==NULL)\n    - check `slab == c-\u003eslab` (true)\n - [PREEMPT A-\u003eB]\n - task B: begin slab_alloc_node():\n    - fastpath fails (`c-\u003efreelist` is NULL)\n    - enter __slab_alloc()\n    - slub_get_cpu_ptr() (disables preemption)\n    - enter ___slab_alloc()\n    - take local_lock_irqsave()\n    - read c-\u003efreelist as NULL\n    - get_freelist() returns NULL\n    - write `c-\u003eslab = NULL`\n    - drop local_unlock_irqrestore()\n    - goto new_slab\n    - slub_percpu_partial() is NULL\n    - get_partial() returns NULL\n    - slub_put_cpu_ptr() (enables preemption)\n - [PREEMPT B-\u003eA]\n - task A: finish do_slab_free():\n    - this_cpu_cmpxchg_double() succeeds()\n    - [CORRUPT STATE: c-\u003eslab==NULL, c-\u003efreelist!=NULL]\n\nFrom there, the object on c-\u003efreelist will get lost if task B is allowed to\ncontinue from here: It will proceed to the retry_load_slab label,\nset c-\u003eslab, then jump to load_freelist, which clobbers c-\u003efreelist.\n\nBut if we instead continue as follows, we get worse corruption:\n\n - task A: run __slab_free() on object from other struct slab:\n    - CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial)\n - task A: run slab_alloc_node() with NUMA node constraint:\n    - fastpath fails (c-\u003eslab is NULL)\n    - call __slab_alloc()\n    - slub_get_cpu_ptr() (disables preemption)\n    - enter ___slab_alloc()\n    - c-\u003eslab is NULL: goto new_slab\n    - slub_percpu_partial() is non-NULL\n    - set c-\u003eslab to slub_percpu_partial(c)\n    - [CORRUPT STATE: c-\u003eslab points to slab-1, c-\u003efreelist has objects\n      from slab-2]\n    - goto redo\n    - node_match() fails\n    - goto deactivate_slab\n    - existing c-\u003efreelist is passed into deactivate_slab()\n    - inuse count of slab-1 is decremented to account for object from\n      slab-2\n\nAt this point, the inuse count of slab-1 is 1 lower than it should be.\nThis means that if we free all allocated objects in slab-1 except for one,\nSLUB will think that slab-1 is completely unused, and may free its page,\nleading to use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0b81cdd-caab-4dd7-9a35-c79059f8378f",
      "id": "CVE-2022-49822",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix connections leak when tlink setup failed\n\nIf the tlink setup failed, lost to put the connections, then\nthe module refcnt leak since the cifsd kthread not exit.\n\nAlso leak the fscache info, and for next mount with fsc, it will\nprint the follow errors:\n  CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST)\n\nLet's check the result of tlink setup, and do some cleanup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0f6046c-c6df-4590-a083-42d400afa6fb",
      "id": "CVE-2022-50011",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvenus: pm_helpers: Fix warning in OPP during probe\n\nFix the following WARN triggered during Venus driver probe on\n5.19.0-rc8-next-20220728:\n\n WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610\n Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor\n  qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+)\n  videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched\n  snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats\n  drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5\n  phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro\n  lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers\n  qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector\n  drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6\n CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4\n Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\n pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : dev_pm_opp_set_config+0x49c/0x610\n lr : dev_pm_opp_set_config+0x58/0x610\n sp : ffff8000093c3710\n x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00\n x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810\n x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810\n x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000\n x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858\n x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000\n x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0\n x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640\n x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008\n x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860\n Call trace:\n  dev_pm_opp_set_config+0x49c/0x610\n  devm_pm_opp_set_config+0x18/0x70\n  vcodec_domains_get+0xb8/0x1638 [venus_core]\n  core_get_v4+0x1d8/0x218 [venus_core]\n  venus_probe+0xf4/0x468 [venus_core]\n  platform_probe+0x68/0xd8\n  really_probe+0xbc/0x2a8\n  __driver_probe_device+0x78/0xe0\n  driver_probe_device+0x3c/0xf0\n  __driver_attach+0x70/0x120\n  bus_for_each_dev+0x70/0xc0\n  driver_attach+0x24/0x30\n  bus_add_driver+0x150/0x200\n  driver_register+0x64/0x120\n  __platform_driver_register+0x28/0x38\n  qcom_venus_driver_init+0x24/0x1000 [venus_core]\n  do_one_initcall+0x54/0x1c8\n  do_init_module+0x44/0x1d0\n  load_module+0x16c8/0x1aa0\n  __do_sys_finit_module+0xbc/0x110\n  __arm64_sys_finit_module+0x20/0x30\n  invoke_syscall+0x44/0x108\n  el0_svc_common.constprop.0+0xcc/0xf0\n  do_el0_svc+0x2c/0xb8\n  el0_svc+0x2c/0x88\n  el0t_64_sync_handler+0xb8/0xc0\n  el0t_64_sync+0x18c/0x190\n  qcom-venus: probe of aa00000.video-codec failed with error -16\n\nThe fix is re-ordering the code related to OPP core. The OPP core\nexpects all configuration options to be provided before the OPP\ntable is added.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1d96b97-50c7-4374-a82d-0c420651cef5",
      "id": "CVE-2022-50200",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: Add boundary check in put_entry()\n\nJust like next_entry(), boundary check is necessary to prevent memory\nout-of-bound access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba94faa4-8889-46f0-af34-d673a53a3c93",
      "id": "CVE-2022-50265",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: annotate data-races around kcm-\u003erx_wait\n\nkcm-\u003erx_psock can be read locklessly in kcm_rfree().\nAnnotate the read and writes accordingly.\n\nsyzbot reported:\n\nBUG: KCSAN: data-race in kcm_rcv_strparser / kcm_rfree\n\nwrite to 0xffff88810784e3d0 of 1 bytes by task 1823 on cpu 1:\nreserve_rx_kcm net/kcm/kcmsock.c:283 [inline]\nkcm_rcv_strparser+0x250/0x3a0 net/kcm/kcmsock.c:363\n__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301\nstrp_recv+0x6d/0x80 net/strparser/strparser.c:335\ntcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703\nstrp_read_sock net/strparser/strparser.c:358 [inline]\ndo_strp_work net/strparser/strparser.c:406 [inline]\nstrp_work+0xe8/0x180 net/strparser/strparser.c:415\nprocess_one_work+0x3d3/0x720 kernel/workqueue.c:2289\nworker_thread+0x618/0xa70 kernel/workqueue.c:2436\nkthread+0x1a9/0x1e0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nread to 0xffff88810784e3d0 of 1 bytes by task 17869 on cpu 0:\nkcm_rfree+0x121/0x220 net/kcm/kcmsock.c:181\nskb_release_head_state+0x8e/0x160 net/core/skbuff.c:841\nskb_release_all net/core/skbuff.c:852 [inline]\n__kfree_skb net/core/skbuff.c:868 [inline]\nkfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891\nkfree_skb include/linux/skbuff.h:1216 [inline]\nkcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161\n____sys_recvmsg+0x16c/0x2e0\n___sys_recvmsg net/socket.c:2743 [inline]\ndo_recvmmsg+0x2f1/0x710 net/socket.c:2837\n__sys_recvmmsg net/socket.c:2916 [inline]\n__do_sys_recvmmsg net/socket.c:2939 [inline]\n__se_sys_recvmmsg net/socket.c:2932 [inline]\n__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nvalue changed: 0x01 -\u003e 0x00\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 17869 Comm: syz-executor.2 Not tainted 6.1.0-rc1-syzkaller-00010-gbb1a1146467a-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4508e07c-4032-4b99-8e22-a858a8156ae2",
      "id": "CVE-2023-0469",
      "description": "A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6184c4fd-5728-4349-bc00-ecf1e19dd453",
      "id": "CVE-2023-1380",
      "description": "A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info-\u003ereq_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "178886b0-9451-4177-bf71-aa13cca2b0e5",
      "id": "CVE-2023-42752",
      "description": "An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8dfaa2af-2e02-4e0c-a47a-0c38cca3c62a",
      "id": "CVE-2023-52683",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: LPIT: Avoid u32 multiplication overflow\n\nIn lpit_update_residency() there is a possibility of overflow\nin multiplication, if tsc_khz is large enough (\u003e UINT_MAX/1000).\n\nChange multiplication to mul_u32_u32().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "53a54513-aa4e-40c5-b706-f88e171c7d77",
      "id": "CVE-2023-52926",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIORING_OP_READ did not correctly consume the provided buffer list when\nread i/o returned \u003c 0 (except for -EAGAIN and -EIOCBQUEUED return).\nThis can lead to a potential use-after-free when the completion via\nio_rw_done runs at separate context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0971afcb-e6e4-4f50-9b0e-3dd9248df26a",
      "id": "CVE-2023-53135",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode\n\nWhen CONFIG_FRAME_POINTER is unset, the stack unwinding function\nwalk_stackframe randomly reads the stack and then, when KASAN is enabled,\nit can lead to the following backtrace:\n\n[    0.000000] ==================================================================\n[    0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a\n[    0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0\n[    0.000000]\n[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43\n[    0.000000] Hardware name: riscv-virtio,qemu (DT)\n[    0.000000] Call Trace:\n[    0.000000] [\u003cffffffff80007ba8\u003e] walk_stackframe+0x0/0x11a\n[    0.000000] [\u003cffffffff80099ecc\u003e] init_param_lock+0x26/0x2a\n[    0.000000] [\u003cffffffff80007c4a\u003e] walk_stackframe+0xa2/0x11a\n[    0.000000] [\u003cffffffff80c49c80\u003e] dump_stack_lvl+0x22/0x36\n[    0.000000] [\u003cffffffff80c3783e\u003e] print_report+0x198/0x4a8\n[    0.000000] [\u003cffffffff80099ecc\u003e] init_param_lock+0x26/0x2a\n[    0.000000] [\u003cffffffff80007c4a\u003e] walk_stackframe+0xa2/0x11a\n[    0.000000] [\u003cffffffff8015f68a\u003e] kasan_report+0x9a/0xc8\n[    0.000000] [\u003cffffffff80007c4a\u003e] walk_stackframe+0xa2/0x11a\n[    0.000000] [\u003cffffffff80007c4a\u003e] walk_stackframe+0xa2/0x11a\n[    0.000000] [\u003cffffffff8006e99c\u003e] desc_make_final+0x80/0x84\n[    0.000000] [\u003cffffffff8009a04e\u003e] stack_trace_save+0x88/0xa6\n[    0.000000] [\u003cffffffff80099fc2\u003e] filter_irq_stacks+0x72/0x76\n[    0.000000] [\u003cffffffff8006b95e\u003e] devkmsg_read+0x32a/0x32e\n[    0.000000] [\u003cffffffff8015ec16\u003e] kasan_save_stack+0x28/0x52\n[    0.000000] [\u003cffffffff8006e998\u003e] desc_make_final+0x7c/0x84\n[    0.000000] [\u003cffffffff8009a04a\u003e] stack_trace_save+0x84/0xa6\n[    0.000000] [\u003cffffffff8015ec52\u003e] kasan_set_track+0x12/0x20\n[    0.000000] [\u003cffffffff8015f22e\u003e] __kasan_slab_alloc+0x58/0x5e\n[    0.000000] [\u003cffffffff8015e7ea\u003e] __kmem_cache_create+0x21e/0x39a\n[    0.000000] [\u003cffffffff80e133ac\u003e] create_boot_cache+0x70/0x9c\n[    0.000000] [\u003cffffffff80e17ab2\u003e] kmem_cache_init+0x6c/0x11e\n[    0.000000] [\u003cffffffff80e00fd6\u003e] mm_init+0xd8/0xfe\n[    0.000000] [\u003cffffffff80e011d8\u003e] start_kernel+0x190/0x3ca\n[    0.000000]\n[    0.000000] The buggy address belongs to stack of task swapper/0\n[    0.000000]  and is located at offset 0 in frame:\n[    0.000000]  stack_trace_save+0x0/0xa6\n[    0.000000]\n[    0.000000] This frame has 1 object:\n[    0.000000]  [32, 56) 'c'\n[    0.000000]\n[    0.000000] The buggy address belongs to the physical page:\n[    0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07\n[    0.000000] flags: 0x1000(reserved|zone=0)\n[    0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000\n[    0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff\n[    0.000000] page dumped because: kasan: bad access detected\n[    0.000000]\n[    0.000000] Memory state around the buggy address:\n[    0.000000]  ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[    0.000000]  ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[    0.000000] \u003effffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3\n[    0.000000]                                            ^\n[    0.000000]  ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n[    0.000000]  ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[    0.000000] ==================================================================\n\nFix that by using READ_ONCE_NOCHECK when reading the stack in imprecise\nmode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12f096ac-dcd2-4689-a28d-418649da606e",
      "id": "CVE-2023-7192",
      "description": "A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e7468e2-565d-4940-933f-723214dad6cd",
      "id": "CVE-2024-26956",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix failure to detect DAT corruption in btree and direct mappings\n\nPatch series \"nilfs2: fix kernel bug at submit_bh_wbc()\".\n\nThis resolves a kernel BUG reported by syzbot.  Since there are two\nflaws involved, I've made each one a separate patch.\n\nThe first patch alone resolves the syzbot-reported bug, but I think\nboth fixes should be sent to stable, so I've tagged them as such.\n\n\nThis patch (of 2):\n\nSyzbot has reported a kernel bug in submit_bh_wbc() when writing file data\nto a nilfs2 file system whose metadata is corrupted.\n\nThere are two flaws involved in this issue.\n\nThe first flaw is that when nilfs_get_block() locates a data block using\nbtree or direct mapping, if the disk address translation routine\nnilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata\ncorruption, it can be passed back to nilfs_get_block().  This causes\nnilfs_get_block() to misidentify an existing block as non-existent,\ncausing both data block lookup and insertion to fail inconsistently.\n\nThe second flaw is that nilfs_get_block() returns a successful status in\nthis inconsistent state.  This causes the caller __block_write_begin_int()\nor others to request a read even though the buffer is not mapped,\nresulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()\nfailing.\n\nThis fixes the first issue by changing the return value to code -EINVAL\nwhen a conversion using DAT fails with code -ENOENT, avoiding the\nconflicting condition that leads to the kernel bug described above.  Here,\ncode -EINVAL indicates that metadata corruption was detected during the\nblock lookup, which will be properly handled as a file system error and\nconverted to -EIO when passing through the nilfs2 bmap layer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0973018-0c46-4cad-972d-c6e97817f34f",
      "id": "CVE-2024-36897",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atom Integrated System Info v2_2 for DCN35\n\nNew request from KMD/VBIOS in order to support new UMA carveout\nmodel. This fixes a null dereference from accessing\nCtx-\u003edc_bios-\u003eintegrated_info while it was NULL.\n\nDAL parses through the BIOS and extracts the necessary\nintegrated_info but was missing a case for the new BIOS\nversion 2.3.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5024257-81aa-499b-8f0d-ecc38aa603eb",
      "id": "CVE-2024-40969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: don't set RO when shutting down f2fs\n\nShutdown does not check the error of thaw_super due to readonly, which\ncauses a deadlock like below.\n\nf2fs_ioc_shutdown(F2FS_GOING_DOWN_FULLSYNC)        issue_discard_thread\n - bdev_freeze\n  - freeze_super\n - f2fs_stop_checkpoint()\n  - f2fs_handle_critical_error                     - sb_start_write\n    - set RO                                         - waiting\n - bdev_thaw\n  - thaw_super_locked\n    - return -EINVAL, if sb_rdonly()\n - f2fs_stop_discard_thread\n  -\u003e wait for kthread_stop(discard_thread);",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c320867d-95ac-4d44-b9b3-7a6795728b9b",
      "id": "CVE-2024-41013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't walk off the end of a directory data block\n\nThis adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry\nto make sure don't stray beyond valid memory region. Before patching, the\nloop simply checks that the start offset of the dup and dep is within the\nrange. So in a crafted image, if last entry is xfs_dir2_data_unused, we\ncan change dup-\u003elength to dup-\u003elength-1 and leave 1 byte of space. In the\nnext traversal, this space will be considered as dup or dep. We may\nencounter an out of bound read when accessing the fixed members.\n\nIn the patch, we make sure that the remaining bytes large enough to hold\nan unused entry before accessing xfs_dir2_data_unused and\nxfs_dir2_data_unused is XFS_DIR2_DATA_ALIGN byte aligned. We also make\nsure that the remaining bytes large enough to hold a dirent with a\nsingle-byte name before accessing xfs_dir2_data_entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00012209-e201-4df6-aa6a-0cb84bbdec02",
      "id": "CVE-2024-42160",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: check validation of fault attrs in f2fs_build_fault_attr()\n\n- It missed to check validation of fault attrs in parse_options(),\nlet's fix to add check condition in f2fs_build_fault_attr().\n- Use f2fs_build_fault_attr() in __sbi_store() to clean up code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36760eca-dd36-4bac-9309-2cd9be327be0",
      "id": "CVE-2024-42280",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix a use after free in hfcmulti_tx()\n\nDon't dereference *sp after calling dev_kfree_skb(*sp).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7066fad-56ad-43b7-a75b-5bfbb1bc594c",
      "id": "CVE-2024-43907",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules\n\nCheck the pointer value to fix potential null pointer\ndereference",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51863f8f-8c0c-4d16-80d0-96b43f6680e9",
      "id": "CVE-2024-46724",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number\n\nCheck the fb_channel_number range to avoid the array out-of-bounds\nread error",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3de3eaf-8b1b-4de6-8c74-feee42140d18",
      "id": "CVE-2024-46746",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: free driver_data after destroying hid device\n\nHID driver callbacks aren't called anymore once hid_destroy_device() has\nbeen called. Hence, hid driver_data should be freed only after the\nhid_destroy_device() function returned as driver_data is used in several\ncallbacks.\n\nI observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling\nKASAN to debug memory allocation, I got this output:\n\n  [   13.050438] ==================================================================\n  [   13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh]\n  [   13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3\n  [   13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479\n\n  [   13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0\n  [   13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024\n  [   13.067860] Call Trace:\n  [   13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8\n  [   13.071486]  \u003cTASK\u003e\n  [   13.071492]  dump_stack_lvl+0x5d/0x80\n  [   13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -\u003e 0002)\n  [   13.078296]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.082199]  print_report+0x174/0x505\n  [   13.085776]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [   13.089367]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.093255]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.097464]  kasan_report+0xc8/0x150\n  [   13.101461]  ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.105802]  amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.110303]  amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38]\n  [   13.114879]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.119450]  sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082]\n  [   13.124097]  hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\n  [   13.127404]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.131925]  ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5]\n  [   13.136455]  ? _raw_spin_lock_irqsave+0x96/0xf0\n  [   13.140197]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [   13.143602]  ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b]\n  [   13.147234]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.150446]  ? __devm_add_action+0x167/0x1d0\n  [   13.155061]  hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\n  [   13.158581]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.161814]  platform_probe+0xa2/0x150\n  [   13.165029]  really_probe+0x1e3/0x8a0\n  [   13.168243]  __driver_probe_device+0x18c/0x370\n  [   13.171500]  driver_probe_device+0x4a/0x120\n  [   13.175000]  __driver_attach+0x190/0x4a0\n  [   13.178521]  ? __pfx___driver_attach+0x10/0x10\n  [   13.181771]  bus_for_each_dev+0x106/0x180\n  [   13.185033]  ? __pfx__raw_spin_lock+0x10/0x10\n  [   13.188229]  ? __pfx_bus_for_each_dev+0x10/0x10\n  [   13.191446]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.194382]  bus_add_driver+0x29e/0x4d0\n  [   13.197328]  driver_register+0x1a5/0x360\n  [   13.200283]  ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172]\n  [   13.203362]  do_one_initcall+0xa7/0x380\n  [   13.206432]  ? __pfx_do_one_initcall+0x10/0x10\n  [   13.210175]  ? srso_alias_return_thunk+0x5/0xfbef5\n  [   13.213211]  ? kasan_unpoison+0x44/0x70\n  [   13.216688]  do_init_module+0x238/0x750\n  [   13.2196\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "70815b8d-7700-41d3-a7cf-e6a046145b6f",
      "id": "CVE-2024-47728",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error\n\nFor all non-tracing helpers which formerly had ARG_PTR_TO_{LONG,INT} as input\narguments, zero the value for the case of an error as otherwise it could leak\nmemory. For tracing, it is not needed given CAP_PERFMON can already read all\nkernel memory anyway hence bpf_get_func_arg() and bpf_get_func_ret() is skipped\nin here.\n\nAlso, the MTU helpers mtu_len pointer value is being written but also read.\nTechnically, the MEM_UNINIT should not be there in order to always force init.\nRemoving MEM_UNINIT needs more verifier rework though: MEM_UNINIT right now\nimplies two things actually: i) write into memory, ii) memory does not have\nto be initialized. If we lift MEM_UNINIT, it then becomes: i) read into memory,\nii) memory must be initialized. This means that for bpf_*_check_mtu() we're\nreadding the issue we're trying to fix, that is, it would then be able to\nwrite back into things like .rodata BPF maps. Follow-up work will rework the\nMEM_UNINIT semantics such that the intent can be better expressed. For now\njust clear the *mtu_len on error path which can be lifted later again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63be54bf-6040-48b1-8dfa-361ef3f35ec9",
      "id": "CVE-2024-49931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process()\nfunction access ath12k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To\nfix this issue, modify ath12k_dp_rx_process() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46fc9e93-af63-405e-8189-9981f32a4fbd",
      "id": "CVE-2024-50265",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()\n\nSyzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():\n\n[   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12\n[   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry\n[   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004\n[...]\n[   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0\n[...]\n[   57.331328] Call Trace:\n[   57.331477]  \u003cTASK\u003e\n[...]\n[   57.333511]  ? do_user_addr_fault+0x3e5/0x740\n[   57.333778]  ? exc_page_fault+0x70/0x170\n[   57.334016]  ? asm_exc_page_fault+0x2b/0x30\n[   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10\n[   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0\n[   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0\n[   57.335164]  ocfs2_xa_set+0x704/0xcf0\n[   57.335381]  ? _raw_spin_unlock+0x1a/0x40\n[   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20\n[   57.335915]  ? trace_preempt_on+0x1e/0x70\n[   57.336153]  ? start_this_handle+0x16c/0x500\n[   57.336410]  ? preempt_count_sub+0x50/0x80\n[   57.336656]  ? _raw_read_unlock+0x20/0x40\n[   57.336906]  ? start_this_handle+0x16c/0x500\n[   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0\n[   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0\n[   57.337706]  ? ocfs2_start_trans+0x13d/0x290\n[   57.337971]  ocfs2_xattr_set+0xb13/0xfb0\n[   57.338207]  ? dput+0x46/0x1c0\n[   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30\n[   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30\n[   57.338948]  __vfs_removexattr+0x92/0xc0\n[   57.339182]  __vfs_removexattr_locked+0xd5/0x190\n[   57.339456]  ? preempt_count_sub+0x50/0x80\n[   57.339705]  vfs_removexattr+0x5f/0x100\n[...]\n\nReproducer uses faultinject facility to fail ocfs2_xa_remove() -\u003e\nocfs2_xa_value_truncate() with -ENOMEM.\n\nIn this case the comment mentions that we can return 0 if\nocfs2_xa_cleanup_value_truncate() is going to wipe the entry\nanyway. But the following 'rc' check is wrong and execution flow do\n'ocfs2_xa_remove_entry(loc);' twice:\n* 1st: in ocfs2_xa_cleanup_value_truncate();\n* 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'.\n\nFix this by skipping the 2nd removal of the same entry and making\nsyzkaller repro happy.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c039465f-7d61-46d8-bc44-c73fdd06bb7d",
      "id": "CVE-2024-53079",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/thp: fix deferred split unqueue naming and locking\n\nRecent changes are putting more pressure on THP deferred split queues:\nunder load revealing long-standing races, causing list_del corruptions,\n\"Bad page state\"s and worse (I keep BUGs in both of those, so usually\ndon't get to see how badly they end up without).  The relevant recent\nchanges being 6.8's mTHP, 6.10's mTHP swapout, and 6.12's mTHP swapin,\nimproved swap allocation, and underused THP splitting.\n\nBefore fixing locking: rename misleading folio_undo_large_rmappable(),\nwhich does not undo large_rmappable, to folio_unqueue_deferred_split(),\nwhich is what it does.  But that and its out-of-line __callee are mm\ninternals of very limited usability: add comment and WARN_ON_ONCEs to\ncheck usage; and return a bool to say if a deferred split was unqueued,\nwhich can then be used in WARN_ON_ONCEs around safety checks (sparing\ncallers the arcane conditionals in __folio_unqueue_deferred_split()).\n\nJust omit the folio_unqueue_deferred_split() from free_unref_folios(), all\nof whose callers now call it beforehand (and if any forget then bad_page()\nwill tell) - except for its caller put_pages_list(), which itself no\nlonger has any callers (and will be deleted separately).\n\nSwapout: mem_cgroup_swapout() has been resetting folio-\u003ememcg_data 0\nwithout checking and unqueueing a THP folio from deferred split list;\nwhich is unfortunate, since the split_queue_lock depends on the memcg\n(when memcg is enabled); so swapout has been unqueueing such THPs later,\nwhen freeing the folio, using the pgdat's lock instead: potentially\ncorrupting the memcg's list.  __remove_mapping() has frozen refcount to 0\nhere, so no problem with calling folio_unqueue_deferred_split() before\nresetting memcg_data.\n\nThat goes back to 5.4 commit 87eaceb3faa5 (\"mm: thp: make deferred split\nshrinker memcg aware\"): which included a check on swapcache before adding\nto deferred queue, but no check on deferred queue before adding THP to\nswapcache.  That worked fine with the usual sequence of events in reclaim\n(though there were a couple of rare ways in which a THP on deferred queue\ncould have been swapped out), but 6.12 commit dafff3f4c850 (\"mm: split\nunderused THPs\") avoids splitting underused THPs in reclaim, which makes\nswapcache THPs on deferred queue commonplace.\n\nKeep the check on swapcache before adding to deferred queue?  Yes: it is\nno longer essential, but preserves the existing behaviour, and is likely\nto be a worthwhile optimization (vmstat showed much more traffic on the\nqueue under swapping load if the check was removed); update its comment.\n\nMemcg-v1 move (deprecated): mem_cgroup_move_account() has been changing\nfolio-\u003ememcg_data without checking and unqueueing a THP folio from the\ndeferred list, sometimes corrupting \"from\" memcg's list, like swapout. \nRefcount is non-zero here, so folio_unqueue_deferred_split() can only be\nused in a WARN_ON_ONCE to validate the fix, which must be done earlier:\nmem_cgroup_move_charge_pte_range() first try to split the THP (splitting\nof course unqueues), or skip it if that fails.  Not ideal, but moving\ncharge has been requested, and khugepaged should repair the THP later:\nnobody wants new custom unqueueing code just for this deprecated case.\n\nThe 87eaceb3faa5 commit did have the code to move from one deferred list\nto another (but was not conscious of its unsafety while refcount non-0);\nbut that was removed by 5.6 commit fac0516b5534 (\"mm: thp: don't need care\ndeferred split queue in memcg charge move path\"), which argued that the\nexistence of a PMD mapping guarantees that the THP cannot be on a deferred\nlist.  As above, false in rare cases, and now commonly false.\n\nBackport to 6.11 should be straightforward.  Earlier backports must take\ncare that other _deferred_list fixes and dependencies are included.  There\nis not a strong case for backports, but they can fix cornercases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47d750ae-69c8-4b5e-9569-b356ddcc09f3",
      "id": "CVE-2025-21634",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: remove kernfs active break\n\nA warning was found:\n\nWARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828\nCPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G\nRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0\nRSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202\nRAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000\nRDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04\nRBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180\nR10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08\nR13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0\nFS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n kernfs_drain+0x15e/0x2f0\n __kernfs_remove+0x165/0x300\n kernfs_remove_by_name_ns+0x7b/0xc0\n cgroup_rm_file+0x154/0x1c0\n cgroup_addrm_files+0x1c2/0x1f0\n css_clear_dir+0x77/0x110\n kill_css+0x4c/0x1b0\n cgroup_destroy_locked+0x194/0x380\n cgroup_rmdir+0x2a/0x140\n\nIt can be explained by:\nrmdir \t\t\t\techo 1 \u003e cpuset.cpus\n\t\t\t\tkernfs_fop_write_iter // active=0\ncgroup_rm_file\nkernfs_remove_by_name_ns\tkernfs_get_active // active=1\n__kernfs_remove\t\t\t\t\t  // active=0x80000002\nkernfs_drain\t\t\tcpuset_write_resmask\nwait_event\n//waiting (active == 0x80000001)\n\t\t\t\tkernfs_break_active_protection\n\t\t\t\t// active = 0x80000001\n// continue\n\t\t\t\tkernfs_unbreak_active_protection\n\t\t\t\t// active = 0x80000002\n...\nkernfs_should_drain_open_files\n// warning occurs\n\t\t\t\tkernfs_put_active\n\nThis warning is caused by 'kernfs_break_active_protection' when it is\nwriting to cpuset.cpus, and the cgroup is removed concurrently.\n\nThe commit 3a5a6d0c2b03 (\"cpuset: don't nest cgroup_mutex inside\nget_online_cpus()\") made cpuset_hotplug_workfn asynchronous, This change\ninvolves calling flush_work(), which can create a multiple processes\ncircular locking dependency that involve cgroup_mutex, potentially leading\nto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (\"cpuset: break\nkernfs active protection in cpuset_write_resmask()\") added\n'kernfs_break_active_protection' in the cpuset_write_resmask. This could\nlead to this warning.\n\nAfter the commit 2125c0034c5d (\"cgroup/cpuset: Make cpuset hotplug\nprocessing synchronous\"), the cpuset_write_resmask no longer needs to\nwait the hotplug to finish, which means that concurrent hotplug and cpuset\noperations are no longer possible. Therefore, the deadlock doesn't exist\nanymore and it does not have to 'break active protection' now. To fix this\nwarning, just remove kernfs_break_active_protection operation in the\n'cpuset_write_resmask'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e057244e-2107-4d2f-8e2c-8ca7dbac7ab5",
      "id": "CVE-2025-21653",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute\n\nsyzbot found that TCA_FLOW_RSHIFT attribute was not validated.\nRight shitfing a 32bit integer is undefined for large shift values.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23\nshift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int')\nCPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: ipv6_addrconf addrconf_dad_work\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:231 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468\n  flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329\n  tc_classify include/net/tc_wrapper.h:197 [inline]\n  __tcf_classify net/sched/cls_api.c:1771 [inline]\n  tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867\n  sfb_classify net/sched/sch_sfb.c:260 [inline]\n  sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318\n  dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793\n  __dev_xmit_skb net/core/dev.c:3889 [inline]\n  __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400\n  dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n  neigh_hh_output include/net/neighbour.h:523 [inline]\n  neigh_output include/net/neighbour.h:537 [inline]\n  ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236\n  iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82\n  udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173\n  geneve_xmit_skb drivers/net/geneve.c:916 [inline]\n  geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039\n  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n  xmit_one net/core/dev.c:3590 [inline]\n  dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606\n  __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1106a07e-54ef-46bf-9a36-5f7c6a73cfcc",
      "id": "CVE-2025-21708",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: enable basic endpoint checking\n\nSyzkaller reports [1] encountering a common issue of utilizing a wrong\nusb endpoint type during URB submitting stage. This, in turn, triggers\na warning shown below.\n\nFor now, enable simple endpoint checking (specifically, bulk and\ninterrupt eps, testing control one is not essential) to mitigate\nthe issue with a view to do other related cosmetic changes later,\nif they are necessary.\n\n[1] Syzkaller report:\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv\u003e\nModules linked in:\nCPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617\u003e\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\nCode: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8\u003e\nRSP: 0018:ffffc9000441f740 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9\nRDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001\nRBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c\nFS:  00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733\n __dev_open+0x2d4/0x4e0 net/core/dev.c:1474\n __dev_change_flags+0x561/0x720 net/core/dev.c:8838\n dev_change_flags+0x8f/0x160 net/core/dev.c:8910\n devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177\n inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003\n sock_do_ioctl+0x116/0x280 net/socket.c:1222\n sock_ioctl+0x22e/0x6c0 net/socket.c:1341\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl fs/ioctl.c:893 [inline]\n __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fc04ef73d49\n...\n\nThis change has not been tested on real hardware.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7635e75e-aa1d-4217-9c1d-450795d954b9",
      "id": "CVE-2025-22045",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix flush_tlb_range() when used for zapping normal PMDs\n\nOn the following path, flush_tlb_range() can be used for zapping normal\nPMD entries (PMD entries that point to page tables) together with the PTE\nentries in the pointed-to page table:\n\n    collapse_pte_mapped_thp\n      pmdp_collapse_flush\n        flush_tlb_range\n\nThe arm64 version of flush_tlb_range() has a comment describing that it can\nbe used for page table removal, and does not use any last-level\ninvalidation optimizations. Fix the X86 version by making it behave the\nsame way.\n\nCurrently, X86 only uses this information for the following two purposes,\nwhich I think means the issue doesn't have much impact:\n\n - In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be\n   IPI'd to avoid issues with speculative page table walks.\n - In Hyper-V TLB paravirtualization, again for lazy TLB stuff.\n\nThe patch \"x86/mm: only invalidate final translations with INVLPGB\" which\nis currently under review (see\n\u003chttps://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/\u003e)\nwould probably be making the impact of this a lot worse.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af985a60-b512-4345-bca8-b89831fe0739",
      "id": "CVE-2025-37792",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btrtl: Prevent potential NULL dereference\n\nThe btrtl_initialize() function checks that rtl_load_file() either\nhad an error or it loaded a zero length file.  However, if it loaded\na zero length file then the error code is not set correctly.  It\nresults in an error pointer vs NULL bug, followed by a NULL pointer\ndereference.  This was detected by Smatch:\n\ndrivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08c8cf2b-a9d3-4220-8026-574b90fbe608",
      "id": "CVE-2025-38068",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lzo - Fix compression buffer overrun\n\nUnlike the decompression code, the compression code in LZO never\nchecked for output overruns.  It instead assumes that the caller\nalways provides enough buffer space, disregarding the buffer length\nprovided by the caller.\n\nAdd a safe compression interface that checks for the end of buffer\nbefore each write.  Use the safe interface in crypto/lzo.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d005eb8-efdc-4ca1-a713-64d704ed14c7",
      "id": "CVE-2025-38602",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niwlwifi: Add missing check for alloc_ordered_workqueue\n\nAdd check for the return value of alloc_ordered_workqueue since it may\nreturn NULL pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bea112b9-4019-4bc7-b1f7-815708d35348",
      "id": "CVE-2021-3659",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4116104-fc4b-45bc-ad1a-439d277bb909",
      "id": "CVE-2021-47547",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tulip: de4x5: fix the problem that the array 'lp-\u003ephy[8]' may be out of bound\n\nIn line 5001, if all id in the array 'lp-\u003ephy[8]' is not 0, when the\n'for' end, the 'k' is 8.\n\nAt this time, the array 'lp-\u003ephy[8]' may be out of bound.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8328c1db-dea5-482e-bb43-e3951c2bb5f5",
      "id": "CVE-2022-0487",
      "description": "A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3b9c42b-3387-41db-abf8-d573ccbfece2",
      "id": "CVE-2022-29968",
      "description": "An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb-\u003eprivate.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9333009-7f00-4a46-ac7d-bd953e879baa",
      "id": "CVE-2022-3543",
      "description": "A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf896f4c-1b95-465d-bf7a-92c4054484b9",
      "id": "CVE-2022-47929",
      "description": "In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with \"tc qdisc\" and \"tc class\" commands. This affects qdisc_graft in net/sched/sch_api.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41034ec0-e05a-44c4-b2f9-8eeb17c2604f",
      "id": "CVE-2022-49289",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuaccess: fix integer overflow on access_ok()\n\nThree architectures check the end of a user access against the\naddress limit without taking a possible overflow into account.\nPassing a negative length or another overflow in here returns\nsuccess when it should not.\n\nUse the most common correct implementation here, which optimizes\nfor a constant 'size' argument, and turns the common case into a\nsingle comparison.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56ede30f-eb0e-4185-8b08-4a39434f1a8c",
      "id": "CVE-2022-49716",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nWhen kcalloc fails, it missing of_node_put() and results in refcount\nleak. Fix this by goto out_put_node label.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02d90241-dc2f-45d1-a9ff-2349b8b8d979",
      "id": "CVE-2022-50149",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential deadlock in __driver_attach\n\nIn __driver_attach function, There are also AA deadlock problem,\nlike the commit b232b02bf3c2 (\"driver core: fix deadlock in\n__device_attach\").\n\nstack like commit b232b02bf3c2 (\"driver core: fix deadlock in\n__device_attach\").\nlist below:\n    In __driver_attach function, The lock holding logic is as follows:\n    ...\n    __driver_attach\n    if (driver_allows_async_probing(drv))\n      device_lock(dev)      // get lock dev\n        async_schedule_dev(__driver_attach_async_helper, dev); // func\n          async_schedule_node\n            async_schedule_node_domain(func)\n              entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC);\n              /* when fail or work limit, sync to execute func, but\n                 __driver_attach_async_helper will get lock dev as\n                 will, which will lead to A-A deadlock.  */\n              if (!entry || atomic_read(\u0026entry_count) \u003e MAX_WORK) {\n                func;\n              else\n                queue_work_node(node, system_unbound_wq, \u0026entry-\u003ework)\n      device_unlock(dev)\n\n    As above show, when it is allowed to do async probes, because of\n    out of memory or work limit, async work is not be allowed, to do\n    sync execute instead. it will lead to A-A deadlock because of\n    __driver_attach_async_helper getting lock dev.\n\nReproduce:\nand it can be reproduce by make the condition\n(if (!entry || atomic_read(\u0026entry_count) \u003e MAX_WORK)) untenable, like\nbelow:\n\n[  370.785650] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables\nthis message.\n[  370.787154] task:swapper/0       state:D stack:    0 pid:    1 ppid:\n0 flags:0x00004000\n[  370.788865] Call Trace:\n[  370.789374]  \u003cTASK\u003e\n[  370.789841]  __schedule+0x482/0x1050\n[  370.790613]  schedule+0x92/0x1a0\n[  370.791290]  schedule_preempt_disabled+0x2c/0x50\n[  370.792256]  __mutex_lock.isra.0+0x757/0xec0\n[  370.793158]  __mutex_lock_slowpath+0x1f/0x30\n[  370.794079]  mutex_lock+0x50/0x60\n[  370.794795]  __device_driver_lock+0x2f/0x70\n[  370.795677]  ? driver_probe_device+0xd0/0xd0\n[  370.796576]  __driver_attach_async_helper+0x1d/0xd0\n[  370.797318]  ? driver_probe_device+0xd0/0xd0\n[  370.797957]  async_schedule_node_domain+0xa5/0xc0\n[  370.798652]  async_schedule_node+0x19/0x30\n[  370.799243]  __driver_attach+0x246/0x290\n[  370.799828]  ? driver_allows_async_probing+0xa0/0xa0\n[  370.800548]  bus_for_each_dev+0x9d/0x130\n[  370.801132]  driver_attach+0x22/0x30\n[  370.801666]  bus_add_driver+0x290/0x340\n[  370.802246]  driver_register+0x88/0x140\n[  370.802817]  ? virtio_scsi_init+0x116/0x116\n[  370.803425]  scsi_register_driver+0x1a/0x30\n[  370.804057]  init_sd+0x184/0x226\n[  370.804533]  do_one_initcall+0x71/0x3a0\n[  370.805107]  kernel_init_freeable+0x39a/0x43a\n[  370.805759]  ? rest_init+0x150/0x150\n[  370.806283]  kernel_init+0x26/0x230\n[  370.806799]  ret_from_fork+0x1f/0x30\n\nTo fix the deadlock, move the async_schedule_dev outside device_lock,\nas we can see, in async_schedule_node_domain, the parameter of\nqueue_work_node is system_unbound_wq, so it can accept concurrent\noperations. which will also not change the code logic, and will\nnot lead to deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bd1a9ae-9d3e-4b05-9c6d-186df1d5cbfe",
      "id": "CVE-2022-50389",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak\n\nIn crb_acpi_add(), we get the TPM2 table to retrieve information\nlike start method, and then assign them to the priv data, so the\nTPM2 table is not used after the init, should be freed, call\nacpi_put_table() to fix the memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0d236d5-62b3-4819-8555-7e0cb7e02390",
      "id": "CVE-2023-52462",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix check for attempt to corrupt spilled pointer\n\nWhen register is spilled onto a stack as a 1/2/4-byte register, we set\nslot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,\ndepending on actual spill size). So to check if some stack slot has\nspilled register we need to consult slot_type[7], not slot_type[0].\n\nTo avoid the need to remember and double-check this in the future, just\nuse is_spilled_reg() helper.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "50660a25-a016-466c-96d1-c031fd3ea9cc",
      "id": "CVE-2023-53138",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: caif: Fix use-after-free in cfusbl_device_notify()\n\nsyzbot reported use-after-free in cfusbl_device_notify() [1].  This\ncauses a stack trace like below:\n\nBUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138\nRead of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214\n\nCPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: netns cleanup_net\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313\n print_report mm/kasan/report.c:429 [inline]\n kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491\n cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138\n notifier_call_chain+0xb5/0x200 kernel/notifier.c:87\n call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945\n call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]\n call_netdevice_notifiers net/core/dev.c:1997 [inline]\n netdev_wait_allrefs_any net/core/dev.c:10227 [inline]\n netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341\n default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334\n ops_exit_list+0x125/0x170 net/core/net_namespace.c:167\n cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594\n process_one_work+0x996/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e9/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302\n \u003c/TASK\u003e\n\nWhen unregistering a net device, unregister_netdevice_many_notify()\nsets the device's reg_state to NETREG_UNREGISTERING, calls notifiers\nwith NETDEV_UNREGISTER, and adds the device to the todo list.\n\nLater on, devices in the todo list are processed by netdev_run_todo().\nnetdev_run_todo() waits devices' reference count become 1 while\nrebdoadcasting NETDEV_UNREGISTER notification.\n\nWhen cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple\ntimes, the parent device might be freed.  This could cause UAF.\nProcessing NETDEV_UNREGISTER multiple times also causes inbalance of\nreference count for the module.\n\nThis patch fixes the issue by accepting only first NETDEV_UNREGISTER\nnotification.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "219d4d76-6567-4adc-952c-094e62ede4b3",
      "id": "CVE-2023-53344",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write\n\nSyzkaller reported the following issue:\n\n=====================================================\nBUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline]\nBUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600\n aio_rw_done fs/aio.c:1520 [inline]\n aio_write+0x899/0x950 fs/aio.c:1600\n io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019\n __do_sys_io_submit fs/aio.c:2078 [inline]\n __se_sys_io_submit+0x293/0x770 fs/aio.c:2048\n __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:766 [inline]\n slab_alloc_node mm/slub.c:3452 [inline]\n __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491\n __do_kmalloc_node mm/slab_common.c:967 [inline]\n __kmalloc+0x11d/0x3b0 mm/slab_common.c:981\n kmalloc_array include/linux/slab.h:636 [inline]\n bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930\n bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n sock_write_iter+0x495/0x5e0 net/socket.c:1108\n call_write_iter include/linux/fs.h:2189 [inline]\n aio_write+0x63a/0x950 fs/aio.c:1600\n io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019\n __do_sys_io_submit fs/aio.c:2078 [inline]\n __se_sys_io_submit+0x293/0x770 fs/aio.c:2048\n __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nCPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023\n=====================================================\n\nWe can follow the call chain and find that 'bcm_tx_setup' function\ncalls 'memcpy_from_msg' to copy some content to the newly allocated\nframe of 'op-\u003eframes'. After that the 'len' field of copied structure\nbeing compared with some constant value (64 or 8). However, if\n'memcpy_from_msg' returns an error, we will compare some uninitialized\nmemory. This triggers 'uninit-value' issue.\n\nThis patch will add 'memcpy_from_msg' possible errors processing to\navoid uninit-value issue.\n\nTested via syzkaller",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1bb2c285-beca-4946-a6ef-b0ffdf28f1c6",
      "id": "CVE-2024-41087",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: Fix double free on error\n\nIf e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump\nto the err_out label, which will call devres_release_group().\ndevres_release_group() will trigger a call to ata_host_release().\nata_host_release() calls kfree(host), so executing the kfree(host) in\nata_host_alloc() will lead to a double free:\n\nkernel BUG at mm/slub.c:553!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 11 PID: 599 Comm: (udev-worker) Not tainted 6.10.0-rc5 #47\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:kfree+0x2cf/0x2f0\nCode: 5d 41 5e 41 5f 5d e9 80 d6 ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da\nRSP: 0018:ffffc90000f377f0 EFLAGS: 00010246\nRAX: ffff888112b1f2c0 RBX: ffff888112b1f2c0 RCX: ffff888112b1f320\nRDX: 000000000000400b RSI: ffffffffc02c9de5 RDI: ffff888112b1f2c0\nRBP: ffffc90000f37830 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffc90000f37610 R11: 617461203a736b6e R12: ffffea00044ac780\nR13: ffff888100046400 R14: ffffffffc02c9de5 R15: 0000000000000006\nFS:  00007f2f1cabe980(0000) GS:ffff88813b380000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f2f1c3acf75 CR3: 0000000111724000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die_body.cold+0x19/0x27\n ? die+0x2e/0x50\n ? do_trap+0xca/0x110\n ? do_error_trap+0x6a/0x90\n ? kfree+0x2cf/0x2f0\n ? exc_invalid_op+0x50/0x70\n ? kfree+0x2cf/0x2f0\n ? asm_exc_invalid_op+0x1a/0x20\n ? ata_host_alloc+0xf5/0x120 [libata]\n ? ata_host_alloc+0xf5/0x120 [libata]\n ? kfree+0x2cf/0x2f0\n ata_host_alloc+0xf5/0x120 [libata]\n ata_host_alloc_pinfo+0x14/0xa0 [libata]\n ahci_init_one+0x6c9/0xd20 [ahci]\n\nEnsure that we will not call kfree(host) twice, by performing the kfree()\nonly if the devres_open_group() call failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "349e26f3-ea77-4107-8a0e-9bb50a96b249",
      "id": "CVE-2024-42083",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: fix kernel panic due to multi-buffer handling\n\nCurrently, the ionic_run_xdp() doesn't handle multi-buffer packets\nproperly for XDP_TX and XDP_REDIRECT.\nWhen a jumbo frame is received, the ionic_run_xdp() first makes xdp\nframe with all necessary pages in the rx descriptor.\nAnd if the action is either XDP_TX or XDP_REDIRECT, it should unmap\ndma-mapping and reset page pointer to NULL for all pages, not only the\nfirst page.\nBut it doesn't for SG pages. So, SG pages unexpectedly will be reused.\nIt eventually causes kernel panic.\n\nOops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25\nRIP: 0010:xdp_return_frame+0x42/0x90\nCode: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd \u003c41\u003e 80 7d0\nRSP: 0018:ffff99d00122ce08 EFLAGS: 00010202\nRAX: 0000000000005453 RBX: ffff8d325f904000 RCX: 0000000000000001\nRDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f4e4d4c4b4a49\nRBP: ffff99d003907740 R08: 0000000000000000 R09: 0000000000000000\nR10: 000000011f90d000 R11: 0000000000000000 R12: ffff8d325f904010\nR13: 504f4e4dbebc64fd R14: ffff8d3242b070c8 R15: ffff99d0039077c0\nFS:  0000000000000000(0000) GS:ffff8d399f780000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f41f6c85e38 CR3: 000000037ac30000 CR4: 00000000007506f0\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? die_addr+0x33/0x90\n ? exc_general_protection+0x251/0x2f0\n ? asm_exc_general_protection+0x22/0x30\n ? xdp_return_frame+0x42/0x90\n ionic_tx_clean+0x211/0x280 [ionic 15881354510e6a9c655c59c54812b319ed2cd015]\n ionic_tx_cq_service+0xd3/0x210 [ionic 15881354510e6a9c655c59c54812b319ed2cd015]\n ionic_txrx_napi+0x41/0x1b0 [ionic 15881354510e6a9c655c59c54812b319ed2cd015]\n __napi_poll.constprop.0+0x29/0x1b0\n net_rx_action+0x2c4/0x350\n handle_softirqs+0xf4/0x320\n irq_exit_rcu+0x78/0xa0\n common_interrupt+0x77/0x90",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f936a90-0f6a-4521-97ef-6a6db4f07ee7",
      "id": "CVE-2024-50033",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: make slhc_remember() more robust against malicious packets\n\nsyzbot found that slhc_remember() was missing checks against\nmalicious packets [1].\n\nslhc_remember() only checked the size of the packet was at least 20,\nwhich is not good enough.\n\nWe need to make sure the packet includes the IPv4 and TCP header\nthat are supposed to be carried.\n\nAdd iph and th pointers to make the code more readable.\n\n[1]\n\nBUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n  slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n  ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455\n  ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]\n  ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212\n  ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327\n  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n  __release_sock+0x1da/0x330 net/core/sock.c:3072\n  release_sock+0x6b/0x250 net/core/sock.c:3626\n  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4091 [inline]\n  slab_alloc_node mm/slub.c:4134 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1322 [inline]\n  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "030df7b3-9cdb-4b3b-adb5-d05d4ddfa474",
      "id": "CVE-2024-50194",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: probes: Fix uprobes for big-endian kernels\n\nThe arm64 uprobes code is broken for big-endian kernels as it doesn't\nconvert the in-memory instruction encoding (which is always\nlittle-endian) into the kernel's native endianness before analyzing and\nsimulating instructions. This may result in a few distinct problems:\n\n* The kernel may may erroneously reject probing an instruction which can\n  safely be probed.\n\n* The kernel may erroneously erroneously permit stepping an\n  instruction out-of-line when that instruction cannot be stepped\n  out-of-line safely.\n\n* The kernel may erroneously simulate instruction incorrectly dur to\n  interpretting the byte-swapped encoding.\n\nThe endianness mismatch isn't caught by the compiler or sparse because:\n\n* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so\n  the compiler and sparse have no idea these contain a little-endian\n  32-bit value. The core uprobes code populates these with a memcpy()\n  which similarly does not handle endianness.\n\n* While the uprobe_opcode_t type is an alias for __le32, both\n  arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() cast from u8[]\n  to the similarly-named probe_opcode_t, which is an alias for u32.\n  Hence there is no endianness conversion warning.\n\nFix this by changing the arch_uprobe::{insn,ixol} fields to __le32 and\nadding the appropriate __le32_to_cpu() conversions prior to consuming\nthe instruction encoding. The core uprobes copies these fields as opaque\nranges of bytes, and so is unaffected by this change.\n\nAt the same time, remove MAX_UINSN_BYTES and consistently use\nAARCH64_INSN_SIZE for clarity.\n\nTested with the following:\n\n| #include \u003cstdio.h\u003e\n| #include \u003cstdbool.h\u003e\n|\n| #define noinline __attribute__((noinline))\n|\n| static noinline void *adrp_self(void)\n| {\n|         void *addr;\n|\n|         asm volatile(\n|         \"       adrp    %x0, adrp_self\\n\"\n|         \"       add     %x0, %x0, :lo12:adrp_self\\n\"\n|         : \"=r\" (addr));\n| }\n|\n|\n| int main(int argc, char *argv)\n| {\n|         void *ptr = adrp_self();\n|         bool equal = (ptr == adrp_self);\n|\n|         printf(\"adrp_self   =\u003e %p\\n\"\n|                \"adrp_self() =\u003e %p\\n\"\n|                \"%s\\n\",\n|                adrp_self, ptr, equal ? \"EQUAL\" : \"NOT EQUAL\");\n|\n|         return 0;\n| }\n\n.... where the adrp_self() function was compiled to:\n\n| 00000000004007e0 \u003cadrp_self\u003e:\n|   4007e0:       90000000        adrp    x0, 400000 \u003c__ehdr_start\u003e\n|   4007e4:       911f8000        add     x0, x0, #0x7e0\n|   4007e8:       d65f03c0        ret\n\nBefore this patch, the ADRP is not recognized, and is assumed to be\nsteppable, resulting in corruption of the result:\n\n| # ./adrp-self\n| adrp_self   =\u003e 0x4007e0\n| adrp_self() =\u003e 0x4007e0\n| EQUAL\n| # echo 'p /root/adrp-self:0x007e0' \u003e /sys/kernel/tracing/uprobe_events\n| # echo 1 \u003e /sys/kernel/tracing/events/uprobes/enable\n| # ./adrp-self\n| adrp_self   =\u003e 0x4007e0\n| adrp_self() =\u003e 0xffffffffff7e0\n| NOT EQUAL\n\nAfter this patch, the ADRP is correctly recognized and simulated:\n\n| # ./adrp-self\n| adrp_self   =\u003e 0x4007e0\n| adrp_self() =\u003e 0x4007e0\n| EQUAL\n| #\n| # echo 'p /root/adrp-self:0x007e0' \u003e /sys/kernel/tracing/uprobe_events\n| # echo 1 \u003e /sys/kernel/tracing/events/uprobes/enable\n| # ./adrp-self\n| adrp_self   =\u003e 0x4007e0\n| adrp_self() =\u003e 0x4007e0\n| EQUAL",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35ab8873-5b6c-4bbc-9414-a26246874c8a",
      "id": "CVE-2024-50248",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: Add bounds checking to mi_enum_attr()\n\nAdded bounds checking to make sure that every attr don't stray beyond\nvalid memory region.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc1bdcef-c855-427a-b191-4b6273880d38",
      "id": "CVE-2024-53051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in intel_hdcp_get_capability\n\nSometimes during hotplug scenario or suspend/resume scenario encoder is\nnot always initialized when intel_hdcp_get_capability add\na check to avoid kernel null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59e4393d-4b23-47bf-83a2-080314d91add",
      "id": "CVE-2024-56775",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix handling of plane refcount\n\n[Why]\nThe mechanism to backup and restore plane states doesn't maintain\nrefcount, which can cause issues if the refcount of the plane changes\nin between backup and restore operations, such as memory leaks if the\nrefcount was supposed to go down, or double frees / invalid memory\naccesses if the refcount was supposed to go up.\n\n[How]\nCache and re-apply current refcount when restoring plane states.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4428ad63-07fd-4be9-a5f4-410d90f79e51",
      "id": "CVE-2025-21779",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel\n\nAdvertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and\nonly if the local API is emulated/virtualized by KVM, and explicitly reject\nsaid hypercalls if the local APIC is emulated in userspace, i.e. don't rely\non userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.\n\nRejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if\nHyper-V enlightenments are exposed to the guest without an in-kernel local\nAPIC:\n\n  dump_stack+0xbe/0xfd\n  __kasan_report.cold+0x34/0x84\n  kasan_report+0x3a/0x50\n  __apic_accept_irq+0x3a/0x5c0\n  kvm_hv_send_ipi.isra.0+0x34e/0x820\n  kvm_hv_hypercall+0x8d9/0x9d0\n  kvm_emulate_hypercall+0x506/0x7e0\n  __vmx_handle_exit+0x283/0xb60\n  vmx_handle_exit+0x1d/0xd0\n  vcpu_enter_guest+0x16b0/0x24c0\n  vcpu_run+0xc0/0x550\n  kvm_arch_vcpu_ioctl_run+0x170/0x6d0\n  kvm_vcpu_ioctl+0x413/0xb20\n  __se_sys_ioctl+0x111/0x160\n  do_syscal1_64+0x30/0x40\n  entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nNote, checking the sending vCPU is sufficient, as the per-VM irqchip_mode\ncan't be modified after vCPUs are created, i.e. if one vCPU has an\nin-kernel local APIC, then all vCPUs have an in-kernel local APIC.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b09a60a1-aea9-4d14-aa49-26db499996db",
      "id": "CVE-2025-22010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup during bt pages loop\n\nDriver runs a for-loop when allocating bt pages and mapping them with\nbuffer pages. When a large buffer (e.g. MR over 100GB) is being allocated,\nit may require a considerable loop count. This will lead to soft lockup:\n\n        watchdog: BUG: soft lockup - CPU#27 stuck for 22s!\n        ...\n        Call trace:\n         hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]\n         hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]\n         hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]\n         alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]\n         hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]\n         ib_uverbs_reg_mr+0x118/0x290\n\n        watchdog: BUG: soft lockup - CPU#35 stuck for 23s!\n        ...\n        Call trace:\n         hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]\n         mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]\n         hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]\n         alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]\n         hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]\n         ib_uverbs_reg_mr+0x120/0x2bc\n\nAdd a cond_resched() to fix soft lockup during these loops. In order not\nto affect the allocation performance of normal-size buffer, set the loop\ncount of a 100GB MR as the threshold to call cond_resched().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5738505a-cfee-4a07-a629-ab4c1547bfc7",
      "id": "CVE-2020-14155",
      "description": "libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "c43fa28f-30c7-4d57-a921-512f4c41c620",
      "id": "CVE-2021-47399",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup\n\nThe ixgbe driver currently generates a NULL pointer dereference with\nsome machine (online cpus \u003c 63). This is due to the fact that the\nmaximum value of num_xdp_queues is nr_cpu_ids. Code is in\n\"ixgbe_set_rss_queues\"\".\n\nHere's how the problem repeats itself:\nSome machine (online cpus \u003c 63), And user set num_queues to 63 through\nethtool. Code is in the \"ixgbe_set_channels\",\n\tadapter-\u003ering_feature[RING_F_FDIR].limit = count;\n\nIt becomes 63.\n\nWhen user use xdp, \"ixgbe_set_rss_queues\" will set queues num.\n\tadapter-\u003enum_rx_queues = rss_i;\n\tadapter-\u003enum_tx_queues = rss_i;\n\tadapter-\u003enum_xdp_queues = ixgbe_xdp_queues(adapter);\n\nAnd rss_i's value is from\n\tf = \u0026adapter-\u003ering_feature[RING_F_FDIR];\n\trss_i = f-\u003eindices = f-\u003elimit;\n\nSo \"num_rx_queues\" \u003e \"num_xdp_queues\", when run to \"ixgbe_xdp_setup\",\n\tfor (i = 0; i \u003c adapter-\u003enum_rx_queues; i++)\n\t\tif (adapter-\u003exdp_ring[i]-\u003exsk_umem)\n\nIt leads to panic.\n\nCall trace:\n[exception RIP: ixgbe_xdp+368]\nRIP: ffffffffc02a76a0  RSP: ffff9fe16202f8d0  RFLAGS: 00010297\nRAX: 0000000000000000  RBX: 0000000000000020  RCX: 0000000000000000\nRDX: 0000000000000000  RSI: 000000000000001c  RDI: ffffffffa94ead90\nRBP: ffff92f8f24c0c18   R8: 0000000000000000   R9: 0000000000000000\nR10: ffff9fe16202f830  R11: 0000000000000000  R12: ffff92f8f24c0000\nR13: ffff9fe16202fc01  R14: 000000000000000a  R15: ffffffffc02a7530\nORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc\n 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808\n 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235\n10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384\n11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd\n12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb\n13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88\n14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319\n15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290\n16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8\n17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64\n18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9\n19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c\n\nSo I fix ixgbe_max_channels so that it will not allow a setting of queues\nto be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup,\ntake the smaller value of num_rx_queues and num_xdp_queues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95a1432c-bfd0-4abd-92db-4048d85597d5",
      "id": "CVE-2024-43899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null pointer deref in dcn20_resource.c\n\nFixes a hang thats triggered when MPV is run on a DCN401 dGPU:\n\nmpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all\n\nand then enabling fullscreen playback (double click on the video)\n\nThe following calltrace will be seen:\n\n[  181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[  181.843997] #PF: supervisor instruction fetch in kernel mode\n[  181.844003] #PF: error_code(0x0010) - not-present page\n[  181.844009] PGD 0 P4D 0\n[  181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI\n[  181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\n[  181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018\n[  181.844044] RIP: 0010:0x0\n[  181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[  181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246\n[  181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004\n[  181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400\n[  181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c\n[  181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8\n[  181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005\n[  181.844121] FS:  00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000\n[  181.844128] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0\n[  181.844141] Call Trace:\n[  181.844146]  \u003cTASK\u003e\n[  181.844153]  ? show_regs+0x6d/0x80\n[  181.844167]  ? __die+0x24/0x80\n[  181.844179]  ? page_fault_oops+0x99/0x1b0\n[  181.844192]  ? do_user_addr_fault+0x31d/0x6b0\n[  181.844204]  ? exc_page_fault+0x83/0x1b0\n[  181.844216]  ? asm_exc_page_fault+0x27/0x30\n[  181.844237]  dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu]\n[  181.845115]  amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu]\n[  181.845985]  amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu]\n[  181.846848]  fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu]\n[  181.847734]  fill_dc_plane_attributes+0x162/0x350 [amdgpu]\n[  181.848748]  dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]\n[  181.849791]  ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]\n[  181.850840]  amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74737b27-6650-40dd-b64a-55776017930a",
      "id": "CVE-2015-2325",
      "description": "The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "995a51ae-b657-4ac5-b383-9676f9b897c8",
      "id": "CVE-2022-48823",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Fix refcount issue when LOGO is received during TMF\n\nHung task call trace was seen during LOGO processing.\n\n[  974.309060] [0000:00:00.0]:[qedf_eh_device_reset:868]: 1:0:2:0: LUN RESET Issued...\n[  974.309065] [0000:00:00.0]:[qedf_initiate_tmf:2422]: tm_flags 0x10 sc_cmd 00000000c16b930f op = 0x2a target_id = 0x2 lun=0\n[  974.309178] [0000:00:00.0]:[qedf_initiate_tmf:2431]: portid=016900 tm_flags =LUN RESET\n[  974.309222] [0000:00:00.0]:[qedf_initiate_tmf:2438]: orig io_req = 00000000ec78df8f xid = 0x180 ref_cnt = 1.\n[  974.309625] host1: rport 016900: Received LOGO request while in state Ready\n[  974.309627] host1: rport 016900: Delete port\n[  974.309642] host1: rport 016900: work event 3\n[  974.309644] host1: rport 016900: lld callback ev 3\n[  974.313243] [0000:61:00.2]:[qedf_execute_tmf:2383]:1: fcport is uploading, not executing flush.\n[  974.313295] [0000:61:00.2]:[qedf_execute_tmf:2400]:1: task mgmt command success...\n[  984.031088] INFO: task jbd2/dm-15-8:7645 blocked for more than 120 seconds.\n[  984.031136]       Not tainted 4.18.0-305.el8.x86_64 #1\n\n[  984.031166] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[  984.031209] jbd2/dm-15-8    D    0  7645      2 0x80004080\n[  984.031212] Call Trace:\n[  984.031222]  __schedule+0x2c4/0x700\n[  984.031230]  ? unfreeze_partials.isra.83+0x16e/0x1a0\n[  984.031233]  ? bit_wait_timeout+0x90/0x90\n[  984.031235]  schedule+0x38/0xa0\n[  984.031238]  io_schedule+0x12/0x40\n[  984.031240]  bit_wait_io+0xd/0x50\n[  984.031243]  __wait_on_bit+0x6c/0x80\n[  984.031248]  ? free_buffer_head+0x21/0x50\n[  984.031251]  out_of_line_wait_on_bit+0x91/0xb0\n[  984.031257]  ? init_wait_var_entry+0x50/0x50\n[  984.031268]  jbd2_journal_commit_transaction+0x112e/0x19f0 [jbd2]\n[  984.031280]  kjournald2+0xbd/0x270 [jbd2]\n[  984.031284]  ? finish_wait+0x80/0x80\n[  984.031291]  ? commit_timeout+0x10/0x10 [jbd2]\n[  984.031294]  kthread+0x116/0x130\n[  984.031300]  ? kthread_flush_work_fn+0x10/0x10\n[  984.031305]  ret_from_fork+0x1f/0x40\n\nThere was a ref count issue when LOGO is received during TMF. This leads to\none of the I/Os hanging with the driver. Fix the ref count.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "898db5da-dd78-4c83-89b1-d828398f0760",
      "id": "CVE-2015-2326",
      "description": "The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by \"((?+1)(\\1))/\".",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "76a5f037-a379-4dd2-847e-17bcaf1c25d6",
      "id": "CVE-2019-20838",
      "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "29d66bdd-8197-492b-bce7-2fe2205da7c8",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "041782fd-db5b-4f84-88dc-4bc601b5270a"
        }
      ]
    },
    {
      "bom-ref": "961b4c43-a0b7-4392-90ff-b06ed4d36326",
      "id": "CVE-2014-8964",
      "description": "Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "16a48245-1b83-4dbc-a3d1-ef110f62cd06",
      "id": "CVE-2015-2328",
      "description": "PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "84a16a29-95d7-406d-8569-02387cb7f0a6",
      "id": "CVE-2015-3217",
      "description": "PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "2caffcc1-4f2c-4293-a13d-6bc645f148e4",
      "id": "CVE-2015-5073",
      "description": "Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "b4d16620-47fa-4b1d-a081-7c6ebf223620",
      "id": "CVE-2015-8391",
      "description": "The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "8993a3dc-6208-4a3a-9d3b-b23eabc3ba0e",
      "id": "CVE-2016-3191",
      "description": "The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "97931ec9-8359-4852-afb7-74d4263ad897",
      "id": "CVE-2017-6004",
      "description": "The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.",
      "affects": [
        {
          "ref": "000d8527-800f-45f1-91fb-af850cdef26d"
        }
      ]
    },
    {
      "bom-ref": "d680e8dd-779c-41e4-8356-f0266ec49c71",
      "id": "CVE-2022-22707",
      "description": "In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.",
      "affects": [
        {
          "ref": "1f390a51-ea22-45b7-9aec-a004695fed7a"
        }
      ]
    },
    {
      "bom-ref": "c79b3906-1ea7-4b2e-89be-aafcf1ec9468",
      "id": "CVE-2016-9840",
      "description": "inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "cc45b13f-f1ee-45cf-a705-dc091ba3a7b5",
      "id": "CVE-2016-9841",
      "description": "inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "06954959-ec79-42aa-bde4-930aef5b917a",
      "id": "CVE-2025-46394",
      "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",
      "affects": [
        {
          "ref": "4b51c6a6-330d-484b-80fb-457239059428"
        }
      ]
    },
    {
      "bom-ref": "84d69de8-27cf-45c3-b7b7-35d8f5f128b9",
      "id": "CVE-2016-9842",
      "description": "The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "b5c4f3f1-512e-4ea5-9879-f6cca2688d8c",
      "id": "CVE-2016-9843",
      "description": "The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "0396d00c-76b0-454a-9955-617e9db3eb5f",
      "id": "CVE-2021-45960",
      "description": "In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "c1c22749-f1ee-4827-9bf0-93cd00ac59f2",
      "id": "CVE-2018-25032",
      "description": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "8468c7c9-d291-4024-ad20-e5c4241a14ce",
      "id": "CVE-2022-37434",
      "description": "zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "85012c34-b04d-4475-9d79-477f5f35df74",
      "id": "CVE-2023-45853",
      "description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.",
      "affects": [
        {
          "ref": "2d0e5945-f58a-4244-9ce1-edb07e97607b"
        }
      ]
    },
    {
      "bom-ref": "503c61f5-cf78-4e57-a828-29b27ab0afad",
      "id": "CVE-2021-46143",
      "description": "In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "50809130-a75d-4d5d-a06c-8130ae5bb6a0",
      "id": "CVE-2022-37434",
      "description": "zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).",
      "affects": [
        {
          "ref": "2e324721-9240-4849-bf53-109c02c29de0"
        }
      ]
    },
    {
      "bom-ref": "2da70612-fb90-4a15-9d3e-1c1bac6c41f2",
      "id": "CVE-2023-45853",
      "description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.",
      "affects": [
        {
          "ref": "2e324721-9240-4849-bf53-109c02c29de0"
        }
      ]
    },
    {
      "bom-ref": "8eaaf78d-efd5-41a5-9101-bc62399baafd",
      "id": "CVE-2024-9681",
      "description": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "aed79f0f-e701-4da9-a2e1-0b4b248bbe28",
      "id": "CVE-2025-0725",
      "description": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.",
      "affects": [
        {
          "ref": "30decfaf-23a6-467a-b00c-5503fdd5773a"
        }
      ]
    },
    {
      "bom-ref": "04654944-cc48-42e3-b54b-4af64b370cdc",
      "id": "CVE-2013-0340",
      "description": "expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "a0d75f86-7b74-4163-9112-37d8e6a97e7d",
      "id": "CVE-2022-22822",
      "description": "addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "1418de92-3f5c-4996-b542-c2e03e79532e",
      "id": "CVE-2022-22823",
      "description": "build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "eca633f5-58a0-4368-9614-7ad8258e25b4",
      "id": "CVE-2022-22824",
      "description": "defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "f45ad475-c17d-44d4-9f27-e3e3b4810e2b",
      "id": "CVE-2022-22825",
      "description": "lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "f84f42de-cb75-42ae-8b2b-937c6bcdb4bf",
      "id": "CVE-2022-22826",
      "description": "nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "724ad9ab-9314-4266-92c1-d616da783ced",
      "id": "CVE-2021-47544",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix page frag corruption on page fault\n\nSteffen reported a TCP stream corruption for HTTP requests\nserved by the apache web-server using a cifs mount-point\nand memory mapping the relevant file.\n\nThe root cause is quite similar to the one addressed by\ncommit 20eb4f29b602 (\"net: fix sk_page_frag() recursion from\nmemory reclaim\"). Here the nested access to the task page frag\nis caused by a page fault on the (mmapped) user-space memory\nbuffer coming from the cifs file.\n\nThe page fault handler performs an smb transaction on a different\nsocket, inside the same process context. Since sk-\u003esk_allaction\nfor such socket does not prevent the usage for the task_frag,\nthe nested allocation modify \"under the hood\" the page frag\nin use by the outer sendmsg call, corrupting the stream.\n\nThe overall relevant stack trace looks like the following:\n\nhttpd 78268 [001] 3461630.850950:      probe:tcp_sendmsg_locked:\n        ffffffff91461d91 tcp_sendmsg_locked+0x1\n        ffffffff91462b57 tcp_sendmsg+0x27\n        ffffffff9139814e sock_sendmsg+0x3e\n        ffffffffc06dfe1d smb_send_kvec+0x28\n        [...]\n        ffffffffc06cfaf8 cifs_readpages+0x213\n        ffffffff90e83c4b read_pages+0x6b\n        ffffffff90e83f31 __do_page_cache_readahead+0x1c1\n        ffffffff90e79e98 filemap_fault+0x788\n        ffffffff90eb0458 __do_fault+0x38\n        ffffffff90eb5280 do_fault+0x1a0\n        ffffffff90eb7c84 __handle_mm_fault+0x4d4\n        ffffffff90eb8093 handle_mm_fault+0xc3\n        ffffffff90c74f6d __do_page_fault+0x1ed\n        ffffffff90c75277 do_page_fault+0x37\n        ffffffff9160111e page_fault+0x1e\n        ffffffff9109e7b5 copyin+0x25\n        ffffffff9109eb40 _copy_from_iter_full+0xe0\n        ffffffff91462370 tcp_sendmsg_locked+0x5e0\n        ffffffff91462370 tcp_sendmsg_locked+0x5e0\n        ffffffff91462b57 tcp_sendmsg+0x27\n        ffffffff9139815c sock_sendmsg+0x4c\n        ffffffff913981f7 sock_write_iter+0x97\n        ffffffff90f2cc56 do_iter_readv_writev+0x156\n        ffffffff90f2dff0 do_iter_write+0x80\n        ffffffff90f2e1c3 vfs_writev+0xa3\n        ffffffff90f2e27c do_writev+0x5c\n        ffffffff90c042bb do_syscall_64+0x5b\n        ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65\n\nThe cifs filesystem rightfully sets sk_allocations to GFP_NOFS,\nwe can avoid the nesting using the sk page frag for allocation\nlacking the __GFP_FS flag. Do not define an additional mm-helper\nfor that, as this is strictly tied to the sk page frag usage.\n\nv1 -\u003e v2:\n - use a stricted sk_page_frag() check instead of reordering the\n   code (Eric)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce55adfd-2395-4b22-ae57-09eb771a0b4e",
      "id": "CVE-2022-22827",
      "description": "storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "c2bd44d6-f0c0-4b72-af12-30de357b59e7",
      "id": "CVE-2024-45492",
      "description": "An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "ed4040d5-a7ec-4ab0-8637-9a12f5efdbe1",
      "id": "CVE-2022-23852",
      "description": "Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "e8e29169-1f1d-4ec6-82e8-569b03077a36",
      "id": "CVE-2022-23990",
      "description": "Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "da56f5db-0624-4a06-b279-1394df6c0752",
      "id": "CVE-2022-25235",
      "description": "xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "14e73b10-bca7-4500-be7c-c1360a8e834c",
      "id": "CVE-2022-25236",
      "description": "xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "473de0b9-b901-4470-8e16-cd8c207099c7",
      "id": "CVE-2024-50602",
      "description": "An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "20839815-4164-456b-a6dc-dcf0668aedb4",
      "id": "CVE-2022-25313",
      "description": "In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "4d55fb09-751b-4c08-911c-e266bad2c1be",
      "id": "CVE-2022-25315",
      "description": "In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "75009aae-da28-43f3-96c6-b8805190bb10",
      "id": "CVE-2022-40674",
      "description": "libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "92a44c69-7650-475d-b106-4c66c598c137",
      "id": "CVE-2022-43680",
      "description": "In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "6e5b7a62-aaac-4975-84ad-2cd8e66e0c23",
      "id": "CVE-2024-8176",
      "description": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "30030582-c196-40af-bdca-ac5412f78d21",
      "id": "CVE-2023-52425",
      "description": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "2bfd35fc-de0f-4be0-94c1-98de2ce376cd",
      "id": "CVE-2023-52426",
      "description": "libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "6356244a-8c0c-43b8-9d1a-2c9898fc87b8",
      "id": "CVE-2024-28757",
      "description": "libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "c7fa815b-9e16-4f0a-9b98-143eeabbb967",
      "id": "CVE-2024-45490",
      "description": "An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "2a728dd6-1685-40c9-9af9-8c0509383bc0",
      "id": "CVE-2024-45491",
      "description": "An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "c6b2a479-eafb-4ca9-b879-38108237ee8e",
      "id": "CVE-2025-59375",
      "description": "libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "7dcce92c-1022-4162-8b0d-5ebadb53ceb2",
      "id": "CVE-2025-66382",
      "description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.",
      "affects": [
        {
          "ref": "38c619a1-1e6d-4cff-8289-6db54878f8b1"
        }
      ]
    },
    {
      "bom-ref": "639df5b0-606c-489f-910b-16e0b29343a4",
      "id": "CVE-2022-49043",
      "description": "xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "892c3c0e-c62a-452c-ab78-cd5de82f5eb0",
      "id": "CVE-2023-45322",
      "description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "f75ed754-94f4-4ba7-b661-d77c7088636c",
      "id": "CVE-2024-25062",
      "description": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "e7a128e2-ca76-4758-825b-6b0477505a35",
      "id": "CVE-2024-26607",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: sii902x: Fix probing race issue\n\nA null pointer dereference crash has been observed rarely on TI\nplatforms using sii9022 bridge:\n\n[   53.271356]  sii902x_get_edid+0x34/0x70 [sii902x]\n[   53.276066]  sii902x_bridge_get_edid+0x14/0x20 [sii902x]\n[   53.281381]  drm_bridge_get_edid+0x20/0x34 [drm]\n[   53.286305]  drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper]\n[   53.292955]  drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper]\n[   53.300510]  drm_client_modeset_probe+0x1f0/0xbd4 [drm]\n[   53.305958]  __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper]\n[   53.313611]  drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper]\n[   53.320039]  drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper]\n[   53.326401]  drm_client_register+0x5c/0xa0 [drm]\n[   53.331216]  drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper]\n[   53.336881]  tidss_probe+0x128/0x264 [tidss]\n[   53.341174]  platform_probe+0x68/0xc4\n[   53.344841]  really_probe+0x188/0x3c4\n[   53.348501]  __driver_probe_device+0x7c/0x16c\n[   53.352854]  driver_probe_device+0x3c/0x10c\n[   53.357033]  __device_attach_driver+0xbc/0x158\n[   53.361472]  bus_for_each_drv+0x88/0xe8\n[   53.365303]  __device_attach+0xa0/0x1b4\n[   53.369135]  device_initial_probe+0x14/0x20\n[   53.373314]  bus_probe_device+0xb0/0xb4\n[   53.377145]  deferred_probe_work_func+0xcc/0x124\n[   53.381757]  process_one_work+0x1f0/0x518\n[   53.385770]  worker_thread+0x1e8/0x3dc\n[   53.389519]  kthread+0x11c/0x120\n[   53.392750]  ret_from_fork+0x10/0x20\n\nThe issue here is as follows:\n\n- tidss probes, but is deferred as sii902x is still missing.\n- sii902x starts probing and enters sii902x_init().\n- sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from\n  DRM's perspective.\n- sii902x calls sii902x_audio_codec_init() and\n  platform_device_register_data()\n- The registration of the audio platform device causes probing of the\n  deferred devices.\n- tidss probes, which eventually causes sii902x_bridge_get_edid() to be\n  called.\n- sii902x_bridge_get_edid() tries to use the i2c to read the edid.\n  However, the sii902x driver has not set up the i2c part yet, leading\n  to the crash.\n\nFix this by moving the drm_bridge_add() to the end of the\nsii902x_init(), which is also at the very end of sii902x_probe().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17e88d4b-b99a-436e-99d8-2eb05311ba65",
      "id": "CVE-2012-2663",
      "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",
      "affects": [
        {
          "ref": "81befa31-1238-44e7-b42b-0333669f29c0"
        }
      ]
    },
    {
      "bom-ref": "efd5e70e-379a-4b61-a6d6-beb3d4514c18",
      "id": "CVE-2024-34459",
      "description": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "8a6f7993-7ad0-41ef-abef-46dd086a6874",
      "id": "CVE-2024-56171",
      "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "c88fec22-b28c-4879-acdb-1dd7c08bc1a4",
      "id": "CVE-2025-24928",
      "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "bfa5429b-0e9d-4568-af7d-46f7716a7af1",
      "id": "CVE-2025-27113",
      "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "99bdf4b4-ae84-44cf-b682-74bc01ba9826",
      "id": "CVE-2025-32414",
      "description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "87b1574c-aade-4230-87e5-8d30f6cdfb0c",
      "id": "CVE-2025-32415",
      "description": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "e00f0e5b-9cc2-40fc-89e9-a238a8d3cb68",
      "id": "CVE-2025-49794",
      "description": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u003csch:name path=\"...\"/\u003e schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "01a7e6ef-a931-4f24-990c-686787c65d1d",
      "id": "CVE-2022-48875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: sdata can be NULL during AMPDU start\n\nieee80211_tx_ba_session_handle_start() may get NULL for sdata when a\ndeauthentication is ongoing.\n\nHere a trace triggering the race with the hostapd test\nmulti_ap_fronthaul_on_ap:\n\n(gdb) list *drv_ampdu_action+0x46\n0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).\n391             int ret = -EOPNOTSUPP;\n392\n393             might_sleep();\n394\n395             sdata = get_bss_sdata(sdata);\n396             if (!check_sdata_in_driver(sdata))\n397                     return -EIO;\n398\n399             trace_drv_ampdu_action(local, sdata, params);\n400\n\nwlan0: moving STA 02:00:00:00:03:00 to state 3\nwlan0: associated\nwlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)\nwlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0\nwlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)\nwlan0: moving STA 02:00:00:00:03:00 to state 2\nwlan0: moving STA 02:00:00:00:03:00 to state 1\nwlan0: Removed STA 02:00:00:00:03:00\nwlan0: Destroyed STA 02:00:00:00:03:00\nBUG: unable to handle page fault for address: fffffffffffffb48\nPGD 11814067 P4D 11814067 PUD 11816067 PMD 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\nWorkqueue: phy3 ieee80211_ba_session_work [mac80211]\nRIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]\nCode: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 \u003c8b\u003e 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85\nRSP: 0018:ffffc900025ebd20 EFLAGS: 00010287\nRAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240\nRDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40\nRBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0\nR13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8\nFS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0\nCall Trace:\n \u003cTASK\u003e\n ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]\n ieee80211_ba_session_work+0xff/0x2e0 [mac80211]\n process_one_work+0x29f/0x620\n worker_thread+0x4d/0x3d0\n ? process_one_work+0x620/0x620\n kthread+0xfb/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "223b5a26-2ce5-4320-8d52-0a760167373b",
      "id": "CVE-2025-49795",
      "description": "A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "56610a9f-17f4-4f0d-af32-6cf90dbac923",
      "id": "CVE-2025-49796",
      "description": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "f594f04f-0a92-44bb-86f9-cbea3d7fd683",
      "id": "CVE-2025-6021",
      "description": "A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "cf73ad55-3aed-4bd3-919b-662ea531df6b",
      "id": "CVE-2025-6170",
      "description": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
      "affects": [
        {
          "ref": "454de516-cfe1-4889-b795-fa274eebeafc"
        }
      ]
    },
    {
      "bom-ref": "3170a41a-755f-47c3-89d4-0ed12ff28882",
      "id": "CVE-2022-28391",
      "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",
      "affects": [
        {
          "ref": "4b51c6a6-330d-484b-80fb-457239059428"
        }
      ]
    },
    {
      "bom-ref": "32b76cf5-f74b-4aec-a98e-faa8afadf54c",
      "id": "CVE-2022-30065",
      "description": "A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.",
      "affects": [
        {
          "ref": "4b51c6a6-330d-484b-80fb-457239059428"
        }
      ]
    },
    {
      "bom-ref": "699e4524-9a55-42d1-9884-6bf9a8007352",
      "id": "CVE-2022-48174",
      "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",
      "affects": [
        {
          "ref": "4b51c6a6-330d-484b-80fb-457239059428"
        }
      ]
    },
    {
      "bom-ref": "a373ce28-5fde-4952-a38f-798fb13b02e7",
      "id": "CVE-2024-58251",
      "description": "In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.",
      "affects": [
        {
          "ref": "4b51c6a6-330d-484b-80fb-457239059428"
        }
      ]
    },
    {
      "bom-ref": "34aed981-c9a0-419b-9b26-8d3c187abf0a",
      "id": "CVE-2023-26242",
      "description": "afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9874d1f6-9ae2-45da-9e0a-51544576b4fc",
      "id": "CVE-2025-60876",
      "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",
      "affects": [
        {
          "ref": "4b51c6a6-330d-484b-80fb-457239059428"
        }
      ]
    },
    {
      "bom-ref": "47758833-c176-4a86-9d4a-a9acc453da56",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "62a79987-a91e-405c-86e6-94845eb64ce6"
        }
      ]
    },
    {
      "bom-ref": "f29f62fa-76c2-4acb-9104-4404cef4d31c",
      "id": "CVE-2002-2439",
      "description": "Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.",
      "affects": [
        {
          "ref": "62a79987-a91e-405c-86e6-94845eb64ce6"
        }
      ]
    },
    {
      "bom-ref": "70127de8-e7d8-4b37-815a-c2e40624bd19",
      "id": "CVE-2015-5276",
      "description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
      "affects": [
        {
          "ref": "62a79987-a91e-405c-86e6-94845eb64ce6"
        }
      ]
    },
    {
      "bom-ref": "bf1cdf0d-c655-4488-8ec5-6af40b550844",
      "id": "CVE-2018-12886",
      "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.",
      "affects": [
        {
          "ref": "62a79987-a91e-405c-86e6-94845eb64ce6"
        }
      ]
    },
    {
      "bom-ref": "c0206846-7394-4f93-a08b-caf148d43efb",
      "id": "CVE-2023-52566",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n\nIn nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the\nreference count of bh when the call to nilfs_dat_translate() fails.  If\nthe reference count hits 0 and its owner page gets unlocked, bh may be\nfreed.  However, bh-\u003eb_page is dereferenced to put the page after that,\nwhich may result in a use-after-free bug.  This patch moves the release\noperation after unlocking and putting the page.\n\nNOTE: The function in question is only called in GC, and in combination\nwith current userland tools, address translation using DAT does not occur\nin that function, so the code path that causes this issue will not be\nexecuted.  However, it is possible to run that code path by intentionally\nmodifying the userland GC library or by calling the GC ioctl directly.\n\n[konishi.ryusuke@gmail.com: NOTE added to the commit log]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae42dfaa-ecb6-4306-b141-1f60188feaae",
      "id": "CVE-2023-52742",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: USB: Fix wrong-direction WARNING in plusb.c\n\nThe syzbot fuzzer detected a bug in the plusb network driver: A\nzero-length control-OUT transfer was treated as a read instead of a\nwrite.  In modern kernels this error provokes a WARNING:\n\nusb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0\nWARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411\nusb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411\nModules linked in:\nCPU: 1 PID: 4645 Comm: dhcpcd Not tainted\n6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google\n01/12/2023\nRIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411\n...\nCall Trace:\n \u003cTASK\u003e\n usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58\n usb_internal_control_msg drivers/usb/core/message.c:102 [inline]\n usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153\n __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010\n usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068\n pl_vendor_req drivers/net/usb/plusb.c:60 [inline]\n pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline]\n pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85\n usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889\n __dev_open+0x297/0x4d0 net/core/dev.c:1417\n __dev_change_flags+0x587/0x750 net/core/dev.c:8530\n dev_change_flags+0x97/0x170 net/core/dev.c:8602\n devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147\n inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979\n sock_do_ioctl+0xcc/0x230 net/socket.c:1169\n sock_ioctl+0x1f8/0x680 net/socket.c:1286\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and\nremove the USB_DIR_IN flag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa76b39f-0074-4c67-ab12-269c28904ae5",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "62a79987-a91e-405c-86e6-94845eb64ce6"
        }
      ]
    },
    {
      "bom-ref": "99d3a40f-7b39-4ab0-a3ee-3df44ff19cbf",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "62a79987-a91e-405c-86e6-94845eb64ce6"
        }
      ]
    },
    {
      "bom-ref": "62b1ce8d-c48d-4605-b486-ae43af928de5",
      "id": "CVE-2024-24806",
      "description": "libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
      "affects": [
        {
          "ref": "6156cdf4-bbe4-4ec3-ba64-3f2740560145"
        }
      ]
    },
    {
      "bom-ref": "fa0bf5d1-340f-4878-a3dd-7359bfa9d239",
      "id": "CVE-2024-11053",
      "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "fd8cff9f-b05d-47f2-8a1f-fdfe3bd50c93",
      "id": "CVE-2024-8096",
      "description": "When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "8aabb2dd-1506-42d0-b7ce-bf351a952088",
      "id": "CVE-2024-9681",
      "description": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "44cd6d75-63ec-4421-94b5-3e7fbaed9f28",
      "id": "CVE-2025-0167",
      "description": "When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "ca7c71b7-baff-48ec-8a95-fdf4f09f6b0a",
      "id": "CVE-2025-0725",
      "description": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "59450bd0-6186-49a0-a5b9-268a2f1fcc93",
      "id": "CVE-2025-10966",
      "description": "curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "9a29dfbb-d8cb-4ff1-9f9c-28bfaa84feeb",
      "id": "CVE-2025-4947",
      "description": "libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "8781ac36-b96a-4ac2-a9d6-c1c967cde778",
      "id": "CVE-2025-5025",
      "description": "libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "bb6a1a99-f59f-4fd6-8b3e-b67b05c1bbfa",
      "id": "CVE-2025-9086",
      "description": "1. A cookie is set using the `secure` keyword for `https://target` \n 2. curl is redirected to or otherwise made to speak with `http://target` (same \n   hostname, but using clear text HTTP) using the same cookie set \n 3. The same cookie name is set - but with just a slash as path (`path=\\\"/\\\",`).\n   Since this site is not secure, the cookie *should* just be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.",
      "affects": [
        {
          "ref": "7e1ed3f0-3979-46a1-ad54-f99ad87acb7c"
        }
      ]
    },
    {
      "bom-ref": "2ac6d8f9-affe-4c2a-846a-43fe13f3617c",
      "id": "CVE-2015-5276",
      "description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
      "affects": [
        {
          "ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e"
        }
      ]
    },
    {
      "bom-ref": "f531caf5-1bf5-4cb1-84e9-6bdc419be779",
      "id": "CVE-2018-12886",
      "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.",
      "affects": [
        {
          "ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e"
        }
      ]
    },
    {
      "bom-ref": "b4f3b50a-23ee-4937-863d-1502bcaf04dd",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e"
        }
      ]
    },
    {
      "bom-ref": "ac029ea9-07a3-4543-afab-0052069e0f95",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e"
        }
      ]
    },
    {
      "bom-ref": "45d8520d-7be1-47e2-bc0d-dbee9e3017d9",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "8131fdb7-42b9-4d48-9c1e-1cc7dfe9fb5e"
        }
      ]
    },
    {
      "bom-ref": "51f9d4b7-738c-416f-b6ad-44be21d3f01c",
      "id": "CVE-2023-4408",
      "description": "The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers.\nThis issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "a802e1df-374f-401a-b1ed-fbb68a95644a",
      "id": "CVE-2023-5517",
      "description": "A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:\n\n  - `nxdomain-redirect \u003cdomain\u003e;` is configured, and\n  - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.\nThis issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "6e83a905-3c6a-4cc4-8ffd-d1a629bfb3d9",
      "id": "CVE-2023-5679",
      "description": "A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.\nThis issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "c4cabdbe-42ed-423f-9411-d09dc6370b07",
      "id": "CVE-2023-5680",
      "description": "If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance. \nThis issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "64edd0b7-f02d-4be7-9f03-118653b815b7",
      "id": "CVE-2024-11187",
      "description": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "4c0c1306-52af-494f-93a1-524d24cd6a48",
      "id": "CVE-2024-12705",
      "description": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "cff2bb69-7b0e-4cee-8533-d685d08d387f",
      "id": "CVE-2024-1737",
      "description": "Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.4-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "cddbe2cf-25fd-460f-9d0b-c9c1898551f4",
      "id": "CVE-2025-21931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio\n\nCommit b15c87263a69 (\"hwpoison, memory_hotplug: allow hwpoisoned pages to\nbe offlined) add page poison checks in do_migrate_range in order to make\noffline hwpoisoned page possible by introducing isolate_lru_page and\ntry_to_unmap for hwpoisoned page.  However folio lock must be held before\ncalling try_to_unmap.  Add it to fix this problem.\n\nWarning will be produced if folio is not locked during unmap:\n\n  ------------[ cut here ]------------\n  kernel BUG at ./include/linux/swapops.h:400!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G        W          6.13.0-rc1-00016-g3c434c7ee82a-dirty #41\n  Tainted: [W]=WARN\n  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n  pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : try_to_unmap_one+0xb08/0xd3c\n  lr : try_to_unmap_one+0x3dc/0xd3c\n  Call trace:\n   try_to_unmap_one+0xb08/0xd3c (P)\n   try_to_unmap_one+0x3dc/0xd3c (L)\n   rmap_walk_anon+0xdc/0x1f8\n   rmap_walk+0x3c/0x58\n   try_to_unmap+0x88/0x90\n   unmap_poisoned_folio+0x30/0xa8\n   do_migrate_range+0x4a0/0x568\n   offline_pages+0x5a4/0x670\n   memory_block_action+0x17c/0x374\n   memory_subsys_offline+0x3c/0x78\n   device_offline+0xa4/0xd0\n   state_store+0x8c/0xf0\n   dev_attr_store+0x18/0x2c\n   sysfs_kf_write+0x44/0x54\n   kernfs_fop_write_iter+0x118/0x1a8\n   vfs_write+0x3a8/0x4bc\n   ksys_write+0x6c/0xf8\n   __arm64_sys_write+0x1c/0x28\n   invoke_syscall+0x44/0x100\n   el0_svc_common.constprop.0+0x40/0xe0\n   do_el0_svc+0x1c/0x28\n   el0_svc+0x30/0xd0\n   el0t_64_sync_handler+0xc8/0xcc\n   el0t_64_sync+0x198/0x19c\n  Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)\n  ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8b10e7b-12aa-4bb0-91fa-637103d00f73",
      "id": "CVE-2024-1975",
      "description": "If a server hosts a zone containing a \"KEY\" Resource Record, or a resolver DNSSEC-validates a \"KEY\" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.\nThis issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "221a91ba-d2af-4ddc-857f-39400f59d6e3",
      "id": "CVE-2024-4076",
      "description": "Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure.\nThis issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "0b9ee031-0d0d-467b-abc9-65d567ec2581",
      "id": "CVE-2025-40776",
      "description": "A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "5894f825-09e3-4fda-a377-daef5ad099bd",
      "id": "CVE-2025-40778",
      "description": "Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "62e27ced-cf96-41c9-94e8-da1d5eb82af2",
      "id": "CVE-2025-40780",
      "description": "In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "7666be0b-8f32-4146-8e1c-c4aeb8354702",
      "id": "CVE-2025-8677",
      "description": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "1c5031cd-eb6a-4157-9b40-3a17e12e68be",
      "id": "CVE-2020-12762",
      "description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
      "affects": [
        {
          "ref": "89a4f8e9-492b-44e0-823f-6ec263ab8f5e"
        }
      ]
    },
    {
      "bom-ref": "14888736-caf3-4f8e-a5e1-e2902e5ef07e",
      "id": "CVE-2022-42898",
      "description": "PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\"",
      "affects": [
        {
          "ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea"
        }
      ]
    },
    {
      "bom-ref": "9fa7de15-7599-4b3f-985f-e8a29d3425e9",
      "id": "CVE-2023-36054",
      "description": "lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.",
      "affects": [
        {
          "ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea"
        }
      ]
    },
    {
      "bom-ref": "84a3186b-7983-4edc-9d52-231b940bbe28",
      "id": "CVE-2024-37370",
      "description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.",
      "affects": [
        {
          "ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea"
        }
      ]
    },
    {
      "bom-ref": "5a9e14d3-29ea-4640-b99c-3cd21c70be71",
      "id": "CVE-2024-37371",
      "description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.",
      "affects": [
        {
          "ref": "8e6e7558-4e22-40f5-b287-e7bc902765ea"
        }
      ]
    },
    {
      "bom-ref": "c0ba74cb-022a-47de-94cb-c658e144dee2",
      "id": "CVE-2024-24806",
      "description": "libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
      "affects": [
        {
          "ref": "90a7e7d0-5d4f-4aaf-b4b0-aa69a86d8131"
        }
      ]
    },
    {
      "bom-ref": "a2997418-cc4b-462b-8118-4e1e69dd4ac9",
      "id": "CVE-2021-20230",
      "description": "A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.",
      "affects": [
        {
          "ref": "89bcbc9a-1471-4d09-99e9-180251156b36"
        }
      ]
    },
    {
      "bom-ref": "b338391a-f38c-4729-807b-8df6ee0eebe3",
      "id": "CVE-2010-4756",
      "description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "8336f290-7642-434d-878d-89f5d1d6b77c",
      "id": "CVE-2022-39046",
      "description": "An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "30ef64c2-8ec2-40ba-88ba-23b19bd37d46",
      "id": "CVE-2023-0687",
      "description": "A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "4ba1acfb-e69c-4e8f-b4e9-3cc9be57fe02",
      "id": "CVE-2023-4527",
      "description": "A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "08164332-d144-43f3-9fcd-b45839b4e857",
      "id": "CVE-2023-4911",
      "description": "A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "a48a51f5-9c86-445e-8a69-814af7f4cdb5",
      "id": "CVE-2023-5156",
      "description": "A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "64a4d18c-4ba9-4788-aaaa-017500081bf0",
      "id": "CVE-2020-12657",
      "description": "An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52b63ebb-b8b8-4a39-ab24-15ad04a136d9",
      "id": "CVE-2023-6246",
      "description": "A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "c52e6732-6bcd-47ff-9577-943b7bd2404f",
      "id": "CVE-2024-2961",
      "description": "The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "5a75e925-1eea-426e-bfe8-11d6b8b7a0b3",
      "id": "CVE-2024-33599",
      "description": "nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow.  This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "41f244dc-0898-4362-8d1c-b1a3998df044",
      "id": "CVE-2024-33600",
      "description": "nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference.  This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "8e946827-a3c3-46a0-9b08-cddd65d87fd0",
      "id": "CVE-2024-33601",
      "description": "nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients.  The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "dc3fa131-8e1a-4809-9c78-160eb404384b",
      "id": "CVE-2022-49014",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: Fix use-after-free in tun_detach()\n\nsyzbot reported use-after-free in tun_detach() [1].  This causes call\ntrace like below:\n\n==================================================================\nBUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75\nRead of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673\n\nCPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x15e/0x461 mm/kasan/report.c:395\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:495\n notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75\n call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942\n call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]\n call_netdevice_notifiers net/core/dev.c:1997 [inline]\n netdev_wait_allrefs_any net/core/dev.c:10237 [inline]\n netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351\n tun_detach drivers/net/tun.c:704 [inline]\n tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467\n __fput+0x27c/0xa90 fs/file_table.c:320\n task_work_run+0x16f/0x270 kernel/task_work.c:179\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0xb3d/0x2a30 kernel/exit.c:820\n do_group_exit+0xd4/0x2a0 kernel/exit.c:950\n get_signal+0x21b1/0x2440 kernel/signal.c:2858\n arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869\n exit_to_user_mode_loop kernel/entry/common.c:168 [inline]\n exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203\n __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296\n do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe cause of the issue is that sock_put() from __tun_detach() drops\nlast reference count for struct net, and then notifier_call_chain()\nfrom netdev_state_change() accesses that struct net.\n\nThis patch fixes the issue by calling sock_put() from tun_detach()\nafter all necessary accesses for the struct net has done.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56823d3b-82ae-49a3-ad9b-77e2bafb812e",
      "id": "CVE-2022-1419",
      "description": "The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6e3d7f3-2d45-4572-a874-e34852fb5c7d",
      "id": "CVE-2024-33602",
      "description": "nscd: netgroup cache assumes NSS callback uses in-buffer strings\n\nThe Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory\nwhen the NSS callback does not store all strings in the provided buffer.\nThe flaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "91fdad8d-4267-4aea-ad9c-994a955d5a82",
      "id": "CVE-2025-0395",
      "description": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "a00e128c-64c9-4a84-8591-b2daa4456230",
      "id": "CVE-2025-4802",
      "description": "Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).",
      "affects": [
        {
          "ref": "98cd2029-ad3d-47d6-8e04-8d0437bfbbd4"
        }
      ]
    },
    {
      "bom-ref": "56313552-16ed-4027-82ed-b930551de7d8",
      "id": "CVE-2007-2768",
      "description": "OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243.",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "93c52185-c859-4e15-bf98-6901eadaa348",
      "id": "CVE-2008-3844",
      "description": "Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact.  NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points.  As of 20080827, no unofficial distributions of this software are known.",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "3694fb45-d58a-4d73-b3d3-7d8ed95081d6",
      "id": "CVE-2024-43834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: fix invalid wait context of page_pool_destroy()\n\nIf the driver uses a page pool, it creates a page pool with\npage_pool_create().\nThe reference count of page pool is 1 as default.\nA page pool will be destroyed only when a reference count reaches 0.\npage_pool_destroy() is used to destroy page pool, it decreases a\nreference count.\nWhen a page pool is destroyed, -\u003edisconnect() is called, which is\nmem_allocator_disconnect().\nThis function internally acquires mutex_lock().\n\nIf the driver uses XDP, it registers a memory model with\nxdp_rxq_info_reg_mem_model().\nThe xdp_rxq_info_reg_mem_model() internally increases a page pool\nreference count if a memory model is a page pool.\nNow the reference count is 2.\n\nTo destroy a page pool, the driver should call both page_pool_destroy()\nand xdp_unreg_mem_model().\nThe xdp_unreg_mem_model() internally calls page_pool_destroy().\nOnly page_pool_destroy() decreases a reference count.\n\nIf a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we\nwill face an invalid wait context warning.\nBecause xdp_unreg_mem_model() calls page_pool_destroy() with\nrcu_read_lock().\nThe page_pool_destroy() internally acquires mutex_lock().\n\nSplat looks like:\n=============================\n[ BUG: Invalid wait context ]\n6.10.0-rc6+ #4 Tainted: G W\n-----------------------------\nethtool/1806 is trying to lock:\nffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150\nother info that might help us debug this:\ncontext-{5:5}\n3 locks held by ethtool/1806:\nstack backtrace:\nCPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed\nHardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x7e/0xc0\n__lock_acquire+0x1681/0x4de0\n? _printk+0x64/0xe0\n? __pfx_mark_lock.part.0+0x10/0x10\n? __pfx___lock_acquire+0x10/0x10\nlock_acquire+0x1b3/0x580\n? mem_allocator_disconnect+0x73/0x150\n? __wake_up_klogd.part.0+0x16/0xc0\n? __pfx_lock_acquire+0x10/0x10\n? dump_stack_lvl+0x91/0xc0\n__mutex_lock+0x15c/0x1690\n? mem_allocator_disconnect+0x73/0x150\n? __pfx_prb_read_valid+0x10/0x10\n? mem_allocator_disconnect+0x73/0x150\n? __pfx_llist_add_batch+0x10/0x10\n? console_unlock+0x193/0x1b0\n? lockdep_hardirqs_on+0xbe/0x140\n? __pfx___mutex_lock+0x10/0x10\n? tick_nohz_tick_stopped+0x16/0x90\n? __irq_work_queue_local+0x1e5/0x330\n? irq_work_queue+0x39/0x50\n? __wake_up_klogd.part.0+0x79/0xc0\n? mem_allocator_disconnect+0x73/0x150\nmem_allocator_disconnect+0x73/0x150\n? __pfx_mem_allocator_disconnect+0x10/0x10\n? mark_held_locks+0xa5/0xf0\n? rcu_is_watching+0x11/0xb0\npage_pool_release+0x36e/0x6d0\npage_pool_destroy+0xd7/0x440\nxdp_unreg_mem_model+0x1a7/0x2a0\n? __pfx_xdp_unreg_mem_model+0x10/0x10\n? kfree+0x125/0x370\n? bnxt_free_ring.isra.0+0x2eb/0x500\n? bnxt_free_mem+0x5ac/0x2500\nxdp_rxq_info_unreg+0x4a/0xd0\nbnxt_free_mem+0x1356/0x2500\nbnxt_close_nic+0xf0/0x3b0\n? __pfx_bnxt_close_nic+0x10/0x10\n? ethnl_parse_bit+0x2c6/0x6d0\n? __pfx___nla_validate_parse+0x10/0x10\n? __pfx_ethnl_parse_bit+0x10/0x10\nbnxt_set_features+0x2a8/0x3e0\n__netdev_update_features+0x4dc/0x1370\n? ethnl_parse_bitset+0x4ff/0x750\n? __pfx_ethnl_parse_bitset+0x10/0x10\n? __pfx___netdev_update_features+0x10/0x10\n? mark_held_locks+0xa5/0xf0\n? _raw_spin_unlock_irqrestore+0x42/0x70\n? __pm_runtime_resume+0x7d/0x110\nethnl_set_features+0x32d/0xa20\n\nTo fix this problem, it uses rhashtable_lookup_fast() instead of\nrhashtable_lookup() with rcu_read_lock().\nUsing xa without rcu_read_lock() here is safe.\nxa is freed by __xdp_mem_allocator_rcu_free() and this is called by\ncall_rcu() of mem_xa_remove().\nThe mem_xa_remove() is called by page_pool_destroy() if a reference\ncount reaches 0.\nThe xa is already protected by the reference count mechanism well in the\ncontrol plane.\nSo removing rcu_read_lock() for page_pool_destroy() is safe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36fbf948-3d9c-4199-b5c5-e8f82f4689fa",
      "id": "CVE-2023-51767",
      "description": "OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "6c7688e4-095e-4713-acef-51b6246d3702",
      "id": "CVE-2025-26466",
      "description": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "f92fbd6b-211f-4df6-97fb-bc847743e2da",
      "id": "CVE-2025-32728",
      "description": "In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "46bce1eb-bf10-4e03-8e01-8ab0e288344c",
      "id": "CVE-2025-61984",
      "description": "ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "ae4cdef7-19a7-4d07-b7ef-7b0607b4b1a0",
      "id": "CVE-2025-61985",
      "description": "ssh in OpenSSH before 10.1 allows the '\\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.",
      "affects": [
        {
          "ref": "ab454ba0-653d-481c-a42a-b6d9364ed90f"
        }
      ]
    },
    {
      "bom-ref": "1f0e3733-0fc8-453a-92ea-d4473c70afa4",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "b20ebf5b-7a83-4111-b676-6abc3ecc542a"
        }
      ]
    },
    {
      "bom-ref": "f39fbdb8-61ba-4f6d-a37e-778dffa88cd4",
      "id": "CVE-2024-5535",
      "description": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "498b595a-0694-4cb4-b6db-b19f3ef27608",
      "id": "CVE-2023-5678",
      "description": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "828baae7-ab98-482f-ad87-8e29f1a800ef",
      "id": "CVE-2024-13176",
      "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "075b5dcc-2a4b-44f2-93ef-f823c62ad90b",
      "id": "CVE-2024-2511",
      "description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "13fe1af7-c3a2-409f-a560-a19992bd5c27",
      "id": "CVE-2024-4741",
      "description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "aaf00adc-0f2c-4f2f-8f13-a6a30622045b",
      "id": "CVE-2024-9143",
      "description": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "2d129d13-e40a-4060-9d49-122dbd56f8ac",
      "id": "CVE-2025-9230",
      "description": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.",
      "affects": [
        {
          "ref": "cdd04b76-b62f-4b85-92ad-9b7292cbafdb"
        }
      ]
    },
    {
      "bom-ref": "d3b92133-6b1d-4a01-9e29-d001bd54aa59",
      "id": "CVE-2022-29458",
      "description": "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
      "affects": [
        {
          "ref": "def6f02b-77c3-408f-a6ad-20fa9a6932f4"
        }
      ]
    },
    {
      "bom-ref": "cdf5ba6a-f2b6-4c00-873c-95a14d98117d",
      "id": "CVE-2023-29491",
      "description": "ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.",
      "affects": [
        {
          "ref": "def6f02b-77c3-408f-a6ad-20fa9a6932f4"
        }
      ]
    },
    {
      "bom-ref": "56fc924a-2e24-41a9-a44c-7b6348c08ab0",
      "id": "CVE-2019-15847",
      "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.",
      "affects": [
        {
          "ref": "edb607c3-12e1-4a91-83f8-f92ef0423039"
        }
      ]
    },
    {
      "bom-ref": "863b586b-3c8b-47f1-be2a-f44ce9d5b2da",
      "id": "CVE-2021-47159",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: fix a crash if -\u003eget_sset_count() fails\n\nIf ds-\u003eops-\u003eget_sset_count() fails then it \"count\" is a negative error\ncode such as -EOPNOTSUPP.  Because \"i\" is an unsigned int, the negative\nerror code is type promoted to a very high value and the loop will\ncorrupt memory until the system crashes.\n\nFix this by checking for error codes and changing the type of \"i\" to\njust int.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "531e0bb2-654e-4dd5-a3cc-12c84950cdb0",
      "id": "CVE-2021-37322",
      "description": "GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.",
      "affects": [
        {
          "ref": "edb607c3-12e1-4a91-83f8-f92ef0423039"
        }
      ]
    },
    {
      "bom-ref": "4d4a93ac-7a7f-41b0-baf9-af46301caab7",
      "id": "CVE-2023-4039",
      "description": "A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.",
      "affects": [
        {
          "ref": "edb607c3-12e1-4a91-83f8-f92ef0423039"
        }
      ]
    },
    {
      "bom-ref": "2af582b1-1309-4a1c-980a-8fe35ba51da2",
      "id": "CVE-2022-3821",
      "description": "An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.",
      "affects": [
        {
          "ref": "f013647d-a63a-4f0e-a675-1a6425e61f15"
        }
      ]
    },
    {
      "bom-ref": "ac6b92ca-f513-4bce-ab9f-493cc0f3fa11",
      "id": "CVE-2022-4415",
      "description": "A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.",
      "affects": [
        {
          "ref": "f013647d-a63a-4f0e-a675-1a6425e61f15"
        }
      ]
    },
    {
      "bom-ref": "5bfdf06d-2d4e-4e4c-81ab-9cb16aab0899",
      "id": "CVE-2022-45873",
      "description": "systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling the same function recursively, and put it in a deeply nested directory to make its backtrace large enough to cause the deadlock. This must be done 16 times when MaxConnections=16 is set for the systemd/units/systemd-coredump.socket file.",
      "affects": [
        {
          "ref": "f013647d-a63a-4f0e-a675-1a6425e61f15"
        }
      ]
    },
    {
      "bom-ref": "bc1d35f5-e7c8-4b50-8dc0-41d4b6370bba",
      "id": "CVE-2021-47310",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: fix UAF in tlan_remove_one\n\npriv is netdev private data and it cannot be\nused after free_netdev() call. Using priv after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9530670f-021c-41df-9550-89891c9a1fb5",
      "id": "CVE-2025-4598",
      "description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
      "affects": [
        {
          "ref": "f013647d-a63a-4f0e-a675-1a6425e61f15"
        }
      ]
    },
    {
      "bom-ref": "bd251a1f-c4ca-4e00-a592-4595d623954e",
      "id": "CVE-2022-42010",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.",
      "affects": [
        {
          "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5"
        }
      ]
    },
    {
      "bom-ref": "4c133c77-021b-4e1a-92f4-cc3ba1d5f4fc",
      "id": "CVE-2023-53042",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not set DRR on pipe Commit\n\n[WHY]\nWriting to DRR registers such as OTG_V_TOTAL_MIN on the same frame as a\npipe commit can cause underflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "750c1d17-b75e-4473-829b-32eed8e0f897",
      "id": "CVE-2022-42011",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.",
      "affects": [
        {
          "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5"
        }
      ]
    },
    {
      "bom-ref": "d0f0afeb-4e66-470e-a124-4111624328d2",
      "id": "CVE-2022-42012",
      "description": "An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.",
      "affects": [
        {
          "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5"
        }
      ]
    },
    {
      "bom-ref": "ddf1ba3f-3ef0-43f5-91b3-ec8cba5d0993",
      "id": "CVE-2023-34969",
      "description": "D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.",
      "affects": [
        {
          "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5"
        }
      ]
    },
    {
      "bom-ref": "dc86e529-0510-4343-9c96-0bb42599522f",
      "id": "CVE-2022-31212",
      "description": "An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.",
      "affects": [
        {
          "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5"
        }
      ]
    },
    {
      "bom-ref": "e674c090-b0ad-4ffd-bd21-91e738ec4b1f",
      "id": "CVE-2022-31213",
      "description": "An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.",
      "affects": [
        {
          "ref": "f266140d-7be6-49eb-8fde-7fc5925c04a5"
        }
      ]
    },
    {
      "bom-ref": "336e0687-ce12-4812-a3f9-804ac0ffec63",
      "id": "CVE-2023-53054",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: fix a devres leak in hw_enable upon suspend resume\n\nEach time the platform goes to low power, PM suspend / resume routines\ncall: __dwc2_lowlevel_hw_enable -\u003e devm_add_action_or_reset().\nThis adds a new devres each time.\nThis may also happen at runtime, as dwc2_lowlevel_hw_enable() can be\ncalled from udc_start().\n\nThis can be seen with tracing:\n- echo 1 \u003e /sys/kernel/debug/tracing/events/dev/devres_log/enable\n- go to low power\n- cat /sys/kernel/debug/tracing/trace\n\nA new \"ADD\" entry is found upon each low power cycle:\n... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes)\n... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes)\n...\n\nA second issue is addressed here:\n- regulator_bulk_enable() is called upon each PM cycle (suspend/resume).\n- regulator_bulk_disable() never gets called.\n\nSo the reference count for these regulators constantly increase, by one\nupon each low power cycle, due to missing regulator_bulk_disable() call\nin __dwc2_lowlevel_hw_disable().\n\nThe original fix that introduced the devm_add_action_or_reset() call,\nfixed an issue during probe, that happens due to other errors in\ndwc2_driver_probe() -\u003e dwc2_core_reset(). Then the probe fails without\ndisabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL.\n\nRather fix the error path: disable all the low level hardware in the\nerror path, by using the \"hsotg-\u003ell_hw_enabled\" flag. Checking dr_mode\nhas been introduced to avoid a dual call to dwc2_lowlevel_hw_disable().\n\"ll_hw_enabled\" should achieve the same (and is used currently in the\nremove() routine).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f070038f-0a71-4e9f-88ed-f52d2028355f",
      "id": "CVE-2023-53176",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Reinit port-\u003epm on port specific driver unbind\n\nWhen we unbind a serial port hardware specific 8250 driver, the generic\nserial8250 driver takes over the port. After that we see an oops about 10\nseconds later. This can produce the following at least on some TI SoCs:\n\nUnhandled fault: imprecise external abort (0x1406)\nInternal error: : 1406 [#1] SMP ARM\n\nTurns out that we may still have the serial port hardware specific driver\nport-\u003epm in use, and serial8250_pm() tries to call it after the port\nspecific driver is gone:\n\nserial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base]\nuart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base]\nuart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c\n__tty_hangup.part.0 from disassociate_ctty+0x154/0x20c\ndisassociate_ctty from do_exit+0x744/0xaac\ndo_exit from do_group_exit+0x40/0x8c\ndo_group_exit from __wake_up_parent+0x0/0x1c\n\nLet's fix the issue by calling serial8250_set_defaults() in\nserial8250_unregister_port(). This will set the port back to using\nthe serial8250 default functions, and sets the port-\u003epm to point to\nserial8250_pm.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1b39ae5-7e1f-45c9-8acd-d9183840443a",
      "id": "CVE-2020-12888",
      "description": "The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90076e42-8557-4fd5-912f-e5f43ea3a6e1",
      "id": "CVE-2020-35501",
      "description": "A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c8d097d-6570-4ee5-bf0a-c612e4e77900",
      "id": "CVE-2021-4154",
      "description": "A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86154083-af81-4056-8758-9f104413e099",
      "id": "CVE-2021-43389",
      "description": "An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4d8692b-e5a3-48f7-a06d-8a5c816b30c0",
      "id": "CVE-2021-46929",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: use call_rcu to free endpoint\n\nThis patch is to delay the endpoint free by calling call_rcu() to fix\nanother use-after-free issue in sctp_sock_dump():\n\n  BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20\n  Call Trace:\n    __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218\n    lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844\n    __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]\n    _raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168\n    spin_lock_bh include/linux/spinlock.h:334 [inline]\n    __lock_sock+0x203/0x350 net/core/sock.c:2253\n    lock_sock_nested+0xfe/0x120 net/core/sock.c:2774\n    lock_sock include/net/sock.h:1492 [inline]\n    sctp_sock_dump+0x122/0xb20 net/sctp/diag.c:324\n    sctp_for_each_transport+0x2b5/0x370 net/sctp/socket.c:5091\n    sctp_diag_dump+0x3ac/0x660 net/sctp/diag.c:527\n    __inet_diag_dump+0xa8/0x140 net/ipv4/inet_diag.c:1049\n    inet_diag_dump+0x9b/0x110 net/ipv4/inet_diag.c:1065\n    netlink_dump+0x606/0x1080 net/netlink/af_netlink.c:2244\n    __netlink_dump_start+0x59a/0x7c0 net/netlink/af_netlink.c:2352\n    netlink_dump_start include/linux/netlink.h:216 [inline]\n    inet_diag_handler_cmd+0x2ce/0x3f0 net/ipv4/inet_diag.c:1170\n    __sock_diag_cmd net/core/sock_diag.c:232 [inline]\n    sock_diag_rcv_msg+0x31d/0x410 net/core/sock_diag.c:263\n    netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477\n    sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:274\n\nThis issue occurs when asoc is peeled off and the old sk is freed after\ngetting it by asoc-\u003ebase.sk and before calling lock_sock(sk).\n\nTo prevent the sk free, as a holder of the sk, ep should be alive when\ncalling lock_sock(). This patch uses call_rcu() and moves sock_put and\nep free into sctp_endpoint_destroy_rcu(), so that it's safe to try to\nhold the ep under rcu_read_lock in sctp_transport_traverse_process().\n\nIf sctp_endpoint_hold() returns true, it means this ep is still alive\nand we have held it and can continue to dump it; If it returns false,\nit means this ep is dead and can be freed after rcu_read_unlock, and\nwe should skip it.\n\nIn sctp_sock_dump(), after locking the sk, if this ep is different from\ntsp-\u003easoc-\u003eep, it means during this dumping, this asoc was peeled off\nbefore calling lock_sock(), and the sk should be skipped; If this ep is\nthe same with tsp-\u003easoc-\u003eep, it means no peeloff happens on this asoc,\nand due to lock_sock, no peeloff will happen either until release_sock.\n\nNote that delaying endpoint free won't delay the port release, as the\nport release happens in sctp_endpoint_destroy() before calling call_rcu().\nAlso, freeing endpoint by call_rcu() makes it safe to access the sk by\nasoc-\u003ebase.sk in sctp_assocs_seq_show() and sctp_rcv().\n\nThanks Jones to bring this issue up.\n\nv1-\u003ev2:\n  - improve the changelog.\n  - add kfree(ep) into sctp_endpoint_destroy_rcu(), as Jakub noticed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84b66947-7021-4510-817f-3251605400fc",
      "id": "CVE-2021-47353",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix NULL pointer dereference in udf_symlink function\n\nIn function udf_symlink, epos.bh is assigned with the value returned\nby udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c\nand returns the value of sb_getblk function that could be NULL.\nThen, epos.bh is used without any check, causing a possible\nNULL pointer dereference when sb_getblk fails.\n\nThis fix adds a check to validate the value of epos.bh.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c1cfb74-4ba0-4937-86f0-639baf98c7e8",
      "id": "CVE-2021-47376",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add oversize check before call kvcalloc()\n\nCommit 7661809d493b (\"mm: don't allow oversized kvmalloc() calls\") add the\noversize check. When the allocation is larger than what kmalloc() supports,\nthe following warning triggered:\n\nWARNING: CPU: 0 PID: 8408 at mm/util.c:597 kvmalloc_node+0x108/0x110 mm/util.c:597\nModules linked in:\nCPU: 0 PID: 8408 Comm: syz-executor221 Not tainted 5.14.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:kvmalloc_node+0x108/0x110 mm/util.c:597\nCall Trace:\n kvmalloc include/linux/mm.h:806 [inline]\n kvmalloc_array include/linux/mm.h:824 [inline]\n kvcalloc include/linux/mm.h:829 [inline]\n check_btf_line kernel/bpf/verifier.c:9925 [inline]\n check_btf_info kernel/bpf/verifier.c:10049 [inline]\n bpf_check+0xd634/0x150d0 kernel/bpf/verifier.c:13759\n bpf_prog_load kernel/bpf/syscall.c:2301 [inline]\n __sys_bpf+0x11181/0x126e0 kernel/bpf/syscall.c:4587\n __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]\n __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4689\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e861e95-a167-4e93-b684-dd3b8612f1e0",
      "id": "CVE-2021-47383",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: Fix out-of-bound vmalloc access in imageblit\n\nThis issue happens when a userspace program does an ioctl\nFBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct\ncontaining only the fields xres, yres, and bits_per_pixel\nwith values.\n\nIf this struct is the same as the previous ioctl, the\nvc_resize() detects it and doesn't call the resize_screen(),\nleaving the fb_var_screeninfo incomplete. And this leads to\nthe updatescrollmode() calculates a wrong value to\nfbcon_display-\u003evrows, which makes the real_y() return a\nwrong value of y, and that value, eventually, causes\nthe imageblit to access an out-of-bound address value.\n\nTo solve this issue I made the resize_screen() be called\neven if the screen does not need any resizing, so it will\n\"fix and fill\" the fb_var_screeninfo independently.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b99eebf9-7b37-4b3b-bd70-56db592300f5",
      "id": "CVE-2021-47432",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/generic-radix-tree.c: Don't overflow in peek()\n\nWhen we started spreading new inode numbers throughout most of the 64\nbit inode space, that triggered some corner case bugs, in particular\nsome integer overflows related to the radix tree code. Oops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f805a35c-e729-4235-938c-1aab4a7bcd25",
      "id": "CVE-2021-47499",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kxcjk-1013: Fix possible memory leak in probe and remove\n\nWhen ACPI type is ACPI_SMO8500, the data-\u003edready_trig will not be set, the\nmemory allocated by iio_triggered_buffer_setup() will not be freed, and cause\nmemory leak as follows:\n\nunreferenced object 0xffff888009551400 (size 512):\n  comm \"i2c-SMO8500-125\", pid 911, jiffies 4294911787 (age 83.852s)\n  hex dump (first 32 bytes):\n    02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff  ........ .......\n  backtrace:\n    [\u003c0000000041ce75ee\u003e] kmem_cache_alloc_trace+0x16d/0x360\n    [\u003c000000000aeb17b0\u003e] iio_kfifo_allocate+0x41/0x130 [kfifo_buf]\n    [\u003c000000004b40c1f5\u003e] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer]\n    [\u003c000000004375b15f\u003e] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013]\n\nFix it by remove data-\u003edready_trig condition in probe and remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b1747f0-8d53-435c-bf52-d62fd8a01cc7",
      "id": "CVE-2021-47566",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc/vmcore: fix clearing user buffer by properly using clear_user()\n\nTo clear a user buffer we cannot simply use memset, we have to use\nclear_user().  With a virtio-mem device that registers a vmcore_cb and\nhas some logically unplugged memory inside an added Linux memory block,\nI can easily trigger a BUG by copying the vmcore via \"cp\":\n\n  systemd[1]: Starting Kdump Vmcore Save Service...\n  kdump[420]: Kdump is using the default log level(3).\n  kdump[453]: saving to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/\n  kdump[458]: saving vmcore-dmesg.txt to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/\n  kdump[465]: saving vmcore-dmesg.txt complete\n  kdump[467]: saving vmcore\n  BUG: unable to handle page fault for address: 00007f2374e01000\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0003) - permissions violation\n  PGD 7a523067 P4D 7a523067 PUD 7a528067 PMD 7a525067 PTE 800000007048f867\n  Oops: 0003 [#1] PREEMPT SMP NOPTI\n  CPU: 0 PID: 468 Comm: cp Not tainted 5.15.0+ #6\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-27-g64f37cc530f1-prebuilt.qemu.org 04/01/2014\n  RIP: 0010:read_from_oldmem.part.0.cold+0x1d/0x86\n  Code: ff ff ff e8 05 ff fe ff e9 b9 e9 7f ff 48 89 de 48 c7 c7 38 3b 60 82 e8 f1 fe fe ff 83 fd 08 72 3c 49 8d 7d 08 4c 89 e9 89 e8 \u003c49\u003e c7 45 00 00 00 00 00 49 c7 44 05 f8 00 00 00 00 48 83 e7 f81\n  RSP: 0018:ffffc9000073be08 EFLAGS: 00010212\n  RAX: 0000000000001000 RBX: 00000000002fd000 RCX: 00007f2374e01000\n  RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00007f2374e01008\n  RBP: 0000000000001000 R08: 0000000000000000 R09: ffffc9000073bc50\n  R10: ffffc9000073bc48 R11: ffffffff829461a8 R12: 000000000000f000\n  R13: 00007f2374e01000 R14: 0000000000000000 R15: ffff88807bd421e8\n  FS:  00007f2374e12140(0000) GS:ffff88807f000000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f2374e01000 CR3: 000000007a4aa000 CR4: 0000000000350eb0\n  Call Trace:\n   read_vmcore+0x236/0x2c0\n   proc_reg_read+0x55/0xa0\n   vfs_read+0x95/0x190\n   ksys_read+0x4f/0xc0\n   do_syscall_64+0x3b/0x90\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nSome x86-64 CPUs have a CPU feature called \"Supervisor Mode Access\nPrevention (SMAP)\", which is used to detect wrong access from the kernel\nto user buffers like this: SMAP triggers a permissions violation on\nwrong access.  In the x86-64 variant of clear_user(), SMAP is properly\nhandled via clac()+stac().\n\nTo fix, properly use clear_user() when we're dealing with a user buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c692b25b-f40e-488d-8920-466973f22b46",
      "id": "CVE-2022-1789",
      "description": "With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1cf9dcba-12c7-48ec-9b68-5eff777271c4",
      "id": "CVE-2022-47520",
      "description": "An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8214174c-922c-4cd8-9194-e03bdb99abea",
      "id": "CVE-2022-48712",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix error handling in ext4_fc_record_modified_inode()\n\nCurrent code does not fully takes care of krealloc() error case, which\ncould lead to silent memory corruption or a kernel bug.  This patch\nfixes that.\n\nAlso it cleans up some duplicated error handling logic from various\nfunctions in fast_commit.c file.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "805c2e56-e6d8-4eed-b9ec-0ae32e424544",
      "id": "CVE-2022-48775",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj\n\nkobject_init_and_add() takes reference even when it fails.\nAccording to the doc of kobject_init_and_add()：\n\n   If this function returns an error, kobject_put() must be called to\n   properly clean up the memory associated with the object.\n\nFix memory leak by calling kobject_put().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa8dfaab-d1b0-431c-8496-bc4ec08b8843",
      "id": "CVE-2022-48805",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup\n\nax88179_rx_fixup() contains several out-of-bounds accesses that can be\ntriggered by a malicious (or defective) USB device, in particular:\n\n - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds,\n   causing OOB reads and (on big-endian systems) OOB endianness flips.\n - A packet can overlap the metadata array, causing a later OOB\n   endianness flip to corrupt data used by a cloned SKB that has already\n   been handed off into the network stack.\n - A packet SKB can be constructed whose tail is far beyond its end,\n   causing out-of-bounds heap data to be considered part of the SKB's\n   data.\n\nI have tested that this can be used by a malicious USB device to send a\nbogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response\nthat contains random kernel heap data.\nIt's probably also possible to get OOB writes from this on a\nlittle-endian system somehow - maybe by triggering skb_cow() via IP\noptions processing -, but I haven't tested that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7298af8e-01b0-4e7f-84bd-6992cbae4a4c",
      "id": "CVE-2022-48988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: fix possible use-after-free in memcg_write_event_control()\n\nmemcg_write_event_control() accesses the dentry-\u003ed_name of the specified\ncontrol fd to route the write call.  As a cgroup interface file can't be\nrenamed, it's safe to access d_name as long as the specified file is a\nregular cgroup file.  Also, as these cgroup interface files can't be\nremoved before the directory, it's safe to access the parent too.\n\nPrior to 347c4a874710 (\"memcg: remove cgroup_event-\u003ecft\"), there was a\ncall to __file_cft() which verified that the specified file is a regular\ncgroupfs file before further accesses.  The cftype pointer returned from\n__file_cft() was no longer necessary and the commit inadvertently dropped\nthe file type check with it allowing any file to slip through.  With the\ninvarients broken, the d_name and parent accesses can now race against\nrenames and removals of arbitrary files and cause use-after-free's.\n\nFix the bug by resurrecting the file type check in __file_cft().  Now that\ncgroupfs is implemented through kernfs, checking the file operations needs\nto go through a layer of indirection.  Instead, let's check the superblock\nand dentry type.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "980b83a8-f6f0-4f60-bfa4-86176186023d",
      "id": "CVE-2022-49108",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: Fix memory leaks on probe\n\nHandle the error branches to free memory where required.\n\nAddresses-Coverity-ID: 1491825 (\"Resource leak\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43db3ed0-5695-4be2-854b-7911e65bdbef",
      "id": "CVE-2022-49109",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix inode reference leakage in ceph_get_snapdir()\n\nThe ceph_get_inode() will search for or insert a new inode into the\nhash for the given vino, and return a reference to it. If new is\nnon-NULL, its reference is consumed.\n\nWe should release the reference when in error handing cases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32aa34c4-4daa-41be-88d3-7a527c883ad7",
      "id": "CVE-2022-49174",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix ext4_mb_mark_bb() with flex_bg with fast_commit\n\nIn case of flex_bg feature (which is by default enabled), extents for\nany given inode might span across blocks from two different block group.\next4_mb_mark_bb() only reads the buffer_head of block bitmap once for the\nstarting block group, but it fails to read it again when the extent length\nboundary overflows to another block group. Then in this below loop it\naccesses memory beyond the block group bitmap buffer_head and results\ninto a data abort.\n\n\tfor (i = 0; i \u003c clen; i++)\n\t\tif (!mb_test_bit(blkoff + i, bitmap_bh-\u003eb_data) == !state)\n\t\t\talready++;\n\nThis patch adds this functionality for checking block group boundary in\next4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different\nblock group.\n\nw/o this patch, I was easily able to hit a data access abort using Power platform.\n\n\u003c...\u003e\n[   74.327662] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters\n[   74.533214] EXT4-fs (loop3): shut down requested (2)\n[   74.536705] Aborting journal on device loop3-8.\n[   74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000\n[   74.703727] Faulting instruction address: 0xc0000000007bffb8\ncpu 0xd: Vector: 300 (Data Access) at [c000000015db7060]\n    pc: c0000000007bffb8: ext4_mb_mark_bb+0x198/0x5a0\n    lr: c0000000007bfeec: ext4_mb_mark_bb+0xcc/0x5a0\n    sp: c000000015db7300\n   msr: 800000000280b033\n   dar: c00000005e980000\n dsisr: 40000000\n  current = 0xc000000027af6880\n  paca    = 0xc00000003ffd5200   irqmask: 0x03   irq_happened: 0x01\n    pid   = 5167, comm = mount\n\u003c...\u003e\nenter ? for help\n[c000000015db7380] c000000000782708 ext4_ext_clear_bb+0x378/0x410\n[c000000015db7400] c000000000813f14 ext4_fc_replay+0x1794/0x2000\n[c000000015db7580] c000000000833f7c do_one_pass+0xe9c/0x12a0\n[c000000015db7710] c000000000834504 jbd2_journal_recover+0x184/0x2d0\n[c000000015db77c0] c000000000841398 jbd2_journal_load+0x188/0x4a0\n[c000000015db7880] c000000000804de8 ext4_fill_super+0x2638/0x3e10\n[c000000015db7a40] c0000000005f8404 get_tree_bdev+0x2b4/0x350\n[c000000015db7ae0] c0000000007ef058 ext4_get_tree+0x28/0x40\n[c000000015db7b00] c0000000005f6344 vfs_get_tree+0x44/0x100\n[c000000015db7b70] c00000000063c408 path_mount+0xdd8/0xe70\n[c000000015db7c40] c00000000063c8f0 sys_mount+0x450/0x550\n[c000000015db7d50] c000000000035770 system_call_exception+0x4a0/0x4e0\n[c000000015db7e10] c00000000000c74c system_call_common+0xec/0x250",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37bacb25-7212-48c8-a0da-26f5028374ea",
      "id": "CVE-2022-49277",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix memory leak in jffs2_do_mount_fs\n\nIf jffs2_build_filesystem() in jffs2_do_mount_fs() returns an error,\nwe can observe the following kmemleak report:\n\n--------------------------------------------\nunreferenced object 0xffff88811b25a640 (size 64):\n  comm \"mount\", pid 691, jiffies 4294957728 (age 71.952s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffffa493be24\u003e] kmem_cache_alloc_trace+0x584/0x880\n    [\u003cffffffffa5423a06\u003e] jffs2_sum_init+0x86/0x130\n    [\u003cffffffffa5400e58\u003e] jffs2_do_mount_fs+0x798/0xac0\n    [\u003cffffffffa540acf3\u003e] jffs2_do_fill_super+0x383/0xc30\n    [\u003cffffffffa540c00a\u003e] jffs2_fill_super+0x2ea/0x4c0\n    [...]\nunreferenced object 0xffff88812c760000 (size 65536):\n  comm \"mount\", pid 691, jiffies 4294957728 (age 71.952s)\n  hex dump (first 32 bytes):\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n  backtrace:\n    [\u003cffffffffa493a449\u003e] __kmalloc+0x6b9/0x910\n    [\u003cffffffffa5423a57\u003e] jffs2_sum_init+0xd7/0x130\n    [\u003cffffffffa5400e58\u003e] jffs2_do_mount_fs+0x798/0xac0\n    [\u003cffffffffa540acf3\u003e] jffs2_do_fill_super+0x383/0xc30\n    [\u003cffffffffa540c00a\u003e] jffs2_fill_super+0x2ea/0x4c0\n    [...]\n--------------------------------------------\n\nThis is because the resources allocated in jffs2_sum_init() are not\nreleased. Call jffs2_sum_exit() to release these resources to solve\nthe problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97d064ff-7817-4f18-b891-a535972e6ffa",
      "id": "CVE-2024-53088",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix race condition by adding filter's intermediate sync state\n\nFix a race condition in the i40e driver that leads to MAC/VLAN filters\nbecoming corrupted and leaking. Address the issue that occurs under\nheavy load when multiple threads are concurrently modifying MAC/VLAN\nfilters by setting mac and port VLAN.\n\n1. Thread T0 allocates a filter in i40e_add_filter() within\n        i40e_ndo_set_vf_port_vlan().\n2. Thread T1 concurrently frees the filter in __i40e_del_filter() within\n        i40e_ndo_set_vf_mac().\n3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which\n        refers to the already freed filter memory, causing corruption.\n\nReproduction steps:\n1. Spawn multiple VFs.\n2. Apply a concurrent heavy load by running parallel operations to change\n        MAC addresses on the VFs and change port VLANs on the host.\n3. Observe errors in dmesg:\n\"Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX,\n\tplease set promiscuous on manually for VF XX\".\n\nExact code for stable reproduction Intel can't open-source now.\n\nThe fix involves implementing a new intermediate filter state,\nI40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list.\nThese filters cannot be deleted from the hash list directly but\nmust be removed using the full process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8da3a91-9cd0-4b38-b888-87f4887f17bb",
      "id": "CVE-2022-49290",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: fix potential double free on mesh join\n\nWhile commit 6a01afcf8468 (\"mac80211: mesh: Free ie data when leaving\nmesh\") fixed a memory leak on mesh leave / teardown it introduced a\npotential memory corruption caused by a double free when rejoining the\nmesh:\n\n  ieee80211_leave_mesh()\n  -\u003e kfree(sdata-\u003eu.mesh.ie);\n  ...\n  ieee80211_join_mesh()\n  -\u003e copy_mesh_setup()\n     -\u003e old_ie = ifmsh-\u003eie;\n     -\u003e kfree(old_ie);\n\nThis double free / kernel panics can be reproduced by using wpa_supplicant\nwith an encrypted mesh (if set up without encryption via \"iw\" then\nifmsh-\u003eie is always NULL, which avoids this issue). And then calling:\n\n  $ iw dev mesh0 mesh leave\n  $ iw dev mesh0 mesh join my-mesh\n\nNote that typically these commands are not used / working when using\nwpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going\nthrough a NETDEV_DOWN/NETDEV_UP cycle between a mesh leave and mesh join\nwhere the NETDEV_UP resets the mesh.ie to NULL via a memcpy of\ndefault_mesh_setup in cfg80211_netdev_notifier_call, which then avoids\nthe memory corruption, too.\n\nThe issue was first observed in an application which was not using\nwpa_supplicant but \"Senf\" instead, which implements its own calls to\nnl80211.\n\nFixing the issue by removing the kfree()'ing of the mesh IE in the mesh\njoin function and leaving it solely up to the mesh leave to free the\nmesh IE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c522aa2a-2541-438e-ab30-5910bbeeebe9",
      "id": "CVE-2022-49316",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Don't hold the layoutget locks across multiple RPC calls\n\nWhen doing layoutget as part of the open() compound, we have to be\ncareful to release the layout locks before we can call any further RPC\ncalls, such as setattr(). The reason is that those calls could trigger\na recall, which could deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b4df511-1ba6-47c5-98df-f38d573c65ad",
      "id": "CVE-2022-49471",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw89: cfo: check mac_id to avoid out-of-bounds\n\nSomehow, hardware reports incorrect mac_id and pollute memory. Check index\nbefore we access the array.\n\n  UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23\n  index 188 is out of range for type 's32 [64]'\n  CPU: 1 PID: 51550 Comm: irq/35-rtw89_pc Tainted: G           OE\n  Call Trace:\n   \u003cIRQ\u003e\n   show_stack+0x52/0x58\n   dump_stack_lvl+0x4c/0x63\n   dump_stack+0x10/0x12\n   ubsan_epilogue+0x9/0x45\n   __ubsan_handle_out_of_bounds.cold+0x44/0x49\n   ? __alloc_skb+0x92/0x1d0\n   rtw89_phy_cfo_parse+0x44/0x7f [rtw89_core]\n   rtw89_core_rx+0x261/0x871 [rtw89_core]\n   ? __alloc_skb+0xee/0x1d0\n   rtw89_pci_napi_poll+0x3fa/0x4ea [rtw89_pci]\n   __napi_poll+0x33/0x1a0\n   net_rx_action+0x126/0x260\n   ? __queue_work+0x217/0x4c0\n   __do_softirq+0xd9/0x315\n   ? disable_irq_nosync+0x10/0x10\n   do_softirq.part.0+0x6d/0x90\n   \u003c/IRQ\u003e\n   \u003cTASK\u003e\n   __local_bh_enable_ip+0x62/0x70\n   rtw89_pci_interrupt_threadfn+0x182/0x1a6 [rtw89_pci]\n   irq_thread_fn+0x28/0x60\n   irq_thread+0xc8/0x190\n   ? irq_thread_fn+0x60/0x60\n   kthread+0x16b/0x190\n   ? irq_thread_check_affinity+0xe0/0xe0\n   ? set_kthread_struct+0x50/0x50\n   ret_from_fork+0x22/0x30\n   \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bbf9c5e-e8aa-4bee-af48-d9cddd094443",
      "id": "CVE-2022-49486",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: fsl: Fix refcount leak in imx_sgtl5000_probe\n\nof_find_i2c_device_by_node() takes a reference,\nIn error paths, we should call put_device() to drop\nthe reference to aviod refount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cabec469-1bd7-494e-8486-5f4405f7fe0c",
      "id": "CVE-2022-49592",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix dma queue left shift overflow issue\n\nWhen queue number is \u003e 4, left shift overflows due to 32 bits\ninteger variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1.\n\nIf CONFIG_UBSAN is enabled, kernel dumps below warning:\n[   10.363842] ==================================================================\n[   10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/\nlinux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12\n[   10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int'\n[   10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg\n[   10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021\n[   10.363958] Call Trace:\n[   10.363960]  \u003cTASK\u003e\n[   10.363963]  dump_stack_lvl+0x4a/0x5f\n[   10.363971]  dump_stack+0x10/0x12\n[   10.363974]  ubsan_epilogue+0x9/0x45\n[   10.363976]  __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e\n[   10.363979]  ? wake_up_klogd+0x4a/0x50\n[   10.363983]  ? vprintk_emit+0x8f/0x240\n[   10.363986]  dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac]\n[   10.364001]  stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac]\n[   10.364009]  ? dwmac410_dma_init_channel+0x70/0x70 [stmmac]\n[   10.364020]  stmmac_hw_setup.cold+0xf/0xb14 [stmmac]\n[   10.364030]  ? page_pool_alloc_pages+0x4d/0x70\n[   10.364034]  ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac]\n[   10.364042]  stmmac_open+0x39e/0x920 [stmmac]\n[   10.364050]  __dev_open+0xf0/0x1a0\n[   10.364054]  __dev_change_flags+0x188/0x1f0\n[   10.364057]  dev_change_flags+0x26/0x60\n[   10.364059]  do_setlink+0x908/0xc40\n[   10.364062]  ? do_setlink+0xb10/0xc40\n[   10.364064]  ? __nla_validate_parse+0x4c/0x1a0\n[   10.364068]  __rtnl_newlink+0x597/0xa10\n[   10.364072]  ? __nla_reserve+0x41/0x50\n[   10.364074]  ? __kmalloc_node_track_caller+0x1d0/0x4d0\n[   10.364079]  ? pskb_expand_head+0x75/0x310\n[   10.364082]  ? nla_reserve_64bit+0x21/0x40\n[   10.364086]  ? skb_free_head+0x65/0x80\n[   10.364089]  ? security_sock_rcv_skb+0x2c/0x50\n[   10.364094]  ? __cond_resched+0x19/0x30\n[   10.364097]  ? kmem_cache_alloc_trace+0x15a/0x420\n[   10.364100]  rtnl_newlink+0x49/0x70\n\nThis change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue\nmapping warning.\n\nBugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216195",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d75aaf36-1b52-4164-8224-070b5882559c",
      "id": "CVE-2022-49850",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix deadlock in nilfs_count_free_blocks()\n\nA semaphore deadlock can occur if nilfs_get_block() detects metadata\ncorruption while locating data blocks and a superblock writeback occurs at\nthe same time:\n\ntask 1                               task 2\n------                               ------\n* A file operation *\nnilfs_truncate()\n  nilfs_get_block()\n    down_read(rwsem A) \u003c--\n    nilfs_bmap_lookup_contig()\n      ...                            generic_shutdown_super()\n                                       nilfs_put_super()\n                                         * Prepare to write superblock *\n                                         down_write(rwsem B) \u003c--\n                                         nilfs_cleanup_super()\n      * Detect b-tree corruption *         nilfs_set_log_cursor()\n      nilfs_bmap_convert_error()             nilfs_count_free_blocks()\n        __nilfs_error()                        down_read(rwsem A) \u003c--\n          nilfs_set_error()\n            down_write(rwsem B) \u003c--\n\n                           *** DEADLOCK ***\n\nHere, nilfs_get_block() readlocks rwsem A (= NILFS_MDT(dat_inode)-\u003emi_sem)\nand then calls nilfs_bmap_lookup_contig(), but if it fails due to metadata\ncorruption, __nilfs_error() is called from nilfs_bmap_convert_error()\ninside the lock section.\n\nSince __nilfs_error() calls nilfs_set_error() unless the filesystem is\nread-only and nilfs_set_error() attempts to writelock rwsem B (=\nnilfs-\u003ens_sem) to write back superblock exclusively, hierarchical lock\nacquisition occurs in the order rwsem A -\u003e rwsem B.\n\nNow, if another task starts updating the superblock, it may writelock\nrwsem B during the lock sequence above, and can deadlock trying to\nreadlock rwsem A in nilfs_count_free_blocks().\n\nHowever, there is actually no need to take rwsem A in\nnilfs_count_free_blocks() because it, within the lock section, only reads\na single integer data on a shared struct with\nnilfs_sufile_get_ncleansegs().  This has been the case after commit\naa474a220180 (\"nilfs2: add local variable to cache the number of clean\nsegments\"), that is, even before this bug was introduced.\n\nSo, this resolves the deadlock problem by just not taking the semaphore in\nnilfs_count_free_blocks().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "44b0dbfe-843b-4412-b0a2-14b8f1903fb9",
      "id": "CVE-2022-49957",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: fix strp_init() order and cleanup\n\nstrp_init() is called just a few lines above this csk-\u003esk_user_data\ncheck, it also initializes strp-\u003ework etc., therefore, it is\nunnecessary to call strp_done() to cancel the freshly initialized\nwork.\n\nAnd if sk_user_data is already used by KCM, psock-\u003estrp should not be\ntouched, particularly strp-\u003ework state, so we need to move strp_init()\nafter the csk-\u003esk_user_data check.\n\nThis also makes a lockdep warning reported by syzbot go away.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66d399c1-acfa-4419-b8e7-8514be2ff54f",
      "id": "CVE-2022-49989",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix error exit of privcmd_ioctl_dm_op()\n\nThe error exit of privcmd_ioctl_dm_op() is calling unlock_pages()\npotentially with pages being NULL, leading to a NULL dereference.\n\nAdditionally lock_pages() doesn't check for pin_user_pages_fast()\nhaving been completely successful, resulting in potentially not\nlocking all pages into memory. This could result in sporadic failures\nwhen using the related memory in user mode.\n\nFix all of that by calling unlock_pages() always with the real number\nof pinned pages, which will be zero in case pages being NULL, and by\nchecking the number of pages pinned by pin_user_pages_fast() matching\nthe expected number of pages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ade91195-1c91-4f77-ae3f-9af40807b7fa",
      "id": "CVE-2022-50167",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b0b5d1b-8d19-4d3d-b800-2497488ddec3",
      "id": "CVE-2022-50355",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vt6655: fix some erroneous memory clean-up loops\n\nIn some initialization functions of this driver, memory is allocated with\n'i' acting as an index variable and increasing from 0. The commit in\n\"Fixes\" introduces some clean-up codes in case of allocation failure,\nwhich free memory in reverse order with 'i' decreasing to 0. However,\nthere are some problems:\n  - The case i=0 is left out. Thus memory is leaked.\n  - In case memory allocation fails right from the start, the memory\n    freeing loops will start with i=-1 and invalid memory locations will\n    be accessed.\n\nOne of these loops has been fixed in commit c8ff91535880 (\"staging:\nvt6655: fix potential memory leak\"). Fix the remaining erroneous loops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b80889f8-53d0-4dfb-af4d-22b106c20825",
      "id": "CVE-2022-50412",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: bridge: adv7511: unregister cec i2c device after cec adapter\n\ncec_unregister_adapter() assumes that the underlying adapter ops are\ncallable. For example, if the CEC adapter currently has a valid physical\naddress, then the unregistration procedure will invalidate the physical\naddress by setting it to f.f.f.f. Whence the following kernel oops\nobserved after removing the adv7511 module:\n\n    Unable to handle kernel execution of user memory at virtual address 0000000000000000\n    Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP\n    Call trace:\n     0x0\n     adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]\n     cec_adap_unconfigure+0x44/0x90 [cec]\n     __cec_s_phys_addr.part.0+0x68/0x230 [cec]\n     __cec_s_phys_addr+0x40/0x50 [cec]\n     cec_unregister_adapter+0xb4/0x118 [cec]\n     adv7511_remove+0x60/0x90 [adv7511]\n     i2c_device_remove+0x34/0xe0\n     device_release_driver_internal+0x114/0x1f0\n     driver_detach+0x54/0xe0\n     bus_remove_driver+0x60/0xd8\n     driver_unregister+0x34/0x60\n     i2c_del_driver+0x2c/0x68\n     adv7511_exit+0x1c/0x67c [adv7511]\n     __arm64_sys_delete_module+0x154/0x288\n     invoke_syscall+0x48/0x100\n     el0_svc_common.constprop.0+0x48/0xe8\n     do_el0_svc+0x28/0x88\n     el0_svc+0x1c/0x50\n     el0t_64_sync_handler+0xa8/0xb0\n     el0t_64_sync+0x15c/0x160\n    Code: bad PC value\n    ---[ end trace 0000000000000000 ]---\n\nProtect against this scenario by unregistering i2c_cec after\nunregistering the CEC adapter. Duly disable the CEC clock afterwards\ntoo.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad88ae3f-a08a-4171-aaaf-9a7f96d7a6f1",
      "id": "CVE-2025-37768",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d6177da-1627-4773-8cb4-7dd55b723731",
      "id": "CVE-2023-3090",
      "description": "A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.\n\nThe out-of-bounds write is caused by missing skb-\u003ecb  initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.\n\n\nWe recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4370fda9-5517-4c6c-b198-c3c232eef6ae",
      "id": "CVE-2023-4569",
      "description": "A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "50a547b9-8d5a-47ce-8b61-01875530eaed",
      "id": "CVE-2023-4611",
      "description": "A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec10d654-f948-4957-8a07-9b6225c73896",
      "id": "CVE-2023-52502",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()\n\nSili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.\n\nGetting a reference on the socket found in a lookup while\nholding a lock should happen before releasing the lock.\n\nnfc_llcp_sock_get_sn() has a similar problem.\n\nFinally nfc_llcp_recv_snl() needs to make sure the socket\nfound by nfc_llcp_sock_from_sn() does not disappear.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5e3b59f-eacb-46b9-a98b-a6d14aff2e1b",
      "id": "CVE-2023-52615",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\n\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\n\nFix this by using a stack buffer when calling copy_to_user.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad8f0674-4686-4cce-8962-088fed18944a",
      "id": "CVE-2023-52809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()\n\nfc_lport_ptp_setup() did not check the return value of fc_rport_create()\nwhich can return NULL and would cause a NULL pointer dereference. Address\nthis issue by checking return value of fc_rport_create() and log error\nmessage on fc_rport_create() failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7756bc89-83dd-4c83-ab1e-57ca0c30a7e6",
      "id": "CVE-2023-52825",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix a race condition of vram buffer unref in svm code\n\nprange-\u003esvm_bo unref can happen in both mmu callback and a callback after\nmigrate to system ram. Both are async call in different tasks. Sync svm_bo\nunref operation to avoid random \"use-after-free\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1dcaeb14-3a56-472c-acc6-1cf4530978e1",
      "id": "CVE-2023-53007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Make sure trace_printk() can output as soon as it can be used\n\nCurrently trace_printk() can be used as soon as early_trace_init() is\ncalled from start_kernel(). But if a crash happens, and\n\"ftrace_dump_on_oops\" is set on the kernel command line, all you get will\nbe:\n\n  [    0.456075]   \u003cidle\u003e-0         0dN.2. 347519us : Unknown type 6\n  [    0.456075]   \u003cidle\u003e-0         0dN.2. 353141us : Unknown type 6\n  [    0.456075]   \u003cidle\u003e-0         0dN.2. 358684us : Unknown type 6\n\nThis is because the trace_printk() event (type 6) hasn't been registered\nyet. That gets done via an early_initcall(), which may be early, but not\nearly enough.\n\nInstead of registering the trace_printk() event (and other ftrace events,\nwhich are not trace events) via an early_initcall(), have them registered at\nthe same time that trace_printk() can be used. This way, if there is a\ncrash before early_initcall(), then the trace_printk()s will actually be\nuseful.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "163cf733-1615-46e2-88c6-88835bed52b6",
      "id": "CVE-2023-53021",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_taprio: fix possible use-after-free\n\nsyzbot reported a nasty crash [1] in net_tx_action() which\nmade little sense until we got a repro.\n\nThis repro installs a taprio qdisc, but providing an\ninvalid TCA_RATE attribute.\n\nqdisc_create() has to destroy the just initialized\ntaprio qdisc, and taprio_destroy() is called.\n\nHowever, the hrtimer used by taprio had already fired,\ntherefore advance_sched() called __netif_schedule().\n\nThen net_tx_action was trying to use a destroyed qdisc.\n\nWe can not undo the __netif_schedule(), so we must wait\nuntil one cpu serviced the qdisc before we can proceed.\n\nMany thanks to Alexander Potapenko for his help.\n\n[1]\nBUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]\nBUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline]\nBUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]\nBUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138\n queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]\n do_raw_spin_trylock include/linux/spinlock.h:191 [inline]\n __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]\n _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138\n spin_trylock include/linux/spinlock.h:359 [inline]\n qdisc_run_begin include/net/sch_generic.h:187 [inline]\n qdisc_run+0xee/0x540 include/net/pkt_sched.h:125\n net_tx_action+0x77c/0x9a0 net/core/dev.c:5086\n __do_softirq+0x1cc/0x7fb kernel/softirq.c:571\n run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934\n smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164\n kthread+0x31b/0x430 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:732 [inline]\n slab_alloc_node mm/slub.c:3258 [inline]\n __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970\n kmalloc_reserve net/core/skbuff.c:358 [inline]\n __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430\n alloc_skb include/linux/skbuff.h:1257 [inline]\n nlmsg_new include/net/netlink.h:953 [inline]\n netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436\n netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507\n rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482\n ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536\n __sys_sendmsg net/socket.c:2565 [inline]\n __do_sys_sendmsg net/socket.c:2574 [inline]\n __se_sys_sendmsg net/socket.c:2572 [inline]\n __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nCPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a8d9874-ae73-4bef-a19e-cf420ee7cdd6",
      "id": "CVE-2023-53218",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Make it so that a waiting process can be aborted\n\nWhen sendmsg() creates an rxrpc call, it queues it to wait for a connection\nand channel to be assigned and then waits before it can start shovelling\ndata as the encrypted DATA packet content includes a summary of the\nconnection parameters.\n\nHowever, sendmsg() may get interrupted before a connection gets assigned\nand further sendmsg() calls will fail with EBUSY until an assignment is\nmade.\n\nFix this so that the call can at least be aborted without failing on\nEBUSY.  We have to be careful here as sendmsg() mustn't be allowed to start\nthe call timer if the call doesn't yet have a connection assigned as an\noops may follow shortly thereafter.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e411f18c-b2ba-476e-90b2-6b07ad2a22d6",
      "id": "CVE-2023-53302",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwl4965: Add missing check for create_singlethread_workqueue()\n\nAdd the check for the return value of the create_singlethread_workqueue()\nin order to avoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4d9f5ee-9ed4-4435-acdb-7ef0e4e5f197",
      "id": "CVE-2023-6200",
      "description": "A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6aa28987-09ad-475a-bdc0-a27255c9edf9",
      "id": "CVE-2024-26884",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix hashtab overflow check on 32-bit arches\n\nThe hashtab code relies on roundup_pow_of_two() to compute the number of\nhash buckets, and contains an overflow check by checking if the\nresulting value is 0. However, on 32-bit arches, the roundup code itself\ncan overflow by doing a 32-bit left-shift of an unsigned long value,\nwhich is undefined behaviour, so it is not guaranteed to truncate\nneatly. This was triggered by syzbot on the DEVMAP_HASH type, which\ncontains the same check, copied from the hashtab code. So apply the same\nfix to hashtab, by moving the overflow check to before the roundup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d217f643-6f46-436d-a690-fdb489f7f399",
      "id": "CVE-2024-23196",
      "description": "A race condition was found in the Linux kernel's sound/hda  device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac3870c2-d758-4c6e-988d-1cf07d1687ac",
      "id": "CVE-2024-24860",
      "description": "A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4059344c-3fb8-4181-9f28-09183ac0099e",
      "id": "CVE-2024-26584",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: handle backlogging of crypto requests\n\nSince we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our\nrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return\n -EBUSY instead of -EINPROGRESS in valid situations. For example, when\nthe cryptd queue for AESNI is full (easy to trigger with an\nartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued\nto the backlog but still processed. In that case, the async callback\nwill also be called twice: first with err == -EINPROGRESS, which it\nseems we can just ignore, then with err == 0.\n\nCompared to Sabrina's original patch this version uses the new\ntls_*crypt_async_wait() helpers and converts the EBUSY to\nEINPROGRESS to avoid having to modify all the error handling\npaths. The handling is identical.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "18865d41-87db-4388-b087-4513560d1874",
      "id": "CVE-2024-26736",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Increase buffer size in afs_update_volume_status()\n\nThe max length of volume-\u003evid value is 20 characters.\nSo increase idbuf[] size up to 24 to avoid overflow.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c88686d-9774-4589-a3c1-f931f31e4271",
      "id": "CVE-2024-26817",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\namdkfd: use calloc instead of kzalloc to avoid integer overflow\n\nThis uses calloc instead of doing the multiplication which might\noverflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3b44823a-3252-45b5-ae3e-e68f1e1c16dc",
      "id": "CVE-2024-26844",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix WARNING in _copy_from_iter\n\nSyzkaller reports a warning in _copy_from_iter because an\niov_iter is supposedly used in the wrong direction. The reason\nis that syzcaller managed to generate a request with\na transfer direction of SG_DXFER_TO_FROM_DEV. This instructs\nthe kernel to copy user buffers into the kernel, read into\nthe copied buffers and then copy the data back to user space.\n\nThus the iovec is used in both directions.\n\nDetect this situation in the block layer and construct a new\niterator with the correct direction for the copy-in.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f5b580f-cad8-45b1-b591-619269a88f6d",
      "id": "CVE-2024-26973",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfat: fix uninitialized field in nostale filehandles\n\nWhen fat_encode_fh_nostale() encodes file handle without a parent it\nstores only first 10 bytes of the file handle. However the length of the\nfile handle must be a multiple of 4 so the file handle is actually 12\nbytes long and the last two bytes remain uninitialized. This is not\ngreat at we potentially leak uninitialized information with the handle\nto userspace. Properly initialize the full handle length.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f2875b1e-4f39-4170-bb5e-b3416840aba9",
      "id": "CVE-2024-27043",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: edia: dvbdev: fix a use-after-free\n\nIn dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed\nin several error-handling paths. However, *pdvbdev is not set to NULL\nafter dvbdev's deallocation, causing use-after-frees in many places,\nfor example, in the following call chain:\n\nbudget_register\n  |-\u003e dvb_dmxdev_init\n        |-\u003e dvb_register_device\n  |-\u003e dvb_dmxdev_release\n        |-\u003e dvb_unregister_device\n              |-\u003e dvb_remove_device\n                    |-\u003e dvb_device_put\n                          |-\u003e kref_put\n\nWhen calling dvb_unregister_device, dmxdev-\u003edvbdev (i.e. *pdvbdev in\ndvb_register_device) could point to memory that had been freed in\ndvb_register_device. Thereafter, this pointer is transferred to\nkref_put and triggering a use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec8ba79a-8cfc-4a00-a056-92fcdb8028ba",
      "id": "CVE-2024-35819",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: fsl: qbman: Use raw spinlock for cgr_lock\n\nsmp_call_function always runs its callback in hard IRQ context, even on\nPREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock\nfor cgr_lock to ensure we aren't waiting on a sleeping task.\n\nAlthough this bug has existed for a while, it was not apparent until\ncommit ef2a8d5478b9 (\"net: dpaa: Adjust queue depth on rate change\")\nwhich invokes smp_call_function_single via qman_update_cgr_safe every\ntime a link goes up or down.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54dcf19f-473b-4719-80a1-26377f26abf3",
      "id": "CVE-2024-35899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: flush pending destroy work before exit_net release\n\nSimilar to 2c9f0293280e (\"netfilter: nf_tables: flush pending destroy\nwork before netlink notifier\") to address a race between exit_net and\nthe destroy workqueue.\n\nThe trace below shows an element to be released via destroy workqueue\nwhile exit_net path (triggered via module removal) has already released\nthe set that is used in such transaction.\n\n[ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]\n[ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465\n[ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359\n[ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables]\n[ 1360.547984] Call Trace:\n[ 1360.547991]  \u003cTASK\u003e\n[ 1360.547998]  dump_stack_lvl+0x53/0x70\n[ 1360.548014]  print_report+0xc4/0x610\n[ 1360.548026]  ? __virt_addr_valid+0xba/0x160\n[ 1360.548040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 1360.548054]  ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]\n[ 1360.548176]  kasan_report+0xae/0xe0\n[ 1360.548189]  ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]\n[ 1360.548312]  nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables]\n[ 1360.548447]  ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables]\n[ 1360.548577]  ? _raw_spin_unlock_irq+0x18/0x30\n[ 1360.548591]  process_one_work+0x2f1/0x670\n[ 1360.548610]  worker_thread+0x4d3/0x760\n[ 1360.548627]  ? __pfx_worker_thread+0x10/0x10\n[ 1360.548640]  kthread+0x16b/0x1b0\n[ 1360.548653]  ? __pfx_kthread+0x10/0x10\n[ 1360.548665]  ret_from_fork+0x2f/0x50\n[ 1360.548679]  ? __pfx_kthread+0x10/0x10\n[ 1360.548690]  ret_from_fork_asm+0x1a/0x30\n[ 1360.548707]  \u003c/TASK\u003e\n\n[ 1360.548719] Allocated by task 192061:\n[ 1360.548726]  kasan_save_stack+0x20/0x40\n[ 1360.548739]  kasan_save_track+0x14/0x30\n[ 1360.548750]  __kasan_kmalloc+0x8f/0xa0\n[ 1360.548760]  __kmalloc_node+0x1f1/0x450\n[ 1360.548771]  nf_tables_newset+0x10c7/0x1b50 [nf_tables]\n[ 1360.548883]  nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink]\n[ 1360.548909]  nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink]\n[ 1360.548927]  netlink_unicast+0x367/0x4f0\n[ 1360.548935]  netlink_sendmsg+0x34b/0x610\n[ 1360.548944]  ____sys_sendmsg+0x4d4/0x510\n[ 1360.548953]  ___sys_sendmsg+0xc9/0x120\n[ 1360.548961]  __sys_sendmsg+0xbe/0x140\n[ 1360.548971]  do_syscall_64+0x55/0x120\n[ 1360.548982]  entry_SYSCALL_64_after_hwframe+0x55/0x5d\n\n[ 1360.548994] Freed by task 192222:\n[ 1360.548999]  kasan_save_stack+0x20/0x40\n[ 1360.549009]  kasan_save_track+0x14/0x30\n[ 1360.549019]  kasan_save_free_info+0x3b/0x60\n[ 1360.549028]  poison_slab_object+0x100/0x180\n[ 1360.549036]  __kasan_slab_free+0x14/0x30\n[ 1360.549042]  kfree+0xb6/0x260\n[ 1360.549049]  __nft_release_table+0x473/0x6a0 [nf_tables]\n[ 1360.549131]  nf_tables_exit_net+0x170/0x240 [nf_tables]\n[ 1360.549221]  ops_exit_list+0x50/0xa0\n[ 1360.549229]  free_exit_list+0x101/0x140\n[ 1360.549236]  unregister_pernet_operations+0x107/0x160\n[ 1360.549245]  unregister_pernet_subsys+0x1c/0x30\n[ 1360.549254]  nf_tables_module_exit+0x43/0x80 [nf_tables]\n[ 1360.549345]  __do_sys_delete_module+0x253/0x370\n[ 1360.549352]  do_syscall_64+0x55/0x120\n[ 1360.549360]  entry_SYSCALL_64_after_hwframe+0x55/0x5d\n\n(gdb) list *__nft_release_table+0x473\n0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354).\n11349           list_for_each_entry_safe(flowtable, nf, \u0026table-\u003eflowtables, list) {\n11350                   list_del(\u0026flowtable-\u003elist);\n11351                   nft_use_dec(\u0026table-\u003euse);\n11352                   nf_tables_flowtable_destroy(flowtable);\n11353           }\n11354           list_for_each_entry_safe(set, ns, \u0026table-\u003esets, list) {\n11355                   list_del(\u0026set-\u003elist);\n11356                   nft_use_dec(\u0026table-\u003euse);\n11357                   if (set-\u003eflags \u0026 (NFT_SET_MAP | NFT_SET_OBJECT))\n11358                           nft_map_deactivat\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff9b4ed4-1472-40f3-a307-aa4f87ba5b75",
      "id": "CVE-2024-36915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix nfc_llcp_setsockopt() unsafe copies\n\nsyzbot reported unsafe calls to copy_from_sockptr() [1]\n\nUse copy_safe_from_sockptr() instead.\n\n[1]\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255\nRead of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078\n\nCPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255\n  do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfd/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\nRIP: 0033:0x7f7fac07fd89\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89\nRDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004\nRBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab41c675-4a15-483e-ba5b-dbf00208dae2",
      "id": "CVE-2024-56636",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: do not assume mac header is set in geneve_xmit_skb()\n\nWe should not assume mac header is set in output path.\n\nUse skb_eth_hdr() instead of eth_hdr() to fix the issue.\n\nsysbot reported the following :\n\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 skb_mac_header include/linux/skbuff.h:3052 [inline]\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 eth_hdr include/linux/if_ether.h:24 [inline]\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 geneve_xmit_skb drivers/net/geneve.c:898 [inline]\n WARNING: CPU: 0 PID: 11635 at include/linux/skbuff.h:3052 geneve_xmit+0x4c38/0x5730 drivers/net/geneve.c:1039\nModules linked in:\nCPU: 0 UID: 0 PID: 11635 Comm: syz.4.1423 Not tainted 6.12.0-syzkaller-10296-gaaf20f870da0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_mac_header include/linux/skbuff.h:3052 [inline]\n RIP: 0010:eth_hdr include/linux/if_ether.h:24 [inline]\n RIP: 0010:geneve_xmit_skb drivers/net/geneve.c:898 [inline]\n RIP: 0010:geneve_xmit+0x4c38/0x5730 drivers/net/geneve.c:1039\nCode: 21 c6 02 e9 35 d4 ff ff e8 a5 48 4c fb 90 0f 0b 90 e9 fd f5 ff ff e8 97 48 4c fb 90 0f 0b 90 e9 d8 f5 ff ff e8 89 48 4c fb 90 \u003c0f\u003e 0b 90 e9 41 e4 ff ff e8 7b 48 4c fb 90 0f 0b 90 e9 cd e7 ff ff\nRSP: 0018:ffffc90003b2f870 EFLAGS: 00010283\nRAX: 000000000000037a RBX: 000000000000ffff RCX: ffffc9000dc3d000\nRDX: 0000000000080000 RSI: ffffffff86428417 RDI: 0000000000000003\nRBP: ffffc90003b2f9f0 R08: 0000000000000003 R09: 000000000000ffff\nR10: 000000000000ffff R11: 0000000000000002 R12: ffff88806603c000\nR13: 0000000000000000 R14: ffff8880685b2780 R15: 0000000000000e23\nFS:  00007fdc2deed6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b30a1dff8 CR3: 0000000056b8c000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n  __dev_direct_xmit+0x58a/0x720 net/core/dev.c:4490\n  dev_direct_xmit include/linux/netdevice.h:3181 [inline]\n  packet_xmit+0x1e4/0x360 net/packet/af_packet.c:285\n  packet_snd net/packet/af_packet.c:3146 [inline]\n  packet_sendmsg+0x2700/0x5660 net/packet/af_packet.c:3178\n  sock_sendmsg_nosec net/socket.c:711 [inline]\n  __sock_sendmsg net/socket.c:726 [inline]\n  __sys_sendto+0x488/0x4f0 net/socket.c:2197\n  __do_sys_sendto net/socket.c:2204 [inline]\n  __se_sys_sendto net/socket.c:2200 [inline]\n  __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2200\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "230e25b1-78bf-460b-baf2-0489f6f41347",
      "id": "CVE-2024-39469",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors\n\nThe error handling in nilfs_empty_dir() when a directory folio/page read\nfails is incorrect, as in the old ext2 implementation, and if the\nfolio/page cannot be read or nilfs_check_folio() fails, it will falsely\ndetermine the directory as empty and corrupt the file system.\n\nIn addition, since nilfs_empty_dir() does not immediately return on a\nfailed folio/page read, but continues to loop, this can cause a long loop\nwith I/O if i_size of the directory's inode is also corrupted, causing the\nlog writer thread to wait and hang, as reported by syzbot.\n\nFix these issues by making nilfs_empty_dir() immediately return a false\nvalue (0) if it fails to get a directory folio/page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07c13149-a454-479a-af91-28348154f9a8",
      "id": "CVE-2024-40918",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Try to fix random segmentation faults in package builds\n\nPA-RISC systems with PA8800 and PA8900 processors have had problems\nwith random segmentation faults for many years.  Systems with earlier\nprocessors are much more stable.\n\nSystems with PA8800 and PA8900 processors have a large L2 cache which\nneeds per page flushing for decent performance when a large range is\nflushed. The combined cache in these systems is also more sensitive to\nnon-equivalent aliases than the caches in earlier systems.\n\nThe majority of random segmentation faults that I have looked at\nappear to be memory corruption in memory allocated using mmap and\nmalloc.\n\nMy first attempt at fixing the random faults didn't work. On\nreviewing the cache code, I realized that there were two issues\nwhich the existing code didn't handle correctly. Both relate\nto cache move-in. Another issue is that the present bit in PTEs\nis racy.\n\n1) PA-RISC caches have a mind of their own and they can speculatively\nload data and instructions for a page as long as there is a entry in\nthe TLB for the page which allows move-in. TLBs are local to each\nCPU. Thus, the TLB entry for a page must be purged before flushing\nthe page. This is particularly important on SMP systems.\n\nIn some of the flush routines, the flush routine would be called\nand then the TLB entry would be purged. This was because the flush\nroutine needed the TLB entry to do the flush.\n\n2) My initial approach to trying the fix the random faults was to\ntry and use flush_cache_page_if_present for all flush operations.\nThis actually made things worse and led to a couple of hardware\nlockups. It finally dawned on me that some lines weren't being\nflushed because the pte check code was racy. This resulted in\nrandom inequivalent mappings to physical pages.\n\nThe __flush_cache_page tmpalias flush sets up its own TLB entry\nand it doesn't need the existing TLB entry. As long as we can find\nthe pte pointer for the vm page, we can get the pfn and physical\naddress of the page. We can also purge the TLB entry for the page\nbefore doing the flush. Further, __flush_cache_page uses a special\nTLB entry that inhibits cache move-in.\n\nWhen switching page mappings, we need to ensure that lines are\nremoved from the cache.  It is not sufficient to just flush the\nlines to memory as they may come back.\n\nThis made it clear that we needed to implement all the required\nflush operations using tmpalias routines. This includes flushes\nfor user and kernel pages.\n\nAfter modifying the code to use tmpalias flushes, it became clear\nthat the random segmentation faults were not fully resolved. The\nfrequency of faults was worse on systems with a 64 MB L2 (PA8900)\nand systems with more CPUs (rp4440).\n\nThe warning that I added to flush_cache_page_if_present to detect\npages that couldn't be flushed triggered frequently on some systems.\n\nHelge and I looked at the pages that couldn't be flushed and found\nthat the PTE was either cleared or for a swap page. Ignoring pages\nthat were swapped out seemed okay but pages with cleared PTEs seemed\nproblematic.\n\nI looked at routines related to pte_clear and noticed ptep_clear_flush.\nThe default implementation just flushes the TLB entry. However, it was\nobvious that on parisc we need to flush the cache page as well. If\nwe don't flush the cache page, stale lines will be left in the cache\nand cause random corruption. Once a PTE is cleared, there is no way\nto find the physical address associated with the PTE and flush the\nassociated page at a later time.\n\nI implemented an updated change with a parisc specific version of\nptep_clear_flush. It fixed the random data corruption on Helge's rp4440\nand rp3440, as well as on my c8000.\n\nAt this point, I realized that I could restore the code where we only\nflush in flush_cache_page_if_present if the page has been accessed.\nHowever, for this, we also need to flush the cache when the accessed\nbit is cleared in\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4042eff7-d779-47a1-8e9e-a2ead41ad165",
      "id": "CVE-2024-40945",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Return right value in iommu_sva_bind_device()\n\niommu_sva_bind_device() should return either a sva bond handle or an\nERR_PTR value in error cases. Existing drivers (idxd and uacce) only\ncheck the return value with IS_ERR(). This could potentially lead to\na kernel NULL pointer dereference issue if the function returns NULL\ninstead of an error pointer.\n\nIn reality, this doesn't cause any problems because iommu_sva_bind_device()\nonly returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.\nIn this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will\nreturn an error, and the device drivers won't call iommu_sva_bind_device()\nat all.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee21ad7f-3a85-43c6-b9e7-725c33ed7391",
      "id": "CVE-2024-40953",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()\n\nUse {READ,WRITE}_ONCE() to access kvm-\u003elast_boosted_vcpu to ensure the\nloads and stores are atomic.  In the extremely unlikely scenario the\ncompiler tears the stores, it's theoretically possible for KVM to attempt\nto get a vCPU using an out-of-bounds index, e.g. if the write is split\ninto multiple 8-bit stores, and is paired with a 32-bit load on a VM with\n257 vCPUs:\n\n  CPU0                              CPU1\n  last_boosted_vcpu = 0xff;\n\n                                    (last_boosted_vcpu = 0x100)\n                                    last_boosted_vcpu[15:8] = 0x01;\n  i = (last_boosted_vcpu = 0x1ff)\n                                    last_boosted_vcpu[7:0] = 0x00;\n\n  vcpu = kvm-\u003evcpu_array[0x1ff];\n\nAs detected by KCSAN:\n\n  BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]\n\n  write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:\n  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm\n  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\n  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\n\t\t arch/x86/kvm/vmx/vmx.c:6606) kvm_intel\n  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\n  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\n  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\n  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\n  __x64_sys_ioctl (fs/ioctl.c:890)\n  x64_sys_call (arch/x86/entry/syscall_64.c:33)\n  do_syscall_64 (arch/x86/entry/common.c:?)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n  read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:\n  kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm\n  handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel\n  vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?\n\t\t\tarch/x86/kvm/vmx/vmx.c:6606) kvm_intel\n  vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm\n  kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm\n  kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm\n  __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)\n  __x64_sys_ioctl (fs/ioctl.c:890)\n  x64_sys_call (arch/x86/entry/syscall_64.c:33)\n  do_syscall_64 (arch/x86/entry/common.c:?)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n  value changed: 0x00000012 -\u003e 0x00000000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b1c4588-f732-4ee6-b715-e8d5d01d05ed",
      "id": "CVE-2024-46720",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix dereference after null check\n\ncheck the pointer hive before use.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02237687-de37-44c0-9b82-cef19c03125d",
      "id": "CVE-2024-42121",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check index msg_id before read or write\n\n[WHAT]\nmsg_id is used as an array index and it cannot be a negative value, and\ntherefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1).\n\n[HOW]\nCheck whether msg_id is valid before reading and setting.\n\nThis fixes 4 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7e18cd3-f1c0-4653-8e2f-370331bb2883",
      "id": "CVE-2024-46811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box\n\n[Why]\nCoverity reports OVERRUN warning. soc.num_states could\nbe 40. But array range of bw_params-\u003eclk_table.entries is 8.\n\n[How]\nAssert if soc.num_states greater than 8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5373ff46-b0bf-4724-90a3-345375a97bb0",
      "id": "CVE-2024-42123",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix double free err_addr pointer warnings\n\nIn amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages\nwill be run many times so that double free err_addr in some special case.\nSo set the err_addr to NULL to avoid the warnings.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f73f2b3-5743-4eec-bc83-83e6114c3f0e",
      "id": "CVE-2024-42283",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Initialize all fields in dumped nexthops\n\nstruct nexthop_grp contains two reserved fields that are not initialized by\nnla_put_nh_group(), and carry garbage. This can be observed e.g. with\nstrace (edited for clarity):\n\n    # ip nexthop add id 1 dev lo\n    # ip nexthop add id 101 group 1\n    # strace -e recvmsg ip nexthop get id 101\n    ...\n    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},\n                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52\n\nThe fields are reserved and therefore not currently used. But as they are, they\nleak kernel memory, and the fact they are not just zero complicates repurposing\nof the fields for new ends. Initialize the full structure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58e21ae3-b045-4f5d-b4a4-b6d2a2779157",
      "id": "CVE-2024-42310",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes\n\nIn cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference on\nfailure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "130daa49-b26c-4c23-b000-5770df72707b",
      "id": "CVE-2024-43856",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n  kokonut //net/encryption\n    http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6b4446a-596b-4187-b916-27120d431af8",
      "id": "CVE-2024-43879",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()\n\nCurrently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in\ncfg80211_calculate_bitrate_he(), leading to below warning:\n\nkernel: invalid HE MCS: bw:6, ru:6\nkernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]\n\nFix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c475c574-cd0b-4732-b528-2770aab06979",
      "id": "CVE-2024-43909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: Fix the null pointer dereference for smu7\n\noptimize the code to avoid pass a null pointer (hwmgr-\u003ebackend)\nto function smu7_update_edc_leakage_table.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ef1325b-26f6-492a-9854-329fea6ef07b",
      "id": "CVE-2024-44999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: pull network headers in gtp_dev_xmit()\n\nsyzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1]\n\nWe must make sure the IPv4 or Ipv6 header is pulled in skb-\u003ehead\nbefore accessing fields in them.\n\nUse pskb_inet_may_pull() to fix this issue.\n\n[1]\nBUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline]\n BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]\n BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281\n  ipv6_pdp_find drivers/net/gtp.c:220 [inline]\n  gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline]\n  gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281\n  __netdev_start_xmit include/linux/netdevice.h:4913 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4922 [inline]\n  xmit_one net/core/dev.c:3580 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596\n  __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423\n  dev_queue_xmit include/linux/netdevice.h:3105 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3145 [inline]\n  packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2204\n  __do_sys_sendto net/socket.c:2216 [inline]\n  __se_sys_sendto net/socket.c:2212 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212\n  x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3994 [inline]\n  slab_alloc_node mm/slub.c:4037 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674\n  alloc_skb include/linux/skbuff.h:1320 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815\n  packet_alloc_skb net/packet/af_packet.c:2994 [inline]\n  packet_snd net/packet/af_packet.c:3088 [inline]\n  packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2204\n  __do_sys_sendto net/socket.c:2216 [inline]\n  __se_sys_sendto net/socket.c:2212 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212\n  x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "18429bf8-6e09-4118-a819-1466b60f09e7",
      "id": "CVE-2024-45028",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmc_test: Fix NULL dereference on allocation failure\n\nIf the \"test-\u003ehighmem = alloc_pages()\" allocation fails then calling\n__free_pages(test-\u003ehighmem) will result in a NULL dereference.  Also\nchange the error code to -ENOMEM instead of returning success.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1bbebfd0-c7cc-497a-bab0-c53189258927",
      "id": "CVE-2024-46737",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix kernel crash if commands allocation fails\n\nIf the commands allocation fails in nvmet_tcp_alloc_cmds()\nthe kernel crashes in nvmet_tcp_release_queue_work() because of\na NULL pointer dereference.\n\n  nvmet: failed to install queue 0 cntlid 1 ret 6\n  Unable to handle kernel NULL pointer dereference at\n         virtual address 0000000000000008\n\nFix the bug by setting queue-\u003enr_cmds to zero in case\nnvmet_tcp_alloc_cmd() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4de2780-3595-4578-bb07-c4b5218d4d34",
      "id": "CVE-2025-22038",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate zero num_subauth before sub_auth is accessed\n\nAccess psid-\u003esub_auth[psid-\u003enum_subauth - 1] without checking\nif num_subauth is non-zero leads to an out-of-bounds read.\nThis patch adds a validation step to ensure num_subauth != 0\nbefore sub_auth is accessed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e05c99d0-86c8-4751-b1a9-51a2fa307b81",
      "id": "CVE-2024-50205",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()\n\nThe step variable is initialized to zero. It is changed in the loop,\nbut if it's not changed it will remain zero. Add a variable check\nbefore the division.\n\nThe observed behavior was introduced by commit 826b5de90c0b\n(\"ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size\"),\nand it is difficult to show that any of the interval parameters will\nsatisfy the snd_interval_test() condition with data from the\namdtp_rate_table[] table.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f5b2a1c9-3415-4bc5-8e86-f9ed619cc50b",
      "id": "CVE-2024-50279",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix out-of-bounds access to the dirty bitset when resizing\n\ndm-cache checks the dirty bits of the cache blocks to be dropped when\nshrinking the fast device, but an index bug in bitset iteration causes\nout-of-bounds access.\n\nReproduce steps:\n\n1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. shrink the fast device to 512 cache blocks, triggering out-of-bounds\n   access to the dirty bitset (offset 0x80)\n\ndmsetup suspend cache\ndmsetup reload cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup resume cdata\ndmsetup resume cache\n\nKASAN reports:\n\n  BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0\n  Read of size 8 at addr ffffc900000f3080 by task dmsetup/131\n\n  (...snip...)\n  The buggy address belongs to the virtual mapping at\n   [ffffc900000f3000, ffffc900000f5000) created by:\n   cache_ctr+0x176a/0x35f0\n\n  (...snip...)\n  Memory state around the buggy address:\n   ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  \u003effffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                     ^\n   ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\nFix by making the index post-incremented.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f006093-268e-4722-9478-d4eb1eca5a4c",
      "id": "CVE-2024-53052",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: fix missing NOWAIT check for O_DIRECT start write\n\nWhen io_uring starts a write, it'll call kiocb_start_write() to bump the\nsuper block rwsem, preventing any freezes from happening while that\nwrite is in-flight. The freeze side will grab that rwsem for writing,\nexcluding any new writers from happening and waiting for existing writes\nto finish. But io_uring unconditionally uses kiocb_start_write(), which\nwill block if someone is currently attempting to freeze the mount point.\nThis causes a deadlock where freeze is waiting for previous writes to\ncomplete, but the previous writes cannot complete, as the task that is\nsupposed to complete them is blocked waiting on starting a new write.\nThis results in the following stuck trace showing that dependency with\nthe write blocked starting a new write:\n\ntask:fio             state:D stack:0     pid:886   tgid:886   ppid:876\nCall trace:\n __switch_to+0x1d8/0x348\n __schedule+0x8e8/0x2248\n schedule+0x110/0x3f0\n percpu_rwsem_wait+0x1e8/0x3f8\n __percpu_down_read+0xe8/0x500\n io_write+0xbb8/0xff8\n io_issue_sqe+0x10c/0x1020\n io_submit_sqes+0x614/0x2110\n __arm64_sys_io_uring_enter+0x524/0x1038\n invoke_syscall+0x74/0x268\n el0_svc_common.constprop.0+0x160/0x238\n do_el0_svc+0x44/0x60\n el0_svc+0x44/0xb0\n el0t_64_sync_handler+0x118/0x128\n el0t_64_sync+0x168/0x170\nINFO: task fsfreeze:7364 blocked for more than 15 seconds.\n      Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963\n\nwith the attempting freezer stuck trying to grab the rwsem:\n\ntask:fsfreeze        state:D stack:0     pid:7364  tgid:7364  ppid:995\nCall trace:\n __switch_to+0x1d8/0x348\n __schedule+0x8e8/0x2248\n schedule+0x110/0x3f0\n percpu_down_write+0x2b0/0x680\n freeze_super+0x248/0x8a8\n do_vfs_ioctl+0x149c/0x1b18\n __arm64_sys_ioctl+0xd0/0x1a0\n invoke_syscall+0x74/0x268\n el0_svc_common.constprop.0+0x160/0x238\n do_el0_svc+0x44/0x60\n el0_svc+0x44/0xb0\n el0t_64_sync_handler+0x118/0x128\n el0t_64_sync+0x168/0x170\n\nFix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a\nblocking grab of the super block rwsem if it isn't set. For normal issue\nwhere IOCB_NOWAIT would always be set, this returns -EAGAIN which will\nhave io_uring core issue a blocking attempt of the write. That will in\nturn also get completions run, ensuring forward progress.\n\nSince freezing requires CAP_SYS_ADMIN in the first place, this isn't\nsomething that can be triggered by a regular user.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d75efd1-285a-44e4-806b-05a522280ff0",
      "id": "CVE-2024-53063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: prevent the risk of out of memory access\n\nThe dvbdev contains a static variable used to store dvb minors.\n\nThe behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set\nor not. When not set, dvb_register_device() won't check for\nboundaries, as it will rely that a previous call to\ndvb_register_adapter() would already be enforcing it.\n\nOn a similar way, dvb_device_open() uses the assumption\nthat the register functions already did the needed checks.\n\nThis can be fragile if some device ends using different\ncalls. This also generate warnings on static check analysers\nlike Coverity.\n\nSo, add explicit guards to prevent potential risk of OOM issues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf76f1a4-e08c-4474-86e3-2ca6f861dc4b",
      "id": "CVE-2024-56623",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use after free on unload\n\nSystem crash is observed with stack trace warning of use after\nfree. There are 2 signals to tell dpc_thread to terminate (UNLOADING\nflag and kthread_stop).\n\nOn setting the UNLOADING flag when dpc_thread happens to run at the time\nand sees the flag, this causes dpc_thread to exit and clean up\nitself. When kthread_stop is called for final cleanup, this causes use\nafter free.\n\nRemove UNLOADING signal to terminate dpc_thread.  Use the kthread_stop\nas the main signal to exit dpc_thread.\n\n[596663.812935] kernel BUG at mm/slub.c:294!\n[596663.812950] invalid opcode: 0000 [#1] SMP PTI\n[596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-240.el8.x86_64 #1\n[596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012\n[596663.812974] RIP: 0010:__slab_free+0x17d/0x360\n\n...\n[596663.813008] Call Trace:\n[596663.813022]  ? __dentry_kill+0x121/0x170\n[596663.813030]  ? _cond_resched+0x15/0x30\n[596663.813034]  ? _cond_resched+0x15/0x30\n[596663.813039]  ? wait_for_completion+0x35/0x190\n[596663.813048]  ? try_to_wake_up+0x63/0x540\n[596663.813055]  free_task+0x5a/0x60\n[596663.813061]  kthread_stop+0xf3/0x100\n[596663.813103]  qla2x00_remove_one+0x284/0x440 [qla2xxx]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e2fcc11-1be5-46eb-993e-d29dc942ae70",
      "id": "CVE-2024-56720",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Several fixes to bpf_msg_pop_data\n\nSeveral fixes to bpf_msg_pop_data,\n1. In sk_msg_shift_left, we should put_page\n2. if (len == 0), return early is better\n3. pop the entire sk_msg (last == msg-\u003esg.size) should be supported\n4. Fix for the value of variable \"a\"\n5. In sk_msg_shift_left, after shifting, i has already pointed to the next\nelement. Addtional sk_msg_iter_var_next may result in BUG.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f5e5a38-4970-42d0-b4f7-dbe4ccd41f02",
      "id": "CVE-2024-56756",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix freeing of the HMB descriptor table\n\nThe HMB descriptor table is sized to the maximum number of descriptors\nthat could be used for a given device, but __nvme_alloc_host_mem could\nbreak out of the loop earlier on memory allocation failure and end up\nusing less descriptors than planned for, which leads to an incorrect\nsize passed to dma_free_coherent.\n\nIn practice this was not showing up because the number of descriptors\ntends to be low and the dma coherent allocator always allocates and\nfrees at least a page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc96e413-0ec9-488d-8734-63f3219c58b3",
      "id": "CVE-2024-57911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer\n\nThe 'data' array is allocated via kmalloc() and it is used to push data\nto user space from a triggered buffer, but it does not set values for\ninactive channels, as it only uses iio_for_each_active_channel()\nto assign new values.\n\nUse kzalloc for the memory allocation to avoid pushing uninitialized\ninformation to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cdac1884-b066-4fa3-89c1-878a01bcc461",
      "id": "CVE-2024-58090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Prevent rescheduling when interrupts are disabled\n\nDavid reported a warning observed while loop testing kexec jump:\n\n  Interrupts enabled after irqrouter_resume+0x0/0x50\n  WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220\n   kernel_kexec+0xf6/0x180\n   __do_sys_reboot+0x206/0x250\n   do_syscall_64+0x95/0x180\n\nThe corresponding interrupt flag trace:\n\n  hardirqs last  enabled at (15573): [\u003cffffffffa8281b8e\u003e] __up_console_sem+0x7e/0x90\n  hardirqs last disabled at (15580): [\u003cffffffffa8281b73\u003e] __up_console_sem+0x63/0x90\n\nThat means __up_console_sem() was invoked with interrupts enabled. Further\ninstrumentation revealed that in the interrupt disabled section of kexec\njump one of the syscore_suspend() callbacks woke up a task, which set the\nNEED_RESCHED flag. A later callback in the resume path invoked\ncond_resched() which in turn led to the invocation of the scheduler:\n\n  __cond_resched+0x21/0x60\n  down_timeout+0x18/0x60\n  acpi_os_wait_semaphore+0x4c/0x80\n  acpi_ut_acquire_mutex+0x3d/0x100\n  acpi_ns_get_node+0x27/0x60\n  acpi_ns_evaluate+0x1cb/0x2d0\n  acpi_rs_set_srs_method_data+0x156/0x190\n  acpi_pci_link_set+0x11c/0x290\n  irqrouter_resume+0x54/0x60\n  syscore_resume+0x6a/0x200\n  kernel_kexec+0x145/0x1c0\n  __do_sys_reboot+0xeb/0x240\n  do_syscall_64+0x95/0x180\n\nThis is a long standing problem, which probably got more visible with\nthe recent printk changes. Something does a task wakeup and the\nscheduler sets the NEED_RESCHED flag. cond_resched() sees it set and\ninvokes schedule() from a completely bogus context. The scheduler\nenables interrupts after context switching, which causes the above\nwarning at the end.\n\nQuite some of the code paths in syscore_suspend()/resume() can result in\ntriggering a wakeup with the exactly same consequences. They might not\nhave done so yet, but as they share a lot of code with normal operations\nit's just a question of time.\n\nThe problem only affects the PREEMPT_NONE and PREEMPT_VOLUNTARY scheduling\nmodels. Full preemption is not affected as cond_resched() is disabled and\nthe preemption check preemptible() takes the interrupt disabled flag into\naccount.\n\nCure the problem by adding a corresponding check into cond_resched().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7736f846-c1d6-4b02-b203-7bcdbb33896b",
      "id": "CVE-2025-21736",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix possible int overflows in nilfs_fiemap()\n\nSince nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result\nby being prepared to go through potentially maxblocks == INT_MAX blocks,\nthe value in n may experience an overflow caused by left shift of blkbits.\n\nWhile it is extremely unlikely to occur, play it safe and cast right hand\nexpression to wider type to mitigate the issue.\n\nFound by Linux Verification Center (linuxtesting.org) with static analysis\ntool SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dee27eb1-0015-4105-a2bc-4beb0f745ac8",
      "id": "CVE-2025-21899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix bad hist from corrupting named_triggers list\n\nThe following commands causes a crash:\n\n ~# cd /sys/kernel/tracing/events/rcu/rcu_callback\n ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' \u003e trigger\n bash: echo: write error: Invalid argument\n ~# echo 'hist:name=bad:keys=common_pid' \u003e trigger\n\nBecause the following occurs:\n\nevent_trigger_write() {\n  trigger_process_regex() {\n    event_hist_trigger_parse() {\n\n      data = event_trigger_alloc(..);\n\n      event_trigger_register(.., data) {\n        cmd_ops-\u003ereg(.., data, ..) [hist_register_trigger()] {\n          data-\u003eops-\u003einit() [event_hist_trigger_init()] {\n            save_named_trigger(name, data) {\n              list_add(\u0026data-\u003enamed_list, \u0026named_triggers);\n            }\n          }\n        }\n      }\n\n      ret = create_actions(); (return -EINVAL)\n      if (ret)\n        goto out_unreg;\n[..]\n      ret = hist_trigger_enable(data, ...) {\n        list_add_tail_rcu(\u0026data-\u003elist, \u0026file-\u003etriggers); \u003c\u003c\u003c---- SKIPPED!!! (this is important!)\n[..]\n out_unreg:\n      event_hist_unregister(.., data) {\n        cmd_ops-\u003eunreg(.., data, ..) [hist_unregister_trigger()] {\n          list_for_each_entry(iter, \u0026file-\u003etriggers, list) {\n            if (!hist_trigger_match(data, iter, named_data, false))   \u003c- never matches\n                continue;\n            [..]\n            test = iter;\n          }\n          if (test \u0026\u0026 test-\u003eops-\u003efree) \u003c\u003c\u003c-- test is NULL\n\n            test-\u003eops-\u003efree(test) [event_hist_trigger_free()] {\n              [..]\n              if (data-\u003ename)\n                del_named_trigger(data) {\n                  list_del(\u0026data-\u003enamed_list);  \u003c\u003c\u003c\u003c-- NEVER gets removed!\n                }\n              }\n           }\n         }\n\n         [..]\n         kfree(data); \u003c\u003c\u003c-- frees item but it is still on list\n\nThe next time a hist with name is registered, it causes an u-a-f bug and\nthe kernel can crash.\n\nMove the code around such that if event_trigger_register() succeeds, the\nnext thing called is hist_trigger_enable() which adds it to the list.\n\nA bunch of actions is called if get_named_trigger_data() returns false.\nBut that doesn't need to be called after event_trigger_register(), so it\ncan be moved up, allowing event_trigger_register() to be called just\nbefore hist_trigger_enable() keeping them together and allowing the\nfile-\u003etriggers to be properly populated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aea81fa7-4424-4b4a-afd5-6b6798645b39",
      "id": "CVE-2024-56551",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix usage slab after free\n\n[  +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147\n\n[  +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1\n[  +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[  +0.000016] Call Trace:\n[  +0.000008]  \u003cTASK\u003e\n[  +0.000009]  dump_stack_lvl+0x76/0xa0\n[  +0.000017]  print_report+0xce/0x5f0\n[  +0.000017]  ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000019]  ? srso_return_thunk+0x5/0x5f\n[  +0.000015]  ? kasan_complete_mode_report_info+0x72/0x200\n[  +0.000016]  ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000019]  kasan_report+0xbe/0x110\n[  +0.000015]  ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000023]  __asan_report_load8_noabort+0x14/0x30\n[  +0.000014]  drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_write+0x14/0x30\n[  +0.000016]  ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched]\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_write+0x14/0x30\n[  +0.000013]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? enable_work+0x124/0x220\n[  +0.000015]  ? __pfx_enable_work+0x10/0x10\n[  +0.000013]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? free_large_kmalloc+0x85/0xf0\n[  +0.000016]  drm_sched_entity_destroy+0x18/0x30 [gpu_sched]\n[  +0.000020]  amdgpu_vce_sw_fini+0x55/0x170 [amdgpu]\n[  +0.000735]  ? __kasan_check_read+0x11/0x20\n[  +0.000016]  vce_v4_0_sw_fini+0x80/0x110 [amdgpu]\n[  +0.000726]  amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu]\n[  +0.000679]  ? mutex_unlock+0x80/0xe0\n[  +0.000017]  ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu]\n[  +0.000662]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __kasan_check_write+0x14/0x30\n[  +0.000013]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? mutex_unlock+0x80/0xe0\n[  +0.000016]  amdgpu_driver_release_kms+0x16/0x80 [amdgpu]\n[  +0.000663]  drm_minor_release+0xc9/0x140 [drm]\n[  +0.000081]  drm_release+0x1fd/0x390 [drm]\n[  +0.000082]  __fput+0x36c/0xad0\n[  +0.000018]  __fput_sync+0x3c/0x50\n[  +0.000014]  __x64_sys_close+0x7d/0xe0\n[  +0.000014]  x64_sys_call+0x1bc6/0x2680\n[  +0.000014]  do_syscall_64+0x70/0x130\n[  +0.000014]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? irqentry_exit_to_user_mode+0x60/0x190\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? irqentry_exit+0x43/0x50\n[  +0.000012]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? exc_page_fault+0x7c/0x110\n[  +0.000015]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  +0.000014] RIP: 0033:0x7ffff7b14f67\n[  +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff\n[  +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003\n[  +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67\n[  +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003\n[  +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000\n[  +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8\n[  +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040\n[  +0.000020]  \u003c/TASK\u003e\n\n[  +0.000016] Allocated by task 383 on cpu 7 at 26.880319s:\n[  +0.000014]  kasan_save_stack+0x28/0x60\n[  +0.000008]  kasan_save_track+0x18/0x70\n[  +0.000007]  kasan_save_alloc_info+0x38/0x60\n[  +0.000007]  __kasan_kmalloc+0xc1/0xd0\n[  +0.000007]  kmalloc_trace_noprof+0x180/0x380\n[  +0.000007]  drm_sched_init+0x411/0xec0 [gpu_sched]\n[  +0.000012]  amdgpu_device_init+0x695f/0xa610 [amdgpu]\n[  +0.000658]  amdgpu_driver_load_kms+0x1a/0x120 [amdgpu]\n[  +0.000662]  amdgpu_pci_p\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "245edd27-065e-4d3d-a309-8a25a180397f",
      "id": "CVE-2025-37812",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix deadlock when using NCM gadget\n\nThe cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit\n58f2fcb3a845 (\"usb: cdnsp: Fix deadlock issue during using NCM gadget\").\n\nUnder PREEMPT_RT the deadlock can be readily triggered by heavy network\ntraffic, for example using \"iperf --bidir\" over NCM ethernet link.\n\nThe deadlock occurs because the threaded interrupt handler gets\npreempted by a softirq, but both are protected by the same spinlock.\nPrevent deadlock by disabling softirq during threaded irq handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4a9bed9-be97-4df9-b944-da5ed209a744",
      "id": "CVE-2025-38200",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix MMIO write access to an invalid page in i40e_clear_hw\n\nWhen the device sends a specific input, an integer underflow can occur, leading\nto MMIO write access to an invalid page.\n\nPrevent the integer underflow by changing the type of related variables.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57a641c3-95df-4fbd-9d77-143177b76b86",
      "id": "CVE-2025-38285",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix WARN() in get_bpf_raw_tp_regs\n\nsyzkaller reported an issue:\n\nWARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861\nModules linked in:\nCPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861\nRSP: 0018:ffffc90003636fa8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c\nRDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 0000000000000005\nRBP: ffff88806a730860 R08: 0000000000000005 R09: 0000000000000003\nR10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000004\nR13: 0000000000000001 R14: ffffc90003637008 R15: 0000000000000900\nFS:  0000000000000000(0000) GS:ffff8880d6cdf000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7baee09130 CR3: 0000000029f5a000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1934 [inline]\n bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931\n bpf_prog_ec3b2eefa702d8d3+0x43/0x47\n bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]\n __bpf_prog_run include/linux/filter.h:718 [inline]\n bpf_prog_run include/linux/filter.h:725 [inline]\n __bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline]\n bpf_trace_run3+0x23f/0x5a0 kernel/trace/bpf_trace.c:2405\n __bpf_trace_mmap_lock_acquire_returned+0xfc/0x140 include/trace/events/mmap_lock.h:47\n __traceiter_mmap_lock_acquire_returned+0x79/0xc0 include/trace/events/mmap_lock.h:47\n __do_trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline]\n trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline]\n __mmap_lock_do_trace_acquire_returned+0x138/0x1f0 mm/mmap_lock.c:35\n __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline]\n mmap_read_trylock include/linux/mmap_lock.h:204 [inline]\n stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157\n __bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483\n ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline]\n bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496\n ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline]\n bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931\n bpf_prog_ec3b2eefa702d8d3+0x43/0x47\n\nTracepoint like trace_mmap_lock_acquire_returned may cause nested call\nas the corner case show above, which will be resolved with more general\nmethod in the future. As a result, WARN_ON_ONCE will be triggered. As\nAlexei suggested, remove the WARN_ON_ONCE first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d450918d-c40e-4915-befd-a23d3ebc79fb",
      "id": "CVE-2025-38332",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Use memcpy() for BIOS version\n\nThe strlcat() with FORTIFY support is triggering a panic because it\nthinks the target buffer will overflow although the correct target\nbuffer size is passed in.\n\nAnyway, instead of memset() with 0 followed by a strlcat(), just use\nmemcpy() and ensure that the resulting buffer is NULL terminated.\n\nBIOSVersion is only used for the lpfc_printf_log() which expects a\nproperly terminated string.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6dbc9be-8286-4622-a115-171b651e5c3b",
      "id": "CVE-2025-38344",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi parse and parseext cache leaks\n\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\n\nI'm Seunghun Han, and I work for National Security Research Institute of\nSouth Korea.\n\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\nearly abort cases.\n\nBoot log of ACPI cache leak is as follows:\n[    0.352414] ACPI: Added _OSI(Module Device)\n[    0.353182] ACPI: Added _OSI(Processor Device)\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #10\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.361873] Call Trace:\n[    0.362243]  ? dump_stack+0x5c/0x81\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.364000]  ? acpi_terminate+0xa/0x14\n[    0.364000]  ? acpi_init+0x2af/0x34f\n[    0.364000]  ? __class_create+0x4c/0x80\n[    0.364000]  ? video_setup+0x7f/0x7f\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\n[    0.364000]  ? rest_init+0xc0/0xc0\n[    0.364000]  ? kernel_init+0xa/0x100\n[    0.364000]  ? ret_from_fork+0x25/0x30\n\nI analyzed this memory leak in detail. I found that “Acpi-State” cache and\n“Acpi-Parse” cache were merged because the size of cache objects was same\nslab cache size.\n\nI finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\n\nReal ACPI cache leak point is as follows:\n[    0.360101] ACPI: Added _OSI(Module Device)\n[    0.360101] ACPI: Added _OSI(Processor Device)\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.372000] Call Trace:\n[    0.372000]  ? dump_stack+0x5c/0x81\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\n[    0.372000]  ? acpi_terminate+0xa/0x14\n[    0.372000]  ? acpi_init+0x2af/0x34f\n[    0.372000]  ? __class_create+0x4c/0x80\n[    0.372000]  ? video_setup+0x7f/0x7f\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\n[    0.372000]  ? rest_init+0xc0/0xc0\n[    0.372000]  ? kernel_init+0xa/0x100\n[    0.372000]  ? ret_from_fork+0x25/0x30\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.392000] Call Trace:\n[    0.392000]  ? dump_stack+0x5c/0x81\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.392000]  ? acpi_terminate+0xa/0x14\n[    0.392000]  ? acpi_init+0x2af/0x3\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "64cfb515-54d2-4843-b5d1-9387fb8c662e",
      "id": "CVE-2025-38387",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Initialize obj_event-\u003eobj_sub_list before xa_insert\n\nThe obj_event may be loaded immediately after inserted, then if the\nlist_head is not initialized then we may get a poisonous pointer.  This\nfixes the crash below:\n\n mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced)\n mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056\n mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0\n mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps\n IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n Mem abort info:\n   ESR = 0x96000006\n   EC = 0x25: DABT (current EL), IL = 32 bits\n   SET = 0, FnV = 0\n   EA = 0, S1PTW = 0\n Data abort info:\n   ISV = 0, ISS = 0x00000006\n   CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000\n [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000\n Internal error: Oops: 96000006 [#1] SMP\n Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E)\n  [last unloaded: mst_pci]\n CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G           OE K   5.10.134-13.1.an8.aarch64 #1\n Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023\n pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--)\n pc : dispatch_event_fd+0x68/0x300 [mlx5_ib]\n lr : devx_event_notifier+0xcc/0x228 [mlx5_ib]\n sp : ffff80001005bcf0\n x29: ffff80001005bcf0 x28: 0000000000000001\n x27: ffff244e0740a1d8 x26: ffff244e0740a1d0\n x25: ffffda56beff5ae0 x24: ffffda56bf911618\n x23: ffff244e0596a480 x22: ffff244e0596a480\n x21: ffff244d8312ad90 x20: ffff244e0596a480\n x19: fffffffffffffff0 x18: 0000000000000000\n x17: 0000000000000000 x16: ffffda56be66d620\n x15: 0000000000000000 x14: 0000000000000000\n x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000040 x10: ffffda56bfcafb50\n x9 : ffffda5655c25f2c x8 : 0000000000000010\n x7 : 0000000000000000 x6 : ffff24545a2e24b8\n x5 : 0000000000000003 x4 : ffff80001005bd28\n x3 : 0000000000000000 x2 : 0000000000000000\n x1 : ffff244e0596a480 x0 : ffff244d8312ad90\n Call trace:\n  dispatch_event_fd+0x68/0x300 [mlx5_ib]\n  devx_event_notifier+0xcc/0x228 [mlx5_ib]\n  atomic_notifier_call_chain+0x58/0x80\n  mlx5_eq_async_int+0x148/0x2b0 [mlx5_core]\n  atomic_notifier_call_chain+0x58/0x80\n  irq_int_handler+0x20/0x30 [mlx5_core]\n  __handle_irq_event_percpu+0x60/0x220\n  handle_irq_event_percpu+0x3c/0x90\n  handle_irq_event+0x58/0x158\n  handle_fasteoi_irq+0xfc/0x188\n  generic_handle_irq+0x34/0x48\n  ...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4391e31-336b-4fd4-b095-ed36c92250a7",
      "id": "CVE-2025-38389",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Fix timeline left held on VMA alloc error\n\nThe following error has been reported sporadically by CI when a test\nunbinds the i915 driver on a ring submission platform:\n\n\u003c4\u003e [239.330153] ------------[ cut here ]------------\n\u003c4\u003e [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv-\u003emm.shrink_count)\n\u003c4\u003e [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915]\n...\n\u003c4\u003e [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915]\n...\n\u003c4\u003e [239.330942] Call Trace:\n\u003c4\u003e [239.330944]  \u003cTASK\u003e\n\u003c4\u003e [239.330949]  i915_driver_late_release+0x2b/0xa0 [i915]\n\u003c4\u003e [239.331202]  i915_driver_release+0x86/0xa0 [i915]\n\u003c4\u003e [239.331482]  devm_drm_dev_init_release+0x61/0x90\n\u003c4\u003e [239.331494]  devm_action_release+0x15/0x30\n\u003c4\u003e [239.331504]  release_nodes+0x3d/0x120\n\u003c4\u003e [239.331517]  devres_release_all+0x96/0xd0\n\u003c4\u003e [239.331533]  device_unbind_cleanup+0x12/0x80\n\u003c4\u003e [239.331543]  device_release_driver_internal+0x23a/0x280\n\u003c4\u003e [239.331550]  ? bus_find_device+0xa5/0xe0\n\u003c4\u003e [239.331563]  device_driver_detach+0x14/0x20\n...\n\u003c4\u003e [357.719679] ---[ end trace 0000000000000000 ]---\n\nIf the test also unloads the i915 module then that's followed with:\n\n\u003c3\u003e [357.787478] =============================================================================\n\u003c3\u003e [357.788006] BUG i915_vma (Tainted: G     U  W        N ): Objects remaining on __kmem_cache_shutdown()\n\u003c3\u003e [357.788031] -----------------------------------------------------------------------------\n\u003c3\u003e [357.788204] Object 0xffff888109e7f480 @offset=29824\n\u003c3\u003e [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244\n\u003c4\u003e [357.788994]  i915_vma_instance+0xee/0xc10 [i915]\n\u003c4\u003e [357.789290]  init_status_page+0x7b/0x420 [i915]\n\u003c4\u003e [357.789532]  intel_engines_init+0x1d8/0x980 [i915]\n\u003c4\u003e [357.789772]  intel_gt_init+0x175/0x450 [i915]\n\u003c4\u003e [357.790014]  i915_gem_init+0x113/0x340 [i915]\n\u003c4\u003e [357.790281]  i915_driver_probe+0x847/0xed0 [i915]\n\u003c4\u003e [357.790504]  i915_pci_probe+0xe6/0x220 [i915]\n...\n\nCloser analysis of CI results history has revealed a dependency of the\nerror on a few IGT tests, namely:\n- igt@api_intel_allocator@fork-simple-stress-signal,\n- igt@api_intel_allocator@two-level-inception-interruptible,\n- igt@gem_linear_blits@interruptible,\n- igt@prime_mmap_coherency@ioctl-errors,\nwhich invisibly trigger the issue, then exhibited with first driver unbind\nattempt.\n\nAll of the above tests perform actions which are actively interrupted with\nsignals.  Further debugging has allowed to narrow that scope down to\nDRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring\nsubmission, in particular.\n\nIf successful then that function, or its execlists or GuC submission\nequivalent, is supposed to be called only once per GEM context engine,\nfollowed by raise of a flag that prevents the function from being called\nagain.  The function is expected to unwind its internal errors itself, so\nit may be safely called once more after it returns an error.\n\nIn case of ring submission, the function first gets a reference to the\nengine's legacy timeline and then allocates a VMA.  If the VMA allocation\nfails, e.g. when i915_vma_instance() called from inside is interrupted\nwith a signal, then ring_context_alloc() fails, leaving the timeline held\nreferenced.  On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the\ntimeline is got, and only that last one is put on successful completion.\nAs a consequence, the legacy timeline, with its underlying engine status\npage's VMA object, is still held and not released on driver unbind.\n\nGet the legacy timeline only after successful allocation of the context\nengine's VMA.\n\nv2: Add a note on other submission methods (Krzysztof Karas):\n    Both execlists and GuC submission use lrc_alloc() which seems free\n    from a similar issue.\n\n(cherry picked from commit cc43422b3cc79eacff4c5a8ba0d224688ca9dd4f)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ba04bd1-a633-4fba-bb02-1221abee9ec9",
      "id": "CVE-2025-39744",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Fix rcu_read_unlock() deadloop due to IRQ work\n\nDuring rcu_read_unlock_special(), if this happens during irq_exit(), we\ncan lockup if an IPI is issued. This is because the IPI itself triggers\nthe irq_exit() path causing a recursive lock up.\n\nThis is precisely what Xiongfeng found when invoking a BPF program on\nthe trace_tick_stop() tracepoint As shown in the trace below. Fix by\nmanaging the irq_work state correctly.\n\nirq_exit()\n  __irq_exit_rcu()\n    /* in_hardirq() returns false after this */\n    preempt_count_sub(HARDIRQ_OFFSET)\n    tick_irq_exit()\n      tick_nohz_irq_exit()\n\t    tick_nohz_stop_sched_tick()\n\t      trace_tick_stop()  /* a bpf prog is hooked on this trace point */\n\t\t   __bpf_trace_tick_stop()\n\t\t      bpf_trace_run2()\n\t\t\t    rcu_read_unlock_special()\n                              /* will send a IPI to itself */\n\t\t\t      irq_work_queue_on(\u0026rdp-\u003edefer_qs_iw, rdp-\u003ecpu);\n\nA simple reproducer can also be obtained by doing the following in\ntick_irq_exit(). It will hang on boot without the patch:\n\n  static inline void tick_irq_exit(void)\n  {\n +\trcu_read_lock();\n +\tWRITE_ONCE(current-\u003ercu_read_unlock_special.b.need_qs, true);\n +\trcu_read_unlock();\n +\n\n[neeraj: Apply Frederic's suggested fix for PREEMPT_RT]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f7653b7-57b9-4dde-bc3e-441edc12069c",
      "id": "CVE-2020-13143",
      "description": "gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98ea5829-e892-4c17-8aea-f724d2b28624",
      "id": "CVE-2020-29569",
      "description": "An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring-\u003exenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0e82508-d610-4f61-be61-0ee3d194e2d7",
      "id": "CVE-2020-36787",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: aspeed: fix clock handling logic\n\nVideo engine uses eclk and vclk for its clock sources and its reset\ncontrol is coupled with eclk so the current clock enabling sequence works\nlike below.\n\n Enable eclk\n De-assert Video Engine reset\n 10ms delay\n Enable vclk\n\nIt introduces improper reset on the Video Engine hardware and eventually\nthe hardware generates unexpected DMA memory transfers that can corrupt\nmemory region in random and sporadic patterns. This issue is observed\nvery rarely on some specific AST2500 SoCs but it causes a critical\nkernel panic with making a various shape of signature so it's extremely\nhard to debug. Moreover, the issue is observed even when the video\nengine is not actively used because udevd turns on the video engine\nhardware for a short time to make a query in every boot.\n\nTo fix this issue, this commit changes the clock handling logic to make\nthe reset de-assertion triggered after enabling both eclk and vclk. Also,\nit adds clk_unprepare call for a case when probe fails.\n\nclk: ast2600: fix reset settings for eclk and vclk\nVideo engine reset setting should be coupled with eclk to match it\nwith the setting for previous Aspeed SoCs which is defined in\nclk-aspeed.c since all Aspeed SoCs are sharing a single video engine\ndriver. Also, reset bit 6 is defined as 'Video Engine' reset in\ndatasheet so it should be de-asserted when eclk is enabled. This\ncommit fixes the setting.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8bffcbe-9a74-4436-862f-d8c9e56c49f2",
      "id": "CVE-2021-28951",
      "description": "An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa7a054d-099b-49c3-8fdf-1052b4c765ba",
      "id": "CVE-2021-28964",
      "description": "A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb4a2dc8-d5a0-4d68-8d28-cb7c49fcf3e5",
      "id": "CVE-2021-33624",
      "description": "In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "602ba98a-905e-4a01-94c0-3c094890de99",
      "id": "CVE-2021-43976",
      "description": "In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b8bc7b0-fa62-4989-8f09-bec0af38d587",
      "id": "CVE-2021-47511",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix negative period/buffer sizes\n\nThe period size calculation in OSS layer may receive a negative value\nas an error, but the code there assumes only the positive values and\nhandle them with size_t.  Due to that, a too big value may be passed\nto the lower layers.\n\nThis patch changes the code to handle with ssize_t and adds the proper\nerror checks appropriately.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "254f92c1-71a6-463f-beb0-bf36703f342f",
      "id": "CVE-2021-46966",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: custom_method: fix potential use-after-free issue\n\nIn cm_write(), buf is always freed when reaching the end of the\nfunction.  If the requested count is less than table.length, the\nallocated buffer will be freed but subsequent calls to cm_write() will\nstill try to access it.\n\nRemove the unconditional kfree(buf) at the end of the function and\nset the buf to NULL in the -EINVAL error path to match the rest of\nfunction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc069460-9cf4-44c2-8675-9571637d5bd1",
      "id": "CVE-2021-47142",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix a use-after-free\n\nlooks like we forget to set ttm-\u003esg to NULL.\nHit panic below\n\n[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI\n[ 1235.989074] Call Trace:\n[ 1235.991751]  sg_free_table+0x17/0x20\n[ 1235.995667]  amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]\n[ 1236.002288]  amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]\n[ 1236.008464]  ttm_tt_destroy+0x1e/0x30 [ttm]\n[ 1236.013066]  ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]\n[ 1236.018783]  ttm_bo_release+0x262/0xa50 [ttm]\n[ 1236.023547]  ttm_bo_put+0x82/0xd0 [ttm]\n[ 1236.027766]  amdgpu_bo_unref+0x26/0x50 [amdgpu]\n[ 1236.032809]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]\n[ 1236.040400]  kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]\n[ 1236.046912]  kfd_ioctl+0x463/0x690 [amdgpu]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c34e87d1-1f71-4666-afac-4065695f4c0f",
      "id": "CVE-2021-47171",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: fix memory leak in smsc75xx_bind\n\nSyzbot reported memory leak in smsc75xx_bind().\nThe problem was is non-freed memory in case of\nerrors after memory allocation.\n\nbacktrace:\n  [\u003cffffffff84245b62\u003e] kmalloc include/linux/slab.h:556 [inline]\n  [\u003cffffffff84245b62\u003e] kzalloc include/linux/slab.h:686 [inline]\n  [\u003cffffffff84245b62\u003e] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460\n  [\u003cffffffff82b5b2e6\u003e] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d30372e-b69a-465e-a31c-31044cf4efcb",
      "id": "CVE-2021-47308",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix array index out of bound exception\n\nFix array index out of bound exception in fc_rport_prli_resp().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4173e9c1-f860-442e-a049-92209202347e",
      "id": "CVE-2022-49394",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iolatency: Fix inflight count imbalances and IO hangs on offline\n\niolatency needs to track the number of inflight IOs per cgroup. As this\ntracking can be expensive, it is disabled when no cgroup has iolatency\nconfigured for the device. To ensure that the inflight counters stay\nbalanced, iolatency_set_limit() freezes the request_queue while manipulating\nthe enabled counter, which ensures that no IO is in flight and thus all\ncounters are zero.\n\nUnfortunately, iolatency_set_limit() isn't the only place where the enabled\ncounter is manipulated. iolatency_pd_offline() can also dec the counter and\ntrigger disabling. As this disabling happens without freezing the q, this\ncan easily happen while some IOs are in flight and thus leak the counts.\n\nThis can be easily demonstrated by turning on iolatency on an one empty\ncgroup while IOs are in flight in other cgroups and then removing the\ncgroup. Note that iolatency shouldn't have been enabled elsewhere in the\nsystem to ensure that removing the cgroup disables iolatency for the whole\ndevice.\n\nThe following keeps flipping on and off iolatency on sda:\n\n  echo +io \u003e /sys/fs/cgroup/cgroup.subtree_control\n  while true; do\n      mkdir -p /sys/fs/cgroup/test\n      echo '8:0 target=100000' \u003e /sys/fs/cgroup/test/io.latency\n      sleep 1\n      rmdir /sys/fs/cgroup/test\n      sleep 1\n  done\n\nand there's concurrent fio generating direct rand reads:\n\n  fio --name test --filename=/dev/sda --direct=1 --rw=randread \\\n      --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k\n\nwhile monitoring with the following drgn script:\n\n  while True:\n    for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()):\n        for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list):\n            blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node')\n            pd = blkg.pd[prog['blkcg_policy_iolatency'].plid]\n            if pd.value_() == 0:\n                continue\n            iolat = container_of(pd, 'struct iolatency_grp', 'pd')\n            inflight = iolat.rq_wait.inflight.counter.value_()\n            if inflight:\n                print(f'inflight={inflight} {disk_name(blkg.q.disk).decode(\"utf-8\")} '\n                      f'{cgroup_path(css.cgroup).decode(\"utf-8\")}')\n    time.sleep(1)\n\nThe monitoring output looks like the following:\n\n  inflight=1 sda /user.slice\n  inflight=1 sda /user.slice\n  ...\n  inflight=14 sda /user.slice\n  inflight=13 sda /user.slice\n  inflight=17 sda /user.slice\n  inflight=15 sda /user.slice\n  inflight=18 sda /user.slice\n  inflight=17 sda /user.slice\n  inflight=20 sda /user.slice\n  inflight=19 sda /user.slice \u003c- fio stopped, inflight stuck at 19\n  inflight=19 sda /user.slice\n  inflight=19 sda /user.slice\n\nIf a cgroup with stuck inflight ends up getting throttled, the throttled IOs\nwill never get issued as there's no completion event to wake it up leading\nto an indefinite hang.\n\nThis patch fixes the bug by unifying enable handling into a work item which\nis automatically kicked off from iolatency_set_min_lat_nsec() which is\ncalled from both iolatency_set_limit() and iolatency_pd_offline() paths.\nPunting to a work item is necessary as iolatency_pd_offline() is called\nunder spinlocks while freezing a request_queue requires a sleepable context.\n\nThis also simplifies the code reducing LOC sans the comments and avoids the\nunnecessary freezes which were happening whenever a cgroup's latency target\nis newly set or cleared.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63086a04-e5ba-4905-8e0e-270f23a7edc5",
      "id": "CVE-2024-27004",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Get runtime PM before walking tree during disable_unused\n\nDoug reported [1] the following hung task:\n\n INFO: task swapper/0:1 blocked for more than 122 seconds.\n       Not tainted 5.15.149-21875-gf795ebc40eb8 #1\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:swapper/0       state:D stack:    0 pid:    1 ppid:     0 flags:0x00000008\n Call trace:\n  __switch_to+0xf4/0x1f4\n  __schedule+0x418/0xb80\n  schedule+0x5c/0x10c\n  rpm_resume+0xe0/0x52c\n  rpm_resume+0x178/0x52c\n  __pm_runtime_resume+0x58/0x98\n  clk_pm_runtime_get+0x30/0xb0\n  clk_disable_unused_subtree+0x58/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused_subtree+0x38/0x208\n  clk_disable_unused+0x4c/0xe4\n  do_one_initcall+0xcc/0x2d8\n  do_initcall_level+0xa4/0x148\n  do_initcalls+0x5c/0x9c\n  do_basic_setup+0x24/0x30\n  kernel_init_freeable+0xec/0x164\n  kernel_init+0x28/0x120\n  ret_from_fork+0x10/0x20\n INFO: task kworker/u16:0:9 blocked for more than 122 seconds.\n       Not tainted 5.15.149-21875-gf795ebc40eb8 #1\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/u16:0   state:D stack:    0 pid:    9 ppid:     2 flags:0x00000008\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  __switch_to+0xf4/0x1f4\n  __schedule+0x418/0xb80\n  schedule+0x5c/0x10c\n  schedule_preempt_disabled+0x2c/0x48\n  __mutex_lock+0x238/0x488\n  __mutex_lock_slowpath+0x1c/0x28\n  mutex_lock+0x50/0x74\n  clk_prepare_lock+0x7c/0x9c\n  clk_core_prepare_lock+0x20/0x44\n  clk_prepare+0x24/0x30\n  clk_bulk_prepare+0x40/0xb0\n  mdss_runtime_resume+0x54/0x1c8\n  pm_generic_runtime_resume+0x30/0x44\n  __genpd_runtime_resume+0x68/0x7c\n  genpd_runtime_resume+0x108/0x1f4\n  __rpm_callback+0x84/0x144\n  rpm_callback+0x30/0x88\n  rpm_resume+0x1f4/0x52c\n  rpm_resume+0x178/0x52c\n  __pm_runtime_resume+0x58/0x98\n  __device_attach+0xe0/0x170\n  device_initial_probe+0x1c/0x28\n  bus_probe_device+0x3c/0x9c\n  device_add+0x644/0x814\n  mipi_dsi_device_register_full+0xe4/0x170\n  devm_mipi_dsi_device_register_full+0x28/0x70\n  ti_sn_bridge_probe+0x1dc/0x2c0\n  auxiliary_bus_probe+0x4c/0x94\n  really_probe+0xcc/0x2c8\n  __driver_probe_device+0xa8/0x130\n  driver_probe_device+0x48/0x110\n  __device_attach_driver+0xa4/0xcc\n  bus_for_each_drv+0x8c/0xd8\n  __device_attach+0xf8/0x170\n  device_initial_probe+0x1c/0x28\n  bus_probe_device+0x3c/0x9c\n  deferred_probe_work_func+0x9c/0xd8\n  process_one_work+0x148/0x518\n  worker_thread+0x138/0x350\n  kthread+0x138/0x1e0\n  ret_from_fork+0x10/0x20\n\nThe first thread is walking the clk tree and calling\nclk_pm_runtime_get() to power on devices required to read the clk\nhardware via struct clk_ops::is_enabled(). This thread holds the clk\nprepare_lock, and is trying to runtime PM resume a device, when it finds\nthat the device is in the process of resuming so the thread schedule()s\naway waiting for the device to finish resuming before continuing. The\nsecond thread is runtime PM resuming the same device, but the runtime\nresume callback is calling clk_prepare(), trying to grab the\nprepare_lock waiting on the first thread.\n\nThis is a classic ABBA deadlock. To properly fix the deadlock, we must\nnever runtime PM resume or suspend a device with the clk prepare_lock\nheld. Actually doing that is near impossible today because the global\nprepare_lock would have to be dropped in the middle of the tree, the\ndevice runtime PM resumed/suspended, and then the prepare_lock grabbed\nagain to ensure consistency of the clk tree topology. If anything\nchanges with the clk tree in the meantime, we've lost and will need to\nstart the operation all over again.\n\nLuckily, most of the time we're simply incrementing or decrementing the\nruntime PM count on an active device, so we don't have the chance to\nschedule away with the prepare_lock held. Let's fix this immediate\nproblem that can be\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e914783c-cc7b-4e4f-96de-b98d71fcf6b4",
      "id": "CVE-2024-35784",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock with fiemap and extent locking\n\nWhile working on the patchset to remove extent locking I got a lockdep\nsplat with fiemap and pagefaulting with my new extent lock replacement\nlock.\n\nThis deadlock exists with our normal code, we just don't have lockdep\nannotations with the extent locking so we've never noticed it.\n\nSince we're copying the fiemap extent to user space on every iteration\nwe have the chance of pagefaulting.  Because we hold the extent lock for\nthe entire range we could mkwrite into a range in the file that we have\nmmap'ed.  This would deadlock with the following stack trace\n\n[\u003c0\u003e] lock_extent+0x28d/0x2f0\n[\u003c0\u003e] btrfs_page_mkwrite+0x273/0x8a0\n[\u003c0\u003e] do_page_mkwrite+0x50/0xb0\n[\u003c0\u003e] do_fault+0xc1/0x7b0\n[\u003c0\u003e] __handle_mm_fault+0x2fa/0x460\n[\u003c0\u003e] handle_mm_fault+0xa4/0x330\n[\u003c0\u003e] do_user_addr_fault+0x1f4/0x800\n[\u003c0\u003e] exc_page_fault+0x7c/0x1e0\n[\u003c0\u003e] asm_exc_page_fault+0x26/0x30\n[\u003c0\u003e] rep_movs_alternative+0x33/0x70\n[\u003c0\u003e] _copy_to_user+0x49/0x70\n[\u003c0\u003e] fiemap_fill_next_extent+0xc8/0x120\n[\u003c0\u003e] emit_fiemap_extent+0x4d/0xa0\n[\u003c0\u003e] extent_fiemap+0x7f8/0xad0\n[\u003c0\u003e] btrfs_fiemap+0x49/0x80\n[\u003c0\u003e] __x64_sys_ioctl+0x3e1/0xb50\n[\u003c0\u003e] do_syscall_64+0x94/0x1a0\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nI wrote an fstest to reproduce this deadlock without my replacement lock\nand verified that the deadlock exists with our existing locking.\n\nTo fix this simply don't take the extent lock for the entire duration of\nthe fiemap.  This is safe in general because we keep track of where we\nare when we're searching the tree, so if an ordered extent updates in\nthe middle of our fiemap call we'll still emit the correct extents\nbecause we know what offset we were on before.\n\nThe only place we maintain the lock is searching delalloc.  Since the\ndelalloc stuff can change during writeback we want to lock the extent\nrange so we have a consistent view of delalloc at the time we're\nchecking to see if we need to set the delalloc flag.\n\nWith this patch applied we no longer deadlock with my testcase.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a502d4c5-063f-4607-9ae3-88bfe99dc575",
      "id": "CVE-2021-47335",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances\n\nAs syzbot reported, there is an use-after-free issue during f2fs recovery:\n\nUse-after-free write at 0xffff88823bc16040 (in kfence-#10):\n kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486\n f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869\n f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945\n mount_bdev+0x26c/0x3a0 fs/super.c:1367\n legacy_get_tree+0xea/0x180 fs/fs_context.c:592\n vfs_get_tree+0x86/0x270 fs/super.c:1497\n do_new_mount fs/namespace.c:2905 [inline]\n path_mount+0x196f/0x2be0 fs/namespace.c:3235\n do_mount fs/namespace.c:3248 [inline]\n __do_sys_mount fs/namespace.c:3456 [inline]\n __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433\n do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is multi f2fs filesystem instances can race on accessing\nglobal fsync_entry_slab pointer, result in use-after-free issue of slab\ncache, fixes to init/destroy this slab cache only once during module\ninit/destroy procedure to avoid this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a84965f5-ff2d-4c68-943b-aa9a6b15cc88",
      "id": "CVE-2021-47338",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbmem: Do not delete the mode that is still in use\n\nThe execution of fb_delete_videomode() is not based on the result of the\nprevious fbcon_mode_deleted(). As a result, the mode is directly deleted,\nregardless of whether it is still in use, which may cause UAF.\n\n==================================================================\nBUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \\\ndrivers/video/fbdev/core/modedb.c:924\nRead of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962\n\nCPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x137/0x1be lib/dump_stack.c:118\n print_address_description+0x6c/0x640 mm/kasan/report.c:385\n __kasan_report mm/kasan/report.c:545 [inline]\n kasan_report+0x13d/0x1e0 mm/kasan/report.c:562\n fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924\n fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746\n fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 18960:\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track+0x3d/0x70 mm/kasan/common.c:56\n kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355\n __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422\n slab_free_hook mm/slub.c:1541 [inline]\n slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574\n slab_free mm/slub.c:3139 [inline]\n kfree+0xca/0x3d0 mm/slub.c:4121\n fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104\n fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xa9",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e0ed35e-783b-4700-8a7c-ed80edbd5404",
      "id": "CVE-2021-47362",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Update intermediate power state for SI\n\nUpdate the current state as boot state during dpm initialization.\nDuring the subsequent initialization, set_power_state gets called to\ntransition to the final power state. set_power_state refers to values\nfrom the current state and without current state populated, it could\nresult in NULL pointer dereference.\n\nFor ex: on platforms where PCI speed change is supported through ACPI\nATCS method, the link speed of current state needs to be queried before\ndeciding on changing to final power state's link speed. The logic to query\nATCS-support was broken on certain platforms. The issue became visible\nwhen broken ATCS-support logic got fixed with commit\nf9b7f3703ff9 (\"drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)\").\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8988c180-62ec-49b2-97e7-2516e9c9d6d9",
      "id": "CVE-2021-47464",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix possible null-pointer dereference in audit_filter_rules\n\nFix  possible null-pointer dereference in audit_filter_rules.\n\naudit_filter_rules() error: we previously assumed 'ctx' could be null",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6868b778-e381-416a-a213-f2d09362df53",
      "id": "CVE-2021-47477",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: dt9812: fix DMA buffers on stack\n\nUSB transfer buffers are typically mapped for DMA and must not be\nallocated on the stack or transfers will fail.\n\nAllocate proper transfer buffers in the various command helpers and\nreturn an error on short transfers instead of acting on random stack\ndata.\n\nNote that this also fixes a stack info leak on systems where DMA is not\nused as 32 bytes are always sent to the device regardless of how short\nthe command is.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab776d11-6b2d-46a7-92ad-9ff000230d80",
      "id": "CVE-2021-47565",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix kernel panic during drive powercycle test\n\nWhile looping over shost's sdev list it is possible that one\nof the drives is getting removed and its sas_target object is\nfreed but its sdev object remains intact.\n\nConsequently, a kernel panic can occur while the driver is trying to access\nthe sas_address field of sas_target object without also checking the\nsas_target object for NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d563d5f-9078-4aee-bcab-b5c0119fdc18",
      "id": "CVE-2021-47571",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()\n\nThe free_rtllib() function frees the \"dev\" pointer so there is use\nafter free on the next line.  Re-arrange things to avoid that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83702fdd-b6eb-4843-95a6-96628f9987b0",
      "id": "CVE-2021-47646",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"Revert \"block, bfq: honor already-setup queue merges\"\"\n\nA crash [1] happened to be triggered in conjunction with commit\n2d52c58b9c9b (\"block, bfq: honor already-setup queue merges\"). The\nlatter was then reverted by commit ebc69e897e17 (\"Revert \"block, bfq:\nhonor already-setup queue merges\"\"). Yet, the reverted commit was not\nthe one introducing the bug. In fact, it actually triggered a UAF\nintroduced by a different commit, and now fixed by commit d29bd41428cf\n(\"block, bfq: reset last_bfqq_created on group change\").\n\nSo, there is no point in keeping commit 2d52c58b9c9b (\"block, bfq:\nhonor already-setup queue merges\") out. This commit restores it.\n\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=214503",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "abba3372-d330-47c3-9b7c-8502eb68699f",
      "id": "CVE-2022-0435",
      "description": "A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cd56577-79fa-4146-85d4-155eb44da522",
      "id": "CVE-2022-0854",
      "description": "A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "757244d4-f058-4a38-86c5-3753d8dd98bc",
      "id": "CVE-2022-48742",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()\n\nWhile looking at one unrelated syzbot bug, I found the replay logic\nin __rtnl_newlink() to potentially trigger use-after-free.\n\nIt is better to clear master_dev and m_ops inside the loop,\nin case we have to replay it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c36a6145-3427-4381-998b-4f6c4f1c3525",
      "id": "CVE-2022-3344",
      "description": "A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f575801e-46e0-4bf9-92e2-4bf6f0d75f95",
      "id": "CVE-2022-3544",
      "description": "A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63fabbbb-c2e3-4879-bb83-1ac1aef506f8",
      "id": "CVE-2022-40307",
      "description": "An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a06d1d51-7ff2-41f8-b334-f3f597cb1631",
      "id": "CVE-2022-48627",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: fix memory overlapping when deleting chars in the buffer\n\nA memory overlapping copy occurs when deleting a long line. This memory\noverlapping copy can cause data corruption when scr_memcpyw is optimized\nto memcpy because memcpy does not ensure its behavior if the destination\nbuffer overlaps with the source buffer. The line buffer is not always\nbroken, because the memcpy utilizes the hardware acceleration, whose\nresult is not deterministic.\n\nFix this problem by using replacing the scr_memcpyw with scr_memmovew.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a5e3404-e7ea-4502-bc4f-9d6d2f4fc50b",
      "id": "CVE-2022-48631",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug in extents parsing when eh_entries == 0 and eh_depth \u003e 0\n\nWhen walking through an inode extents, the ext4_ext_binsearch_idx() function\nassumes that the extent header has been previously validated.  However, there\nare no checks that verify that the number of entries (eh-\u003eeh_entries) is\nnon-zero when depth is \u003e 0.  And this will lead to problems because the\nEXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:\n\n[  135.245946] ------------[ cut here ]------------\n[  135.247579] kernel BUG at fs/ext4/extents.c:2258!\n[  135.249045] invalid opcode: 0000 [#1] PREEMPT SMP\n[  135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4\n[  135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014\n[  135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0\n[  135.256475] Code:\n[  135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246\n[  135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023\n[  135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c\n[  135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c\n[  135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024\n[  135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000\n[  135.272394] FS:  00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000\n[  135.274510] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0\n[  135.277952] Call Trace:\n[  135.278635]  \u003cTASK\u003e\n[  135.279247]  ? preempt_count_add+0x6d/0xa0\n[  135.280358]  ? percpu_counter_add_batch+0x55/0xb0\n[  135.281612]  ? _raw_read_unlock+0x18/0x30\n[  135.282704]  ext4_map_blocks+0x294/0x5a0\n[  135.283745]  ? xa_load+0x6f/0xa0\n[  135.284562]  ext4_mpage_readpages+0x3d6/0x770\n[  135.285646]  read_pages+0x67/0x1d0\n[  135.286492]  ? folio_add_lru+0x51/0x80\n[  135.287441]  page_cache_ra_unbounded+0x124/0x170\n[  135.288510]  filemap_get_pages+0x23d/0x5a0\n[  135.289457]  ? path_openat+0xa72/0xdd0\n[  135.290332]  filemap_read+0xbf/0x300\n[  135.291158]  ? _raw_spin_lock_irqsave+0x17/0x40\n[  135.292192]  new_sync_read+0x103/0x170\n[  135.293014]  vfs_read+0x15d/0x180\n[  135.293745]  ksys_read+0xa1/0xe0\n[  135.294461]  do_syscall_64+0x3c/0x80\n[  135.295284]  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis patch simply adds an extra check in __ext4_ext_check(), verifying that\neh_entries is not 0 when eh_depth is \u003e 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79cc091d-7c84-42c7-824c-7505b24588fd",
      "id": "CVE-2022-48768",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histogram: Fix a potential memory leak for kstrdup()\n\nkfree() is missing on an error path to free the memory allocated by\nkstrdup():\n\n  p = param = kstrdup(data-\u003eparams[i], GFP_KERNEL);\n\nSo it is better to free it via kfree(p).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1c8757c-c7d7-4140-ba02-555e7bee0d4e",
      "id": "CVE-2022-48799",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix list corruption in perf_cgroup_switch()\n\nThere's list corruption on cgrp_cpuctx_list. This happens on the\nfollowing path:\n\n  perf_cgroup_switch: list_for_each_entry(cgrp_cpuctx_list)\n      cpu_ctx_sched_in\n         ctx_sched_in\n            ctx_pinned_sched_in\n              merge_sched_in\n                  perf_cgroup_event_disable: remove the event from the list\n\nUse list_for_each_entry_safe() to allow removing an entry during\niteration.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37443479-44b8-44d2-b0dc-b995e48dd01b",
      "id": "CVE-2022-48924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: int340x: fix memory leak in int3400_notify()\n\nIt is easy to hit the below memory leaks in my TigerLake platform:\n\nunreferenced object 0xffff927c8b91dbc0 (size 32):\n  comm \"kworker/0:2\", pid 112, jiffies 4294893323 (age 83.604s)\n  hex dump (first 32 bytes):\n    4e 41 4d 45 3d 49 4e 54 33 34 30 30 20 54 68 65  NAME=INT3400 The\n    72 6d 61 6c 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  rmal.kkkkkkkkkk.\n  backtrace:\n    [\u003cffffffff9c502c3e\u003e] __kmalloc_track_caller+0x2fe/0x4a0\n    [\u003cffffffff9c7b7c15\u003e] kvasprintf+0x65/0xd0\n    [\u003cffffffff9c7b7d6e\u003e] kasprintf+0x4e/0x70\n    [\u003cffffffffc04cb662\u003e] int3400_notify+0x82/0x120 [int3400_thermal]\n    [\u003cffffffff9c8b7358\u003e] acpi_ev_notify_dispatch+0x54/0x71\n    [\u003cffffffff9c88f1a7\u003e] acpi_os_execute_deferred+0x17/0x30\n    [\u003cffffffff9c2c2c0a\u003e] process_one_work+0x21a/0x3f0\n    [\u003cffffffff9c2c2e2a\u003e] worker_thread+0x4a/0x3b0\n    [\u003cffffffff9c2cb4dd\u003e] kthread+0xfd/0x130\n    [\u003cffffffff9c201c1f\u003e] ret_from_fork+0x1f/0x30\n\nFix it by calling kfree() accordingly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e31a739-2e74-4705-8c71-209f5668088c",
      "id": "CVE-2022-49031",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: health: afe4403: Fix oob read in afe4403_read_raw\n\nKASAN report out-of-bounds read as follows:\n\nBUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0\nRead of size 4 at addr ffffffffc02ac638 by task cat/279\n\nCall Trace:\n afe4403_read_raw\n iio_read_channel_info\n dev_attr_show\n\nThe buggy address belongs to the variable:\n afe4403_channel_leds+0x18/0xffffffffffffe9e0\n\nThis issue can be reproduced by singe command:\n\n $ cat /sys/bus/spi/devices/spi0.0/iio\\:device0/in_intensity6_raw\n\nThe array size of afe4403_channel_leds is less than channels, so access\nwith chan-\u003eaddress cause OOB read in afe4403_read_raw. Fix it by moving\naccess before use it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08b686ee-33a6-46b3-921f-1fa5c8ff1709",
      "id": "CVE-2022-49098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Fix potential crash on module unload\n\nThe vmbus driver relies on the panic notifier infrastructure to perform\nsome operations when a panic event is detected. Since vmbus can be built\nas module, it is required that the driver handles both registering and\nunregistering such panic notifier callback.\n\nAfter commit 74347a99e73a (\"x86/Hyper-V: Unload vmbus channel in hv panic callback\")\nthough, the panic notifier registration is done unconditionally in the module\ninitialization routine whereas the unregistering procedure is conditionally\nguarded and executes only if HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE capability\nis set.\n\nThis patch fixes that by unconditionally unregistering the panic notifier\nin the module's exit routine as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "246a8d0b-3f71-4d53-932b-f59e9c73d159",
      "id": "CVE-2022-49578",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: Fix data-races around sysctl_ip_prot_sock.\n\nsysctl_ip_prot_sock is accessed concurrently, and there is always a chance\nof data-race.  So, all readers and writers need some basic protection to\navoid load/store-tearing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf48b5d1-5063-4ca6-8174-b09c983fb0a1",
      "id": "CVE-2022-49129",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt7921: fix crash when startup fails.\n\nIf the nic fails to start, it is possible that the\nreset_work has already been scheduled.  Ensure the\nwork item is canceled so we do not have use-after-free\ncrash in case cleanup is called before the work item\nis executed.\n\nThis fixes crash on my x86_64 apu2 when mt7921k radio\nfails to work.  Radio still fails, but OS does not\ncrash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "703c72ea-9eda-402c-96e0-4b7f6cd49866",
      "id": "CVE-2022-49176",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: fix use-after-free in bfq_dispatch_request\n\nKASAN reports a use-after-free report when doing normal scsi-mq test\n\n[69832.239032] ==================================================================\n[69832.241810] BUG: KASAN: use-after-free in bfq_dispatch_request+0x1045/0x44b0\n[69832.243267] Read of size 8 at addr ffff88802622ba88 by task kworker/3:1H/155\n[69832.244656]\n[69832.245007] CPU: 3 PID: 155 Comm: kworker/3:1H Not tainted 5.10.0-10295-g576c6382529e #8\n[69832.246626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[69832.249069] Workqueue: kblockd blk_mq_run_work_fn\n[69832.250022] Call Trace:\n[69832.250541]  dump_stack+0x9b/0xce\n[69832.251232]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.252243]  print_address_description.constprop.6+0x3e/0x60\n[69832.253381]  ? __cpuidle_text_end+0x5/0x5\n[69832.254211]  ? vprintk_func+0x6b/0x120\n[69832.254994]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.255952]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.256914]  kasan_report.cold.9+0x22/0x3a\n[69832.257753]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.258755]  check_memory_region+0x1c1/0x1e0\n[69832.260248]  bfq_dispatch_request+0x1045/0x44b0\n[69832.261181]  ? bfq_bfqq_expire+0x2440/0x2440\n[69832.262032]  ? blk_mq_delay_run_hw_queues+0xf9/0x170\n[69832.263022]  __blk_mq_do_dispatch_sched+0x52f/0x830\n[69832.264011]  ? blk_mq_sched_request_inserted+0x100/0x100\n[69832.265101]  __blk_mq_sched_dispatch_requests+0x398/0x4f0\n[69832.266206]  ? blk_mq_do_dispatch_ctx+0x570/0x570\n[69832.267147]  ? __switch_to+0x5f4/0xee0\n[69832.267898]  blk_mq_sched_dispatch_requests+0xdf/0x140\n[69832.268946]  __blk_mq_run_hw_queue+0xc0/0x270\n[69832.269840]  blk_mq_run_work_fn+0x51/0x60\n[69832.278170]  process_one_work+0x6d4/0xfe0\n[69832.278984]  worker_thread+0x91/0xc80\n[69832.279726]  ? __kthread_parkme+0xb0/0x110\n[69832.280554]  ? process_one_work+0xfe0/0xfe0\n[69832.281414]  kthread+0x32d/0x3f0\n[69832.282082]  ? kthread_park+0x170/0x170\n[69832.282849]  ret_from_fork+0x1f/0x30\n[69832.283573]\n[69832.283886] Allocated by task 7725:\n[69832.284599]  kasan_save_stack+0x19/0x40\n[69832.285385]  __kasan_kmalloc.constprop.2+0xc1/0xd0\n[69832.286350]  kmem_cache_alloc_node+0x13f/0x460\n[69832.287237]  bfq_get_queue+0x3d4/0x1140\n[69832.287993]  bfq_get_bfqq_handle_split+0x103/0x510\n[69832.289015]  bfq_init_rq+0x337/0x2d50\n[69832.289749]  bfq_insert_requests+0x304/0x4e10\n[69832.290634]  blk_mq_sched_insert_requests+0x13e/0x390\n[69832.291629]  blk_mq_flush_plug_list+0x4b4/0x760\n[69832.292538]  blk_flush_plug_list+0x2c5/0x480\n[69832.293392]  io_schedule_prepare+0xb2/0xd0\n[69832.294209]  io_schedule_timeout+0x13/0x80\n[69832.295014]  wait_for_common_io.constprop.1+0x13c/0x270\n[69832.296137]  submit_bio_wait+0x103/0x1a0\n[69832.296932]  blkdev_issue_discard+0xe6/0x160\n[69832.297794]  blk_ioctl_discard+0x219/0x290\n[69832.298614]  blkdev_common_ioctl+0x50a/0x1750\n[69832.304715]  blkdev_ioctl+0x470/0x600\n[69832.305474]  block_ioctl+0xde/0x120\n[69832.306232]  vfs_ioctl+0x6c/0xc0\n[69832.306877]  __se_sys_ioctl+0x90/0xa0\n[69832.307629]  do_syscall_64+0x2d/0x40\n[69832.308362]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[69832.309382]\n[69832.309701] Freed by task 155:\n[69832.310328]  kasan_save_stack+0x19/0x40\n[69832.311121]  kasan_set_track+0x1c/0x30\n[69832.311868]  kasan_set_free_info+0x1b/0x30\n[69832.312699]  __kasan_slab_free+0x111/0x160\n[69832.313524]  kmem_cache_free+0x94/0x460\n[69832.314367]  bfq_put_queue+0x582/0x940\n[69832.315112]  __bfq_bfqd_reset_in_service+0x166/0x1d0\n[69832.317275]  bfq_bfqq_expire+0xb27/0x2440\n[69832.318084]  bfq_dispatch_request+0x697/0x44b0\n[69832.318991]  __blk_mq_do_dispatch_sched+0x52f/0x830\n[69832.319984]  __blk_mq_sched_dispatch_requests+0x398/0x4f0\n[69832.321087]  blk_mq_sched_dispatch_requests+0xdf/0x140\n[69832.322225]  __blk_mq_run_hw_queue+0xc0/0x270\n[69832.323114]  blk_mq_run_work_fn+0x51/0x6\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b64ff274-3ed9-4a26-b1e6-f17b19acb7e6",
      "id": "CVE-2022-49182",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: add vlan list lock to protect vlan list\n\nWhen adding port base VLAN, vf VLAN need to remove from HW and modify\nthe vlan state in vf VLAN list as false. If the periodicity task is\nfreeing the same node, it may cause \"use after free\" error.\nThis patch adds a vlan list lock to protect the vlan list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f629cd1-dac6-4fbd-8b23-4fe28245ba03",
      "id": "CVE-2022-49205",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix double uncharge the mem of sk_msg\n\nIf tcp_bpf_sendmsg is running during a tear down operation, psock may be\nfreed.\n\ntcp_bpf_sendmsg()\n tcp_bpf_send_verdict()\n  sk_msg_return()\n  tcp_bpf_sendmsg_redir()\n   unlikely(!psock))\n     sk_msg_free()\n\nThe mem of msg has been uncharged in tcp_bpf_send_verdict() by\nsk_msg_return(), and would be uncharged by sk_msg_free() again. When psock\nis null, we can simply returning an error code, this would then trigger\nthe sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have\nthe side effect of throwing an error up to user space. This would be a\nslight change in behavior from user side but would look the same as an\nerror if the redirect on the socket threw an error.\n\nThis issue can cause the following info:\nWARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x24/0x1f0\n sk_psock_destroy+0x19b/0x1c0\n process_one_work+0x1b3/0x3c0\n worker_thread+0x30/0x350\n ? process_one_work+0x3c0/0x3c0\n kthread+0xe6/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d18d319-a10a-42bd-aec8-0c0102a45183",
      "id": "CVE-2022-49234",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: Avoid cross-chip syncing of VLAN filtering\n\nChanges to VLAN filtering are not applicable to cross-chip\nnotifications.\n\nOn a system like this:\n\n.-----.   .-----.   .-----.\n| sw1 +---+ sw2 +---+ sw3 |\n'-1-2-'   '-1-2-'   '-1-2-'\n\nBefore this change, upon sw1p1 leaving a bridge, a call to\ndsa_port_vlan_filtering would also be made to sw2p1 and sw3p1.\n\nIn this scenario:\n\n.---------.   .-----.   .-----.\n|   sw1   +---+ sw2 +---+ sw3 |\n'-1-2-3-4-'   '-1-2-'   '-1-2-'\n\nWhen sw1p4 would leave a bridge, dsa_port_vlan_filtering would be\ncalled for sw2 and sw3 with a non-existing port - leading to array\nout-of-bounds accesses and crashes on mv88e6xxx.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f53198b-ed40-4f08-80b5-44cf13dcec84",
      "id": "CVE-2022-49450",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix listen() setting the bar too high for the prealloc rings\n\nAF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump\nup the sysctl), but whilst the preallocation circular buffers have 32 slots\nin them, one of them has to be a dead slot because we're using CIRC_CNT().\n\nThis means that listen(rxrpc_sock, 32) will cause an oops when the socket\nis closed because rxrpc_service_prealloc_one() allocated one too many calls\nand rxrpc_discard_prealloc() won't then be able to get rid of them because\nit'll think the ring is empty.  rxrpc_release_calls_on_socket() then tries\nto abort them, but oopses because call-\u003epeer isn't yet set.\n\nFix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match\nthe ring capacity.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000086\n ...\n RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]\n Call Trace:\n  \u003cTASK\u003e\n  ? __wake_up_common_lock+0x7a/0x90\n  ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]\n  ? rxrpc_abort_call+0x4c/0x60 [rxrpc]\n  rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]\n  rxrpc_release+0xc9/0x1c0 [rxrpc]\n  __sock_release+0x37/0xa0\n  sock_close+0x11/0x20\n  __fput+0x89/0x240\n  task_work_run+0x59/0x90\n  do_exit+0x319/0xaa0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "033f9755-4d89-40c8-9ede-024b2e4dab88",
      "id": "CVE-2022-49437",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: Fix refcount leak in xive_spapr_init\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f8a3dc4-7458-459f-ac0a-8fbfe41b0f55",
      "id": "CVE-2022-49451",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix list protocols enumeration in the base protocol\n\nWhile enumerating protocols implemented by the SCMI platform using\nBASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is\ncurrently validated in an improper way since the check employs a sum\nbetween unsigned integers that could overflow and cause the check itself\nto be silently bypassed if the returned value 'loop_num_ret' is big\nenough.\n\nFix the validation avoiding the addition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "854e0d85-babe-4a24-8f87-bb41ce68e121",
      "id": "CVE-2022-49467",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: msm: fix possible memory leak in mdp5_crtc_cursor_set()\n\ndrm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo\nneeds to be put when msm_gem_get_and_pin_iova fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6aafddff-b846-4b24-8500-cfa1574066e3",
      "id": "CVE-2022-49535",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI\n\nIf lpfc_issue_els_flogi() fails and returns non-zero status, the node\nreference count is decremented to trigger the release of the nodelist\nstructure. However, if there is a prior registration or dev-loss-evt work\npending, the node may be released prematurely.  When dev-loss-evt\ncompletes, the released node is referenced causing a use-after-free null\npointer dereference.\n\nSimilarly, when processing non-zero ELS PLOGI completion status in\nlpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport\nregistration before triggering node removal.  If dev-loss-evt work is\npending, the node may be released prematurely and a subsequent call to\nlpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference.\n\nAdd test for pending dev-loss before decrementing the node reference count\nfor FLOGI, PLOGI, PRLI, and ADISC handling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f317b13-2ee3-4ce6-ac00-96a33966fd62",
      "id": "CVE-2022-49595",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_probe_threshold.\n\nWhile reading sysctl_tcp_probe_threshold, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7ae02d0-5173-4fe2-a4aa-c7b0ab2e7145",
      "id": "CVE-2022-49608",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: ralink: Check for null return of devm_kcalloc\n\nBecause of the possible failure of the allocation, data-\u003edomains might\nbe NULL pointer and will cause the dereference of the NULL pointer\nlater.\nTherefore, it might be better to check it and directly return -ENOMEM\nwithout releasing data manually if fails, because the comment of the\ndevm_kmalloc() says \"Memory allocated with this function is\nautomatically freed on driver detach.\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f5cb994e-7f56-474f-a9bb-9b2ea711944c",
      "id": "CVE-2022-49621",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: pmac32-cpufreq: Fix refcount leak bug\n\nIn pmac_cpufreq_init_MacRISC3(), we need to add corresponding\nof_node_put() for the three node pointers whose refcount have\nbeen incremented by of_find_node_by_name().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58d6fbde-e0bb-480c-be88-1ebc384fb1e6",
      "id": "CVE-2022-49811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: use after free in drbd_create_device()\n\nThe drbd_destroy_connection() frees the \"connection\" so use the _safe()\niterator to prevent a use after free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1a1d853-2f1b-4296-97e0-2371f017b942",
      "id": "CVE-2023-4206",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation.\n\nWhen route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.\n\nWe recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c0def557-cfa4-4716-b2ed-139ce612523d",
      "id": "CVE-2022-49864",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()\n\n./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5fa0ec83-8069-4187-88cc-192d92882351",
      "id": "CVE-2022-50132",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()\n\nIf 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer\nand its dereference with priv_ep-\u003ecdns3_dev may cause panic.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "80789185-96a3-400d-931a-a6ea7c268258",
      "id": "CVE-2022-50191",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: of: Fix refcount leak bug in of_get_regulation_constraints()\n\nWe should call the of_node_put() for the reference returned by\nof_get_child_by_name() which has increased the refcount.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f458866-f6b4-45a0-a3f3-a4b5b8027473",
      "id": "CVE-2022-50297",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: verify the expected usb_endpoints are present\n\nThe bug arises when a USB device claims to be an ATH9K but doesn't\nhave the expected endpoints. (In this case there was an interrupt\nendpoint where the driver expected a bulk endpoint.) The kernel\nneeds to be able to handle such devices without getting an internal error.\n\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493\nModules linked in:\nCPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nWorkqueue: events request_firmware_work_func\nRIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493\nCall Trace:\n ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline]\n ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019\n ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline]\n ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242\n request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097\n process_one_work+0x9af/0x1600 kernel/workqueue.c:2279\n worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425\n kthread+0x3b4/0x4a0 kernel/kthread.c:313\n ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3a114657-358f-44af-86cb-6dd0b789933b",
      "id": "CVE-2023-31436",
      "description": "qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbd0dc48-ed9e-4b8d-82cc-f92e282135fc",
      "id": "CVE-2023-4394",
      "description": "A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba3647cd-6deb-40a7-97dc-f877ee8b9e7f",
      "id": "CVE-2023-46838",
      "description": "Transmit requests in Xen's virtual network protocol can consist of\nmultiple parts.  While not really useful, except for the initial part\nany of them may be of zero length, i.e. carry no data at all.  Besides a\ncertain initial portion of the to be transferred data, these parts are\ndirectly translated into what Linux calls SKB fragments.  Such converted\nrequest parts can, when for a particular SKB they are all of length\nzero, lead to a de-reference of NULL in core networking code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "158c1590-fed9-43d1-a48d-1126346895a6",
      "id": "CVE-2023-52481",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: errata: Add Cortex-A520 speculative unprivileged load workaround\n\nImplement the workaround for ARM Cortex-A520 erratum 2966298. On an\naffected Cortex-A520 core, a speculatively executed unprivileged load\nmight leak data from a privileged load via a cache side channel. The\nissue only exists for loads within a translation regime with the same\ntranslation (e.g. same ASID and VMID). Therefore, the issue only affects\nthe return to EL0.\n\nThe workaround is to execute a TLBI before returning to EL0 after all\nloads of privileged data. A non-shareable TLBI to any address is\nsufficient.\n\nThe workaround isn't necessary if page table isolation (KPTI) is\nenabled, but for simplicity it will be. Page table isolation should\nnormally be disabled for Cortex-A520 as it supports the CSV3 feature\nand the E0PD feature (used when KASLR is enabled).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2bc65274-dbca-4dee-b7e7-03ea10a22bbf",
      "id": "CVE-2023-52498",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: sleep: Fix possible deadlocks in core system-wide PM code\n\nIt is reported that in low-memory situations the system-wide resume core\ncode deadlocks, because async_schedule_dev() executes its argument\nfunction synchronously if it cannot allocate memory (and not only in\nthat case) and that function attempts to acquire a mutex that is already\nheld.  Executing the argument function synchronously from within\ndpm_async_fn() may also be problematic for ordering reasons (it may\ncause a consumer device's resume callback to be invoked before a\nrequisite supplier device's one, for example).\n\nAddress this by changing the code in question to use\nasync_schedule_dev_nocall() for scheduling the asynchronous\nexecution of device suspend and resume functions and to directly\nrun them synchronously if async_schedule_dev_nocall() returns false.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "648035ab-b8d8-4320-a4e9-c3b0129a9c79",
      "id": "CVE-2023-52588",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11828c5d-02ef-45f5-8b7c-683a73354a78",
      "id": "CVE-2023-52632",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix lock dependency warning with srcu\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.5.0-kfd-yangp #2289 Not tainted\n------------------------------------------------------\nkworker/0:2/996 is trying to acquire lock:\n        (srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x5/0x1a0\n\nbut task is already holding lock:\n        ((work_completion)(\u0026svms-\u003edeferred_list_work)){+.+.}-{0:0}, at:\n\tprocess_one_work+0x211/0x560\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #3 ((work_completion)(\u0026svms-\u003edeferred_list_work)){+.+.}-{0:0}:\n        __flush_work+0x88/0x4f0\n        svm_range_list_lock_and_flush_work+0x3d/0x110 [amdgpu]\n        svm_range_set_attr+0xd6/0x14c0 [amdgpu]\n        kfd_ioctl+0x1d1/0x630 [amdgpu]\n        __x64_sys_ioctl+0x88/0xc0\n\n-\u003e #2 (\u0026info-\u003elock#2){+.+.}-{3:3}:\n        __mutex_lock+0x99/0xc70\n        amdgpu_amdkfd_gpuvm_restore_process_bos+0x54/0x740 [amdgpu]\n        restore_process_helper+0x22/0x80 [amdgpu]\n        restore_process_worker+0x2d/0xa0 [amdgpu]\n        process_one_work+0x29b/0x560\n        worker_thread+0x3d/0x3d0\n\n-\u003e #1 ((work_completion)(\u0026(\u0026process-\u003erestore_work)-\u003ework)){+.+.}-{0:0}:\n        __flush_work+0x88/0x4f0\n        __cancel_work_timer+0x12c/0x1c0\n        kfd_process_notifier_release_internal+0x37/0x1f0 [amdgpu]\n        __mmu_notifier_release+0xad/0x240\n        exit_mmap+0x6a/0x3a0\n        mmput+0x6a/0x120\n        do_exit+0x322/0xb90\n        do_group_exit+0x37/0xa0\n        __x64_sys_exit_group+0x18/0x20\n        do_syscall_64+0x38/0x80\n\n-\u003e #0 (srcu){.+.+}-{0:0}:\n        __lock_acquire+0x1521/0x2510\n        lock_sync+0x5f/0x90\n        __synchronize_srcu+0x4f/0x1a0\n        __mmu_notifier_release+0x128/0x240\n        exit_mmap+0x6a/0x3a0\n        mmput+0x6a/0x120\n        svm_range_deferred_list_work+0x19f/0x350 [amdgpu]\n        process_one_work+0x29b/0x560\n        worker_thread+0x3d/0x3d0\n\nother info that might help us debug this:\nChain exists of:\n  srcu --\u003e \u0026info-\u003elock#2 --\u003e (work_completion)(\u0026svms-\u003edeferred_list_work)\n\nPossible unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n        lock((work_completion)(\u0026svms-\u003edeferred_list_work));\n                        lock(\u0026info-\u003elock#2);\n\t\t\tlock((work_completion)(\u0026svms-\u003edeferred_list_work));\n        sync(srcu);",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57a8908d-e5c2-4610-a4e9-e1bad4c875bd",
      "id": "CVE-2023-52680",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: scarlett2: Add missing error checks to *_ctl_get()\n\nThe *_ctl_get() functions which call scarlett2_update_*() were not\nchecking the return value. Fix to check the return value and pass to\nthe caller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e69e0ed0-cbe3-4d1c-81a6-b0f3e25f76f7",
      "id": "CVE-2023-52749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: Fix null dereference on suspend\n\nA race condition exists where a synchronous (noqueue) transfer can be\nactive during a system suspend. This can cause a null pointer\ndereference exception to occur when the system resumes.\n\nExample order of events leading to the exception:\n1. spi_sync() calls __spi_transfer_message_noqueue() which sets\n   ctlr-\u003ecur_msg\n2. Spi transfer begins via spi_transfer_one_message()\n3. System is suspended interrupting the transfer context\n4. System is resumed\n6. spi_controller_resume() calls spi_start_queue() which resets cur_msg\n   to NULL\n7. Spi transfer context resumes and spi_finalize_current_message() is\n   called which dereferences cur_msg (which is now NULL)\n\nWait for synchronous transfers to complete before suspending by\nacquiring the bus mutex and setting/checking a suspend flag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "31e497fd-6cec-478c-9664-60b9a91d45fc",
      "id": "CVE-2023-52804",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: Add validity check for db_maxag and db_agpref\n\nBoth db_maxag and db_agpref are used as the index of the\ndb_agfree array, but there is currently no validity check for\ndb_maxag and db_agpref, which can lead to errors.\n\nThe following is related bug reported by Syzbot:\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20\nindex 7936 is out of range for type 'atomic_t[128]'\n\nAdd checking that the values of db_maxag and db_agpref are valid\nindexes for the db_agfree array.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5695aa56-0a75-4a24-9f87-1c0167d08d22",
      "id": "CVE-2023-52827",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()\n\nlen is extracted from HTT message and could be an unexpected value in\ncase errors happen, so add validation before using to avoid possible\nout-of-bound read in the following message iteration and parsing.\n\nThe same issue also applies to ppdu_info-\u003eppdu_stats.common.num_users,\nso validate it before using too.\n\nThese are found during code review.\n\nCompile test only.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9cde49f-7fb1-4379-8d1c-5163bc3d20c9",
      "id": "CVE-2023-52832",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't return unset power in ieee80211_get_tx_power()\n\nWe can get a UBSAN warning if ieee80211_get_tx_power() returns the\nINT_MIN value mac80211 internally uses for \"unset power level\".\n\n UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5\n -2147483648 * 100 cannot be represented in type 'int'\n CPU: 0 PID: 20433 Comm: insmod Tainted: G        WC OE\n Call Trace:\n  dump_stack+0x74/0x92\n  ubsan_epilogue+0x9/0x50\n  handle_overflow+0x8d/0xd0\n  __ubsan_handle_mul_overflow+0xe/0x10\n  nl80211_send_iface+0x688/0x6b0 [cfg80211]\n  [...]\n  cfg80211_register_wdev+0x78/0xb0 [cfg80211]\n  cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211]\n  [...]\n  ieee80211_if_add+0x60e/0x8f0 [mac80211]\n  ieee80211_register_hw+0xda5/0x1170 [mac80211]\n\nIn this case, simply return an error instead, to indicate\nthat no data is available.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49f50ee2-89f3-4379-a109-ea577e909852",
      "id": "CVE-2023-5717",
      "description": "A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.\n\nIf perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.\n\nWe recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b8aefd5-330b-489d-852b-c38d8c6f5fee",
      "id": "CVE-2023-3159",
      "description": "A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54144103-0f47-4808-8b08-b19c9e3d6399",
      "id": "CVE-2023-53220",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: az6007: Fix null-ptr-deref in az6007_i2c_xfer()\n\nIn az6007_i2c_xfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach az6007_i2c_xfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 0ed554fd769a\n(\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23e13932-3801-4f06-b3bd-4cabaa2c4826",
      "id": "CVE-2023-53234",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix kmemleak in watchdog_cdev_register\n\nkmemleak reports memory leaks in watchdog_dev_register, as follows:\nunreferenced object 0xffff888116233000 (size 2048):\n  comm \"\"modprobe\"\", pid 28147, jiffies 4353426116 (age 61.741s)\n  hex dump (first 32 bytes):\n    80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff  .........0#.....\n    08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00  .0#.............\n  backtrace:\n    [\u003c000000007f001ffd\u003e] __kmem_cache_alloc_node+0x157/0x220\n    [\u003c000000006a389304\u003e] kmalloc_trace+0x21/0x110\n    [\u003c000000008d640eea\u003e] watchdog_dev_register+0x4e/0x780 [watchdog]\n    [\u003c0000000053c9f248\u003e] __watchdog_register_device+0x4f0/0x680 [watchdog]\n    [\u003c00000000b2979824\u003e] watchdog_register_device+0xd2/0x110 [watchdog]\n    [\u003c000000001f730178\u003e] 0xffffffffc10880ae\n    [\u003c000000007a1a8bcc\u003e] do_one_initcall+0xcb/0x4d0\n    [\u003c00000000b98be325\u003e] do_init_module+0x1ca/0x5f0\n    [\u003c0000000046d08e7c\u003e] load_module+0x6133/0x70f0\n    ...\n\nunreferenced object 0xffff888105b9fa80 (size 16):\n  comm \"\"modprobe\"\", pid 28147, jiffies 4353426116 (age 61.741s)\n  hex dump (first 16 bytes):\n    77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff  watchdog1.......\n  backtrace:\n    [\u003c000000007f001ffd\u003e] __kmem_cache_alloc_node+0x157/0x220\n    [\u003c00000000486ab89b\u003e] __kmalloc_node_track_caller+0x44/0x1b0\n    [\u003c000000005a39aab0\u003e] kvasprintf+0xb5/0x140\n    [\u003c0000000024806f85\u003e] kvasprintf_const+0x55/0x180\n    [\u003c000000009276cb7f\u003e] kobject_set_name_vargs+0x56/0x150\n    [\u003c00000000a92e820b\u003e] dev_set_name+0xab/0xe0\n    [\u003c00000000cec812c6\u003e] watchdog_dev_register+0x285/0x780 [watchdog]\n    [\u003c0000000053c9f248\u003e] __watchdog_register_device+0x4f0/0x680 [watchdog]\n    [\u003c00000000b2979824\u003e] watchdog_register_device+0xd2/0x110 [watchdog]\n    [\u003c000000001f730178\u003e] 0xffffffffc10880ae\n    [\u003c000000007a1a8bcc\u003e] do_one_initcall+0xcb/0x4d0\n    [\u003c00000000b98be325\u003e] do_init_module+0x1ca/0x5f0\n    [\u003c0000000046d08e7c\u003e] load_module+0x6133/0x70f0\n    ...\n\nThe reason is that put_device is not be called if cdev_device_add fails\nand wdd-\u003eid != 0.\n\nwatchdog_cdev_register\n  wd_data = kzalloc                             [1]\n  err = dev_set_name                            [2]\n  ..\n  err = cdev_device_add\n  if (err) {\n    if (wdd-\u003eid == 0) {  // wdd-\u003eid != 0\n      ..\n    }\n    return err;  // [1],[2] would be leaked\n\nTo fix it, call put_device in all wdd-\u003eid cases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d42d6758-409e-48fa-b286-a57818ccf089",
      "id": "CVE-2023-53311",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput\n\nDuring unmount process of nilfs2, nothing holds nilfs_root structure after\nnilfs2 detaches its writer in nilfs_detach_log_writer().  Previously,\nnilfs_evict_inode() could cause use-after-free read for nilfs_root if\ninodes are left in \"garbage_list\" and released by nilfs_dispose_list at\nthe end of nilfs_detach_log_writer(), and this bug was fixed by commit\n9b5a04ac3ad9 (\"nilfs2: fix use-after-free bug of nilfs_root in\nnilfs_evict_inode()\").\n\nHowever, it turned out that there is another possibility of UAF in the\ncall path where mark_inode_dirty_sync() is called from iput():\n\nnilfs_detach_log_writer()\n  nilfs_dispose_list()\n    iput()\n      mark_inode_dirty_sync()\n        __mark_inode_dirty()\n          nilfs_dirty_inode()\n            __nilfs_mark_inode_dirty()\n              nilfs_load_inode_block() --\u003e causes UAF of nilfs_root struct\n\nThis can happen after commit 0ae45f63d4ef (\"vfs: add support for a\nlazytime mount option\"), which changed iput() to call\nmark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME\nflag and i_nlink is non-zero.\n\nThis issue appears after commit 28a65b49eb53 (\"nilfs2: do not write dirty\ndata after degenerating to read-only\") when using the syzbot reproducer,\nbut the issue has potentially existed before.\n\nFix this issue by adding a \"purging flag\" to the nilfs structure, setting\nthat flag while disposing the \"garbage_list\" and checking it in\n__nilfs_mark_inode_dirty().\n\nUnlike commit 9b5a04ac3ad9 (\"nilfs2: fix use-after-free bug of nilfs_root\nin nilfs_evict_inode()\"), this patch does not rely on ns_writer to\ndetermine whether to skip operations, so as not to break recovery on\nmount.  The nilfs_salvage_orphan_logs routine dirties the buffer of\nsalvaged data before attaching the log writer, so changing\n__nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL\nwill cause recovery write to fail.  The purpose of using the cleanup-only\nflag is to allow for narrowing of such conditions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd2b9baf-11d3-4351-8e1b-ad02bc9f3c75",
      "id": "CVE-2023-53369",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dcb: choose correct policy to parse DCB_ATTR_BCN\n\nThe dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN],\nwhich is introduced in commit 859ee3c43812 (\"DCB: Add support for DCB\nBCN\"). Please see the comment in below code\n\nstatic int dcbnl_bcn_setcfg(...)\n{\n  ...\n  ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. )\n  // !!! dcbnl_pfc_up_nest for attributes\n  //  DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs\n  ...\n  for (i = DCB_BCN_ATTR_RP_0; i \u003c= DCB_BCN_ATTR_RP_7; i++) {\n  // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs\n    ...\n    value_byte = nla_get_u8(data[i]);\n    ...\n  }\n  ...\n  for (i = DCB_BCN_ATTR_BCNA_0; i \u003c= DCB_BCN_ATTR_RI; i++) {\n  // !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs\n  ...\n    value_int = nla_get_u32(data[i]);\n  ...\n  }\n  ...\n}\n\nThat is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest\nattributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the\nfollowing access code fetch each nlattr as dcbnl_bcn_attrs attributes.\nBy looking up the associated nla_policy for dcbnl_bcn_attrs. We can find\nthe beginning part of these two policies are \"same\".\n\nstatic const struct nla_policy dcbnl_pfc_up_nest[...] = {\n        [DCB_PFC_UP_ATTR_0]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_1]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_2]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_3]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_4]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_5]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_6]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_7]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG},\n};\n\nstatic const struct nla_policy dcbnl_bcn_nest[...] = {\n        [DCB_BCN_ATTR_RP_0]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_1]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_2]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_3]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_4]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_5]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_6]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_7]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_ALL]       = {.type = NLA_FLAG},\n        // from here is somewhat different\n        [DCB_BCN_ATTR_BCNA_0]       = {.type = NLA_U32},\n        ...\n        [DCB_BCN_ATTR_ALL]          = {.type = NLA_FLAG},\n};\n\nTherefore, the current code is buggy and this\nnla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use\nthe adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0.\n\nHence use the correct policy dcbnl_bcn_nest to parse the nested\ntb[DCB_ATTR_BCN] TLV.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed696d17-9fb0-4c4d-aa68-18b9f12b549f",
      "id": "CVE-2023-53372",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix a potential overflow in sctp_ifwdtsn_skip\n\nCurrently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only\nchecks the pos against the end of the chunk. However, the data left for\nthe last pos may be \u003c sizeof(struct sctp_ifwdtsn_skip), and dereference\nit as struct sctp_ifwdtsn_skip may cause coverflow.\n\nThis patch fixes it by checking the pos against \"the end of the chunk -\nsizeof(struct sctp_ifwdtsn_skip)\" in sctp_ifwdtsn_skip, similar to\nsctp_fwdtsn_skip.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6a4fdfc0-e105-4b03-ad72-ad676a693100",
      "id": "CVE-2024-50301",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsecurity/keys: fix slab-out-of-bounds in key_task_permission\n\nKASAN reports an out of bounds read:\nBUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36\nBUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline]\nBUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410\nsecurity/keys/permission.c:54\nRead of size 4 at addr ffff88813c3ab618 by task stress-ng/4362\n\nCPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0x107/0x167 lib/dump_stack.c:123\n print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n __kuid_val include/linux/uidgid.h:36 [inline]\n uid_eq include/linux/uidgid.h:63 [inline]\n key_task_permission+0x394/0x410 security/keys/permission.c:54\n search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793\n\nThis issue was also reported by syzbot.\n\nIt can be reproduced by following these steps(more details [1]):\n1. Obtain more than 32 inputs that have similar hashes, which ends with the\n   pattern '0xxxxxxxe6'.\n2. Reboot and add the keys obtained in step 1.\n\nThe reproducer demonstrates how this issue happened:\n1. In the search_nested_keyrings function, when it iterates through the\n   slots in a node(below tag ascend_to_node), if the slot pointer is meta\n   and node-\u003eback_pointer != NULL(it means a root), it will proceed to\n   descend_to_node. However, there is an exception. If node is the root,\n   and one of the slots points to a shortcut, it will be treated as a\n   keyring.\n2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function.\n   However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as\n   ASSOC_ARRAY_PTR_SUBTYPE_MASK.\n3. When 32 keys with the similar hashes are added to the tree, the ROOT\n   has keys with hashes that are not similar (e.g. slot 0) and it splits\n   NODE A without using a shortcut. When NODE A is filled with keys that\n   all hashes are xxe6, the keys are similar, NODE A will split with a\n   shortcut. Finally, it forms the tree as shown below, where slot 6 points\n   to a shortcut.\n\n                      NODE A\n              +------\u003e+---+\n      ROOT    |       | 0 | xxe6\n      +---+   |       +---+\n xxxx | 0 | shortcut  :   : xxe6\n      +---+   |       +---+\n xxe6 :   :   |       |   | xxe6\n      +---+   |       +---+\n      | 6 |---+       :   : xxe6\n      +---+           +---+\n xxe6 :   :           | f | xxe6\n      +---+           +---+\n xxe6 | f |\n      +---+\n\n4. As mentioned above, If a slot(slot 6) of the root points to a shortcut,\n   it may be mistakenly transferred to a key*, leading to a read\n   out-of-bounds read.\n\nTo fix this issue, one should jump to descend_to_node if the ptr is a\nshortcut, regardless of whether the node is root or not.\n\n[1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/\n\n[jarkko: tweaked the commit message a bit to have an appropriate closes\n tag.]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce607550-0f1b-4567-9404-5aebc50d2bf0",
      "id": "CVE-2024-26648",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay()\n\nIn edp_setup_replay(), 'struct dc *dc' \u0026 'struct dmub_replay *replay'\nwas dereferenced before the pointer 'link' \u0026 'replay' NULL check.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:947 edp_setup_replay() warn: variable dereferenced before check 'link' (see line 933)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "730653de-4dba-455e-9fdf-126b76ceaf2d",
      "id": "CVE-2024-26852",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\n\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\n\nCommit f7225172f25a (\"net/ipv6: prevent use after free in\nip6_route_mpath_notify\") was not able to fix the root cause.\n\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\n\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\n\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x167/0x540 mm/kasan/report.c:488\n  kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n  inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n  ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n  ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n  inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n \u003c/TASK\u003e\n\nAllocated by task 23037:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3981 [inline]\n  __kmalloc+0x22e/0x490 mm/slub.c:3994\n  kmalloc include/linux/slab.h:594 [inline]\n  kzalloc include/linux/slab.h:711 [inline]\n  fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n  ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n  ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n  inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n\nFreed by task 16:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n  poison_slab_object+0xa6/0xe0 m\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7bfa4d66-3934-4e9b-99ba-086e323d14fa",
      "id": "CVE-2024-26961",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac802154_llsec_key_del\n\nmac802154_llsec_key_del() can free resources of a key directly without\nfollowing the RCU rules for waiting before the end of a grace period. This\nmay lead to use-after-free in case llsec_lookup_key() is traversing the\nlist of keys in parallel with a key deletion:\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0\nModules linked in:\nCPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x162/0x2a0\nCall Trace:\n \u003cTASK\u003e\n llsec_lookup_key.isra.0+0x890/0x9e0\n mac802154_llsec_encrypt+0x30c/0x9c0\n ieee802154_subif_start_xmit+0x24/0x1e0\n dev_hard_start_xmit+0x13e/0x690\n sch_direct_xmit+0x2ae/0xbc0\n __dev_queue_xmit+0x11dd/0x3c20\n dgram_sendmsg+0x90b/0xd60\n __sys_sendto+0x466/0x4c0\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x45/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nAlso, ieee802154_llsec_key_entry structures are not freed by\nmac802154_llsec_key_del():\n\nunreferenced object 0xffff8880613b6980 (size 64):\n  comm \"iwpan\", pid 2176, jiffies 4294761134 (age 60.475s)\n  hex dump (first 32 bytes):\n    78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de  x.......\".......\n    00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff81dcfa62\u003e] __kmem_cache_alloc_node+0x1e2/0x2d0\n    [\u003cffffffff81c43865\u003e] kmalloc_trace+0x25/0xc0\n    [\u003cffffffff88968b09\u003e] mac802154_llsec_key_add+0xac9/0xcf0\n    [\u003cffffffff8896e41a\u003e] ieee802154_add_llsec_key+0x5a/0x80\n    [\u003cffffffff8892adc6\u003e] nl802154_add_llsec_key+0x426/0x5b0\n    [\u003cffffffff86ff293e\u003e] genl_family_rcv_msg_doit+0x1fe/0x2f0\n    [\u003cffffffff86ff46d1\u003e] genl_rcv_msg+0x531/0x7d0\n    [\u003cffffffff86fee7a9\u003e] netlink_rcv_skb+0x169/0x440\n    [\u003cffffffff86ff1d88\u003e] genl_rcv+0x28/0x40\n    [\u003cffffffff86fec15c\u003e] netlink_unicast+0x53c/0x820\n    [\u003cffffffff86fecd8b\u003e] netlink_sendmsg+0x93b/0xe60\n    [\u003cffffffff86b91b35\u003e] ____sys_sendmsg+0xac5/0xca0\n    [\u003cffffffff86b9c3dd\u003e] ___sys_sendmsg+0x11d/0x1c0\n    [\u003cffffffff86b9c65a\u003e] __sys_sendmsg+0xfa/0x1d0\n    [\u003cffffffff88eadbf5\u003e] do_syscall_64+0x45/0xf0\n    [\u003cffffffff890000ea\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nHandle the proper resource release in the RCU callback function\nmac802154_llsec_key_del_rcu().\n\nNote that if llsec_lookup_key() finds a key, it gets a refcount via\nllsec_key_get() and locally copies key id from key_entry (which is a\nlist element). So it's safe to call llsec_key_put() and free the list\nentry after the RCU grace period elapses.\n\nFound by Linux Verification Center (linuxtesting.org).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "614be487-a174-45b6-af82-0a5df16de6bc",
      "id": "CVE-2024-26969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: gcc-ipq8074: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0320030d-dcf7-4520-b07f-4e657caa2ebd",
      "id": "CVE-2024-26996",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error\n\nWhen ncm function is working and then stop usb0 interface for link down,\neth_stop() is called. At this piont, accidentally if usb transport error\nshould happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled.\n\nAfter that, ncm_disable() is called to disable for ncm unbind\nbut gether_disconnect() is never called since 'in_ep' is not enabled.\n\nAs the result, ncm object is released in ncm unbind\nbut 'dev-\u003eport_usb' associated to 'ncm-\u003eport' is not NULL.\n\nAnd when ncm bind again to recover netdev, ncm object is reallocated\nbut usb0 interface is already associated to previous released ncm object.\n\nTherefore, once usb0 interface is up and eth_start_xmit() is called,\nreleased ncm object is dereferrenced and it might cause use-after-free memory.\n\n[function unlink via configfs]\n  usb0: eth_stop dev-\u003eport_usb=ffffff9b179c3200\n  --\u003e error happens in usb_ep_enable().\n  NCM: ncm_disable: ncm=ffffff9b179c3200\n  --\u003e no gether_disconnect() since ncm-\u003eport.in_ep-\u003eenabled is false.\n  NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200\n  NCM: ncm_free: ncm free ncm=ffffff9b179c3200   \u003c-- released ncm\n\n[function link via configfs]\n  NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000\n  NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000\n  NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0\n  usb0: eth_open dev-\u003eport_usb=ffffff9b179c3200  \u003c-- previous released ncm\n  usb0: eth_start dev-\u003eport_usb=ffffff9b179c3200 \u003c--\n  eth_start_xmit()\n  --\u003e dev-\u003ewrap()\n  Unable to handle kernel paging request at virtual address dead00000000014f\n\nThis patch addresses the issue by checking if 'ncm-\u003enetdev' is not NULL at\nncm_disable() to call gether_disconnect() to deassociate 'dev-\u003eport_usb'.\nIt's more reasonable to check 'ncm-\u003enetdev' to call gether_connect/disconnect\nrather than check 'ncm-\u003eport.in_ep-\u003eenabled' since it might not be enabled\nbut the gether connection might be established.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8146a81-0fa8-4cae-a51a-8329c7b27a4f",
      "id": "CVE-2024-35847",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Prevent double free on error\n\nThe error handling path in its_vpe_irq_domain_alloc() causes a double free\nwhen its_vpe_init() fails after successfully allocating at least one\ninterrupt. This happens because its_vpe_irq_domain_free() frees the\ninterrupts along with the area bitmap and the vprop_page and\nits_vpe_irq_domain_alloc() subsequently frees the area bitmap and the\nvprop_page again.\n\nFix this by unconditionally invoking its_vpe_irq_domain_free() which\nhandles all cases correctly and by removing the bitmap/vprop_page freeing\nfrom its_vpe_irq_domain_alloc().\n\n[ tglx: Massaged change log ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6ac977a-609a-451d-877d-3c8572b65f0b",
      "id": "CVE-2024-35878",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: module: prevent NULL pointer dereference in vsnprintf()\n\nIn of_modalias(), we can get passed the str and len parameters which would\ncause a kernel oops in vsnprintf() since it only allows passing a NULL ptr\nwhen the length is also 0. Also, we need to filter out the negative values\nof the len parameter as these will result in a really huge buffer since\nsnprintf() takes size_t parameter while ours is ssize_t...\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6708ab18-e1ba-432a-8953-d658bec9bd57",
      "id": "CVE-2024-35936",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()\n\nThe unhandled case in btrfs_relocate_sys_chunks() loop is a corruption,\nas it could be caused only by two impossible conditions:\n\n- at first the search key is set up to look for a chunk tree item, with\n  offset -1, this is an inexact search and the key-\u003eoffset will contain\n  the correct offset upon a successful search, a valid chunk tree item\n  cannot have an offset -1\n\n- after first successful search, the found_key corresponds to a chunk\n  item, the offset is decremented by 1 before the next loop, it's\n  impossible to find a chunk item there due to alignment and size\n  constraints",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d3539a0-997e-49a3-9241-f61fd2e2cd9d",
      "id": "CVE-2024-35939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-direct: Leak pages on dma_set_decrypted() failure\n\nOn TDX it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nDMA could free decrypted/shared pages if dma_set_decrypted() fails. This\nshould be a rare case. Just leak the pages in this case instead of\nfreeing them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ac52e9f-a516-4de8-8d76-d081101d8b5f",
      "id": "CVE-2024-38567",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: add a proper sanity check for endpoints\n\nSyzkaller reports [1] hitting a warning which is caused by presence\nof a wrong endpoint type at the URB sumbitting stage. While there\nwas a check for a specific 4th endpoint, since it can switch types\nbetween bulk and interrupt, other endpoints are trusted implicitly.\nSimilar warning is triggered in a couple of other syzbot issues [2].\n\nFix the issue by doing a comprehensive check of all endpoints\ntaking into account difference between high- and full-speed\nconfiguration.\n\n[1] Syzkaller report:\n...\nWARNING: CPU: 0 PID: 4721 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\n...\nCall Trace:\n \u003cTASK\u003e\n carl9170_usb_send_rx_irq_urb+0x273/0x340 drivers/net/wireless/ath/carl9170/usb.c:504\n carl9170_usb_init_device drivers/net/wireless/ath/carl9170/usb.c:939 [inline]\n carl9170_usb_firmware_finish drivers/net/wireless/ath/carl9170/usb.c:999 [inline]\n carl9170_usb_firmware_step2+0x175/0x240 drivers/net/wireless/ath/carl9170/usb.c:1028\n request_firmware_work_func+0x130/0x240 drivers/base/firmware_loader/main.c:1107\n process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289\n worker_thread+0x669/0x1090 kernel/workqueue.c:2436\n kthread+0x2e8/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n \u003c/TASK\u003e\n\n[2] Related syzkaller crashes:",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "578d9205-9ef5-4ec8-93e4-1ad719773a78",
      "id": "CVE-2024-43863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix a deadlock in dma buf fence polling\n\nIntroduce a version of the fence ops that on release doesn't remove\nthe fence from the pending list, and thus doesn't require a lock to\nfix poll-\u003efence wait-\u003efence unref deadlocks.\n\nvmwgfx overwrites the wait callback to iterate over the list of all\nfences and update their status, to do that it holds a lock to prevent\nthe list modifcations from other threads. The fence destroy callback\nboth deletes the fence and removes it from the list of pending\nfences, for which it holds a lock.\n\ndma buf polling cb unrefs a fence after it's been signaled: so the poll\ncalls the wait, which signals the fences, which are being destroyed.\nThe destruction tries to acquire the lock on the pending fences list\nwhich it can never get because it's held by the wait from which it\nwas called.\n\nOld bug, but not a lot of userspace apps were using dma-buf polling\ninterfaces. Fix those, in particular this fixes KDE stalls/deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d61bfc6-c115-4f3d-8ac8-35728733f16e",
      "id": "CVE-2024-44950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: fix invalid FIFO access with special register set\n\nWhen enabling access to the special register set, Receiver time-out and\nRHR interrupts can happen. In this case, the IRQ handler will try to read\nfrom the FIFO thru the RHR register at address 0x00, but address 0x00 is\nmapped to DLL register, resulting in erroneous FIFO reading.\n\nCall graph example:\n    sc16is7xx_startup(): entry\n    sc16is7xx_ms_proc(): entry\n    sc16is7xx_set_termios(): entry\n    sc16is7xx_set_baud(): DLH/DLL = $009C --\u003e access special register set\n    sc16is7xx_port_irq() entry            --\u003e IIR is 0x0C\n    sc16is7xx_handle_rx() entry\n    sc16is7xx_fifo_read(): --\u003e unable to access FIFO (RHR) because it is\n                               mapped to DLL (LCR=LCR_CONF_MODE_A)\n    sc16is7xx_set_baud(): exit --\u003e Restore access to general register set\n\nFix the problem by claiming the efr_lock mutex when accessing the Special\nregister set.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3756edc-f4ca-4a78-8031-21e1cca7a4fc",
      "id": "CVE-2024-46806",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix the warning division or modulo by zero\n\nChecks the partition mode and returns an error for an invalid mode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2419f83e-f609-4e6a-a906-eceeabe7ecad",
      "id": "CVE-2025-37803",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: fix a buf size overflow issue during udmabuf creation\n\nby casting size_limit_mb to u64  when calculate pglimit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89b1551a-f94d-4d3c-bd92-4f07458b1816",
      "id": "CVE-2024-47659",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label 'foo' connects to a label 'bar' with tcp/ipv4,\n'foo' always gets 'foo' in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled ('foo' instead of 'bar')\n2) 'bar' can write to 'foo' without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let's call them C and S,\n   with active Smack in the default state\n   (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule 'foo bar w'\n   (labels 'foo' and 'bar' are instantiated at S at this moment)\n\n* At S, at label 'bar', launch a program\n   that listens for incoming tcp/ipv4 connections\n\n* From C, at label 'foo', connect to the listener at S.\n   (label 'foo' is instantiated at C at this moment)\n   Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label 'foo'. Hence, label 'bar' writes to 'foo' without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the 'bar',\nto bring it into line with the Smack documentation claims.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f94216e5-3258-4e65-8157-1cdd314fb432",
      "id": "CVE-2024-49899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize denominators' default to 1\n\n[WHAT \u0026 HOW]\nVariables used as denominators and maybe not assigned to other values,\nshould not be 0. Change their default to 1 so they are never 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f991797d-46a3-4ba7-be19-58849198cb5a",
      "id": "CVE-2024-49997",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: lantiq_etop: fix memory disclosure\n\nWhen applying padding, the buffer is not zeroed, which results in memory\ndisclosure. The mentioned data is observed on the wire. This patch uses\nskb_put_padto() to pad Ethernet frames properly. The mentioned function\nzeroes the expanded buffer.\n\nIn case the packet cannot be padded it is silently dropped. Statistics\nare also not incremented. This driver does not support statistics in the\nold 32-bit format or the new 64-bit format. These will be added in the\nfuture. In its current form, the patch should be easily backported to\nstable versions.\n\nEthernet MACs on Amazon-SE and Danube cannot do padding of the packets\nin hardware, so software padding must be applied.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "987e9986-5f70-4ffc-9520-c71d10bfa53a",
      "id": "CVE-2024-50057",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: Free IRQ only if it was requested before\n\nIn polling mode, if no IRQ was requested there is no need to free it.\nCall devm_free_irq() only if client-\u003eirq is set. This fixes the warning\ncaused by the tps6598x module removal:\n\nWARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c\n...\n...\nCall trace:\n  devm_free_irq+0x80/0x8c\n  tps6598x_remove+0x28/0x88 [tps6598x]\n  i2c_device_remove+0x2c/0x9c\n  device_remove+0x4c/0x80\n  device_release_driver_internal+0x1cc/0x228\n  driver_detach+0x50/0x98\n  bus_remove_driver+0x6c/0xbc\n  driver_unregister+0x30/0x60\n  i2c_del_driver+0x54/0x64\n  tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x]\n  __arm64_sys_delete_module+0x184/0x264\n  invoke_syscall+0x48/0x110\n  el0_svc_common.constprop.0+0xc8/0xe8\n  do_el0_svc+0x20/0x2c\n  el0_svc+0x28/0x98\n  el0t_64_sync_handler+0x13c/0x158\n  el0t_64_sync+0x190/0x194",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4125ae7e-475e-4cfa-93c3-afbba5da3db8",
      "id": "CVE-2024-50272",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: Fix bounds checking in filemap_read()\n\nIf the caller supplies an iocb-\u003eki_pos value that is close to the\nfilesystem upper limit, and an iterator with a count that causes us to\noverflow that limit, then filemap_read() enters an infinite loop.\n\nThis behaviour was discovered when testing xfstests generic/525 with the\n\"localio\" optimisation for loopback NFS mounts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9fc43db3-a047-407b-9978-f84195bf1878",
      "id": "CVE-2022-48629",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qcom-rng - ensure buffer for generate is completely filled\n\nThe generate function in struct rng_alg expects that the destination\nbuffer is completely filled if the function returns 0. qcom_rng_read()\ncan run into a situation where the buffer is partially filled with\nrandomness and the remaining part of the buffer is zeroed since\nqcom_rng_generate() doesn't check the return value. This issue can\nbe reproduced by running the following from libkcapi:\n\n    kcapi-rng -b 9000000 \u003e OUTFILE\n\nThe generated OUTFILE will have three huge sections that contain all\nzeros, and this is caused by the code where the test\n'val \u0026 PRNG_STATUS_DATA_AVAIL' fails.\n\nLet's fix this issue by ensuring that qcom_rng_read() always returns\nwith a full buffer if the function returns success. Let's also have\nqcom_rng_generate() return the correct value.\n\nHere's some statistics from the ent project\n(https://www.fourmilab.ch/random/) that shows information about the\nquality of the generated numbers:\n\n    $ ent -c qcom-random-before\n    Value Char Occurrences Fraction\n      0           606748   0.067416\n      1            33104   0.003678\n      2            33001   0.003667\n    ...\n    253   �        32883   0.003654\n    254   �        33035   0.003671\n    255   �        33239   0.003693\n\n    Total:       9000000   1.000000\n\n    Entropy = 7.811590 bits per byte.\n\n    Optimum compression would reduce the size\n    of this 9000000 byte file by 2 percent.\n\n    Chi square distribution for 9000000 samples is 9329962.81, and\n    randomly would exceed this value less than 0.01 percent of the\n    times.\n\n    Arithmetic mean value of data bytes is 119.3731 (127.5 = random).\n    Monte Carlo value for Pi is 3.197293333 (error 1.77 percent).\n    Serial correlation coefficient is 0.159130 (totally uncorrelated =\n    0.0).\n\nWithout this patch, the results of the chi-square test is 0.01%, and\nthe numbers are certainly not random according to ent's project page.\nThe results improve with this patch:\n\n    $ ent -c qcom-random-after\n    Value Char Occurrences Fraction\n      0            35432   0.003937\n      1            35127   0.003903\n      2            35424   0.003936\n    ...\n    253   �        35201   0.003911\n    254   �        34835   0.003871\n    255   �        35368   0.003930\n\n    Total:       9000000   1.000000\n\n    Entropy = 7.999979 bits per byte.\n\n    Optimum compression would reduce the size\n    of this 9000000 byte file by 0 percent.\n\n    Chi square distribution for 9000000 samples is 258.77, and randomly\n    would exceed this value 42.24 percent of the times.\n\n    Arithmetic mean value of data bytes is 127.5006 (127.5 = random).\n    Monte Carlo value for Pi is 3.141277333 (error 0.01 percent).\n    Serial correlation coefficient is 0.000468 (totally uncorrelated =\n    0.0).\n\nThis change was tested on a Nexus 5 phone (msm8974 SoC).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cefa1917-2347-440b-b1f8-7bf09062d68c",
      "id": "CVE-2024-53150",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors.  That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal.  When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e682c080-bc10-4ed9-b39e-4b8807e86f99",
      "id": "CVE-2024-56572",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()\n\nThe buffer in the loop should be released under the exception path,\notherwise there may be a memory leak here.\n\nTo mitigate this, free the buffer when allegro_alloc_buffer fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c712501-1a3c-4ec3-a060-282f4e2f3105",
      "id": "CVE-2024-56787",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: imx8m: Probe the SoC driver as platform driver\n\nWith driver_async_probe=* on kernel command line, the following trace is\nproduced because on i.MX8M Plus hardware because the soc-imx8m.c driver\ncalls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock\ndriver is not yet probed. This was not detected during regular testing\nwithout driver_async_probe.\n\nConvert the SoC code to platform driver and instantiate a platform device\nin its current device_initcall() to probe the platform driver. Rework\n.soc_revision callback to always return valid error code and return SoC\nrevision via parameter. This way, if anything in the .soc_revision callback\nreturn -EPROBE_DEFER, it gets propagated to .probe and the .probe will get\nretried later.\n\n\"\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180\nCPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603\nHardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : imx8mm_soc_revision+0xdc/0x180\nlr : imx8mm_soc_revision+0xd0/0x180\nsp : ffff8000821fbcc0\nx29: ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120\nx26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311\nx23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb\nx20: ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff\nx17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8\nx14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801\nx11: ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c\nx8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3\nx5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb\nCall trace:\n imx8mm_soc_revision+0xdc/0x180\n imx8_soc_init+0xb0/0x1e0\n do_one_initcall+0x94/0x1a8\n kernel_init_freeable+0x240/0x2a8\n kernel_init+0x28/0x140\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\nSoC: i.MX8MP revision 1.1\n\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "176ddbf9-30a2-4971-bc68-523fe0ef74ca",
      "id": "CVE-2024-58055",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: Don't free command immediately\n\nDon't prematurely free the command. Wait for the status completion of\nthe sense status. It can be freed then. Otherwise we will double-free\nthe command.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac978397-81c2-425d-9df1-06a11fb00973",
      "id": "CVE-2024-58089",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double accounting race when btrfs_run_delalloc_range() failed\n\n[BUG]\nWhen running btrfs with block size (4K) smaller than page size (64K,\naarch64), there is a very high chance to crash the kernel at\ngeneric/750, with the following messages:\n(before the call traces, there are 3 extra debug messages added)\n\n  BTRFS warning (device dm-3): read-write for sector size 4096 with page size 65536 is experimental\n  BTRFS info (device dm-3): checking UUID tree\n  hrtimer: interrupt took 5451385 ns\n  BTRFS error (device dm-3): cow_file_range failed, root=4957 inode=257 start=1605632 len=69632: -28\n  BTRFS error (device dm-3): run_delalloc_nocow failed, root=4957 inode=257 start=1605632 len=69632: -28\n  BTRFS error (device dm-3): failed to run delalloc range, root=4957 ino=257 folio=1572864 submit_bitmap=8-15 start=1605632 len=69632: -28\n  ------------[ cut here ]------------\n  WARNING: CPU: 2 PID: 3020984 at ordered-data.c:360 can_finish_ordered_extent+0x370/0x3b8 [btrfs]\n  CPU: 2 UID: 0 PID: 3020984 Comm: kworker/u24:1 Tainted: G           OE      6.13.0-rc1-custom+ #89\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : can_finish_ordered_extent+0x370/0x3b8 [btrfs]\n  lr : can_finish_ordered_extent+0x1ec/0x3b8 [btrfs]\n  Call trace:\n   can_finish_ordered_extent+0x370/0x3b8 [btrfs] (P)\n   can_finish_ordered_extent+0x1ec/0x3b8 [btrfs] (L)\n   btrfs_mark_ordered_io_finished+0x130/0x2b8 [btrfs]\n   extent_writepage+0x10c/0x3b8 [btrfs]\n   extent_write_cache_pages+0x21c/0x4e8 [btrfs]\n   btrfs_writepages+0x94/0x160 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x74/0xa0\n   start_delalloc_inodes+0x17c/0x3b0 [btrfs]\n   btrfs_start_delalloc_roots+0x17c/0x288 [btrfs]\n   shrink_delalloc+0x11c/0x280 [btrfs]\n   flush_space+0x288/0x328 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x228/0x680\n   worker_thread+0x1bc/0x360\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  ---[ end trace 0000000000000000 ]---\n  BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1605632 OE len=16384 to_dec=16384 left=0\n  BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1622016 OE len=12288 to_dec=12288 left=0\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n  BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=1634304 OE len=8192 to_dec=4096 left=0\n  CPU: 1 UID: 0 PID: 3286940 Comm: kworker/u24:3 Tainted: G        W  OE      6.13.0-rc1-custom+ #89\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue:  btrfs_work_helper [btrfs] (btrfs-endio-write)\n  pstate: 404000c5 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : process_one_work+0x110/0x680\n  lr : worker_thread+0x1bc/0x360\n  Call trace:\n   process_one_work+0x110/0x680 (P)\n   worker_thread+0x1bc/0x360 (L)\n   worker_thread+0x1bc/0x360\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: f84086a1 f9000fe1 53041c21 b9003361 (f9400661)\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Oops: Fatal exception\n  SMP: stopping secondary CPUs\n  SMP: failed to stop secondary CPUs 2-3\n  Dumping ftrace buffer:\n     (ftrace buffer empty)\n  Kernel Offset: 0x275bb9540000 from 0xffff800080000000\n  PHYS_OFFSET: 0xffff8fbba0000000\n  CPU features: 0x100,00000070,00801250,8201720b\n\n[CAUSE]\nThe above warning is triggered immediately after the delalloc range\nfailure, this happens in the following sequence:\n\n- Range [1568K, 1636K) is dirty\n\n   1536K  1568K     1600K    1636K  1664K\n   |      |/////////|////////|      |\n\n  Where 1536K, 1600K and 1664K are page boundaries (64K page size)\n\n- Enter extent_writepage() for page 1536K\n\n- Enter run_delalloc_nocow() with locke\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "da78ff08-6f51-4b88-ae65-c3b80b29c9c4",
      "id": "CVE-2025-23158",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add check to handle incorrect queue size\n\nqsize represents size of shared queued between driver and video\nfirmware. Firmware can modify this value to an invalid large value. In\nsuch situation, empty_space will be bigger than the space actually\navailable. Since new_wr_idx is not checked, so the following code will\nresult in an OOB write.\n...\nqsize = qhdr-\u003eq_size\n\nif (wr_idx \u003e= rd_idx)\n empty_space = qsize - (wr_idx - rd_idx)\n....\nif (new_wr_idx \u003c qsize) {\n memcpy(wr_ptr, packet, dwords \u003c\u003c 2) --\u003e OOB write\n\nAdd check to ensure qsize is within the allocated size while\nreading and writing packets into the queue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1c02da2-d40d-4293-a6ed-991a2b5fa01d",
      "id": "CVE-2025-21999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: fix UAF in proc_get_inode()\n\nFix race between rmmod and /proc/XXX's inode instantiation.\n\nThe bug is that pde-\u003eproc_ops don't belong to /proc, it belongs to a\nmodule, therefore dereferencing it after /proc entry has been registered\nis a bug unless use_pde/unuse_pde() pair has been used.\n\nuse_pde/unuse_pde can be avoided (2 atomic ops!) because pde-\u003eproc_ops\nnever changes so information necessary for inode instantiation can be\nsaved _before_ proc_register() in PDE itself and used later, avoiding\npde-\u003eproc_ops-\u003e...  dereference.\n\n      rmmod                         lookup\nsys_delete_module\n                         proc_lookup_de\n\t\t\t   pde_get(de);\n\t\t\t   proc_get_inode(dir-\u003ei_sb, de);\n  mod-\u003eexit()\n    proc_remove\n      remove_proc_subtree\n       proc_entry_rundown(de);\n  free_module(mod);\n\n                               if (S_ISREG(inode-\u003ei_mode))\n\t                         if (de-\u003eproc_ops-\u003eproc_read_iter)\n                           --\u003e As module is already freed, will trigger UAF\n\nBUG: unable to handle page fault for address: fffffbfff80a702b\nPGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nRIP: 0010:proc_get_inode+0x302/0x6e0\nRSP: 0018:ffff88811c837998 EFLAGS: 00010a06\nRAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007\nRDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158\nRBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20\nR10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0\nR13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001\nFS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n proc_lookup_de+0x11f/0x2e0\n __lookup_slow+0x188/0x350\n walk_component+0x2ab/0x4f0\n path_lookupat+0x120/0x660\n filename_lookup+0x1ce/0x560\n vfs_statx+0xac/0x150\n __do_sys_newstat+0x96/0x110\n do_syscall_64+0x5f/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n[adobriyan@gmail.com: don't do 2 atomic ops on the common path]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "174058b9-e23d-422a-9114-74be45f14cd9",
      "id": "CVE-2025-37849",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Tear down vGIC on failed vCPU creation\n\nIf kvm_arch_vcpu_create() fails to share the vCPU page with the\nhypervisor, we propagate the error back to the ioctl but leave the\nvGIC vCPU data initialised. Note only does this leak the corresponding\nmemory when the vCPU is destroyed but it can also lead to use-after-free\nif the redistributor device handling tries to walk into the vCPU.\n\nAdd the missing cleanup to kvm_arch_vcpu_create(), ensuring that the\nvGIC vCPU structures are destroyed on error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8109e399-1f77-49c8-994c-836a1082eb4b",
      "id": "CVE-2025-37927",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid\n\nThere is a string parsing logic error which can lead to an overflow of hid\nor uid buffers. Comparing ACPIID_LEN against a total string length doesn't\ntake into account the lengths of individual hid and uid buffers so the\ncheck is insufficient in some cases. For example if the length of hid\nstring is 4 and the length of the uid string is 260, the length of str\nwill be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer\nwhich size is 256.\n\nThe same applies to the hid string with length 13 and uid string with\nlength 250.\n\nCheck the length of hid and uid strings separately to prevent\nbuffer overflow.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f2eb279-3896-4e78-b1a4-e8fab5f3c511",
      "id": "CVE-2025-38074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq-\u003elog_used with vq-\u003emutex\n\nThe vhost-scsi completion path may access vq-\u003elog_base when vq-\u003elog_used is\nalready set to false.\n\n    vhost-thread                       QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-\u003e vhost_add_used()\n   -\u003e vhost_add_used_n()\n      if (unlikely(vq-\u003elog_used))\n                                      QEMU disables vq-\u003elog_used\n                                      via VHOST_SET_VRING_ADDR.\n                                      mutex_lock(\u0026vq-\u003emutex);\n                                      vq-\u003elog_used = false now!\n                                      mutex_unlock(\u0026vq-\u003emutex);\n\n\t\t\t\t      QEMU gfree(vq-\u003elog_base)\n        log_used()\n        -\u003e log_write(vq-\u003elog_base)\n\nAssuming the VMM is QEMU. The vq-\u003elog_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cf9e68b-d0b4-4fb7-b26b-f9ea53800c16",
      "id": "CVE-2025-38078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix race of buffer access at PCM OSS layer\n\nThe PCM OSS layer tries to clear the buffer with the silence data at\ninitialization (or reconfiguration) of a stream with the explicit call\nof snd_pcm_format_set_silence() with runtime-\u003edma_area.  But this may\nlead to a UAF because the accessed runtime-\u003edma_area might be freed\nconcurrently, as it's performed outside the PCM ops.\n\nFor avoiding it, move the code into the PCM core and perform it inside\nthe buffer access lock, so that it won't be changed during the\noperation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c68cdf7-8729-4cac-8018-d0cd2a0246de",
      "id": "CVE-2025-38083",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: prio: fix a race in prio_tune()\n\nGerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer\nfires at the wrong time.\n\nThe race is as follows:\n\nCPU 0                                 CPU 1\n[1]: lock root\n[2]: qdisc_tree_flush_backlog()\n[3]: unlock root\n |\n |                                    [5]: lock root\n |                                    [6]: rehash\n |                                    [7]: qdisc_tree_reduce_backlog()\n |\n[4]: qdisc_put()\n\nThis can be abused to underflow a parent's qlen.\n\nCalling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()\nshould fix the race, because all packets will be purged from the qdisc\nbefore releasing the lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7641217b-fff3-4f8f-bc63-090a54caed33",
      "id": "CVE-2020-25212",
      "description": "A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed54347f-4df7-4d1a-b432-2713f1dc1bed",
      "id": "CVE-2025-38108",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: red: fix a race in __red_change()\n\nGerrard Tai reported a race condition in RED, whenever SFQ perturb timer\nfires at the wrong time.\n\nThe race is as follows:\n\nCPU 0                                 CPU 1\n[1]: lock root\n[2]: qdisc_tree_flush_backlog()\n[3]: unlock root\n |\n |                                    [5]: lock root\n |                                    [6]: rehash\n |                                    [7]: qdisc_tree_reduce_backlog()\n |\n[4]: qdisc_put()\n\nThis can be abused to underflow a parent's qlen.\n\nCalling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()\nshould fix the race, because all packets will be purged from the qdisc\nbefore releasing the lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bcdcb28-51e2-4647-849d-c32caec2cbfd",
      "id": "CVE-2025-38177",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: make hfsc_qlen_notify() idempotent\n\nhfsc_qlen_notify() is not idempotent either and not friendly\nto its callers, like fq_codel_dequeue(). Let's make it idempotent\nto ease qdisc_tree_reduce_backlog() callers' life:\n\n1. update_vf() decreases cl-\u003ecl_nactive, so we can check whether it is\nnon-zero before calling it.\n\n2. eltree_remove() always removes RB node cl-\u003eel_node, but we can use\n   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d25395c3-6a59-4e08-a1f3-4c61c96724fa",
      "id": "CVE-2025-38280",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Avoid __bpf_prog_ret0_warn when jit fails\n\nsyzkaller reported an issue:\n\nWARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357\nModules linked in:\nCPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39\nRIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357\nCall Trace:\n \u003cTASK\u003e\n bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]\n __bpf_prog_run include/linux/filter.h:718 [inline]\n bpf_prog_run include/linux/filter.h:725 [inline]\n cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105\n ...\n\nWhen creating bpf program, 'fp-\u003ejit_requested' depends on bpf_jit_enable.\nThis issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set\nand bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog,\nbut jit failed due to FAULT_INJECTION. As a result, incorrectly\ntreats the program as valid, when the program runs it calls\n`__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3875d5ab-cb07-4e5a-8824-7023ad96f78b",
      "id": "CVE-2025-38312",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()\n\nIn fb_find_mode_cvt(), iff mode-\u003erefresh somehow happens to be 0x80000000,\ncvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's\nthen passed to fb_cvt_hperiod(), where it's used as a divider -- division\nby 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to\navoid such overflow...\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "627e42d4-c6a9-47b1-bd76-bebd4402ceb8",
      "id": "CVE-2025-38324",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().\n\nAs syzbot reported [0], mpls_route_input_rcu() can be called\nfrom mpls_getroute(), where is under RTNL.\n\nnet-\u003empls.platform_label is only updated under RTNL.\n\nLet's use rcu_dereference_rtnl() in mpls_route_input_rcu() to\nsilence the splat.\n\n[0]:\nWARNING: suspicious RCU usage\n6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 Not tainted\n ----------------------------\nnet/mpls/af_mpls.c:84 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by syz.2.4451/17730:\n #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]\n #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 net/core/rtnetlink.c:6961\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 17730 Comm: syz.2.4451 Not tainted 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6865\n mpls_route_input_rcu+0x1d4/0x200 net/mpls/af_mpls.c:84\n mpls_getroute+0x621/0x1ea0 net/mpls/af_mpls.c:2381\n rtnetlink_rcv_msg+0x3c9/0xe90 net/core/rtnetlink.c:6964\n netlink_rcv_skb+0x16d/0x440 net/netlink/af_netlink.c:2534\n netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]\n netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339\n netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n ____sys_sendmsg+0xa98/0xc70 net/socket.c:2566\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620\n __sys_sendmmsg+0x200/0x420 net/socket.c:2709\n __do_sys_sendmmsg net/socket.c:2736 [inline]\n __se_sys_sendmmsg net/socket.c:2733 [inline]\n __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2733\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x230 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f0a2818e969\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f0a28f52038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133\nRAX: ffffffffffffffda RBX: 00007f0a283b5fa0 RCX: 00007f0a2818e969\nRDX: 0000000000000003 RSI: 0000200000000080 RDI: 0000000000000003\nRBP: 00007f0a28210ab1 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f0a283b5fa0 R15: 00007ffce5e9f268\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8be7c108-5a0c-4225-82ea-b508ba2d54fe",
      "id": "CVE-2025-38375",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8913cb5-d8cb-483d-8b53-7cf6d857bdf2",
      "id": "CVE-2025-38482",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: das6402: Fix bit shift out of bounds\n\nWhen checking for a supported IRQ number, the following test is used:\n\n\t/* IRQs 2,3,5,6,7, 10,11,15 are valid for \"enhanced\" mode */\n\tif ((1 \u003c\u003c it-\u003eoptions[1]) \u0026 0x8cec) {\n\nHowever, `it-\u003eoptions[i]` is an unchecked `int` value from userspace, so\nthe shift amount could be negative or out of bounds.  Fix the test by\nrequiring `it-\u003eoptions[1]` to be within bounds before proceeding with\nthe original test.  Valid `it-\u003eoptions[1]` values that select the IRQ\nwill be in the range [1,15]. The value 0 explicitly disables the use of\ninterrupts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf2034a4-934d-469a-ac80-728615424d3a",
      "id": "CVE-2025-38498",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndo_change_type(): refuse to operate on unmounted/not ours mounts\n\nEnsure that propagation settings can only be changed for mounts located\nin the caller's mount namespace. This change aligns permission checking\nwith the rest of mount(2).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2125d9a-087f-4b2f-bcc0-b8ccad836065",
      "id": "CVE-2025-38513",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()\n\nThere is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For\nexample, the following is possible:\n\n    \tT0\t\t\t    \t\tT1\nzd_mac_tx_to_dev()\n  /* len == skb_queue_len(q) */\n  while (len \u003e ZD_MAC_MAX_ACK_WAITERS) {\n\n\t\t\t\t\t  filter_ack()\n\t\t\t\t\t    spin_lock_irqsave(\u0026q-\u003elock, flags);\n\t\t\t\t\t    /* position == skb_queue_len(q) */\n\t\t\t\t\t    for (i=1; i\u003cposition; i++)\n\t\t\t\t    \t      skb = __skb_dequeue(q)\n\n\t\t\t\t\t    if (mac-\u003etype == NL80211_IFTYPE_AP)\n\t\t\t\t\t      skb = __skb_dequeue(q);\n\t\t\t\t\t    spin_unlock_irqrestore(\u0026q-\u003elock, flags);\n\n    skb_dequeue() -\u003e NULL\n\nSince there is a small gap between checking skb queue length and skb being\nunconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL.\nThen the pointer is passed to zd_mac_tx_status() where it is dereferenced.\n\nIn order to avoid potential NULL pointer dereference due to situations like\nabove, check if skb is not NULL before passing it to zd_mac_tx_status().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0fd32219-c2d7-4ef7-81dc-69e8fff71e05",
      "id": "CVE-2020-10766",
      "description": "A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a508378b-e8be-4986-8edc-e0c25585cdcf",
      "id": "CVE-2020-12654",
      "description": "An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55189762-55d9-4d0e-adf6-4f095e891dcf",
      "id": "CVE-2020-36558",
      "description": "A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "949f3ddc-74cd-4784-a305-bbd81f538695",
      "id": "CVE-2020-24394",
      "description": "In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8effbe4a-da00-46e9-8cf7-376d7079ebfe",
      "id": "CVE-2020-25704",
      "description": "A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5fbe8c6-9b6a-4b1d-86c0-477dc94174ba",
      "id": "CVE-2021-38203",
      "description": "btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de7fd365-ec7c-4e42-a738-4bfa341b14a6",
      "id": "CVE-2021-4150",
      "description": "A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "833aaf45-428a-49b0-9903-7b44db8e2360",
      "id": "CVE-2021-46956",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix memory leak in virtio_fs_probe()\n\nWhen accidentally passing twice the same tag to qemu, kmemleak ended up\nreporting a memory leak in virtiofs.  Also, looking at the log I saw the\nfollowing error (that's when I realised the duplicated tag):\n\n  virtiofs: probe of virtio5 failed with error -17\n\nHere's the kmemleak log for reference:\n\nunreferenced object 0xffff888103d47800 (size 1024):\n  comm \"systemd-udevd\", pid 118, jiffies 4294893780 (age 18.340s)\n  hex dump (first 32 bytes):\n    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........\n    ff ff ff ff ff ff ff ff 80 90 02 a0 ff ff ff ff  ................\n  backtrace:\n    [\u003c000000000ebb87c1\u003e] virtio_fs_probe+0x171/0x7ae [virtiofs]\n    [\u003c00000000f8aca419\u003e] virtio_dev_probe+0x15f/0x210\n    [\u003c000000004d6baf3c\u003e] really_probe+0xea/0x430\n    [\u003c00000000a6ceeac8\u003e] device_driver_attach+0xa8/0xb0\n    [\u003c00000000196f47a7\u003e] __driver_attach+0x98/0x140\n    [\u003c000000000b20601d\u003e] bus_for_each_dev+0x7b/0xc0\n    [\u003c00000000399c7b7f\u003e] bus_add_driver+0x11b/0x1f0\n    [\u003c0000000032b09ba7\u003e] driver_register+0x8f/0xe0\n    [\u003c00000000cdd55998\u003e] 0xffffffffa002c013\n    [\u003c000000000ea196a2\u003e] do_one_initcall+0x64/0x2e0\n    [\u003c0000000008f727ce\u003e] do_init_module+0x5c/0x260\n    [\u003c000000003cdedab6\u003e] __do_sys_finit_module+0xb5/0x120\n    [\u003c00000000ad2f48c6\u003e] do_syscall_64+0x33/0x40\n    [\u003c00000000809526b5\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37b50ca7-a2a1-4b90-9ced-fb8349740756",
      "id": "CVE-2021-47051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()\n\npm_runtime_get_sync will increment pm usage counter even it failed.\nForgetting to putting operation will result in reference leak here.\nFix it by replacing it with pm_runtime_resume_and_get to keep usage\ncounter balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc295d48-e39d-4029-8f01-acaa49cbe483",
      "id": "CVE-2021-47170",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: usbfs: Don't WARN about excessively large memory allocations\n\nSyzbot found that the kernel generates a WARNing if the user tries to\nsubmit a bulk transfer through usbfs with a buffer that is way too\nlarge.  This isn't a bug in the kernel; it's merely an invalid request\nfrom the user and the usbfs code does handle it correctly.\n\nIn theory the same thing can happen with async transfers, or with the\npacket descriptor table for isochronous transfers.\n\nTo prevent the MM subsystem from complaining about these bad\nallocation requests, add the __GFP_NOWARN flag to the kmalloc calls\nfor these buffers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9f0fdef-88b2-48e5-80a0-524ced51d608",
      "id": "CVE-2021-47207",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: gus: fix null pointer dereference on pointer block\n\nThe pointer block return from snd_gf1_dma_next_block could be\nnull, so there is a potential null pointer dereference issue.\nFix this by adding a null check before dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ebf441c-c3e8-45eb-906b-baabd2110668",
      "id": "CVE-2021-47211",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix null pointer dereference on pointer cs_desc\n\nThe pointer cs_desc return from snd_usb_find_clock_source could\nbe null, so there is a potential null pointer dereference issue.\nFix this by adding a null check before dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7940a79-5863-4037-bd07-851386c8d440",
      "id": "CVE-2021-47230",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Immediately reset the MMU context when the SMM flag is cleared\n\nImmediately reset the MMU context when the vCPU's SMM flag is cleared so\nthat the SMM flag in the MMU role is always synchronized with the vCPU's\nflag.  If RSM fails (which isn't correctly emulated), KVM will bail\nwithout calling post_leave_smm() and leave the MMU in a bad state.\n\nThe bad MMU role can lead to a NULL pointer dereference when grabbing a\nshadow page's rmap for a page fault as the initial lookups for the gfn\nwill happen with the vCPU's SMM flag (=0), whereas the rmap lookup will\nuse the shadow page's SMM flag, which comes from the MMU (=1).  SMM has\nan entirely different set of memslots, and so the initial lookup can find\na memslot (SMM=0) and then explode on the rmap memslot lookup (SMM=1).\n\n  general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  CPU: 1 PID: 8410 Comm: syz-executor382 Not tainted 5.13.0-rc5-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:__gfn_to_rmap arch/x86/kvm/mmu/mmu.c:935 [inline]\n  RIP: 0010:gfn_to_rmap+0x2b0/0x4d0 arch/x86/kvm/mmu/mmu.c:947\n  Code: \u003c42\u003e 80 3c 20 00 74 08 4c 89 ff e8 f1 79 a9 00 4c 89 fb 4d 8b 37 44\n  RSP: 0018:ffffc90000ffef98 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff888015b9f414 RCX: ffff888019669c40\n  RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001\n  RBP: 0000000000000001 R08: ffffffff811d9cdb R09: ffffed10065a6002\n  R10: ffffed10065a6002 R11: 0000000000000000 R12: dffffc0000000000\n  R13: 0000000000000003 R14: 0000000000000001 R15: 0000000000000000\n  FS:  000000000124b300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 0000000028e31000 CR4: 00000000001526e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   rmap_add arch/x86/kvm/mmu/mmu.c:965 [inline]\n   mmu_set_spte+0x862/0xe60 arch/x86/kvm/mmu/mmu.c:2604\n   __direct_map arch/x86/kvm/mmu/mmu.c:2862 [inline]\n   direct_page_fault+0x1f74/0x2b70 arch/x86/kvm/mmu/mmu.c:3769\n   kvm_mmu_do_page_fault arch/x86/kvm/mmu.h:124 [inline]\n   kvm_mmu_page_fault+0x199/0x1440 arch/x86/kvm/mmu/mmu.c:5065\n   vmx_handle_exit+0x26/0x160 arch/x86/kvm/vmx/vmx.c:6122\n   vcpu_enter_guest+0x3bdd/0x9630 arch/x86/kvm/x86.c:9428\n   vcpu_run+0x416/0xc20 arch/x86/kvm/x86.c:9494\n   kvm_arch_vcpu_ioctl_run+0x4e8/0xa40 arch/x86/kvm/x86.c:9722\n   kvm_vcpu_ioctl+0x70f/0xbb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3460\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:1069 [inline]\n   __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:1055\n   do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  RIP: 0033:0x440ce9",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74bf5f85-eb9b-4170-8ea2-236f1d146fdc",
      "id": "CVE-2021-47323",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7da3eafd-0160-4e57-94ce-3f49ba59d417",
      "id": "CVE-2022-4543",
      "description": "A flaw named \"EntryBleed\" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c313a0ad-3657-46a4-8e5c-fbfaba00958e",
      "id": "CVE-2021-47330",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: serial_cs: Fix a memory leak in error handling path\n\nIn the probe function, if the final 'serial_config()' fails, 'info' is\nleaking.\n\nAdd a resource handling path to free this memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58430d62-ade0-451d-acfe-fe2fc8166b3e",
      "id": "CVE-2021-47505",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naio: fix use-after-free due to missing POLLFREE handling\n\nsignalfd_poll() and binder_poll() are special in that they use a\nwaitqueue whose lifetime is the current task, rather than the struct\nfile as is normally the case.  This is okay for blocking polls, since a\nblocking poll occurs within one task; however, non-blocking polls\nrequire another solution.  This solution is for the queue to be cleared\nbefore it is freed, by sending a POLLFREE notification to all waiters.\n\nUnfortunately, only eventpoll handles POLLFREE.  A second type of\nnon-blocking poll, aio poll, was added in kernel v4.18, and it doesn't\nhandle POLLFREE.  This allows a use-after-free to occur if a signalfd or\nbinder fd is polled with aio poll, and the waitqueue gets freed.\n\nFix this by making aio poll handle POLLFREE.\n\nA patch by Ramji Jiyani \u003cramjiyani@google.com\u003e\n(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)\ntried to do this by making aio_poll_wake() always complete the request\ninline if POLLFREE is seen.  However, that solution had two bugs.\nFirst, it introduced a deadlock, as it unconditionally locked the aio\ncontext while holding the waitqueue lock, which inverts the normal\nlocking order.  Second, it didn't consider that POLLFREE notifications\nare missed while the request has been temporarily de-queued.\n\nThe second problem was solved by my previous patch.  This patch then\nproperly fixes the use-after-free by handling POLLFREE in a\ndeadlock-free way.  It does this by taking advantage of the fact that\nfreeing of the waitqueue is RCU-delayed, similar to what eventpoll does.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f71f287-50da-4684-98e2-2d222c65d0b7",
      "id": "CVE-2022-0168",
      "description": "A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a940254c-61a7-49ee-a5c6-db1836c6cfad",
      "id": "CVE-2022-1729",
      "description": "A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39554bb2-82e7-4c99-8ad4-e4b48f731286",
      "id": "CVE-2022-32296",
      "description": "The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 (\"Double-Hash Port Selection Algorithm\") of RFC 6056.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58c0c8a0-53d4-4ba5-831b-2a1e2df90f58",
      "id": "CVE-2022-49602",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: Fix a data-race around sysctl_fwmark_reflect.\n\nWhile reading sysctl_fwmark_reflect, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e9f4a80-d32d-4820-98da-9fa87634097b",
      "id": "CVE-2022-48769",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: runtime: avoid EFIv2 runtime services on Apple x86 machines\n\nAditya reports [0] that his recent MacbookPro crashes in the firmware\nwhen using the variable services at runtime. The culprit appears to be a\ncall to QueryVariableInfo(), which we did not use to call on Apple x86\nmachines in the past as they only upgraded from EFI v1.10 to EFI v2.40\nfirmware fairly recently, and QueryVariableInfo() (along with\nUpdateCapsule() et al) was added in EFI v2.00.\n\nThe only runtime service introduced in EFI v2.00 that we actually use in\nLinux is QueryVariableInfo(), as the capsule based ones are optional,\ngenerally not used at runtime (all the LVFS/fwupd firmware update\ninfrastructure uses helper EFI programs that invoke capsule update at\nboot time, not runtime), and not implemented by Apple machines in the\nfirst place. QueryVariableInfo() is used to 'safely' set variables,\ni.e., only when there is enough space. This prevents machines with buggy\nfirmwares from corrupting their NVRAMs when they run out of space.\n\nGiven that Apple machines have been using EFI v1.10 services only for\nthe longest time (the EFI v2.0 spec was released in 2006, and Linux\nsupport for the newly introduced runtime services was added in 2011, but\nthe MacbookPro12,1 released in 2015 still claims to be EFI v1.10 only),\nlet's avoid the EFI v2.0 ones on all Apple x86 machines.\n\n[0] https://lore.kernel.org/all/6D757C75-65B1-468B-842D-10410081A8E4@live.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "728329d4-1309-4873-a334-054c6a9f71a6",
      "id": "CVE-2022-48821",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: avoid double fput() on failed usercopy\n\nIf the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF\nioctl(), we shouldn't assume that 'buf-\u003edmabuf' is still valid. In fact,\ndma_buf_fd() called fd_install() before, i.e. \"consumed\" one reference,\nleaving us with none.\n\nCalling dma_buf_put() will therefore put a reference we no longer own,\nleading to a valid file descritor table entry for an already released\n'file' object which is a straight use-after-free.\n\nSimply avoid calling dma_buf_put() and rely on the process exit code to\ndo the necessary cleanup, if needed, i.e. if the file descriptor is\nstill valid.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c782f55-acbc-4cec-b29c-18708cf181d3",
      "id": "CVE-2022-48960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: Fix potential use-after-free in hix5hd2_rx()\n\nThe skb is delivered to napi_gro_receive() which may free it, after\ncalling this, dereferencing skb may trigger use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee42dde4-5098-49ff-8314-21110cc2d825",
      "id": "CVE-2022-49504",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Inhibit aborts if external loopback plug is inserted\n\nAfter running a short external loopback test, when the external loopback is\nremoved and a normal cable inserted that is directly connected to a target\ndevice, the system oops in the llpfc_set_rrq_active() routine.\n\nWhen the loopback was inserted an FLOGI was transmit. As we're looped back,\nwe receive the FLOGI request. The FLOGI is ABTS'd as we recognize the same\nwppn thus understand it's a loopback. However, as the ABTS sends address\ninformation the port is not set to (fffffe), the ABTS is dropped on the\nwire. A short 1 frame loopback test is run and completes before the ABTS\ntimes out. The looback is unplugged and the new cable plugged in, and the\nan FLOGI to the new device occurs and completes. Due to a mixup in ref\ncounting the completion of the new FLOGI releases the fabric ndlp. Then the\noriginal ABTS completes and references the released ndlp generating the\noops.\n\nCorrect by no-op'ing the ABTS when in loopback mode (it will be dropped\nanyway). Added a flag to track the mode to recognize when it should be\nno-op'd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1023688c-683b-4256-8441-1fb4f8e8686a",
      "id": "CVE-2022-49171",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't BUG if someone dirty pages without asking ext4 first\n\n[un]pin_user_pages_remote is dirtying pages without properly warning\nthe file system in advance.  A related race was noted by Jan Kara in\n2018[1]; however, more recently instead of it being a very hard-to-hit\nrace, it could be reliably triggered by process_vm_writev(2) which was\ndiscovered by Syzbot[2].\n\nThis is technically a bug in mm/gup.c, but arguably ext4 is fragile in\nthat if some other kernel subsystem dirty pages without properly\nnotifying the file system using page_mkwrite(), ext4 will BUG, while\nother file systems will not BUG (although data will still be lost).\n\nSo instead of crashing with a BUG, issue a warning (since there may be\npotential data loss) and just mark the page as clean to avoid\nunprivileged denial of service attacks until the problem can be\nproperly fixed.  More discussion and background can be found in the\nthread starting at [2].\n\n[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz\n[2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd578e33-e7cf-4c1d-8c8c-df44e51adab3",
      "id": "CVE-2022-49307",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: synclink_gt: Fix null-pointer-dereference in slgt_clean()\n\nWhen the driver fails at alloc_hdlcdev(), and then we remove the driver\nmodule, we will get the following splat:\n\n[   25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI\n[   25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]\n[   25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0\n[   25.077709] Call Trace:\n[   25.077924]  \u003cTASK\u003e\n[   25.078108]  unregister_hdlc_device+0x16/0x30\n[   25.078481]  slgt_cleanup+0x157/0x9f0 [synclink_gt]\n\nFix this by checking whether the 'info-\u003enetdev' is a null pointer first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "044d248a-b698-4e0f-932f-619d9bac5386",
      "id": "CVE-2022-49326",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtl818x: Prevent using not initialized queues\n\nUsing not existing queues can panic the kernel with rtl8180/rtl8185 cards.\nIgnore the skb priority for those cards, they only have one tx queue. Pierre\nAsselin (pa@panix.com) reported the kernel crash in the Gentoo forum:\n\nhttps://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html\n\nHe also confirmed that this patch fixes the issue. In summary this happened:\n\nAfter updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a\n\"divide error: 0000\" when connecting to an AP. Control port tx now tries to\nuse IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in\n2.10.\n\nSince only the rtl8187se part of the driver supports QoS, the priority\nof the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185\ncards.\n\nrtl8180 is then unconditionally reading out the priority and finally crashes on\ndrivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this\npatch:\n\tidx = (ring-\u003eidx + skb_queue_len(\u0026ring-\u003equeue)) % ring-\u003eentries\n\n\"ring-\u003eentries\" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got\ninitialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4da5c91-d872-4ebb-95f3-412326fdcd25",
      "id": "CVE-2022-49344",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix a data-race in unix_dgram_peer_wake_me().\n\nunix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s\nlock held and check if its receive queue is full.  Here we need to\nuse unix_recvq_full_lockless() instead of unix_recvq_full(), otherwise\nKCSAN will report a data-race.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d93026d5-160d-4497-8345-69fe5f7a94a2",
      "id": "CVE-2022-49351",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: altera: Fix refcount leak in altera_tse_mdio_create\n\nEvery iteration of for_each_child_of_node() decrements\nthe reference count of the previous node.\nWhen break from a for_each_child_of_node() loop,\nwe need to explicitly call of_node_put() on the child node when\nnot need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "962922db-dc0d-4309-83a1-7fbd2d87ff1e",
      "id": "CVE-2022-49657",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: fix memory leak in error case\n\nusbnet_write_cmd_async() mixed up which buffers\nneed to be freed in which error case.\n\nv2: add Fixes tag\nv3: fix uninitialized buf pointer",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd91754f-ce20-4e0b-8991-720928b73b9a",
      "id": "CVE-2022-49679",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: Fix refcount leak in axxia_boot_secondary\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3af16e3b-ed01-44a8-b30e-63eb27d5bcbb",
      "id": "CVE-2022-49682",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxtensa: Fix refcount leak bug in time.c\n\nIn calibrate_ccount(), of_find_compatible_node() will return a node\npointer with refcount incremented. We should use of_node_put() when\nit is not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30954b36-8f27-4116-acfd-2b075d28dc1b",
      "id": "CVE-2022-50300",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix extent map use-after-free when handling missing device in read_one_chunk\n\nStore the error code before freeing the extent_map. Though it's\nreference counted structure, in that function it's the first and last\nallocation so this would lead to a potential use-after-free.\n\nThe error can happen eg. when chunk is stored on a missing device and\nthe degraded mount option is missing.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3daf258b-a7c4-4aec-9547-d146b163fa7a",
      "id": "CVE-2022-50350",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix a race condition between login_work and the login thread\n\nIn case a malicious initiator sends some random data immediately after a\nlogin PDU; the iscsi_target_sk_data_ready() callback will schedule the\nlogin_work and, at the same time, the negotiation may end without clearing\nthe LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are\nrequired to complete the login).\n\nThe login has been completed but the login_work function will find the\nLOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling\nitself; at this point, if the initiator drops the connection, the\niscsit_conn structure will be freed, login_work will dereference a released\nsocket structure and the kernel crashes.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000230\nPF: supervisor write access in kernel mode\nPF: error_code(0x0002) - not-present page\nWorkqueue: events iscsi_target_do_login_rx [iscsi_target_mod]\nRIP: 0010:_raw_read_lock_bh+0x15/0x30\nCall trace:\n iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod]\n process_one_work+0x1e8/0x3c0\n\nFix this bug by forcing login_work to stop after the login has been\ncompleted and the socket callbacks have been restored.\n\nAdd a comment to clearify the return values of iscsi_target_do_login()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00622c74-9344-4491-af27-11cae0f0a48d",
      "id": "CVE-2022-49720",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix handling of offline queues in blk_mq_alloc_request_hctx()\n\nThis patch prevents that test nvme/004 triggers the following:\n\nUBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9\nindex 512 is out of range for type 'long unsigned int [512]'\nCall Trace:\n show_stack+0x52/0x58\n dump_stack_lvl+0x49/0x5e\n dump_stack+0x10/0x12\n ubsan_epilogue+0x9/0x3b\n __ubsan_handle_out_of_bounds.cold+0x44/0x49\n blk_mq_alloc_request_hctx+0x304/0x310\n __nvme_submit_sync_cmd+0x70/0x200 [nvme_core]\n nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics]\n nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop]\n nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop]\n nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics]\n nvmf_dev_write+0xae/0x111 [nvme_fabrics]\n vfs_write+0x144/0x560\n ksys_write+0xb7/0x140\n __x64_sys_write+0x42/0x50\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce6d1b55-674c-4db0-b767-d4f76d9d3688",
      "id": "CVE-2022-49742",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: initialize locks earlier in f2fs_fill_super()\n\nsyzbot is reporting lockdep warning at f2fs_handle_error() [1], for\nspin_lock(\u0026sbi-\u003eerror_lock) is called before spin_lock_init() is called.\nFor safe locking in error handling, move initialization of locks (and\nobvious structures) in f2fs_fill_super() to immediately after memory\nallocation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79e3299e-7471-4d30-900b-be5baacd288d",
      "id": "CVE-2022-49901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: Fix kmemleak in blk_mq_init_allocated_queue\n\nThere is a kmemleak caused by modprobe null_blk.ko\n\nunreferenced object 0xffff8881acb1f000 (size 1024):\n  comm \"modprobe\", pid 836, jiffies 4294971190 (age 27.068s)\n  hex dump (first 32 bytes):\n    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........\n    ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff  .........S......\n  backtrace:\n    [\u003c000000004a10c249\u003e] kmalloc_node_trace+0x22/0x60\n    [\u003c00000000648f7950\u003e] blk_mq_alloc_and_init_hctx+0x289/0x350\n    [\u003c00000000af06de0e\u003e] blk_mq_realloc_hw_ctxs+0x2fe/0x3d0\n    [\u003c00000000e00c1872\u003e] blk_mq_init_allocated_queue+0x48c/0x1440\n    [\u003c00000000d16b4e68\u003e] __blk_mq_alloc_disk+0xc8/0x1c0\n    [\u003c00000000d10c98c3\u003e] 0xffffffffc450d69d\n    [\u003c00000000b9299f48\u003e] 0xffffffffc4538392\n    [\u003c0000000061c39ed6\u003e] do_one_initcall+0xd0/0x4f0\n    [\u003c00000000b389383b\u003e] do_init_module+0x1a4/0x680\n    [\u003c0000000087cf3542\u003e] load_module+0x6249/0x7110\n    [\u003c00000000beba61b8\u003e] __do_sys_finit_module+0x140/0x200\n    [\u003c00000000fdcfff51\u003e] do_syscall_64+0x35/0x80\n    [\u003c000000003c0f1f71\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThat is because q-\u003ema_ops is set to NULL before blk_release_queue is\ncalled.\n\nblk_mq_init_queue_data\n  blk_mq_init_allocated_queue\n    blk_mq_realloc_hw_ctxs\n      for (i = 0; i \u003c set-\u003enr_hw_queues; i++) {\n        old_hctx = xa_load(\u0026q-\u003ehctx_table, i);\n        if (!blk_mq_alloc_and_init_hctx(.., i, ..))\t\t[1]\n          if (!old_hctx)\n\t    break;\n\n      xa_for_each_start(\u0026q-\u003ehctx_table, j, hctx, j)\n        blk_mq_exit_hctx(q, set, hctx, j); \t\t\t[2]\n\n    if (!q-\u003enr_hw_queues)\t\t\t\t\t[3]\n      goto err_hctxs;\n\n  err_exit:\n      q-\u003emq_ops = NULL;\t\t\t  \t\t\t[4]\n\n  blk_put_queue\n    blk_release_queue\n      if (queue_is_mq(q))\t\t\t\t\t[5]\n        blk_mq_release(q);\n\n[1]: blk_mq_alloc_and_init_hctx failed at i != 0.\n[2]: The hctxs allocated by [1] are moved to q-\u003eunused_hctx_list and\nwill be cleaned up in blk_mq_release.\n[3]: q-\u003enr_hw_queues is 0.\n[4]: Set q-\u003emq_ops to NULL.\n[5]: queue_is_mq returns false due to [4]. And blk_mq_release\nwill not be called. The hctxs in q-\u003eunused_hctx_list are leaked.\n\nTo fix it, call blk_release_queue in exception path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "938552c2-e1c7-4b7c-a37f-f22f91afc0fc",
      "id": "CVE-2022-49945",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (gpio-fan) Fix array out of bounds access\n\nThe driver does not check if the cooling state passed to\ngpio_fan_set_cur_state() exceeds the maximum cooling state as\nstored in fan_data-\u003enum_speeds. Since the cooling state is later\nused as an array index in set_fan_speed(), an array out of bounds\naccess can occur.\nThis can be exploited by setting the state of the thermal cooling device\nto arbitrary values, causing for example a kernel oops when unavailable\nmemory is accessed this way.\n\nExample kernel oops:\n[  807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064\n[  807.987369] Mem abort info:\n[  807.987398]   ESR = 0x96000005\n[  807.987428]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  807.987477]   SET = 0, FnV = 0\n[  807.987507]   EA = 0, S1PTW = 0\n[  807.987536]   FSC = 0x05: level 1 translation fault\n[  807.987570] Data abort info:\n[  807.987763]   ISV = 0, ISS = 0x00000005\n[  807.987801]   CM = 0, WnR = 0\n[  807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000\n[  807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[  807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP\n[  807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6\n[  807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G         C        5.15.56-v8+ #1575\n[  807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)\n[  807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan]\n[  807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan]\n[  807.988691] sp : ffffffc008cf3bd0\n[  807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 0000000000000000\n[  807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800747c920\n[  807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 000000001999997c\n[  807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 0000000000000000\n[  807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e271b70\n[  807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60c741c\n[  807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 0000000000000009\n[  807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff800369f2e8\n[  807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d0588060\n[  807.989084] Call trace:\n[  807.989091]  set_fan_speed.part.5+0x34/0x80 [gpio_fan]\n[  807.989113]  gpio_fan_set_cur_state+0x34/0x50 [gpio_fan]\n[  807.989199]  cur_state_store+0x84/0xd0\n[  807.989221]  dev_attr_store+0x20/0x38\n[  807.989262]  sysfs_kf_write+0x4c/0x60\n[  807.989282]  kernfs_fop_write_iter+0x130/0x1c0\n[  807.989298]  new_sync_write+0x10c/0x190\n[  807.989315]  vfs_write+0x254/0x378\n[  807.989362]  ksys_write+0x70/0xf8\n[  807.989379]  __arm64_sys_write+0x24/0x30\n[  807.989424]  invoke_syscall+0x4c/0x110\n[  807.989442]  el0_svc_common.constprop.3+0xfc/0x120\n[  807.989458]  do_el0_svc+0x2c/0x90\n[  807.989473]  el0_svc+0x24/0x60\n[  807.989544]  el0t_64_sync_handler+0x90/0xb8\n[  807.989558]  el0t_64_sync+0x1a0/0x1a4\n[  807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416)\n[  807.989627] ---[ end t\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8613782a-1d66-47a4-9a37-bcaa8e19a8f9",
      "id": "CVE-2022-50122",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nFix refcount leak in some error paths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "399f8e92-4a7a-4a1d-84e5-7a0701a2a6eb",
      "id": "CVE-2022-50146",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors\n\nIf dw_pcie_ep_init() fails to perform any action after the EPC memory is\ninitialized and the MSI memory region is allocated, the latter parts won't\nbe undone thus causing a memory leak.  Add a cleanup-on-error path to fix\nthese leaks.\n\n[bhelgaas: commit log]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89512d5b-6254-4c98-8381-c9ba130e643e",
      "id": "CVE-2022-50228",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0\n\nDon't BUG/WARN on interrupt injection due to GIF being cleared,\nsince it's trivial for userspace to force the situation via\nKVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct\nfor KVM internally generated injections).\n\n  kernel BUG at arch/x86/kvm/svm/svm.c:3386!\n  invalid opcode: 0000 [#1] SMP\n  CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd]\n  Code: \u003c0f\u003e 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53\n  RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006\n  RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0\n  RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n  R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000\n  FS:  0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0\n  Call Trace:\n   \u003cTASK\u003e\n   inject_pending_event+0x2f7/0x4c0 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm]\n   kvm_vcpu_ioctl+0x26d/0x650 [kvm]\n   __x64_sys_ioctl+0x82/0xb0\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n   \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52dfc2d3-1757-47c2-82bf-861422c4cfbf",
      "id": "CVE-2023-0240",
      "description": "There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation.\n\nIn the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4981ec9-a9ad-4657-a916-ccc2c31bd3c0",
      "id": "CVE-2023-1513",
      "description": "A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0fbbefe-e1f6-44a2-8f21-7a759a7a5d4d",
      "id": "CVE-2023-52444",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid dirent corruption\n\nAs Al reported in link[1]:\n\nf2fs_rename()\n...\n\tif (old_dir != new_dir \u0026\u0026 !whiteout)\n\t\tf2fs_set_link(old_inode, old_dir_entry,\n\t\t\t\t\told_dir_page, new_dir);\n\telse\n\t\tf2fs_put_page(old_dir_page, 0);\n\nYou want correct inumber in the \"..\" link.  And cross-directory\nrename does move the source to new parent, even if you'd been asked\nto leave a whiteout in the old place.\n\n[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/\n\nWith below testcase, it may cause dirent corruption, due to it missed\nto call f2fs_set_link() to update \"..\" link to new directory.\n- mkdir -p dir/foo\n- renameat2 -w dir/foo bar\n\n[ASSERT] (__chk_dots_dentries:1421)  --\u003e Bad inode number[0x4] for '..', parent parent ino is [0x3]\n[FSCK] other corrupted bugs                           [Fail]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09f957e6-642c-447d-8979-9e6343bae604",
      "id": "CVE-2023-52479",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix uaf in smb20_oplock_break_ack\n\ndrop reference after use opinfo.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efed02c7-d062-46d2-9843-d25e8e32de44",
      "id": "CVE-2023-52813",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix hungtask for PADATA_RESET\n\nWe found a hungtask bug in test_aead_vec_cfg as follows:\n\nINFO: task cryptomgr_test:391009 blocked for more than 120 seconds.\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nCall trace:\n __switch_to+0x98/0xe0\n __schedule+0x6c4/0xf40\n schedule+0xd8/0x1b4\n schedule_timeout+0x474/0x560\n wait_for_common+0x368/0x4e0\n wait_for_completion+0x20/0x30\n wait_for_completion+0x20/0x30\n test_aead_vec_cfg+0xab4/0xd50\n test_aead+0x144/0x1f0\n alg_test_aead+0xd8/0x1e0\n alg_test+0x634/0x890\n cryptomgr_test+0x40/0x70\n kthread+0x1e0/0x220\n ret_from_fork+0x10/0x18\n Kernel panic - not syncing: hung_task: blocked tasks\n\nFor padata_do_parallel, when the return err is 0 or -EBUSY, it will call\nwait_for_completion(\u0026wait-\u003ecompletion) in test_aead_vec_cfg. In normal\ncase, aead_request_complete() will be called in pcrypt_aead_serial and the\nreturn err is 0 for padata_do_parallel. But, when pinst-\u003eflags is\nPADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it\nwon't call aead_request_complete(). Therefore, test_aead_vec_cfg will\nhung at wait_for_completion(\u0026wait-\u003ecompletion), which will cause\nhungtask.\n\nThe problem comes as following:\n(padata_do_parallel)                 |\n    rcu_read_lock_bh();              |\n    err = -EINVAL;                   |   (padata_replace)\n                                     |     pinst-\u003eflags |= PADATA_RESET;\n    err = -EBUSY                     |\n    if (pinst-\u003eflags \u0026 PADATA_RESET) |\n        rcu_read_unlock_bh()         |\n        return err\n\nIn order to resolve the problem, we replace the return err -EBUSY with\n-EAGAIN, which means parallel_data is changing, and the caller should call\nit again.\n\nv3:\nremove retry and just change the return err.\nv2:\nintroduce padata_try_do_parallel() in pcrypt_aead_encrypt and\npcrypt_aead_decrypt to solve the hungtask.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7b48729-f521-4b92-b126-994324229307",
      "id": "CVE-2023-7042",
      "description": "A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "372863eb-6979-46e8-9253-aba64de5a5ee",
      "id": "CVE-2023-52833",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: Add date-\u003eevt_skb is NULL check\n\nfix crash because of null pointers\n\n[ 6104.969662] BUG: kernel NULL pointer dereference, address: 00000000000000c8\n[ 6104.969667] #PF: supervisor read access in kernel mode\n[ 6104.969668] #PF: error_code(0x0000) - not-present page\n[ 6104.969670] PGD 0 P4D 0\n[ 6104.969673] Oops: 0000 [#1] SMP NOPTI\n[ 6104.969684] RIP: 0010:btusb_mtk_hci_wmt_sync+0x144/0x220 [btusb]\n[ 6104.969688] RSP: 0018:ffffb8d681533d48 EFLAGS: 00010246\n[ 6104.969689] RAX: 0000000000000000 RBX: ffff8ad560bb2000 RCX: 0000000000000006\n[ 6104.969691] RDX: 0000000000000000 RSI: ffffb8d681533d08 RDI: 0000000000000000\n[ 6104.969692] RBP: ffffb8d681533d70 R08: 0000000000000001 R09: 0000000000000001\n[ 6104.969694] R10: 0000000000000001 R11: 00000000fa83b2da R12: ffff8ad461d1d7c0\n[ 6104.969695] R13: 0000000000000000 R14: ffff8ad459618c18 R15: ffffb8d681533d90\n[ 6104.969697] FS:  00007f5a1cab9d40(0000) GS:ffff8ad578200000(0000) knlGS:00000\n[ 6104.969699] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6104.969700] CR2: 00000000000000c8 CR3: 000000018620c001 CR4: 0000000000760ef0\n[ 6104.969701] PKRU: 55555554\n[ 6104.969702] Call Trace:\n[ 6104.969708]  btusb_mtk_shutdown+0x44/0x80 [btusb]\n[ 6104.969732]  hci_dev_do_close+0x470/0x5c0 [bluetooth]\n[ 6104.969748]  hci_rfkill_set_block+0x56/0xa0 [bluetooth]\n[ 6104.969753]  rfkill_set_block+0x92/0x160\n[ 6104.969755]  rfkill_fop_write+0x136/0x1e0\n[ 6104.969759]  __vfs_write+0x18/0x40\n[ 6104.969761]  vfs_write+0xdf/0x1c0\n[ 6104.969763]  ksys_write+0xb1/0xe0\n[ 6104.969765]  __x64_sys_write+0x1a/0x20\n[ 6104.969769]  do_syscall_64+0x51/0x180\n[ 6104.969771]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[ 6104.969773] RIP: 0033:0x7f5a21f18fef\n[ 6104.9] RSP: 002b:00007ffeefe39010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n[ 6104.969780] RAX: ffffffffffffffda RBX: 000055c10a7560a0 RCX: 00007f5a21f18fef\n[ 6104.969781] RDX: 0000000000000008 RSI: 00007ffeefe39060 RDI: 0000000000000012\n[ 6104.969782] RBP: 00007ffeefe39060 R08: 0000000000000000 R09: 0000000000000017\n[ 6104.969784] R10: 00007ffeefe38d97 R11: 0000000000000293 R12: 0000000000000002\n[ 6104.969785] R13: 00007ffeefe39220 R14: 00007ffeefe391a0 R15: 000055c10a72acf0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9275550b-f991-42e9-9caa-fc163308ac91",
      "id": "CVE-2023-53117",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: prevent out-of-bounds array speculation when closing a file descriptor\n\nGoogle-Bug-Id: 114199369",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88e478c9-f981-4dd1-81b4-1a68fdff24cb",
      "id": "CVE-2023-52903",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: lock overflowing for IOPOLL\n\nsyzbot reports an issue with overflow filling for IOPOLL:\n\nWARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\nCPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0\nWorkqueue: events_unbound io_ring_exit_work\nCall trace:\n io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\n io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773\n io_fill_cqe_req io_uring/io_uring.h:168 [inline]\n io_do_iopoll+0x474/0x62c io_uring/rw.c:1065\n io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513\n io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056\n io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869\n process_one_work+0x2d8/0x504 kernel/workqueue.c:2289\n worker_thread+0x340/0x610 kernel/workqueue.c:2436\n kthread+0x12c/0x158 kernel/kthread.c:376\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863\n\nThere is no real problem for normal IOPOLL as flush is also called with\nuring_lock taken, but it's getting more complicated for IOPOLL|SQPOLL,\nfor which __io_cqring_overflow_flush() happens from the CQ waiting path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ceeb2215-0bc4-4fe8-bcd7-edd393a8a536",
      "id": "CVE-2023-52915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer\n\nIn af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach af9035_i2c_master_xfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 0ed554fd769a\n(\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d2e77ec-6b2c-4269-9531-bbcf7e1a5495",
      "id": "CVE-2023-53031",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/imc-pmu: Fix use of mutex in IRQs disabled section\n\nCurrent imc-pmu code triggers a WARNING with CONFIG_DEBUG_ATOMIC_SLEEP\nand CONFIG_PROVE_LOCKING enabled, while running a thread_imc event.\n\nCommand to trigger the warning:\n  # perf stat -e thread_imc/CPM_CS_FROM_L4_MEM_X_DPTEG/ sleep 5\n\n   Performance counter stats for 'sleep 5':\n\n                   0      thread_imc/CPM_CS_FROM_L4_MEM_X_DPTEG/\n\n         5.002117947 seconds time elapsed\n\n         0.000131000 seconds user\n         0.001063000 seconds sys\n\nBelow is snippet of the warning in dmesg:\n\n  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580\n  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2869, name: perf-exec\n  preempt_count: 2, expected: 0\n  4 locks held by perf-exec/2869:\n   #0: c00000004325c540 (\u0026sig-\u003ecred_guard_mutex){+.+.}-{3:3}, at: bprm_execve+0x64/0xa90\n   #1: c00000004325c5d8 (\u0026sig-\u003eexec_update_lock){++++}-{3:3}, at: begin_new_exec+0x460/0xef0\n   #2: c0000003fa99d4e0 (\u0026cpuctx_lock){-...}-{2:2}, at: perf_event_exec+0x290/0x510\n   #3: c000000017ab8418 (\u0026ctx-\u003elock){....}-{2:2}, at: perf_event_exec+0x29c/0x510\n  irq event stamp: 4806\n  hardirqs last  enabled at (4805): [\u003cc000000000f65b94\u003e] _raw_spin_unlock_irqrestore+0x94/0xd0\n  hardirqs last disabled at (4806): [\u003cc0000000003fae44\u003e] perf_event_exec+0x394/0x510\n  softirqs last  enabled at (0): [\u003cc00000000013c404\u003e] copy_process+0xc34/0x1ff0\n  softirqs last disabled at (0): [\u003c0000000000000000\u003e] 0x0\n  CPU: 36 PID: 2869 Comm: perf-exec Not tainted 6.2.0-rc2-00011-g1247637727f2 #61\n  Hardware name: 8375-42A POWER9 0x4e1202 opal:v7.0-16-g9b85f7d961 PowerNV\n  Call Trace:\n    dump_stack_lvl+0x98/0xe0 (unreliable)\n    __might_resched+0x2f8/0x310\n    __mutex_lock+0x6c/0x13f0\n    thread_imc_event_add+0xf4/0x1b0\n    event_sched_in+0xe0/0x210\n    merge_sched_in+0x1f0/0x600\n    visit_groups_merge.isra.92.constprop.166+0x2bc/0x6c0\n    ctx_flexible_sched_in+0xcc/0x140\n    ctx_sched_in+0x20c/0x2a0\n    ctx_resched+0x104/0x1c0\n    perf_event_exec+0x340/0x510\n    begin_new_exec+0x730/0xef0\n    load_elf_binary+0x3f8/0x1e10\n  ...\n  do not call blocking ops when !TASK_RUNNING; state=2001 set at [\u003c00000000fd63e7cf\u003e] do_nanosleep+0x60/0x1a0\n  WARNING: CPU: 36 PID: 2869 at kernel/sched/core.c:9912 __might_sleep+0x9c/0xb0\n  CPU: 36 PID: 2869 Comm: sleep Tainted: G        W          6.2.0-rc2-00011-g1247637727f2 #61\n  Hardware name: 8375-42A POWER9 0x4e1202 opal:v7.0-16-g9b85f7d961 PowerNV\n  NIP:  c000000000194a1c LR: c000000000194a18 CTR: c000000000a78670\n  REGS: c00000004d2134e0 TRAP: 0700   Tainted: G        W           (6.2.0-rc2-00011-g1247637727f2)\n  MSR:  9000000000021033 \u003cSF,HV,ME,IR,DR,RI,LE\u003e  CR: 48002824  XER: 00000000\n  CFAR: c00000000013fb64 IRQMASK: 1\n\nThe above warning triggered because the current imc-pmu code uses mutex\nlock in interrupt disabled sections. The function mutex_lock()\ninternally calls __might_resched(), which will check if IRQs are\ndisabled and in case IRQs are disabled, it will trigger the warning.\n\nFix the issue by changing the mutex lock to spinlock.\n\n[mpe: Fix comments, trim oops in change log, add reported-by tags]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0242c14b-ae0b-411f-bc56-8dc4b7812141",
      "id": "CVE-2023-53034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans\n\nThere is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and\nsize. This would make xlate_pos negative.\n\n[   23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000\n[   23.734158] ================================================================================\n[   23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7\n[   23.734418] shift exponent -1 is negative\n\nEnsuring xlate_pos is a positive or zero before BIT.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d63f1a9-a71e-4666-8ada-1b4c4fef5f31",
      "id": "CVE-2024-33621",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: Dont Use skb-\u003esk in ipvlan_process_v{4,6}_outbound\n\nRaw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will\nhit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path.\n\nWARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70\nModules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper\nCPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:sk_mc_loop+0x2d/0x70\nCode: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c\nRSP: 0018:ffffa9584015cd78 EFLAGS: 00010212\nRAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001\nRDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000\nRBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00\nR10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000\nR13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000\nFS:  0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cIRQ\u003e\n ? __warn (kernel/panic.c:693)\n ? sk_mc_loop (net/core/sock.c:760)\n ? report_bug (lib/bug.c:201 lib/bug.c:219)\n ? handle_bug (arch/x86/kernel/traps.c:239)\n ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1))\n ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)\n ? sk_mc_loop (net/core/sock.c:760)\n ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1))\n ? nf_hook_slow (net/netfilter/core.c:626)\n ip6_finish_output (net/ipv6/ip6_output.c:222)\n ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215)\n ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan\n ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan\n dev_hard_start_xmit (net/core/dev.c:3594)\n sch_direct_xmit (net/sched/sch_generic.c:343)\n __qdisc_run (net/sched/sch_generic.c:416)\n net_tx_action (net/core/dev.c:5286)\n handle_softirqs (kernel/softirq.c:555)\n __irq_exit_rcu (kernel/softirq.c:589)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043)\n\nThe warning triggers as this:\npacket_sendmsg\n   packet_snd //skb-\u003esk is packet sk\n      __dev_queue_xmit\n         __dev_xmit_skb //q-\u003eenqueue is not NULL\n             __qdisc_run\n               sch_direct_xmit\n                 dev_hard_start_xmit\n                   ipvlan_start_xmit\n                      ipvlan_xmit_mode_l3 //l3 mode\n                        ipvlan_process_outbound //vepa flag\n                          ipvlan_process_v6_outbound\n                            ip6_local_out\n                                __ip6_finish_output\n                                  ip6_finish_output2 //multicast packet\n                                    sk_mc_loop //sk-\u003esk_family is AF_PACKET\n\nCall ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15a39af9-d185-407a-8b24-4bc270d52613",
      "id": "CVE-2023-53094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: fsl_lpuart: fix race on RX DMA shutdown\n\nFrom time to time DMA completion can come in the middle of DMA shutdown:\n\n\u003cprocess ctx\u003e:\t\t\t\t\u003cIRQ\u003e:\nlpuart32_shutdown()\n  lpuart_dma_shutdown()\n    del_timer_sync()\n\t\t\t\t\tlpuart_dma_rx_complete()\n\t\t\t\t\t  lpuart_copy_rx_to_tty()\n\t\t\t\t\t    mod_timer()\n    lpuart_dma_rx_free()\n\nWhen the timer fires a bit later, sport-\u003edma_rx_desc is NULL:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000004\npc : lpuart_copy_rx_to_tty+0xcc/0x5bc\nlr : lpuart_timer_func+0x1c/0x2c\nCall trace:\n lpuart_copy_rx_to_tty\n lpuart_timer_func\n call_timer_fn\n __run_timers.part.0\n run_timer_softirq\n __do_softirq\n __irq_exit_rcu\n irq_exit\n handle_domain_irq\n gic_handle_irq\n call_on_irq_stack\n do_interrupt_handler\n ...\n\nTo fix this fold del_timer_sync() into lpuart_dma_rx_free() after\ndmaengine_terminate_sync() to make sure timer will not be re-started in\nlpuart_copy_rx_to_tty() \u003c= lpuart_dma_rx_complete().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42effdf9-2e6d-4264-8329-ed0c87ce9d2e",
      "id": "CVE-2023-53373",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Handle EBUSY correctly\n\nAs it is seqiv only handles the special return value of EINPROGERSS,\nwhich means that in all other cases it will free data related to the\nrequest.\n\nHowever, as the caller of seqiv may specify MAY_BACKLOG, we also need\nto expect EBUSY and treat it in the same way.  Otherwise backlogged\nrequests will trigger a use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a933c9d-99e9-4791-bf41-ed4ce49da28b",
      "id": "CVE-2023-53411",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: EM: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd678b84-6d84-4cff-8625-f2c2c23fef6e",
      "id": "CVE-2023-53425",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mediatek: vpu: fix NULL ptr dereference\n\nIf pdev is NULL, then it is still dereferenced.\n\nThis fixes this smatch warning:\n\ndrivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b19f941d-216c-49f7-b173-08b2b30c0d4a",
      "id": "CVE-2024-25740",
      "description": "A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj-\u003ename is not released.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4626ed70-9239-4ba2-958a-9670bf062e2c",
      "id": "CVE-2024-26793",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix use-after-free and null-ptr-deref in gtp_newlink()\n\nThe gtp_link_ops operations structure for the subsystem must be\nregistered after registering the gtp_net_ops pernet operations structure.\n\nSyzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:\n\n[ 1010.702740] gtp: GTP module unloaded\n[ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n[ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1\n[ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\n[ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00\n[ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203\n[ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000\n[ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282\n[ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000\n[ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80\n[ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400\n[ 1010.715953] FS:  00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000\n[ 1010.715958] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0\n[ 1010.715968] PKRU: 55555554\n[ 1010.715972] Call Trace:\n[ 1010.715985]  ? __die_body.cold+0x1a/0x1f\n[ 1010.715995]  ? die_addr+0x43/0x70\n[ 1010.716002]  ? exc_general_protection+0x199/0x2f0\n[ 1010.716016]  ? asm_exc_general_protection+0x1e/0x30\n[ 1010.716026]  ? gtp_newlink+0x4d7/0x9c0 [gtp]\n[ 1010.716034]  ? gtp_net_exit+0x150/0x150 [gtp]\n[ 1010.716042]  __rtnl_newlink+0x1063/0x1700\n[ 1010.716051]  ? rtnl_setlink+0x3c0/0x3c0\n[ 1010.716063]  ? is_bpf_text_address+0xc0/0x1f0\n[ 1010.716070]  ? kernel_text_address.part.0+0xbb/0xd0\n[ 1010.716076]  ? __kernel_text_address+0x56/0xa0\n[ 1010.716084]  ? unwind_get_return_address+0x5a/0xa0\n[ 1010.716091]  ? create_prof_cpu_mask+0x30/0x30\n[ 1010.716098]  ? arch_stack_walk+0x9e/0xf0\n[ 1010.716106]  ? stack_trace_save+0x91/0xd0\n[ 1010.716113]  ? stack_trace_consume_entry+0x170/0x170\n[ 1010.716121]  ? __lock_acquire+0x15c5/0x5380\n[ 1010.716139]  ? mark_held_locks+0x9e/0xe0\n[ 1010.716148]  ? kmem_cache_alloc_trace+0x35f/0x3c0\n[ 1010.716155]  ? __rtnl_newlink+0x1700/0x1700\n[ 1010.716160]  rtnl_newlink+0x69/0xa0\n[ 1010.716166]  rtnetlink_rcv_msg+0x43b/0xc50\n[ 1010.716172]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716179]  ? lock_acquire+0x1fe/0x560\n[ 1010.716188]  ? netlink_deliver_tap+0x12f/0xd50\n[ 1010.716196]  netlink_rcv_skb+0x14d/0x440\n[ 1010.716202]  ? rtnl_fdb_dump+0x9f0/0x9f0\n[ 1010.716208]  ? netlink_ack+0xab0/0xab0\n[ 1010.716213]  ? netlink_deliver_tap+0x202/0xd50\n[ 1010.716220]  ? netlink_deliver_tap+0x218/0xd50\n[ 1010.716226]  ? __virt_addr_valid+0x30b/0x590\n[ 1010.716233]  netlink_unicast+0x54b/0x800\n[ 1010.716240]  ? netlink_attachskb+0x870/0x870\n[ 1010.716248]  ? __check_object_size+0x2de/0x3b0\n[ 1010.716254]  netlink_sendmsg+0x938/0xe40\n[ 1010.716261]  ? netlink_unicast+0x800/0x800\n[ 1010.716269]  ? __import_iovec+0x292/0x510\n[ 1010.716276]  ? netlink_unicast+0x800/0x800\n[ 1010.716284]  __sock_sendmsg+0x159/0x190\n[ 1010.716290]  ____sys_sendmsg+0x712/0x880\n[ 1010.716297]  ? sock_write_iter+0x3d0/0x3d0\n[ 1010.716304]  ? __ia32_sys_recvmmsg+0x270/0x270\n[ 1010.716309]  ? lock_acquire+0x1fe/0x560\n[ 1010.716315]  ? drain_array_locked+0x90/0x90\n[ 1010.716324]  ___sys_sendmsg+0xf8/0x170\n[ 1010.716331]  ? sendmsg_copy_msghdr+0x170/0x170\n[ 1010.716337]  ? lockdep_init_map\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "633367c5-c95d-48f3-a1ad-47980285ad69",
      "id": "CVE-2024-26810",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Lock external INTx masking ops\n\nMask operations through config space changes to DisINTx may race INTx\nconfiguration changes via ioctl.  Create wrappers that add locking for\npaths outside of the core interrupt code.\n\nIn particular, irq_type is updated holding igate, therefore testing\nis_intx() requires holding igate.  For example clearing DisINTx from\nconfig space can otherwise race changes of the interrupt configuration.\n\nThis aligns interfaces which may trigger the INTx eventfd into two\ncamps, one side serialized by igate and the other only enabled while\nINTx is configured.  A subsequent patch introduces synchronization for\nthe latter flows.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3013bd46-e07e-46c5-9a6c-565cbdfe78ee",
      "id": "CVE-2024-26976",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Always flush async #PF workqueue when vCPU is being destroyed\n\nAlways flush the per-vCPU async #PF workqueue when a vCPU is clearing its\ncompletion queue, e.g. when a VM and all its vCPUs is being destroyed.\nKVM must ensure that none of its workqueue callbacks is running when the\nlast reference to the KVM _module_ is put.  Gifting a reference to the\nassociated VM prevents the workqueue callback from dereferencing freed\nvCPU/VM memory, but does not prevent the KVM module from being unloaded\nbefore the callback completes.\n\nDrop the misguided VM refcount gifting, as calling kvm_put_kvm() from\nasync_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will\nresult in deadlock.  async_pf_execute() can't return until kvm_put_kvm()\nfinishes, and kvm_put_kvm() can't return until async_pf_execute() finishes:\n\n WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm]\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass\n CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n Workqueue: events async_pf_execute [kvm]\n RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm]\n Call Trace:\n  \u003cTASK\u003e\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n INFO: task kworker/8:1:251 blocked for more than 120 seconds.\n       Tainted: G        W          6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/8:1     state:D stack:0     pid:251   ppid:2      flags:0x00004000\n Workqueue: events async_pf_execute [kvm]\n Call Trace:\n  \u003cTASK\u003e\n  __schedule+0x33f/0xa40\n  schedule+0x53/0xc0\n  schedule_timeout+0x12a/0x140\n  __wait_for_common+0x8d/0x1d0\n  __flush_work.isra.0+0x19f/0x2c0\n  kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm]\n  kvm_arch_destroy_vm+0x78/0x1b0 [kvm]\n  kvm_put_kvm+0x1c1/0x320 [kvm]\n  async_pf_execute+0x198/0x260 [kvm]\n  process_one_work+0x145/0x2d0\n  worker_thread+0x27e/0x3a0\n  kthread+0xba/0xe0\n  ret_from_fork+0x2d/0x50\n  ret_from_fork_asm+0x11/0x20\n  \u003c/TASK\u003e\n\nIf kvm_clear_async_pf_completion_queue() actually flushes the workqueue,\nthen there's no need to gift async_pf_execute() a reference because all\ninvocations of async_pf_execute() will be forced to complete before the\nvCPU and its VM are destroyed/freed.  And that in turn fixes the module\nunloading bug as __fput() won't do module_put() on the last vCPU reference\nuntil the vCPU has been freed, e.g. if closing the vCPU file also puts the\nlast reference to the KVM module.\n\nNote that kvm_check_async_pf_completion() may also take the work item off\nthe completion queue and so also needs to flush the work queue, as the\nwork will not be seen by kvm_clear_async_pf_completion_queue().  Waiting\non the workqueue could theoretically delay a vCPU due to waiting for the\nwork to complete, but that's a very, very small chance, and likely a very\nsmall delay.  kvm_arch_async_page_present_queued() unconditionally makes a\nnew request, i.e. will effectively delay entering the guest, so the\nremaining work is really just:\n\n        trace_kvm_async_pf_completed(addr, cr2_or_gpa);\n\n        __kvm_vcpu_wake_up(vcpu);\n\n        mmput(mm);\n\nand mmput() can't drop the last reference to the page tables if the vCPU is\nstill alive, i.e. the vCPU won't get stuck tearing down page tables.\n\nAdd a helper to do the flushing, specifically to deal with \"wakeup all\"\nwork items, as they aren't actually work items, i.e. are never placed in a\nworkqueue.  Trying to flush a bogus workqueue entry rightly makes\n__flush_work() complain (kudos to whoever added that sanity check).\n\nNote, commit 5f6de5cbebee (\"KVM: Prevent module exit until al\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "da902ea9-8a0c-496f-b958-7717cc2ed1b1",
      "id": "CVE-2024-46802",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: added NULL check at start of dc_validate_stream\n\n[Why]\nprevent invalid memory access\n\n[How]\ncheck if dc and stream are NULL",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d24b0335-1dc3-4f8f-95be-fcb8e80880b0",
      "id": "CVE-2024-27397",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: use timestamp to check for set element timeout\n\nAdd a timestamp field at the beginning of the transaction, store it\nin the nftables per-netns area.\n\nUpdate set backend .insert, .deactivate and sync gc path to use the\ntimestamp, this avoids that an element expires while control plane\ntransaction is still unfinished.\n\n.lookup and .update, which are used from packet path, still use the\ncurrent time to check if the element has expired. And .get path and dump\nalso since this runs lockless under rcu read size lock. Then, there is\nasync gc which also needs to check the current time since it runs\nasynchronously from a workqueue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38abb1e3-d4a3-4a4e-9e24-2e7892973693",
      "id": "CVE-2024-43855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev-\u003eflush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev-\u003eflush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev-\u003eflush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev-\u003eflush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev-\u003eflush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev-\u003eflush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f0da97e-74c8-4bb7-8d1c-fa46d8962140",
      "id": "CVE-2024-35866",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_dump_full_key()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d091409b-6619-4913-9c5d-a24bb2356343",
      "id": "CVE-2024-36286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()\n\nsyzbot reported that nf_reinject() could be called without rcu_read_lock() :\n\nWARNING: suspicious RCU usage\n6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted\n\nnet/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n2 locks held by syz-executor.4/13427:\n  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]\n  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline]\n  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471\n  #1: ffff88801ca92958 (\u0026inst-\u003elock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n  #1: ffff88801ca92958 (\u0026inst-\u003elock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline]\n  #1: ffff88801ca92958 (\u0026inst-\u003elock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172\n\nstack backtrace:\nCPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nCall Trace:\n \u003cIRQ\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712\n  nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline]\n  nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397\n  nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline]\n  instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172\n  rcu_do_batch kernel/rcu/tree.c:2196 [inline]\n  rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471\n  handle_softirqs+0x2d6/0x990 kernel/softirq.c:554\n  __do_softirq kernel/softirq.c:588 [inline]\n  invoke_softirq kernel/softirq.c:428 [inline]\n  __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:649\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043\n \u003c/IRQ\u003e\n \u003cTASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "364c8e67-c7d4-45dc-865b-d27818aa284c",
      "id": "CVE-2024-36880",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: add missing firmware sanity checks\n\nAdd the missing sanity checks when parsing the firmware files before\ndownloading them to avoid accessing and corrupting memory beyond the\nvmalloced buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cecc627-ba3c-4f4c-9ee5-7cf0a7c1800c",
      "id": "CVE-2024-38560",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bfa: Ensure the copied buf is NUL terminated\n\nCurrently, we allocate a nbytes-sized kernel buffer and copy nbytes from\nuserspace to that buffer. Later, we use sscanf on this buffer but we don't\nensure that the string is terminated inside the buffer, this can lead to\nOOB read when using sscanf. Fix this issue by using memdup_user_nul instead\nof memdup_user.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1e253a9-1263-4e53-93d4-53c374de3a1a",
      "id": "CVE-2023-1195",
      "description": "A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server-\u003ehostname to NULL, leading to an invalid pointer request.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7965fd9-626c-474f-8974-e81dc9831229",
      "id": "CVE-2024-38612",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix invalid unregister error path\n\nThe error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL\nis not defined. In that case if seg6_hmac_init() fails, the\ngenl_unregister_family() isn't called.\n\nThis issue exist since commit 46738b1317e1 (\"ipv6: sr: add option to control\nlwtunnel support\"), and commit 5559cea2d5aa (\"ipv6: sr: fix possible\nuse-after-free and null-ptr-deref\") replaced unregister_pernet_subsys()\nwith genl_unregister_family() in this error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3d07cce-be66-4e8a-9c27-e0f37ca7be7a",
      "id": "CVE-2024-38627",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstm class: Fix a double free in stm_register_device()\n\nThe put_device(\u0026stm-\u003edev) call will trigger stm_device_release() which\nfrees \"stm\" so the vfree(stm) on the next line is a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f05b7961-af1a-404e-82fd-13a7abd03340",
      "id": "CVE-2024-46813",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_index before accessing dc-\u003elinks[]\n\n[WHY \u0026 HOW]\ndc-\u003elinks[] has max size of MAX_LINKS and NULL is return when trying to\naccess with out-of-bound index.\n\nThis fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a624fcb7-5aa1-47eb-a854-9ef99460bd80",
      "id": "CVE-2024-39483",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked\n\nWhen requesting an NMI window, WARN on vNMI support being enabled if and\nonly if NMIs are actually masked, i.e. if the vCPU is already handling an\nNMI.  KVM's ABI for NMIs that arrive simultanesouly (from KVM's point of\nview) is to inject one NMI and pend the other.  When using vNMI, KVM pends\nthe second NMI simply by setting V_NMI_PENDING, and lets the CPU do the\nrest (hardware automatically sets V_NMI_BLOCKING when an NMI is injected).\n\nHowever, if KVM can't immediately inject an NMI, e.g. because the vCPU is\nin an STI shadow or is running with GIF=0, then KVM will request an NMI\nwindow and trigger the WARN (but still function correctly).\n\nWhether or not the GIF=0 case makes sense is debatable, as the intent of\nKVM's behavior is to provide functionality that is as close to real\nhardware as possible.  E.g. if two NMIs are sent in quick succession, the\nprobability of both NMIs arriving in an STI shadow is infinitesimally low\non real hardware, but significantly larger in a virtual environment, e.g.\nif the vCPU is preempted in the STI shadow.  For GIF=0, the argument isn't\nas clear cut, because the window where two NMIs can collide is much larger\nin bare metal (though still small).\n\nThat said, KVM should not have divergent behavior for the GIF=0 case based\non whether or not vNMI support is enabled.  And KVM has allowed\nsimultaneous NMIs with GIF=0 for over a decade, since commit 7460fb4a3400\n(\"KVM: Fix simultaneous NMIs\").  I.e. KVM's GIF=0 handling shouldn't be\nmodified without a *really* good reason to do so, and if KVM's behavior\nwere to be modified, it should be done irrespective of vNMI support.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "552152b7-55cc-4dd2-ab78-98c30f5fd58c",
      "id": "CVE-2024-41020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Fix fcntl/close race recovery compat path\n\nWhen I wrote commit 3cad1bc01041 (\"filelock: Remove locks reliably when\nfcntl/close race is detected\"), I missed that there are two copies of the\ncode I was patching: The normal version, and the version for 64-bit offsets\non 32-bit kernels.\nThanks to Greg KH for stumbling over this while doing the stable\nbackport...\n\nApply exactly the same fix to the compat path for 32-bit kernels.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "358f0fe4-e58d-4770-92a5-364f8fb1bba1",
      "id": "CVE-2022-48972",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()\n\nKernel fault injection test reports null-ptr-deref as follows:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nRIP: 0010:cfg802154_netdev_notifier_call+0x120/0x310 include/linux/list.h:114\nCall Trace:\n \u003cTASK\u003e\n raw_notifier_call_chain+0x6d/0xa0 kernel/notifier.c:87\n call_netdevice_notifiers_info+0x6e/0xc0 net/core/dev.c:1944\n unregister_netdevice_many_notify+0x60d/0xcb0 net/core/dev.c:1982\n unregister_netdevice_queue+0x154/0x1a0 net/core/dev.c:10879\n register_netdevice+0x9a8/0xb90 net/core/dev.c:10083\n ieee802154_if_add+0x6ed/0x7e0 net/mac802154/iface.c:659\n ieee802154_register_hw+0x29c/0x330 net/mac802154/main.c:229\n mcr20a_probe+0xaaa/0xcb1 drivers/net/ieee802154/mcr20a.c:1316\n\nieee802154_if_add() allocates wpan_dev as netdev's private data, but not\ninit the list in struct wpan_dev. cfg802154_netdev_notifier_call() manage\nthe list when device register/unregister, and may lead to null-ptr-deref.\n\nUse INIT_LIST_HEAD() on it to initialize it correctly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f61eac4-3dd8-4f2b-a9a1-7da8944d1ce8",
      "id": "CVE-2024-42087",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep\n\nThe ilitek-ili9881c controls the reset GPIO using the non-sleeping\ngpiod_set_value() function. This complains loudly when the GPIO\ncontroller needs to sleep. As the caller can sleep, use\ngpiod_set_value_cansleep() to fix the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26c0efd2-355a-43cf-a962-e356d08cd58d",
      "id": "CVE-2024-42089",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: fsl-asoc-card: set priv-\u003epdev before using it\n\npriv-\u003epdev pointer was set after being used in\nfsl_asoc_card_audmux_init().\nMove this assignment at the start of the probe function, so\nsub-functions can correctly use pdev through priv.\n\nfsl_asoc_card_audmux_init() dereferences priv-\u003epdev to get access to the\ndev struct, used with dev_err macros.\nAs priv is zero-initialised, there would be a NULL pointer dereference.\nNote that if priv-\u003edev is dereferenced before assignment but never used,\nfor example if there is no error to be printed, the driver won't crash\nprobably due to compiler optimisations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8de07811-59f0-4fa5-9aaf-5f707b6815c0",
      "id": "CVE-2024-43829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/qxl: Add check for drm_cvt_mode\n\nAdd check for the return value of drm_cvt_mode() and return the error if\nit fails in order to avoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1918446d-8c92-4065-924e-039f63789994",
      "id": "CVE-2024-42271",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use after free in iucv_sock_close()\n\niucv_sever_path() is called from process context and from bh context.\niucv-\u003epath is used as indicator whether somebody else is taking care of\nsevering the path (or it is already removed / never existed).\nThis needs to be done with atomic compare and swap, otherwise there is a\nsmall window where iucv_sock_close() will try to work with a path that has\nalready been severed and freed by iucv_callback_connrej() called by\niucv_tasklet_fn().\n\nExample:\n[452744.123844] Call Trace:\n[452744.123845] ([\u003c0000001e87f03880\u003e] 0x1e87f03880)\n[452744.123966]  [\u003c00000000d593001e\u003e] iucv_path_sever+0x96/0x138\n[452744.124330]  [\u003c000003ff801ddbca\u003e] iucv_sever_path+0xc2/0xd0 [af_iucv]\n[452744.124336]  [\u003c000003ff801e01b6\u003e] iucv_sock_close+0xa6/0x310 [af_iucv]\n[452744.124341]  [\u003c000003ff801e08cc\u003e] iucv_sock_release+0x3c/0xd0 [af_iucv]\n[452744.124345]  [\u003c00000000d574794e\u003e] __sock_release+0x5e/0xe8\n[452744.124815]  [\u003c00000000d5747a0c\u003e] sock_close+0x34/0x48\n[452744.124820]  [\u003c00000000d5421642\u003e] __fput+0xba/0x268\n[452744.124826]  [\u003c00000000d51b382c\u003e] task_work_run+0xbc/0xf0\n[452744.124832]  [\u003c00000000d5145710\u003e] do_notify_resume+0x88/0x90\n[452744.124841]  [\u003c00000000d5978096\u003e] system_call+0xe2/0x2c8\n[452744.125319] Last Breaking-Event-Address:\n[452744.125321]  [\u003c00000000d5930018\u003e] iucv_path_sever+0x90/0x138\n[452744.125324]\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\n\nNote that bh_lock_sock() is not serializing the tasklet context against\nprocess context, because the check for sock_owned_by_user() and\ncorresponding handling is missing.\n\nIdeas for a future clean-up patch:\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\nRe-enqueue, if needed. This may require adding return values to the\ntasklet functions and thus changes to all users of iucv.\n\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03fee5ac-d448-4f56-ae69-9c411a26ef3b",
      "id": "CVE-2024-43867",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: prime: fix refcount underflow\n\nCalling nouveau_bo_ref() on a nouveau_bo without initializing it (and\nhence the backing ttm_bo) leads to a refcount underflow.\n\nInstead of calling nouveau_bo_ref() in the unwind path of\ndrm_gem_object_init(), clean things up manually.\n\n(cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d26ae6d0-9f05-4561-903f-417301e54a96",
      "id": "CVE-2024-43882",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Fix ToCToU between perm check and set-uid/gid usage\n\nWhen opening a file for exec via do_filp_open(), permission checking is\ndone against the file's metadata at that moment, and on success, a file\npointer is passed back. Much later in the execve() code path, the file\nmetadata (specifically mode, uid, and gid) is used to determine if/how\nto set the uid and gid. However, those values may have changed since the\npermissions check, meaning the execution may gain unintended privileges.\n\nFor example, if a file could change permissions from executable and not\nset-id:\n\n---------x 1 root root 16048 Aug  7 13:16 target\n\nto set-id and non-executable:\n\n---S------ 1 root root 16048 Aug  7 13:16 target\n\nit is possible to gain root privileges when execution should have been\ndisallowed.\n\nWhile this race condition is rare in real-world scenarios, it has been\nobserved (and proven exploitable) when package managers are updating\nthe setuid bits of installed programs. Such files start with being\nworld-executable but then are adjusted to be group-exec with a set-uid\nbit. For example, \"chmod o-x,u+s target\" makes \"target\" executable only\nby uid \"root\" and gid \"cdrom\", while also becoming setuid-root:\n\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\n\nbecomes:\n\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\n\nBut racing the chmod means users without group \"cdrom\" membership can\nget the permission to execute \"target\" just before the chmod, and when\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\nsetuid to root, violating the expressed authorization of \"only cdrom\ngroup members can setuid to root\".\n\nRe-check that we still have execute permissions in case the metadata\nhas changed. It would be better to keep a copy from the perm-check time,\nbut until we can do that refactoring, the least-bad option is to do a\nfull inode_permission() call (under inode lock). It is understood that\nthis is safe against dead-locks, but hardly optimal.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "376cd8cf-0a11-487a-8b77-10f835278f80",
      "id": "CVE-2024-44982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: cleanup FB if dpu_format_populate_layout fails\n\nIf the dpu_format_populate_layout() fails, then FB is prepared, but not\ncleaned up. This ends up leaking the pin_count on the GEM object and\ncauses a splat during DRM file closure:\n\nmsm_obj-\u003epin_count\nWARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc\n[...]\nCall trace:\n update_lru_locked+0xc4/0xcc\n put_pages+0xac/0x100\n msm_gem_free_object+0x138/0x180\n drm_gem_object_free+0x1c/0x30\n drm_gem_object_handle_put_unlocked+0x108/0x10c\n drm_gem_object_release_handle+0x58/0x70\n idr_for_each+0x68/0xec\n drm_gem_release+0x28/0x40\n drm_file_free+0x174/0x234\n drm_release+0xb0/0x160\n __fput+0xc0/0x2c8\n __fput_sync+0x50/0x5c\n __arm64_sys_close+0x38/0x7c\n invoke_syscall+0x48/0x118\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x4c/0x120\n el0t_64_sync_handler+0x100/0x12c\n el0t_64_sync+0x190/0x194\nirq event stamp: 129818\nhardirqs last  enabled at (129817): [\u003cffffa5f6d953fcc0\u003e] console_unlock+0x118/0x124\nhardirqs last disabled at (129818): [\u003cffffa5f6da7dcf04\u003e] el1_dbg+0x24/0x8c\nsoftirqs last  enabled at (129808): [\u003cffffa5f6d94afc18\u003e] handle_softirqs+0x4c8/0x4e8\nsoftirqs last disabled at (129785): [\u003cffffa5f6d94105e4\u003e] __do_softirq+0x14/0x20\n\nPatchwork: https://patchwork.freedesktop.org/patch/600714/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a74d4751-861c-41c9-8e52-6095f274f8be",
      "id": "CVE-2022-50405",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tunnel: wait until all sk_user_data reader finish before releasing the sock\n\nThere is a race condition in vxlan that when deleting a vxlan device\nduring receiving packets, there is a possibility that the sock is\nreleased after getting vxlan_sock vs from sk_user_data. Then in\nlater vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got\nNULL pointer dereference. e.g.\n\n   #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757\n   #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d\n   #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48\n   #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b\n   #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb\n   #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542\n   #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62\n      [exception RIP: vxlan_ecn_decapsulate+0x3b]\n      RIP: ffffffffc1014e7b  RSP: ffffa25ec6978cb0  RFLAGS: 00010246\n      RAX: 0000000000000008  RBX: ffff8aa000888000  RCX: 0000000000000000\n      RDX: 000000000000000e  RSI: ffff8a9fc7ab803e  RDI: ffff8a9fd1168700\n      RBP: ffff8a9fc7ab803e   R8: 0000000000700000   R9: 00000000000010ae\n      R10: ffff8a9fcb748980  R11: 0000000000000000  R12: ffff8a9fd1168700\n      R13: ffff8aa000888000  R14: 00000000002a0000  R15: 00000000000010ae\n      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n   #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]\n   #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507\n   #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45\n  #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807\n  #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951\n  #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde\n  #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b\n  #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139\n  #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a\n  #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3\n  #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca\n  #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3\n\nReproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh\n\nFix this by waiting for all sk_user_data reader to finish before\nreleasing the sock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "239e78d7-d5ba-4d03-acec-0ced8ffecc2f",
      "id": "CVE-2023-52478",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Fix kernel crash on receiver USB disconnect\n\nhidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU)\nraces when it races with itself.\n\nhidpp_connect_event() primarily runs from a workqueue but it also runs\non probe() and if a \"device-connected\" packet is received by the hw\nwhen the thread running hidpp_connect_event() from probe() is waiting on\nthe hw, then a second thread running hidpp_connect_event() will be\nstarted from the workqueue.\n\nThis opens the following races (note the below code is simplified):\n\n1. Retrieving + printing the protocol (harmless race):\n\n\tif (!hidpp-\u003eprotocol_major) {\n\t\thidpp_root_get_protocol_version()\n\t\thidpp-\u003eprotocol_major = response.rap.params[0];\n\t}\n\nWe can actually see this race hit in the dmesg in the abrt output\nattached to rhbz#2227968:\n\n[ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.\n[ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.\n\nTesting with extra logging added has shown that after this the 2 threads\ntake turn grabbing the hw access mutex (send_mutex) so they ping-pong\nthrough all the other TOCTOU cases managing to hit all of them:\n\n2. Updating the name to the HIDPP name (harmless race):\n\n\tif (hidpp-\u003ename == hdev-\u003ename) {\n\t\t...\n\t\thidpp-\u003ename = new_name;\n\t}\n\n3. Initializing the power_supply class for the battery (problematic!):\n\nhidpp_initialize_battery()\n{\n        if (hidpp-\u003ebattery.ps)\n                return 0;\n\n\tprobe_battery(); /* Blocks, threads take turns executing this */\n\n\thidpp-\u003ebattery.desc.properties =\n\t\tdevm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);\n\n\thidpp-\u003ebattery.ps =\n\t\tdevm_power_supply_register(\u0026hidpp-\u003ehid_dev-\u003edev,\n\t\t\t\t\t   \u0026hidpp-\u003ebattery.desc, cfg);\n}\n\n4. Creating delayed input_device (potentially problematic):\n\n\tif (hidpp-\u003edelayed_input)\n\t\treturn;\n\n\thidpp-\u003edelayed_input = hidpp_allocate_input(hdev);\n\nThe really big problem here is 3. Hitting the race leads to the following\nsequence:\n\n\thidpp-\u003ebattery.desc.properties =\n\t\tdevm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);\n\n\thidpp-\u003ebattery.ps =\n\t\tdevm_power_supply_register(\u0026hidpp-\u003ehid_dev-\u003edev,\n\t\t\t\t\t   \u0026hidpp-\u003ebattery.desc, cfg);\n\n\t...\n\n\thidpp-\u003ebattery.desc.properties =\n\t\tdevm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);\n\n\thidpp-\u003ebattery.ps =\n\t\tdevm_power_supply_register(\u0026hidpp-\u003ehid_dev-\u003edev,\n\t\t\t\t\t   \u0026hidpp-\u003ebattery.desc, cfg);\n\nSo now we have registered 2 power supplies for the same battery,\nwhich looks a bit weird from userspace's pov but this is not even\nthe really big problem.\n\nNotice how:\n\n1. This is all devm-maganaged\n2. The hidpp-\u003ebattery.desc struct is shared between the 2 power supplies\n3. hidpp-\u003ebattery.desc.properties points to the result from the second\n   devm_kmemdup()\n\nThis causes a use after free scenario on USB disconnect of the receiver:\n1. The last registered power supply class device gets unregistered\n2. The memory from the last devm_kmemdup() call gets freed,\n   hidpp-\u003ebattery.desc.properties now points to freed memory\n3. The first registered power supply class device gets unregistered,\n   this involves sending a remove uevent to userspace which invokes\n   power_supply_uevent() to fill the uevent data\n4. power_supply_uevent() uses hidpp-\u003ebattery.desc.properties which\n   now points to freed memory leading to backtraces like this one:\n\nSep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08\n...\nSep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event\nSep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0\n...\nSep 22 20:01:35 eric kernel:  ? asm_exc_page_fault+0x26/0x30\nSep 22 20:01:35 eric kernel:  ? power_supply_uevent+0xee/0x1d0\nSep 22 20:01:35 eric kernel:  ? power_supply_uevent+0x10d/0x1d0\nSep 22 20:01:35 eric kernel:  dev_uevent+0x10f/0x2d0\nSep 22 20:01:35 eric kernel:  kobject_uevent_env+0x291/0x680\nSep 22 20:01:35 eric kernel:  \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3623c359-4189-4127-a4dd-b24cea45ca1a",
      "id": "CVE-2024-46821",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix negative array index read\n\nAvoid using the negative values\nfor clk_idex as an index into an array pptable-\u003eDpmDescriptor.\n\nV2: fix clk_index return check (Tim Huang)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2070f016-7e53-446a-b6f0-15de047e4033",
      "id": "CVE-2024-47668",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()\n\nIf we need to increase the tree depth, allocate a new node, and then\nrace with another thread that increased the tree depth before us, we'll\nstill have a preallocated node that might be used later.\n\nIf we then use that node for a new non-root node, it'll still have a\npointer to the old root instead of being zeroed - fix this by zeroing it\nin the cmpxchg failure path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c69cf214-6f04-4993-bbff-2eb7c9ccde76",
      "id": "CVE-2022-48633",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock-\u003emagic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[   79.693962] ------------[ cut here ]------------\n[   79.693992] DEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\n[   79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[   79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G        W   E      6.0.0-rc3+ #490\n[   79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[   79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff \u003c0f\u003e 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[   79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[   79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[   79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[   79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[   79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[   79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[   79.694690] FS:  00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[   79.694705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[   79.694734] Call Trace:\n[   79.694749]  \u003cTASK\u003e\n[   79.694761]  ? __schedule+0x47f/0x1670\n[   79.694796]  ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694830]  ? lock_is_held_type+0xe3/0x140\n[   79.694864]  ? ww_mutex_lock+0x38/0xa0\n[   79.694885]  ? __cond_resched+0x1c/0x30\n[   79.694902]  ww_mutex_lock+0x38/0xa0\n[   79.694925]  psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694964]  psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[   79.694996]  drm_gem_object_release_handle+0x50/0x60\n[   79.695020]  ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[   79.695042]  idr_for_each+0x4b/0xb0\n[   79.695066]  ? _raw_spin_unlock_irqrestore+0x30/0x60\n[   79.695095]  drm_gem_release+0x1c/0x30\n[   79.695118]  drm_file_free.part.0+0x1ea/0x260\n[   79.695150]  drm_release+0x6a/0x120\n[   79.695175]  __fput+0x9f/0x260\n[   79.695203]  task_work_run+0x59/0xa0\n[   79.695227]  do_exit+0x387/0xbe0\n[   79.695250]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[   79.695275]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695304]  do_group_exit+0x33/0xb0\n[   79.695331]  __x64_sys_exit_group+0x14/0x20\n[   79.695353]  do_syscall_64+0x58/0x80\n[   79.695376]  ? up_read+0x17/0x20\n[   79.695401]  ? lock_is_held_type+0xe3/0x140\n[   79.695429]  ? asm_exc_page_fault+0x22/0x30\n[   79.695450]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695473]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   79.695493] RIP: 0033:0x7ff1ccefe3f1\n[   79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[   79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d63d2cf4-0e96-465a-b7b8-bc3495c7357e",
      "id": "CVE-2024-47706",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix possible UAF for bfqq-\u003ebic with merge chain\n\n1) initial state, three tasks:\n\n\t\tProcess 1       Process 2\tProcess 3\n\t\t (BIC1)          (BIC2)\t\t (BIC3)\n\t\t  |  Λ            |  Λ\t\t  |  Λ\n\t\t  |  |            |  |\t\t  |  |\n\t\t  V  |            V  |\t\t  V  |\n\t\t  bfqq1           bfqq2\t\t  bfqq3\nprocess ref:\t   1\t\t    1\t\t    1\n\n2) bfqq1 merged to bfqq2:\n\n\t\tProcess 1       Process 2\tProcess 3\n\t\t (BIC1)          (BIC2)\t\t (BIC3)\n\t\t  |               |\t\t  |  Λ\n\t\t  \\--------------\\|\t\t  |  |\n\t\t                  V\t\t  V  |\n\t\t  bfqq1---------\u003ebfqq2\t\t  bfqq3\nprocess ref:\t   0\t\t    2\t\t    1\n\n3) bfqq2 merged to bfqq3:\n\n\t\tProcess 1       Process 2\tProcess 3\n\t\t (BIC1)          (BIC2)\t\t (BIC3)\n\t here -\u003e Λ                |\t\t  |\n\t\t  \\--------------\\ \\-------------\\|\n\t\t                  V\t\t  V\n\t\t  bfqq1---------\u003ebfqq2----------\u003ebfqq3\nprocess ref:\t   0\t\t    1\t\t    3\n\nIn this case, IO from Process 1 will get bfqq2 from BIC1 first, and then\nget bfqq3 through merge chain, and finially handle IO by bfqq3.\nHowerver, current code will think bfqq2 is owned by BIC1, like initial\nstate, and set bfqq2-\u003ebic to BIC1.\n\nbfq_insert_request\n-\u003e by Process 1\n bfqq = bfq_init_rq(rq)\n  bfqq = bfq_get_bfqq_handle_split\n   bfqq = bic_to_bfqq\n   -\u003e get bfqq2 from BIC1\n bfqq-\u003eref++\n rq-\u003eelv.priv[0] = bic\n rq-\u003eelv.priv[1] = bfqq\n if (bfqq_process_refs(bfqq) == 1)\n  bfqq-\u003ebic = bic\n  -\u003e record BIC1 to bfqq2\n\n  __bfq_insert_request\n   new_bfqq = bfq_setup_cooperator\n   -\u003e get bfqq3 from bfqq2-\u003enew_bfqq\n   bfqq_request_freed(bfqq)\n   new_bfqq-\u003eref++\n   rq-\u003eelv.priv[1] = new_bfqq\n   -\u003e handle IO by bfqq3\n\nFix the problem by checking bfqq is from merge chain fist. And this\nmight fix a following problem reported by our syzkaller(unreproducible):\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\nBUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\nBUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\nWrite of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595\n\nCPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G             L     6.6.0-07439-gba2303cacfda #6\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\nWorkqueue: kblockd blk_mq_requeue_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:364 [inline]\n print_report+0x10d/0x610 mm/kasan/report.c:475\n kasan_report+0x8e/0xc0 mm/kasan/report.c:588\n bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\n bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\n bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\n bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757\n bfq_init_rq block/bfq-iosched.c:6876 [inline]\n bfq_insert_request block/bfq-iosched.c:6254 [inline]\n bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304\n blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593\n blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502\n process_one_work kernel/workqueue.c:2627 [inline]\n process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n kthread+0x33c/0x440 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n \u003c/TASK\u003e\n\nAllocated by task 20776:\n kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328\n kasan_slab_alloc include/linux/kasan.h:188 [inline]\n slab_post_alloc_hook mm/slab.h:763 [inline]\n slab_alloc_node mm/slub.c:3458 [inline]\n kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503\n ioc_create_icq block/blk-ioc.c:370 [inline]\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a5af87f-55cf-4310-bf54-c081c4bb427e",
      "id": "CVE-2024-49894",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in degamma hardware format translation\n\nFixes index out of bounds issue in\n`cm_helper_translate_curve_to_degamma_hw_format` function. The issue\ncould occur when the index 'i' exceeds the number of transfer function\npoints (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.red' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.green' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.blue' 1025 \u003c= s32max",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61bc81ea-3713-4330-9d82-f22b37d09c35",
      "id": "CVE-2024-49909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn32_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null, but then it was being\ndereferenced without any null check. This could lead to a null pointer\ndereference if set_output_gamma is null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19c91f38-c224-4a2a-abd3-c901af3391b9",
      "id": "CVE-2024-49921",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before used\n\n[WHAT \u0026 HOW]\nPoniters, such as dc-\u003eclk_mgr, are null checked previously in the same\nfunction, so Coverity warns \"implies that \"dc-\u003eclk_mgr\" might be null\".\nAs a result, these pointers need to be checked when used again.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "984af8dd-e582-48e0-bc40-cf899b2624ab",
      "id": "CVE-2024-49933",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk_iocost: fix more out of bound shifts\n\nRecently running UBSAN caught few out of bound shifts in the\nioc_forgive_debts() function:\n\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nCall Trace:\n\u003cIRQ\u003e\ndump_stack_lvl+0xca/0x130\n__ubsan_handle_shift_out_of_bounds+0x22c/0x280\n? __lock_acquire+0x6441/0x7c10\nioc_timer_fn+0x6cec/0x7750\n? blk_iocost_init+0x720/0x720\n? call_timer_fn+0x5d/0x470\ncall_timer_fn+0xfa/0x470\n? blk_iocost_init+0x720/0x720\n__run_timer_base+0x519/0x700\n...\n\nActual impact of this issue was not identified but I propose to fix the\nundefined behaviour.\nThe proposed fix to prevent those out of bound shifts consist of\nprecalculating exponent before using it the shift operations by taking\nmin value from the actual exponent and maximum possible number of bits.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35080ff8-29c7-4f97-b335-9dfe4353e504",
      "id": "CVE-2025-37741",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Prevent copying of nlink with value 0 from disk inode\n\nsyzbot report a deadlock in diFree. [1]\n\nWhen calling \"ioctl$LOOP_SET_STATUS64\", the offset value passed in is 4,\nwhich does not match the mounted loop device, causing the mapping of the\nmounted loop device to be invalidated.\n\nWhen creating the directory and creating the inode of iag in diReadSpecial(),\nread the page of fixed disk inode (AIT) in raw mode in read_metapage(), the\nmetapage data it returns is corrupted, which causes the nlink value of 0 to be\nassigned to the iag inode when executing copy_from_dinode(), which ultimately\ncauses a deadlock when entering diFree().\n\nTo avoid this, first check the nlink value of dinode before setting iag inode.\n\n[1]\nWARNING: possible recursive locking detected\n6.12.0-rc7-syzkaller-00212-g4a5df3796467 #0 Not tainted\n--------------------------------------------\nsyz-executor301/5309 is trying to acquire lock:\nffff888044548920 (\u0026(imap-\u003eim_aglock[index])){+.+.}-{3:3}, at: diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889\n\nbut task is already holding lock:\nffff888044548920 (\u0026(imap-\u003eim_aglock[index])){+.+.}-{3:3}, at: diAlloc+0x1b6/0x1630\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(\u0026(imap-\u003eim_aglock[index]));\n  lock(\u0026(imap-\u003eim_aglock[index]));\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n5 locks held by syz-executor301/5309:\n #0: ffff8880422a4420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515\n #1: ffff88804755b390 (\u0026type-\u003ei_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:850 [inline]\n #1: ffff88804755b390 (\u0026type-\u003ei_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:4026\n #2: ffff888044548920 (\u0026(imap-\u003eim_aglock[index])){+.+.}-{3:3}, at: diAlloc+0x1b6/0x1630\n #3: ffff888044548890 (\u0026imap-\u003eim_freelock){+.+.}-{3:3}, at: diNewIAG fs/jfs/jfs_imap.c:2460 [inline]\n #3: ffff888044548890 (\u0026imap-\u003eim_freelock){+.+.}-{3:3}, at: diAllocExt fs/jfs/jfs_imap.c:1905 [inline]\n #3: ffff888044548890 (\u0026imap-\u003eim_freelock){+.+.}-{3:3}, at: diAllocAG+0x4b7/0x1e50 fs/jfs/jfs_imap.c:1669\n #4: ffff88804755a618 (\u0026jfs_ip-\u003erdwrlock/1){++++}-{3:3}, at: diNewIAG fs/jfs/jfs_imap.c:2477 [inline]\n #4: ffff88804755a618 (\u0026jfs_ip-\u003erdwrlock/1){++++}-{3:3}, at: diAllocExt fs/jfs/jfs_imap.c:1905 [inline]\n #4: ffff88804755a618 (\u0026jfs_ip-\u003erdwrlock/1){++++}-{3:3}, at: diAllocAG+0x869/0x1e50 fs/jfs/jfs_imap.c:1669\n\nstack backtrace:\nCPU: 0 UID: 0 PID: 5309 Comm: syz-executor301 Not tainted 6.12.0-rc7-syzkaller-00212-g4a5df3796467 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037\n check_deadlock kernel/locking/lockdep.c:3089 [inline]\n validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891\n __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202\n lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825\n __mutex_lock_common kernel/locking/mutex.c:608 [inline]\n __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752\n diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889\n jfs_evict_inode+0x32d/0x440 fs/jfs/inode.c:156\n evict+0x4e8/0x9b0 fs/inode.c:725\n diFreeSpecial fs/jfs/jfs_imap.c:552 [inline]\n duplicateIXtree+0x3c6/0x550 fs/jfs/jfs_imap.c:3022\n diNewIAG fs/jfs/jfs_imap.c:2597 [inline]\n diAllocExt fs/jfs/jfs_imap.c:1905 [inline]\n diAllocAG+0x17dc/0x1e50 fs/jfs/jfs_imap.c:1669\n diAlloc+0x1d2/0x1630 fs/jfs/jfs_imap.c:1590\n ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56\n jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225\n vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257\n do_mkdirat+0x264/0x3a0 fs/namei.c:4280\n __do_sys_mkdirat fs/namei.c:4295 [inline]\n __se_sys_mkdirat fs/namei.c:4293 [inline]\n __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293\n do_syscall_x64 arch/x86/en\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1db133c-fc58-4279-81d4-1f4b78cb106f",
      "id": "CVE-2024-49960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix timer use-after-free on failed mount\n\nSyzbot has found an ODEBUG bug in ext4_fill_super\n\nThe del_timer_sync function cancels the s_err_report timer,\nwhich reminds about filesystem errors daily. We should\nguarantee the timer is no longer active before kfree(sbi).\n\nWhen filesystem mounting fails, the flow goes to failed_mount3,\nwhere an error occurs when ext4_stop_mmpd is called, causing\na read I/O failure. This triggers the ext4_handle_error function\nthat ultimately re-arms the timer,\nleaving the s_err_report timer active before kfree(sbi) is called.\n\nFix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db3d148e-1bd9-4abe-b383-367f50cbc1cf",
      "id": "CVE-2024-49981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free bug in venus_remove due to race condition\n\nin venus_probe, core-\u003ework is bound with venus_sys_error_handler, which is\nused to handle error. The code use core-\u003esys_err_done to make sync work.\nThe core-\u003ework is started in venus_event_notify.\n\nIf we call venus_remove, there might be an unfished work. The possible\nsequence is as follows:\n\nCPU0                  CPU1\n\n                     |venus_sys_error_handler\nvenus_remove         |\nhfi_destroy\t \t\t |\nvenus_hfi_destroy\t |\nkfree(hdev);\t     |\n                     |hfi_reinit\n\t\t\t\t\t |venus_hfi_queues_reinit\n                     |//use hdev\n\nFix it by canceling the work in venus_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "05f21c0e-7f8f-486a-b752-fbd0d294b5d7",
      "id": "CVE-2024-50012",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: Avoid a bad reference count on CPU node\n\nIn the parse_perf_domain function, if the call to\nof_parse_phandle_with_args returns an error, then the reference to the\nCPU device node that was acquired at the start of the function would not\nbe properly decremented.\n\nAddress this by declaring the variable with the __free(device_node)\ncleanup attribute.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd1c8365-b408-47d9-bf44-a965707b5628",
      "id": "CVE-2024-53112",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: uncache inode which has failed entering the group\n\nSyzbot has reported the following BUG:\n\nkernel BUG at fs/ocfs2/uptodate.c:509!\n...\nCall Trace:\n \u003cTASK\u003e\n ? __die_body+0x5f/0xb0\n ? die+0x9e/0xc0\n ? do_trap+0x15a/0x3a0\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ? do_error_trap+0x1dc/0x2c0\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ? __pfx_do_error_trap+0x10/0x10\n ? handle_invalid_op+0x34/0x40\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ? exc_invalid_op+0x38/0x50\n ? asm_exc_invalid_op+0x1a/0x20\n ? ocfs2_set_new_buffer_uptodate+0x2e/0x160\n ? ocfs2_set_new_buffer_uptodate+0x144/0x160\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ocfs2_group_add+0x39f/0x15a0\n ? __pfx_ocfs2_group_add+0x10/0x10\n ? __pfx_lock_acquire+0x10/0x10\n ? mnt_get_write_access+0x68/0x2b0\n ? __pfx_lock_release+0x10/0x10\n ? rcu_read_lock_any_held+0xb7/0x160\n ? __pfx_rcu_read_lock_any_held+0x10/0x10\n ? smack_log+0x123/0x540\n ? mnt_get_write_access+0x68/0x2b0\n ? mnt_get_write_access+0x68/0x2b0\n ? mnt_get_write_access+0x226/0x2b0\n ocfs2_ioctl+0x65e/0x7d0\n ? __pfx_ocfs2_ioctl+0x10/0x10\n ? smack_file_ioctl+0x29e/0x3a0\n ? __pfx_smack_file_ioctl+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? __pfx_ocfs2_ioctl+0x10/0x10\n __se_sys_ioctl+0xfb/0x170\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n \u003c/TASK\u003e\n\nWhen 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular\ninode in 'ocfs2_verify_group_and_input()', corresponding buffer head\nremains cached and subsequent call to the same 'ioctl()' for the same\ninode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying\nto cache the same buffer head of that inode). Fix this by uncaching\nthe buffer head with 'ocfs2_remove_from_cache()' on error path in\n'ocfs2_group_add()'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d5a82f4-e324-450b-9950-67374997a507",
      "id": "CVE-2024-53172",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: fastmap: Fix duplicate slab cache names while attaching\n\nSince commit 4c39529663b9 (\"slab: Warn on duplicate cache names when\nDEBUG_VM=y\"), the duplicate slab cache names can be detected and a\nkernel WARNING is thrown out.\nIn UBI fast attaching process, alloc_ai() could be invoked twice\nwith the same slab cache name 'ubi_aeb_slab_cache', which will trigger\nfollowing warning messages:\n kmem_cache of name 'ubi_aeb_slab_cache' already exists\n WARNING: CPU: 0 PID: 7519 at mm/slab_common.c:107\n          __kmem_cache_create_args+0x100/0x5f0\n Modules linked in: ubi(+) nandsim [last unloaded: nandsim]\n CPU: 0 UID: 0 PID: 7519 Comm: modprobe Tainted: G 6.12.0-rc2\n RIP: 0010:__kmem_cache_create_args+0x100/0x5f0\n Call Trace:\n   __kmem_cache_create_args+0x100/0x5f0\n   alloc_ai+0x295/0x3f0 [ubi]\n   ubi_attach+0x3c3/0xcc0 [ubi]\n   ubi_attach_mtd_dev+0x17cf/0x3fa0 [ubi]\n   ubi_init+0x3fb/0x800 [ubi]\n   do_init_module+0x265/0x7d0\n   __x64_sys_finit_module+0x7a/0xc0\n\nThe problem could be easily reproduced by loading UBI device by fastmap\nwith CONFIG_DEBUG_VM=y.\nFix it by using different slab names for alloc_ai() callers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f99dafed-d2cb-4056-83e6-67d6d5251b27",
      "id": "CVE-2024-56544",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: change folios array from kmalloc to kvmalloc\n\nWhen PAGE_SIZE 4096, MAX_PAGE_ORDER 10, 64bit machine,\npage_alloc only support 4MB.\nIf above this, trigger this warn and return NULL.\n\nudmabuf can change size limit, if change it to 3072(3GB), and then alloc\n3GB udmabuf, will fail create.\n\n[ 4080.876581] ------------[ cut here ]------------\n[ 4080.876843] WARNING: CPU: 3 PID: 2015 at mm/page_alloc.c:4556 __alloc_pages+0x2c8/0x350\n[ 4080.878839] RIP: 0010:__alloc_pages+0x2c8/0x350\n[ 4080.879470] Call Trace:\n[ 4080.879473]  \u003cTASK\u003e\n[ 4080.879473]  ? __alloc_pages+0x2c8/0x350\n[ 4080.879475]  ? __warn.cold+0x8e/0xe8\n[ 4080.880647]  ? __alloc_pages+0x2c8/0x350\n[ 4080.880909]  ? report_bug+0xff/0x140\n[ 4080.881175]  ? handle_bug+0x3c/0x80\n[ 4080.881556]  ? exc_invalid_op+0x17/0x70\n[ 4080.881559]  ? asm_exc_invalid_op+0x1a/0x20\n[ 4080.882077]  ? udmabuf_create+0x131/0x400\n\nBecause MAX_PAGE_ORDER, kmalloc can max alloc 4096 * (1 \u003c\u003c 10), 4MB\nmemory, each array entry is pointer(8byte), so can save 524288 pages(2GB).\n\nFurther more, costly order(order 3) may not be guaranteed that it can be\napplied for, due to fragmentation.\n\nThis patch change udmabuf array use kvmalloc_array, this can fallback\nalloc into vmalloc, which can guarantee allocation for any size and does\nnot affect the performance of kmalloc allocations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bf1f0ea-307e-451a-8b1c-3c7ace0aec17",
      "id": "CVE-2024-56642",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free of kernel socket in cleanup_bearer().\n\nsyzkaller reported a use-after-free of UDP kernel socket\nin cleanup_bearer() without repro. [0][1]\n\nWhen bearer_disable() calls tipc_udp_disable(), cleanup\nof the UDP kernel socket is deferred by work calling\ncleanup_bearer().\n\ntipc_exit_net() waits for such works to finish by checking\ntipc_net(net)-\u003ewq_count.  However, the work decrements the\ncount too early before releasing the kernel socket,\nunblocking cleanup_net() and resulting in use-after-free.\n\nLet's move the decrement after releasing the socket in\ncleanup_bearer().\n\n[0]:\nref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at\n     sk_alloc+0x438/0x608\n     inet_create+0x4c8/0xcb0\n     __sock_create+0x350/0x6b8\n     sock_create_kern+0x58/0x78\n     udp_sock_create4+0x68/0x398\n     udp_sock_create+0x88/0xc8\n     tipc_udp_enable+0x5e8/0x848\n     __tipc_nl_bearer_enable+0x84c/0xed8\n     tipc_nl_bearer_enable+0x38/0x60\n     genl_family_rcv_msg_doit+0x170/0x248\n     genl_rcv_msg+0x400/0x5b0\n     netlink_rcv_skb+0x1dc/0x398\n     genl_rcv+0x44/0x68\n     netlink_unicast+0x678/0x8b0\n     netlink_sendmsg+0x5e4/0x898\n     ____sys_sendmsg+0x500/0x830\n\n[1]:\nBUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline]\nBUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979\n udp_hashslot include/net/udp.h:85 [inline]\n udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979\n sk_common_release+0xaf/0x3f0 net/core/sock.c:3820\n inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437\n inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489\n __sock_release net/socket.c:658 [inline]\n sock_release+0xa0/0x210 net/socket.c:686\n cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310\n worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391\n kthread+0x531/0x6b0 kernel/kthread.c:389\n ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244\n\nUninit was created at:\n slab_free_hook mm/slub.c:2269 [inline]\n slab_free mm/slub.c:4580 [inline]\n kmem_cache_free+0x207/0xc40 mm/slub.c:4682\n net_free net/core/net_namespace.c:454 [inline]\n cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310\n worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391\n kthread+0x531/0x6b0 kernel/kthread.c:389\n ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244\n\nCPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: events cleanup_bearer",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8efca64-fb27-4117-9edb-0f3ee7a3e48d",
      "id": "CVE-2024-57850",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: Prevent rtime decompress memory corruption\n\nThe rtime decompression routine does not fully check bounds during the\nentirety of the decompression pass and can corrupt memory outside the\ndecompression buffer if the compressed data is corrupted. This adds the\nrequired check to prevent this failure mode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0f3f7cb-a16f-4fcc-83e6-6af32dcca20f",
      "id": "CVE-2024-57912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: zpa2326: fix information leak in triggered buffer\n\nThe 'sample' local struct is used to push data to user space from a\ntriggered buffer, but it has a hole between the temperature and the\ntimestamp (u32 pressure, u16 temperature, GAP, u64 timestamp).\nThis hole is never initialized.\n\nInitialize the struct to zero before using it to avoid pushing\nuninitialized information to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40dfee12-44d1-4240-9ec4-ac199c8b20e1",
      "id": "CVE-2025-21821",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap: use threaded IRQ for LCD DMA\n\nWhen using touchscreen and framebuffer, Nokia 770 crashes easily with:\n\n    BUG: scheduling while atomic: irq/144-ads7846/82/0x00010000\n    Modules linked in: usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs omap_udc ohci_omap ohci_hcd\n    CPU: 0 UID: 0 PID: 82 Comm: irq/144-ads7846 Not tainted 6.12.7-770 #2\n    Hardware name: Nokia 770\n    Call trace:\n     unwind_backtrace from show_stack+0x10/0x14\n     show_stack from dump_stack_lvl+0x54/0x5c\n     dump_stack_lvl from __schedule_bug+0x50/0x70\n     __schedule_bug from __schedule+0x4d4/0x5bc\n     __schedule from schedule+0x34/0xa0\n     schedule from schedule_preempt_disabled+0xc/0x10\n     schedule_preempt_disabled from __mutex_lock.constprop.0+0x218/0x3b4\n     __mutex_lock.constprop.0 from clk_prepare_lock+0x38/0xe4\n     clk_prepare_lock from clk_set_rate+0x18/0x154\n     clk_set_rate from sossi_read_data+0x4c/0x168\n     sossi_read_data from hwa742_read_reg+0x5c/0x8c\n     hwa742_read_reg from send_frame_handler+0xfc/0x300\n     send_frame_handler from process_pending_requests+0x74/0xd0\n     process_pending_requests from lcd_dma_irq_handler+0x50/0x74\n     lcd_dma_irq_handler from __handle_irq_event_percpu+0x44/0x130\n     __handle_irq_event_percpu from handle_irq_event+0x28/0x68\n     handle_irq_event from handle_level_irq+0x9c/0x170\n     handle_level_irq from generic_handle_domain_irq+0x2c/0x3c\n     generic_handle_domain_irq from omap1_handle_irq+0x40/0x8c\n     omap1_handle_irq from generic_handle_arch_irq+0x28/0x3c\n     generic_handle_arch_irq from call_with_stack+0x1c/0x24\n     call_with_stack from __irq_svc+0x94/0xa8\n    Exception stack(0xc5255da0 to 0xc5255de8)\n    5da0: 00000001 c22fc620 00000000 00000000 c08384a8 c106fc00 00000000 c240c248\n    5dc0: c113a600 c3f6ec30 00000001 00000000 c22fc620 c5255df0 c22fc620 c0279a94\n    5de0: 60000013 ffffffff\n     __irq_svc from clk_prepare_lock+0x4c/0xe4\n     clk_prepare_lock from clk_get_rate+0x10/0x74\n     clk_get_rate from uwire_setup_transfer+0x40/0x180\n     uwire_setup_transfer from spi_bitbang_transfer_one+0x2c/0x9c\n     spi_bitbang_transfer_one from spi_transfer_one_message+0x2d0/0x664\n     spi_transfer_one_message from __spi_pump_transfer_message+0x29c/0x498\n     __spi_pump_transfer_message from __spi_sync+0x1f8/0x2e8\n     __spi_sync from spi_sync+0x24/0x40\n     spi_sync from ads7846_halfd_read_state+0x5c/0x1c0\n     ads7846_halfd_read_state from ads7846_irq+0x58/0x348\n     ads7846_irq from irq_thread_fn+0x1c/0x78\n     irq_thread_fn from irq_thread+0x120/0x228\n     irq_thread from kthread+0xc8/0xe8\n     kthread from ret_from_fork+0x14/0x28\n\nAs a quick fix, switch to a threaded IRQ which provides a stable system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b9e99e9-677e-4728-8e00-7ad99e849c3f",
      "id": "CVE-2025-22104",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Use kernel helpers for hex dumps\n\nPreviously, when the driver was printing hex dumps, the buffer was cast\nto an 8 byte long and printed using string formatters. If the buffer\nsize was not a multiple of 8 then a read buffer overflow was possible.\n\nTherefore, create a new ibmvnic function that loops over a buffer and\ncalls hex_dump_to_buffer instead.\n\nThis patch address KASAN reports like the one below:\n  ibmvnic 30000003 env3: Login Buffer:\n  ibmvnic 30000003 env3: 01000000af000000\n  \u003c...\u003e\n  ibmvnic 30000003 env3: 2e6d62692e736261\n  ibmvnic 30000003 env3: 65050003006d6f63\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic]\n  Read of size 8 at addr c0000001331a9aa8 by task ip/17681\n  \u003c...\u003e\n  Allocated by task 17681:\n  \u003c...\u003e\n  ibmvnic_login+0x2f0/0xffc [ibmvnic]\n  ibmvnic_open+0x148/0x308 [ibmvnic]\n  __dev_open+0x1ac/0x304\n  \u003c...\u003e\n  The buggy address is located 168 bytes inside of\n                allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf)\n  \u003c...\u003e\n  =================================================================\n  ibmvnic 30000003 env3: 000000000033766e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5f5b7ad-aec2-49b2-98a1-4db2a5cb6295",
      "id": "CVE-2025-37913",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: qfq: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of qfq, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nThis patch checks whether the class was already added to the agg-\u003eactive\nlist (cl_is_active) before doing the addition to cater for the reentrant\ncase.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3b0e3dd-af3c-45c2-a33f-73e14e0d65ee",
      "id": "CVE-2025-38095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: insert memory barrier before updating num_fences\n\nsmp_store_mb() inserts memory barrier after storing operation.\nIt is different with what the comment is originally aiming so Null\npointer dereference can be happened if memory update is reordered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27b8f57c-acbd-412b-b023-06cf469aa898",
      "id": "CVE-2025-38189",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`\n\nThe following kernel Oops was recently reported by Mesa CI:\n\n[  800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588\n[  800.148619] Mem abort info:\n[  800.151402]   ESR = 0x0000000096000005\n[  800.155141]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  800.160444]   SET = 0, FnV = 0\n[  800.163488]   EA = 0, S1PTW = 0\n[  800.166619]   FSC = 0x05: level 1 translation fault\n[  800.171487] Data abort info:\n[  800.174357]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[  800.179832]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[  800.184873]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[  800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000\n[  800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[  800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n[  800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight\n[  800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1  Debian 1:6.12.25-1+rpt1\n[  800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n[  800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d]\n[  800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d]\n[  800.267251] sp : ffffffc080003e60\n[  800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000\n[  800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020\n[  800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158\n[  800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000\n[  800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000\n[  800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c\n[  800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0\n[  800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980\n[  800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382\n[  800.341859] Call trace:\n[  800.344294]  v3d_job_update_stats+0x60/0x130 [v3d]\n[  800.349086]  v3d_irq+0x124/0x2e0 [v3d]\n[  800.352835]  __handle_irq_event_percpu+0x58/0x218\n[  800.357539]  handle_irq_event+0x54/0xb8\n[  800.361369]  handle_fasteoi_irq+0xac/0x240\n[  800.365458]  handle_irq_desc+0x48/0x68\n[  800.369200]  generic_handle_domain_irq+0x24/0x38\n[  800.373810]  gic_handle_irq+0x48/0xd8\n[  800.377464]  call_on_irq_stack+0x24/0x58\n[  800.381379]  do_interrupt_handler+0x88/0x98\n[  800.385554]  el1_interrupt+0x34/0x68\n[  800.389123]  el1h_64_irq_handler+0x18/0x28\n[  800.393211]  el1h_64_irq+0x64/0x68\n[  800.396603]  default_idle_call+0x3c/0x168\n[  800.400606]  do_idle+0x1fc/0x230\n[  800.403827]  cpu_startup_entry+0x40/0x50\n[  800.407742]  rest_init+0xe4/0xf0\n[  800.410962]  start_kernel+0x5e8/0x790\n[  800.414616]  __primary_switched+0x80/0x90\n[  800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1)\n[  800.424707] ---[ end trace 0000000000000000 ]---\n[  800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---\n\nThis issue happens when the file descriptor is closed before the jobs\nsubmitted by it are completed. When the job completes, we update the\nglobal GPU stats and the per-fd GPU stats, which are exposed through\nfdinfo. If the file descriptor was closed, then the struct `v3d_file_priv`\nand its stats were already freed and we can't update the per-fd stats.\n\nTherefore, if the file descriptor was already closed, don't u\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "574fc9f3-960d-4d6b-b0e8-eaebca16773b",
      "id": "CVE-2025-38410",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix a fence leak in submit error path\n\nIn error paths, we could unref the submit without calling\ndrm_sched_entity_push_job(), so msm_job_free() will never get\ncalled.  Since drm_sched_job_cleanup() will NULL out the\ns_fence, we can use that to detect this case.\n\nPatchwork: https://patchwork.freedesktop.org/patch/653584/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3781159f-e160-4fb9-983b-1b8f940fb28c",
      "id": "CVE-2025-39684",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()\n\nsyzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`.  A kernel\nbuffer is allocated to hold `insn-\u003en` samples (each of which is an\n`unsigned int`).  For some instruction types, `insn-\u003en` samples are\ncopied back to user-space, unless an error code is being returned.  The\nproblem is that not all the instruction handlers that need to return\ndata to userspace fill in the whole `insn-\u003en` samples, so that there is\nan information leak.  There is a similar syzbot report for\n`do_insnlist_ioctl()`, although it does not have a reproducer for it at\nthe time of writing.\n\nOne culprit is `insn_rw_emulate_bits()` which is used as the handler for\n`INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have\na specific handler for that instruction, but do have an `INSN_BITS`\nhandler.  For `INSN_READ` it only fills in at most 1 sample, so if\n`insn-\u003en` is greater than 1, the remaining `insn-\u003en - 1` samples copied\nto userspace will be uninitialized kernel data.\n\nAnother culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver.  It\nnever returns an error, even if it fails to fill the buffer.\n\nFix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure\nthat uninitialized parts of the allocated buffer are zeroed before\nhandling each instruction.\n\nThanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`.  That fix\nreplaced the call to `kmalloc_array()` with `kcalloc()`, but it is not\nalways necessary to clear the whole buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eff8c563-5cf7-4569-9289-a15c3240a209",
      "id": "CVE-2025-39833",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: hfcpci: Fix warning when deleting uninitialized timer\n\nWith CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads\nto the following splat:\n\n[  250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0\n[  250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0\n[  250.218775] Modules linked in: hfcpci(-) mISDN_core\n[  250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary)\n[  250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0\n[  250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d\n[  250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286\n[  250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95\n[  250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0\n[  250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39\n[  250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001\n[  250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8\n[  250.232454] FS:  00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000\n[  250.233851] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0\n[  250.236117] Call Trace:\n[  250.236599]  \u003cTASK\u003e\n[  250.236967]  ? trace_irq_enable.constprop.0+0xd4/0x130\n[  250.237920]  debug_object_assert_init+0x1f6/0x310\n[  250.238762]  ? __pfx_debug_object_assert_init+0x10/0x10\n[  250.239658]  ? __lock_acquire+0xdea/0x1c70\n[  250.240369]  __try_to_del_timer_sync+0x69/0x140\n[  250.241172]  ? __pfx___try_to_del_timer_sync+0x10/0x10\n[  250.242058]  ? __timer_delete_sync+0xc6/0x120\n[  250.242842]  ? lock_acquire+0x30/0x80\n[  250.243474]  ? __timer_delete_sync+0xc6/0x120\n[  250.244262]  __timer_delete_sync+0x98/0x120\n[  250.245015]  HFC_cleanup+0x10/0x20 [hfcpci]\n[  250.245704]  __do_sys_delete_module+0x348/0x510\n[  250.246461]  ? __pfx___do_sys_delete_module+0x10/0x10\n[  250.247338]  do_syscall_64+0xc1/0x360\n[  250.247924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by initializing hfc_tl timer with DEFINE_TIMER macro.\nAlso, use mod_timer instead of manual timeout update.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f71ad87-ab5a-4c22-af70-74a63787a1f3",
      "id": "CVE-2022-49319",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0722b018-ac12-433f-8213-bf5733a70baf",
      "id": "CVE-2010-4563",
      "description": "The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d168e2b-85f8-4a6a-acfb-34325be35b0d",
      "id": "CVE-2020-25669",
      "description": "A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d705842-9cac-4a00-9b57-5f1842656849",
      "id": "CVE-2021-22600",
      "description": "A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb5cd6e2-1110-47b2-ab92-4a0226566027",
      "id": "CVE-2021-32078",
      "description": "An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e5332585-aa49-443b-b9f2-79733db6703f",
      "id": "CVE-2021-3732",
      "description": "A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06d36955-7640-4018-9f28-f83a11760d09",
      "id": "CVE-2021-4149",
      "description": "A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e00e318-f5a4-4968-8c8a-567f12236c48",
      "id": "CVE-2021-4155",
      "description": "A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3cc76a4a-8681-4efe-bbbb-069756ea822a",
      "id": "CVE-2021-46988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: release page in error path to avoid BUG_ON\n\nConsider the following sequence of events:\n\n1. Userspace issues a UFFD ioctl, which ends up calling into\n   shmem_mfill_atomic_pte(). We successfully account the blocks, we\n   shmem_alloc_page(), but then the copy_from_user() fails. We return\n   -ENOENT. We don't release the page we allocated.\n2. Our caller detects this error code, tries the copy_from_user() after\n   dropping the mmap_lock, and retries, calling back into\n   shmem_mfill_atomic_pte().\n3. Meanwhile, let's say another process filled up the tmpfs being used.\n4. So shmem_mfill_atomic_pte() fails to account blocks this time, and\n   immediately returns - without releasing the page.\n\nThis triggers a BUG_ON in our caller, which asserts that the page\nshould always be consumed, unless -ENOENT is returned.\n\nTo fix this, detect if we have such a \"dangling\" page when accounting\nfails, and if so, release it before returning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "04bb4fe2-94c1-413a-b10e-0fea13900608",
      "id": "CVE-2021-47020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: stream: fix memory leak in stream config error path\n\nWhen stream config is failed, master runtime will release all\nslave runtime in the slave_rt_list, but slave runtime is not\nadded to the list at this time. This patch frees slave runtime\nin the config error path to fix the memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4a7511cd-3902-4338-91a7-4ac0bfb43049",
      "id": "CVE-2021-47034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: Fix pte update for kernel memory on radix\n\nWhen adding a PTE a ptesync is needed to order the update of the PTE\nwith subsequent accesses otherwise a spurious fault may be raised.\n\nradix__set_pte_at() does not do this for performance gains. For\nnon-kernel memory this is not an issue as any faults of this kind are\ncorrected by the page fault handler. For kernel memory these faults\nare not handled. The current solution is that there is a ptesync in\nflush_cache_vmap() which should be called when mapping from the\nvmalloc region.\n\nHowever, map_kernel_page() does not call flush_cache_vmap(). This is\ntroublesome in particular for code patching with Strict RWX on radix.\nIn do_patch_instruction() the page frame that contains the instruction\nto be patched is mapped and then immediately patched. With no ordering\nor synchronization between setting up the PTE and writing to the page\nit is possible for faults.\n\nAs the code patching is done using __put_user_asm_goto() the resulting\nfault is obscured - but using a normal store instead it can be seen:\n\n  BUG: Unable to handle kernel data access on write at 0xc008000008f24a3c\n  Faulting instruction address: 0xc00000000008bd74\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV\n  Modules linked in: nop_module(PO+) [last unloaded: nop_module]\n  CPU: 4 PID: 757 Comm: sh Tainted: P           O      5.10.0-rc5-01361-ge3c1b78c8440-dirty #43\n  NIP:  c00000000008bd74 LR: c00000000008bd50 CTR: c000000000025810\n  REGS: c000000016f634a0 TRAP: 0300   Tainted: P           O       (5.10.0-rc5-01361-ge3c1b78c8440-dirty)\n  MSR:  9000000000009033 \u003cSF,HV,EE,ME,IR,DR,RI,LE\u003e  CR: 44002884  XER: 00000000\n  CFAR: c00000000007c68c DAR: c008000008f24a3c DSISR: 42000000 IRQMASK: 1\n\nThis results in the kind of issue reported here:\n  https://lore.kernel.org/linuxppc-dev/15AC5B0E-A221-4B8C-9039-FA96B8EF7C88@lca.pw/\n\nChris Riedl suggested a reliable way to reproduce the issue:\n  $ mount -t debugfs none /sys/kernel/debug\n  $ (while true; do echo function \u003e /sys/kernel/debug/tracing/current_tracer ; echo nop \u003e /sys/kernel/debug/tracing/current_tracer ; done) \u0026\n\nTurning ftrace on and off does a large amount of code patching which\nin usually less then 5min will crash giving a trace like:\n\n   ftrace-powerpc: (____ptrval____): replaced (4b473b11) != old (60000000)\n   ------------[ ftrace bug ]------------\n   ftrace failed to modify\n   [\u003cc000000000bf8e5c\u003e] napi_busy_loop+0xc/0x390\n    actual:   11:3b:47:4b\n   Setting ftrace call site to call ftrace function\n   ftrace record flags: 80000001\n    (1)\n    expected tramp: c00000000006c96c\n   ------------[ cut here ]------------\n   WARNING: CPU: 4 PID: 809 at kernel/trace/ftrace.c:2065 ftrace_bug+0x28c/0x2e8\n   Modules linked in: nop_module(PO-) [last unloaded: nop_module]\n   CPU: 4 PID: 809 Comm: sh Tainted: P           O      5.10.0-rc5-01360-gf878ccaf250a #1\n   NIP:  c00000000024f334 LR: c00000000024f330 CTR: c0000000001a5af0\n   REGS: c000000004c8b760 TRAP: 0700   Tainted: P           O       (5.10.0-rc5-01360-gf878ccaf250a)\n   MSR:  900000000282b033 \u003cSF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 28008848  XER: 20040000\n   CFAR: c0000000001a9c98 IRQMASK: 0\n   GPR00: c00000000024f330 c000000004c8b9f0 c000000002770600 0000000000000022\n   GPR04: 00000000ffff7fff c000000004c8b6d0 0000000000000027 c0000007fe9bcdd8\n   GPR08: 0000000000000023 ffffffffffffffd8 0000000000000027 c000000002613118\n   GPR12: 0000000000008000 c0000007fffdca00 0000000000000000 0000000000000000\n   GPR16: 0000000023ec37c5 0000000000000000 0000000000000000 0000000000000008\n   GPR20: c000000004c8bc90 c0000000027a2d20 c000000004c8bcd0 c000000002612fe8\n   GPR24: 0000000000000038 0000000000000030 0000000000000028 0000000000000020\n   GPR28: c000000000ff1b68 c000000000bf8e5c c00000000312f700 c000000000fbb9b0\n   NIP ftrace_bug+0x28c/0x2e8\n   LR  ftrace_bug+0x288/0x2e8\n   Call T\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0b3310b-60c3-460f-a957-fa847b3d03fb",
      "id": "CVE-2021-47143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: remove device from smcd_dev_list after failed device_add()\n\nIf the device_add() for a smcd_dev fails, there's no cleanup step that\nrolls back the earlier list_add(). The device subsequently gets freed,\nand we end up with a corrupted list.\n\nAdd some error handling that removes the device from the list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02bfc913-2380-48fc-9966-adde54813f75",
      "id": "CVE-2021-47163",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: wait and exit until all work queues are done\n\nOn some host, a crash could be triggered simply by repeating these\ncommands several times:\n\n  # modprobe tipc\n  # tipc bearer enable media udp name UDP1 localip 127.0.0.1\n  # rmmod tipc\n\n  [] BUG: unable to handle kernel paging request at ffffffffc096bb00\n  [] Workqueue: events 0xffffffffc096bb00\n  [] Call Trace:\n  []  ? process_one_work+0x1a7/0x360\n  []  ? worker_thread+0x30/0x390\n  []  ? create_worker+0x1a0/0x1a0\n  []  ? kthread+0x116/0x130\n  []  ? kthread_flush_work_fn+0x10/0x10\n  []  ? ret_from_fork+0x35/0x40\n\nWhen removing the TIPC module, the UDP tunnel sock will be delayed to\nrelease in a work queue as sock_release() can't be done in rtnl_lock().\nIf the work queue is schedule to run after the TIPC module is removed,\nkernel will crash as the work queue function cleanup_beareri() code no\nlonger exists when trying to invoke it.\n\nTo fix it, this patch introduce a member wq_count in tipc_net to track\nthe numbers of work queues in schedule, and  wait and exit until all\nwork queues are done in tipc_exit_net().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de668207-9862-4d9f-bf82-811c005af713",
      "id": "CVE-2021-47248",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix race between close() and udp_abort()\n\nKaustubh reported and diagnosed a panic in udp_lib_lookup().\nThe root cause is udp_abort() racing with close(). Both\nracing functions acquire the socket lock, but udp{v6}_destroy_sock()\nrelease it before performing destructive actions.\n\nWe can't easily extend the socket lock scope to avoid the race,\ninstead use the SOCK_DEAD flag to prevent udp_abort from doing\nany action when the critical race happens.\n\nDiagnosed-and-tested-by: Kaustubh Pandey \u003ckapandey@codeaurora.org\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1768b93a-4aba-4135-9906-2e5809d3576d",
      "id": "CVE-2021-47261",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix initializing CQ fragments buffer\n\nThe function init_cq_frag_buf() can be called to initialize the current CQ\nfragments buffer cq-\u003ebuf, or the temporary cq-\u003eresize_buf that is filled\nduring CQ resize operation.\n\nHowever, the offending commit started to use function get_cqe() for\ngetting the CQEs, the issue with this change is that get_cqe() always\nreturns CQEs from cq-\u003ebuf, which leads us to initialize the wrong buffer,\nand in case of enlarging the CQ we try to access elements beyond the size\nof the current cq-\u003ebuf and eventually hit a kernel panic.\n\n [exception RIP: init_cq_frag_buf+103]\n  [ffff9f799ddcbcd8] mlx5_ib_resize_cq at ffffffffc0835d60 [mlx5_ib]\n  [ffff9f799ddcbdb0] ib_resize_cq at ffffffffc05270df [ib_core]\n  [ffff9f799ddcbdc0] llt_rdma_setup_qp at ffffffffc0a6a712 [llt]\n  [ffff9f799ddcbe10] llt_rdma_cc_event_action at ffffffffc0a6b411 [llt]\n  [ffff9f799ddcbe98] llt_rdma_client_conn_thread at ffffffffc0a6bb75 [llt]\n  [ffff9f799ddcbec8] kthread at ffffffffa66c5da1\n  [ffff9f799ddcbf50] ret_from_fork_nospec_begin at ffffffffa6d95ddd\n\nFix it by getting the needed CQE by calling mlx5_frag_buf_get_wqe() that\ntakes the correct source buffer as a parameter.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "985599ec-8921-465c-8b68-a8934701b3fa",
      "id": "CVE-2021-47393",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs\n\nFan speed minimum can be enforced from sysfs. For example, setting\ncurrent fan speed to 20 is used to enforce fan speed to be at 100%\nspeed, 19 - to be not below 90% speed, etcetera. This feature provides\nability to limit fan speed according to some system wise\nconsiderations, like absence of some replaceable units or high system\nambient temperature.\n\nRequest for changing fan minimum speed is configuration request and can\nbe set only through 'sysfs' write procedure. In this situation value of\nargument 'state' is above nominal fan speed maximum.\n\nReturn non-zero code in this case to avoid\nthermal_cooling_device_stats_update() call, because in this case\nstatistics update violates thermal statistics table range.\nThe issues is observed in case kernel is configured with option\nCONFIG_THERMAL_STATISTICS.\n\nHere is the trace from KASAN:\n[  159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0\n[  159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444\n[  159.545625] Call Trace:\n[  159.548366]  dump_stack+0x92/0xc1\n[  159.552084]  ? thermal_cooling_device_stats_update+0x7d/0xb0\n[  159.635869]  thermal_zone_device_update+0x345/0x780\n[  159.688711]  thermal_zone_device_set_mode+0x7d/0xc0\n[  159.694174]  mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core]\n[  159.700972]  ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core]\n[  159.731827]  mlxsw_thermal_init+0x763/0x880 [mlxsw_core]\n[  160.070233] RIP: 0033:0x7fd995909970\n[  160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ..\n[  160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[  160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970\n[  160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001\n[  160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700\n[  160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013\n[  160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013\n[  160.143671]\n[  160.145338] Allocated by task 2924:\n[  160.149242]  kasan_save_stack+0x19/0x40\n[  160.153541]  __kasan_kmalloc+0x7f/0xa0\n[  160.157743]  __kmalloc+0x1a2/0x2b0\n[  160.161552]  thermal_cooling_device_setup_sysfs+0xf9/0x1a0\n[  160.167687]  __thermal_cooling_device_register+0x1b5/0x500\n[  160.173833]  devm_thermal_of_cooling_device_register+0x60/0xa0\n[  160.180356]  mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan]\n[  160.248140]\n[  160.249807] The buggy address belongs to the object at ffff888116163400\n[  160.249807]  which belongs to the cache kmalloc-1k of size 1024\n[  160.263814] The buggy address is located 64 bytes to the right of\n[  160.263814]  1024-byte region [ffff888116163400, ffff888116163800)\n[  160.277536] The buggy address belongs to the page:\n[  160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160\n[  160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0\n[  160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)\n[  160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0\n[  160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000\n[  160.327033] page dumped because: kasan: bad access detected\n[  160.333270]\n[  160.334937] Memory state around the buggy address:\n[  160.356469] \u003effff888116163800: fc ..",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "64fc1e0a-c919-4e7e-90b3-75cd6d9547e5",
      "id": "CVE-2021-47602",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: track only QoS data frames for admission control\n\nFor admission control, obviously all of that only works for\nQoS data frames, otherwise we cannot even access the QoS\nfield in the header.\n\nSyzbot reported (see below) an uninitialized value here due\nto a status of a non-QoS nullfunc packet, which isn't even\nlong enough to contain the QoS header.\n\nFix this to only do anything for QoS data packets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b84e3895-3de6-406c-a404-b4b7b6f91bef",
      "id": "CVE-2022-50124",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b313770d-0798-453a-b57d-6027276cd2d8",
      "id": "CVE-2022-0264",
      "description": "A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions \u003c v5.16-rc6",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5de42b7d-29dd-4858-abe9-e5ecd4d1fc4f",
      "id": "CVE-2022-0480",
      "description": "A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12d0689b-46da-4fea-a4a9-d67fe5448580",
      "id": "CVE-2022-27950",
      "description": "In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f1ea13f-3b62-41c9-bdcf-89e7ea24fabc",
      "id": "CVE-2022-2961",
      "description": "A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "131122a0-5511-423a-87f2-1fa589f70f7f",
      "id": "CVE-2022-50160",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: maps: Fix refcount leak in ap_flash_init\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65d6ab09-1818-422d-8647-7b08d6de39b4",
      "id": "CVE-2022-3111",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c24ff14-fb66-48e1-8fce-1a636d00bd9a",
      "id": "CVE-2022-42720",
      "description": "Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65cb0bc3-a7f1-45ad-a664-a477c55892d9",
      "id": "CVE-2022-48822",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: f_fs: Fix use-after-free for epfile\n\nConsider a case where ffs_func_eps_disable is called from\nffs_func_disable as part of composition switch and at the\nsame time ffs_epfile_release get called from userspace.\nffs_epfile_release will free up the read buffer and call\nffs_data_closed which in turn destroys ffs-\u003eepfiles and\nmark it as NULL. While this was happening the driver has\nalready initialized the local epfile in ffs_func_eps_disable\nwhich is now freed and waiting to acquire the spinlock. Once\nspinlock is acquired the driver proceeds with the stale value\nof epfile and tries to free the already freed read buffer\ncausing use-after-free.\n\nFollowing is the illustration of the race:\n\n      CPU1                                  CPU2\n\n   ffs_func_eps_disable\n   epfiles (local copy)\n\t\t\t\t\tffs_epfile_release\n\t\t\t\t\tffs_data_closed\n\t\t\t\t\tif (last file closed)\n\t\t\t\t\tffs_data_reset\n\t\t\t\t\tffs_data_clear\n\t\t\t\t\tffs_epfiles_destroy\nspin_lock\ndereference epfiles\n\nFix this races by taking epfiles local copy \u0026 assigning it under\nspinlock and if epfiles(local) is null then update it in ffs-\u003eepfiles\nthen finally destroy it.\nExtending the scope further from the race, protecting the ep related\nstructures, and concurrent accesses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9eb509cb-9d82-44b6-b3f5-0e8259196890",
      "id": "CVE-2022-48857",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: port100: fix use-after-free in port100_send_complete\n\nSyzbot reported UAF in port100_send_complete(). The root case is in\nmissing usb_kill_urb() calls on error handling path of -\u003eprobe function.\n\nport100_send_complete() accesses devm allocated memory which will be\nfreed on probe failure. We should kill this urbs before returning an\nerror from probe function to prevent reported use-after-free\n\nFail log:\n\nBUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935\nRead of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26\n...\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935\n __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670\n\n...\n\nAllocated by task 1255:\n kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38\n kasan_set_track mm/kasan/common.c:45 [inline]\n set_alloc_info mm/kasan/common.c:436 [inline]\n ____kasan_kmalloc mm/kasan/common.c:515 [inline]\n ____kasan_kmalloc mm/kasan/common.c:474 [inline]\n __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524\n alloc_dr drivers/base/devres.c:116 [inline]\n devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823\n devm_kzalloc include/linux/device.h:209 [inline]\n port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502\n\nFreed by task 1255:\n kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38\n kasan_set_track+0x21/0x30 mm/kasan/common.c:45\n kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370\n ____kasan_slab_free mm/kasan/common.c:366 [inline]\n ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328\n kasan_slab_free include/linux/kasan.h:236 [inline]\n __cache_free mm/slab.c:3437 [inline]\n kfree+0xf8/0x2b0 mm/slab.c:3794\n release_nodes+0x112/0x1a0 drivers/base/devres.c:501\n devres_release_all+0x114/0x190 drivers/base/devres.c:530\n really_probe+0x626/0xcc0 drivers/base/dd.c:670",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4397c3c-1f81-4cfb-a823-02e25ae44c20",
      "id": "CVE-2023-53080",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Add missing overflow check in xdp_umem_reg\n\nThe number of chunks can overflow u32. Make sure to return -EINVAL on\noverflow. Also remove a redundant u32 cast assigning umem-\u003enpgs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c81e376-9e1f-4e7e-8458-eb172ee2f837",
      "id": "CVE-2022-48858",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix a race on command flush flow\n\nFix a refcount use after free warning due to a race on command entry.\nSuch race occurs when one of the commands releases its last refcount and\nfrees its index and entry while another process running command flush\nflow takes refcount to this command entry. The process which handles\ncommands flush may see this command as needed to be flushed if the other\nprocess released its refcount but didn't release the index yet. Fix it\nby adding the needed spin lock.\n\nIt fixes the following warning trace:\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0\n...\nRIP: 0010:refcount_warn_saturate+0x80/0xe0\n...\nCall Trace:\n \u003cTASK\u003e\n mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core]\n mlx5_cmd_flush+0x3a/0xf0 [mlx5_core]\n enter_error_state+0x44/0x80 [mlx5_core]\n mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core]\n process_one_work+0x1be/0x390\n worker_thread+0x4d/0x3d0\n ? rescuer_thread+0x350/0x350\n kthread+0x141/0x160\n ? set_kthread_struct+0x40/0x40\n ret_from_fork+0x1f/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55c135a6-5c1b-4338-a26d-9110c978cfce",
      "id": "CVE-2022-48945",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vivid: fix compose size exceed boundary\n\nsyzkaller found a bug:\n\n BUG: unable to handle page fault for address: ffffc9000a3b1000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0\n Oops: 0002 [#1] PREEMPT SMP\n CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n RIP: 0010:memcpy_erms+0x6/0x10\n[...]\n Call Trace:\n  \u003cTASK\u003e\n  ? tpg_fill_plane_buffer+0x856/0x15b0\n  vivid_fillbuff+0x8ac/0x1110\n  vivid_thread_vid_cap_tick+0x361/0xc90\n  vivid_thread_vid_cap+0x21a/0x3a0\n  kthread+0x143/0x180\n  ret_from_fork+0x1f/0x30\n  \u003c/TASK\u003e\n\nThis is because we forget to check boundary after adjust compose-\u003eheight\nint V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem\nfor this case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "70ee2784-c5d2-4a85-bfcf-0911987d35ce",
      "id": "CVE-2022-48973",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: amd8111: Fix PCI device reference count leak\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL\ninput parameter, there is no problem for the 'Device not found' branch.\nFor the normal path, add pci_dev_put() in amd_gpio_exit().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d4ad437-8383-4633-bb76-1c84f42a6a15",
      "id": "CVE-2022-48978",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix shift-out-of-bounds in hid_report_raw_event\n\nSyzbot reported shift-out-of-bounds in hid_report_raw_event.\n\nmicrosoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) \u003e\n32! (swapper/0)\n======================================================================\nUBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20\nshift exponent 127 is too large for 32-bit type 'int'\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted\n6.1.0-rc4-syzkaller-00159-g4bbf3422df78 #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS\nGoogle 10/26/2022\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_shift_out_of_bounds+0x3a6/0x420 lib/ubsan.c:322\n snto32 drivers/hid/hid-core.c:1323 [inline]\n hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline]\n hid_process_report drivers/hid/hid-core.c:1665 [inline]\n hid_report_raw_event+0xd56/0x18b0 drivers/hid/hid-core.c:1998\n hid_input_report+0x408/0x4f0 drivers/hid/hid-core.c:2066\n hid_irq_in+0x459/0x690 drivers/hid/usbhid/hid-core.c:284\n __usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671\n dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988\n call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474\n expire_timers kernel/time/timer.c:1519 [inline]\n __run_timers+0x76a/0x980 kernel/time/timer.c:1790\n run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803\n __do_softirq+0x277/0x75b kernel/softirq.c:571\n __irq_exit_rcu+0xec/0x170 kernel/softirq.c:650\n irq_exit_rcu+0x5/0x20 kernel/softirq.c:662\n sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107\n======================================================================\n\nIf the size of the integer (unsigned n) is bigger than 32 in snto32(),\nshift exponent will be too large for 32-bit type 'int', resulting in a\nshift-out-of-bounds bug.\nFix this by adding a check on the size of the integer (unsigned n) in\nsnto32(). To add support for n greater than 32 bits, set n to 32, if n\nis greater than 32.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08fa9f2c-10a7-40ba-ace1-f150d944fa8e",
      "id": "CVE-2022-49000",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix PCI device refcount leak in has_external_pci()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() before 'return true' to avoid reference count leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5602b2de-0267-4a42-896f-18b44acc95be",
      "id": "CVE-2022-49258",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccree - Fix use after free in cc_cipher_exit()\n\nkfree_sensitive(ctx_p-\u003euser.key) will free the ctx_p-\u003euser.key. But\nctx_p-\u003euser.key is still used in the next line, which will lead to a\nuse after free.\n\nWe can call kfree_sensitive() after dev_dbg() to avoid the uaf.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa2e86df-2a96-4084-8895-6c16728dc6b2",
      "id": "CVE-2022-49321",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: treat all calls not a bcall when bc_serv is NULL\n\nWhen a rdma server returns a fault format reply, nfs v3 client may\ntreats it as a bcall when bc service is not exist.\n\nThe debug message at rpcrdma_bc_receive_call are,\n\n[56579.837169] RPC:       rpcrdma_bc_receive_call: callback XID\n00000001, length=20\n[56579.837174] RPC:       rpcrdma_bc_receive_call: 00 00 00 01 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 04\n\nAfter that, rpcrdma_bc_receive_call will meets NULL pointer as,\n\n[  226.057890] BUG: unable to handle kernel NULL pointer dereference at\n00000000000000c8\n...\n[  226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20\n...\n[  226.059732] Call Trace:\n[  226.059878]  rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma]\n[  226.060011]  __ib_process_cq+0x89/0x170 [ib_core]\n[  226.060092]  ib_cq_poll_work+0x26/0x80 [ib_core]\n[  226.060257]  process_one_work+0x1a7/0x360\n[  226.060367]  ? create_worker+0x1a0/0x1a0\n[  226.060440]  worker_thread+0x30/0x390\n[  226.060500]  ? create_worker+0x1a0/0x1a0\n[  226.060574]  kthread+0x116/0x130\n[  226.060661]  ? kthread_flush_work_fn+0x10/0x10\n[  226.060724]  ret_from_fork+0x35/0x40\n...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a6ef054-3e39-4b01-a695-ff449fa8e939",
      "id": "CVE-2022-49346",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list\n\nEvery iteration of for_each_available_child_of_node() decrements\nthe reference count of the previous node.\nwhen breaking early from a for_each_available_child_of_node() loop,\nwe need to explicitly call of_node_put() on the gphy_fw_np.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52a0e8b1-12d4-49dd-b9b9-c63722bf584c",
      "id": "CVE-2022-49347",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug_on in ext4_writepages\n\nwe got issue as follows:\nEXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls\n------------[ cut here ]------------\nkernel BUG at fs/ext4/inode.c:2708!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155\nRIP: 0010:ext4_writepages+0x1977/0x1c10\nRSP: 0018:ffff88811d3e7880 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000\nRDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002\nRBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000\nR10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001\nR13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028\nFS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n do_writepages+0x130/0x3a0\n filemap_fdatawrite_wbc+0x83/0xa0\n filemap_flush+0xab/0xe0\n ext4_alloc_da_blocks+0x51/0x120\n __ext4_ioctl+0x1534/0x3210\n __x64_sys_ioctl+0x12c/0x170\n do_syscall_64+0x3b/0x90\n\nIt may happen as follows:\n1. write inline_data inode\nvfs_write\n  new_sync_write\n    ext4_file_write_iter\n      ext4_buffered_write_iter\n        generic_perform_write\n          ext4_da_write_begin\n            ext4_da_write_inline_data_begin -\u003e If inline data size too\n            small will allocate block to write, then mapping will has\n            dirty page\n                ext4_da_convert_inline_data_to_extent -\u003eclear EXT4_STATE_MAY_INLINE_DATA\n2. fallocate\ndo_vfs_ioctl\n  ioctl_preallocate\n    vfs_fallocate\n      ext4_fallocate\n        ext4_convert_inline_data\n          ext4_convert_inline_data_nolock\n            ext4_map_blocks -\u003e fail will goto restore data\n            ext4_restore_inline_data\n              ext4_create_inline_data\n              ext4_write_inline_data\n              ext4_set_inode_state -\u003e set inode EXT4_STATE_MAY_INLINE_DATA\n3. writepages\n__ext4_ioctl\n  ext4_alloc_da_blocks\n    filemap_flush\n      filemap_fdatawrite_wbc\n        do_writepages\n          ext4_writepages\n            if (ext4_has_inline_data(inode))\n              BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))\n\nThe root cause of this issue is we destory inline data until call\next4_writepages under delay allocation mode.  But there maybe already\nconvert from inline to extent.  To solve this issue, we call\nfilemap_flush first..",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "502c34e7-101b-4554-83bd-1171187ca1c4",
      "id": "CVE-2022-49364",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty inode in f2fs_evict_inode()\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215904\n\nThe kernel message is shown below:\n\nkernel BUG at fs/f2fs/inode.c:825!\nCall Trace:\n evict+0x282/0x4e0\n __dentry_kill+0x2b2/0x4d0\n shrink_dentry_list+0x17c/0x4f0\n shrink_dcache_parent+0x143/0x1e0\n do_one_tree+0x9/0x30\n shrink_dcache_for_umount+0x51/0x120\n generic_shutdown_super+0x5c/0x3a0\n kill_block_super+0x90/0xd0\n kill_f2fs_super+0x225/0x310\n deactivate_locked_super+0x78/0xc0\n cleanup_mnt+0x2b7/0x480\n task_work_run+0xc8/0x150\n exit_to_user_mode_prepare+0x14a/0x150\n syscall_exit_to_user_mode+0x1d/0x40\n do_syscall_64+0x48/0x90\n\nThe root cause is: inode node and dnode node share the same nid,\nso during f2fs_evict_inode(), dnode node truncation will invalidate\nits NAT entry, so when truncating inode node, it fails due to\ninvalid NAT entry, result in inode is still marked as dirty, fix\nthis issue by clearing dirty for inode and setting SBI_NEED_FSCK\nflag in filesystem.\n\noutput from dump.f2fs:\n[print_node_info: 354] Node ID [0xf:15] is inode\ni_nid[0]                      \t\t[0x       f : 15]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "333fe9ef-f117-4fab-ae91-00352a040fac",
      "id": "CVE-2022-49425",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix dereference of stale list iterator after loop body\n\nThe list iterator variable will be a bogus pointer if no break was hit.\nDereferencing it (cur-\u003epage in this case) could load an out-of-bounds/undefined\nvalue making it unsafe to use that in the comparision to determine if the\nspecific element was found.\n\nSince 'cur-\u003epage' *can* be out-ouf-bounds it cannot be guaranteed that\nby chance (or intention of an attacker) it matches the value of 'page'\neven though the correct element was not found.\n\nThis is fixed by using a separate list iterator variable for the loop\nand only setting the original variable if a suitable element was found.\nThen determing if the element was found is simply checking if the\nvariable is set.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "deed2598-7500-4ee3-b94c-cc96f7a754d5",
      "id": "CVE-2022-49435",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()\n\nIt will cause null-ptr-deref when using 'res', if platform_get_resource()\nreturns NULL, so move using 'res' after devm_ioremap_resource() that\nwill check it to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ca7db2d2-c76c-4492-8426-e483f2b888c1",
      "id": "CVE-2022-49733",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\n\nThere is a small race window at snd_pcm_oss_sync() that is called from\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\nfor the rest.  When the stream is set up again by another thread\nbetween them, it leads to inconsistency, and may result in unexpected\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\nrecently.\n\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "751571b4-50be-4ab1-9371-5c0e18fd2252",
      "id": "CVE-2022-49913",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix inode list leak during backref walking at find_parent_nodes()\n\nDuring backref walking, at find_parent_nodes(), if we are dealing with a\ndata extent and we get an error while resolving the indirect backrefs, at\nresolve_indirect_refs(), or in the while loop that iterates over the refs\nin the direct refs rbtree, we end up leaking the inode lists attached to\nthe direct refs we have in the direct refs rbtree that were not yet added\nto the refs ulist passed as argument to find_parent_nodes(). Since they\nwere not yet added to the refs ulist and prelim_release() does not free\nthe lists, on error the caller can only free the lists attached to the\nrefs that were added to the refs ulist, all the remaining refs get their\ninode lists never freed, therefore leaking their memory.\n\nFix this by having prelim_release() always free any attached inode list\nto each ref found in the rbtree, and have find_parent_nodes() set the\nref's inode list to NULL once it transfers ownership of the inode list\nto a ref added to the refs ulist passed to find_parent_nodes().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35c0ca79-7438-4946-a4bf-d6fef3f7fe25",
      "id": "CVE-2022-49922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()\n\nnfcmrvl_i2c_nci_send() will be called by nfcmrvl_nci_send(), and skb\nshould be freed in nfcmrvl_i2c_nci_send(). However, nfcmrvl_nci_send()\nwill only free skb when i2c_master_send() return \u003e=0, which means skb\nwill memleak when i2c_master_send() failed. Free skb no matter whether\ni2c_master_send() succeeds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "80d7fcbf-e217-4819-a3a5-420f585851e2",
      "id": "CVE-2022-49990",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390: fix double free of GS and RI CBs on fork() failure\n\nThe pointers for guarded storage and runtime instrumentation control\nblocks are stored in the thread_struct of the associated task. These\npointers are initially copied on fork() via arch_dup_task_struct()\nand then cleared via copy_thread() before fork() returns. If fork()\nhappens to fail after the initial task dup and before copy_thread(),\nthe newly allocated task and associated thread_struct memory are\nfreed via free_task() -\u003e arch_release_task_struct(). This results in\na double free of the guarded storage and runtime info structs\nbecause the fields in the failed task still refer to memory\nassociated with the source task.\n\nThis problem can manifest as a BUG_ON() in set_freepointer() (with\nCONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled)\nwhen running trinity syscall fuzz tests on s390x. To avoid this\nproblem, clear the associated pointer fields in\narch_dup_task_struct() immediately after the new task is copied.\nNote that the RI flag is still cleared in copy_thread() because it\nresides in thread stack memory and that is where stack info is\ncopied.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2185296-992b-4df8-bb68-98139fef9d84",
      "id": "CVE-2022-50030",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input\n\nMalformed user input to debugfs results in buffer overflow crashes.  Adapt\ninput string lengths to fit within internal buffers, leaving space for NULL\nterminators.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73690d5c-54d8-4d5b-b7fb-a43ad1cf106e",
      "id": "CVE-2022-50067",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\n\nIn btrfs_relocate_block_group(), the rc is allocated.  Then\nbtrfs_relocate_block_group() calls\n\nrelocate_block_group()\n  prepare_to_relocate()\n    set_reloc_control()\n\nthat assigns rc to the variable fs_info-\u003ereloc_ctl. When\nprepare_to_relocate() returns, it calls\n\nbtrfs_commit_transaction()\n  btrfs_start_dirty_block_groups()\n    btrfs_alloc_path()\n      kmem_cache_zalloc()\n\nwhich may fail for example (or other errors could happen). When the\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\nrc and doesn't set fs_info-\u003ereloc_ctl to NULL. After that, in\nbtrfs_init_reloc_root(), rc is retrieved from fs_info-\u003ereloc_ctl and\nthen used, which may cause a use-after-free bug.\n\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\nbefore calling btrfs_ioctl_defrag().\n\nTo fix this possible bug, in prepare_to_relocate(), check if\nbtrfs_commit_transaction() fails. If the failure occurs,\nunset_reloc_control() is called to set fs_info-\u003ereloc_ctl to NULL.\n\nThe error log in our fault-injection testing is shown as follows:\n\n  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  ...\n  [   58.753577] Call Trace:\n  ...\n  [   58.755800]  kasan_report+0x45/0x60\n  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]\n  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\n  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]\n  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]\n  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\n  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]\n  ...\n  [   58.768510] Allocated by task 23683:\n  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0\n  [   58.769069]  __kmalloc+0x227/0x3d0\n  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]\n  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\n  [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...\n  [   58.773337] Freed by task 23683:\n  ...\n  [   58.774815]  kfree+0xda/0x2b0\n  [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]\n  [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\n  [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d180a402-b1f5-40a5-b0a5-7b8d0e2640ec",
      "id": "CVE-2024-49950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix uaf in l2cap_connect\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949\nRead of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54\n\nCPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nWorkqueue: hci2 hci_rx_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949\n l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline]\n l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline]\n l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline]\n l2cap_recv_frame+0xf0b/0x8eb0 net/bluetooth/l2cap_core.c:6825\n l2cap_recv_acldata+0x9b4/0xb70 net/bluetooth/l2cap_core.c:7514\n hci_acldata_packet net/bluetooth/hci_core.c:3791 [inline]\n hci_rx_work+0xaab/0x1610 net/bluetooth/hci_core.c:4028\n process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231\n process_scheduled_works kernel/workqueue.c:3312 [inline]\n worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n...\n\nFreed by task 5245:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579\n poison_slab_object+0xf7/0x160 mm/kasan/common.c:240\n __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2256 [inline]\n slab_free mm/slub.c:4477 [inline]\n kfree+0x12a/0x3b0 mm/slub.c:4598\n l2cap_conn_free net/bluetooth/l2cap_core.c:1810 [inline]\n kref_put include/linux/kref.h:65 [inline]\n l2cap_conn_put net/bluetooth/l2cap_core.c:1822 [inline]\n l2cap_conn_del+0x59d/0x730 net/bluetooth/l2cap_core.c:1802\n l2cap_connect_cfm+0x9e6/0xf80 net/bluetooth/l2cap_core.c:7241\n hci_connect_cfm include/net/bluetooth/hci_core.h:1960 [inline]\n hci_conn_failed+0x1c3/0x370 net/bluetooth/hci_conn.c:1265\n hci_abort_conn_sync+0x75a/0xb50 net/bluetooth/hci_sync.c:5583\n abort_conn_sync+0x197/0x360 net/bluetooth/hci_conn.c:2917\n hci_cmd_sync_work+0x1a4/0x410 net/bluetooth/hci_sync.c:328\n process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231\n process_scheduled_works kernel/workqueue.c:3312 [inline]\n worker_thread+0x6c8/0xed0 kernel/workqueue.c:3389\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2008d3cc-59a7-4e95-8a1d-0e6cf292f39f",
      "id": "CVE-2022-50282",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nchardev: fix error handling in cdev_device_add()\n\nWhile doing fault injection test, I got the following report:\n\n------------[ cut here ]------------\nkobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called.\nWARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0\nCPU: 3 PID: 6306 Comm: 283 Tainted: G        W          6.1.0-rc2-00005-g307c1086d7c9 #1253\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:kobject_put+0x23d/0x4e0\nCall Trace:\n \u003cTASK\u003e\n cdev_device_add+0x15e/0x1b0\n __iio_device_register+0x13b4/0x1af0 [industrialio]\n __devm_iio_device_register+0x22/0x90 [industrialio]\n max517_probe+0x3d8/0x6b4 [max517]\n i2c_device_probe+0xa81/0xc00\n\nWhen device_add() is injected fault and returns error, if dev-\u003edevt is not set,\ncdev_add() is not called, cdev_del() is not needed. Fix this by checking dev-\u003edevt\nin error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9289360f-95a7-419c-ad03-94b001af9706",
      "id": "CVE-2023-1838",
      "description": "A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58890c5c-99cd-4680-9f92-b0c1c4c40021",
      "id": "CVE-2023-1998",
      "description": "The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line.\n\nThis happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "64ecf687-030a-4e9f-b2d7-abe1856b9af0",
      "id": "CVE-2023-2166",
      "description": "A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff5abae1-94a5-4022-9e4c-066974fe6400",
      "id": "CVE-2025-21727",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: fix UAF in padata_reorder\n\nA bug was found when run ltp test:\n\nBUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0\nRead of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206\n\nCPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+\nWorkqueue: pdecrypt_parallel padata_parallel_worker\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x32/0x50\nprint_address_description.constprop.0+0x6b/0x3d0\nprint_report+0xdd/0x2c0\nkasan_report+0xa5/0xd0\npadata_find_next+0x29/0x1a0\npadata_reorder+0x131/0x220\npadata_parallel_worker+0x3d/0xc0\nprocess_one_work+0x2ec/0x5a0\n\nIf 'mdelay(10)' is added before calling 'padata_find_next' in the\n'padata_reorder' function, this issue could be reproduced easily with\nltp test (pcrypt_aead01).\n\nThis can be explained as bellow:\n\npcrypt_aead_encrypt\n...\npadata_do_parallel\nrefcount_inc(\u0026pd-\u003erefcnt); // add refcnt\n...\npadata_do_serial\npadata_reorder // pd\nwhile (1) {\npadata_find_next(pd, true); // using pd\nqueue_work_on\n...\npadata_serial_worker\t\t\t\tcrypto_del_alg\npadata_put_pd_cnt // sub refcnt\n\t\t\t\t\t\tpadata_free_shell\n\t\t\t\t\t\tpadata_put_pd(ps-\u003epd);\n\t\t\t\t\t\t// pd is freed\n// loop again, but pd is freed\n// call padata_find_next, UAF\n}\n\nIn the padata_reorder function, when it loops in 'while', if the alg is\ndeleted, the refcnt may be decreased to 0 before entering\n'padata_find_next', which leads to UAF.\n\nAs mentioned in [1], do_serial is supposed to be called with BHs disabled\nand always happen under RCU protection, to address this issue, add\nsynchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls\nto finish.\n\n[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/\n[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7207a6f2-d8af-43d8-9dc4-3597a22539d9",
      "id": "CVE-2023-23001",
      "description": "In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6837709a-120f-4d31-82de-e8948eb296ea",
      "id": "CVE-2023-3212",
      "description": "A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10ba059b-4eb3-4192-8ce0-664e40114782",
      "id": "CVE-2023-37453",
      "description": "An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9747a59d-718b-4d1d-b30a-392424881c26",
      "id": "CVE-2023-46813",
      "description": "An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5c98cac-3951-404c-a1d8-54b646598fd4",
      "id": "CVE-2023-4921",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.\n\nWhen the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().\n\nWe recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be812e69-9067-430a-af02-0aeac3b6afbb",
      "id": "CVE-2023-52449",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: Fix gluebi NULL pointer dereference caused by ftl notifier\n\nIf both ftl.ko and gluebi.ko are loaded, the notifier of ftl\ntriggers NULL pointer dereference when trying to access\n‘gluebi-\u003edesc’ in gluebi_read().\n\nubi_gluebi_init\n  ubi_register_volume_notifier\n    ubi_enumerate_volumes\n      ubi_notify_all\n        gluebi_notify    nb-\u003enotifier_call()\n          gluebi_create\n            mtd_device_register\n              mtd_device_parse_register\n                add_mtd_device\n                  blktrans_notify_add   not-\u003eadd()\n                    ftl_add_mtd         tr-\u003eadd_mtd()\n                      scan_header\n                        mtd_read\n                          mtd_read_oob\n                            mtd_read_oob_std\n                              gluebi_read   mtd-\u003eread()\n                                gluebi-\u003edesc - NULL\n\nDetailed reproduction information available at the Link [1],\n\nIn the normal case, obtain gluebi-\u003edesc in the gluebi_get_device(),\nand access gluebi-\u003edesc in the gluebi_read(). However,\ngluebi_get_device() is not executed in advance in the\nftl_add_mtd() process, which leads to NULL pointer dereference.\n\nThe solution for the gluebi module is to run jffs2 on the UBI\nvolume without considering working with ftl or mtdblock [2].\nTherefore, this problem can be avoided by preventing gluebi from\ncreating the mtdblock device after creating mtd partition of the\ntype MTD_UBIVOLUME.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc6f58f1-6274-4100-97f8-e38471b4fd30",
      "id": "CVE-2023-52584",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspmi: mediatek: Fix UAF on device remove\n\nThe pmif driver data that contains the clocks is allocated along with\nspmi_controller.\nOn device remove, spmi_controller will be freed first, and then devres\n, including the clocks, will be cleanup.\nThis leads to UAF because putting the clocks will access the clocks in\nthe pmif driver data, which is already freed along with spmi_controller.\n\nThis can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and\nbuilding the kernel with KASAN.\n\nFix the UAF issue by using unmanaged clk_bulk_get() and putting the\nclocks before freeing spmi_controller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5f7aa16-098c-4255-a893-62c89bc1f119",
      "id": "CVE-2023-52674",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()\n\nEnsure the value passed to scarlett2_mixer_ctl_put() is between 0 and\nSCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside\nscarlett2_mixer_values[].",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fdb104ff-63e2-4232-af28-d31db918c050",
      "id": "CVE-2023-52760",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in gfs2_qd_dealloc\n\nIn gfs2_put_super(), whether withdrawn or not, the quota should\nbe cleaned up by gfs2_quota_cleanup().\n\nOtherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu\ncallback) has run for all gfs2_quota_data objects, resulting in\nuse-after-free.\n\nAlso, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called\nby gfs2_make_fs_ro(), so in gfs2_put_super(), after calling\ngfs2_make_fs_ro(), there is no need to call them again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab20445e-d0cb-451a-8856-889215be36a7",
      "id": "CVE-2023-52923",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: adapt set backend to use GC transaction API\n\nUse the GC transaction API to replace the old and buggy gc API and the\nbusy mark approach.\n\nNo set elements are removed from async garbage collection anymore,\ninstead the _DEAD bit is set on so the set element is not visible from\nlookup path anymore. Async GC enqueues transaction work that might be\naborted and retried later.\n\nrbtree and pipapo set backends does not set on the _DEAD bit from the\nsync GC path since this runs in control plane path where mutex is held.\nIn this case, set elements are deactivated, removed and then released\nvia RCU callback, sync GC never fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b4b4555-6f01-4133-8af4-f6feb41cbe83",
      "id": "CVE-2024-47664",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware\n\nIf the value of max_speed_hz is 0, it may cause a division by zero\nerror in hisi_calc_effective_speed().\nThe value of max_speed_hz is provided by firmware.\nFirmware is generally considered as a trusted domain. However, as\ndivision by zero errors can cause system failure, for defense measure,\nthe value of max_speed is validated here. So 0 is regarded as invalid\nand an error code is returned.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7197386b-3ec7-4a97-b735-917d5f268e04",
      "id": "CVE-2023-53418",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43b7a9ef-2240-4900-ac86-5a63c6a8a6a6",
      "id": "CVE-2023-53074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini\n\nThe call trace occurs when the amdgpu is removed after\nthe mode1 reset. During mode1 reset, from suspend to resume,\nthere is no need to reinitialize the ta firmware buffer\nwhich caused the bo pin_count increase redundantly.\n\n[  489.885525] Call Trace:\n[  489.885525]  \u003cTASK\u003e\n[  489.885526]  amdttm_bo_put+0x34/0x50 [amdttm]\n[  489.885529]  amdgpu_bo_free_kernel+0xe8/0x130 [amdgpu]\n[  489.885620]  psp_free_shared_bufs+0xb7/0x150 [amdgpu]\n[  489.885720]  psp_hw_fini+0xce/0x170 [amdgpu]\n[  489.885815]  amdgpu_device_fini_hw+0x2ff/0x413 [amdgpu]\n[  489.885960]  ? blocking_notifier_chain_unregister+0x56/0xb0\n[  489.885962]  amdgpu_driver_unload_kms+0x51/0x60 [amdgpu]\n[  489.886049]  amdgpu_pci_remove+0x5a/0x140 [amdgpu]\n[  489.886132]  ? __pm_runtime_resume+0x60/0x90\n[  489.886134]  pci_device_remove+0x3e/0xb0\n[  489.886135]  __device_release_driver+0x1ab/0x2a0\n[  489.886137]  driver_detach+0xf3/0x140\n[  489.886138]  bus_remove_driver+0x6c/0xf0\n[  489.886140]  driver_unregister+0x31/0x60\n[  489.886141]  pci_unregister_driver+0x40/0x90\n[  489.886142]  amdgpu_exit+0x15/0x451 [amdgpu]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6081f06-473f-4971-92bb-36ea5406483d",
      "id": "CVE-2023-53101",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: zero i_disksize when initializing the bootloader inode\n\nIf the boot loader inode has never been used before, the\nEXT4_IOC_SWAP_BOOT inode will initialize it, including setting the\ni_size to 0.  However, if the \"never before used\" boot loader has a\nnon-zero i_size, then i_disksize will be non-zero, and the\ninconsistency between i_size and i_disksize can trigger a kernel\nwarning:\n\n WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319\n CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa\n RIP: 0010:ext4_file_write_iter+0xbc7/0xd10\n Call Trace:\n  vfs_write+0x3b1/0x5c0\n  ksys_write+0x77/0x160\n  __x64_sys_write+0x22/0x30\n  do_syscall_64+0x39/0x80\n\nReproducer:\n 1. create corrupted image and mount it:\n       mke2fs -t ext4 /tmp/foo.img 200\n       debugfs -wR \"sif \u003c5\u003e size 25700\" /tmp/foo.img\n       mount -t ext4 /tmp/foo.img /mnt\n       cd /mnt\n       echo 123 \u003e file\n 2. Run the reproducer program:\n       posix_memalign(\u0026buf, 1024, 1024)\n       fd = open(\"file\", O_RDWR | O_DIRECT);\n       ioctl(fd, EXT4_IOC_SWAP_BOOT);\n       write(fd, buf, 1024);\n\nFix this by setting i_disksize as well as i_size to zero when\ninitiaizing the boot loader inode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d3df50f-90df-4c22-8afe-03d7dfbff4f3",
      "id": "CVE-2023-53188",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix race on port output\n\nassume the following setup on a single machine:\n1. An openvswitch instance with one bridge and default flows\n2. two network namespaces \"server\" and \"client\"\n3. two ovs interfaces \"server\" and \"client\" on the bridge\n4. for each ovs interface a veth pair with a matching name and 32 rx and\n   tx queues\n5. move the ends of the veth pairs to the respective network namespaces\n6. assign ip addresses to each of the veth ends in the namespaces (needs\n   to be the same subnet)\n7. start some http server on the server network namespace\n8. test if a client in the client namespace can reach the http server\n\nwhen following the actions below the host has a chance of getting a cpu\nstuck in a infinite loop:\n1. send a large amount of parallel requests to the http server (around\n   3000 curls should work)\n2. in parallel delete the network namespace (do not delete interfaces or\n   stop the server, just kill the namespace)\n\nthere is a low chance that this will cause the below kernel cpu stuck\nmessage. If this does not happen just retry.\nBelow there is also the output of bpftrace for the functions mentioned\nin the output.\n\nThe series of events happening here is:\n1. the network namespace is deleted calling\n   `unregister_netdevice_many_notify` somewhere in the process\n2. this sets first `NETREG_UNREGISTERING` on both ends of the veth and\n   then runs `synchronize_net`\n3. it then calls `call_netdevice_notifiers` with `NETDEV_UNREGISTER`\n4. this is then handled by `dp_device_event` which calls\n   `ovs_netdev_detach_dev` (if a vport is found, which is the case for\n   the veth interface attached to ovs)\n5. this removes the rx_handlers of the device but does not prevent\n   packages to be sent to the device\n6. `dp_device_event` then queues the vport deletion to work in\n   background as a ovs_lock is needed that we do not hold in the\n   unregistration path\n7. `unregister_netdevice_many_notify` continues to call\n   `netdev_unregister_kobject` which sets `real_num_tx_queues` to 0\n8. port deletion continues (but details are not relevant for this issue)\n9. at some future point the background task deletes the vport\n\nIf after 7. but before 9. a packet is send to the ovs vport (which is\nnot deleted at this point in time) which forwards it to the\n`dev_queue_xmit` flow even though the device is unregistering.\nIn `skb_tx_hash` (which is called in the `dev_queue_xmit`) path there is\na while loop (if the packet has a rx_queue recorded) that is infinite if\n`dev-\u003ereal_num_tx_queues` is zero.\n\nTo prevent this from happening we update `do_output` to handle devices\nwithout carrier the same as if the device is not found (which would\nbe the code path after 9. is done).\n\nAdditionally we now produce a warning in `skb_tx_hash` if we will hit\nthe infinite loop.\n\nbpftrace (first word is function name):\n\n__dev_queue_xmit server: real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1\nnetdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 2, reg_state: 1\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\ndp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 6, reg_state: 2\novs_netdev_detach_dev server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, reg_state: 2\nnetdev_rx_handler_unregister server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2\nsynchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024\nnetdev_rx_handler_unregister ret server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2\ndp_\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "276484b1-6f49-4593-9ca9-d57689c38444",
      "id": "CVE-2023-53189",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6/addrconf: fix a potential refcount underflow for idev\n\nNow in addrconf_mod_rs_timer(), reference idev depends on whether\nrs_timer is not pending. Then modify rs_timer timeout.\n\nThere is a time gap in [1], during which if the pending rs_timer\nbecomes not pending. It will miss to hold idev, but the rs_timer\nis activated. Thus rs_timer callback function addrconf_rs_timer()\nwill be executed and put idev later without holding idev. A refcount\nunderflow issue for idev can be caused by this.\n\n\tif (!timer_pending(\u0026idev-\u003ers_timer))\n\t\tin6_dev_hold(idev);\n\t\t  \u003c--------------[1]\n\tmod_timer(\u0026idev-\u003ers_timer, jiffies + when);\n\nTo fix the issue, hold idev if mod_timer() return 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4a004ac0-b6f1-4b45-a400-60e61af664dc",
      "id": "CVE-2023-53242",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/hisi: Drop second sensor hi3660\n\nThe commit 74c8e6bffbe1 (\"driver core: Add __alloc_size hint to devm\nallocators\") exposes a panic \"BRK handler: Fatal exception\" on the\nhi3660_thermal_probe funciton.\nThis is because the function allocates memory for only one\nsensors array entry, but tries to fill up a second one.\n\nFix this by removing the unneeded second access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce200699-54f5-4019-aa63-e45a6a8b8b3f",
      "id": "CVE-2024-26965",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-msm8974: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "159f3360-12c6-4c46-bc30-d9b67bac5b18",
      "id": "CVE-2023-53275",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()\n\nThe variable codec-\u003eregmap is often protected by the lock\ncodec-\u003eregmap_lock when is accessed. However, it is accessed without\nholding the lock when is accessed in snd_hdac_regmap_sync():\n\n  if (codec-\u003eregmap)\n\nIn my opinion, this may be a harmful race, because if codec-\u003eregmap is\nset to NULL right after the condition is checked, a null-pointer\ndereference can occur in the called function regcache_sync():\n\n  map-\u003elock(map-\u003elock_arg); --\u003e Line 360 in drivers/base/regmap/regcache.c\n\nTo fix this possible null-pointer dereference caused by data race, the\nmutex_lock coverage is extended to protect the if statement as well as the\nfunction call to regcache_sync().\n\n[ Note: the lack of the regmap_lock itself is harmless for the current\n  codec driver implementations, as snd_hdac_regmap_sync() is only for\n  PM runtime resume that is prohibited during the codec probe.\n  But the change makes the whole code more consistent, so it's merged\n  as is -- tiwai ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6c27f2c-7fd8-45cd-970c-3860d46cdf17",
      "id": "CVE-2024-39476",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING\n\nXiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with\nsmall possibility, the root cause is exactly the same as commit\nbed9e27baf52 (\"Revert \"md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\"\")\n\nHowever, Dan reported another hang after that, and junxiao investigated\nthe problem and found out that this is caused by plugged bio can't issue\nfrom raid5d().\n\nCurrent implementation in raid5d() has a weird dependence:\n\n1) md_check_recovery() from raid5d() must hold 'reconfig_mutex' to clear\n   MD_SB_CHANGE_PENDING;\n2) raid5d() handles IO in a deadloop, until all IO are issued;\n3) IO from raid5d() must wait for MD_SB_CHANGE_PENDING to be cleared;\n\nThis behaviour is introduce before v2.6, and for consequence, if other\ncontext hold 'reconfig_mutex', and md_check_recovery() can't update\nsuper_block, then raid5d() will waste one cpu 100% by the deadloop, until\n'reconfig_mutex' is released.\n\nRefer to the implementation from raid1 and raid10, fix this problem by\nskipping issue IO if MD_SB_CHANGE_PENDING is still set after\nmd_check_recovery(), daemon thread will be woken up when 'reconfig_mutex'\nis released. Meanwhile, the hang problem will be fixed as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fcb6651d-ab44-47fd-8114-2fd618ebabce",
      "id": "CVE-2024-39488",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY\n\nWhen CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes\nto bug_table entries, and as a result the last entry in a bug table will\nbe ignored, potentially leading to an unexpected panic(). All prior\nentries in the table will be handled correctly.\n\nThe arm64 ABI requires that struct fields of up to 8 bytes are\nnaturally-aligned, with padding added within a struct such that struct\nare suitably aligned within arrays.\n\nWhen CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is:\n\n\tstruct bug_entry {\n\t\tsigned int      bug_addr_disp;\t// 4 bytes\n\t\tsigned int      file_disp;\t// 4 bytes\n\t\tunsigned short  line;\t\t// 2 bytes\n\t\tunsigned short  flags;\t\t// 2 bytes\n\t}\n\n... with 12 bytes total, requiring 4-byte alignment.\n\nWhen CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is:\n\n\tstruct bug_entry {\n\t\tsigned int      bug_addr_disp;\t// 4 bytes\n\t\tunsigned short  flags;\t\t// 2 bytes\n\t\t\u003c implicit padding \u003e\t\t// 2 bytes\n\t}\n\n... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing\npadding, requiring 4-byte alginment.\n\nWhen we create a bug_entry in assembly, we align the start of the entry\nto 4 bytes, which implicitly handles padding for any prior entries.\nHowever, we do not align the end of the entry, and so when\nCONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding\nbytes.\n\nFor the main kernel image this is not a problem as find_bug() doesn't\ndepend on the trailing padding bytes when searching for entries:\n\n\tfor (bug = __start___bug_table; bug \u003c __stop___bug_table; ++bug)\n\t\tif (bugaddr == bug_addr(bug))\n\t\t\treturn bug;\n\nHowever for modules, module_bug_finalize() depends on the trailing\nbytes when calculating the number of entries:\n\n\tmod-\u003enum_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);\n\n... and as the last bug_entry lacks the necessary padding bytes, this entry\nwill not be counted, e.g. in the case of a single entry:\n\n\tsechdrs[i].sh_size == 6\n\tsizeof(struct bug_entry) == 8;\n\n\tsechdrs[i].sh_size / sizeof(struct bug_entry) == 0;\n\nConsequently module_find_bug() will miss the last bug_entry when it does:\n\n\tfor (i = 0; i \u003c mod-\u003enum_bugs; ++i, ++bug)\n\t\tif (bugaddr == bug_addr(bug))\n\t\t\tgoto out;\n\n... which can lead to a kenrel panic due to an unhandled bug.\n\nThis can be demonstrated with the following module:\n\n\tstatic int __init buginit(void)\n\t{\n\t\tWARN(1, \"hello\\n\");\n\t\treturn 0;\n\t}\n\n\tstatic void __exit bugexit(void)\n\t{\n\t}\n\n\tmodule_init(buginit);\n\tmodule_exit(bugexit);\n\tMODULE_LICENSE(\"GPL\");\n\n... which will trigger a kernel panic when loaded:\n\n\t------------[ cut here ]------------\n\thello\n\tUnexpected kernel BRK exception at EL1\n\tInternal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP\n\tModules linked in: hello(O+)\n\tCPU: 0 PID: 50 Comm: insmod Tainted: G           O       6.9.1 #8\n\tHardware name: linux,dummy-virt (DT)\n\tpstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n\tpc : buginit+0x18/0x1000 [hello]\n\tlr : buginit+0x18/0x1000 [hello]\n\tsp : ffff800080533ae0\n\tx29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000\n\tx26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58\n\tx23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0\n\tx20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006\n\tx17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720\n\tx14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312\n\tx11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8\n\tx8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000\n\tx5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000\n\tx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0\n\tCall trace:\n\t buginit+0x18/0x1000 [hello]\n\t do_one_initcall+0x80/0x1c8\n\t do_init_module+0x60/0x218\n\t load_module+0x1ba4/0x1d70\n\t __do_sys_init_module+0x198/0x1d0\n\t __arm64_sys_init_module+0x1c/0x28\n\t invoke_syscall+0x48/0x114\n\t el0_svc\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d14869a0-c5a7-48d8-89c5-ec0ed1c53242",
      "id": "CVE-2024-23849",
      "description": "In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20b62be3-0f3d-4128-9e98-192af977fdec",
      "id": "CVE-2024-25741",
      "description": "printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82d15999-93c6-40b6-ac06-6c65c48509f2",
      "id": "CVE-2024-26747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: roles: fix NULL pointer issue when put module's reference\n\nIn current design, usb role class driver will get usb_role_switch parent's\nmodule reference after the user get usb_role_switch device and put the\nreference after the user put the usb_role_switch device. However, the\nparent device of usb_role_switch may be removed before the user put the\nusb_role_switch. If so, then, NULL pointer issue will be met when the user\nput the parent module's reference.\n\nThis will save the module pointer in structure of usb_role_switch. Then,\nwe don't need to find module by iterating long relations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36164d01-9367-4090-aecf-ca9b1238cddb",
      "id": "CVE-2024-46773",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check denominator pbn_div before used\n\n[WHAT \u0026 HOW]\nA denominator cannot be 0, and is checked before used.\n\nThis fixes 1 DIVIDE_BY_ZERO issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db7fef32-8fa4-499e-ab08-82a32e74da83",
      "id": "CVE-2024-35843",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c31ad685-07b3-46f4-8b88-d35814cd3da1",
      "id": "CVE-2024-42079",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix NULL pointer dereference in gfs2_log_flush\n\nIn gfs2_jindex_free(), set sdp-\u003esd_jdesc to NULL under the log flush\nlock to provide exclusion against gfs2_log_flush().\n\nIn gfs2_log_flush(), check if sdp-\u003esd_jdesc is non-NULL before\ndereferencing it.  Otherwise, we could run into a NULL pointer\ndereference when outstanding glock work races with an unmount\n(glock_work_func -\u003e run_queue -\u003e do_xmote -\u003e inode_go_sync -\u003e\ngfs2_log_flush).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ecb745cb-87ab-4ab4-bfe9-a438605e70fa",
      "id": "CVE-2024-42082",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: Remove WARN() from __xdp_reg_mem_model()\n\nsyzkaller reports a warning in __xdp_reg_mem_model().\n\nThe warning occurs only if __mem_id_init_hash_table() returns an error. It\nreturns the error in two cases:\n\n  1. memory allocation fails;\n  2. rhashtable_init() fails when some fields of rhashtable_params\n     struct are not initialized properly.\n\nThe second case cannot happen since there is a static const rhashtable_params\nstruct with valid fields. So, warning is only triggered when there is a\nproblem with memory allocation.\n\nThus, there is no sense in using WARN() to handle this error and it can be\nsafely removed.\n\nWARNING: CPU: 0 PID: 5065 at net/core/xdp.c:299 __xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299\n\nCPU: 0 PID: 5065 Comm: syz-executor883 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nRIP: 0010:__xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299\n\nCall Trace:\n xdp_reg_mem_model+0x22/0x40 net/core/xdp.c:344\n xdp_test_run_setup net/bpf/test_run.c:188 [inline]\n bpf_test_run_xdp_live+0x365/0x1e90 net/bpf/test_run.c:377\n bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267\n bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240\n __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649\n __do_sys_bpf kernel/bpf/syscall.c:5738 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5736 [inline]\n __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nFound by Linux Verification Center (linuxtesting.org) with syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b7b77fd-d8db-4d65-9647-f4076724059b",
      "id": "CVE-2024-42130",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc/nci: Add the inconsistency check between the input data length and count\n\nwrite$nci(r0, \u0026(0x7f0000000740)=ANY=[@ANYBLOB=\"610501\"], 0xf)\n\nSyzbot constructed a write() call with a data length of 3 bytes but a count value\nof 15, which passed too little data to meet the basic requirements of the function\nnci_rf_intf_activated_ntf_packet().\n\nTherefore, increasing the comparison between data length and count value to avoid\nproblems caused by inconsistent data length and count.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41538d00-75ec-4169-9b16-ef3f11598516",
      "id": "CVE-2024-44962",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading\n\nWhen unload the btnxpuart driver, its associated timer will be deleted.\nIf the timer happens to be modified at this moment, it leads to the\nkernel call this timer even after the driver unloaded, resulting in\nkernel panic.\nUse timer_shutdown_sync() instead of del_timer_sync() to prevent rearming.\n\npanic log:\n  Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP\n  Modules linked in: algif_hash algif_skcipher af_alg moal(O) mlan(O) crct10dif_ce polyval_ce polyval_generic   snd_soc_imx_card snd_soc_fsl_asoc_card snd_soc_imx_audmux mxc_jpeg_encdec v4l2_jpeg snd_soc_wm8962 snd_soc_fsl_micfil   snd_soc_fsl_sai flexcan snd_soc_fsl_utils ap130x rpmsg_ctrl imx_pcm_dma can_dev rpmsg_char pwm_fan fuse [last unloaded:   btnxpuart]\n  CPU: 5 PID: 723 Comm: memtester Tainted: G           O       6.6.23-lts-next-06207-g4aef2658ac28 #1\n  Hardware name: NXP i.MX95 19X19 board (DT)\n  pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : 0xffff80007a2cf464\n  lr : call_timer_fn.isra.0+0x24/0x80\n...\n  Call trace:\n   0xffff80007a2cf464\n   __run_timers+0x234/0x280\n   run_timer_softirq+0x20/0x40\n   __do_softirq+0x100/0x26c\n   ____do_softirq+0x10/0x1c\n   call_on_irq_stack+0x24/0x4c\n   do_softirq_own_stack+0x1c/0x2c\n   irq_exit_rcu+0xc0/0xdc\n   el0_interrupt+0x54/0xd8\n   __el0_irq_handler_common+0x18/0x24\n   el0t_64_irq_handler+0x10/0x1c\n   el0t_64_irq+0x190/0x194\n  Code: ???????? ???????? ???????? ???????? (????????)\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Oops: Fatal exception in interrupt\n  SMP: stopping secondary CPUs\n  Kernel Offset: disabled\n  CPU features: 0x0,c0000000,40028143,1000721b\n  Memory Limit: none\n  ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa1515cd-499f-4074-81a2-91764483ffbf",
      "id": "CVE-2024-44977",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Validate TA binary size\n\nAdd TA binary size validation to avoid OOB write.\n\n(cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1f8c9fb-3158-4ef3-b41c-cf8fb76dba3c",
      "id": "CVE-2024-44987",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent UAF in ip6_send_skb()\n\nsyzbot reported an UAF in ip6_send_skb() [1]\n\nAfter ip6_local_out() has returned, we no longer can safely\ndereference rt, unless we hold rcu_read_lock().\n\nA similar issue has been fixed in commit\na688caa34beb (\"ipv6: take rcu lock in rawv6_send_hdrinc()\")\n\nAnother potential issue in ip6_finish_output2() is handled in a\nseparate patch.\n\n[1]\n BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964\nRead of size 8 at addr ffff88806dde4858 by task syz.1.380/6530\n\nCPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:93 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964\n  rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588\n  rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  sock_write_iter+0x2dd/0x400 net/socket.c:1160\n do_iter_readv_writev+0x60a/0x890\n  vfs_writev+0x37c/0xbb0 fs/read_write.c:971\n  do_writev+0x1b1/0x350 fs/read_write.c:1018\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f936bf79e79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79\nRDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004\nRBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8\n \u003c/TASK\u003e\n\nAllocated by task 6530:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  unpoison_slab_object mm/kasan/common.c:312 [inline]\n  __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338\n  kasan_slab_alloc include/linux/kasan.h:201 [inline]\n  slab_post_alloc_hook mm/slub.c:3988 [inline]\n  slab_alloc_node mm/slub.c:4037 [inline]\n  kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044\n  dst_alloc+0x12b/0x190 net/core/dst.c:89\n  ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670\n  make_blackhole net/xfrm/xfrm_policy.c:3120 [inline]\n  xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313\n  ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257\n  rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597\n  ___sys_sendmsg net/socket.c:2651 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 45:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n  poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n  __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n  kasan_slab_free include/linux/kasan.h:184 [inline]\n  slab_free_hook mm/slub.c:2252 [inline]\n  slab_free mm/slub.c:4473 [inline]\n  kmem_cache_free+0x145/0x350 mm/slub.c:4548\n  dst_destroy+0x2ac/0x460 net/core/dst.c:124\n  rcu_do_batch kernel/rcu/tree.c:2569 [inline]\n  rcu_core+0xafd/0x1830 kernel/rcu/tree.\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3625005c-25e2-47eb-a42c-99c88ed2ecfd",
      "id": "CVE-2024-46728",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check index for aux_rd_interval before using\n\naux_rd_interval has size of 7 and should be checked.\n\nThis fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06d3de5f-5deb-4781-8d4d-b4e2fcebd98d",
      "id": "CVE-2024-47691",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\n\nsyzbot reports a f2fs bug as below:\n\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_report+0xe8/0x550 mm/kasan/report.c:491\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n instrument_atomic_read_write include/linux/instrumented.h:96 [inline]\n atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]\n __refcount_add include/linux/refcount.h:184 [inline]\n __refcount_inc include/linux/refcount.h:241 [inline]\n refcount_inc include/linux/refcount.h:258 [inline]\n get_task_struct include/linux/sched/task.h:118 [inline]\n kthread_stop+0xca/0x630 kernel/kthread.c:704\n f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210\n f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283\n f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]\n __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is below race condition, it may cause use-after-free\nissue in sbi-\u003egc_th pointer.\n\n- remount\n - f2fs_remount\n  - f2fs_stop_gc_thread\n   - kfree(gc_th)\n\t\t\t\t- f2fs_ioc_shutdown\n\t\t\t\t - f2fs_do_shutdown\n\t\t\t\t  - f2fs_stop_gc_thread\n\t\t\t\t   - kthread_stop(gc_th-\u003ef2fs_gc_task)\n   : sbi-\u003egc_thread = NULL;\n\nWe will call f2fs_do_shutdown() in two paths:\n- for f2fs_ioc_shutdown() path, we should grab sb-\u003es_umount semaphore\nfor fixing.\n- for f2fs_shutdown() path, it's safe since caller has already grabbed\nsb-\u003es_umount semaphore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f30025c6-0c37-45b6-9776-7a6d145444a4",
      "id": "CVE-2025-39762",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: add null check\n\n[WHY]\nPrevents null pointer dereferences to enhance function robustness\n\n[HOW]\nAdds early null check and return false if invalid.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "882d1211-b175-4b56-aeb2-8e4607b7adf7",
      "id": "CVE-2024-49957",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix null-ptr-deref when journal load failed.\n\nDuring the mounting process, if journal_reset() fails because of too short\njournal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. \nSubsequently, ocfs2_journal_shutdown() calls\njbd2_journal_flush()-\u003ejbd2_cleanup_journal_tail()-\u003e\n__jbd2_update_log_tail()-\u003ejbd2_journal_update_sb_log_tail()\n-\u003elock_buffer(journal-\u003ej_sb_buffer), resulting in a null-pointer\ndereference error.\n\nTo resolve this issue, we should check the JBD2_LOADED flag to ensure the\njournal was properly loaded.  Additionally, use journal instead of\nosb-\u003ejournal directly to simplify the code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c6e6afe-7f43-414b-b3f8-0b436a2bc992",
      "id": "CVE-2024-49959",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error\n\nIn __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail()\nto recover some journal space. But if an error occurs while executing\njbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free\nspace right away, we try other branches, and if j_committing_transaction\nis NULL (i.e., the tid is 0), we will get the following complain:\n\n============================================\nJBD2: I/O error when updating journal superblock for sdd-8.\n__jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available\n__jbd2_log_wait_for_space: no way to get more journal space in sdd-8\n------------[ cut here ]------------\nWARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0\nModules linked in:\nCPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1\nRIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0\nCall Trace:\n \u003cTASK\u003e\n add_transaction_credits+0x5d1/0x5e0\n start_this_handle+0x1ef/0x6a0\n jbd2__journal_start+0x18b/0x340\n ext4_dirty_inode+0x5d/0xb0\n __mark_inode_dirty+0xe4/0x5d0\n generic_update_time+0x60/0x70\n[...]\n============================================\n\nSo only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to\nclean up at the moment, continue to try to reclaim free space in other ways.\n\nNote that this fix relies on commit 6f6a6fda2945 (\"jbd2: fix ocfs2 corrupt\nwhen updating journal superblock fails\") to make jbd2_cleanup_journal_tail\nreturn the correct error code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2ae901b-00b3-4746-a34b-e882b1878f8e",
      "id": "CVE-2024-50047",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in async decryption\n\nDoing an async decryption (large read) crashes with a\nslab-use-after-free way down in the crypto API.\n\nReproducer:\n    # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\n    # dd if=/mnt/largefile of=/dev/null\n    ...\n    [  194.196391] ==================================================================\n    [  194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\n    [  194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\n    [  194.197707]\n    [  194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\n    [  194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\n    [  194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\n    [  194.200032] Call Trace:\n    [  194.200191]  \u003cTASK\u003e\n    [  194.200327]  dump_stack_lvl+0x4e/0x70\n    [  194.200558]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.200809]  print_report+0x174/0x505\n    [  194.201040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n    [  194.201352]  ? srso_return_thunk+0x5/0x5f\n    [  194.201604]  ? __virt_addr_valid+0xdf/0x1c0\n    [  194.201868]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.202128]  kasan_report+0xc8/0x150\n    [  194.202361]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.202616]  gf128mul_4k_lle+0xc1/0x110\n    [  194.202863]  ghash_update+0x184/0x210\n    [  194.203103]  shash_ahash_update+0x184/0x2a0\n    [  194.203377]  ? __pfx_shash_ahash_update+0x10/0x10\n    [  194.203651]  ? srso_return_thunk+0x5/0x5f\n    [  194.203877]  ? crypto_gcm_init_common+0x1ba/0x340\n    [  194.204142]  gcm_hash_assoc_remain_continue+0x10a/0x140\n    [  194.204434]  crypt_message+0xec1/0x10a0 [cifs]\n    [  194.206489]  ? __pfx_crypt_message+0x10/0x10 [cifs]\n    [  194.208507]  ? srso_return_thunk+0x5/0x5f\n    [  194.209205]  ? srso_return_thunk+0x5/0x5f\n    [  194.209925]  ? srso_return_thunk+0x5/0x5f\n    [  194.210443]  ? srso_return_thunk+0x5/0x5f\n    [  194.211037]  decrypt_raw_data+0x15f/0x250 [cifs]\n    [  194.212906]  ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\n    [  194.214670]  ? srso_return_thunk+0x5/0x5f\n    [  194.215193]  smb2_decrypt_offload+0x12a/0x6c0 [cifs]\n\nThis is because TFM is being used in parallel.\n\nFix this by allocating a new AEAD TFM for async decryption, but keep\nthe existing one for synchronous READ cases (similar to what is done\nin smb3_calc_signature()).\n\nAlso remove the calls to aead_request_set_callback() and\ncrypto_wait_req() since it's always going to be a synchronous operation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c07537b4-e8a1-4ca3-b041-f891b2c21247",
      "id": "CVE-2024-50106",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix race between laundromat and free_stateid\n\nThere is a race between laundromat handling of revoked delegations\nand a client sending free_stateid operation. Laundromat thread\nfinds that delegation has expired and needs to be revoked so it\nmarks the delegation stid revoked and it puts it on a reaper list\nbut then it unlock the state lock and the actual delegation revocation\nhappens without the lock. Once the stid is marked revoked a racing\nfree_stateid processing thread does the following (1) it calls\nlist_del_init() which removes it from the reaper list and (2) frees\nthe delegation stid structure. The laundromat thread ends up not\ncalling the revoke_delegation() function for this particular delegation\nbut that means it will no release the lock lease that exists on\nthe file.\n\nNow, a new open for this file comes in and ends up finding that\nlease list isn't empty and calls nfsd_breaker_owns_lease() which ends\nup trying to derefence a freed delegation stateid. Leading to the\nfollowint use-after-free KASAN warning:\n\nkernel: ==================================================================\nkernel: BUG: KASAN: slab-use-after-free in nfsd_breaker_owns_lease+0x140/0x160 [nfsd]\nkernel: Read of size 8 at addr ffff0000e73cd0c8 by task nfsd/6205\nkernel:\nkernel: CPU: 2 UID: 0 PID: 6205 Comm: nfsd Kdump: loaded Not tainted 6.11.0-rc7+ #9\nkernel: Hardware name: Apple Inc. Apple Virtualization Generic Platform, BIOS 2069.0.0.0.0 08/03/2024\nkernel: Call trace:\nkernel: dump_backtrace+0x98/0x120\nkernel: show_stack+0x1c/0x30\nkernel: dump_stack_lvl+0x80/0xe8\nkernel: print_address_description.constprop.0+0x84/0x390\nkernel: print_report+0xa4/0x268\nkernel: kasan_report+0xb4/0xf8\nkernel: __asan_report_load8_noabort+0x1c/0x28\nkernel: nfsd_breaker_owns_lease+0x140/0x160 [nfsd]\nkernel: nfsd_file_do_acquire+0xb3c/0x11d0 [nfsd]\nkernel: nfsd_file_acquire_opened+0x84/0x110 [nfsd]\nkernel: nfs4_get_vfs_file+0x634/0x958 [nfsd]\nkernel: nfsd4_process_open2+0xa40/0x1a40 [nfsd]\nkernel: nfsd4_open+0xa08/0xe80 [nfsd]\nkernel: nfsd4_proc_compound+0xb8c/0x2130 [nfsd]\nkernel: nfsd_dispatch+0x22c/0x718 [nfsd]\nkernel: svc_process_common+0x8e8/0x1960 [sunrpc]\nkernel: svc_process+0x3d4/0x7e0 [sunrpc]\nkernel: svc_handle_xprt+0x828/0xe10 [sunrpc]\nkernel: svc_recv+0x2cc/0x6a8 [sunrpc]\nkernel: nfsd+0x270/0x400 [nfsd]\nkernel: kthread+0x288/0x310\nkernel: ret_from_fork+0x10/0x20\n\nThis patch proposes a fixed that's based on adding 2 new additional\nstid's sc_status values that help coordinate between the laundromat\nand other operations (nfsd4_free_stateid() and nfsd4_delegreturn()).\n\nFirst to make sure, that once the stid is marked revoked, it is not\nremoved by the nfsd4_free_stateid(), the laundromat take a reference\non the stateid. Then, coordinating whether the stid has been put\non the cl_revoked list or we are processing FREE_STATEID and need to\nmake sure to remove it from the list, each check that state and act\naccordingly. If laundromat has added to the cl_revoke list before\nthe arrival of FREE_STATEID, then nfsd4_free_stateid() knows to remove\nit from the list. If nfsd4_free_stateid() finds that operations arrived\nbefore laundromat has placed it on cl_revoke list, it marks the state\nfreed and then laundromat will no longer add it to the list.\n\nAlso, for nfsd4_delegreturn() when looking for the specified stid,\nwe need to access stid that are marked removed or freeable, it means\nthe laundromat has started processing it but hasn't finished and this\ndelegreturn needs to return nfserr_deleg_revoked and not\nnfserr_bad_stateid. The latter will not trigger a FREE_STATEID and the\nlack of it will leave this stid on the cl_revoked list indefinitely.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db3cda43-0089-4530-8d1d-9b8e84618bdb",
      "id": "CVE-2024-50151",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOBs when building SMB2_IOCTL request\n\nWhen using encryption, either enforced by the server or when using\n'seal' mount option, the client will squash all compound request buffers\ndown for encryption into a single iov in smb2_set_next_command().\n\nSMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the\nSMB2_IOCTL request in the first iov, and if the user passes an input\nbuffer that is greater than 328 bytes, smb2_set_next_command() will\nend up writing off the end of @rqst-\u003eiov[0].iov_base as shown below:\n\n  mount.cifs //srv/share /mnt -o ...,seal\n  ln -s $(perl -e \"print('a')for 1..1024\") /mnt/link\n\n  BUG: KASAN: slab-out-of-bounds in\n  smb2_set_next_command.cold+0x1d6/0x24c [cifs]\n  Write of size 4116 at addr ffff8881148fcab8 by task ln/859\n\n  CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  1.16.3-2.fc40 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x5d/0x80\n   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]\n   print_report+0x156/0x4d9\n   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]\n   ? __virt_addr_valid+0x145/0x310\n   ? __phys_addr+0x46/0x90\n   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]\n   kasan_report+0xda/0x110\n   ? smb2_set_next_command.cold+0x1d6/0x24c [cifs]\n   kasan_check_range+0x10f/0x1f0\n   __asan_memcpy+0x3c/0x60\n   smb2_set_next_command.cold+0x1d6/0x24c [cifs]\n   smb2_compound_op+0x238c/0x3840 [cifs]\n   ? kasan_save_track+0x14/0x30\n   ? kasan_save_free_info+0x3b/0x70\n   ? vfs_symlink+0x1a1/0x2c0\n   ? do_symlinkat+0x108/0x1c0\n   ? __pfx_smb2_compound_op+0x10/0x10 [cifs]\n   ? kmem_cache_free+0x118/0x3e0\n   ? cifs_get_writable_path+0xeb/0x1a0 [cifs]\n   smb2_get_reparse_inode+0x423/0x540 [cifs]\n   ? __pfx_smb2_get_reparse_inode+0x10/0x10 [cifs]\n   ? rcu_is_watching+0x20/0x50\n   ? __kmalloc_noprof+0x37c/0x480\n   ? smb2_create_reparse_symlink+0x257/0x490 [cifs]\n   ? smb2_create_reparse_symlink+0x38f/0x490 [cifs]\n   smb2_create_reparse_symlink+0x38f/0x490 [cifs]\n   ? __pfx_smb2_create_reparse_symlink+0x10/0x10 [cifs]\n   ? find_held_lock+0x8a/0xa0\n   ? hlock_class+0x32/0xb0\n   ? __build_path_from_dentry_optional_prefix+0x19d/0x2e0 [cifs]\n   cifs_symlink+0x24f/0x960 [cifs]\n   ? __pfx_make_vfsuid+0x10/0x10\n   ? __pfx_cifs_symlink+0x10/0x10 [cifs]\n   ? make_vfsgid+0x6b/0xc0\n   ? generic_permission+0x96/0x2d0\n   vfs_symlink+0x1a1/0x2c0\n   do_symlinkat+0x108/0x1c0\n   ? __pfx_do_symlinkat+0x10/0x10\n   ? strncpy_from_user+0xaa/0x160\n   __x64_sys_symlinkat+0xb9/0xf0\n   do_syscall_64+0xbb/0x1d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x7f08d75c13bb",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a743556-c4f5-4fc0-b5c7-95aa667bad70",
      "id": "CVE-2024-53174",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: make sure cache entry active before cache_show\n\nThe function `c_show` was called with protection from RCU. This only\nensures that `cp` will not be freed. Therefore, the reference count for\n`cp` can drop to zero, which will trigger a refcount use-after-free\nwarning when `cache_get` is called. To resolve this issue, use\n`cache_get_rcu` to ensure that `cp` remains active.\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 7 PID: 822 at lib/refcount.c:25\nrefcount_warn_saturate+0xb1/0x120\nCPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xb1/0x120\n\nCall Trace:\n \u003cTASK\u003e\n c_show+0x2fc/0x380 [sunrpc]\n seq_read_iter+0x589/0x770\n seq_read+0x1e5/0x270\n proc_reg_read+0xe1/0x140\n vfs_read+0x125/0x530\n ksys_read+0xc1/0x160\n do_syscall_64+0x5f/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad138431-135e-44df-9039-c1ac485e9381",
      "id": "CVE-2024-53239",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: Release resources at card release\n\nThe current 6fire code tries to release the resources right after the\ncall of usb6fire_chip_abort().  But at this moment, the card object\nmight be still in use (as we're calling snd_card_free_when_closed()).\n\nFor avoid potential UAFs, move the release of resources to the card's\nprivate_free instead of the manual call of usb6fire_chip_destroy() at\nthe USB disconnect callback.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ca490bf6-7001-4bfd-a8b1-8eb4810ae2d8",
      "id": "CVE-2024-56600",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: inet6: do not leave a dangling sk pointer in inet6_create()\n\nsock_init_data() attaches the allocated sk pointer to the provided sock\nobject. If inet6_create() fails later, the sk object is released, but the\nsock object retains the dangling sk pointer, which may cause use-after-free\nlater.\n\nClear the sock sk pointer on error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cd304d2-6b6f-4ce2-becb-a4158cf8982c",
      "id": "CVE-2024-56608",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'\n\nAn issue was identified in the dcn21_link_encoder_create function where\nan out-of-bounds access could occur when the hpd_source index was used\nto reference the link_enc_hpd_regs array. This array has a fixed size\nand the index was not being checked against the array's bounds before\naccessing it.\n\nThis fix adds a conditional check to ensure that the hpd_source index is\nwithin the valid range of the link_enc_hpd_regs array. If the index is\nout of bounds, the function now returns NULL to prevent undefined\nbehavior.\n\nReferences:\n\n[   65.920507] ------------[ cut here ]------------\n[   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29\n[   65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]'\n[   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13\n[   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020\n[   65.920527] Call Trace:\n[   65.920529]  \u003cTASK\u003e\n[   65.920532]  dump_stack_lvl+0x48/0x70\n[   65.920541]  dump_stack+0x10/0x20\n[   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0\n[   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu]\n[   65.921009]  link_create+0x6d3/0xed0 [amdgpu]\n[   65.921355]  create_links+0x18a/0x4e0 [amdgpu]\n[   65.921679]  dc_create+0x360/0x720 [amdgpu]\n[   65.921999]  ? dmi_matches+0xa0/0x220\n[   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu]\n[   65.922342]  ? console_unlock+0x77/0x120\n[   65.922348]  ? dev_printk_emit+0x86/0xb0\n[   65.922354]  dm_hw_init+0x15/0x40 [amdgpu]\n[   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu]\n[   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu]\n[   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu]\n[   65.923087]  local_pci_probe+0x4b/0xb0\n[   65.923087]  pci_device_probe+0xc8/0x280\n[   65.923087]  really_probe+0x187/0x300\n[   65.923087]  __driver_probe_device+0x85/0x130\n[   65.923087]  driver_probe_device+0x24/0x110\n[   65.923087]  __driver_attach+0xac/0x1d0\n[   65.923087]  ? __pfx___driver_attach+0x10/0x10\n[   65.923087]  bus_for_each_dev+0x7d/0xd0\n[   65.923087]  driver_attach+0x1e/0x30\n[   65.923087]  bus_add_driver+0xf2/0x200\n[   65.923087]  driver_register+0x64/0x130\n[   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu]\n[   65.923087]  __pci_register_driver+0x61/0x70\n[   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu]\n[   65.923087]  do_one_initcall+0x49/0x310\n[   65.923087]  ? kmalloc_trace+0x136/0x360\n[   65.923087]  do_init_module+0x6a/0x270\n[   65.923087]  load_module+0x1fce/0x23a0\n[   65.923087]  init_module_from_file+0x9c/0xe0\n[   65.923087]  ? init_module_from_file+0x9c/0xe0\n[   65.923087]  idempotent_init_module+0x179/0x230\n[   65.923087]  __x64_sys_finit_module+0x5d/0xa0\n[   65.923087]  do_syscall_64+0x76/0x120\n[   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   65.923087] RIP: 0033:0x7f2d80f1e88d\n[   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139\n[   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d\n[   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f\n[   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002\n[   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480\n[   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0\n[   65.923087]  \u003c/TASK\u003e\n[   65.923927] ---[ end trace ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5b5ecee-d8d2-4af8-96c6-96b5d4dd8c43",
      "id": "CVE-2024-56658",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: defer final 'struct net' free in netns dismantle\n\nIlya reported a slab-use-after-free in dst_destroy [1]\n\nIssue is in xfrm6_net_init() and xfrm4_net_init() :\n\nThey copy xfrm[46]_dst_ops_template into net-\u003exfrm.xfrm[46]_dst_ops.\n\nBut net structure might be freed before all the dst callbacks are\ncalled. So when dst_destroy() calls later :\n\nif (dst-\u003eops-\u003edestroy)\n    dst-\u003eops-\u003edestroy(dst);\n\ndst-\u003eops points to the old net-\u003exfrm.xfrm[46]_dst_ops, which has been freed.\n\nSee a relevant issue fixed in :\n\nac888d58869b (\"net: do not delay dst_entries_add() in dst_release()\")\n\nA fix is to queue the 'struct net' to be freed after one\nanother cleanup_net() round (and existing rcu_barrier())\n\n[1]\n\nBUG: KASAN: slab-use-after-free in dst_destroy (net/core/dst.c:112)\nRead of size 8 at addr ffff8882137ccab0 by task swapper/37/0\nDec 03 05:46:18 kernel:\nCPU: 37 UID: 0 PID: 0 Comm: swapper/37 Kdump: loaded Not tainted 6.12.0 #67\nHardware name: Red Hat KVM/RHEL, BIOS 1.16.1-1.el9 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\ndump_stack_lvl (lib/dump_stack.c:124)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\n? dst_destroy (net/core/dst.c:112)\nprint_report (mm/kasan/report.c:489)\n? dst_destroy (net/core/dst.c:112)\n? kasan_addr_to_slab (mm/kasan/common.c:37)\nkasan_report (mm/kasan/report.c:603)\n? dst_destroy (net/core/dst.c:112)\n? rcu_do_batch (kernel/rcu/tree.c:2567)\ndst_destroy (net/core/dst.c:112)\nrcu_do_batch (kernel/rcu/tree.c:2567)\n? __pfx_rcu_do_batch (kernel/rcu/tree.c:2491)\n? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4339 kernel/locking/lockdep.c:4406)\nrcu_core (kernel/rcu/tree.c:2825)\nhandle_softirqs (kernel/softirq.c:554)\n__irq_exit_rcu (kernel/softirq.c:589 kernel/softirq.c:428 kernel/softirq.c:637)\nirq_exit_rcu (kernel/softirq.c:651)\nsysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1049 arch/x86/kernel/apic/apic.c:1049)\n \u003c/IRQ\u003e\n \u003cTASK\u003e\nasm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702)\nRIP: 0010:default_idle (./arch/x86/include/asm/irqflags.h:37 ./arch/x86/include/asm/irqflags.h:92 arch/x86/kernel/process.c:743)\nCode: 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 6e ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 0f 00 2d c7 c9 27 00 fb f4 \u003cfa\u003e c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90\nRSP: 0018:ffff888100d2fe00 EFLAGS: 00000246\nRAX: 00000000001870ed RBX: 1ffff110201a5fc2 RCX: ffffffffb61a3e46\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffb3d4d123\nRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed11c7e1835d\nR10: ffff888e3f0c1aeb R11: 0000000000000000 R12: 0000000000000000\nR13: ffff888100d20000 R14: dffffc0000000000 R15: 0000000000000000\n? ct_kernel_exit.constprop.0 (kernel/context_tracking.c:148)\n? cpuidle_idle_call (kernel/sched/idle.c:186)\ndefault_idle_call (./include/linux/cpuidle.h:143 kernel/sched/idle.c:118)\ncpuidle_idle_call (kernel/sched/idle.c:186)\n? __pfx_cpuidle_idle_call (kernel/sched/idle.c:168)\n? lock_release (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5848)\n? lockdep_hardirqs_on_prepare (kernel/locking/lockdep.c:4347 kernel/locking/lockdep.c:4406)\n? tsc_verify_tsc_adjust (arch/x86/kernel/tsc_sync.c:59)\ndo_idle (kernel/sched/idle.c:326)\ncpu_startup_entry (kernel/sched/idle.c:423 (discriminator 1))\nstart_secondary (arch/x86/kernel/smpboot.c:202 arch/x86/kernel/smpboot.c:282)\n? __pfx_start_secondary (arch/x86/kernel/smpboot.c:232)\n? soft_restart_cpu (arch/x86/kernel/head_64.S:452)\ncommon_startup_64 (arch/x86/kernel/head_64.S:414)\n \u003c/TASK\u003e\nDec 03 05:46:18 kernel:\nAllocated by task 12184:\nkasan_save_stack (mm/kasan/common.c:48)\nkasan_save_track (./arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69)\n__kasan_slab_alloc (mm/kasan/common.c:319 mm/kasan/common.c:345)\nkmem_cache_alloc_noprof (mm/slub.c:4085 mm/slub.c:4134 mm/slub.c:4141)\ncopy_net_ns (net/core/net_namespace.c:421 net/core/net_namespace.c:480)\ncreate_new_namespaces\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5ed5861-31e5-4866-acb4-c8868e13cf98",
      "id": "CVE-2025-38259",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: wcd9335: Fix missing free of regulator supplies\n\nDriver gets and enables all regulator supplies in probe path\n(wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup\nin final error paths and in unbind (missing remove() callback).  This\nleads to leaked memory and unbalanced regulator enable count during\nprobe errors or unbind.\n\nFix this by converting entire code into devm_regulator_bulk_get_enable()\nwhich also greatly simplifies the code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc5f5895-7a57-4403-9262-0cea84cb51c8",
      "id": "CVE-2024-56785",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a\n\nFix the dtc warnings:\n\n    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider\n    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider\n    arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'\n\nAnd a runtime warning introduced in commit 045b14ca5c36 (\"of: WARN on\ndeprecated #address-cells/#size-cells handling\"):\n\n    WARNING: CPU: 0 PID: 1 at drivers/of/base.c:106 of_bus_n_addr_cells+0x9c/0xe0\n    Missing '#address-cells' in /bus@10000000/pci@1a000000/pci_bridge@9,0\n\nThe fix is similar to commit d89a415ff8d5 (\"MIPS: Loongson64: DTS: Fix PCIe\nport nodes for ls7a\"), which has fixed the issue for ls2k (despite its\nsubject mentions ls7a).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c0fd830f-b9aa-45dd-a0c5-0ac586e8c7f4",
      "id": "CVE-2024-57896",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: flush delalloc workers queue before stopping cleaner kthread during unmount\n\nDuring the unmount path, at close_ctree(), we first stop the cleaner\nkthread, using kthread_stop() which frees the associated task_struct, and\nthen stop and destroy all the work queues. However after we stopped the\ncleaner we may still have a worker from the delalloc_workers queue running\ninode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(),\nwhich in turn tries to wake up the cleaner kthread - which was already\ndestroyed before, resulting in a use-after-free on the task_struct.\n\nSyzbot reported this with the following stack traces:\n\n  BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089\n  Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52\n\n  CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  Workqueue: btrfs-delalloc btrfs_work_helper\n  Call Trace:\n   \u003cTASK\u003e\n   __dump_stack lib/dump_stack.c:94 [inline]\n   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n   print_address_description mm/kasan/report.c:378 [inline]\n   print_report+0x169/0x550 mm/kasan/report.c:489\n   kasan_report+0x143/0x180 mm/kasan/report.c:602\n   __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089\n   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n   _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162\n   class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]\n   try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205\n   submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615\n   run_ordered_work fs/btrfs/async-thread.c:288 [inline]\n   btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324\n   process_one_work kernel/workqueue.c:3229 [inline]\n   process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n   worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n   kthread+0x2f0/0x390 kernel/kthread.c:389\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n   \u003c/TASK\u003e\n\n  Allocated by task 2:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   unpoison_slab_object mm/kasan/common.c:319 [inline]\n   __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345\n   kasan_slab_alloc include/linux/kasan.h:250 [inline]\n   slab_post_alloc_hook mm/slub.c:4104 [inline]\n   slab_alloc_node mm/slub.c:4153 [inline]\n   kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205\n   alloc_task_struct_node kernel/fork.c:180 [inline]\n   dup_task_struct+0x57/0x8c0 kernel/fork.c:1113\n   copy_process+0x5d1/0x3d50 kernel/fork.c:2225\n   kernel_clone+0x223/0x870 kernel/fork.c:2807\n   kernel_thread+0x1bc/0x240 kernel/fork.c:2869\n   create_kthread kernel/kthread.c:412 [inline]\n   kthreadd+0x60d/0x810 kernel/kthread.c:767\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n  Freed by task 24:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n   poison_slab_object mm/kasan/common.c:247 [inline]\n   __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n   kasan_slab_free include/linux/kasan.h:233 [inline]\n   slab_free_hook mm/slub.c:2338 [inline]\n   slab_free mm/slub.c:4598 [inline]\n   kmem_cache_free+0x195/0x410 mm/slub.c:4700\n   put_task_struct include/linux/sched/task.h:144 [inline]\n   delayed_put_task_struct+0x125/0x300 kernel/exit.c:227\n   rcu_do_batch kernel/rcu/tree.c:2567 [inline]\n   rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823\n   handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554\n   run_ksoftirqd+0xca/0x130 kernel/softirq.c:943\n  \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e96ec0bb-5a97-41f7-9b5b-cb3da920a4d1",
      "id": "CVE-2024-57948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: check local interfaces before deleting sdata list\n\nsyzkaller reported a corrupted list in ieee802154_if_remove. [1]\n\nRemove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4\nhardware device from the system.\n\nCPU0\t\t\t\t\tCPU1\n====\t\t\t\t\t====\ngenl_family_rcv_msg_doit\t\tieee802154_unregister_hw\nieee802154_del_iface\t\t\tieee802154_remove_interfaces\nrdev_del_virtual_intf_deprecated\tlist_del(\u0026sdata-\u003elist)\nieee802154_if_remove\nlist_del_rcu\n\nThe net device has been unregistered, since the rcu grace period,\nunregistration must be run before ieee802154_if_remove.\n\nTo avoid this issue, add a check for local-\u003einterfaces before deleting\nsdata list.\n\n[1]\nkernel BUG at lib/list_debug.c:58!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nRIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56\nCode: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 \u003c0f\u003e 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7\nRSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246\nRAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d\nR10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000\nR13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0\nFS:  0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __list_del_entry_valid include/linux/list.h:124 [inline]\n __list_del_entry include/linux/list.h:215 [inline]\n list_del_rcu include/linux/rculist.h:157 [inline]\n ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687\n rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline]\n ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]\n netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357\n netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:744\n ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607\n ___sys_sendmsg net/socket.c:2661 [inline]\n __sys_sendmsg+0x292/0x380 net/socket.c:2690\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a66f10cb-c369-46a4-a398-a33c6e45baf7",
      "id": "CVE-2024-58034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()\n\nAs of_find_node_by_name() release the reference of the argument device\nnode, tegra_emc_find_node_by_ram_code() releases some device nodes while\nstill in use, resulting in possible UAFs. According to the bindings and\nthe in-tree DTS files, the \"emc-tables\" node is always device's child\nnode with the property \"nvidia,use-ram-code\", and the \"lpddr2\" node is a\nchild of the \"emc-tables\" node. Thus utilize the\nfor_each_child_of_node() macro and of_get_child_by_name() instead of\nof_find_node_by_name() to simplify the code.\n\nThis bug was found by an experimental verification tool that I am\ndeveloping.\n\n[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d515480f-b017-489f-94e2-d8b5189e6870",
      "id": "CVE-2025-21682",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\n\nRecalculate features when XDP is detached.\n\nBefore:\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n  # ip li set dev eth0 xdp off\n  # ethtool -k eth0 | grep gro\n  rx-gro-hw: off [requested on]\n\nAfter:\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n  # ip li set dev eth0 xdp off\n  # ethtool -k eth0 | grep gro\n  rx-gro-hw: on\n\nThe fact that HW-GRO doesn't get re-enabled automatically is just\na minor annoyance. The real issue is that the features will randomly\ncome back during another reconfiguration which just happens to invoke\nnetdev_update_features(). The driver doesn't handle reconfiguring\ntwo things at a time very robustly.\n\nStarting with commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") we only reconfigure the RSS hash table\nif the \"effective\" number of Rx rings has changed. If HW-GRO is\nenabled \"effective\" number of rings is 2x what user sees.\nSo if we are in the bad state, with HW-GRO re-enablement \"pending\"\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\nand the:\n\n  if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\n\ncondition in __bnxt_reserve_rings() will be false.\nThe RSS map won't get updated, and we'll crash with:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000168\n  RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\n    bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\n    __bnxt_setup_vnic_p5+0x58/0x110\n    bnxt_init_nic+0xb72/0xf50\n    __bnxt_open_nic+0x40d/0xab0\n    bnxt_open_nic+0x2b/0x60\n    ethtool_set_channels+0x18c/0x1d0\n\nAs we try to access a freed ring.\n\nThe issue is present since XDP support was added, really, but\nprior to commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") it wasn't causing major issues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c36a185f-d9c3-4fc9-a402-99d17b1404dd",
      "id": "CVE-2025-22020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove\n\nThis fixes the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\nRead of size 8 at addr ffff888136335380 by task kworker/6:0/140241\n\nCPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G            E      6.14.0-rc6+ #1\nTainted: [E]=UNSIGNED_MODULE\nHardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024\nWorkqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x51/0x70\n print_address_description.constprop.0+0x27/0x320\n ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\n print_report+0x3e/0x70\n kasan_report+0xab/0xe0\n ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\n rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms]\n ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms]\n ? __pfx___schedule+0x10/0x10\n ? kick_pool+0x3b/0x270\n process_one_work+0x357/0x660\n worker_thread+0x390/0x4c0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x190/0x1d0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 161446:\n kasan_save_stack+0x20/0x40\n kasan_save_track+0x10/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x1a7/0x470\n memstick_alloc_host+0x1f/0xe0 [memstick]\n rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms]\n platform_probe+0x60/0xe0\n call_driver_probe+0x35/0x120\n really_probe+0x123/0x410\n __driver_probe_device+0xc7/0x1e0\n driver_probe_device+0x49/0xf0\n __device_attach_driver+0xc6/0x160\n bus_for_each_drv+0xe4/0x160\n __device_attach+0x13a/0x2b0\n bus_probe_device+0xbd/0xd0\n device_add+0x4a5/0x760\n platform_device_add+0x189/0x370\n mfd_add_device+0x587/0x5e0\n mfd_add_devices+0xb1/0x130\n rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb]\n usb_probe_interface+0x15c/0x460\n call_driver_probe+0x35/0x120\n really_probe+0x123/0x410\n __driver_probe_device+0xc7/0x1e0\n driver_probe_device+0x49/0xf0\n __device_attach_driver+0xc6/0x160\n bus_for_each_drv+0xe4/0x160\n __device_attach+0x13a/0x2b0\n rebind_marked_interfaces.isra.0+0xcc/0x110\n usb_reset_device+0x352/0x410\n usbdev_do_ioctl+0xe5c/0x1860\n usbdev_ioctl+0xa/0x20\n __x64_sys_ioctl+0xc5/0xf0\n do_syscall_64+0x59/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 161506:\n kasan_save_stack+0x20/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x36/0x60\n __kasan_slab_free+0x34/0x50\n kfree+0x1fd/0x3b0\n device_release+0x56/0xf0\n kobject_cleanup+0x73/0x1c0\n rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms]\n platform_remove+0x2f/0x50\n device_release_driver_internal+0x24b/0x2e0\n bus_remove_device+0x124/0x1d0\n device_del+0x239/0x530\n platform_device_del.part.0+0x19/0xe0\n platform_device_unregister+0x1c/0x40\n mfd_remove_devices_fn+0x167/0x170\n device_for_each_child_reverse+0xc9/0x130\n mfd_remove_devices+0x6e/0xa0\n rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb]\n usb_unbind_interface+0xf3/0x3f0\n device_release_driver_internal+0x24b/0x2e0\n proc_disconnect_claim+0x13d/0x220\n usbdev_do_ioctl+0xb5e/0x1860\n usbdev_ioctl+0xa/0x20\n __x64_sys_ioctl+0xc5/0xf0\n do_syscall_64+0x59/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nLast potentially related work creation:\n kasan_save_stack+0x20/0x40\n kasan_record_aux_stack+0x85/0x90\n insert_work+0x29/0x100\n __queue_work+0x34a/0x540\n call_timer_fn+0x2a/0x160\n expire_timers+0x5f/0x1f0\n __run_timer_base.part.0+0x1b6/0x1e0\n run_timer_softirq+0x8b/0xe0\n handle_softirqs+0xf9/0x360\n __irq_exit_rcu+0x114/0x130\n sysvec_apic_timer_interrupt+0x72/0x90\n asm_sysvec_apic_timer_interrupt+0x16/0x20\n\nSecond to last potentially related work creation:\n kasan_save_stack+0x20/0x40\n kasan_record_aux_stack+0x85/0x90\n insert_work+0x29/0x100\n __queue_work+0x34a/0x540\n call_timer_fn+0x2a/0x160\n expire_timers+0x5f/0x1f0\n __run_timer_base.part.0+0x1b6/0x1e0\n run_timer_softirq+0x8b/0xe0\n handle_softirqs+0xf9/0x\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5495882-20b6-4081-acec-dc625d03b27a",
      "id": "CVE-2025-21776",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: hub: Ignore non-compliant devices with too many configs or interfaces\n\nRobert Morris created a test program which can cause\nusb_hub_to_struct_hub() to dereference a NULL or inappropriate\npointer:\n\nOops: general protection fault, probably for non-canonical address\n0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI\nCPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14\nHardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110\n...\nCall Trace:\n \u003cTASK\u003e\n ? die_addr+0x31/0x80\n ? exc_general_protection+0x1b4/0x3c0\n ? asm_exc_general_protection+0x26/0x30\n ? usb_hub_adjust_deviceremovable+0x78/0x110\n hub_probe+0x7c7/0xab0\n usb_probe_interface+0x14b/0x350\n really_probe+0xd0/0x2d0\n ? __pfx___device_attach_driver+0x10/0x10\n __driver_probe_device+0x6e/0x110\n driver_probe_device+0x1a/0x90\n __device_attach_driver+0x7e/0xc0\n bus_for_each_drv+0x7f/0xd0\n __device_attach+0xaa/0x1a0\n bus_probe_device+0x8b/0xa0\n device_add+0x62e/0x810\n usb_set_configuration+0x65d/0x990\n usb_generic_driver_probe+0x4b/0x70\n usb_probe_device+0x36/0xd0\n\nThe cause of this error is that the device has two interfaces, and the\nhub driver binds to interface 1 instead of interface 0, which is where\nusb_hub_to_struct_hub() looks.\n\nWe can prevent the problem from occurring by refusing to accept hub\ndevices that violate the USB spec by having more than one\nconfiguration or interface.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c2afc13-3713-4fdd-b315-b3f4722a5090",
      "id": "CVE-2025-22005",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().\n\nfib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything\nwhen it fails.\n\nCommit 7dd73168e273 (\"ipv6: Always allocate pcpu memory in a fib6_nh\")\nmoved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init()\nbut forgot to add cleanup for fib6_nh-\u003enh_common.nhc_pcpu_rth_output in\ncase it fails to allocate fib6_nh-\u003ert6i_pcpu, resulting in memleak.\n\nLet's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the\nerror path.\n\nNote that we can remove the fib6_nh_release() call in nh_create_ipv6()\nlater in net-next.git.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f7b310d-bfb9-4fd2-8da3-7d0f62d113cd",
      "id": "CVE-2025-22055",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix geneve_opt length integer overflow\n\nstruct geneve_opt uses 5 bit length for each single option, which\nmeans every vary size option should be smaller than 128 bytes.\n\nHowever, all current related Netlink policies cannot promise this\nlength condition and the attacker can exploit a exact 128-byte size\noption to *fake* a zero length option and confuse the parsing logic,\nfurther achieve heap out-of-bounds read.\n\nOne example crash log is like below:\n\n[    3.905425] ==================================================================\n[    3.905925] BUG: KASAN: slab-out-of-bounds in nla_put+0xa9/0xe0\n[    3.906255] Read of size 124 at addr ffff888005f291cc by task poc/177\n[    3.906646]\n[    3.906775] CPU: 0 PID: 177 Comm: poc-oob-read Not tainted 6.1.132 #1\n[    3.907131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n[    3.907784] Call Trace:\n[    3.907925]  \u003cTASK\u003e\n[    3.908048]  dump_stack_lvl+0x44/0x5c\n[    3.908258]  print_report+0x184/0x4be\n[    3.909151]  kasan_report+0xc5/0x100\n[    3.909539]  kasan_check_range+0xf3/0x1a0\n[    3.909794]  memcpy+0x1f/0x60\n[    3.909968]  nla_put+0xa9/0xe0\n[    3.910147]  tunnel_key_dump+0x945/0xba0\n[    3.911536]  tcf_action_dump_1+0x1c1/0x340\n[    3.912436]  tcf_action_dump+0x101/0x180\n[    3.912689]  tcf_exts_dump+0x164/0x1e0\n[    3.912905]  fw_dump+0x18b/0x2d0\n[    3.913483]  tcf_fill_node+0x2ee/0x460\n[    3.914778]  tfilter_notify+0xf4/0x180\n[    3.915208]  tc_new_tfilter+0xd51/0x10d0\n[    3.918615]  rtnetlink_rcv_msg+0x4a2/0x560\n[    3.919118]  netlink_rcv_skb+0xcd/0x200\n[    3.919787]  netlink_unicast+0x395/0x530\n[    3.921032]  netlink_sendmsg+0x3d0/0x6d0\n[    3.921987]  __sock_sendmsg+0x99/0xa0\n[    3.922220]  __sys_sendto+0x1b7/0x240\n[    3.922682]  __x64_sys_sendto+0x72/0x90\n[    3.922906]  do_syscall_64+0x5e/0x90\n[    3.923814]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[    3.924122] RIP: 0033:0x7e83eab84407\n[    3.924331] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 \u003c5b\u003e c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf\n[    3.925330] RSP: 002b:00007ffff505e370 EFLAGS: 00000202 ORIG_RAX: 000000000000002c\n[    3.925752] RAX: ffffffffffffffda RBX: 00007e83eaafa740 RCX: 00007e83eab84407\n[    3.926173] RDX: 00000000000001a8 RSI: 00007ffff505e3c0 RDI: 0000000000000003\n[    3.926587] RBP: 00007ffff505f460 R08: 00007e83eace1000 R09: 000000000000000c\n[    3.926977] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffff505f3c0\n[    3.927367] R13: 00007ffff505f5c8 R14: 00007e83ead1b000 R15: 00005d4fbbe6dcb8\n\nFix these issues by enforing correct length condition in related\npolicies.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d114f6c-8011-48b9-b536-24ecf77b1f4c",
      "id": "CVE-2025-23150",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix off-by-one error in do_split\n\nSyzkaller detected a use-after-free issue in ext4_insert_dentry that was\ncaused by out-of-bounds access due to incorrect splitting in do_split.\n\nBUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\nWrite of size 251 at addr ffff888074572f14 by task syz-executor335/5847\n\nCPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106\n ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109\n add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154\n make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455\n ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796\n ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431\n vfs_symlink+0x137/0x2e0 fs/namei.c:4615\n do_symlinkat+0x222/0x3a0 fs/namei.c:4641\n __do_sys_symlink fs/namei.c:4662 [inline]\n __se_sys_symlink fs/namei.c:4660 [inline]\n __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nThe following loop is located right above 'if' statement.\n\nfor (i = count-1; i \u003e= 0; i--) {\n\t/* is more than half of this entry in 2nd half of the block? */\n\tif (size + map[i].size/2 \u003e blocksize/2)\n\t\tbreak;\n\tsize += map[i].size;\n\tmove++;\n}\n\n'i' in this case could go down to -1, in which case sum of active entries\nwouldn't exceed half the block size, but previous behaviour would also do\nsplit in half if sum would exceed at the very last block, which in case of\nhaving too many long name files in a single block could lead to\nout-of-bounds access and following use-after-free.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d229b06-1521-4e01-942e-4832827c6781",
      "id": "CVE-2025-37932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_htb: make htb_qlen_notify() idempotent\n\nhtb_qlen_notify() always deactivates the HTB class and in fact could\ntrigger a warning if it is already deactivated. Therefore, it is not\nidempotent and not friendly to its callers, like fq_codel_dequeue().\n\nLet's make it idempotent to ease qdisc_tree_reduce_backlog() callers'\nlife.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e64beaf-8c63-4c5c-99b9-5de8c2a9cf01",
      "id": "CVE-2025-38237",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()\n\nIn fimc_is_hw_change_mode(), the function changes camera modes without\nwaiting for hardware completion, risking corrupted data or system hangs\nif subsequent operations proceed before the hardware is ready.\n\nAdd fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring\nhardware state synchronization and stable interrupt handling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be73e59d-d7d5-4132-9049-4eb10a9a5f2b",
      "id": "CVE-2025-38286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: at91: Fix possible out-of-boundary access\n\nat91_gpio_probe() doesn't check that given OF alias is not available or\nsomething went wrong when trying to get it. This might have consequences\nwhen accessing gpio_chips array with that value as an index. Note, that\nBUG() can be compiled out and hence won't actually perform the required\nchecks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0e630d6-4e66-4df7-8739-913bec9b577b",
      "id": "CVE-2025-38424",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix sample vs do_exit()\n\nBaisheng Gao reported an ARM64 crash, which Mark decoded as being a\nsynchronous external abort -- most likely due to trying to access\nMMIO in bad ways.\n\nThe crash further shows perf trying to do a user stack sample while in\nexit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address\nspace it is trying to access.\n\nIt turns out that we stop perf after we tear down the userspace mm; a\nreceipie for disaster, since perf likes to access userspace for\nvarious reasons.\n\nFlip this order by moving up where we stop perf in do_exit().\n\nAdditionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER\nto abort when the current task does not have an mm (exit_mm() makes\nsure to set current-\u003emm = NULL; before commencing with the actual\nteardown). Such that CPU wide events don't trip on this same problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a767486-7526-4540-baea-69433a27af4f",
      "id": "CVE-2025-38639",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_nfacct: don't assume acct name is null-terminated\n\nBUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721\nRead of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851\n[..]\n string+0x231/0x2b0 lib/vsprintf.c:721\n vsnprintf+0x739/0xf00 lib/vsprintf.c:2874\n [..]\n nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41\n xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523\n\nnfnl_acct_find_get() handles non-null input, but the error\nprintk relied on its presence.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa9588a6-eee0-476b-bf17-7aa7deda73da",
      "id": "CVE-2022-49345",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xfrm: unexport __init-annotated xfrm4_protocol_init()\n\nEXPORT_SYMBOL and __init is a bad combination because the .init.text\nsection is freed up after the initialization. Hence, modules cannot\nuse symbols annotated __init. The access to a freed symbol may end up\nwith kernel panic.\n\nmodpost used to detect it, but it has been broken for a decade.\n\nRecently, I fixed modpost so it started to warn it again, then this\nshowed up in linux-next builds.\n\nThere are two ways to fix it:\n\n  - Remove __init\n  - Remove EXPORT_SYMBOL\n\nI chose the latter for this case because the only in-tree call-site,\nnet/ipv4/xfrm4_policy.c is never compiled as modular.\n(CONFIG_XFRM is boolean)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a71ef4c-bbf1-43b7-a0c2-aca142cc9368",
      "id": "CVE-2025-39863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\n\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\nruns as timer handler, sets timer_on to false. This creates critical\nrace conditions:\n\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\nis executing, it may observe timer_on as false and skip the call to\ntimer_shutdown_sync().\n\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\nworker after the cancel_work_sync() has been executed, resulting in\nuse-after-free bugs.\n\nThe use-after-free bugs occur in two distinct scenarios, depending on\nthe timing of when the brcmf_btcoex_info struct is freed relative to\nthe execution of its worker thread.\n\nScenario 1: Freed before the worker is scheduled\n\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\nA race condition can occur when schedule_work(\u0026bt_local-\u003ework) is\ncalled after the target memory has been freed. The sequence of events\nis detailed below:\n\nCPU0                           | CPU1\nbrcmf_btcoex_detach            | brcmf_btcoex_timerfunc\n                               |   bt_local-\u003etimer_on = false;\n  if (cfg-\u003ebtcoex-\u003etimer_on)   |\n    ...                        |\n  cancel_work_sync();          |\n  ...                          |\n  kfree(cfg-\u003ebtcoex); // FREE  |\n                               |   schedule_work(\u0026bt_local-\u003ework); // USE\n\nScenario 2: Freed after the worker is scheduled\n\nThe brcmf_btcoex_info is freed after the worker has been scheduled\nbut before or during its execution. In this case, statements within\nthe brcmf_btcoex_handler() — such as the container_of macro and\nsubsequent dereferences of the brcmf_btcoex_info object will cause\na use-after-free access. The following timeline illustrates this\nscenario:\n\nCPU0                            | CPU1\nbrcmf_btcoex_detach             | brcmf_btcoex_timerfunc\n                                |   bt_local-\u003etimer_on = false;\n  if (cfg-\u003ebtcoex-\u003etimer_on)    |\n    ...                         |\n  cancel_work_sync();           |\n  ...                           |   schedule_work(); // Reschedule\n                                |\n  kfree(cfg-\u003ebtcoex); // FREE   |   brcmf_btcoex_handler() // Worker\n  /*                            |     btci = container_of(....); // USE\n   The kfree() above could      |     ...\n   also occur at any point      |     btci-\u003e // USE\n   during the worker's execution|\n   */                           |\n\nTo resolve the race conditions, drop the conditional check and call\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\nregardless of its current state. Once stopped, the timer_on state is\nthen set to false.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "973ff1a6-1e47-4805-830e-8d55e74caaa5",
      "id": "CVE-2020-10781",
      "description": "A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3af455b1-3503-4dd6-8db1-e79206686ddf",
      "id": "CVE-2020-14386",
      "description": "A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d0d1851-4f4c-4304-9135-c1c9fc5c5fe2",
      "id": "CVE-2020-25639",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27af42a6-9f34-4c98-b7e6-31024a27974f",
      "id": "CVE-2020-8992",
      "description": "ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58307860-debd-48ea-8911-b847db9cd864",
      "id": "CVE-2022-49197",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_netlink: Fix shift out of bounds in group mask calculation\n\nWhen a netlink message is received, netlink_recvmsg() fills in the address\nof the sender. One of the fields is the 32-bit bitfield nl_groups, which\ncarries the multicast group on which the message was received. The least\nsignificant bit corresponds to group 1, and therefore the highest group\nthat the field can represent is 32. Above that, the UB sanitizer flags the\nout-of-bounds shift attempts.\n\nWhich bits end up being set in such case is implementation defined, but\nit's either going to be a wrong non-zero value, or zero, which is at least\nnot misleading. Make the latter choice deterministic by always setting to 0\nfor higher-numbered multicast groups.\n\nTo get information about membership in groups \u003e= 32, userspace is expected\nto use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO\nsocket option.\n[0] https://lwn.net/Articles/147608/\n\nThe way to trigger this issue is e.g. through monitoring the BRVLAN group:\n\n\t# bridge monitor vlan \u0026\n\t# ip link add name br type bridge\n\nWhich produces the following citation:\n\n\tUBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19\n\tshift exponent 32 is too large for 32-bit type 'int'",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c7d4b9b-d6ed-438d-85e1-e3be14b9890d",
      "id": "CVE-2021-4148",
      "description": "A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bc0ed15-edf3-4bd3-ab0f-28e2462e15b9",
      "id": "CVE-2021-47016",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nm68k: mvme147,mvme16x: Don't wipe PCC timer config bits\n\nDon't clear the timer 1 configuration bits when clearing the interrupt flag\nand counter overflow. As Michael reported, \"This results in no timer\ninterrupts being delivered after the first. Initialization then hangs\nin calibrate_delay as the jiffies counter is not updated.\"\n\nOn mvme16x, enable the timer after requesting the irq, consistent with\nmvme147.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e2a2507-c508-4f0f-a804-b49f26d5db90",
      "id": "CVE-2021-47475",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix transfer-buffer overflows\n\nThe driver uses endpoint-sized USB transfer buffers but up until\nrecently had no sanity checks on the sizes.\n\nCommit e1f13c879a7c (\"staging: comedi: check validity of wMaxPacketSize\nof usb endpoints found\") inadvertently fixed NULL-pointer dereferences\nwhen accessing the transfer buffers in case a malicious device has a\nzero wMaxPacketSize.\n\nMake sure to allocate buffers large enough to handle also the other\naccesses that are done without a size check (e.g. byte 18 in\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\nthe buffers, for example, when doing descriptor fuzzing.\n\nThe original driver was for a low-speed device with 8-byte buffers.\nSupport was later added for a device that uses bulk transfers and is\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db9b55ac-00e5-40d8-8737-cdf43498343f",
      "id": "CVE-2021-47582",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Make do_proc_control() and do_proc_bulk() killable\n\nThe USBDEVFS_CONTROL and USBDEVFS_BULK ioctls invoke\nusb_start_wait_urb(), which contains an uninterruptible wait with a\nuser-specified timeout value.  If timeout value is very large and the\ndevice being accessed does not respond in a reasonable amount of time,\nthe kernel will complain about \"Task X blocked for more than N\nseconds\", as found in testing by syzbot:\n\nINFO: task syz-executor.0:8700 blocked for more than 143 seconds.\n      Not tainted 5.14.0-rc7-syzkaller #0\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:syz-executor.0  state:D stack:23192 pid: 8700 ppid:  8455 flags:0x00004004\nCall Trace:\n context_switch kernel/sched/core.c:4681 [inline]\n __schedule+0xc07/0x11f0 kernel/sched/core.c:5938\n schedule+0x14b/0x210 kernel/sched/core.c:6017\n schedule_timeout+0x98/0x2f0 kernel/time/timer.c:1857\n do_wait_for_common+0x2da/0x480 kernel/sched/completion.c:85\n __wait_for_common kernel/sched/completion.c:106 [inline]\n wait_for_common kernel/sched/completion.c:117 [inline]\n wait_for_completion_timeout+0x46/0x60 kernel/sched/completion.c:157\n usb_start_wait_urb+0x167/0x550 drivers/usb/core/message.c:63\n do_proc_bulk+0x978/0x1080 drivers/usb/core/devio.c:1236\n proc_bulk drivers/usb/core/devio.c:1273 [inline]\n usbdev_do_ioctl drivers/usb/core/devio.c:2547 [inline]\n usbdev_ioctl+0x3441/0x6b10 drivers/usb/core/devio.c:2713\n...\n\nTo fix this problem, this patch replaces usbfs's calls to\nusb_control_msg() and usb_bulk_msg() with special-purpose code that\ndoes essentially the same thing (as recommended in the comment for\nusb_start_wait_urb()), except that it always uses a killable wait and\nit uses GFP_KERNEL rather than GFP_NOIO.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56de51bc-3e8d-4417-a163-6b21d6a69bf0",
      "id": "CVE-2022-2503",
      "description": "Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "687e5d1a-91bb-428b-a3a0-d57edd25a89d",
      "id": "CVE-2022-3110",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc720ce8-7a93-4ffa-a44d-e1a8d1b36dec",
      "id": "CVE-2022-49075",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix qgroup reserve overflow the qgroup limit\n\nWe use extent_changeset-\u003ebytes_changed in qgroup_reserve_data() to record\nhow many bytes we set for EXTENT_QGROUP_RESERVED state. Currently the\nbytes_changed is set as \"unsigned int\", and it will overflow if we try to\nfallocate a range larger than 4GiB. The result is we reserve less bytes\nand eventually break the qgroup limit.\n\nUnlike regular buffered/direct write, which we use one changeset for\neach ordered extent, which can never be larger than 256M.  For\nfallocate, we use one changeset for the whole range, thus it no longer\nrespects the 256M per extent limit, and caused the problem.\n\nThe following example test script reproduces the problem:\n\n  $ cat qgroup-overflow.sh\n  #!/bin/bash\n\n  DEV=/dev/sdj\n  MNT=/mnt/sdj\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  # Set qgroup limit to 2GiB.\n  btrfs quota enable $MNT\n  btrfs qgroup limit 2G $MNT\n\n  # Try to fallocate a 3GiB file. This should fail.\n  echo\n  echo \"Try to fallocate a 3GiB file...\"\n  fallocate -l 3G $MNT/3G.file\n\n  # Try to fallocate a 5GiB file.\n  echo\n  echo \"Try to fallocate a 5GiB file...\"\n  fallocate -l 5G $MNT/5G.file\n\n  # See we break the qgroup limit.\n  echo\n  sync\n  btrfs qgroup show -r $MNT\n\n  umount $MNT\n\nWhen running the test:\n\n  $ ./qgroup-overflow.sh\n  (...)\n\n  Try to fallocate a 3GiB file...\n  fallocate: fallocate failed: Disk quota exceeded\n\n  Try to fallocate a 5GiB file...\n\n  qgroupid         rfer         excl     max_rfer\n  --------         ----         ----     --------\n  0/5           5.00GiB      5.00GiB      2.00GiB\n\nSince we have no control of how bytes_changed is used, it's better to\nset it to u64.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f723b39-e273-46f0-a646-736de6383b07",
      "id": "CVE-2022-49122",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: prevent potential spectre v1 gadget\n\nIt appears like cmd could be a Spectre v1 gadget as it's supplied by a\nuser and used as an array index. Prevent the contents of kernel memory\nfrom being leaked to userspace via speculative execution by using\narray_index_nospec.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d237f338-883a-495d-9780-af538ddbf658",
      "id": "CVE-2022-49339",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: unexport __init-annotated seg6_hmac_init()\n\nEXPORT_SYMBOL and __init is a bad combination because the .init.text\nsection is freed up after the initialization. Hence, modules cannot\nuse symbols annotated __init. The access to a freed symbol may end up\nwith kernel panic.\n\nmodpost used to detect it, but it has been broken for a decade.\n\nRecently, I fixed modpost so it started to warn it again, then this\nshowed up in linux-next builds.\n\nThere are two ways to fix it:\n\n  - Remove __init\n  - Remove EXPORT_SYMBOL\n\nI chose the latter for this case because the caller (net/ipv6/seg6.c)\nand the callee (net/ipv6/seg6_hmac.c) belong to the same module.\nIt seems an internal function call in ipv6.ko.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6e6c2e9-2216-45ac-bc7b-e9ada3d1d717",
      "id": "CVE-2022-49343",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid cycles in directory h-tree\n\nA maliciously corrupted filesystem can contain cycles in the h-tree\nstored inside a directory. That can easily lead to the kernel corrupting\ntree nodes that were already verified under its hands while doing a node\nsplit and consequently accessing unallocated memory. Fix the problem by\nverifying traversed block numbers are unique.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b595fdc-debe-4de3-87e7-a2549a864162",
      "id": "CVE-2022-49569",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers\n\nIn case a IRQ based transfer times out the bcm2835_spi_handle_err()\nfunction is called. Since commit 1513ceee70f2 (\"spi: bcm2835: Drop\ndma_pending flag\") the TX and RX DMA transfers are unconditionally\ncanceled, leading to NULL pointer derefs if ctlr-\u003edma_tx or\nctlr-\u003edma_rx are not set.\n\nFix the NULL pointer deref by checking that ctlr-\u003edma_tx and\nctlr-\u003edma_rx are valid pointers before accessing them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39f606fb-201b-4697-9bc8-5cb493befee1",
      "id": "CVE-2022-49599",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_l3mdev_accept.\n\nWhile reading sysctl_tcp_l3mdev_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e990ff7b-860f-41dd-a121-5db974f45765",
      "id": "CVE-2022-49829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/scheduler: fix fence ref counting\n\nWe leaked dependency fences when processes were beeing killed.\n\nAdditional to that grab a reference to the last scheduled fence.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4574820-53ca-412b-bd01-6fc0a4bde6d4",
      "id": "CVE-2022-50101",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: vt8623fb: Check the size of screen before memset_io()\n\nIn the function vt8623fb_set_par(), the value of 'screen_size' is\ncalculated by the user input. If the user provides the improper value,\nthe value of 'screen_size' may larger than 'info-\u003escreen_size', which\nmay cause the following bug:\n\n[  583.339036] BUG: unable to handle page fault for address: ffffc90005000000\n[  583.339049] #PF: supervisor write access in kernel mode\n[  583.339052] #PF: error_code(0x0002) - not-present page\n[  583.339074] RIP: 0010:memset_orig+0x33/0xb0\n[  583.339110] Call Trace:\n[  583.339118]  vt8623fb_set_par+0x11cd/0x21e0\n[  583.339146]  fb_set_var+0x604/0xeb0\n[  583.339181]  do_fb_ioctl+0x234/0x670\n[  583.339209]  fb_ioctl+0xdd/0x130\n\nFix the this by checking the value of 'screen_size' before memset_io().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f0039b1-c61b-4e17-b5a3-b1fa949fdf03",
      "id": "CVE-2022-50172",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg\n\nFree the skb if mt76u_bulk_msg fails in __mt76x02u_mcu_send_msg routine.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0952e189-d3ae-4c31-8f32-1cf81db89a26",
      "id": "CVE-2022-50246",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpci: fix of node refcount leak in tcpci_register_port()\n\nI got the following report while doing device(mt6370-tcpc) load\ntest with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled:\n\n  OF: ERROR: memory leak, expected refcount 1 instead of 2,\n  of_node_get()/of_node_put() unbalanced - destroy cset entry:\n  attach overlay node /i2c/pmic@34/tcpc/connector\n\nThe 'fwnode' set in tcpci_parse_config() which is called\nin tcpci_register_port(), its node refcount is increased\nin device_get_named_child_node(). It needs be put while\nexiting, so call fwnode_handle_put() in the error path of\ntcpci_register_port() and in tcpci_unregister_port() to\navoid leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56ab7034-f2e6-4505-b71b-bb071424d899",
      "id": "CVE-2022-50344",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix null-ptr-deref in ext4_write_info\n\nI caught a null-ptr-deref bug as follows:\n==================================================================\nKASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]\nCPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339\nRIP: 0010:ext4_write_info+0x53/0x1b0\n[...]\nCall Trace:\n dquot_writeback_dquots+0x341/0x9a0\n ext4_sync_fs+0x19e/0x800\n __sync_filesystem+0x83/0x100\n sync_filesystem+0x89/0xf0\n generic_shutdown_super+0x79/0x3e0\n kill_block_super+0xa1/0x110\n deactivate_locked_super+0xac/0x130\n deactivate_super+0xb6/0xd0\n cleanup_mnt+0x289/0x400\n __cleanup_mnt+0x16/0x20\n task_work_run+0x11c/0x1c0\n exit_to_user_mode_prepare+0x203/0x210\n syscall_exit_to_user_mode+0x5b/0x3a0\n do_syscall_64+0x59/0x70\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n ==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\nexit_to_user_mode_prepare\n task_work_run\n  __cleanup_mnt\n   cleanup_mnt\n    deactivate_super\n     deactivate_locked_super\n      kill_block_super\n       generic_shutdown_super\n        shrink_dcache_for_umount\n         dentry = sb-\u003es_root\n         sb-\u003es_root = NULL              \u003c--- Here set NULL\n        sync_filesystem\n         __sync_filesystem\n          sb-\u003es_op-\u003esync_fs \u003e ext4_sync_fs\n           dquot_writeback_dquots\n            sb-\u003edq_op-\u003ewrite_info \u003e ext4_write_info\n             ext4_journal_start(d_inode(sb-\u003es_root), EXT4_HT_QUOTA, 2)\n              d_inode(sb-\u003es_root)\n               s_root-\u003ed_inode          \u003c--- Null pointer dereference\n\nTo solve this problem, we use ext4_journal_start_sb directly\nto avoid s_root being used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f5cb4923-6f9e-4c9d-94f3-785b741fe07f",
      "id": "CVE-2023-4458",
      "description": "A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0d318a2-61d8-4dfa-ba58-eec1000b8bec",
      "id": "CVE-2023-52741",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata-\u003eread_into_pages()\n\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\n\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\n\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x38/0x4c\n   print_report+0x16f/0x4a6\n   kasan_report+0xb7/0x130\n   readpages_fill_pages+0x14c/0x7e0\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n   \u003c/TASK\u003e\n\n  Allocated by task 2535:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x82/0x90\n   cifs_readdata_direct_alloc+0x2c/0x110\n   cifs_readdata_alloc+0x2d/0x60\n   cifs_readahead+0x393/0xfe0\n   read_pages+0x12f/0x470\n   page_cache_ra_unbounded+0x1b1/0x240\n   filemap_get_pages+0x1c8/0x9a0\n   filemap_read+0x1c0/0x540\n   cifs_strict_readv+0x21b/0x240\n   vfs_read+0x395/0x4b0\n   ksys_read+0xb8/0x150\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n  Freed by task 79:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2e/0x50\n   __kasan_slab_free+0x10e/0x1a0\n   __kmem_cache_free+0x7a/0x1a0\n   cifs_readdata_release+0x49/0x60\n   process_one_work+0x46c/0x760\n   worker_thread+0x2a4/0x6f0\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\n  Last potentially related work creation:\n   kasan_save_stack+0x22/0x50\n   __kasan_record_aux_stack+0x95/0xb0\n   insert_work+0x2b/0x130\n   __queue_work+0x1fe/0x660\n   queue_work_on+0x4b/0x60\n   smb2_readv_callback+0x396/0x800\n   cifs_abort_connection+0x474/0x6a0\n   cifs_reconnect+0x5cb/0xa50\n   cifs_readv_from_socket.cold+0x22/0x6c\n   cifs_read_page_from_socket+0xc1/0x100\n   readpages_fill_pages.cold+0x2f/0x46\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\nThe following function calls will cause UAF of the rdata pointer.\n\nreadpages_fill_pages\n cifs_read_page_from_socket\n  cifs_readv_from_socket\n   cifs_reconnect\n    __cifs_reconnect\n     cifs_abort_connection\n      mid-\u003ecallback() --\u003e smb2_readv_callback\n       queue_work(\u0026rdata-\u003ework)  # if the worker completes first,\n                                 # the rdata is freed\n          cifs_readv_complete\n            kref_put\n              cifs_readdata_release\n                kfree(rdata)\n return rdata-\u003e...               # UAF in readpages_fill_pages()\n\nSimilarly, this problem also occurs in the uncache_fill_pages().\n\nFix this by adjusts the order of condition judgment in the return\nstatement.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd76d0de-8879-4646-8684-3587ce2cfe11",
      "id": "CVE-2023-53010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt: Do not read past the end of test names\n\nTest names were being concatenated based on a offset beyond the end of\nthe first name, which tripped the buffer overflow detection logic:\n\n detected buffer overflow in strnlen\n [...]\n Call Trace:\n bnxt_ethtool_init.cold+0x18/0x18\n\nRefactor struct hwrm_selftest_qlist_output to use an actual array,\nand adjust the concatenation to use snprintf() rather than a series of\nstrncat() calls.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fac6475c-9e3c-4881-959c-b4c65c703566",
      "id": "CVE-2023-53149",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid deadlock in fs reclaim with page writeback\n\nExt4 has a filesystem wide lock protecting ext4_writepages() calls to\navoid races with switching of journalled data flag or inode format. This\nlock can however cause a deadlock like:\n\nCPU0                            CPU1\n\next4_writepages()\n  percpu_down_read(sbi-\u003es_writepages_rwsem);\n                                ext4_change_inode_journal_flag()\n                                  percpu_down_write(sbi-\u003es_writepages_rwsem);\n                                    - blocks, all readers block from now on\n  ext4_do_writepages()\n    ext4_init_io_end()\n      kmem_cache_zalloc(io_end_cachep, GFP_KERNEL)\n        fs_reclaim frees dentry...\n          dentry_unlink_inode()\n            iput() - last ref =\u003e\n              iput_final() - inode dirty =\u003e\n                write_inode_now()...\n                  ext4_writepages() tries to acquire sbi-\u003es_writepages_rwsem\n                    and blocks forever\n\nMake sure we cannot recurse into filesystem reclaim from writeback code\nto avoid the deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37a2ee79-b576-4536-83f1-f84d2d72f8d1",
      "id": "CVE-2023-53254",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncacheinfo: Fix shared_cpu_map to handle shared caches at different levels\n\nThe cacheinfo sets up the shared_cpu_map by checking whether the caches\nwith the same index are shared between CPUs. However, this will trigger\nslab-out-of-bounds access if the CPUs do not have the same cache hierarchy.\nAnother problem is the mismatched shared_cpu_map when the shared cache does\nnot have the same index between CPUs.\n\nCPU0\tI\tD\tL3\nindex\t0\t1\t2\tx\n\t^\t^\t^\t^\nindex\t0\t1\t2\t3\nCPU1\tI\tD\tL2\tL3\n\nThis patch checks each cache is shared with all caches on other CPUs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "448d3881-44e5-4420-a8d5-2ca881875134",
      "id": "CVE-2024-39505",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/komeda: check for error-valued pointer\n\nkomeda_pipeline_get_state() may return an error-valued pointer, thus\ncheck the pointer for negative or null value before dereferencing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e9ad3ce-bf41-4f6e-b5d0-6d668da01097",
      "id": "CVE-2023-53282",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write\n\nDuring the sysfs firmware write process, a use-after-free read warning is\nlogged from the lpfc_wr_object() routine:\n\n  BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc]\n  Use-after-free read at 0x0000000000cf164d (in kfence-#111):\n  lpfc_wr_object+0x235/0x310 [lpfc]\n  lpfc_write_firmware.cold+0x206/0x30d [lpfc]\n  lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc]\n  lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]\n  kernfs_fop_write_iter+0x121/0x1b0\n  new_sync_write+0x11c/0x1b0\n  vfs_write+0x1ef/0x280\n  ksys_write+0x5f/0xe0\n  do_syscall_64+0x59/0x90\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe driver accessed wr_object pointer data, which was initialized into\nmailbox payload memory, after the mailbox object was released back to the\nmailbox pool.\n\nFix by moving the mailbox free calls to the end of the routine ensuring\nthat we don't reference internal mailbox memory after release.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a2d8fec-ff70-4b76-87cc-e1427144b737",
      "id": "CVE-2024-0646",
      "description": "An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63643340-1e28-4fd3-84b9-1c8a51079ebf",
      "id": "CVE-2024-26677",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix delayed ACKs to not set the reference serial number\n\nFix the construction of delayed ACKs to not set the reference serial number\nas they can't be used as an RTT reference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b521407-f47a-4250-811b-9fe464c8a544",
      "id": "CVE-2024-26735",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix possible use-after-free and null-ptr-deref\n\nThe pernet operations structure for the subsystem must be registered\nbefore registering the generic netlink family.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83e455ce-1be9-4214-97ab-fa7f84f62b25",
      "id": "CVE-2024-35867",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_stats_proc_show()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "62be78de-eea0-4f8f-ae1d-336060cb17ce",
      "id": "CVE-2024-26922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\n\nVerify the parameters of\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d5f1e52-57e6-4840-93ef-38a260aea65f",
      "id": "CVE-2024-40988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix UBSAN warning in kv_dpm.c\n\nAdds bounds check for sumo_vid_mapping_entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d6307ac-a6a2-4328-9037-7e56434bff5a",
      "id": "CVE-2024-26931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix command flush on cable pull\n\nSystem crash due to command failed to flush back to SCSI layer.\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n PGD 0 P4D 0\n Oops: 0000 [#1] SMP NOPTI\n CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-372.9.1.el8.x86_64 #1\n Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021\n Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]\n RIP: 0010:__wake_up_common+0x4c/0x190\n Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 \u003c49\u003e 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75\n RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086\n RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320\n RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8\n R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20\n R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  __wake_up_common_lock+0x7c/0xc0\n  qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]\n qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0\n ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]\n qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200.\n  ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]\n qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1\n ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]\n qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0\n  ? __switch_to+0x10c/0x450\n ? process_one_work+0x1a7/0x360\n qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201.\n  ? worker_thread+0x1ce/0x390\n  ? create_worker+0x1a0/0x1a0\n qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70\n  ? kthread+0x10a/0x120\n qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8\n  ? set_kthread_struct+0x40/0x40\n qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed.\n  ? ret_from_fork+0x1f/0x40\n qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout\n\nThe system was under memory stress where driver was not able to allocate an\nSRB to carry out error recovery of cable pull.  The failure to flush causes\nupper layer to start modifying scsi_cmnd.  When the system frees up some\nmemory, the subsequent cable pull trigger another command flush. At this\npoint the driver access a null pointer when attempting to DMA unmap the\nSGL.\n\nAdd a check to make sure commands are flush back on session tear down to\nprevent the null pointer access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e76ec222-61bb-48e9-9431-5e34cf871354",
      "id": "CVE-2024-27000",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: mxs-auart: add spinlock around changing cts state\n\nThe uart_handle_cts_change() function in serial_core expects the caller\nto hold uport-\u003elock. For example, I have seen the below kernel splat,\nwhen the Bluetooth driver is loaded on an i.MX28 board.\n\n    [   85.119255] ------------[ cut here ]------------\n    [   85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec\n    [   85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs\n    [   85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1\n    [   85.151396] Hardware name: Freescale MXS (Device Tree)\n    [   85.156679] Workqueue: hci0 hci_power_on [bluetooth]\n    (...)\n    [   85.191765]  uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4\n    [   85.198787]  mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210\n    (...)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6edb9b2f-8e79-4517-b86d-fa6a4b80e48f",
      "id": "CVE-2024-27395",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Fix Use-After-Free in ovs_ct_exit\n\nSince kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof ovs_ct_limit_exit, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\n\nTo prevent this, it should be changed to hlist_for_each_entry_safe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "129ffea5-4529-4f86-927a-3c98293051bc",
      "id": "CVE-2024-27437",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Disable auto-enable of exclusive INTx IRQ\n\nCurrently for devices requiring masking at the irqchip for INTx, ie.\ndevices without DisINTx support, the IRQ is enabled in request_irq()\nand subsequently disabled as necessary to align with the masked status\nflag.  This presents a window where the interrupt could fire between\nthese events, resulting in the IRQ incrementing the disable depth twice.\nThis would be unrecoverable for a user since the masked flag prevents\nnested enables through vfio.\n\nInstead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx\nis never auto-enabled, then unmask as required.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d2fb666-b11c-420f-9ac7-7b27127d4dd3",
      "id": "CVE-2024-36941",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: don't free NULL coalescing rule\n\nIf the parsing fails, we can dereference a NULL pointer here.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "756dce1b-1424-49cb-a166-2d5e6dd7b001",
      "id": "CVE-2020-27194",
      "description": "An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33b9916c-b9ea-440f-b87f-2d29b2615e9c",
      "id": "CVE-2024-42297",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to don't dirty inode for readonly filesystem\n\nsyzbot reports f2fs bug as below:\n\nkernel BUG at fs/f2fs/inode.c:933!\nRIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933\nCall Trace:\n evict+0x2a4/0x620 fs/inode.c:664\n dispose_list fs/inode.c:697 [inline]\n evict_inodes+0x5f8/0x690 fs/inode.c:747\n generic_shutdown_super+0x9d/0x2c0 fs/super.c:675\n kill_block_super+0x44/0x90 fs/super.c:1667\n kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894\n deactivate_locked_super+0xc1/0x130 fs/super.c:484\n cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256\n task_work_run+0x24a/0x300 kernel/task_work.c:180\n ptrace_notify+0x2cd/0x380 kernel/signal.c:2399\n ptrace_report_syscall include/linux/ptrace.h:411 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]\n syscall_exit_work kernel/entry/common.c:251 [inline]\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]\n syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296\n do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nThe root cause is:\n- do_sys_open\n - f2fs_lookup\n  - __f2fs_find_entry\n   - f2fs_i_depth_write\n    - f2fs_mark_inode_dirty_sync\n     - f2fs_dirty_inode\n      - set_inode_flag(inode, FI_DIRTY_INODE)\n\n- umount\n - kill_f2fs_super\n  - kill_block_super\n   - generic_shutdown_super\n    - sync_filesystem\n    : sb is readonly, skip sync_filesystem()\n    - evict_inodes\n     - iput\n      - f2fs_evict_inode\n       - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE))\n       : trigger kernel panic\n\nWhen we try to repair i_current_depth in readonly filesystem, let's\nskip dirty inode to avoid panic in later f2fs_evict_inode().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e831fb10-5865-436b-9a6c-a1d3d7f6b227",
      "id": "CVE-2024-43841",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: avoid reporting connection success with wrong SSID\n\nWhen user issues a connection with a different SSID than the one\nvirt_wifi has advertised, the __cfg80211_connect_result() will\ntrigger the warning: WARN_ON(bss_not_found).\n\nThe issue is because the connection code in virt_wifi does not\ncheck the SSID from user space (it only checks the BSSID), and\nvirt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS\neven if the SSID is different from the one virt_wifi has advertised.\nEventually cfg80211 won't be able to find the cfg80211_bss and generate\nthe warning.\n\nFixed it by checking the SSID (from user space) in the connection code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a836c738-70e2-4672-929e-aacb648efe3a",
      "id": "CVE-2024-46685",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: single: fix potential NULL dereference in pcs_get_function()\n\npinmux_generic_get_function() can return NULL and the pointer 'function'\nwas dereferenced without checking against NULL. Add checking of pointer\n'function' in pcs_get_function().\n\nFound by code review.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01aba3c3-defb-42e0-b281-36b0f4dbeb93",
      "id": "CVE-2024-58095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add check read-only before txBeginAnon() call\n\nAdded a read-only check before calling `txBeginAnon` in `extAlloc`\nand `extRecord`. This prevents modification attempts on a read-only\nmounted filesystem, avoiding potential errors or crashes.\n\nCall trace:\n txBeginAnon+0xac/0x154\n extAlloc+0xe8/0xdec fs/jfs/jfs_extent.c:78\n jfs_get_block+0x340/0xb98 fs/jfs/inode.c:248\n __block_write_begin_int+0x580/0x166c fs/buffer.c:2128\n __block_write_begin fs/buffer.c:2177 [inline]\n block_write_begin+0x98/0x11c fs/buffer.c:2236\n jfs_write_begin+0x44/0x88 fs/jfs/inode.c:299",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e13029fe-0000-491a-8c55-8bfd6cb60513",
      "id": "CVE-2024-46739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind\n\nFor primary VM Bus channels, primary_channel pointer is always NULL. This\npointer is valid only for the secondary channels. Also, rescind callback\nis meant for primary channels only.\n\nFix NULL pointer dereference by retrieving the device_obj from the parent\nfor the primary channel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8bd48d4-b7ea-4796-8eaf-d989a47a7e95",
      "id": "CVE-2024-49902",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: check if leafidx greater than num leaves per dmap tree\n\nsyzbot report a out of bounds in dbSplit, it because dmt_leafidx greater\nthan num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.\n\nShaggy:\nModified sanity check to apply to control pages as well as leaf pages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e0cbe6b-d4bb-4326-bf22-265342364913",
      "id": "CVE-2024-41042",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: prefer nft_chain_validate\n\nnft_chain_validate already performs loop detection because a cycle will\nresult in a call stack overflow (ctx-\u003elevel \u003e= NFT_JUMP_STACK_SIZE).\n\nIt also follows maps via -\u003evalidate callback in nft_lookup, so there\nappears no reason to iterate the maps again.\n\nnf_tables_check_loops() and all its helper functions can be removed.\nThis improves ruleset load time significantly, from 23s down to 12s.\n\nThis also fixes a crash bug. Old loop detection code can result in\nunbounded recursion:\n\nBUG: TASK stack guard page was hit at ....\nOops: stack guard page: 0000 [#1] PREEMPT SMP KASAN\nCPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1\n[..]\n\nwith a suitable ruleset during validation of register stores.\n\nI can't see any actual reason to attempt to check for this from\nnft_validate_register_store(), at this point the transaction is still in\nprogress, so we don't have a full picture of the rule graph.\n\nFor nf-next it might make sense to either remove it or make this depend\non table-\u003evalidate_state in case we could catch an error earlier\n(for improved error reporting to userspace).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc7935e5-4c7b-459a-83cb-1c60e0675485",
      "id": "CVE-2024-50116",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug due to missing clearing of buffer delay flag\n\nSyzbot reported that after nilfs2 reads a corrupted file system image\nand degrades to read-only, the BUG_ON check for the buffer delay flag\nin submit_bh_wbc() may fail, causing a kernel bug.\n\nThis is because the buffer delay flag is not cleared when clearing the\nbuffer state flags to discard a page/folio or a buffer head. So, fix\nthis.\n\nThis became necessary when the use of nilfs2's own page clear routine\nwas expanded.  This state inconsistency does not occur if the buffer\nis written normally by log writing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8927696c-641f-40b0-ba19-0c11b83c06b7",
      "id": "CVE-2024-50298",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: allocate vf_state during PF probes\n\nIn the previous implementation, vf_state is allocated memory only when VF\nis enabled. However, net_device_ops::ndo_set_vf_mac() may be called before\nVF is enabled to configure the MAC address of VF. If this is the case,\nenetc_pf_set_vf_mac() will access vf_state, resulting in access to a null\npointer. The simplified error log is as follows.\n\nroot@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89\n[  173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n[  173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy\n[  173.641973] lr : do_setlink+0x4a8/0xec8\n[  173.732292] Call trace:\n[  173.734740]  enetc_pf_set_vf_mac+0x3c/0x80\n[  173.738847]  __rtnl_newlink+0x530/0x89c\n[  173.742692]  rtnl_newlink+0x50/0x7c\n[  173.746189]  rtnetlink_rcv_msg+0x128/0x390\n[  173.750298]  netlink_rcv_skb+0x60/0x130\n[  173.754145]  rtnetlink_rcv+0x18/0x24\n[  173.757731]  netlink_unicast+0x318/0x380\n[  173.761665]  netlink_sendmsg+0x17c/0x3c8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "710c1385-a392-43b3-8311-cc0c5eaeaec4",
      "id": "CVE-2024-56615",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix OOB devmap writes when deleting elements\n\nJordy reported issue against XSKMAP which also applies to DEVMAP - the\nindex used for accessing map entry, due to being a signed integer,\ncauses the OOB writes. Fix is simple as changing the type from int to\nu32, however, when compared to XSKMAP case, one more thing needs to be\naddressed.\n\nWhen map is released from system via dev_map_free(), we iterate through\nall of the entries and an iterator variable is also an int, which\nimplies OOB accesses. Again, change it to be u32.\n\nExample splat below:\n\n[  160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000\n[  160.731662] #PF: supervisor read access in kernel mode\n[  160.736876] #PF: error_code(0x0000) - not-present page\n[  160.742095] PGD 0 P4D 0\n[  160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP\n[  160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487\n[  160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019\n[  160.767642] Workqueue: events_unbound bpf_map_free_deferred\n[  160.773308] RIP: 0010:dev_map_free+0x77/0x170\n[  160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 \u003c48\u003e 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff\n[  160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202\n[  160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024\n[  160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000\n[  160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001\n[  160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122\n[  160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000\n[  160.838310] FS:  0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000\n[  160.846528] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0\n[  160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  160.874092] PKRU: 55555554\n[  160.876847] Call Trace:\n[  160.879338]  \u003cTASK\u003e\n[  160.881477]  ? __die+0x20/0x60\n[  160.884586]  ? page_fault_oops+0x15a/0x450\n[  160.888746]  ? search_extable+0x22/0x30\n[  160.892647]  ? search_bpf_extables+0x5f/0x80\n[  160.896988]  ? exc_page_fault+0xa9/0x140\n[  160.900973]  ? asm_exc_page_fault+0x22/0x30\n[  160.905232]  ? dev_map_free+0x77/0x170\n[  160.909043]  ? dev_map_free+0x58/0x170\n[  160.912857]  bpf_map_free_deferred+0x51/0x90\n[  160.917196]  process_one_work+0x142/0x370\n[  160.921272]  worker_thread+0x29e/0x3b0\n[  160.925082]  ? rescuer_thread+0x4b0/0x4b0\n[  160.929157]  kthread+0xd4/0x110\n[  160.932355]  ? kthread_park+0x80/0x80\n[  160.936079]  ret_from_fork+0x2d/0x50\n[  160.943396]  ? kthread_park+0x80/0x80\n[  160.950803]  ret_from_fork_asm+0x11/0x20\n[  160.958482]  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "291c617a-e2e3-4d9f-ab90-0ee3e3e20420",
      "id": "CVE-2024-56616",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Fix MST sideband message body length check\n\nFix the MST sideband message body length check, which must be at least 1\nbyte accounting for the message body CRC (aka message data CRC) at the\nend of the message.\n\nThis fixes a case where an MST branch device returns a header with a\ncorrect header CRC (indicating a correctly received body length), with\nthe body length being incorrectly set to 0. This will later lead to a\nmemory corruption in drm_dp_sideband_append_payload() and the following\nerrors in dmesg:\n\n   UBSAN: array-index-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:786:25\n   index -1 is out of range for type 'u8 [48]'\n   Call Trace:\n    drm_dp_sideband_append_payload+0x33d/0x350 [drm_display_helper]\n    drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper]\n    drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper]\n\n   memcpy: detected field-spanning write (size 18446744073709551615) of single field \"\u0026msg-\u003emsg[msg-\u003ecurlen]\" at drivers/gpu/drm/display/drm_dp_mst_topology.c:791 (size 256)\n   Call Trace:\n    drm_dp_sideband_append_payload+0x324/0x350 [drm_display_helper]\n    drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper]\n    drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ab7ae87-19bc-4a5e-872c-5014d44c1916",
      "id": "CVE-2024-56609",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb\n\nWhen removing kernel modules by:\n   rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core\n\nDriver uses skb_queue_purge() to purge TX skb, but not report tx status\ncausing \"Have pending ack frames!\" warning. Use ieee80211_purge_tx_queue()\nto correct this.\n\nSince ieee80211_purge_tx_queue() doesn't take locks, to prevent racing\nbetween TX work and purge TX queue, flush and destroy TX work in advance.\n\n   wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local\n     choice (Reason: 3=DEAUTH_LEAVING)\n   ------------[ cut here ]------------\n   Have pending ack frames!\n   WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691\n       ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   CPU: 3 PID: 9232 Comm: rmmod Tainted: G         C\n       6.10.1-200.fc40.aarch64 #1\n   Hardware name: pine64 Pine64 PinePhone Braveheart\n      (1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024\n   pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n   pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n   sp : ffff80008c1b37b0\n   x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000\n   x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0\n   x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff\n   x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000\n   x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000\n   x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964\n   x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0\n   x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001\n   x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n   x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000\n   Call trace:\n    ieee80211_free_ack_frame+0x5c/0x90 [mac80211]\n    idr_for_each+0x74/0x110\n    ieee80211_free_hw+0x44/0xe8 [mac80211]\n    rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]\n    sdio_bus_remove+0x44/0x180\n    device_remove+0x54/0x90\n    device_release_driver_internal+0x1d4/0x238\n    driver_detach+0x54/0xc0\n    bus_remove_driver+0x78/0x108\n    driver_unregister+0x38/0x78\n    sdio_unregister_driver+0x2c/0x40\n    rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]\n    __do_sys_delete_module.isra.0+0x190/0x338\n    __arm64_sys_delete_module+0x1c/0x30\n    invoke_syscall+0x74/0x100\n    el0_svc_common.constprop.0+0x48/0xf0\n    do_el0_svc+0x24/0x38\n    el0_svc+0x3c/0x158\n    el0t_64_sync_handler+0x120/0x138\n    el0t_64_sync+0x194/0x198\n   ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd69ea26-db16-4123-95cb-b04f0c812088",
      "id": "CVE-2025-22040",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix session use-after-free in multichannel connection\n\nThere is a race condition between session setup and\nksmbd_sessions_deregister. The session can be freed before the connection\nis added to channel list of session.\nThis patch check reference count of session before freeing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd8676dc-b933-45fe-a5b3-15495f34e733",
      "id": "CVE-2025-37757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix memory leak in tipc_link_xmit\n\nIn case the backlog transmit queue for system-importance messages is overloaded,\ntipc_link_xmit() returns -ENOBUFS but the skb list is not purged. This leads to\nmemory leak and failure when a skb is allocated.\n\nThis commit fixes this issue by purging the skb list before tipc_link_xmit()\nreturns.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ccf1766-fa51-45a8-84c3-4be754f4578e",
      "id": "CVE-2025-37878",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix WARN_ON(!ctx) in __free_event() for partial init\n\nMove the get_ctx(child_ctx) call and the child_event-\u003ectx assignment to\noccur immediately after the child event is allocated. Ensure that\nchild_event-\u003ectx is non-NULL before any subsequent error path within\ninherit_event calls free_event(), satisfying the assumptions of the\ncleanup code.\n\nDetails:\n\nThere's no clear Fixes tag, because this bug is a side-effect of\nmultiple interacting commits over time (up to 15 years old), not\na single regression.\n\nThe code initially incremented refcount then assigned context\nimmediately after the child_event was created. Later, an early\nvalidity check for child_event was added before the\nrefcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was\nadded, assuming event-\u003ectx is valid if the pmu_ctx is valid.\nThe problem is that the WARN_ON_ONCE() could trigger after the initial\ncheck passed but before child_event-\u003ectx was assigned, violating its\nprecondition. The solution is to assign child_event-\u003ectx right after\nits initial validation. This ensures the context exists for any\nsubsequent checks or cleanup routines, resolving the WARN_ON_ONCE().\n\nTo resolve it, defer the refcount update and child_event-\u003ectx assignment\ndirectly after child_event-\u003epmu_ctx is set but before checking if the\nparent event is orphaned. The cleanup routine depends on\nevent-\u003epmu_ctx being non-NULL before it verifies event-\u003ectx is\nnon-NULL. This also maintains the author's original intent of passing\nin child_ctx to find_get_pmu_context before its refcount/assignment.\n\n[ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "226088b5-917a-4e65-a62e-c40bae6a5f7d",
      "id": "CVE-2025-37937",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nobjtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()\n\nIf dib8000_set_dds()'s call to dib8000_read32() returns zero, the result\nis a divide-by-zero.  Prevent that from happening.\n\nFixes the following warning with an UBSAN kernel:\n\n  drivers/media/dvb-frontends/dib8000.o: warning: objtool: dib8000_tune() falls through to next function dib8096p_cfg_DibRx()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec4e0a0d-efdc-4e4e-882f-0e78d7e1548b",
      "id": "CVE-2025-4598",
      "description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fa1862a-7d59-4be3-870b-e949b643bfaa",
      "id": "CVE-2020-12770",
      "description": "An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eadf2663-a2e3-4ee0-b266-e3ca181bb283",
      "id": "CVE-2020-15393",
      "description": "In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f18f47c-b697-4116-81c7-2594d06575f8",
      "id": "CVE-2020-29534",
      "description": "An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3967ca8-7921-41fd-ab68-adb50aa7d907",
      "id": "CVE-2021-3764",
      "description": "A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0853693-4fe9-481e-b799-6d4698448132",
      "id": "CVE-2021-47551",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\n\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\nalready been called, the start_cpsch will not be called since there is no resume in this\ncase.  When reset been triggered again, driver should avoid to do uninitialization again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "405c236a-e2b4-4f10-a037-e2ec8bda082d",
      "id": "CVE-2021-47552",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\n\nFor avoiding to slow down queue destroy, we don't call\nblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to\ncancel dispatch work in blk_release_queue().\n\nHowever, this way has caused kernel oops[1], reported by Changhui. The log\nshows that scsi_device can be freed before running blk_release_queue(),\nwhich is expected too since scsi_device is released after the scsi disk\nis closed and the scsi_device is removed.\n\nFixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()\nand disk_release():\n\n1) when disk_release() is run, the disk has been closed, and any sync\ndispatch activities have been done, so canceling dispatch work is enough to\nquiesce filesystem I/O dispatch activity.\n\n2) in blk_cleanup_queue(), we only focus on passthrough request, and\npassthrough request is always explicitly allocated \u0026 freed by\nits caller, so once queue is frozen, all sync dispatch activity\nfor passthrough request has been done, then it is enough to just cancel\ndispatch work for avoiding any dispatch activity.\n\n[1] kernel panic log\n[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300\n[12622.777186] #PF: supervisor read access in kernel mode\n[12622.782918] #PF: error_code(0x0000) - not-present page\n[12622.788649] PGD 0 P4D 0\n[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI\n[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1\n[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015\n[12622.813321] Workqueue: kblockd blk_mq_run_work_fn\n[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190\n[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 \u003c48\u003e 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58\n[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202\n[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004\n[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030\n[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334\n[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000\n[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030\n[12622.889926] FS:  0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000\n[12622.898956] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0\n[12622.913328] Call Trace:\n[12622.916055]  \u003cTASK\u003e\n[12622.918394]  scsi_mq_get_budget+0x1a/0x110\n[12622.922969]  __blk_mq_do_dispatch_sched+0x1d4/0x320\n[12622.928404]  ? pick_next_task_fair+0x39/0x390\n[12622.933268]  __blk_mq_sched_dispatch_requests+0xf4/0x140\n[12622.939194]  blk_mq_sched_dispatch_requests+0x30/0x60\n[12622.944829]  __blk_mq_run_hw_queue+0x30/0xa0\n[12622.949593]  process_one_work+0x1e8/0x3c0\n[12622.954059]  worker_thread+0x50/0x3b0\n[12622.958144]  ? rescuer_thread+0x370/0x370\n[12622.962616]  kthread+0x158/0x180\n[12622.966218]  ? set_kthread_struct+0x40/0x40\n[12622.970884]  ret_from_fork+0x22/0x30\n[12622.974875]  \u003c/TASK\u003e\n[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4381175-6ae9-42dc-be77-47504b7be4c0",
      "id": "CVE-2021-38209",
      "description": "net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efc12901-c83f-437b-80d5-5f88cb56f1e1",
      "id": "CVE-2021-44879",
      "description": "In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74c101c8-4a5a-4d08-a80a-a59bda17bf69",
      "id": "CVE-2021-46925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix kernel panic caused by race of smc_sock\n\nA crash occurs when smc_cdc_tx_handler() tries to access smc_sock\nbut smc_release() has already freed it.\n\n[ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88\n[ 4570.696048] #PF: supervisor write access in kernel mode\n[ 4570.696728] #PF: error_code(0x0002) - not-present page\n[ 4570.697401] PGD 0 P4D 0\n[ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI\n[ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111\n[ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0\n[ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30\n\u003c...\u003e\n[ 4570.711446] Call Trace:\n[ 4570.711746]  \u003cIRQ\u003e\n[ 4570.711992]  smc_cdc_tx_handler+0x41/0xc0\n[ 4570.712470]  smc_wr_tx_tasklet_fn+0x213/0x560\n[ 4570.712981]  ? smc_cdc_tx_dismisser+0x10/0x10\n[ 4570.713489]  tasklet_action_common.isra.17+0x66/0x140\n[ 4570.714083]  __do_softirq+0x123/0x2f4\n[ 4570.714521]  irq_exit_rcu+0xc4/0xf0\n[ 4570.714934]  common_interrupt+0xba/0xe0\n\nThough smc_cdc_tx_handler() checked the existence of smc connection,\nsmc_release() may have already dismissed and released the smc socket\nbefore smc_cdc_tx_handler() further visits it.\n\nsmc_cdc_tx_handler()           |smc_release()\nif (!conn)                     |\n                               |\n                               |smc_cdc_tx_dismiss_slots()\n                               |      smc_cdc_tx_dismisser()\n                               |\n                               |sock_put(\u0026smc-\u003esk) \u003c- last sock_put,\n                               |                      smc_sock freed\nbh_lock_sock(\u0026smc-\u003esk) (panic) |\n\nTo make sure we won't receive any CDC messages after we free the\nsmc_sock, add a refcount on the smc_connection for inflight CDC\nmessage(posted to the QP but haven't received related CQE), and\ndon't release the smc_connection until all the inflight CDC messages\nhaven been done, for both success or failed ones.\n\nUsing refcount on CDC messages brings another problem: when the link\nis going to be destroyed, smcr_link_clear() will reset the QP, which\nthen remove all the pending CQEs related to the QP in the CQ. To make\nsure all the CQEs will always come back so the refcount on the\nsmc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced\nby smc_ib_modify_qp_error().\nAnd remove the timeout in smc_wr_tx_wait_no_pending_sends() since we\nneed to wait for all pending WQEs done, or we may encounter use-after-\nfree when handling CQEs.\n\nFor IB device removal routine, we need to wait for all the QPs on that\ndevice been destroyed before we can destroy CQs on the device, or\nthe refcount on smc_connection won't reach 0 and smc_sock cannot be\nreleased.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd7e1704-a79b-4da0-956a-f81e8b153693",
      "id": "CVE-2021-47049",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Use after free in __vmbus_open()\n\nThe \"open_info\" variable is added to the \u0026vmbus_connection.chn_msg_list,\nbut the error handling frees \"open_info\" without removing it from the\nlist.  This will result in a use after free.  First remove it from the\nlist, and then free it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37870839-3561-42e3-b933-f0929515e0b9",
      "id": "CVE-2021-47172",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad7124: Fix potential overflow due to non sequential channel numbers\n\nChannel numbering must start at 0 and then not have any holes, or\nit is possible to overflow the available storage.  Note this bug was\nintroduced as part of a fix to ensure we didn't rely on the ordering\nof child nodes.  So we need to support arbitrary ordering but they all\nneed to be there somewhere.\n\nNote I hit this when using qemu to test the rest of this series.\nArguably this isn't the best fix, but it is probably the most minimal\noption for backporting etc.\n\nAlexandru's sign-off is here because he carried this patch in a larger\nset that Jonathan then applied.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd96a748-50df-45a3-988a-a94b391cddb4",
      "id": "CVE-2021-47288",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n\nFix an 11-year old bug in ngene_command_config_free_buf() while\naddressing the following warnings caught with -Warray-bounds:\n\narch/alpha/include/asm/string.h:22:16: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]\narch/x86/include/asm/string_32.h:182:25: warning: '__builtin_memcpy' offset [12, 16] from the object at 'com' is out of the bounds of referenced subobject 'config' with type 'unsigned char' at offset 10 [-Warray-bounds]\n\nThe problem is that the original code is trying to copy 6 bytes of\ndata into a one-byte size member _config_ of the wrong structue\nFW_CONFIGURE_BUFFERS, in a single call to memcpy(). This causes a\nlegitimate compiler warning because memcpy() overruns the length\nof \u0026com.cmd.ConfigureBuffers.config. It seems that the right\nstructure is FW_CONFIGURE_FREE_BUFFERS, instead, because it contains\n6 more members apart from the header _hdr_. Also, the name of\nthe function ngene_command_config_free_buf() suggests that the actual\nintention is to ConfigureFreeBuffers, instead of ConfigureBuffers\n(which takes place in the function ngene_command_config_buf(), above).\n\nFix this by enclosing those 6 members of struct FW_CONFIGURE_FREE_BUFFERS\ninto new struct config, and use \u0026com.cmd.ConfigureFreeBuffers.config as\nthe destination address, instead of \u0026com.cmd.ConfigureBuffers.config,\nwhen calling memcpy().\n\nThis also helps with the ongoing efforts to globally enable\n-Warray-bounds and get us closer to being able to tighten the\nFORTIFY_SOURCE routines on memcpy().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d200877-22f3-4e45-b60c-24a04a284ada",
      "id": "CVE-2022-48952",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mt7621: Add sentinel to quirks table\n\nCurrent driver is missing a sentinel in the struct soc_device_attribute\narray, which causes an oops when assessed by the\nsoc_device_match(mt7621_pcie_quirks_match) call.\n\nThis was only exposed once the CONFIG_SOC_MT7621 mt7621 soc_dev_attr\nwas fixed to register the SOC as a device, in:\n\ncommit 7c18b64bba3b (\"mips: ralink: mt7621: do not use kzalloc too early\")\n\nFix it by adding the required sentinel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e581ef2-4585-4921-9740-68aeb43f5a4e",
      "id": "CVE-2022-48956",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid use-after-free in ip6_fragment()\n\nBlamed commit claimed rcu_read_lock() was held by ip6_fragment() callers.\n\nIt seems to not be always true, at least for UDP stack.\n\nsyzbot reported:\n\nBUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:245 [inline]\nBUG: KASAN: use-after-free in ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951\nRead of size 8 at addr ffff88801d403e80 by task syz-executor.3/7618\n\nCPU: 1 PID: 7618 Comm: syz-executor.3 Not tainted 6.1.0-rc6-syzkaller-00012-g4312098baf37 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x15e/0x45d mm/kasan/report.c:395\n kasan_report+0xbf/0x1f0 mm/kasan/report.c:495\n ip6_dst_idev include/net/ip6_fib.h:245 [inline]\n ip6_fragment+0x2724/0x2770 net/ipv6/ip6_output.c:951\n __ip6_finish_output net/ipv6/ip6_output.c:193 [inline]\n ip6_finish_output+0x9a3/0x1170 net/ipv6/ip6_output.c:206\n NF_HOOK_COND include/linux/netfilter.h:291 [inline]\n ip6_output+0x1f1/0x540 net/ipv6/ip6_output.c:227\n dst_output include/net/dst.h:445 [inline]\n ip6_local_out+0xb3/0x1a0 net/ipv6/output_core.c:161\n ip6_send_skb+0xbb/0x340 net/ipv6/ip6_output.c:1966\n udp_v6_send_skb+0x82a/0x18a0 net/ipv6/udp.c:1286\n udp_v6_push_pending_frames+0x140/0x200 net/ipv6/udp.c:1313\n udpv6_sendmsg+0x18da/0x2c80 net/ipv6/udp.c:1606\n inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:665\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg+0xd3/0x120 net/socket.c:734\n sock_write_iter+0x295/0x3d0 net/socket.c:1108\n call_write_iter include/linux/fs.h:2191 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x9ed/0xdd0 fs/read_write.c:584\n ksys_write+0x1ec/0x250 fs/read_write.c:637\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fde3588c0d9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fde365b6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007fde359ac050 RCX: 00007fde3588c0d9\nRDX: 000000000000ffdc RSI: 00000000200000c0 RDI: 000000000000000a\nRBP: 00007fde358e7ae9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fde35acfb1f R14: 00007fde365b6300 R15: 0000000000022000\n \u003c/TASK\u003e\n\nAllocated by task 7618:\n kasan_save_stack+0x22/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n __kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325\n kasan_slab_alloc include/linux/kasan.h:201 [inline]\n slab_post_alloc_hook mm/slab.h:737 [inline]\n slab_alloc_node mm/slub.c:3398 [inline]\n slab_alloc mm/slub.c:3406 [inline]\n __kmem_cache_alloc_lru mm/slub.c:3413 [inline]\n kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422\n dst_alloc+0x14a/0x1f0 net/core/dst.c:92\n ip6_dst_alloc+0x32/0xa0 net/ipv6/route.c:344\n ip6_rt_pcpu_alloc net/ipv6/route.c:1369 [inline]\n rt6_make_pcpu_route net/ipv6/route.c:1417 [inline]\n ip6_pol_route+0x901/0x1190 net/ipv6/route.c:2254\n pol_lookup_func include/net/ip6_fib.h:582 [inline]\n fib6_rule_lookup+0x52e/0x6f0 net/ipv6/fib6_rules.c:121\n ip6_route_output_flags_noref+0x2e6/0x380 net/ipv6/route.c:2625\n ip6_route_output_flags+0x76/0x320 net/ipv6/route.c:2638\n ip6_route_output include/net/ip6_route.h:98 [inline]\n ip6_dst_lookup_tail+0x5ab/0x1620 net/ipv6/ip6_output.c:1092\n ip6_dst_lookup_flow+0x90/0x1d0 net/ipv6/ip6_output.c:1222\n ip6_sk_dst_lookup_flow+0x553/0x980 net/ipv6/ip6_output.c:1260\n udpv6_sendmsg+0x151d/0x2c80 net/ipv6/udp.c:1554\n inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:665\n sock_sendmsg_nosec n\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1441477b-9245-4c42-a55b-6b8dfbe10ab7",
      "id": "CVE-2022-1011",
      "description": "A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4d4e7e6-3884-4d6c-aad3-f890266135ff",
      "id": "CVE-2022-1048",
      "description": "A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5560ee1d-bdd0-4076-8be7-619f6a811963",
      "id": "CVE-2022-1679",
      "description": "A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f70102e2-f10b-4657-b56d-866f836bfa33",
      "id": "CVE-2022-1734",
      "description": "A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "da700c9c-2a62-4672-9fe8-573c6f4533ec",
      "id": "CVE-2022-49166",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: add sanity check on allocation size\n\nntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation\nsize.  It triggers one BUG in the __ntfs_malloc function.\n\nFix this by adding sanity check on ni-\u003eattr_list_size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30d3ef74-c535-49e7-8459-4a4867546899",
      "id": "CVE-2022-50296",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,\ncpu_max_bits_warn() generates a runtime warning similar as below while\nwe show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[    3.052463] ------------[ cut here ]------------\n[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[    3.070072] Modules linked in: efivarfs autofs4\n[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[    3.195868]         ...\n[    3.199917] Call Trace:\n[    3.203941] [\u003c90000000002086d8\u003e] show_stack+0x38/0x14c\n[    3.210666] [\u003c9000000000cf846c\u003e] dump_stack_lvl+0x60/0x88\n[    3.217625] [\u003c900000000023d268\u003e] __warn+0xd0/0x100\n[    3.223958] [\u003c9000000000cf3c90\u003e] warn_slowpath_fmt+0x7c/0xcc\n[    3.231150] [\u003c9000000000210220\u003e] show_cpuinfo+0x5e8/0x5f0\n[    3.238080] [\u003c90000000004f578c\u003e] seq_read_iter+0x354/0x4b4\n[    3.245098] [\u003c90000000004c2e90\u003e] new_sync_read+0x17c/0x1c4\n[    3.252114] [\u003c90000000004c5174\u003e] vfs_read+0x138/0x1d0\n[    3.258694] [\u003c90000000004c55f8\u003e] ksys_read+0x70/0x100\n[    3.265265] [\u003c9000000000cfde9c\u003e] do_syscall+0x7c/0x94\n[    3.271820] [\u003c9000000000202fe4\u003e] handle_syscall+0xc4/0x160\n[    3.281824] ---[ end trace 8b484262b4b8c24c ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54a208c0-0b19-454f-8fca-730fb1ad58dc",
      "id": "CVE-2022-21546",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix WRITE_SAME No Data Buffer crash\n\nIn newer version of the SBC specs, we have a NDOB bit that indicates there\nis no data buffer that gets written out. If this bit is set using commands\nlike \"sg_write_same --ndob\" we will crash in target_core_iblock/file's\nexecute_write_same handlers when we go to access the se_cmd-\u003et_data_sg\nbecause its NULL.\n\nThis patch adds a check for the NDOB bit in the common WRITE SAME code\nbecause we don't support it. And, it adds a check for zero SG elements in\neach handler in case the initiator tries to send a normal WRITE SAME with\nno data buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7aaff9e-d255-4a98-a292-152b255db25b",
      "id": "CVE-2022-2586",
      "description": "It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6660124c-70b4-47f0-a53c-bb2e9f9bc937",
      "id": "CVE-2022-32981",
      "description": "An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43be861a-809a-4251-ac4d-0c336995fc87",
      "id": "CVE-2022-48731",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kmemleak: avoid scanning potential huge holes\n\nWhen using devm_request_free_mem_region() and devm_memremap_pages() to\nadd ZONE_DEVICE memory, if requested free mem region's end pfn were\nhuge(e.g., 0x400000000), the node_end_pfn() will be also huge (see\nmove_pfn_range_to_zone()).  Thus it creates a huge hole between\nnode_start_pfn() and node_end_pfn().\n\nWe found on some AMD APUs, amdkfd requested such a free mem region and\ncreated a huge hole.  In such a case, following code snippet was just\ndoing busy test_bit() looping on the huge hole.\n\n  for (pfn = start_pfn; pfn \u003c end_pfn; pfn++) {\n\tstruct page *page = pfn_to_online_page(pfn);\n\t\tif (!page)\n\t\t\tcontinue;\n\t...\n  }\n\nSo we got a soft lockup:\n\n  watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]\n  CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1\n  RIP: 0010:pfn_to_online_page+0x5/0xd0\n  Call Trace:\n    ? kmemleak_scan+0x16a/0x440\n    kmemleak_write+0x306/0x3a0\n    ? common_file_perm+0x72/0x170\n    full_proxy_write+0x5c/0x90\n    vfs_write+0xb9/0x260\n    ksys_write+0x67/0xe0\n    __x64_sys_write+0x1a/0x20\n    do_syscall_64+0x3b/0xc0\n    entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nI did some tests with the patch.\n\n(1) amdgpu module unloaded\n\nbefore the patch:\n\n  real    0m0.976s\n  user    0m0.000s\n  sys     0m0.968s\n\nafter the patch:\n\n  real    0m0.981s\n  user    0m0.000s\n  sys     0m0.973s\n\n(2) amdgpu module loaded\n\nbefore the patch:\n\n  real    0m35.365s\n  user    0m0.000s\n  sys     0m35.354s\n\nafter the patch:\n\n  real    0m1.049s\n  user    0m0.000s\n  sys     0m1.042s",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10be2cf8-5d1b-461a-aa02-3c997d2c8d7b",
      "id": "CVE-2022-48825",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Add stag_work to all the vports\n\nCall trace seen when creating NPIV ports, only 32 out of 64 show online.\nstag work was not initialized for vport, hence initialize the stag work.\n\nWARNING: CPU: 8 PID: 645 at kernel/workqueue.c:1635 __queue_delayed_work+0x68/0x80\nCPU: 8 PID: 645 Comm: kworker/8:1 Kdump: loaded Tainted: G IOE    --------- --\n 4.18.0-348.el8.x86_64 #1\nHardware name: Dell Inc. PowerEdge MX740c/0177V9, BIOS 2.12.2 07/09/2021\nWorkqueue: events fc_lport_timeout [libfc]\nRIP: 0010:__queue_delayed_work+0x68/0x80\nCode: 89 b2 88 00 00 00 44 89 82 90 00 00 00 48 01 c8 48 89 42 50 41 81\nf8 00 20 00 00 75 1d e9 60 24 07 00 44 89 c7 e9 98 f6 ff ff \u003c0f\u003e 0b eb\nc5 0f 0b eb a1 0f 0b eb a7 0f 0b eb ac 44 89 c6 e9 40 23\nRSP: 0018:ffffae514bc3be40 EFLAGS: 00010006\nRAX: ffff8d25d6143750 RBX: 0000000000000202 RCX: 0000000000000002\nRDX: ffff8d2e31383748 RSI: ffff8d25c000d600 RDI: ffff8d2e31383788\nRBP: ffff8d2e31380de0 R08: 0000000000002000 R09: ffff8d2e31383750\nR10: ffffffffc0c957e0 R11: ffff8d2624800000 R12: ffff8d2e31380a58\nR13: ffff8d2d915eb000 R14: ffff8d25c499b5c0 R15: ffff8d2e31380e18\nFS:  0000000000000000(0000) GS:ffff8d2d1fb00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055fd0484b8b8 CR3: 00000008ffc10006 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n  queue_delayed_work_on+0x36/0x40\n  qedf_elsct_send+0x57/0x60 [qedf]\n  fc_lport_enter_flogi+0x90/0xc0 [libfc]\n  fc_lport_timeout+0xb7/0x140 [libfc]\n  process_one_work+0x1a7/0x360\n  ? create_worker+0x1a0/0x1a0\n  worker_thread+0x30/0x390\n  ? create_worker+0x1a0/0x1a0\n  kthread+0x116/0x130\n  ? kthread_flush_work_fn+0x10/0x10\n  ret_from_fork+0x35/0x40\n ---[ end trace 008f00f722f2c2ff ]--\n\nInitialize stag work for all the vports.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e5cae18-0171-45f3-a2b6-9693372eb39a",
      "id": "CVE-2022-48899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: Fix GEM handle creation UAF\n\nUserspace can guess the handle value and try to race GEM object creation\nwith handle close, resulting in a use-after-free if we dereference the\nobject after dropping the handle's reference.  For that reason, dropping\nthe handle's reference must be done *after* we are done dereferencing\nthe object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2512087c-6ea2-45de-8831-8c5ad177625d",
      "id": "CVE-2022-49304",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: tty: serial: Fix deadlock in sa1100_set_termios()\n\nThere is a deadlock in sa1100_set_termios(), which is shown\nbelow:\n\n   (Thread 1)              |      (Thread 2)\n                           | sa1100_enable_ms()\nsa1100_set_termios()       |  mod_timer()\n spin_lock_irqsave() //(1) |  (wait a time)\n ...                       | sa1100_timeout()\n del_timer_sync()          |  spin_lock_irqsave() //(2)\n (wait timer to stop)      |  ...\n\nWe hold sport-\u003eport.lock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need sport-\u003eport.lock in position (2) of thread 2. As a result,\nsa1100_set_termios() will block forever.\n\nThis patch moves del_timer_sync() before spin_lock_irqsave()\nin order to prevent the deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28e03082-df5a-44eb-801a-3fcc18b87a7c",
      "id": "CVE-2022-49372",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: tcp_rtx_synack() can be called from process context\n\nLaurent reported the enclosed report [1]\n\nThis bug triggers with following coditions:\n\n0) Kernel built with CONFIG_DEBUG_PREEMPT=y\n\n1) A new passive FastOpen TCP socket is created.\n   This FO socket waits for an ACK coming from client to be a complete\n   ESTABLISHED one.\n2) A socket operation on this socket goes through lock_sock()\n   release_sock() dance.\n3) While the socket is owned by the user in step 2),\n   a retransmit of the SYN is received and stored in socket backlog.\n4) At release_sock() time, the socket backlog is processed while\n   in process context.\n5) A SYNACK packet is cooked in response of the SYN retransmit.\n6) -\u003e tcp_rtx_synack() is called in process context.\n\nBefore blamed commit, tcp_rtx_synack() was always called from BH handler,\nfrom a timer handler.\n\nFix this by using TCP_INC_STATS() \u0026 NET_INC_STATS()\nwhich do not assume caller is in non preemptible context.\n\n[1]\nBUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180\ncaller is tcp_rtx_synack.part.0+0x36/0xc0\nCPU: 10 PID: 2180 Comm: epollpep Tainted: G           OE     5.16.0-0.bpo.4-amd64 #1  Debian 5.16.12-1~bpo11+1\nHardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x48/0x5e\n check_preemption_disabled+0xde/0xe0\n tcp_rtx_synack.part.0+0x36/0xc0\n tcp_rtx_synack+0x8d/0xa0\n ? kmem_cache_alloc+0x2e0/0x3e0\n ? apparmor_file_alloc_security+0x3b/0x1f0\n inet_rtx_syn_ack+0x16/0x30\n tcp_check_req+0x367/0x610\n tcp_rcv_state_process+0x91/0xf60\n ? get_nohz_timer_target+0x18/0x1a0\n ? lock_timer_base+0x61/0x80\n ? preempt_count_add+0x68/0xa0\n tcp_v4_do_rcv+0xbd/0x270\n __release_sock+0x6d/0xb0\n release_sock+0x2b/0x90\n sock_setsockopt+0x138/0x1140\n ? __sys_getsockname+0x7e/0xc0\n ? aa_sk_perm+0x3e/0x1a0\n __sys_setsockopt+0x198/0x1e0\n __x64_sys_setsockopt+0x21/0x30\n do_syscall_64+0x38/0xc0\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbbeccd0-0c4d-44fc-b7fb-9c432f8a88a2",
      "id": "CVE-2022-49410",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix potential double free in create_var_ref()\n\nIn create_var_ref(), init_var_ref() is called to initialize the fields\nof variable ref_field, which is allocated in the previous function call\nto create_hist_field(). Function init_var_ref() allocates the\ncorresponding fields such as ref_field-\u003esystem, but frees these fields\nwhen the function encounters an error. The caller later calls\ndestroy_hist_field() to conduct error handling, which frees the fields\nand the variable itself. This results in double free of the fields which\nare already freed in the previous function.\n\nFix this by storing NULL to the corresponding fields when they are freed\nin init_var_ref().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ab098c3-da01-48db-b48e-1514d5855e01",
      "id": "CVE-2022-49447",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: hisi: Add missing of_node_put after of_find_compatible_node\n\nof_find_compatible_node  will increment the refcount of the returned\ndevice_node. Calling of_node_put() to avoid the refcount leak",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96daf599-89aa-4e49-a4fb-3b34effb182f",
      "id": "CVE-2022-49462",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/a6xx: Fix refcount leak in a6xx_gpu_init\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\n\na6xx_gmu_init() passes the node to of_find_device_by_node()\nand of_dma_configure(), of_find_device_by_node() will takes its\nreference, of_dma_configure() doesn't need the node after usage.\n\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14435636-ef5b-4023-8467-063e2fe0f0d6",
      "id": "CVE-2022-49482",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mxs-saif: Fix refcount leak in mxs_saif_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "246f2ded-f74a-49ee-93eb-7ad109e1bb88",
      "id": "CVE-2023-52620",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: disallow timeout for anonymous sets\n\nNever used from userspace, disallow these parameters.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "348af0f3-daae-4db1-a103-e187b8cd6f69",
      "id": "CVE-2022-49496",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko\n\nIf the driver support subdev mode, the parameter \"dev-\u003epm.dev\" will be\nNULL in mtk_vcodec_dec_remove. Kernel will crash when try to rmmod\nmtk-vcodec-dec.ko.\n\n[ 4380.702726] pc : do_raw_spin_trylock+0x4/0x80\n[ 4380.707075] lr : _raw_spin_lock_irq+0x90/0x14c\n[ 4380.711509] sp : ffff80000819bc10\n[ 4380.714811] x29: ffff80000819bc10 x28: ffff3600c03e4000 x27: 0000000000000000\n[ 4380.721934] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n[ 4380.729057] x23: ffff3600c0f34930 x22: ffffd5e923549000 x21: 0000000000000220\n[ 4380.736179] x20: 0000000000000208 x19: ffffd5e9213e8ebc x18: 0000000000000020\n[ 4380.743298] x17: 0000002000000000 x16: ffffd5e9213e8e90 x15: 696c346f65646976\n[ 4380.750420] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000040\n[ 4380.757542] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\n[ 4380.764664] x8 : 0000000000000000 x7 : ffff3600c7273ae8 x6 : ffffd5e9213e8ebc\n[ 4380.771786] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000\n[ 4380.778908] x2 : 0000000000000000 x1 : ffff3600c03e4000 x0 : 0000000000000208\n[ 4380.786031] Call trace:\n[ 4380.788465]  do_raw_spin_trylock+0x4/0x80\n[ 4380.792462]  __pm_runtime_disable+0x2c/0x1b0\n[ 4380.796723]  mtk_vcodec_dec_remove+0x5c/0xa0 [mtk_vcodec_dec]\n[ 4380.802466]  platform_remove+0x2c/0x60\n[ 4380.806204]  __device_release_driver+0x194/0x250\n[ 4380.810810]  driver_detach+0xc8/0x15c\n[ 4380.814462]  bus_remove_driver+0x5c/0xb0\n[ 4380.818375]  driver_unregister+0x34/0x64\n[ 4380.822288]  platform_driver_unregister+0x18/0x24\n[ 4380.826979]  mtk_vcodec_dec_driver_exit+0x1c/0x888 [mtk_vcodec_dec]\n[ 4380.833240]  __arm64_sys_delete_module+0x190/0x224\n[ 4380.838020]  invoke_syscall+0x48/0x114\n[ 4380.841760]  el0_svc_common.constprop.0+0x60/0x11c\n[ 4380.846540]  do_el0_svc+0x28/0x90\n[ 4380.849844]  el0_svc+0x4c/0x100\n[ 4380.852975]  el0t_64_sync_handler+0xec/0xf0\n[ 4380.857148]  el0t_64_sync+0x190/0x194\n[ 4380.860801] Code: 94431515 17ffffca d503201f d503245f (b9400004)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79c04f62-239d-4e29-b865-39701e4856a7",
      "id": "CVE-2022-49497",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove two BUG() from skb_checksum_help()\n\nI have a syzbot report that managed to get a crash in skb_checksum_help()\n\nIf syzbot can trigger these BUG(), it makes sense to replace\nthem with more friendly WARN_ON_ONCE() since skb_checksum_help()\ncan instead return an error code.\n\nNote that syzbot will still crash there, until real bug is fixed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9f6ffd7-4027-4ce3-aee4-5d94c582e81f",
      "id": "CVE-2022-49594",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.\n\nWhile reading sysctl_tcp_mtu_probe_floor, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73c3165e-648f-470f-a629-c0a3824ab54c",
      "id": "CVE-2022-49643",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix a potential integer overflow in ima_appraise_measurement\n\nWhen the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be\nnegative, which may cause the integer overflow problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1abe5a93-e646-4106-ba12-979313584683",
      "id": "CVE-2022-49724",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: goldfish: Fix free_irq() on remove\n\nPass the correct dev_id to free_irq() to fix this splat when the driver\nis unbound:\n\n WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq\n Trying to free already-free IRQ 65\n Call Trace:\n  warn_slowpath_fmt\n  free_irq\n  goldfish_tty_remove\n  platform_remove\n  device_remove\n  device_release_driver_internal\n  device_driver_detach\n  unbind_store\n  drv_attr_store\n  ...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74bd1949-3a26-4ec1-90f4-f3e08fa9805b",
      "id": "CVE-2022-49728",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix signed integer overflow in __ip6_append_data\n\nResurrect ubsan overflow checks and ubsan report this warning,\nfix it by change the variable [length] type to size_t.\n\nUBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19\n2147479552 + 8567 cannot be represented in type 'int'\nCPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1\nHardware name: linux,dummy-virt (DT)\nCall trace:\n  dump_backtrace+0x214/0x230\n  show_stack+0x30/0x78\n  dump_stack_lvl+0xf8/0x118\n  dump_stack+0x18/0x30\n  ubsan_epilogue+0x18/0x60\n  handle_overflow+0xd0/0xf0\n  __ubsan_handle_add_overflow+0x34/0x44\n  __ip6_append_data.isra.48+0x1598/0x1688\n  ip6_append_data+0x128/0x260\n  udpv6_sendmsg+0x680/0xdd0\n  inet6_sendmsg+0x54/0x90\n  sock_sendmsg+0x70/0x88\n  ____sys_sendmsg+0xe8/0x368\n  ___sys_sendmsg+0x98/0xe0\n  __sys_sendmmsg+0xf4/0x3b8\n  __arm64_sys_sendmmsg+0x34/0x48\n  invoke_syscall+0x64/0x160\n  el0_svc_common.constprop.4+0x124/0x300\n  do_el0_svc+0x44/0xc8\n  el0_svc+0x3c/0x1e8\n  el0t_64_sync_handler+0x88/0xb0\n  el0t_64_sync+0x16c/0x170\n\nChanges since v1:\n-Change the variable [length] type to unsigned, as Eric Dumazet suggested.\nChanges since v2:\n-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested.\nChanges since v3:\n-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as\nJakub Kicinski suggested.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2d92197-671a-4316-aa10-0f385b2c770b",
      "id": "CVE-2022-49750",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: CPPC: Add u64 casts to avoid overflowing\n\nThe fields of the _CPC object are unsigned 32-bits values.\nTo avoid overflows while using _CPC's values, add 'u64' casts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be9eaa1e-2a73-4f59-b164-34c3a247f887",
      "id": "CVE-2022-49828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlbfs: don't delete error page from pagecache\n\nThis change is very similar to the change that was made for shmem [1], and\nit solves the same problem but for HugeTLBFS instead.\n\nCurrently, when poison is found in a HugeTLB page, the page is removed\nfrom the page cache.  That means that attempting to map or read that\nhugepage in the future will result in a new hugepage being allocated\ninstead of notifying the user that the page was poisoned.  As [1] states,\nthis is effectively memory corruption.\n\nThe fix is to leave the page in the page cache.  If the user attempts to\nuse a poisoned HugeTLB page with a syscall, the syscall will fail with\nEIO, the same error code that shmem uses.  For attempts to map the page,\nthe thread will get a BUS_MCEERR_AR SIGBUS.\n\n[1]: commit a76054266661 (\"mm: shmem: don't truncate page if memory failure happens\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12e221fa-f71e-4280-854a-056b9dfd4612",
      "id": "CVE-2022-49925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix null-ptr-deref in ib_core_cleanup()\n\nKASAN reported a null-ptr-deref error:\n\n  KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\n  CPU: 1 PID: 379\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  RIP: 0010:destroy_workqueue+0x2f/0x740\n  RSP: 0018:ffff888016137df8 EFLAGS: 00000202\n  ...\n  Call Trace:\n   ib_core_cleanup+0xa/0xa1 [ib_core]\n   __do_sys_delete_module.constprop.0+0x34f/0x5b0\n   do_syscall_64+0x3a/0x90\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  RIP: 0033:0x7fa1a0d221b7\n  ...\n\nIt is because the fail of roce_gid_mgmt_init() is ignored:\n\n ib_core_init()\n   roce_gid_mgmt_init()\n     gid_cache_wq = alloc_ordered_workqueue # fail\n ...\n ib_core_cleanup()\n   roce_gid_mgmt_cleanup()\n     destroy_workqueue(gid_cache_wq)\n     # destroy an unallocated wq\n\nFix this by catching the fail of roce_gid_mgmt_init() in ib_core_init().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "31e757e8-afcc-42f1-a23b-a6bf9a4ffd1b",
      "id": "CVE-2022-49952",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix memory corruption on probe\n\nAdd the missing sanity check on the probed-session count to avoid\ncorrupting memory beyond the fixed-size slab-allocated session array\nwhen there are more than FASTRPC_MAX_SESSIONS sessions defined in the\ndevicetree.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f41c0bbf-c369-4d09-a7e6-7b62fef0f065",
      "id": "CVE-2022-49981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidraw: fix memory leak in hidraw_release()\n\nFree the buffered reports before deleting the list entry.\n\nBUG: memory leak\nunreferenced object 0xffff88810e72f180 (size 32):\n  comm \"softirq\", pid 0, jiffies 4294945143 (age 16.080s)\n  hex dump (first 32 bytes):\n    64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00  d..j............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff814ac6c3\u003e] kmemdup+0x23/0x50 mm/util.c:128\n    [\u003cffffffff8357c1d2\u003e] kmemdup include/linux/fortify-string.h:440 [inline]\n    [\u003cffffffff8357c1d2\u003e] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521\n    [\u003cffffffff8356ddad\u003e] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992\n    [\u003cffffffff8356e41e\u003e] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065\n    [\u003cffffffff835f0d3f\u003e] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284\n    [\u003cffffffff82d3c7f9\u003e] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670\n    [\u003cffffffff82d3cc26\u003e] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747\n    [\u003cffffffff82ef1e14\u003e] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988\n    [\u003cffffffff812f50a8\u003e] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474\n    [\u003cffffffff812f5586\u003e] expire_timers kernel/time/timer.c:1519 [inline]\n    [\u003cffffffff812f5586\u003e] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790\n    [\u003cffffffff812f56e4\u003e] __run_timers kernel/time/timer.c:1768 [inline]\n    [\u003cffffffff812f56e4\u003e] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803\n    [\u003cffffffff848000e6\u003e] __do_softirq+0xe6/0x2ea kernel/softirq.c:571\n    [\u003cffffffff81246db0\u003e] invoke_softirq kernel/softirq.c:445 [inline]\n    [\u003cffffffff81246db0\u003e] __irq_exit_rcu kernel/softirq.c:650 [inline]\n    [\u003cffffffff81246db0\u003e] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662\n    [\u003cffffffff84574f02\u003e] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106\n    [\u003cffffffff84600c8b\u003e] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649\n    [\u003cffffffff8458a070\u003e] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]\n    [\u003cffffffff8458a070\u003e] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]\n    [\u003cffffffff8458a070\u003e] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]\n    [\u003cffffffff8458a070\u003e] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86219956-9f6e-4870-b07c-165783bd914a",
      "id": "CVE-2022-50015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot\n\nIt is not yet clear, but it is possible to create a firmware so broken\nthat it will send a reply message before a FW_READY message (it is not\nyet clear if FW_READY will arrive later).\nSince the reply_data is allocated only after the FW_READY message, this\nwill lead to a NULL pointer dereference if not filtered out.\n\nThe issue was reported with IPC4 firmware but the same condition is present\nfor IPC3.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "293ce6d5-f5d7-4a6e-90c9-8e4223d2727e",
      "id": "CVE-2022-50066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: fix aq_vec index out of range error\n\nThe final update statement of the for loop exceeds the array range, the\ndereference of self-\u003eaq_vec[i] is not checked and then leads to the\nindex out of range error.\nAlso fixed this kind of coding style in other for loop.\n\n[   97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48\n[   97.937607] index 8 is out of range for type 'aq_vec_s *[8]'\n[   97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2\n[   97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022\n[   97.937611] Workqueue: events_unbound async_run_entry_fn\n[   97.937616] Call Trace:\n[   97.937617]  \u003cTASK\u003e\n[   97.937619]  dump_stack_lvl+0x49/0x63\n[   97.937624]  dump_stack+0x10/0x16\n[   97.937626]  ubsan_epilogue+0x9/0x3f\n[   97.937627]  __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[   97.937629]  ? __scm_send+0x348/0x440\n[   97.937632]  ? aq_vec_stop+0x72/0x80 [atlantic]\n[   97.937639]  aq_nic_stop+0x1b6/0x1c0 [atlantic]\n[   97.937644]  aq_suspend_common+0x88/0x90 [atlantic]\n[   97.937648]  aq_pm_suspend_poweroff+0xe/0x20 [atlantic]\n[   97.937653]  pci_pm_suspend+0x7e/0x1a0\n[   97.937655]  ? pci_pm_suspend_noirq+0x2b0/0x2b0\n[   97.937657]  dpm_run_callback+0x54/0x190\n[   97.937660]  __device_suspend+0x14c/0x4d0\n[   97.937661]  async_suspend+0x23/0x70\n[   97.937663]  async_run_entry_fn+0x33/0x120\n[   97.937664]  process_one_work+0x21f/0x3f0\n[   97.937666]  worker_thread+0x4a/0x3c0\n[   97.937668]  ? process_one_work+0x3f0/0x3f0\n[   97.937669]  kthread+0xf0/0x120\n[   97.937671]  ? kthread_complete_and_exit+0x20/0x20\n[   97.937672]  ret_from_fork+0x22/0x30\n[   97.937676]  \u003c/TASK\u003e\n\nv2. fixed \"warning: variable 'aq_vec' set but not used\"\n\nv3. simplified a for loop",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8203d08d-8aec-4cb2-8ba3-4f74c9567e62",
      "id": "CVE-2022-50098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts\n\nEnsure SRB is returned during I/O timeout error escalation. If that is not\npossible fail the escalation path.\n\nFollowing crash stack was seen:\n\nBUG: unable to handle kernel paging request at 0000002f56aa90f8\nIP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx]\nCall Trace:\n ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx]\n ? qla2x00_start_sp+0x116/0x1170 [qla2xxx]\n ? dma_pool_alloc+0x1d6/0x210\n ? mempool_alloc+0x54/0x130\n ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx]\n ? qla_do_work+0x2d/0x40 [qla2xxx]\n ? process_one_work+0x14c/0x390",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cdafeec8-ee89-4839-9677-91a0916a4a9a",
      "id": "CVE-2022-50185",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()\n\nThe last case label can write two buffers 'mc_reg_address[j]' and\n'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE\nsince there are no checks for this value in both case labels after the\nlast 'j++'.\n\nInstead of changing '\u003e' to '\u003e=' there, add the bounds check at the start\nof the second 'case' (the first one already has it).\n\nAlso, remove redundant last checks for 'j' index bigger than array size.\nThe expression is always false. Moreover, before or after the patch\n'table-\u003elast' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it\nseems it can be a valid value.\n\nDetected using the static analysis tool - Svace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "febb6565-50f6-4231-8f14-70dbee7322be",
      "id": "CVE-2022-50222",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vt: initialize unicode screen buffer\n\nsyzbot reports kernel infoleak at vcs_read() [1], for buffer can be read\nimmediately after resize operation. Initialize buffer using kzalloc().\n\n  ----------\n  #include \u003cfcntl.h\u003e\n  #include \u003cunistd.h\u003e\n  #include \u003csys/ioctl.h\u003e\n  #include \u003clinux/fb.h\u003e\n\n  int main(int argc, char *argv[])\n  {\n    struct fb_var_screeninfo var = { };\n    const int fb_fd = open(\"/dev/fb0\", 3);\n    ioctl(fb_fd, FBIOGET_VSCREENINFO, \u0026var);\n    var.yres = 0x21;\n    ioctl(fb_fd, FBIOPUT_VSCREENINFO, \u0026var);\n    return read(open(\"/dev/vcsu\", O_RDONLY), \u0026var, sizeof(var)) == -1;\n  }\n  ----------",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb8dc0af-9259-4fb6-bddf-b76ec56eec2c",
      "id": "CVE-2022-50253",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: make sure skb-\u003elen != 0 when redirecting to a tunneling device\n\nsyzkaller managed to trigger another case where skb-\u003elen == 0\nwhen we enter __dev_queue_xmit:\n\nWARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline]\nWARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295\n\nCall Trace:\n dev_queue_xmit+0x17/0x20 net/core/dev.c:4406\n __bpf_tx_skb net/core/filter.c:2115 [inline]\n __bpf_redirect_no_mac net/core/filter.c:2140 [inline]\n __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163\n ____bpf_clone_redirect net/core/filter.c:2447 [inline]\n bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419\n bpf_prog_48159a89cb4a9a16+0x59/0x5e\n bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline]\n __bpf_prog_run include/linux/filter.h:596 [inline]\n bpf_prog_run include/linux/filter.h:603 [inline]\n bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402\n bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170\n bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648\n __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005\n __do_sys_bpf kernel/bpf/syscall.c:5091 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5089 [inline]\n __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089\n do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48\n entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nThe reproducer doesn't really reproduce outside of syzkaller\nenvironment, so I'm taking a guess here. It looks like we\ndo generate correct ETH_HLEN-sized packet, but we redirect\nthe packet to the tunneling device. Before we do so, we\n__skb_pull l2 header and arrive again at skb-\u003elen == 0.\nDoesn't seem like we can do anything better than having\nan explicit check after __skb_pull?",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8acee23c-2b23-4981-9cfe-7f7820fcd384",
      "id": "CVE-2023-2430",
      "description": "A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88e6af62-fbfb-419a-af56-2a3aadf7e91d",
      "id": "CVE-2023-28328",
      "description": "A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "840158e9-5ffb-4aba-af65-8a960863c92e",
      "id": "CVE-2023-3357",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57a27827-d08b-4ef9-bfc3-d97386835b37",
      "id": "CVE-2023-4194",
      "description": "A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 (\"tun: tun_chr_open(): correctly initialize socket uid\"), - 66b2c338adce (\"tap: tap_open(): correctly initialize socket uid\"), pass \"inode-\u003ei_uid\" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5348d818-5a80-477b-8ebd-4c833d8bca9e",
      "id": "CVE-2023-52506",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Set all reserved memblocks on Node#0 at initialization\n\nAfter commit 61167ad5fecdea (\"mm: pass nid to reserve_bootmem_region()\")\nwe get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled:\n\n[    0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18\n[    0.000000] Oops[#1]:\n[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733\n[    0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90\n[    0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0\n[    0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000\n[    0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800\n[    0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20\n[    0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000\n[    0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000\n[    0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000\n[    0.000000]    ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c\n[    0.000000]   ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c\n[    0.000000]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n[    0.000000]  PRMD: 00000000 (PPLV0 -PIE -PWE)\n[    0.000000]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n[    0.000000]  ECFG: 00070800 (LIE=11 VS=7)\n[    0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0)\n[    0.000000]  BADV: 0000000000002b82\n[    0.000000]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)\n[    0.000000] Modules linked in:\n[    0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))\n[    0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00\n[    0.000000]         900000000470e000 90000000002c1918 0000000000000000 9000000004110780\n[    0.000000]         00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748\n[    0.000000]         0000000000000000 900000000421ca84 9000000004620000 9000000004564970\n[    0.000000]         90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000\n[    0.000000]         9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000\n[    0.000000]         0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918\n[    0.000000]         90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000\n[    0.000000]         90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c\n[    0.000000]         9000000004270008 0000000000000001 0000000000000000 90000000045ccd00\n[    0.000000]         ...\n[    0.000000] Call Trace:\n[    0.000000] [\u003c90000000040e3f28\u003e] reserve_bootmem_region+0xfc/0x21c\n[    0.000000] [\u003c900000000421ca84\u003e] memblock_free_all+0x114/0x350\n[    0.000000] [\u003c9000000004218b2c\u003e] mm_core_init+0x138/0x3cc\n[    0.000000] [\u003c9000000004200e38\u003e] start_kernel+0x488/0x7a4\n[    0.000000] [\u003c90000000040df0d8\u003e] kernel_entry+0xd8/0xdc\n[    0.000000]\n[    0.000000] Code: 02eb21ad  00410f4c  380c31ac \u003c262b818d\u003e 6800b70d  02c1c196  0015001c  57fe4bb1  260002cd\n\nThe reason is early memblock_reserve() in memblock_init() set node id to\nMAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chain\nreserve_bootmem_region() -\u003e init_reserved_page(). After memblock_init(),\nthose late calls of memblock_reserve() operate on subregions of memblock\n.memory regions. As a result, these reserved regions will be set to the\ncorrect node at the first iteration of memmap_init_reserved_pages().\n\nSo set all reserved memblocks on Node#0 at initialization can avoid this\npanic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40e6382b-4118-4cec-92b4-4e71418a2698",
      "id": "CVE-2023-52600",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix uaf in jfs_evict_inode\n\nWhen the execution of diMount(ipimap) fails, the object ipimap that has been\nreleased may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs\nwhen rcu_core() calls jfs_free_node().\n\nTherefore, when diMount(ipimap) fails, sbi-\u003eipimap should not be initialized as\nipimap.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61cdaeab-26af-41c6-8705-48f9eb24e5c0",
      "id": "CVE-2023-52629",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\n\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\n\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(\u0026psw-\u003ework)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw-\u003estate = 0 // use\n\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcdd713d-2f46-4188-8b3e-fe88a7aebe76",
      "id": "CVE-2023-52818",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: Fix UBSAN array-index-out-of-bounds for SMU7\n\nFor pptable structs that use flexible array sizes, use flexible arrays.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5cf7b725-3c2b-44f3-98ad-68c9e607fc86",
      "id": "CVE-2023-52847",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: bttv: fix use after free error due to btv-\u003etimeout timer\n\nThere may be some a race condition between timer function\nbttv_irq_timeout and bttv_remove. The timer is setup in\nprobe and there is no timer_delete operation in remove\nfunction. When it hit kfree btv, the function might still be\ninvoked, which will cause use after free bug.\n\nThis bug is found by static analysis, it may be false positive.\n\nFix it by adding del_timer_sync invoking to the remove function.\n\ncpu0                cpu1\n                  bttv_probe\n                    -\u003etimer_setup\n                      -\u003ebttv_set_dma\n                        -\u003emod_timer;\nbttv_remove\n  -\u003ekfree(btv);\n                  -\u003ebttv_irq_timeout\n                    -\u003eUSE btv",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bea07263-ef2f-404f-a1c0-36f2b9924b24",
      "id": "CVE-2023-53003",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info\n\nThe memory for llcc_driv_data is allocated by the LLCC driver. But when\nit is passed as the private driver info to the EDAC core, it will get freed\nduring the qcom_edac driver release. So when the qcom_edac driver gets probed\nagain, it will try to use the freed data leading to the use-after-free bug.\n\nHence, do not pass llcc_driv_data as pvt_info but rather reference it\nusing the platform_data pointer in the qcom_edac driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d08d9e04-6b4b-4d02-bbaf-20c5cb4c31d8",
      "id": "CVE-2023-53044",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm stats: check for and propagate alloc_percpu failure\n\nCheck alloc_precpu()'s return value and return an error from\ndm_stats_init() if it fails. Update alloc_dev() to fail if\ndm_stats_init() does.\n\nOtherwise, a NULL pointer dereference will occur in dm_stats_cleanup()\neven if dm-stats isn't being actively used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "918aba67-9bed-4da8-8b12-7c088b47e696",
      "id": "CVE-2023-53075",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix invalid address access in lookup_rec() when index is 0\n\nKASAN reported follow problem:\n\n BUG: KASAN: use-after-free in lookup_rec\n Read of size 8 at addr ffff000199270ff0 by task modprobe\n CPU: 2 Comm: modprobe\n Call trace:\n  kasan_report\n  __asan_load8\n  lookup_rec\n  ftrace_location\n  arch_check_ftrace_location\n  check_kprobe_address_safe\n  register_kprobe\n\nWhen checking pg-\u003erecords[pg-\u003eindex - 1].ip in lookup_rec(), it can get a\npg which is newly added to ftrace_pages_start in ftrace_process_locs().\nBefore the first pg-\u003eindex++, index is 0 and accessing pg-\u003erecords[-1].ip\nwill cause this problem.\n\nDon't check the ip when pg-\u003eindex is 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4d1236d-6cdb-40c4-aef3-3bb4764d4f6d",
      "id": "CVE-2023-53153",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Fix use after free for wext\n\nKey information in wext.connect is not reset on (re)connect and can hold\ndata from a previous connection.\n\nReset key data to avoid that drivers or mac80211 incorrectly detect a\nWEP connection request and access the freed or already reused memory.\n\nAdditionally optimize cfg80211_sme_connect() and avoid an useless\nschedule of conn_work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba46e8ed-fcfc-41da-8d61-9ceb0d7a88c0",
      "id": "CVE-2023-53314",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev/ep93xx-fb: Do not assign to struct fb_info.dev\n\nDo not assing the Linux device to struct fb_info.dev. The call to\nregister_framebuffer() initializes the field to the fbdev device.\nDrivers should not override its value.\n\nFixes a bug where the driver incorrectly decreases the hardware\ndevice's reference counter and leaks the fbdev device.\n\nv2:\n\t* add Fixes tag (Dan)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d3364c5-2f22-4733-aa6c-18a98d6fa9d0",
      "id": "CVE-2023-53400",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Fix Oops by 9.1 surround channel names\n\nget_line_out_pfx() may trigger an Oops by overflowing the static array\nwith more than 8 channels.  This was reported for MacBookPro 12,1 with\nCirrus codec.\n\nAs a workaround, extend for the 9.1 channels and also fix the\npotential Oops by unifying the code paths accessing the same array\nwith the proper size check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e052fe81-e338-4036-aeb4-af7f98c98c77",
      "id": "CVE-2024-0775",
      "description": "A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c4f05e18-d984-4d63-9be6-d6612da19abc",
      "id": "CVE-2024-26614",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: make sure init the accept_queue's spinlocks once\n\nWhen I run syz's reproduction C program locally, it causes the following\nissue:\npvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0!\nWARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508)\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nRIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508)\nCode: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7\n30 20 ce 8f e8 ad 56 42 ff \u003c0f\u003e 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90\nRSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908\nRDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900\nRBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff\nR10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000\nR13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000\nFS:  00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0\nCall Trace:\n\u003cIRQ\u003e\n  _raw_spin_unlock (kernel/locking/spinlock.c:186)\n  inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321)\n  inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358)\n  tcp_check_req (net/ipv4/tcp_minisocks.c:868)\n  tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260)\n  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)\n  ip_local_deliver_finish (net/ipv4/ip_input.c:234)\n  __netif_receive_skb_one_core (net/core/dev.c:5529)\n  process_backlog (./include/linux/rcupdate.h:779)\n  __napi_poll (net/core/dev.c:6533)\n  net_rx_action (net/core/dev.c:6604)\n  __do_softirq (./arch/x86/include/asm/jump_label.h:27)\n  do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)\n\u003c/IRQ\u003e\n\u003cTASK\u003e\n  __local_bh_enable_ip (kernel/softirq.c:381)\n  __dev_queue_xmit (net/core/dev.c:4374)\n  ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235)\n  __ip_queue_xmit (net/ipv4/ip_output.c:535)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1462)\n  tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469)\n  tcp_rcv_state_process (net/ipv4/tcp_input.c:6657)\n  tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929)\n  __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968)\n  release_sock (net/core/sock.c:3536)\n  inet_wait_for_connect (net/ipv4/af_inet.c:609)\n  __inet_stream_connect (net/ipv4/af_inet.c:702)\n  inet_stream_connect (net/ipv4/af_inet.c:748)\n  __sys_connect (./include/linux/file.h:45 net/socket.c:2064)\n  __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070)\n  do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)\n  RIP: 0033:0x7fa10ff05a3d\n  Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89\n  c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48\n  RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a\n  RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d\n  RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003\n  RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640\n  R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20\n\u003c/TASK\u003e\n\nThe issue triggering process is analyzed as follows:\nThread A                                       Thread B\ntcp_v4_rcv\t//receive ack TCP packet       inet_shutdown\n  tcp_check_req                                  tcp_disconnect //disconnect sock\n  ...                                              tcp_set_state(sk, TCP_CLOSE)\n    inet_csk_complete_hashdance                ...\n      inet_csk_reqsk_queue_add         \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4413cd13-3956-4737-954f-51488531a46d",
      "id": "CVE-2024-26774",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt\n\nDetermine if bb_fragments is 0 instead of determining bb_free to eliminate\nthe risk of dividing by zero when the block bitmap is corrupted.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3274e12f-7635-4584-84ba-9c83c324ee50",
      "id": "CVE-2024-46861",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: ipheth: do not stop RX on failing RX callback\n\nRX callbacks can fail for multiple reasons:\n\n* Payload too short\n* Payload formatted incorrecly (e.g. bad NCM framing)\n* Lack of memory\n\nNone of these should cause the driver to seize up.\n\nMake such failures non-critical and continue processing further\nincoming URBs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9d049c9-b005-4aee-ae80-c71cea364aeb",
      "id": "CVE-2024-49881",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: update orig_path in ext4_find_extent()\n\nIn ext4_find_extent(), if the path is not big enough, we free it and set\n*orig_path to NULL. But after reallocating and successfully initializing\nthe path, we don't update *orig_path, in which case the caller gets a\nvalid path but a NULL ppath, and this may cause a NULL pointer dereference\nor a path memory leak. For example:\n\next4_split_extent\n  path = *ppath = 2000\n  ext4_find_extent\n    if (depth \u003e path[0].p_maxdepth)\n      kfree(path = 2000);\n      *orig_path = path = NULL;\n      path = kcalloc() = 3000\n  ext4_split_extent_at(*ppath = NULL)\n    path = *ppath;\n    ex = path[depth].p_ext;\n    // NULL pointer dereference!\n\n==================================================================\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nCPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847\nRIP: 0010:ext4_split_extent_at+0x6d/0x560\nCall Trace:\n \u003cTASK\u003e\n ext4_split_extent.isra.0+0xcb/0x1b0\n ext4_ext_convert_to_initialized+0x168/0x6c0\n ext4_ext_handle_unwritten_extents+0x325/0x4d0\n ext4_ext_map_blocks+0x520/0xdb0\n ext4_map_blocks+0x2b0/0x690\n ext4_iomap_begin+0x20e/0x2c0\n[...]\n==================================================================\n\nTherefore, *orig_path is updated when the extent lookup succeeds, so that\nthe caller can safely use path or *ppath.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bd093a1-f2b7-49b0-b9c2-4f3b93d69b94",
      "id": "CVE-2024-26830",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not allow untrusted VF to remove administratively set MAC\n\nCurrently when PF administratively sets VF's MAC address and the VF\nis put down (VF tries to delete all MACs) then the MAC is removed\nfrom MAC filters and primary VF MAC is zeroed.\n\nDo not allow untrusted VF to remove primary MAC when it was set\nadministratively by PF.\n\nReproducer:\n1) Create VF\n2) Set VF interface up\n3) Administratively set the VF's MAC\n4) Put VF interface down\n\n[root@host ~]# echo 1 \u003e /sys/class/net/enp2s0f0/device/sriov_numvfs\n[root@host ~]# ip link set enp2s0f0v0 up\n[root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n    link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n    vf 0     link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off\n[root@host ~]# ip link set enp2s0f0v0 down\n[root@host ~]# ip link show enp2s0f0\n23: enp2s0f0: \u003cBROADCAST,MULTICAST,UP,LOWER_UP\u003e mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n    link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff\n    vf 0     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8bf3a1c2-fe60-4853-accb-7410841028d0",
      "id": "CVE-2024-26994",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Avoid crash on very long word\n\nIn case a console is set up really large and contains a really long word\n(\u003e 256 characters), we have to stop before the length of the word buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94eae6c3-3dfa-44e2-82f5-c5d41661626d",
      "id": "CVE-2024-35946",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: fix null pointer access when abort scan\n\nDuring cancel scan we might use vif that weren't scanning.\nFix this by using the actual scanning vif.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b02a862a-718d-4131-a918-dc4b05d0f70c",
      "id": "CVE-2024-37356",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix shift-out-of-bounds in dctcp_update_alpha().\n\nIn dctcp_update_alpha(), we use a module parameter dctcp_shift_g\nas follows:\n\n  alpha -= min_not_zero(alpha, alpha \u003e\u003e dctcp_shift_g);\n  ...\n  delivered_ce \u003c\u003c= (10 - dctcp_shift_g);\n\nIt seems syzkaller started fuzzing module parameters and triggered\nshift-out-of-bounds [0] by setting 100 to dctcp_shift_g:\n\n  memcpy((void*)0x20000080,\n         \"/sys/module/tcp_dctcp/parameters/dctcp_shift_g\\000\", 47);\n  res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,\n                /*flags=*/2ul, /*mode=*/0ul);\n  memcpy((void*)0x20000000, \"100\\000\", 4);\n  syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);\n\nLet's limit the max value of dctcp_shift_g by param_set_uint_minmax().\n\nWith this patch:\n\n  # echo 10 \u003e /sys/module/tcp_dctcp/parameters/dctcp_shift_g\n  # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g\n  10\n  # echo 11 \u003e /sys/module/tcp_dctcp/parameters/dctcp_shift_g\n  -bash: echo: write error: Invalid argument\n\n[0]:\nUBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12\nshift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int')\nCPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114\n ubsan_epilogue lib/ubsan.c:231 [inline]\n __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468\n dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143\n tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline]\n tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948\n tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711\n tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937\n sk_backlog_rcv include/net/sock.h:1106 [inline]\n __release_sock+0x20f/0x350 net/core/sock.c:2983\n release_sock+0x61/0x1f0 net/core/sock.c:3549\n mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907\n mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976\n __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072\n mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127\n inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437\n __sock_release net/socket.c:659 [inline]\n sock_close+0xc0/0x240 net/socket.c:1421\n __fput+0x41b/0x890 fs/file_table.c:422\n task_work_run+0x23b/0x300 kernel/task_work.c:180\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x9c8/0x2540 kernel/exit.c:878\n do_group_exit+0x201/0x2b0 kernel/exit.c:1027\n __do_sys_exit_group kernel/exit.c:1038 [inline]\n __se_sys_exit_group kernel/exit.c:1036 [inline]\n __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x67/0x6f\nRIP: 0033:0x7f6c2b5005b6\nCode: Unable to access opcode bytes at 0x7f6c2b50058c.\nRSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6\nRDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001\nRBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0\nR10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0\nR13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "388d9fd9-a695-4bdc-93fe-1f5bef1c6794",
      "id": "CVE-2024-38541",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: module: add buffer overflow check in of_modalias()\n\nIn of_modalias(), if the buffer happens to be too small even for the 1st\nsnprintf() call, the len parameter will become negative and str parameter\n(if not NULL initially) will point beyond the buffer's end. Add the buffer\noverflow check after the 1st snprintf() call and fix such check after the\nstrlen() call (accounting for the terminating NUL char).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4de05926-cd30-44f3-b9ec-80ec5f597bd3",
      "id": "CVE-2021-47636",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()\n\nFunction ubifs_wbuf_write_nolock() may access buf out of bounds in\nfollowing process:\n\nubifs_wbuf_write_nolock():\n  aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096\n  if (aligned_len \u003c= wbuf-\u003eavail) ... // Not satisfy\n  if (wbuf-\u003eused) {\n    ubifs_leb_write()  // Fill some data in avail wbuf\n    len -= wbuf-\u003eavail;   // len is still not 8-bytes aligned\n    aligned_len -= wbuf-\u003eavail;\n  }\n  n = aligned_len \u003e\u003e c-\u003emax_write_shift;\n  if (n) {\n    n \u003c\u003c= c-\u003emax_write_shift;\n    err = ubifs_leb_write(c, wbuf-\u003elnum, buf + written,\n                          wbuf-\u003eoffs, n);\n    // n \u003e len, read out of bounds less than 8(n-len) bytes\n  }\n\n, which can be catched by KASAN:\n  =========================================================\n  BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0\n  Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128\n  Workqueue: writeback wb_workfn (flush-ubifs_0_0)\n  Call Trace:\n    kasan_report.cold+0x81/0x165\n    nand_write_page_swecc+0xa9/0x160\n    ubifs_leb_write+0xf2/0x1b0 [ubifs]\n    ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]\n    write_head+0xdc/0x1c0 [ubifs]\n    ubifs_jnl_write_inode+0x627/0x960 [ubifs]\n    wb_workfn+0x8af/0xb80\n\nFunction ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8\nbytes aligned, the 'len' represents the true length of buf (which is\nallocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so\nubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully\nto write leb safely.\n\nFetch a reproducer in [Link].",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "536088d9-4c1d-43f8-aff6-5f4af966d3fb",
      "id": "CVE-2024-38635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: cadence: fix invalid PDI offset\n\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\n\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\n\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\n\nA follow-up patch completely removes this useless offset.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bcdc2c91-51b4-4efd-b72f-b6341388f193",
      "id": "CVE-2021-47257",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: fix null deref in parse dev addr\n\nFix a logic error that could result in a null deref if the user sets\nthe mode incorrectly for the given addr type.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06cfb3d3-54a8-4512-ac61-4093e12d1faf",
      "id": "CVE-2024-39467",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()\n\nsyzbot reports a kernel bug as below:\n\nF2FS-fs (loop0): Mounted with checkpoint version = 48b305e4\n==================================================================\nBUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]\nBUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline]\nBUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600\nRead of size 1 at addr ffff88807a58c76c by task syz-executor280/5076\n\nCPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]\n current_nat_addr fs/f2fs/node.h:213 [inline]\n f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600\n f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline]\n f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925\n ioctl_fiemap fs/ioctl.c:220 [inline]\n do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838\n __do_sys_ioctl fs/ioctl.c:902 [inline]\n __se_sys_ioctl+0x81/0x170 fs/ioctl.c:890\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is we missed to do sanity check on i_xattr_nid during\nf2fs_iget(), so that in fiemap() path, current_nat_addr() will access\nnat_bitmap w/ offset from invalid i_xattr_nid, result in triggering\nkasan bug report, fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b51880a-3034-4995-9891-d7dfe4b48ba3",
      "id": "CVE-2024-42154",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_metrics: validate source addr length\n\nI don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4\nis at least 4 bytes long, and the policy doesn't have an entry\nfor this attribute at all (neither does it for IPv6 but v6 is\nmanually validated).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6fccc2f5-6c2f-4fee-8eb3-20d32e7fb43a",
      "id": "CVE-2024-42284",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Return non-zero value from tipc_udp_addr2str() on error\n\ntipc_udp_addr2str() should return non-zero value if the UDP media\naddress is invalid. Otherwise, a buffer overflow access can occur in\ntipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP\nmedia address.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ce67621-b72e-425e-b4d0-e78805950fb5",
      "id": "CVE-2024-42302",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\n\nKeith reports a use-after-free when a DPC event occurs concurrently to\nhot-removal of the same portion of the hierarchy:\n\nThe dpc_handler() awaits readiness of the secondary bus below the\nDownstream Port where the DPC event occurred.  To do so, it polls the\nconfig space of the first child device on the secondary bus.  If that\nchild device is concurrently removed, accesses to its struct pci_dev\ncause the kernel to oops.\n\nThat's because pci_bridge_wait_for_secondary_bus() neglects to hold a\nreference on the child device.  Before v6.3, the function was only\ncalled on resume from system sleep or on runtime resume.  Holding a\nreference wasn't necessary back then because the pciehp IRQ thread\ncould never run concurrently.  (On resume from system sleep, IRQs are\nnot enabled until after the resume_noirq phase.  And runtime resume is\nalways awaited before a PCI device is removed.)\n\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\ncalled on a DPC event.  Commit 53b54ad074de (\"PCI/DPC: Await readiness\nof secondary bus after reset\"), which introduced that, failed to\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\nreference on the child device because dpc_handler() and pciehp may\nindeed run concurrently.  The commit was backported to v5.10+ stable\nkernels, so that's the oldest one affected.\n\nAdd the missing reference acquisition.\n\nAbridged stack trace:\n\n  BUG: unable to handle page fault for address: 00000000091400c0\n  CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\n  RIP: pci_bus_read_config_dword+0x17/0x50\n  pci_dev_wait()\n  pci_bridge_wait_for_secondary_bus()\n  dpc_reset_link()\n  pcie_do_recovery()\n  dpc_handler()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "808f3e79-f56b-41b3-96f8-00c85f6fc4f6",
      "id": "CVE-2024-50017",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/ident_map: Use gbpages only where full GB page should be mapped.\n\nWhen ident_pud_init() uses only GB pages to create identity maps, large\nranges of addresses not actually requested can be included in the resulting\ntable; a 4K request will map a full GB.  This can include a lot of extra\naddress space past that requested, including areas marked reserved by the\nBIOS.  That allows processor speculation into reserved regions, that on UV\nsystems can cause system halts.\n\nOnly use GB pages when map creation requests include the full GB page of\nspace.  Fall back to using smaller 2M pages when only portions of a GB page\nare included in the request.\n\nNo attempt is made to coalesce mapping requests. If a request requires a\nmap entry at the 2M (pmd) level, subsequent mapping requests within the\nsame 1G region will also be at the pmd level, even if adjacent or\noverlapping such requests could have been combined to map a full GB page.\nExisting usage starts with larger regions and then adds smaller regions, so\nthis should not have any great consequence.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b253fde7-d31d-4ba4-93af-765bf8714b2f",
      "id": "CVE-2024-50067",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobe: avoid out-of-bounds memory access of fetching args\n\nUprobe needs to fetch args into a percpu buffer, and then copy to ring\nbuffer to avoid non-atomic context problem.\n\nSometimes user-space strings, arrays can be very large, but the size of\npercpu buffer is only page size. And store_trace_args() won't check\nwhether these data exceeds a single page or not, caused out-of-bounds\nmemory access.\n\nIt could be reproduced by following steps:\n1. build kernel with CONFIG_KASAN enabled\n2. save follow program as test.c\n\n```\n\\#include \u003cstdio.h\u003e\n\\#include \u003cstdlib.h\u003e\n\\#include \u003cstring.h\u003e\n\n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()\n// will return 0, cause __get_data_size() return shorter size, and\n// store_trace_args() will not trigger out-of-bounds access.\n// So make string length less than 4096.\n\\#define STRLEN 4093\n\nvoid generate_string(char *str, int n)\n{\n    int i;\n    for (i = 0; i \u003c n; ++i)\n    {\n        char c = i % 26 + 'a';\n        str[i] = c;\n    }\n    str[n-1] = '\\0';\n}\n\nvoid print_string(char *str)\n{\n    printf(\"%s\\n\", str);\n}\n\nint main()\n{\n    char tmp[STRLEN];\n\n    generate_string(tmp, STRLEN);\n    print_string(tmp);\n\n    return 0;\n}\n```\n3. compile program\n`gcc -o test test.c`\n\n4. get the offset of `print_string()`\n```\nobjdump -t test | grep -w print_string\n0000000000401199 g     F .text  000000000000001b              print_string\n```\n\n5. configure uprobe with offset 0x1199\n```\noff=0x1199\n\ncd /sys/kernel/debug/tracing/\necho \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\"\n \u003e uprobe_events\necho 1 \u003e events/uprobes/enable\necho 1 \u003e tracing_on\n```\n\n6. run `test`, and kasan will report error.\n==================================================================\nBUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0\nWrite of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18\nHardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x55/0x70\n print_address_description.constprop.0+0x27/0x310\n kasan_report+0x10f/0x120\n ? strncpy_from_user+0x1d6/0x1f0\n strncpy_from_user+0x1d6/0x1f0\n ? rmqueue.constprop.0+0x70d/0x2ad0\n process_fetch_insn+0xb26/0x1470\n ? __pfx_process_fetch_insn+0x10/0x10\n ? _raw_spin_lock+0x85/0xe0\n ? __pfx__raw_spin_lock+0x10/0x10\n ? __pte_offset_map+0x1f/0x2d0\n ? unwind_next_frame+0xc5f/0x1f80\n ? arch_stack_walk+0x68/0xf0\n ? is_bpf_text_address+0x23/0x30\n ? kernel_text_address.part.0+0xbb/0xd0\n ? __kernel_text_address+0x66/0xb0\n ? unwind_get_return_address+0x5e/0xa0\n ? __pfx_stack_trace_consume_entry+0x10/0x10\n ? arch_stack_walk+0xa2/0xf0\n ? _raw_spin_lock_irqsave+0x8b/0xf0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? depot_alloc_stack+0x4c/0x1f0\n ? _raw_spin_unlock_irqrestore+0xe/0x30\n ? stack_depot_save_flags+0x35d/0x4f0\n ? kasan_save_stack+0x34/0x50\n ? kasan_save_stack+0x24/0x50\n ? mutex_lock+0x91/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n prepare_uprobe_buffer.part.0+0x2cd/0x500\n uprobe_dispatcher+0x2c3/0x6a0\n ? __pfx_uprobe_dispatcher+0x10/0x10\n ? __kasan_slab_alloc+0x4d/0x90\n handler_chain+0xdd/0x3e0\n handle_swbp+0x26e/0x3d0\n ? __pfx_handle_swbp+0x10/0x10\n ? uprobe_pre_sstep_notifier+0x151/0x1b0\n irqentry_exit_to_user_mode+0xe2/0x1b0\n asm_exc_int3+0x39/0x40\nRIP: 0033:0x401199\nCode: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce\nRSP: 002b:00007ffdf00576a8 EFLAGS: 00000206\nRAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2\nRDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0\nRBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20\nR10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040\nR13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e\n\nThis commit enforces the buffer's maxlen less than a page-size to avoid\nstore_trace_args() out-of-memory access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8064816a-c6f0-4428-96f7-d99401c85e1f",
      "id": "CVE-2024-50143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: fix uninit-value use in udf_get_fileshortad\n\nCheck for overflow when computing alen in udf_current_aext to mitigate\nlater uninit-value use in udf_get_fileshortad KMSAN bug[1].\nAfter applying the patch reproducer did not trigger any issue[2].\n\n[1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df\n[2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0cef307-37be-49a7-b51f-ee08c910d6c6",
      "id": "CVE-2024-50187",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Stop the active perfmon before being destroyed\n\nUpon closing the file descriptor, the active performance monitor is not\nstopped. Although all perfmons are destroyed in `vc4_perfmon_close_file()`,\nthe active performance monitor's pointer (`vc4-\u003eactive_perfmon`) is still\nretained.\n\nIf we open a new file descriptor and submit a few jobs with performance\nmonitors, the driver will attempt to stop the active performance monitor\nusing the stale pointer in `vc4-\u003eactive_perfmon`. However, this pointer\nis no longer valid because the previous process has already terminated,\nand all performance monitors associated with it have been destroyed and\nfreed.\n\nTo fix this, when the active performance monitor belongs to a given\nprocess, explicitly stop it before destroying and freeing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d10e664-8812-458d-a4df-811b12639092",
      "id": "CVE-2024-50283",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp\n\nksmbd_user_session_put should be called under smb3_preauth_hash_rsp().\nIt will avoid freeing session before calling smb3_preauth_hash_rsp().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "318c9eeb-1b17-4d3c-b70d-624de924a6ef",
      "id": "CVE-2024-53090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lock recursion\n\nafs_wake_up_async_call() can incur lock recursion.  The problem is that it\nis called from AF_RXRPC whilst holding the -\u003enotify_lock, but it tries to\ntake a ref on the afs_call struct in order to pass it to a work queue - but\nif the afs_call is already queued, we then have an extraneous ref that must\nbe put... calling afs_put_call() may call back down into AF_RXRPC through\nrxrpc_kernel_shutdown_call(), however, which might try taking the\n-\u003enotify_lock again.\n\nThis case isn't very common, however, so defer it to a workqueue.  The oops\nlooks something like:\n\n  BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646\n   lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0\n  CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351\n  Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x47/0x70\n   do_raw_spin_lock+0x3c/0x90\n   rxrpc_kernel_shutdown_call+0x83/0xb0\n   afs_put_call+0xd7/0x180\n   rxrpc_notify_socket+0xa0/0x190\n   rxrpc_input_split_jumbo+0x198/0x1d0\n   rxrpc_input_data+0x14b/0x1e0\n   ? rxrpc_input_call_packet+0xc2/0x1f0\n   rxrpc_input_call_event+0xad/0x6b0\n   rxrpc_input_packet_on_conn+0x1e1/0x210\n   rxrpc_input_packet+0x3f2/0x4d0\n   rxrpc_io_thread+0x243/0x410\n   ? __pfx_rxrpc_io_thread+0x10/0x10\n   kthread+0xcf/0xe0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x24/0x40\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1913b45b-7d9a-4b45-8901-f4bfcadb4ec7",
      "id": "CVE-2024-56630",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: free inode when ocfs2_get_init_inode() fails\n\nsyzbot is reporting busy inodes after unmount, for commit 9c89fe0af826\n(\"ocfs2: Handle error from dquot_initialize()\") forgot to call iput() when\nnew_inode() succeeded and dquot_initialize() failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55d229c2-8eef-46b3-ab91-769a20ec9df5",
      "id": "CVE-2024-56748",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()\n\nHook \"qed_ops-\u003ecommon-\u003esb_init = qed_sb_init\" does not release the DMA\nmemory sb_virt when it fails. Add dma_free_coherent() to free it. This\nis the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b8729f0-1574-47c5-95de-9cc6067df103",
      "id": "CVE-2024-58002",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Remove dangling pointers\n\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\n\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\n\nClean all the dangling pointers during release().\n\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9e00a6d-ee44-43df-9142-9d6a24b81d69",
      "id": "CVE-2024-58083",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Explicitly verify target vCPU is online in kvm_get_vcpu()\n\nExplicitly verify the target vCPU is fully online _prior_ to clamping the\nindex in kvm_get_vcpu().  If the index is \"bad\", the nospec clamping will\ngenerate '0', i.e. KVM will return vCPU0 instead of NULL.\n\nIn practice, the bug is unlikely to cause problems, as it will only come\ninto play if userspace or the guest is buggy or misbehaving, e.g. KVM may\nsend interrupts to vCPU0 instead of dropping them on the floor.\n\nHowever, returning vCPU0 when it shouldn't exist per online_vcpus is\nproblematic now that KVM uses an xarray for the vCPUs array, as KVM needs\nto insert into the xarray before publishing the vCPU to userspace (see\ncommit c5b077549136 (\"KVM: Convert the kvm-\u003evcpus array to a xarray\")),\ni.e. before vCPU creation is guaranteed to succeed.\n\nAs a result, incorrectly providing access to vCPU0 will trigger a\nuse-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu()\nbails out of vCPU creation due to an error and frees vCPU0.  Commit\nafb2acb2e3a3 (\"KVM: Fix vcpu_array[0] races\") papered over that issue, but\nin doing so introduced an unsolvable teardown conundrum.  Preventing\naccesses to vCPU0 before it's fully online will allow reverting commit\nafb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74ba1b9b-bedf-4c26-acfd-905418d6fc8b",
      "id": "CVE-2025-21638",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: sysctl: auth_enable: avoid using current-\u003ensproxy\n\nAs mentioned in a previous commit of this series, using the 'net'\nstructure via 'current' is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader's/writer's netns vs only\n  from the opener's netns.\n\n- current-\u003ensproxy can be NULL in some cases, resulting in an 'Oops'\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe 'net' structure can be obtained from the table-\u003edata using\ncontainer_of().\n\nNote that table-\u003edata could also be used directly, but that would\nincrease the size of this fix, while 'sctp.ctl_sock' still needs to be\nretrieved from 'net' structure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dda42c40-438b-4add-a440-4a0e6161b4c5",
      "id": "CVE-2025-21734",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix copy buffer page size\n\nFor non-registered buffer, fastrpc driver copies the buffer and\npass it to the remote subsystem. There is a problem with current\nimplementation of page size calculation which is not considering\nthe offset in the calculation. This might lead to passing of\nimproper and out-of-bounds page size which could result in\nmemory issue. Calculate page start and page end using the offset\nadjusted address instead of absolute address.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69992535-6462-454e-92d3-27c9a761bead",
      "id": "CVE-2025-21801",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ravb: Fix missing rtnl lock in suspend/resume path\n\nFix the suspend/resume path by ensuring the rtnl lock is held where\nrequired. Calls to ravb_open, ravb_close and wol operations must be\nperformed under the rtnl lock to prevent conflicts with ongoing ndo\noperations.\n\nWithout this fix, the following warning is triggered:\n[   39.032969] =============================\n[   39.032983] WARNING: suspicious RCU usage\n[   39.033019] -----------------------------\n[   39.033033] drivers/net/phy/phy_device.c:2004 suspicious\nrcu_dereference_protected() usage!\n...\n[   39.033597] stack backtrace:\n[   39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted\n6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7\n[   39.033623] Hardware name: Renesas SMARC EVK version 2 based on\nr9a08g045s33 (DT)\n[   39.033628] Call trace:\n[   39.033633]  show_stack+0x14/0x1c (C)\n[   39.033652]  dump_stack_lvl+0xb4/0xc4\n[   39.033664]  dump_stack+0x14/0x1c\n[   39.033671]  lockdep_rcu_suspicious+0x16c/0x22c\n[   39.033682]  phy_detach+0x160/0x190\n[   39.033694]  phy_disconnect+0x40/0x54\n[   39.033703]  ravb_close+0x6c/0x1cc\n[   39.033714]  ravb_suspend+0x48/0x120\n[   39.033721]  dpm_run_callback+0x4c/0x14c\n[   39.033731]  device_suspend+0x11c/0x4dc\n[   39.033740]  dpm_suspend+0xdc/0x214\n[   39.033748]  dpm_suspend_start+0x48/0x60\n[   39.033758]  suspend_devices_and_enter+0x124/0x574\n[   39.033769]  pm_suspend+0x1ac/0x274\n[   39.033778]  state_store+0x88/0x124\n[   39.033788]  kobj_attr_store+0x14/0x24\n[   39.033798]  sysfs_kf_write+0x48/0x6c\n[   39.033808]  kernfs_fop_write_iter+0x118/0x1a8\n[   39.033817]  vfs_write+0x27c/0x378\n[   39.033825]  ksys_write+0x64/0xf4\n[   39.033833]  __arm64_sys_write+0x18/0x20\n[   39.033841]  invoke_syscall+0x44/0x104\n[   39.033852]  el0_svc_common.constprop.0+0xb4/0xd4\n[   39.033862]  do_el0_svc+0x18/0x20\n[   39.033870]  el0_svc+0x3c/0xf0\n[   39.033880]  el0t_64_sync_handler+0xc0/0xc4\n[   39.033888]  el0t_64_sync+0x154/0x158\n[   39.041274] ravb 11c30000.ethernet eth0: Link is Down",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "926214e0-e6b7-4285-8e47-b6415bd585eb",
      "id": "CVE-2025-21956",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Assign normalized_pix_clk when color depth = 14\n\n[WHY \u0026 HOW]\nA warning message \"WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397\ncalculate_phy_pix_clks+0xef/0x100 [amdgpu]\" occurs because the\ndisplay_color_depth == COLOR_DEPTH_141414 is not handled. This is\nobserved in Radeon RX 6600 XT.\n\nIt is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests.\n\nAlso fixes the indentation in get_norm_pix_clk.\n\n(cherry picked from commit 274a87eb389f58eddcbc5659ab0b180b37e92775)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57a7d09a-b3f3-4e6a-baff-a98af1fa5836",
      "id": "CVE-2025-37742",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of imap allocated in the diMount() function\n\nsyzbot reports that hex_dump_to_buffer is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171\nhex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171\nprint_hex_dump+0x13d/0x3e0 lib/hexdump.c:276\ndiFree+0x5ba/0x4350 fs/jfs/jfs_imap.c:876\njfs_evict_inode+0x510/0x550 fs/jfs/inode.c:156\nevict+0x723/0xd10 fs/inode.c:796\niput_final fs/inode.c:1946 [inline]\niput+0x97b/0xdb0 fs/inode.c:1972\ntxUpdateMap+0xf3e/0x1150 fs/jfs/jfs_txnmgr.c:2367\ntxLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\njfs_lazycommit+0x627/0x11d0 fs/jfs/jfs_txnmgr.c:2733\nkthread+0x6b9/0xef0 kernel/kthread.c:464\nret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148\nret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nUninit was created at:\nslab_post_alloc_hook mm/slub.c:4121 [inline]\nslab_alloc_node mm/slub.c:4164 [inline]\n__kmalloc_cache_noprof+0x8e3/0xdf0 mm/slub.c:4320\nkmalloc_noprof include/linux/slab.h:901 [inline]\ndiMount+0x61/0x7f0 fs/jfs/jfs_imap.c:105\njfs_mount+0xa8e/0x11d0 fs/jfs/jfs_mount.c:176\njfs_fill_super+0xa47/0x17c0 fs/jfs/super.c:523\nget_tree_bdev_flags+0x6ec/0x910 fs/super.c:1636\nget_tree_bdev+0x37/0x50 fs/super.c:1659\njfs_get_tree+0x34/0x40 fs/jfs/super.c:635\nvfs_get_tree+0xb1/0x5a0 fs/super.c:1814\ndo_new_mount+0x71f/0x15e0 fs/namespace.c:3560\npath_mount+0x742/0x1f10 fs/namespace.c:3887\ndo_mount fs/namespace.c:3900 [inline]\n__do_sys_mount fs/namespace.c:4111 [inline]\n__se_sys_mount+0x71f/0x800 fs/namespace.c:4088\n__x64_sys_mount+0xe4/0x150 fs/namespace.c:4088\nx64_sys_call+0x39bf/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:166\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n=====================================================\n\nThe reason is that imap is not properly initialized after memory\nallocation. It will cause the snprintf() function to write uninitialized\ndata into linebuf within hex_dump_to_buffer().\n\nFix this by using kzalloc instead of kmalloc to clear its content at the\nbeginning in diMount().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d676f7b-342d-4025-bd34-5ba5ddbdaa63",
      "id": "CVE-2025-37963",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: bpf: Only mitigate cBPF programs loaded by unprivileged users\n\nSupport for eBPF programs loaded by unprivileged users is typically\ndisabled. This means only cBPF programs need to be mitigated for BHB.\n\nIn addition, only mitigate cBPF programs that were loaded by an\nunprivileged user. Privileged users can also load the same program\nvia eBPF, making the mitigation pointless.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29bb7be1-b43a-45db-bc49-4d7c1ba4d2f6",
      "id": "CVE-2021-31829",
      "description": "kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "168fad0f-2226-4c95-8c7f-9d215b896838",
      "id": "CVE-2025-38048",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_ring: Fix data race by tagging event_triggered as racy for KCSAN\n\nsyzbot reports a data-race when accessing the event_triggered, here is the\nsimplified stack when the issue occurred:\n\n==================================================================\nBUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed\n\nwrite to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0:\n virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653\n start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264\n __netdev_start_xmit include/linux/netdevice.h:5151 [inline]\n netdev_start_xmit include/linux/netdevice.h:5160 [inline]\n xmit_one net/core/dev.c:3800 [inline]\n\nread to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1:\n virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline]\n virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566\n skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777\n vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715\n __handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158\n handle_irq_event_percpu kernel/irq/handle.c:193 [inline]\n\nvalue changed: 0x01 -\u003e 0x00\n==================================================================\n\nWhen the data race occurs, the function virtqueue_enable_cb_delayed() sets\nevent_triggered to false, and virtqueue_disable_cb_split/packed() reads it\nas false due to the race condition. Since event_triggered is an unreliable\nhint used for optimization, this should only cause the driver temporarily\nsuggest that the device not send an interrupt notification when the event\nindex is used.\n\nFix this KCSAN reported data-race issue by explicitly tagging the access as\ndata_racy.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a33416a-2d2f-4494-9f41-f077d7cfe989",
      "id": "CVE-2025-38153",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: aqc111: fix error handling of usbnet read calls\n\nSyzkaller, courtesy of syzbot, identified an error (see report [1]) in\naqc111 driver, caused by incomplete sanitation of usb read calls'\nresults. This problem is quite similar to the one fixed in commit\n920a9fa27e78 (\"net: asix: add proper error handling of usb read errors\").\n\nFor instance, usbnet_read_cmd() may read fewer than 'size' bytes,\neven if the caller expected the full amount, and aqc111_read_cmd()\nwill not check its result properly. As [1] shows, this may lead\nto MAC address in aqc111_bind() being only partly initialized,\ntriggering KMSAN warnings.\n\nFix the issue by verifying that the number of bytes read is\nas expected and not less.\n\n[1] Partial syzbot report:\nBUG: KMSAN: uninit-value in is_valid_ether_addr include/linux/etherdevice.h:208 [inline]\nBUG: KMSAN: uninit-value in usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830\n is_valid_ether_addr include/linux/etherdevice.h:208 [inline]\n usbnet_probe+0x2e57/0x4390 drivers/net/usb/usbnet.c:1830\n usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396\n call_driver_probe drivers/base/dd.c:-1 [inline]\n really_probe+0x4d1/0xd90 drivers/base/dd.c:658\n __driver_probe_device+0x268/0x380 drivers/base/dd.c:800\n...\n\nUninit was stored to memory at:\n dev_addr_mod+0xb0/0x550 net/core/dev_addr_lists.c:582\n __dev_addr_set include/linux/netdevice.h:4874 [inline]\n eth_hw_addr_set include/linux/etherdevice.h:325 [inline]\n aqc111_bind+0x35f/0x1150 drivers/net/usb/aqc111.c:717\n usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772\n usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396\n...\n\nUninit was stored to memory at:\n ether_addr_copy include/linux/etherdevice.h:305 [inline]\n aqc111_read_perm_mac drivers/net/usb/aqc111.c:663 [inline]\n aqc111_bind+0x794/0x1150 drivers/net/usb/aqc111.c:713\n usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772\n usb_probe_interface+0xd01/0x1310 drivers/usb/core/driver.c:396\n call_driver_probe drivers/base/dd.c:-1 [inline]\n...\n\nLocal variable buf.i created at:\n aqc111_read_perm_mac drivers/net/usb/aqc111.c:656 [inline]\n aqc111_bind+0x221/0x1150 drivers/net/usb/aqc111.c:713\n usbnet_probe+0xbe6/0x4390 drivers/net/usb/usbnet.c:1772",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88abdd19-821f-41bd-b125-41c624ee5a31",
      "id": "CVE-2025-38198",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Make sure modelist not set on unregistered console\n\nIt looks like attempting to write to the \"store_modes\" sysfs node will\nrun afoul of unregistered consoles:\n\nUBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28\nindex -1 is out of range for type 'fb_info *[32]'\n...\n fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122\n fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048\n fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673\n store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113\n dev_attr_store+0x55/0x80 drivers/base/core.c:2439\n\nstatic struct fb_info *fbcon_registered_fb[FB_MAX];\n...\nstatic signed char con2fb_map[MAX_NR_CONSOLES];\n...\nstatic struct fb_info *fbcon_info_from_console(int console)\n...\n        return fbcon_registered_fb[con2fb_map[console]];\n\nIf con2fb_map contains a -1 things go wrong here. Instead, return NULL,\nas callers of fbcon_info_from_console() are trying to compare against\nexisting \"info\" pointers, so error handling should kick in correctly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "60266b44-629e-4e88-8888-66b8e20d4510",
      "id": "CVE-2025-38232",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix race between nfsd registration and exports_proc\n\nAs of now nfsd calls create_proc_exports_entry() at start of init_nfsd\nand cleanup by remove_proc_entry() at last of exit_nfsd.\n\nWhich causes kernel OOPs if there is race between below 2 operations:\n(i) exportfs -r\n(ii) mount -t nfsd none /proc/fs/nfsd\n\nfor 5.4 kernel ARM64:\n\nCPU 1:\nel1_irq+0xbc/0x180\narch_counter_get_cntvct+0x14/0x18\nrunning_clock+0xc/0x18\npreempt_count_add+0x88/0x110\nprep_new_page+0xb0/0x220\nget_page_from_freelist+0x2d8/0x1778\n__alloc_pages_nodemask+0x15c/0xef0\n__vmalloc_node_range+0x28c/0x478\n__vmalloc_node_flags_caller+0x8c/0xb0\nkvmalloc_node+0x88/0xe0\nnfsd_init_net+0x6c/0x108 [nfsd]\nops_init+0x44/0x170\nregister_pernet_operations+0x114/0x270\nregister_pernet_subsys+0x34/0x50\ninit_nfsd+0xa8/0x718 [nfsd]\ndo_one_initcall+0x54/0x2e0\n\nCPU 2 :\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n\nPC is at : exports_net_open+0x50/0x68 [nfsd]\n\nCall trace:\nexports_net_open+0x50/0x68 [nfsd]\nexports_proc_open+0x2c/0x38 [nfsd]\nproc_reg_open+0xb8/0x198\ndo_dentry_open+0x1c4/0x418\nvfs_open+0x38/0x48\npath_openat+0x28c/0xf18\ndo_filp_open+0x70/0xe8\ndo_sys_open+0x154/0x248\n\nSometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().\n\nand same is happening on latest 6.14 kernel as well:\n\n[    0.000000] Linux version 6.14.0-rc5-next-20250304-dirty\n...\n[  285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48\n...\n[  285.464902] pc : cache_seq_next_rcu+0x78/0xa4\n...\n[  285.469695] Call trace:\n[  285.470083]  cache_seq_next_rcu+0x78/0xa4 (P)\n[  285.470488]  seq_read+0xe0/0x11c\n[  285.470675]  proc_reg_read+0x9c/0xf0\n[  285.470874]  vfs_read+0xc4/0x2fc\n[  285.471057]  ksys_read+0x6c/0xf4\n[  285.471231]  __arm64_sys_read+0x1c/0x28\n[  285.471428]  invoke_syscall+0x44/0x100\n[  285.471633]  el0_svc_common.constprop.0+0x40/0xe0\n[  285.471870]  do_el0_svc_compat+0x1c/0x34\n[  285.472073]  el0_svc_compat+0x2c/0x80\n[  285.472265]  el0t_32_sync_handler+0x90/0x140\n[  285.472473]  el0t_32_sync+0x19c/0x1a0\n[  285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)\n[  285.473422] ---[ end trace 0000000000000000 ]---\n\nIt reproduced simply with below script:\nwhile [ 1 ]\ndo\n/exportfs -r\ndone \u0026\n\nwhile [ 1 ]\ndo\ninsmod /nfsd.ko\nmount -t nfsd none /proc/fs/nfsd\numount /proc/fs/nfsd\nrmmod nfsd\ndone \u0026\n\nSo exporting interfaces to user space shall be done at last and\ncleanup at first place.\n\nWith change there is no Kernel OOPs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61d734c8-faca-43f6-a288-482b83312c6c",
      "id": "CVE-2025-38465",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: Fix wraparounds of sk-\u003esk_rmem_alloc.\n\nNetlink has this pattern in some places\n\n  if (atomic_read(\u0026sk-\u003esk_rmem_alloc) \u003e sk-\u003esk_rcvbuf)\n  \tatomic_add(skb-\u003etruesize, \u0026sk-\u003esk_rmem_alloc);\n\n, which has the same problem fixed by commit 5a465a0da13e (\"udp:\nFix multiple wraparounds of sk-\u003esk_rmem_alloc.\").\n\nFor example, if we set INT_MAX to SO_RCVBUFFORCE, the condition\nis always false as the two operands are of int.\n\nThen, a single socket can eat as many skb as possible until OOM\nhappens, and we can see multiple wraparounds of sk-\u003esk_rmem_alloc.\n\nLet's fix it by using atomic_add_return() and comparing the two\nvariables as unsigned int.\n\nBefore:\n  [root@fedora ~]# ss -f netlink\n  Recv-Q      Send-Q Local Address:Port                Peer Address:Port\n  -1668710080 0               rtnl:nl_wraparound/293               *\n\nAfter:\n  [root@fedora ~]# ss -f netlink\n  Recv-Q     Send-Q Local Address:Port                Peer Address:Port\n  2147483072 0               rtnl:nl_wraparound/290               *\n  ^\n  `--- INT_MAX - 576",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8d2b741-9c02-460d-b3bd-60b0b3220f72",
      "id": "CVE-2022-49601",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.\n\nWhile reading sysctl_tcp_fwmark_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94e7b52b-8dd8-4630-83e2-53f6acac6e11",
      "id": "CVE-2025-39781",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Drop WARN_ON_ONCE() from flush_cache_vmap\n\nI have observed warning to occassionally trigger.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bbbdc09b-6738-44b0-86d9-c052f73d7017",
      "id": "CVE-2025-39925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: implement NETDEV_UNREGISTER notification handler\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for vcan0 to become free. Usage count = 2\n\nproblem, for j1939 protocol did not have NETDEV_UNREGISTER notification\nhandler for undoing changes made by j1939_sk_bind().\n\nCommit 25fe97cb7620 (\"can: j1939: move j1939_priv_put() into sk_destruct\ncallback\") expects that a call to j1939_priv_put() can be unconditionally\ndelayed until j1939_sk_sock_destruct() is called. But we need to call\nj1939_priv_put() against an extra ref held by j1939_sk_bind() call\n(as a part of undoing changes made by j1939_sk_bind()) as soon as\nNETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct()\nis called via j1939_sk_release()). Otherwise, the extra ref on \"struct\nj1939_priv\" held by j1939_sk_bind() call prevents \"struct net_device\" from\ndropping the usage count to 1; making it impossible for\nunregister_netdevice() to continue.\n\n[mkl: remove space in front of label]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "290b163f-e8fd-471b-9337-f0b580c4df44",
      "id": "CVE-2020-36516",
      "description": "An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c9dc73a-debe-4ffd-99e7-1651e41478b5",
      "id": "CVE-2021-20321",
      "description": "A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06c6127a-e8db-4de4-85c9-9d8e4fa9e8dd",
      "id": "CVE-2021-23134",
      "description": "Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6720fc4a-ce52-4cd9-a070-f8a806683f9a",
      "id": "CVE-2021-3669",
      "description": "A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78fa2c23-4323-4a42-b787-72200e6024fb",
      "id": "CVE-2021-38160",
      "description": "In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf-\u003elen value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3c83d2f-61ad-4e14-be56-0f6a01987264",
      "id": "CVE-2021-4001",
      "description": "A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f875bbc-20e0-4688-829b-010bc108ff69",
      "id": "CVE-2021-4037",
      "description": "A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b37a11ce-1e51-43f5-be4d-117f7a2b9a5c",
      "id": "CVE-2021-46943",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging/intel-ipu3: Fix set_fmt error handling\n\nIf there in an error during a set_fmt, do not overwrite the previous\nsizes with the invalid config.\n\nWithout this patch, v4l2-compliance ends up allocating 4GiB of RAM and\ncausing the following OOPs\n\n[   38.662975] ipu3-imgu 0000:00:05.0: swiotlb buffer is full (sz: 4096 bytes)\n[   38.662980] DMA: Out of SW-IOMMU space for 4096 bytes at device 0000:00:05.0\n[   38.663010] general protection fault: 0000 [#1] PREEMPT SMP",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27c8512e-21de-4a5e-a36c-76dd9d9e9ef3",
      "id": "CVE-2021-47138",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxgb4: avoid accessing registers when clearing filters\n\nHardware register having the server TID base can contain\ninvalid values when adapter is in bad state (for example,\ndue to AER fatal error). Reading these invalid values in the\nregister can lead to out-of-bound memory access. So, fix\nby using the saved server TID base when clearing filters.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ccbe140-7c5f-4fd8-8977-98addb2c94f7",
      "id": "CVE-2021-47229",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: aardvark: Fix kernel panic during PIO transfer\n\nTrying to start a new PIO transfer by writing value 0 in PIO_START register\nwhen previous transfer has not yet completed (which is indicated by value 1\nin PIO_START) causes an External Abort on CPU, which results in kernel\npanic:\n\n    SError Interrupt on CPU0, code 0xbf000002 -- SError\n    Kernel panic - not syncing: Asynchronous SError Interrupt\n\nTo prevent kernel panic, it is required to reject a new PIO transfer when\nprevious one has not finished yet.\n\nIf previous PIO transfer is not finished yet, the kernel may issue a new\nPIO request only if the previous PIO transfer timed out.\n\nIn the past the root cause of this issue was incorrectly identified (as it\noften happens during link retraining or after link down event) and special\nhack was implemented in Trusted Firmware to catch all SError events in EL3,\nto ignore errors with code 0xbf000002 and not forwarding any other errors\nto kernel and instead throw panic from EL3 Trusted Firmware handler.\n\nLinks to discussion and patches about this issue:\nhttps://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50\nhttps://lore.kernel.org/linux-pci/20190316161243.29517-1-repk@triplefau.lt/\nhttps://lore.kernel.org/linux-pci/971be151d24312cc533989a64bd454b4@www.loen.fr/\nhttps://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541\n\nBut the real cause was the fact that during link retraining or after link\ndown event the PIO transfer may take longer time, up to the 1.44s until it\ntimes out. This increased probability that a new PIO transfer would be\nissued by kernel while previous one has not finished yet.\n\nAfter applying this change into the kernel, it is possible to revert the\nmentioned TF-A hack and SError events do not have to be caught in TF-A EL3.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1297bbb5-5182-41af-a742-cf25e33c8705",
      "id": "CVE-2021-47253",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential memory leak in DMUB hw_init\n\n[Why]\nOn resume we perform DMUB hw_init which allocates memory:\ndm_resume-\u003edm_dmub_hw_init-\u003edc_dmub_srv_create-\u003ekzalloc\nThat results in memory leak in suspend/resume scenarios.\n\n[How]\nAllocate memory for the DC wrapper to DMUB only if it was not\nallocated before.\nNo need to reallocate it on suspend/resume.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97cae57c-30e5-4f13-acf4-dcbae544b729",
      "id": "CVE-2021-47361",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmcb: fix error handling in mcb_alloc_bus()\n\nThere are two bugs:\n1) If ida_simple_get() fails then this code calls put_device(carrier)\n   but we haven't yet called get_device(carrier) and probably that\n   leads to a use after free.\n2) After device_initialize() then we need to use put_device() to\n   release the bus.  This will free the internal resources tied to the\n   device and call mcb_free_bus() which will free the rest.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "767df9bf-4787-49bf-9edd-da4e17855d66",
      "id": "CVE-2021-47379",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd\n\nKASAN reports a use-after-free report when doing fuzz test:\n\n[693354.104835] ==================================================================\n[693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338\n\n[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147\n[693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018\n[693354.105612] Call Trace:\n[693354.105621]  dump_stack+0xf1/0x19b\n[693354.105626]  ? show_regs_print_info+0x5/0x5\n[693354.105634]  ? printk+0x9c/0xc3\n[693354.105638]  ? cpumask_weight+0x1f/0x1f\n[693354.105648]  print_address_description+0x70/0x360\n[693354.105654]  kasan_report+0x1b2/0x330\n[693354.105659]  ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105665]  ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105670]  bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105675]  ? bfq_cpd_init+0x20/0x20\n[693354.105683]  cgroup_file_write+0x3aa/0x510\n[693354.105693]  ? ___slab_alloc+0x507/0x540\n[693354.105698]  ? cgroup_file_poll+0x60/0x60\n[693354.105702]  ? 0xffffffff89600000\n[693354.105708]  ? usercopy_abort+0x90/0x90\n[693354.105716]  ? mutex_lock+0xef/0x180\n[693354.105726]  kernfs_fop_write+0x1ab/0x280\n[693354.105732]  ? cgroup_file_poll+0x60/0x60\n[693354.105738]  vfs_write+0xe7/0x230\n[693354.105744]  ksys_write+0xb0/0x140\n[693354.105749]  ? __ia32_sys_read+0x50/0x50\n[693354.105760]  do_syscall_64+0x112/0x370\n[693354.105766]  ? syscall_return_slowpath+0x260/0x260\n[693354.105772]  ? do_page_fault+0x9b/0x270\n[693354.105779]  ? prepare_exit_to_usermode+0xf9/0x1a0\n[693354.105784]  ? enter_from_user_mode+0x30/0x30\n[693354.105793]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.105875] Allocated by task 1453337:\n[693354.106001]  kasan_kmalloc+0xa0/0xd0\n[693354.106006]  kmem_cache_alloc_node_trace+0x108/0x220\n[693354.106010]  bfq_pd_alloc+0x96/0x120\n[693354.106015]  blkcg_activate_policy+0x1b7/0x2b0\n[693354.106020]  bfq_create_group_hierarchy+0x1e/0x80\n[693354.106026]  bfq_init_queue+0x678/0x8c0\n[693354.106031]  blk_mq_init_sched+0x1f8/0x460\n[693354.106037]  elevator_switch_mq+0xe1/0x240\n[693354.106041]  elevator_switch+0x25/0x40\n[693354.106045]  elv_iosched_store+0x1a1/0x230\n[693354.106049]  queue_attr_store+0x78/0xb0\n[693354.106053]  kernfs_fop_write+0x1ab/0x280\n[693354.106056]  vfs_write+0xe7/0x230\n[693354.106060]  ksys_write+0xb0/0x140\n[693354.106064]  do_syscall_64+0x112/0x370\n[693354.106069]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106114] Freed by task 1453336:\n[693354.106225]  __kasan_slab_free+0x130/0x180\n[693354.106229]  kfree+0x90/0x1b0\n[693354.106233]  blkcg_deactivate_policy+0x12c/0x220\n[693354.106238]  bfq_exit_queue+0xf5/0x110\n[693354.106241]  blk_mq_exit_sched+0x104/0x130\n[693354.106245]  __elevator_exit+0x45/0x60\n[693354.106249]  elevator_switch_mq+0xd6/0x240\n[693354.106253]  elevator_switch+0x25/0x40\n[693354.106257]  elv_iosched_store+0x1a1/0x230\n[693354.106261]  queue_attr_store+0x78/0xb0\n[693354.106264]  kernfs_fop_write+0x1ab/0x280\n[693354.106268]  vfs_write+0xe7/0x230\n[693354.106271]  ksys_write+0xb0/0x140\n[693354.106275]  do_syscall_64+0x112/0x370\n[693354.106280]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106329] The buggy address belongs to the object at ffff888be0a35580\n                 which belongs to the cache kmalloc-1k of size 1024\n[693354.106736] The buggy address is located 228 bytes inside of\n                 1024-byte region [ffff888be0a35580, ffff888be0a35980)\n[693354.107114] The buggy address belongs to the page:\n[693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0\n[693354.107606] flags: 0x17ffffc0008100(slab|head)\n[693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080\n[693354.108020] r\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f6681ea-797f-46e2-86a6-f33b01919569",
      "id": "CVE-2021-47550",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdgpu: fix potential memleak\n\nIn function amdgpu_get_xgmi_hive, when kobject_init_and_add failed\nThere is a potential memleak if not call kobject_put.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c19fccc-1603-4c11-9dfb-56bd7de7c84d",
      "id": "CVE-2021-47597",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet_diag: fix kernel-infoleak for UDP sockets\n\nKMSAN reported a kernel-infoleak [1], that can exploited\nby unpriv users.\n\nAfter analysis it turned out UDP was not initializing\nr-\u003eidiag_expires. Other users of inet_sk_diag_fill()\nmight make the same mistake in the future, so fix this\nin inet_sk_diag_fill().\n\n[1]\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]\nBUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:156 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x69d/0x25c0 lib/iov_iter.c:670\n instrument_copy_to_user include/linux/instrumented.h:121 [inline]\n copyout lib/iov_iter.c:156 [inline]\n _copy_to_iter+0x69d/0x25c0 lib/iov_iter.c:670\n copy_to_iter include/linux/uio.h:155 [inline]\n simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519\n __skb_datagram_iter+0x2cb/0x1280 net/core/datagram.c:425\n skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533\n skb_copy_datagram_msg include/linux/skbuff.h:3657 [inline]\n netlink_recvmsg+0x660/0x1c60 net/netlink/af_netlink.c:1974\n sock_recvmsg_nosec net/socket.c:944 [inline]\n sock_recvmsg net/socket.c:962 [inline]\n sock_read_iter+0x5a9/0x630 net/socket.c:1035\n call_read_iter include/linux/fs.h:2156 [inline]\n new_sync_read fs/read_write.c:400 [inline]\n vfs_read+0x1631/0x1980 fs/read_write.c:481\n ksys_read+0x28c/0x520 fs/read_write.c:619\n __do_sys_read fs/read_write.c:629 [inline]\n __se_sys_read fs/read_write.c:627 [inline]\n __x64_sys_read+0xdb/0x120 fs/read_write.c:627\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974\n kmalloc_reserve net/core/skbuff.c:354 [inline]\n __alloc_skb+0x545/0xf90 net/core/skbuff.c:426\n alloc_skb include/linux/skbuff.h:1126 [inline]\n netlink_dump+0x3d5/0x16a0 net/netlink/af_netlink.c:2245\n __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370\n netlink_dump_start include/linux/netlink.h:254 [inline]\n inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1343\n sock_diag_rcv_msg+0x24a/0x620\n netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491\n sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:276\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg net/socket.c:724 [inline]\n sock_write_iter+0x594/0x690 net/socket.c:1057\n do_iter_readv_writev+0xa7f/0xc70\n do_iter_write+0x52c/0x1500 fs/read_write.c:851\n vfs_writev fs/read_write.c:924 [inline]\n do_writev+0x63f/0xe30 fs/read_write.c:967\n __do_sys_writev fs/read_write.c:1040 [inline]\n __se_sys_writev fs/read_write.c:1037 [inline]\n __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBytes 68-71 of 312 are uninitialized\nMemory access of size 312 starts at ffff88812ab54000\nData copied to user address 0000000020001440\n\nCPU: 1 PID: 6365 Comm: syz-executor801 Not tainted 5.16.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c302edff-bd2a-4ad4-93a7-90c9f8472226",
      "id": "CVE-2021-47650",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: soc-compress: prevent the potentially use of null pointer\n\nThere is one call trace that snd_soc_register_card()\n-\u003esnd_soc_bind_card()-\u003esoc_init_pcm_runtime()\n-\u003esnd_soc_dai_compress_new()-\u003esnd_soc_new_compress().\nIn the trace the 'codec_dai' transfers from card-\u003edai_link,\nand we can see from the snd_soc_add_pcm_runtime() in\nsnd_soc_bind_card() that, if value of card-\u003edai_link-\u003enum_codecs\nis 0, then 'codec_dai' could be null pointer caused\nby index out of bound in 'asoc_rtd_to_codec(rtd, 0)'.\nAnd snd_soc_register_card() is called by various platforms.\nTherefore, it is better to add the check in the case of misusing.\nAnd because 'cpu_dai' has already checked in soc_init_pcm_runtime(),\nthere is no need to check again.\nAdding the check as follow, then if 'codec_dai' is null,\nsnd_soc_new_compress() will not pass through the check\n'if (playback + capture != 1)', avoiding the leftover use of\n'codec_dai'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "464bb98c-5781-4a14-b440-bf02de8075a4",
      "id": "CVE-2022-2196",
      "description": "A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a42b643a-47ec-4a57-81ef-6a42201a8d0b",
      "id": "CVE-2022-38457",
      "description": "A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb845560-d4b7-469b-983a-3767b95d4da5",
      "id": "CVE-2022-41848",
      "description": "drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f2163c50-f860-4592-bb8a-d6ba4418a4c9",
      "id": "CVE-2025-38705",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix null pointer access\n\nWriting a string without delimiters (' ', '\\n', '\\0') to the under\ngpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile\nwill result in a null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9c8909f-5a5d-47d9-9224-84cddaed9c42",
      "id": "CVE-2022-48423",
      "description": "In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32358ff0-336a-460c-a127-4720ed7738b4",
      "id": "CVE-2022-48695",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix use-after-free warning\n\nFix the following use-after-free warning which is observed during\ncontroller reset:\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df742f08-d1f4-47cf-b9ec-ffca8a421496",
      "id": "CVE-2022-48877",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: let's avoid panic if extent_tree is not created\n\nThis patch avoids the below panic.\n\npc : __lookup_extent_tree+0xd8/0x760\nlr : f2fs_do_write_data_page+0x104/0x87c\nsp : ffffffc010cbb3c0\nx29: ffffffc010cbb3e0 x28: 0000000000000000\nx27: ffffff8803e7f020 x26: ffffff8803e7ed40\nx25: ffffff8803e7f020 x24: ffffffc010cbb460\nx23: ffffffc010cbb480 x22: 0000000000000000\nx21: 0000000000000000 x20: ffffffff22e90900\nx19: 0000000000000000 x18: ffffffc010c5d080\nx17: 0000000000000000 x16: 0000000000000020\nx15: ffffffdb1acdbb88 x14: ffffff888759e2b0\nx13: 0000000000000000 x12: ffffff802da49000\nx11: 000000000a001200 x10: ffffff8803e7ed40\nx9 : ffffff8023195800 x8 : ffffff802da49078\nx7 : 0000000000000001 x6 : 0000000000000000\nx5 : 0000000000000006 x4 : ffffffc010cbba28\nx3 : 0000000000000000 x2 : ffffffc010cbb480\nx1 : 0000000000000000 x0 : ffffff8803e7ed40\nCall trace:\n __lookup_extent_tree+0xd8/0x760\n f2fs_do_write_data_page+0x104/0x87c\n f2fs_write_single_data_page+0x420/0xb60\n f2fs_write_cache_pages+0x418/0xb1c\n __f2fs_write_data_pages+0x428/0x58c\n f2fs_write_data_pages+0x30/0x40\n do_writepages+0x88/0x190\n __writeback_single_inode+0x48/0x448\n writeback_sb_inodes+0x468/0x9e8\n __writeback_inodes_wb+0xb8/0x2a4\n wb_writeback+0x33c/0x740\n wb_do_writeback+0x2b4/0x400\n wb_workfn+0xe4/0x34c\n process_one_work+0x24c/0x5bc\n worker_thread+0x3e8/0xa50\n kthread+0x150/0x1b4",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a04b2a8b-3203-4025-91bd-a0d95449cba4",
      "id": "CVE-2022-48941",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix concurrent reset and removal of VFs\n\nCommit c503e63200c6 (\"ice: Stop processing VF messages during teardown\")\nintroduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is\nintended to prevent some issues with concurrently handling messages from\nVFs while tearing down the VFs.\n\nThis change was motivated by crashes caused while tearing down and\nbringing up VFs in rapid succession.\n\nIt turns out that the fix actually introduces issues with the VF driver\ncaused because the PF no longer responds to any messages sent by the VF\nduring its .remove routine. This results in the VF potentially removing\nits DMA memory before the PF has shut down the device queues.\n\nAdditionally, the fix doesn't actually resolve concurrency issues within\nthe ice driver. It is possible for a VF to initiate a reset just prior\nto the ice driver removing VFs. This can result in the remove task\nconcurrently operating while the VF is being reset. This results in\nsimilar memory corruption and panics purportedly fixed by that commit.\n\nFix this concurrency at its root by protecting both the reset and\nremoval flows using the existing VF cfg_lock. This ensures that we\ncannot remove the VF while any outstanding critical tasks such as a\nvirtchnl message or a reset are occurring.\n\nThis locking change also fixes the root cause originally fixed by commit\nc503e63200c6 (\"ice: Stop processing VF messages during teardown\"), so we\ncan simply revert it.\n\nNote that I kept these two changes together because simply reverting the\noriginal commit alone would leave the driver vulnerable to worse race\nconditions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5fd47502-ade9-4f9b-a5e1-0d4d3eb2f26e",
      "id": "CVE-2022-49536",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix SCSI I/O completion and abort handler deadlock\n\nDuring stress I/O tests with 500+ vports, hard LOCKUP call traces are\nobserved.\n\nCPU A:\n native_queued_spin_lock_slowpath+0x192\n _raw_spin_lock_irqsave+0x32\n lpfc_handle_fcp_err+0x4c6\n lpfc_fcp_io_cmd_wqe_cmpl+0x964\n lpfc_sli4_fp_handle_cqe+0x266\n __lpfc_sli4_process_cq+0x105\n __lpfc_sli4_hba_process_cq+0x3c\n lpfc_cq_poll_hdler+0x16\n irq_poll_softirq+0x76\n __softirqentry_text_start+0xe4\n irq_exit+0xf7\n do_IRQ+0x7f\n\nCPU B:\n native_queued_spin_lock_slowpath+0x5b\n _raw_spin_lock+0x1c\n lpfc_abort_handler+0x13e\n scmd_eh_abort_handler+0x85\n process_one_work+0x1a7\n worker_thread+0x30\n kthread+0x112\n ret_from_fork+0x1f\n\nDiagram of lockup:\n\nCPUA                            CPUB\n----                            ----\nlpfc_cmd-\u003ebuf_lock\n                            phba-\u003ehbalock\n                            lpfc_cmd-\u003ebuf_lock\nphba-\u003ehbalock\n\nFix by reordering the taking of the lpfc_cmd-\u003ebuf_lock and phba-\u003ehbalock in\nlpfc_abort_handler routine so that it tries to take the lpfc_cmd-\u003ebuf_lock\nfirst before phba-\u003ehbalock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a27e3882-510c-494f-8a19-4964247a59a6",
      "id": "CVE-2022-48975",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: fix memory leak in gpiochip_setup_dev()\n\nHere is a backtrace report about memory leak detected in\ngpiochip_setup_dev():\n\nunreferenced object 0xffff88810b406400 (size 512):\n  comm \"python3\", pid 1682, jiffies 4295346908 (age 24.090s)\n  backtrace:\n    kmalloc_trace\n    device_add\t\tdevice_private_init at drivers/base/core.c:3361\n\t\t\t(inlined by) device_add at drivers/base/core.c:3411\n    cdev_device_add\n    gpiolib_cdev_register\n    gpiochip_setup_dev\n    gpiochip_add_data_with_key\n\ngcdev_register() \u0026 gcdev_unregister() would call device_add() \u0026\ndevice_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to\nregister/unregister device.\n\nHowever, if device_add() succeeds, some resource (like\nstruct device_private allocated by device_private_init())\nis not released by device_del().\n\nTherefore, after device_add() succeeds by gcdev_register(), it\nneeds to call put_device() to release resource in the error handle\npath.\n\nHere we move forward the register of release function, and let it\nrelease every piece of resource by put_device() instead of kfree().\n\nWhile at it, fix another subtle issue, i.e. when gc-\u003engpio is equal\nto 0, we still call kcalloc() and, in case of further error, kfree()\non the ZERO_PTR pointer, which is not NULL. It's not a bug per se,\nbut rather waste of the resources and potentially wrong expectation\nabout contents of the gdev-\u003edescs variable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bf0185f-a7a7-443f-ad30-f313e2f16120",
      "id": "CVE-2022-49033",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()\n\nSyzkaller reported BUG as follows:\n\n  BUG: sleeping function called from invalid context at\n       include/linux/sched/mm.h:274\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0xcd/0x134\n   __might_resched.cold+0x222/0x26b\n   kmem_cache_alloc+0x2e7/0x3c0\n   update_qgroup_limit_item+0xe1/0x390\n   btrfs_qgroup_inherit+0x147b/0x1ee0\n   create_subvol+0x4eb/0x1710\n   btrfs_mksubvol+0xfe5/0x13f0\n   __btrfs_ioctl_snap_create+0x2b0/0x430\n   btrfs_ioctl_snap_create_v2+0x25a/0x520\n   btrfs_ioctl+0x2a1c/0x5ce0\n   __x64_sys_ioctl+0x193/0x200\n   do_syscall_64+0x35/0x80\n\nFix this by calling qgroup_dirty() on @dstqgroup, and update limit item in\nbtrfs_run_qgroups() later outside of the spinlock context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b26bb061-de2e-4315-abf6-550995e894ba",
      "id": "CVE-2022-49058",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: potential buffer overflow in handling symlinks\n\nSmatch printed a warning:\n\tarch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error:\n\t__memcpy() 'dctx-\u003ebuf' too small (16 vs u32max)\n\nIt's caused because Smatch marks 'link_len' as untrusted since it comes\nfrom sscanf(). Add a check to ensure that 'link_len' is not larger than\nthe size of the 'link_str' buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66d7eb7c-0243-440f-98ea-98a49b0d1c1d",
      "id": "CVE-2022-49135",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix memory leak\n\n[why]\nResource release is needed on the error handling path\nto prevent memory leak.\n\n[how]\nFix this by adding kfree on the error handling path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ea20e00-64d9-495d-b114-504810ed00ce",
      "id": "CVE-2022-49286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: use try_get_ops() in tpm-space.c\n\nAs part of the series conversion to remove nested TPM operations:\n\nhttps://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/\n\nexposure of the chip-\u003etpm_mutex was removed from much of the upper\nlevel code.  In this conversion, tpm2_del_space() was missed.  This\ndidn't matter much because it's usually called closely after a\nconverted operation, so there's only a very tiny race window where the\nchip can be removed before the space flushing is done which causes a\nNULL deref on the mutex.  However, there are reports of this window\nbeing hit in practice, so fix this by converting tpm2_del_space() to\nuse tpm_try_get_ops(), which performs all the teardown checks before\nacquring the mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f75434fd-729c-44c2-b045-96e9a64ce8a6",
      "id": "CVE-2022-49593",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_probe_interval.\n\nWhile reading sysctl_tcp_probe_interval, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87fb115d-6b6f-49f2-809d-79769edb0869",
      "id": "CVE-2022-49298",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix uninit-value in r871xu_drv_init()\n\nWhen 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,\n'mac[6]' will not be initialized.\n\nBUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541\n r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541\n usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396\n really_probe+0x653/0x14b0 drivers/base/dd.c:596\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238\n usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293\n really_probe+0x653/0x14b0 drivers/base/dd.c:596\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566\n hub_port_connect drivers/usb/core/hub.c:5358 [inline]\n hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]\n port_event drivers/usb/core/hub.c:5660 [inline]\n hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742\n process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307\n worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454\n kthread+0x3c7/0x500 kernel/kthread.c:377\n ret_from_fork+0x1f/0x30\n\nLocal variable mac created at:\n r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394\n usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396\n\nKMSAN: uninit-value in r871xu_drv_init\nhttps://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "349b876d-f6e6-4420-b719-c3250cfdac43",
      "id": "CVE-2022-49381",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix memory leak in jffs2_do_fill_super\n\nIf jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns\nan error, we can observe the following kmemleak report:\n\n--------------------------------------------\nunreferenced object 0xffff888105a65340 (size 64):\n  comm \"mount\", pid 710, jiffies 4302851558 (age 58.239s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff859c45e5\u003e] kmem_cache_alloc_trace+0x475/0x8a0\n    [\u003cffffffff86160146\u003e] jffs2_sum_init+0x96/0x1a0\n    [\u003cffffffff86140e25\u003e] jffs2_do_mount_fs+0x745/0x2120\n    [\u003cffffffff86149fec\u003e] jffs2_do_fill_super+0x35c/0x810\n    [\u003cffffffff8614aae9\u003e] jffs2_fill_super+0x2b9/0x3b0\n    [...]\nunreferenced object 0xffff8881bd7f0000 (size 65536):\n  comm \"mount\", pid 710, jiffies 4302851558 (age 58.239s)\n  hex dump (first 32 bytes):\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n  backtrace:\n    [\u003cffffffff858579ba\u003e] kmalloc_order+0xda/0x110\n    [\u003cffffffff85857a11\u003e] kmalloc_order_trace+0x21/0x130\n    [\u003cffffffff859c2ed1\u003e] __kmalloc+0x711/0x8a0\n    [\u003cffffffff86160189\u003e] jffs2_sum_init+0xd9/0x1a0\n    [\u003cffffffff86140e25\u003e] jffs2_do_mount_fs+0x745/0x2120\n    [\u003cffffffff86149fec\u003e] jffs2_do_fill_super+0x35c/0x810\n    [\u003cffffffff8614aae9\u003e] jffs2_fill_super+0x2b9/0x3b0\n    [...]\n--------------------------------------------\n\nThis is because the resources allocated in jffs2_sum_init() are not\nreleased. Call jffs2_sum_exit() to release these resources to solve\nthe problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6000797d-893b-47ea-85c5-2c0026ab96d5",
      "id": "CVE-2022-49470",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event\n\nWe should not access skb buffer data anymore after hci_recv_frame was\ncalled.\n\n[   39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0\n[   39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker\n[   39.634962] Call trace:\n[   39.634974]  dump_backtrace+0x0/0x3b8\n[   39.634999]  show_stack+0x20/0x2c\n[   39.635016]  dump_stack_lvl+0x60/0x78\n[   39.635040]  print_address_description+0x70/0x2f0\n[   39.635062]  kasan_report+0x154/0x194\n[   39.635079]  __asan_report_load1_noabort+0x44/0x50\n[   39.635099]  btmtksdio_recv_event+0x1b0/0x1c4\n[   39.635129]  btmtksdio_txrx_work+0x6cc/0xac4\n[   39.635157]  process_one_work+0x560/0xc5c\n[   39.635177]  worker_thread+0x7ec/0xcc0\n[   39.635195]  kthread+0x2d0/0x3d0\n[   39.635215]  ret_from_fork+0x10/0x20\n[   39.635247] Allocated by task 0:\n[   39.635260] (stack is not available)\n[   39.635281] Freed by task 2392:\n[   39.635295]  kasan_save_stack+0x38/0x68\n[   39.635319]  kasan_set_track+0x28/0x3c\n[   39.635338]  kasan_set_free_info+0x28/0x4c\n[   39.635357]  ____kasan_slab_free+0x104/0x150\n[   39.635374]  __kasan_slab_free+0x18/0x28\n[   39.635391]  slab_free_freelist_hook+0x114/0x248\n[   39.635410]  kfree+0xf8/0x2b4\n[   39.635427]  skb_free_head+0x58/0x98\n[   39.635447]  skb_release_data+0x2f4/0x410\n[   39.635464]  skb_release_all+0x50/0x60\n[   39.635481]  kfree_skb+0xc8/0x25c\n[   39.635498]  hci_event_packet+0x894/0xca4 [bluetooth]\n[   39.635721]  hci_rx_work+0x1c8/0x68c [bluetooth]\n[   39.635925]  process_one_work+0x560/0xc5c\n[   39.635951]  worker_thread+0x7ec/0xcc0\n[   39.635970]  kthread+0x2d0/0x3d0\n[   39.635990]  ret_from_fork+0x10/0x20\n[   39.636021] The buggy address belongs to the object at ffffff80cf28a600\n                which belongs to the cache kmalloc-512 of size 512\n[   39.636039] The buggy address is located 13 bytes inside of\n                512-byte region [ffffff80cf28a600, ffffff80cf28a800)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c7b0bf4c-0ea9-489f-940b-3520d49f955b",
      "id": "CVE-2022-49524",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: cx23885: Fix the error handling in cx23885_initdev()\n\nWhen the driver fails to call the dma_set_mask(), the driver will get\nthe following splat:\n\n[   55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240\n[   55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590\n[   55.856822] Call Trace:\n[   55.860327]  __process_removed_driver+0x3c/0x240\n[   55.861347]  bus_for_each_dev+0x102/0x160\n[   55.861681]  i2c_del_driver+0x2f/0x50\n\nThis is because the driver has initialized the i2c related resources\nin cx23885_dev_setup() but not released them in error handling, fix this\nbug by modifying the error path that jumps after failing to call the\ndma_set_mask().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4a025062-d911-4ae4-bb10-1bd5ed5ed8ce",
      "id": "CVE-2022-48651",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: Fix out-of-bound bugs caused by unset skb-\u003emac_header\n\nIf an AF_PACKET socket is used to send packets through ipvlan and the\ndefault xmit function of the AF_PACKET socket is changed from\ndev_queue_xmit() to packet_direct_xmit() via setsockopt() with the option\nname of PACKET_QDISC_BYPASS, the skb-\u003emac_header may not be reset and\nremains as the initial value of 65535, this may trigger slab-out-of-bounds\nbugs as following:\n\n=================================================================\nUG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]\nPU: 2 PID: 1768 Comm: raw_send Kdump: loaded Not tainted 6.0.0-rc4+ #6\nardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33\nall Trace:\nprint_address_description.constprop.0+0x1d/0x160\nprint_report.cold+0x4f/0x112\nkasan_report+0xa3/0x130\nipvlan_xmit_mode_l2+0xdb/0x330 [ipvlan]\nipvlan_start_xmit+0x29/0xa0 [ipvlan]\n__dev_direct_xmit+0x2e2/0x380\npacket_direct_xmit+0x22/0x60\npacket_snd+0x7c9/0xc40\nsock_sendmsg+0x9a/0xa0\n__sys_sendto+0x18a/0x230\n__x64_sys_sendto+0x74/0x90\ndo_syscall_64+0x3b/0x90\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe root cause is:\n  1. packet_snd() only reset skb-\u003emac_header when sock-\u003etype is SOCK_RAW\n     and skb-\u003eprotocol is not specified as in packet_parse_headers()\n\n  2. packet_direct_xmit() doesn't reset skb-\u003emac_header as dev_queue_xmit()\n\nIn this case, skb-\u003emac_header is 65535 when ipvlan_xmit_mode_l2() is\ncalled. So when ipvlan_xmit_mode_l2() gets mac header with eth_hdr() which\nuse \"skb-\u003ehead + skb-\u003emac_header\", out-of-bound access occurs.\n\nThis patch replaces eth_hdr() with skb_eth_hdr() in ipvlan_xmit_mode_l2()\nand reset mac header in multicast to solve this out-of-bound bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3b75b3a3-d490-490c-9a26-e349d645c256",
      "id": "CVE-2022-49649",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue\n\nxenvif_rx_next_skb() is expecting the rx queue not being empty, but\nin case the loop in xenvif_rx_action() is doing multiple iterations,\nthe availability of another skb in the rx queue is not being checked.\n\nThis can lead to crashes:\n\n[40072.537261] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080\n[40072.537407] IP: xenvif_rx_skb+0x23/0x590 [xen_netback]\n[40072.537534] PGD 0 P4D 0\n[40072.537644] Oops: 0000 [#1] SMP NOPTI\n[40072.537749] CPU: 0 PID: 12505 Comm: v1-c40247-q2-gu Not tainted 4.12.14-122.121-default #1 SLE12-SP5\n[40072.537867] Hardware name: HP ProLiant DL580 Gen9/ProLiant DL580 Gen9, BIOS U17 11/23/2021\n[40072.537999] task: ffff880433b38100 task.stack: ffffc90043d40000\n[40072.538112] RIP: e030:xenvif_rx_skb+0x23/0x590 [xen_netback]\n[40072.538217] RSP: e02b:ffffc90043d43de0 EFLAGS: 00010246\n[40072.538319] RAX: 0000000000000000 RBX: ffffc90043cd7cd0 RCX: 00000000000000f7\n[40072.538430] RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffffc90043d43df8\n[40072.538531] RBP: 000000000000003f R08: 000077ff80000000 R09: 0000000000000008\n[40072.538644] R10: 0000000000007ff0 R11: 00000000000008f6 R12: ffffc90043ce2708\n[40072.538745] R13: 0000000000000000 R14: ffffc90043d43ed0 R15: ffff88043ea748c0\n[40072.538861] FS: 0000000000000000(0000) GS:ffff880484600000(0000) knlGS:0000000000000000\n[40072.538988] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033\n[40072.539088] CR2: 0000000000000080 CR3: 0000000407ac8000 CR4: 0000000000040660\n[40072.539211] Call Trace:\n[40072.539319] xenvif_rx_action+0x71/0x90 [xen_netback]\n[40072.539429] xenvif_kthread_guest_rx+0x14a/0x29c [xen_netback]\n\nFix that by stopping the loop in case the rx queue becomes empty.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c27d11bb-039e-481e-a5fa-e5a003a9f1d0",
      "id": "CVE-2022-49719",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic/realview: Fix refcount leak in realview_gic_of_init\n\nof_find_matching_node_and_match() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b627d45b-6395-48e9-8919-7c5eb6d0bd87",
      "id": "CVE-2022-49770",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: avoid putting the realm twice when decoding snaps fails\n\nWhen decoding the snaps fails it maybe leaving the 'first_realm'\nand 'realm' pointing to the same snaprealm memory. And then it'll\nput it twice and could cause random use-after-free, BUG_ON, etc\nissues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28ae07a5-3d39-4899-a1bc-d1bd0aa23f62",
      "id": "CVE-2022-49825",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-transport: fix error handling in ata_tport_add()\n\nIn ata_tport_add(), the return value of transport_add_device() is\nnot checked. As a result, it causes null-ptr-deref while removing\nthe module, because transport_remove_device() is called to remove\nthe device that was not added.\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000d0\nCPU: 12 PID: 13605 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc3+ #8\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : device_del+0x48/0x39c\nlr : device_del+0x44/0x39c\nCall trace:\n device_del+0x48/0x39c\n attribute_container_class_device_del+0x28/0x40\n transport_remove_classdev+0x60/0x7c\n attribute_container_device_trigger+0x118/0x120\n transport_remove_device+0x20/0x30\n ata_tport_delete+0x34/0x60 [libata]\n ata_port_detach+0x148/0x1b0 [libata]\n ata_pci_remove_one+0x50/0x80 [libata]\n ahci_remove_one+0x4c/0x8c [ahci]\n\nFix this by checking and handling return value of transport_add_device()\nin ata_tport_add().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c885668-84f4-46aa-a830-49162768bb14",
      "id": "CVE-2022-49862",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix the msg-\u003ereq tlv len check in tipc_nl_compat_name_table_dump_header\n\nThis is a follow-up for commit 974cb0e3e7c9 (\"tipc: fix uninit-value\nin tipc_nl_compat_name_table_dump\") where it should have type casted\nsizeof(..) to int to work when TLV_GET_DATA_LEN() returns a negative\nvalue.\n\nsyzbot reported a call trace because of it:\n\n  BUG: KMSAN: uninit-value in ...\n   tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934\n   __tipc_nl_compat_dumpit+0xab2/0x1320 net/tipc/netlink_compat.c:238\n   tipc_nl_compat_dumpit+0x991/0xb50 net/tipc/netlink_compat.c:321\n   tipc_nl_compat_recv+0xb6e/0x1640 net/tipc/netlink_compat.c:1324\n   genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]\n   genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]\n   genl_rcv_msg+0x103f/0x1260 net/netlink/genetlink.c:792\n   netlink_rcv_skb+0x3a5/0x6c0 net/netlink/af_netlink.c:2501\n   genl_rcv+0x3c/0x50 net/netlink/genetlink.c:803\n   netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n   netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345\n   netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921\n   sock_sendmsg_nosec net/socket.c:714 [inline]\n   sock_sendmsg net/socket.c:734 [inline]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6a6303d-fbb7-4071-9358-743002675f8c",
      "id": "CVE-2022-48838",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: Fix use-after-free bug by not setting udc-\u003edev.driver\n\nThe syzbot fuzzer found a use-after-free bug:\n\nBUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:2320\nRead of size 8 at addr ffff88802b934098 by task udevd/3689\n\nCPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n dev_uevent+0x712/0x780 drivers/base/core.c:2320\n uevent_show+0x1b8/0x380 drivers/base/core.c:2391\n dev_attr_show+0x4b/0x90 drivers/base/core.c:2094\n\nAlthough the bug manifested in the driver core, the real cause was a\nrace with the gadget core.  dev_uevent() does:\n\n\tif (dev-\u003edriver)\n\t\tadd_uevent_var(env, \"DRIVER=%s\", dev-\u003edriver-\u003ename);\n\nand between the test and the dereference of dev-\u003edriver, the gadget\ncore sets dev-\u003edriver to NULL.\n\nThe race wouldn't occur if the gadget core registered its devices on\na real bus, using the standard synchronization techniques of the\ndriver core.  However, it's not necessary to make such a large change\nin order to fix this bug; all we need to do is make sure that\nudc-\u003edev.driver is always NULL.\n\nIn fact, there is no reason for udc-\u003edev.driver ever to be set to\nanything, let alone to the value it currently gets: the address of the\ngadget's driver.  After all, a gadget driver only knows how to manage\na gadget, not how to manage a UDC.\n\nThis patch simply removes the statements in the gadget core that touch\nudc-\u003edev.driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a65ef7fd-b082-4d7b-be37-f92f7b82545a",
      "id": "CVE-2022-49881",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix memory leak in query_regdb_file()\n\nIn the function query_regdb_file() the alpha2 parameter is duplicated\nusing kmemdup() and subsequently freed in regdb_fw_cb(). However,\nrequest_firmware_nowait() can fail without calling regdb_fw_cb() and\nthus leak memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cdcbac1-0740-4f41-b05d-99228f025e83",
      "id": "CVE-2022-50123",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nFix missing of_node_put() in error paths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3c956c4-ba8f-4432-bd4a-48f2bf39e3b7",
      "id": "CVE-2022-50206",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: fix oops in concurrently setting insn_emulation sysctls\n\nemulation_proc_handler() changes table-\u003edata for proc_dointvec_minmax\nand can generate the following Oops if called concurrently with itself:\n\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n | Internal error: Oops: 96000006 [#1] SMP\n | Call trace:\n | update_insn_emulation_mode+0xc0/0x148\n | emulation_proc_handler+0x64/0xb8\n | proc_sys_call_handler+0x9c/0xf8\n | proc_sys_write+0x18/0x20\n | __vfs_write+0x20/0x48\n | vfs_write+0xe4/0x1d0\n | ksys_write+0x70/0xf8\n | __arm64_sys_write+0x20/0x28\n | el0_svc_common.constprop.0+0x7c/0x1c0\n | el0_svc_handler+0x2c/0xa0\n | el0_svc+0x8/0x200\n\nTo fix this issue, keep the table-\u003edata as \u0026insn-\u003ecurrent_mode and\nuse container_of() to retrieve the insn pointer. Another mutex is\nused to protect against the current_mode update but not for retrieving\ninsn_emulation as table-\u003edata is no longer changing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73693233-6e55-487d-9568-919636546d40",
      "id": "CVE-2022-50240",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nandroid: binder: stop saving a pointer to the VMA\n\nDo not record a pointer to a VMA outside of the mmap_lock for later use. \nThis is unsafe and there are a number of failure paths *after* the\nrecorded VMA pointer may be freed during setup.  There is no callback to\nthe driver to clear the saved pointer from generic mm code.  Furthermore,\nthe VMA pointer may become stale if any number of VMA operations end up\nfreeing the VMA so saving it was fragile to being with.\n\nInstead, change the binder_alloc struct to record the start address of the\nVMA and use vma_lookup() to get the vma when needed.  Add lockdep\nmmap_lock checks on updates to the vma pointer to ensure the lock is held\nand depend on that lock for synchronization of readers and writers - which\nwas already the case anyways, so the smp_wmb()/smp_rmb() was not\nnecessary.\n\n[akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "317d096b-5baf-4fd2-a1fd-8cb935db72ab",
      "id": "CVE-2022-50289",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix memory leak in ocfs2_stack_glue_init()\n\nocfs2_table_header should be free in ocfs2_stack_glue_init() if\nocfs2_sysfs_init() failed, otherwise kmemleak will report memleak.\n\nBUG: memory leak\nunreferenced object 0xffff88810eeb5800 (size 128):\n  comm \"modprobe\", pid 4507, jiffies 4296182506 (age 55.888s)\n  hex dump (first 32 bytes):\n    c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00  .@..............\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c000000001e59e1cd\u003e] __register_sysctl_table+0xca/0xef0\n    [\u003c00000000c04f70f7\u003e] 0xffffffffa0050037\n    [\u003c000000001bd12912\u003e] do_one_initcall+0xdb/0x480\n    [\u003c0000000064f766c9\u003e] do_init_module+0x1cf/0x680\n    [\u003c000000002ba52db0\u003e] load_module+0x6441/0x6f20\n    [\u003c000000009772580d\u003e] __do_sys_finit_module+0x12f/0x1c0\n    [\u003c00000000380c1f22\u003e] do_syscall_64+0x3f/0x90\n    [\u003c000000004cf473bc\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e201de2f-be21-4b46-a1a5-c6dad0b9f3eb",
      "id": "CVE-2023-53435",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncassini: Fix a memory leak in the error handling path of cas_init_one()\n\ncas_saturn_firmware_init() allocates some memory using vmalloc(). This\nmemory is freed in the .remove() function but not it the error handling\npath of the probe.\n\nAdd the missing vfree() to avoid a memory leak, should an error occur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24a3faa5-7eee-41d3-88d8-8f0c33908ffe",
      "id": "CVE-2022-50293",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range\n\nIf we get -ENOMEM while dropping file extent items in a given range, at\nbtrfs_drop_extents(), due to failure to allocate memory when attempting to\nincrement the reference count for an extent or drop the reference count,\nwe handle it with a BUG_ON(). This is excessive, instead we can simply\nabort the transaction and return the error to the caller. In fact most\ncallers of btrfs_drop_extents(), directly or indirectly, already abort\nthe transaction if btrfs_drop_extents() returns any error.\n\nAlso, we already have error paths at btrfs_drop_extents() that may return\n-ENOMEM and in those cases we abort the transaction, like for example\nanything that changes the b+tree may return -ENOMEM due to a failure to\nallocate a new extent buffer when COWing an existing extent buffer, such\nas a call to btrfs_duplicate_item() for example.\n\nSo replace the BUG_ON() calls with proper logic to abort the transaction\nand return the error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3e9db58-70db-4dc3-be2d-189a5a691944",
      "id": "CVE-2022-50294",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix memory leak in lbs_init_adapter()\n\nWhen kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not\nreleased. Add free memory to processing error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5bfc156-ca0d-4aea-bc15-c6226eb5ea6a",
      "id": "CVE-2022-50367",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: fix UAF/GPF bug in nilfs_mdt_destroy\n\nIn alloc_inode, inode_init_always() could return -ENOMEM if\nsecurity_inode_alloc() fails, which causes inode-\u003ei_private\nuninitialized. Then nilfs_is_metadata_file_inode() returns\ntrue and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(),\nwhich frees the uninitialized inode-\u003ei_private\nand leads to crashes(e.g., UAF/GPF).\n\nFix this by moving security_inode_alloc just prior to\nthis_cpu_inc(nr_inodes)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f32b00e3-7072-4e46-a27f-f8674ca57dac",
      "id": "CVE-2022-50368",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dsi: fix memory corruption with too many bridges\n\nAdd the missing sanity check on the bridge counter to avoid corrupting\ndata beyond the fixed-sized bridge array in case there are ever more\nthan eight bridges.\n\nPatchwork: https://patchwork.freedesktop.org/patch/502668/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "998d2fe8-9ad5-4711-b551-6ecb163cf2ce",
      "id": "CVE-2023-1095",
      "description": "In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1044ff47-3aa2-46ad-83d2-272344a111d9",
      "id": "CVE-2024-26688",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super\n\nWhen configuring a hugetlb filesystem via the fsconfig() syscall, there is\na possible NULL dereference in hugetlbfs_fill_super() caused by assigning\nNULL to ctx-\u003ehstate in hugetlbfs_parse_param() when the requested pagesize\nis non valid.\n\nE.g: Taking the following steps:\n\n     fd = fsopen(\"hugetlbfs\", FSOPEN_CLOEXEC);\n     fsconfig(fd, FSCONFIG_SET_STRING, \"pagesize\", \"1024\", 0);\n     fsconfig(fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);\n\nGiven that the requested \"pagesize\" is invalid, ctxt-\u003ehstate will be replaced\nwith NULL, losing its previous value, and we will print an error:\n\n ...\n ...\n case Opt_pagesize:\n ps = memparse(param-\u003estring, \u0026rest);\n ctx-\u003ehstate = h;\n if (!ctx-\u003ehstate) {\n         pr_err(\"Unsupported page size %lu MB\\n\", ps / SZ_1M);\n         return -EINVAL;\n }\n return 0;\n ...\n ...\n\nThis is a problem because later on, we will dereference ctxt-\u003ehstate in\nhugetlbfs_fill_super()\n\n ...\n ...\n sb-\u003es_blocksize = huge_page_size(ctx-\u003ehstate);\n ...\n ...\n\nCausing below Oops.\n\nFix this by replacing cxt-\u003ehstate value only when then pagesize is known\nto be valid.\n\n kernel: hugetlbfs: Unsupported page size 0 MB\n kernel: BUG: kernel NULL pointer dereference, address: 0000000000000028\n kernel: #PF: supervisor read access in kernel mode\n kernel: #PF: error_code(0x0000) - not-present page\n kernel: PGD 800000010f66c067 P4D 800000010f66c067 PUD 1b22f8067 PMD 0\n kernel: Oops: 0000 [#1] PREEMPT SMP PTI\n kernel: CPU: 4 PID: 5659 Comm: syscall Tainted: G            E      6.8.0-rc2-default+ #22 5a47c3fef76212addcc6eb71344aabc35190ae8f\n kernel: Hardware name: Intel Corp. GROVEPORT/GROVEPORT, BIOS GVPRCRB1.86B.0016.D04.1705030402 05/03/2017\n kernel: RIP: 0010:hugetlbfs_fill_super+0xb4/0x1a0\n kernel: Code: 48 8b 3b e8 3e c6 ed ff 48 85 c0 48 89 45 20 0f 84 d6 00 00 00 48 b8 ff ff ff ff ff ff ff 7f 4c 89 e7 49 89 44 24 20 48 8b 03 \u003c8b\u003e 48 28 b8 00 10 00 00 48 d3 e0 49 89 44 24 18 48 8b 03 8b 40 28\n kernel: RSP: 0018:ffffbe9960fcbd48 EFLAGS: 00010246\n kernel: RAX: 0000000000000000 RBX: ffff9af5272ae780 RCX: 0000000000372004\n kernel: RDX: ffffffffffffffff RSI: ffffffffffffffff RDI: ffff9af555e9b000\n kernel: RBP: ffff9af52ee66b00 R08: 0000000000000040 R09: 0000000000370004\n kernel: R10: ffffbe9960fcbd48 R11: 0000000000000040 R12: ffff9af555e9b000\n kernel: R13: ffffffffa66b86c0 R14: ffff9af507d2f400 R15: ffff9af507d2f400\n kernel: FS:  00007ffbc0ba4740(0000) GS:ffff9b0bd7000000(0000) knlGS:0000000000000000\n kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n kernel: CR2: 0000000000000028 CR3: 00000001b1ee0000 CR4: 00000000001506f0\n kernel: Call Trace:\n kernel:  \u003cTASK\u003e\n kernel:  ? __die_body+0x1a/0x60\n kernel:  ? page_fault_oops+0x16f/0x4a0\n kernel:  ? search_bpf_extables+0x65/0x70\n kernel:  ? fixup_exception+0x22/0x310\n kernel:  ? exc_page_fault+0x69/0x150\n kernel:  ? asm_exc_page_fault+0x22/0x30\n kernel:  ? __pfx_hugetlbfs_fill_super+0x10/0x10\n kernel:  ? hugetlbfs_fill_super+0xb4/0x1a0\n kernel:  ? hugetlbfs_fill_super+0x28/0x1a0\n kernel:  ? __pfx_hugetlbfs_fill_super+0x10/0x10\n kernel:  vfs_get_super+0x40/0xa0\n kernel:  ? __pfx_bpf_lsm_capable+0x10/0x10\n kernel:  vfs_get_tree+0x25/0xd0\n kernel:  vfs_cmd_create+0x64/0xe0\n kernel:  __x64_sys_fsconfig+0x395/0x410\n kernel:  do_syscall_64+0x80/0x160\n kernel:  ? syscall_exit_to_user_mode+0x82/0x240\n kernel:  ? do_syscall_64+0x8d/0x160\n kernel:  ? syscall_exit_to_user_mode+0x82/0x240\n kernel:  ? do_syscall_64+0x8d/0x160\n kernel:  ? exc_page_fault+0x69/0x150\n kernel:  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n kernel: RIP: 0033:0x7ffbc0cb87c9\n kernel: Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 97 96 0d 00 f7 d8 64 89 01 48\n kernel: RSP: 002b:00007ffc29d2f388 EFLAGS: 00000206 ORIG_RAX: 00000000000001af\n kernel: RAX: fffffffffff\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c67aa341-a04d-4924-b740-3ab209efa0a2",
      "id": "CVE-2023-22995",
      "description": "In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1f680b4-8888-4ad5-aa1d-e051b21994c0",
      "id": "CVE-2023-33203",
      "description": "The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3fab3c44-c9a9-4d46-b3b0-0ddbfd154925",
      "id": "CVE-2023-4732",
      "description": "A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf22b2e8-1763-4163-8462-51eefd2c7fc5",
      "id": "CVE-2024-26712",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kasan: Fix addr error caused by page alignment\n\nIn kasan_init_region, when k_start is not page aligned, at the begin of\nfor loop, k_cur = k_start \u0026 PAGE_MASK is less than k_start, and then\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\nbecause the memory address space from va to block is not alloced by\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\nwill be used by other places.\n\nAs a result, memory overwriting occurs.\n\nfor example:\nint __init __weak kasan_init_region(void *start, size_t size)\n{\n[...]\n\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\n\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\n\t[...]\n\tfor (k_cur = k_start \u0026 PAGE_MASK; k_cur \u003c k_end; k_cur += PAGE_SIZE) {\n\t\t/* at the begin of for loop\n\t\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\n\t\t * va(dcd96c00) is less than block(dcd97000), va is invalid\n\t\t */\n\t\tvoid *va = block + k_cur - k_start;\n\t\t[...]\n\t}\n[...]\n}\n\nTherefore, page alignment is performed on k_start before\nmemblock_alloc() to ensure the validity of the VA address.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3240d884-ab57-4234-8877-92d2a6a801f7",
      "id": "CVE-2023-5090",
      "description": "A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "234c7b81-5895-41ab-ada9-b80b22d4bfe0",
      "id": "CVE-2023-52434",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOBs in smb2_parse_contexts()\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n  BUG: unable to handle page fault for address: ffff8881178d8cc3\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 4a01067 P4D 4a01067 PUD 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 \u003c0f\u003e b7\n  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n  R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n  R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die+0x23/0x70\n   ? page_fault_oops+0x181/0x480\n   ? search_module_extables+0x19/0x60\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? exc_page_fault+0x1b6/0x1c0\n   ? asm_exc_page_fault+0x26/0x30\n   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n   SMB2_open+0x38d/0x5f0 [cifs]\n   ? smb2_is_path_accessible+0x138/0x260 [cifs]\n   smb2_is_path_accessible+0x138/0x260 [cifs]\n   cifs_is_path_remote+0x8d/0x230 [cifs]\n   cifs_mount+0x7e/0x350 [cifs]\n   cifs_smb3_do_mount+0x128/0x780 [cifs]\n   smb3_get_tree+0xd9/0x290 [cifs]\n   vfs_get_tree+0x2c/0x100\n   ? capable+0x37/0x70\n   path_mount+0x2d7/0xb80\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? _raw_spin_unlock_irqrestore+0x44/0x60\n   __x64_sys_mount+0x11a/0x150\n   do_syscall_64+0x47/0xf0\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n  RIP: 0033:0x7f8737657b1e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8e9b0be-d21c-428b-8b53-aacc41879894",
      "id": "CVE-2023-52436",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: explicitly null-terminate the xattr list\n\nWhen setting an xattr, explicitly null-terminate the xattr list.  This\neliminates the fragile assumption that the unused xattr space is always\nzeroed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7ff17ee-f4e0-47d3-a07f-05026fbeb944",
      "id": "CVE-2023-52489",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/sparsemem: fix race in accessing memory_section-\u003eusage\n\nThe below race is observed on a PFN which falls into the device memory\nregion with the system memory configuration where PFN's are such that\n[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL].  Since normal zone start and end\npfn contains the device memory PFN's as well, the compaction triggered\nwill try on the device memory PFN's too though they end up in NOP(because\npfn_to_online_page() returns NULL for ZONE_DEVICE memory sections).  When\nfrom other core, the section mappings are being removed for the\nZONE_DEVICE region, that the PFN in question belongs to, on which\ncompaction is currently being operated is resulting into the kernel crash\nwith CONFIG_SPASEMEM_VMEMAP enabled.  The crash logs can be seen at [1].\n\ncompact_zone()\t\t\tmemunmap_pages\n-------------\t\t\t---------------\n__pageblock_pfn_to_page\n   ......\n (a)pfn_valid():\n     valid_section()//return true\n\t\t\t      (b)__remove_pages()-\u003e\n\t\t\t\t  sparse_remove_section()-\u003e\n\t\t\t\t    section_deactivate():\n\t\t\t\t    [Free the array ms-\u003eusage and set\n\t\t\t\t     ms-\u003eusage = NULL]\n     pfn_section_valid()\n     [Access ms-\u003eusage which\n     is NULL]\n\nNOTE: From the above it can be said that the race is reduced to between\nthe pfn_valid()/pfn_section_valid() and the section deactivate with\nSPASEMEM_VMEMAP enabled.\n\nThe commit b943f045a9af(\"mm/sparse: fix kernel crash with\npfn_section_valid check\") tried to address the same problem by clearing\nthe SECTION_HAS_MEM_MAP with the expectation of valid_section() returns\nfalse thus ms-\u003eusage is not accessed.\n\nFix this issue by the below steps:\n\na) Clear SECTION_HAS_MEM_MAP before freeing the -\u003eusage.\n\nb) RCU protected read side critical section will either return NULL\n   when SECTION_HAS_MEM_MAP is cleared or can successfully access -\u003eusage.\n\nc) Free the -\u003eusage with kfree_rcu() and set ms-\u003eusage = NULL.  No\n   attempt will be made to access -\u003eusage after this as the\n   SECTION_HAS_MEM_MAP is cleared thus valid_section() return false.\n\nThanks to David/Pavan for their inputs on this patch.\n\n[1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/\n\nOn Snapdragon SoC, with the mentioned memory configuration of PFN's as\n[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of\nissues daily while testing on a device farm.\n\nFor this particular issue below is the log.  Though the below log is\nnot directly pointing to the pfn_section_valid(){ ms-\u003eusage;}, when we\nloaded this dump on T32 lauterbach tool, it is pointing.\n\n[  540.578056] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\n[  540.578068] Mem abort info:\n[  540.578070]   ESR = 0x0000000096000005\n[  540.578073]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  540.578077]   SET = 0, FnV = 0\n[  540.578080]   EA = 0, S1PTW = 0\n[  540.578082]   FSC = 0x05: level 1 translation fault\n[  540.578085] Data abort info:\n[  540.578086]   ISV = 0, ISS = 0x00000005\n[  540.578088]   CM = 0, WnR = 0\n[  540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--)\n[  540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c\n[  540.579454] lr : compact_zone+0x994/0x1058\n[  540.579460] sp : ffffffc03579b510\n[  540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c\n[  540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640\n[  540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000\n[  540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140\n[  540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff\n[  540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001\n[  540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440\n[  540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4\n[  540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "063fc8f3-4e5e-4fdc-890a-17cdce759cf3",
      "id": "CVE-2023-52497",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix lz4 inplace decompression\n\nCurrently EROFS can map another compressed buffer for inplace\ndecompression, that was used to handle the cases that some pages of\ncompressed data are actually not in-place I/O.\n\nHowever, like most simple LZ77 algorithms, LZ4 expects the compressed\ndata is arranged at the end of the decompressed buffer and it\nexplicitly uses memmove() to handle overlapping:\n  __________________________________________________________\n |_ direction of decompression --\u003e ____ |_ compressed data _|\n\nAlthough EROFS arranges compressed data like this, it typically maps two\nindividual virtual buffers so the relative order is uncertain.\nPreviously, it was hardly observed since LZ4 only uses memmove() for\nshort overlapped literals and x86/arm64 memmove implementations seem to\ncompletely cover it up and they don't have this issue.  Juhyung reported\nthat EROFS data corruption can be found on a new Intel x86 processor.\nAfter some analysis, it seems that recent x86 processors with the new\nFSRM feature expose this issue with \"rep movsb\".\n\nLet's strictly use the decompressed buffer for lz4 inplace\ndecompression for now.  Later, as an useful improvement, we could try\nto tie up these two buffers together in the correct order.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1361f678-1258-4238-a0af-8cef2bd6d754",
      "id": "CVE-2024-26771",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Add some null pointer checks to the edma_probe\n\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "67e2f85c-ff5c-4243-8d24-ca4ea7f2ada8",
      "id": "CVE-2023-52939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()\n\nAs commit 18365225f044 (\"hwpoison, memcg: forcibly uncharge LRU pages\"),\nhwpoison will forcibly uncharg a LRU hwpoisoned page, the folio_memcg\ncould be NULl, then, mem_cgroup_track_foreign_dirty_slowpath() could\noccurs a NULL pointer dereference, let's do not record the foreign\nwritebacks for folio memcg is null in mem_cgroup_track_foreign_dirty() to\nfix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7fafef3-40e2-44fe-9f9f-33d26a22094c",
      "id": "CVE-2023-53062",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: smsc95xx: Limit packet length to skb-\u003elen\n\nPacket length retrieved from descriptor may be larger than\nthe actual socket buffer length. In such case the cloned\nskb passed up the network stack will leak kernel memory contents.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17152c6a-806c-4487-8a0c-809b87f4e958",
      "id": "CVE-2023-53100",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix WARNING in ext4_update_inline_data\n\nSyzbot found the following issue:\nEXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.\nfscrypt: AES-256-CTS-CBC using implementation \"cts-cbc-aes-aesni\"\nfscrypt: AES-256-XTS using implementation \"xts-aes-aesni\"\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 5071 at mm/page_alloc.c:5525 __alloc_pages+0x30a/0x560 mm/page_alloc.c:5525\nModules linked in:\nCPU: 1 PID: 5071 Comm: syz-executor263 Not tainted 6.2.0-rc1-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nRIP: 0010:__alloc_pages+0x30a/0x560 mm/page_alloc.c:5525\nRSP: 0018:ffffc90003c2f1c0 EFLAGS: 00010246\nRAX: ffffc90003c2f220 RBX: 0000000000000014 RCX: 0000000000000000\nRDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003c2f248\nRBP: ffffc90003c2f2d8 R08: dffffc0000000000 R09: ffffc90003c2f220\nR10: fffff52000785e49 R11: 1ffff92000785e44 R12: 0000000000040d40\nR13: 1ffff92000785e40 R14: dffffc0000000000 R15: 1ffff92000785e3c\nFS:  0000555556c0d300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f95d5e04138 CR3: 00000000793aa000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __alloc_pages_node include/linux/gfp.h:237 [inline]\n alloc_pages_node include/linux/gfp.h:260 [inline]\n __kmalloc_large_node+0x95/0x1e0 mm/slab_common.c:1113\n __do_kmalloc_node mm/slab_common.c:956 [inline]\n __kmalloc+0xfe/0x190 mm/slab_common.c:981\n kmalloc include/linux/slab.h:584 [inline]\n kzalloc include/linux/slab.h:720 [inline]\n ext4_update_inline_data+0x236/0x6b0 fs/ext4/inline.c:346\n ext4_update_inline_dir fs/ext4/inline.c:1115 [inline]\n ext4_try_add_inline_entry+0x328/0x990 fs/ext4/inline.c:1307\n ext4_add_entry+0x5a4/0xeb0 fs/ext4/namei.c:2385\n ext4_add_nondir+0x96/0x260 fs/ext4/namei.c:2772\n ext4_create+0x36c/0x560 fs/ext4/namei.c:2817\n lookup_open fs/namei.c:3413 [inline]\n open_last_lookups fs/namei.c:3481 [inline]\n path_openat+0x12ac/0x2dd0 fs/namei.c:3711\n do_filp_open+0x264/0x4f0 fs/namei.c:3741\n do_sys_openat2+0x124/0x4e0 fs/open.c:1310\n do_sys_open fs/open.c:1326 [inline]\n __do_sys_openat fs/open.c:1342 [inline]\n __se_sys_openat fs/open.c:1337 [inline]\n __x64_sys_openat+0x243/0x290 fs/open.c:1337\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAbove issue happens as follows:\next4_iget\n   ext4_find_inline_data_nolock -\u003ei_inline_off=164 i_inline_size=60\next4_try_add_inline_entry\n   __ext4_mark_inode_dirty\n      ext4_expand_extra_isize_ea -\u003ei_extra_isize=32 s_want_extra_isize=44\n         ext4_xattr_shift_entries\n\t -\u003eafter shift i_inline_off is incorrect, actually is change to 176\next4_try_add_inline_entry\n  ext4_update_inline_dir\n    get_max_inline_xattr_value_size\n      if (EXT4_I(inode)-\u003ei_inline_off)\n\tentry = (struct ext4_xattr_entry *)((void *)raw_inode +\n\t\t\tEXT4_I(inode)-\u003ei_inline_off);\n        free += EXT4_XATTR_SIZE(le32_to_cpu(entry-\u003ee_value_size));\n\t-\u003eAs entry is incorrect, then 'free' may be negative\n   ext4_update_inline_data\n      value = kzalloc(len, GFP_NOFS);\n      -\u003e len is unsigned int, maybe very large, then trigger warning when\n         'kzalloc()'\n\nTo resolve the above issue we need to update 'i_inline_off' after\n'ext4_xattr_shift_entries()'.  We do not need to set\nEXT4_STATE_MAY_INLINE_DATA flag here, since ext4_mark_inode_dirty()\nalready sets this flag if needed.  Setting EXT4_STATE_MAY_INLINE_DATA\nwhen it is needed may trigger a BUG_ON in ext4_writepages().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a54e6985-bfd1-42ad-a576-d0df5193aec4",
      "id": "CVE-2023-53295",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Do not update file length for failed writes to inline files\n\nWhen write to inline file fails (or happens only partly), we still\nupdated length of inline data as if the whole write succeeded. Fix the\nupdate of length of inline data to happen only if the write succeeds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eac71681-7ed4-4cb6-8fab-8a200543ba43",
      "id": "CVE-2023-53391",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nshmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs\n\nAs the ramfs-based tmpfs uses ramfs_init_fs_context() for the\ninit_fs_context method, which allocates fc-\u003es_fs_info, use ramfs_kill_sb()\nto free it and avoid a memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8572b6e5-4ec6-4fbe-90b0-0d715eb7f894",
      "id": "CVE-2024-26828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix underflow in parse_server_interfaces()\n\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \"bytes_left\" is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "374d2143-1525-407c-a398-1f473806aa5f",
      "id": "CVE-2024-26957",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: fix reference counting on zcrypt card objects\n\nTests with hot-plugging crytpo cards on KVM guests with debug\nkernel build revealed an use after free for the load field of\nthe struct zcrypt_card. The reason was an incorrect reference\nhandling of the zcrypt card object which could lead to a free\nof the zcrypt card object while it was still in use.\n\nThis is an example of the slab message:\n\n    kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b\n    kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43\n    kernel:  kmalloc_trace+0x3f2/0x470\n    kernel:  zcrypt_card_alloc+0x36/0x70 [zcrypt]\n    kernel:  zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4]\n    kernel:  ap_device_probe+0x15c/0x290\n    kernel:  really_probe+0xd2/0x468\n    kernel:  driver_probe_device+0x40/0xf0\n    kernel:  __device_attach_driver+0xc0/0x140\n    kernel:  bus_for_each_drv+0x8c/0xd0\n    kernel:  __device_attach+0x114/0x198\n    kernel:  bus_probe_device+0xb4/0xc8\n    kernel:  device_add+0x4d2/0x6e0\n    kernel:  ap_scan_adapter+0x3d0/0x7c0\n    kernel:  ap_scan_bus+0x5a/0x3b0\n    kernel:  ap_scan_bus_wq_callback+0x40/0x60\n    kernel:  process_one_work+0x26e/0x620\n    kernel:  worker_thread+0x21c/0x440\n    kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43\n    kernel:  kfree+0x37e/0x418\n    kernel:  zcrypt_card_put+0x54/0x80 [zcrypt]\n    kernel:  ap_device_remove+0x4c/0xe0\n    kernel:  device_release_driver_internal+0x1c4/0x270\n    kernel:  bus_remove_device+0x100/0x188\n    kernel:  device_del+0x164/0x3c0\n    kernel:  device_unregister+0x30/0x90\n    kernel:  ap_scan_adapter+0xc8/0x7c0\n    kernel:  ap_scan_bus+0x5a/0x3b0\n    kernel:  ap_scan_bus_wq_callback+0x40/0x60\n    kernel:  process_one_work+0x26e/0x620\n    kernel:  worker_thread+0x21c/0x440\n    kernel:  kthread+0x150/0x168\n    kernel:  __ret_from_fork+0x3c/0x58\n    kernel:  ret_from_fork+0xa/0x30\n    kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff)\n    kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88\n    kernel: Redzone  00000000885a74b0: bb bb bb bb bb bb bb bb                          ........\n    kernel: Object   00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5  kkkkkkkkkkhKkkk.\n    kernel: Redzone  00000000885a7518: bb bb bb bb bb bb bb bb                          ........\n    kernel: Padding  00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ\n    kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2\n    kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux)\n    kernel: Call Trace:\n    kernel:  [\u003c00000000ca5ab5b8\u003e] dump_stack_lvl+0x90/0x120\n    kernel:  [\u003c00000000c99d78bc\u003e] check_bytes_and_report+0x114/0x140\n    kernel:  [\u003c00000000c99d53cc\u003e] check_object+0x334/0x3f8\n    kernel:  [\u003c00000000c99d820c\u003e] alloc_debug_processing+0xc4/0x1f8\n    kernel:  [\u003c00000000c99d852e\u003e] get_partial_node.part.0+0x1ee/0x3e0\n    kernel:  [\u003c00000000c99d94ec\u003e] ___slab_alloc+0xaf4/0x13c8\n    kernel:  [\u003c00000000c99d9e38\u003e] __slab_alloc.constprop.0+0x78/0xb8\n    kernel:  [\u003c00000000c99dc8dc\u003e] __kmalloc+0x434/0x590\n    kernel:  [\u003c00000000c9b4c0ce\u003e] ext4_htree_store_dirent+0x4e/0x1c0\n    kernel:  [\u003c00000000c9b908a2\u003e] htree_dirblock_to_tree+0x17a/0x3f0\n    kernel: \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90f25804-0383-4c22-ad4a-25985718753a",
      "id": "CVE-2024-35839",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: replace physindev with physinif in nf_bridge_info\n\nAn skb can be added to a neigh-\u003earp_queue while waiting for an arp\nreply. Where original skb's skb-\u003edev can be different to neigh's\nneigh-\u003edev. For instance in case of bridging dnated skb from one veth to\nanother, the skb would be added to a neigh-\u003earp_queue of the bridge.\n\nAs skb-\u003edev can be reset back to nf_bridge-\u003ephysindev and used, and as\nthere is no explicit mechanism that prevents this physindev from been\nfreed under us (for instance neigh_flush_dev doesn't cleanup skbs from\ndifferent device's neigh queue) we can crash on e.g. this stack:\n\narp_process\n  neigh_update\n    skb = __skb_dequeue(\u0026neigh-\u003earp_queue)\n      neigh_resolve_output(..., skb)\n        ...\n          br_nf_dev_xmit\n            br_nf_pre_routing_finish_bridge_slow\n              skb-\u003edev = nf_bridge-\u003ephysindev\n              br_handle_frame_finish\n\nLet's use plain ifindex instead of net_device link. To peek into the\noriginal net_device we will use dev_get_by_index_rcu(). Thus either we\nget device and are safe to use it or we don't get it and drop skb.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15631c2a-101c-459d-89e3-56c86e1d0428",
      "id": "CVE-2024-35969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr\n\nAlthough ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it\nstill means hlist_for_each_entry_rcu can return an item that got removed\nfrom the list. The memory itself of such item is not freed thanks to RCU\nbut nothing guarantees the actual content of the memory is sane.\n\nIn particular, the reference count can be zero. This can happen if\nipv6_del_addr is called in parallel. ipv6_del_addr removes the entry\nfrom inet6_addr_lst (hlist_del_init_rcu(\u0026ifp-\u003eaddr_lst)) and drops all\nreferences (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough\ntiming, this can happen:\n\n1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry.\n\n2. Then, the whole ipv6_del_addr is executed for the given entry. The\n   reference count drops to zero and kfree_rcu is scheduled.\n\n3. ipv6_get_ifaddr continues and tries to increments the reference count\n   (in6_ifa_hold).\n\n4. The rcu is unlocked and the entry is freed.\n\n5. The freed entry is returned.\n\nPrevent increasing of the reference count in such case. The name\nin6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe.\n\n[   41.506330] refcount_t: addition on 0; use-after-free.\n[   41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130\n[   41.507413] Modules linked in: veth bridge stp llc\n[   41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14\n[   41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n[   41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130\n[   41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 \u003c0f\u003e 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff\n[   41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282\n[   41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000\n[   41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900\n[   41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff\n[   41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000\n[   41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48\n[   41.514086] FS:  00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000\n[   41.514726] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0\n[   41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   41.516799] Call Trace:\n[   41.517037]  \u003cTASK\u003e\n[   41.517249]  ? __warn+0x7b/0x120\n[   41.517535]  ? refcount_warn_saturate+0xa5/0x130\n[   41.517923]  ? report_bug+0x164/0x190\n[   41.518240]  ? handle_bug+0x3d/0x70\n[   41.518541]  ? exc_invalid_op+0x17/0x70\n[   41.520972]  ? asm_exc_invalid_op+0x1a/0x20\n[   41.521325]  ? refcount_warn_saturate+0xa5/0x130\n[   41.521708]  ipv6_get_ifaddr+0xda/0xe0\n[   41.522035]  inet6_rtm_getaddr+0x342/0x3f0\n[   41.522376]  ? __pfx_inet6_rtm_getaddr+0x10/0x10\n[   41.522758]  rtnetlink_rcv_msg+0x334/0x3d0\n[   41.523102]  ? netlink_unicast+0x30f/0x390\n[   41.523445]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n[   41.523832]  netlink_rcv_skb+0x53/0x100\n[   41.524157]  netlink_unicast+0x23b/0x390\n[   41.524484]  netlink_sendmsg+0x1f2/0x440\n[   41.524826]  __sys_sendto+0x1d8/0x1f0\n[   41.525145]  __x64_sys_sendto+0x1f/0x30\n[   41.525467]  do_syscall_64+0xa5/0x1b0\n[   41.525794]  entry_SYSCALL_64_after_hwframe+0x72/0x7a\n[   41.526213] RIP: 0033:0x7fbc4cfcea9a\n[   41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89\n[   41.527942] RSP: 002b:00007f\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99889f8e-efa9-4427-b84b-8e98e59523e0",
      "id": "CVE-2024-36024",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Disable idle reallow as part of command/gpint execution\n\n[Why]\nWorkaroud for a race condition where DMCUB is in the process of\ncommitting to IPS1 during the handshake causing us to miss the\ntransition into IPS2 and touch the INBOX1 RPTR causing a HW hang.\n\n[How]\nDisable the reallow to ensure that we have enough of a gap between entry\nand exit and we're not seeing back-to-back wake_and_executes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b66cfd52-ee3c-4d48-aa97-2c278c6e69f3",
      "id": "CVE-2024-42064",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip pipe if the pipe idx not set properly\n\n[why]\nDriver crashes when pipe idx not set properly\n\n[how]\nAdd code to skip the pipe that idx not set properly",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e346d0f-5319-4420-a57d-fef5f7545aa4",
      "id": "CVE-2024-36951",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: range check cp bad op exception interrupts\n\nDue to a CP interrupt bug, bad packet garbage exception codes are raised.\nDo a range check so that the debugger and runtime do not receive garbage\ncodes.\nUpdate the user api to guard exception code type checking as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd794d6f-9a30-473d-9576-658277d3e032",
      "id": "CVE-2024-38558",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix overwriting ct original tuple for ICMPv6\n\nOVS_PACKET_CMD_EXECUTE has 3 main attributes:\n - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format.\n - OVS_PACKET_ATTR_PACKET - Binary packet content.\n - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet.\n\nOVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure\nwith the metadata like conntrack state, input port, recirculation id,\netc.  Then the packet itself gets parsed to populate the rest of the\nkeys from the packet headers.\n\nWhenever the packet parsing code starts parsing the ICMPv6 header, it\nfirst zeroes out fields in the key corresponding to Neighbor Discovery\ninformation even if it is not an ND packet.\n\nIt is an 'ipv6.nd' field.  However, the 'ipv6' is a union that shares\nthe space between 'nd' and 'ct_orig' that holds the original tuple\nconntrack metadata parsed from the OVS_PACKET_ATTR_KEY.\n\nND packets should not normally have conntrack state, so it's fine to\nshare the space, but normal ICMPv6 Echo packets or maybe other types of\nICMPv6 can have the state attached and it should not be overwritten.\n\nThe issue results in all but the last 4 bytes of the destination\naddress being wiped from the original conntrack tuple leading to\nincorrect packet matching and potentially executing wrong actions\nin case this packet recirculates within the datapath or goes back\nto userspace.\n\nND fields should not be accessed in non-ND packets, so not clearing\nthem should be fine.  Executing memset() only for actual ND packets to\navoid the issue.\n\nInitializing the whole thing before parsing is needed because ND packet\nmay not contain all the options.\n\nThe issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't\naffect packets entering OVS datapath from network interfaces, because\nin this case CT metadata is populated from skb after the packet is\nalready parsed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b805df45-0d30-48ca-9826-5a636db49aac",
      "id": "CVE-2024-38565",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ar5523: enable proper endpoint verification\n\nSyzkaller reports [1] hitting a warning about an endpoint in use\nnot having an expected type to it.\n\nFix the issue by checking for the existence of all proper\nendpoints with their according types intact.\n\nSadly, this patch has not been tested on real hardware.\n\n[1] Syzkaller report:\n------------[ cut here ]------------\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 0 PID: 3643 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\n...\nCall Trace:\n \u003cTASK\u003e\n ar5523_cmd+0x41b/0x780 drivers/net/wireless/ath/ar5523/ar5523.c:275\n ar5523_cmd_read drivers/net/wireless/ath/ar5523/ar5523.c:302 [inline]\n ar5523_host_available drivers/net/wireless/ath/ar5523/ar5523.c:1376 [inline]\n ar5523_probe+0x14b0/0x1d10 drivers/net/wireless/ath/ar5523/ar5523.c:1655\n usb_probe_interface+0x30f/0x7f0 drivers/usb/core/driver.c:396\n call_driver_probe drivers/base/dd.c:560 [inline]\n really_probe+0x249/0xb90 drivers/base/dd.c:639\n __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778\n driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808\n __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936\n bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427\n __device_attach+0x1e4/0x530 drivers/base/dd.c:1008\n bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487\n device_add+0xbd9/0x1e90 drivers/base/core.c:3517\n usb_set_configuration+0x101d/0x1900 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0xbe/0x100 drivers/usb/core/generic.c:238\n usb_probe_device+0xd8/0x2c0 drivers/usb/core/driver.c:293\n call_driver_probe drivers/base/dd.c:560 [inline]\n really_probe+0x249/0xb90 drivers/base/dd.c:639\n __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778\n driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808\n __device_attach_driver+0x1d4/0x2e0 drivers/base/dd.c:936\n bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:427\n __device_attach+0x1e4/0x530 drivers/base/dd.c:1008\n bus_probe_device+0x1e8/0x2a0 drivers/base/bus.c:487\n device_add+0xbd9/0x1e90 drivers/base/core.c:3517\n usb_new_device.cold+0x685/0x10ad drivers/usb/core/hub.c:2573\n hub_port_connect drivers/usb/core/hub.c:5353 [inline]\n hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]\n port_event drivers/usb/core/hub.c:5653 [inline]\n hub_event+0x26cb/0x45d0 drivers/usb/core/hub.c:5735\n process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289\n worker_thread+0x669/0x1090 kernel/workqueue.c:2436\n kthread+0x2e8/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "440f29ff-7e58-43b5-a490-fb030bac2b11",
      "id": "CVE-2024-39292",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Add winch to winch_handlers before registering winch IRQ\n\nRegistering a winch IRQ is racy, an interrupt may occur before the winch is\nadded to the winch_handlers list.\n\nIf that happens, register_winch_irq() adds to that list a winch that is\nscheduled to be (or has already been) freed, causing a panic later in\nwinch_cleanup().\n\nAvoid the race by adding the winch to the winch_handlers list before\nregistering the IRQ, and rolling back if um_request_irq() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e97369a0-0f33-450e-b379-530ca5bb3570",
      "id": "CVE-2024-39507",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix kernel crash problem in concurrent scenario\n\nWhen link status change, the nic driver need to notify the roce\ndriver to handle this event, but at this time, the roce driver\nmay uninit, then cause kernel crash.\n\nTo fix the problem, when link status change, need to check\nwhether the roce registered, and when uninit, need to wait link\nupdate finish.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "642203d8-a214-4d14-a852-5e17a2a51c92",
      "id": "CVE-2024-40980",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: replace spin_lock by raw_spin_lock\n\ntrace_drop_common() is called with preemption disabled, and it acquires\na spin_lock. This is problematic for RT kernels because spin_locks are\nsleeping locks in this configuration, which causes the following splat:\n\nBUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47\npreempt_count: 1, expected: 0\nRCU nest depth: 2, expected: 2\n5 locks held by rcuc/47/449:\n #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210\n #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130\n #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210\n #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70\n #4: ff1100086ee07520 (\u0026data-\u003elock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290\nirq event stamp: 139909\nhardirqs last  enabled at (139908): [\u003cffffffffb1df2b33\u003e] _raw_spin_unlock_irqrestore+0x63/0x80\nhardirqs last disabled at (139909): [\u003cffffffffb19bd03d\u003e] trace_drop_common.constprop.0+0x26d/0x290\nsoftirqs last  enabled at (139892): [\u003cffffffffb07a1083\u003e] __local_bh_enable_ip+0x103/0x170\nsoftirqs last disabled at (139898): [\u003cffffffffb0909b33\u003e] rcu_cpu_kthread+0x93/0x1f0\nPreemption disabled at:\n[\u003cffffffffb1de786b\u003e] rt_mutex_slowunlock+0xab/0x2e0\nCPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7\nHardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x8c/0xd0\n dump_stack+0x14/0x20\n __might_resched+0x21e/0x2f0\n rt_spin_lock+0x5e/0x130\n ? trace_drop_common.constprop.0+0xb5/0x290\n ? skb_queue_purge_reason.part.0+0x1bf/0x230\n trace_drop_common.constprop.0+0xb5/0x290\n ? preempt_count_sub+0x1c/0xd0\n ? _raw_spin_unlock_irqrestore+0x4a/0x80\n ? __pfx_trace_drop_common.constprop.0+0x10/0x10\n ? rt_mutex_slowunlock+0x26a/0x2e0\n ? skb_queue_purge_reason.part.0+0x1bf/0x230\n ? __pfx_rt_mutex_slowunlock+0x10/0x10\n ? skb_queue_purge_reason.part.0+0x1bf/0x230\n trace_kfree_skb_hit+0x15/0x20\n trace_kfree_skb+0xe9/0x150\n kfree_skb_reason+0x7b/0x110\n skb_queue_purge_reason.part.0+0x1bf/0x230\n ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10\n ? mark_lock.part.0+0x8a/0x520\n...\n\ntrace_drop_common() also disables interrupts, but this is a minor issue\nbecause we could easily replace it with a local_lock.\n\nReplace the spin_lock with raw_spin_lock to avoid sleeping in atomic\ncontext.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3233c815-3d3a-401c-8c2a-81e7f628f81a",
      "id": "CVE-2023-53217",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnubus: Partially revert proc_create_single_data() conversion\n\nThe conversion to proc_create_single_data() introduced a regression\nwhereby reading a file in /proc/bus/nubus results in a seg fault:\n\n    # grep -r . /proc/bus/nubus/e/\n    Data read fault at 0x00000020 in Super Data (pc=0x1074c2)\n    BAD KERNEL BUSERR\n    Oops: 00000000\n    Modules linked in:\n    PC: [\u003c001074c2\u003e] PDE_DATA+0xc/0x16\n    SR: 2010  SP: 38284958  a2: 01152370\n    d0: 00000001    d1: 01013000    d2: 01002790    d3: 00000000\n    d4: 00000001    d5: 0008ce2e    a0: 00000000    a1: 00222a40\n    Process grep (pid: 45, task=142f8727)\n    Frame format=B ssw=074d isc=2008 isb=4e5e daddr=00000020 dobuf=01199e70\n    baddr=001074c8 dibuf=ffffffff ver=f\n    Stack from 01199e48:\n\t    01199e70 00222a58 01002790 00000000 011a3000 01199eb0 015000c0 00000000\n\t    00000000 01199ec0 01199ec0 000d551a 011a3000 00000001 00000000 00018000\n\t    d003f000 00000003 00000001 0002800d 01052840 01199fa8 c01f8000 00000000\n\t    00000029 0b532b80 00000000 00000000 00000029 0b532b80 01199ee4 00103640\n\t    011198c0 d003f000 00018000 01199fa8 00000000 011198c0 00000000 01199f4c\n\t    000b3344 011198c0 d003f000 00018000 01199fa8 00000000 00018000 011198c0\n    Call Trace: [\u003c00222a58\u003e] nubus_proc_rsrc_show+0x18/0xa0\n     [\u003c000d551a\u003e] seq_read+0xc4/0x510\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c0002800d\u003e] __sys_setreuid+0x115/0x1c6\n     [\u003c00103640\u003e] proc_reg_read+0x5c/0xb0\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c000b3344\u003e] __vfs_read+0x2c/0x13c\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c000b8aa2\u003e] sys_statx+0x60/0x7e\n     [\u003c000b34b6\u003e] vfs_read+0x62/0x12a\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c000b39c2\u003e] ksys_read+0x48/0xbe\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c000b3a4e\u003e] sys_read+0x16/0x1a\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c00002b84\u003e] syscall+0x8/0xc\n     [\u003c00018000\u003e] fp_fcos+0x2/0x82\n     [\u003c0000c016\u003e] not_ext+0xa/0x18\n    Code: 4e5e 4e75 4e56 0000 206e 0008 2068 ffe8 \u003c2068\u003e 0020 2008 4e5e 4e75 4e56 0000 2f0b 206e 0008 2068 0004 2668 0020 206b ffe8\n    Disabling lock debugging due to kernel taint\n\n    Segmentation fault\n\nThe proc_create_single_data() conversion does not work because\nsingle_open(file, nubus_proc_rsrc_show, PDE_DATA(inode)) is not\nequivalent to the original code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c88146df-cb30-48d0-9725-81d0df1aa704",
      "id": "CVE-2024-42070",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers\n\nregister store validation for NFT_DATA_VALUE is conditional, however,\nthe datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This\nonly requires a new helper function to infer the register type from the\nset datatype so this conditional check can be removed. Otherwise,\npointer to chain object can be leaked through the registers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3418d7a0-68cb-4009-9076-7dabd1255651",
      "id": "CVE-2024-42292",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkobject_uevent: Fix OOB access within zap_modalias_env()\n\nzap_modalias_env() wrongly calculates size of memory block to move, so\nwill cause OOB memory access issue if variable MODALIAS is not the last\none within its @env parameter, fixed by correcting size to memmove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e306e843-b568-4dbc-8c0d-d8e6c2abac18",
      "id": "CVE-2024-43861",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: fix memory leak for not ip packets\n\nFree the unused skb when not ip packets arrive.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52e3710d-5396-4345-8c6d-9584b0dcfe44",
      "id": "CVE-2024-44988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: Fix out-of-bound access\n\nIf an ATU violation was caused by a CPU Load operation, the SPID could\nbe larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45def4a4-e12b-4de2-abb1-8d6727cfc4e2",
      "id": "CVE-2024-46705",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "31e99946-1b9a-4cf9-bf74-3398bc075ac9",
      "id": "CVE-2024-46762",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: privcmd: Fix possible access to a freed kirqfd instance\n\nNothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and\nprivcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd\ncreated and added to the irqfds_list by privcmd_irqfd_assign() may get\nremoved by another thread executing privcmd_irqfd_deassign(), while the\nformer is still using it after dropping the locks.\n\nThis can lead to a situation where an already freed kirqfd instance may\nbe accessed and cause kernel oops.\n\nUse SRCU locking to prevent the same, as is done for the KVM\nimplementation for irqfds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0254d6fb-434c-40f3-9dc2-98be9372ec5f",
      "id": "CVE-2024-46770",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Add netif_device_attach/detach into PF reset flow\n\nEthtool callbacks can be executed while reset is in progress and try to\naccess deleted resources, e.g. getting coalesce settings can result in a\nNULL pointer dereference seen below.\n\nReproduction steps:\nOnce the driver is fully initialized, trigger reset:\n\t# echo 1 \u003e /sys/class/net/\u003cinterface\u003e/device/reset\nwhen reset is in progress try to get coalesce settings using ethtool:\n\t# ethtool -c \u003cinterface\u003e\n\nBUG: kernel NULL pointer dereference, address: 0000000000000020\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP PTI\nCPU: 11 PID: 19713 Comm: ethtool Tainted: G S                 6.10.0-rc7+ #7\nRIP: 0010:ice_get_q_coalesce+0x2e/0xa0 [ice]\nRSP: 0018:ffffbab1e9bcf6a8 EFLAGS: 00010206\nRAX: 000000000000000c RBX: ffff94512305b028 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff9451c3f2e588 RDI: ffff9451c3f2e588\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff9451c3f2e580 R11: 000000000000001f R12: ffff945121fa9000\nR13: ffffbab1e9bcf760 R14: 0000000000000013 R15: ffffffff9e65dd40\nFS:  00007faee5fbe740(0000) GS:ffff94546fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000020 CR3: 0000000106c2e005 CR4: 00000000001706f0\nCall Trace:\n\u003cTASK\u003e\nice_get_coalesce+0x17/0x30 [ice]\ncoalesce_prepare_data+0x61/0x80\nethnl_default_doit+0xde/0x340\ngenl_family_rcv_msg_doit+0xf2/0x150\ngenl_rcv_msg+0x1b3/0x2c0\nnetlink_rcv_skb+0x5b/0x110\ngenl_rcv+0x28/0x40\nnetlink_unicast+0x19c/0x290\nnetlink_sendmsg+0x222/0x490\n__sys_sendto+0x1df/0x1f0\n__x64_sys_sendto+0x24/0x30\ndo_syscall_64+0x82/0x160\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7faee60d8e27\n\nCalling netif_device_detach() before reset makes the net core not call\nthe driver when ethtool command is issued, the attempt to execute an\nethtool command during reset will result in the following message:\n\n    netlink error: No such device\n\ninstead of NULL pointer dereference. Once reset is done and\nice_rebuild() is executing, the netif_device_attach() is called to allow\nfor ethtool operations to occur again in a safe manner.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc73883b-fc4f-4ff8-83f1-09ccfec30a80",
      "id": "CVE-2024-46798",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: dapm: Fix UAF for snd_soc_pcm_runtime object\n\nWhen using kernel with the following extra config,\n\n  - CONFIG_KASAN=y\n  - CONFIG_KASAN_GENERIC=y\n  - CONFIG_KASAN_INLINE=y\n  - CONFIG_KASAN_VMALLOC=y\n  - CONFIG_FRAME_WARN=4096\n\nkernel detects that snd_pcm_suspend_all() access a freed\n'snd_soc_pcm_runtime' object when the system is suspended, which\nleads to a use-after-free bug:\n\n[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270\n[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330\n\n[   52.047785] Call trace:\n[   52.047787]  dump_backtrace+0x0/0x3c0\n[   52.047794]  show_stack+0x34/0x50\n[   52.047797]  dump_stack_lvl+0x68/0x8c\n[   52.047802]  print_address_description.constprop.0+0x74/0x2c0\n[   52.047809]  kasan_report+0x210/0x230\n[   52.047815]  __asan_report_load1_noabort+0x3c/0x50\n[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270\n[   52.047824]  snd_soc_suspend+0x19c/0x4e0\n\nThe snd_pcm_sync_stop() has a NULL check on 'substream-\u003eruntime' before\nmaking any access. So we need to always set 'substream-\u003eruntime' to NULL\neverytime we kfree() it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "238b633a-2205-4ffb-afa4-e120235bdac9",
      "id": "CVE-2024-47667",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)\n\nErrata #i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0\n(SPRZ452D_July 2018_Revised December 2019 [1]) mentions when an\ninbound PCIe TLP spans more than two internal AXI 128-byte bursts,\nthe bus may corrupt the packet payload and the corrupt data may\ncause associated applications or the processor to hang.\n\nThe workaround for Errata #i2037 is to limit the maximum read\nrequest size and maximum payload size to 128 bytes. Add workaround\nfor Errata #i2037 here.\n\nThe errata and workaround is applicable only to AM65x SR 1.0 and\nlater versions of the silicon will have this fixed.\n\n[1] -\u003e https://www.ti.com/lit/er/sprz452i/sprz452i.pdf",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bd0ffd3-887d-4f96-be84-155a98cd6897",
      "id": "CVE-2024-47723",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix out-of-bounds in dbNextAG() and diAlloc()\n\nIn dbNextAG() , there is no check for the case where bmp-\u003edb_numag is\ngreater or same than MAXAG due to a polluted image, which causes an\nout-of-bounds. Therefore, a bounds check should be added in dbMount().\n\nAnd in dbNextAG(), a check for the case where agpref is greater than\nbmp-\u003edb_numag should be added, so an out-of-bounds exception should be\nprevented.\n\nAdditionally, a check for the case where agno is greater or same than\nMAXAG should be added in diAlloc() to prevent out-of-bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3523ba80-48cf-4121-b9cc-dced14902134",
      "id": "CVE-2024-49897",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check phantom_stream before it is used\n\ndcn32_enable_phantom_stream can return null, so returned value\nmust be checked before used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c02ef9e-284b-4ee6-8ae4-43d8880c9fa5",
      "id": "CVE-2024-49912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'\n\nThis commit adds a null check for 'stream_status' in the function\n'planes_changed_for_existing_stream'. Previously, the code assumed\n'stream_status' could be null, but did not handle the case where it was\nactually null. This could lead to a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02a13608-a605-4b66-83da-49f684b2df09",
      "id": "CVE-2024-49923",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags\n\n[WHAT \u0026 HOW]\n\"dcn20_validate_apply_pipe_split_flags\" dereferences merge, and thus it\ncannot be a null pointer. Let's pass a valid pointer to avoid null\ndereference.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c79817ba-fbff-4135-b4ab-f853e39cf7bd",
      "id": "CVE-2024-49958",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reserve space for inline xattr before attaching reflink tree\n\nOne of our customers reported a crash and a corrupted ocfs2 filesystem. \nThe crash was due to the detection of corruption.  Upon troubleshooting,\nthe fsck -fn output showed the below corruption\n\n[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,\nbut fsck believes the largest valid value is 227.  Clamp the next record value? n\n\nThe stat output from the debugfs.ocfs2 showed the following corruption\nwhere the \"Next Free Rec:\" had overshot the \"Count:\" in the root metadata\nblock.\n\n        Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)\n        FS Generation: 904309833 (0x35e6ac49)\n        CRC32: 00000000   ECC: 0000\n        Type: Regular   Attr: 0x0   Flags: Valid\n        Dynamic Features: (0x16) HasXattr InlineXattr Refcounted\n        Extended Attributes Block: 0  Extended Attributes Inline Size: 256\n        User: 0 (root)   Group: 0 (root)   Size: 281320357888\n        Links: 1   Clusters: 141738\n        ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024\n        atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024\n        mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024\n        dtime: 0x0 -- Wed Dec 31 17:00:00 1969\n        Refcount Block: 2777346\n        Last Extblk: 2886943   Orphan Slot: 0\n        Sub Alloc Slot: 0   Sub Alloc Bit: 14\n        Tree Depth: 1   Count: 227   Next Free Rec: 230\n        ## Offset        Clusters       Block#\n        0  0             2310           2776351\n        1  2310          2139           2777375\n        2  4449          1221           2778399\n        3  5670          731            2779423\n        4  6401          566            2780447\n        .......          ....           .......\n        .......          ....           .......\n\nThe issue was in the reflink workfow while reserving space for inline\nxattr.  The problematic function is ocfs2_reflink_xattr_inline().  By the\ntime this function is called the reflink tree is already recreated at the\ndestination inode from the source inode.  At this point, this function\nreserves space for inline xattrs at the destination inode without even\nchecking if there is space at the root metadata block.  It simply reduces\nthe l_count from 243 to 227 thereby making space of 256 bytes for inline\nxattr whereas the inode already has extents beyond this index (in this\ncase up to 230), thereby causing corruption.\n\nThe fix for this is to reserve space for inline metadata at the destination\ninode before the reflink tree gets recreated. The customer has verified the\nfix.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d56a51d-fc80-4eb1-a6c2-9caa62765ad9",
      "id": "CVE-2021-45486",
      "description": "In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "241bd5de-fcfe-4d3b-a396-888ec4ea7f80",
      "id": "CVE-2024-50184",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_pmem: Check device status before requesting flush\n\nIf a pmem device is in a bad status, the driver side could wait for\nhost ack forever in virtio_pmem_flush(), causing the system to hang.\n\nSo add a status check in the beginning of virtio_pmem_flush() to return\nearly if the device is not activated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b34dce23-2e3b-406a-af3f-ef0722983b67",
      "id": "CVE-2024-50242",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Additional check in ntfs_file_release",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e4ed083-8331-4a58-a78a-cae8cf277290",
      "id": "CVE-2024-56606",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: avoid erroring out after sock_init_data() in packet_create()\n\nAfter sock_init_data() the allocated sk object is attached to the provided\nsock object. On error, packet_create() frees the sk object leaving the\ndangling pointer in the sock object on return. Some other code may try\nto use this pointer and cause use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16a674b2-2b73-4dfc-b1ef-8e4893160275",
      "id": "CVE-2024-57890",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Prevent integer overflow issue\n\nIn the expression \"cmd.wqe_size * cmd.wr_count\", both variables are u32\nvalues that come from the user so the multiplication can lead to integer\nwrapping.  Then we pass the result to uverbs_request_next_ptr() which also\ncould potentially wrap.  The \"cmd.sge_count * sizeof(struct ib_uverbs_sge)\"\nmultiplication can also overflow on 32bit systems although it's fine on\n64bit systems.\n\nThis patch does two things.  First, I've re-arranged the condition in\nuverbs_request_next_ptr() so that the use controlled variable \"len\" is on\none side of the comparison by itself without any math.  Then I've modified\nall the callers to use size_mul() for the multiplications.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ce57af4-7bb4-4efc-939b-8b5f0ca934ab",
      "id": "CVE-2023-4134",
      "description": "A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eae94007-c6b7-4b30-b4f9-6b3546aa45cd",
      "id": "CVE-2025-37980",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix resource leak in blk_register_queue() error path\n\nWhen registering a queue fails after blk_mq_sysfs_register() is\nsuccessful but the function later encounters an error, we need\nto clean up the blk_mq_sysfs resources.\n\nAdd the missing blk_mq_sysfs_unregister() call in the error path\nto properly clean up these resources and prevent a memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00dd9a8f-7052-4173-ac68-f20c71752b43",
      "id": "CVE-2024-57980",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix double free in error path\n\nIf the uvc_status_init() function fails to allocate the int_urb, it will\nfree the dev-\u003estatus pointer but doesn't reset the pointer to NULL. This\nresults in the kfree() call in uvc_status_cleanup() trying to\ndouble-free the memory. Fix it by resetting the dev-\u003estatus pointer to\nNULL after freeing it.\n\nReviewed by: Ricardo Ribalda \u003cribalda@chromium.org\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "150318e1-aa95-4438-9391-48b814cd1e75",
      "id": "CVE-2025-21722",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: do not force clear folio if buffer is referenced\n\nPatch series \"nilfs2: protect busy buffer heads from being force-cleared\".\n\nThis series fixes the buffer head state inconsistency issues reported by\nsyzbot that occurs when the filesystem is corrupted and falls back to\nread-only, and the associated buffer head use-after-free issue.\n\n\nThis patch (of 2):\n\nSyzbot has reported that after nilfs2 detects filesystem corruption and\nfalls back to read-only, inconsistencies in the buffer state may occur.\n\nOne of the inconsistencies is that when nilfs2 calls mark_buffer_dirty()\nto set a data or metadata buffer as dirty, but it detects that the buffer\nis not in the uptodate state:\n\n WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520\n  fs/buffer.c:1177\n ...\n Call Trace:\n  \u003cTASK\u003e\n  nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598\n  nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73\n  nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344\n  nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218\n  vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257\n  do_mkdirat+0x264/0x3a0 fs/namei.c:4280\n  __do_sys_mkdirat fs/namei.c:4295 [inline]\n  __se_sys_mkdirat fs/namei.c:4293 [inline]\n  __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe other is when nilfs_btree_propagate(), which propagates the dirty\nstate to the ancestor nodes of a b-tree that point to a dirty buffer,\ndetects that the origin buffer is not dirty, even though it should be:\n\n WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089\n  nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089\n ...\n Call Trace:\n  \u003cTASK\u003e\n  nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345\n  nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587\n  nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006\n  nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045\n  nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline]\n  nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline]\n  nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115\n  nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline]\n  nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701\n  kthread+0x2f0/0x390 kernel/kthread.c:389\n  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n  \u003c/TASK\u003e\n\nBoth of these issues are caused by the callbacks that handle the\npage/folio write requests, forcibly clear various states, including the\nworking state of the buffers they hold, at unexpected times when they\ndetect read-only fallback.\n\nFix these issues by checking if the buffer is referenced before clearing\nthe page/folio state, and skipping the clear if it is.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ad3a171-f507-4538-8538-cf8cf5156512",
      "id": "CVE-2025-21796",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clear acl_access/acl_default after releasing them\n\nIf getting acl_default fails, acl_access and acl_default will be released\nsimultaneously. However, acl_access will still retain a pointer pointing\nto the released posix_acl, which will trigger a WARNING in\nnfs3svc_release_getacl like this:\n\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 26 PID: 3199 at lib/refcount.c:28\nrefcount_warn_saturate+0xb5/0x170\nModules linked in:\nCPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted\n6.12.0-rc6-00079-g04ae226af01f-dirty #8\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xb5/0x170\nCode: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75\ne4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff \u003c0f\u003e 0b eb\ncd 0f b6 1d 8a3\nRSP: 0018:ffffc90008637cd8 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380\nRBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56\nR10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0\nFS:  0000000000000000(0000) GS:ffff88871ed00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? refcount_warn_saturate+0xb5/0x170\n ? __warn+0xa5/0x140\n ? refcount_warn_saturate+0xb5/0x170\n ? report_bug+0x1b1/0x1e0\n ? handle_bug+0x53/0xa0\n ? exc_invalid_op+0x17/0x40\n ? asm_exc_invalid_op+0x1a/0x20\n ? tick_nohz_tick_stopped+0x1e/0x40\n ? refcount_warn_saturate+0xb5/0x170\n ? refcount_warn_saturate+0xb5/0x170\n nfs3svc_release_getacl+0xc9/0xe0\n svc_process_common+0x5db/0xb60\n ? __pfx_svc_process_common+0x10/0x10\n ? __rcu_read_unlock+0x69/0xa0\n ? __pfx_nfsd_dispatch+0x10/0x10\n ? svc_xprt_received+0xa1/0x120\n ? xdr_init_decode+0x11d/0x190\n svc_process+0x2a7/0x330\n svc_handle_xprt+0x69d/0x940\n svc_recv+0x180/0x2d0\n nfsd+0x168/0x200\n ? __pfx_nfsd+0x10/0x10\n kthread+0x1a2/0x1e0\n ? kthread+0xf4/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x60\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\nKernel panic - not syncing: kernel: panic_on_warn set ...\n\nClear acl_access/acl_default after posix_acl_release is called to prevent\nUAF from being triggered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de0232f3-7343-462e-ab53-c515a4aaedff",
      "id": "CVE-2025-23159",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add a check to handle OOB in sfr region\n\nsfr-\u003ebuf_size is in shared memory and can be modified by malicious user.\nOOB write is possible when the size is made higher than actual sfr data\nbuffer. Cap the size to allocated size for such cases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01c58878-b5e0-4474-873d-748d4b574517",
      "id": "CVE-2025-37765",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: prime: fix ttm_bo_delayed_delete oops\n\nFix an oops in ttm_bo_delayed_delete which results from dererencing a\ndangling pointer:\n\nOops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b7b: 0000 [#1] PREEMPT SMP\nCPU: 4 UID: 0 PID: 1082 Comm: kworker/u65:2 Not tainted 6.14.0-rc4-00267-g505460b44513-dirty #216\nHardware name: LENOVO 82N6/LNVNB161216, BIOS GKCN65WW 01/16/2024\nWorkqueue: ttm ttm_bo_delayed_delete [ttm]\nRIP: 0010:dma_resv_iter_first_unlocked+0x55/0x290\nCode: 31 f6 48 c7 c7 00 2b fa aa e8 97 bd 52 ff e8 a2 c1 53 00 5a 85 c0 74 48 e9 88 01 00 00 4c 89 63 20 4d 85 e4 0f 84 30 01 00 00 \u003c41\u003e 8b 44 24 10 c6 43 2c 01 48 89 df 89 43 28 e8 97 fd ff ff 4c 8b\nRSP: 0018:ffffbf9383473d60 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffffbf9383473d88 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffbf9383473d78 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 6b6b6b6b6b6b6b6b\nR13: ffffa003bbf78580 R14: ffffa003a6728040 R15: 00000000000383cc\nFS:  0000000000000000(0000) GS:ffffa00991c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000758348024dd0 CR3: 000000012c259000 CR4: 0000000000f50ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die_body.cold+0x19/0x26\n ? die_addr+0x3d/0x70\n ? exc_general_protection+0x159/0x460\n ? asm_exc_general_protection+0x27/0x30\n ? dma_resv_iter_first_unlocked+0x55/0x290\n dma_resv_wait_timeout+0x56/0x100\n ttm_bo_delayed_delete+0x69/0xb0 [ttm]\n process_one_work+0x217/0x5c0\n worker_thread+0x1c8/0x3d0\n ? apply_wqattrs_cleanup.part.0+0xc0/0xc0\n kthread+0x10b/0x240\n ? kthreads_online_cpu+0x140/0x140\n ret_from_fork+0x40/0x70\n ? kthreads_online_cpu+0x140/0x140\n ret_from_fork_asm+0x11/0x20\n \u003c/TASK\u003e\n\nThe cause of this is:\n\n- drm_prime_gem_destroy calls dma_buf_put(dma_buf) which releases the\n  reference to the shared dma_buf. The reference count is 0, so the\n  dma_buf is destroyed, which in turn decrements the corresponding\n  amdgpu_bo reference count to 0, and the amdgpu_bo is destroyed -\n  calling drm_gem_object_release then dma_resv_fini (which destroys the\n  reservation object), then finally freeing the amdgpu_bo.\n\n- nouveau_bo obj-\u003ebo.base.resv is now a dangling pointer to the memory\n  formerly allocated to the amdgpu_bo.\n\n- nouveau_gem_object_del calls ttm_bo_put(\u0026nvbo-\u003ebo) which calls\n  ttm_bo_release, which schedules ttm_bo_delayed_delete.\n\n- ttm_bo_delayed_delete runs and dereferences the dangling resv pointer,\n  resulting in a general protection fault.\n\nFix this by moving the drm_prime_gem_destroy call from\nnouveau_gem_object_del to nouveau_bo_del_ttm. This ensures that it will\nbe run after ttm_bo_delayed_delete.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "015d7d02-dc04-45a9-87a5-56540bbc7541",
      "id": "CVE-2025-37800",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential NULL pointer dereference in dev_uevent()\n\nIf userspace reads \"uevent\" device attribute at the same time as another\nthreads unbinds the device from its driver, change to dev-\u003edriver from a\nvalid pointer to NULL may result in crash. Fix this by using READ_ONCE()\nwhen fetching the pointer, and take bus' drivers klist lock to make sure\ndriver instance will not disappear while we access it.\n\nUse WRITE_ONCE() when setting the driver pointer to ensure there is no\ntearing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34187bd0-86a1-4884-92aa-d0e7b21648b9",
      "id": "CVE-2024-42289",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: During vport delete send async logout explicitly\n\nDuring vport delete, it is observed that during unload we hit a crash\nbecause of stale entries in outstanding command array.  For all these stale\nI/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but\nI/Os could not complete while vport delete is in process of deleting.\n\n  BUG: kernel NULL pointer dereference, address: 000000000000001c\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  Workqueue: qla2xxx_wq qla_do_work [qla2xxx]\n  RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0\n  RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046\n  RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001\n  RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0\n  RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8\n  R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000\n  R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000\n  FS:  0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0\n  Call Trace:\n  \u003cTASK\u003e\n  qla2xxx_qpair_sp_free_dma+0x417/0x4e0\n  ? qla2xxx_qpair_sp_compl+0x10d/0x1a0\n  ? qla2x00_status_entry+0x768/0x2830\n  ? newidle_balance+0x2f0/0x430\n  ? dequeue_entity+0x100/0x3c0\n  ? qla24xx_process_response_queue+0x6a1/0x19e0\n  ? __schedule+0x2d5/0x1140\n  ? qla_do_work+0x47/0x60\n  ? process_one_work+0x267/0x440\n  ? process_one_work+0x440/0x440\n  ? worker_thread+0x2d/0x3d0\n  ? process_one_work+0x440/0x440\n  ? kthread+0x156/0x180\n  ? set_kthread_struct+0x50/0x50\n  ? ret_from_fork+0x22/0x30\n  \u003c/TASK\u003e\n\nSend out async logout explicitly for all the ports during vport delete.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bf0f6f9-3077-466f-bdfe-135157d229f1",
      "id": "CVE-2025-37884",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix deadlock between rcu_tasks_trace and event_mutex.\n\nFix the following deadlock:\nCPU A\n_free_event()\n  perf_kprobe_destroy()\n    mutex_lock(\u0026event_mutex)\n      perf_trace_event_unreg()\n        synchronize_rcu_tasks_trace()\n\nThere are several paths where _free_event() grabs event_mutex\nand calls sync_rcu_tasks_trace. Above is one such case.\n\nCPU B\nbpf_prog_test_run_syscall()\n  rcu_read_lock_trace()\n    bpf_prog_run_pin_on_cpu()\n      bpf_prog_load()\n        bpf_tracing_func_proto()\n          trace_set_clr_event()\n            mutex_lock(\u0026event_mutex)\n\nDelegate trace_set_clr_event() to workqueue to avoid\nsuch lock dependency.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae0c4d47-32b8-4fd7-9088-04fb88137cba",
      "id": "CVE-2025-38045",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix debug actions order\n\nThe order of actions taken for debug was implemented incorrectly.\nNow we implemented the dump split and do the FW reset only in the\nmiddle of the dump (rather than the FW killing itself on error.)\nAs a result, some of the actions taken when applying the config\nwill now crash the device, so we need to fix the order.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "860b7922-ae23-4f8a-814e-d5d1aa69f217",
      "id": "CVE-2025-38126",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: make sure that ptp_rate is not 0 before configuring timestamping\n\nThe stmmac platform drivers that do not open-code the clk_ptp_rate value\nafter having retrieved the default one from the device-tree can end up\nwith 0 in clk_ptp_rate (as clk_get_rate can return 0). It will\neventually propagate up to PTP initialization when bringing up the\ninterface, leading to a divide by 0:\n\n Division by zero in kernel.\n CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22\n Hardware name: STM32 (Device Tree Support)\n Call trace:\n  unwind_backtrace from show_stack+0x18/0x1c\n  show_stack from dump_stack_lvl+0x6c/0x8c\n  dump_stack_lvl from Ldiv0_64+0x8/0x18\n  Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4\n  stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c\n  stmmac_hw_setup from __stmmac_open+0x18c/0x434\n  __stmmac_open from stmmac_open+0x3c/0xbc\n  stmmac_open from __dev_open+0xf4/0x1ac\n  __dev_open from __dev_change_flags+0x1cc/0x224\n  __dev_change_flags from dev_change_flags+0x24/0x60\n  dev_change_flags from ip_auto_config+0x2e8/0x11a0\n  ip_auto_config from do_one_initcall+0x84/0x33c\n  do_one_initcall from kernel_init_freeable+0x1b8/0x214\n  kernel_init_freeable from kernel_init+0x24/0x140\n  kernel_init from ret_from_fork+0x14/0x28\n Exception stack(0xe0815fb0 to 0xe0815ff8)\n\nPrevent this division by 0 by adding an explicit check and error log\nabout the actual issue. While at it, remove the same check from\nstmmac_ptp_register, which then becomes duplicate",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3bb63f9-71a8-4858-a16a-b4da5f1d0662",
      "id": "CVE-2025-38193",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition fixed in a separate patch.\n\nWe want to make sure ctl-\u003eperturb_period * HZ will not overflow\nand is positive.\n\n\ntc qd add dev lo root sfq perturb -10   # negative value : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 1000000000 # too big : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 2000000 # acceptable value\ntc -s -d qd sh dev lo\nqdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec\n Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a42652ad-cc4d-4e64-89ba-b791c0fbe1e2",
      "id": "CVE-2025-38264",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: sanitize request list handling\n\nValidate the request in nvme_tcp_handle_r2t() to ensure it's not part of\nany list, otherwise a malicious R2T PDU might inject a loop in request\nlist processing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a4a46a4-9baa-487c-993e-29a18ee1ab5b",
      "id": "CVE-2022-49116",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: use memset avoid memory leaks\n\nUse memset to initialize structs to prevent memory leaks\nin l2cap_ecred_connect",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81e6043a-565c-4d96-954a-4caba97b7c51",
      "id": "CVE-2025-38645",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Check device memory pointer before usage\n\nAdd a NULL check before accessing device memory to prevent a crash if\ndev-\u003edm allocation in mlx5_init_once() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73f6db54-5521-4c46-92e3-c173822e1f64",
      "id": "CVE-2025-39810",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix memory corruption when FW resources change during ifdown\n\nbnxt_set_dflt_rings() assumes that it is always called before any TC has\nbeen created.  So it doesn't take bp-\u003enum_tc into account and assumes\nthat it is always 0 or 1.\n\nIn the FW resource or capability change scenario, the FW will return\nflags in bnxt_hwrm_if_change() that will cause the driver to\nreinitialize and call bnxt_cancel_reservations().  This will lead to\nbnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp-\u003enum_tc\nmay be greater than 1.  This will cause bp-\u003etx_ring[] to be sized too\nsmall and cause memory corruption in bnxt_alloc_cp_rings().\n\nFix it by properly scaling the TX rings by bp-\u003enum_tc in the code\npaths mentioned above.  Add 2 helper functions to determine\nbp-\u003etx_nr_rings and bp-\u003etx_nr_rings_per_tc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b93635c9-be82-4a09-9309-cc01e3cb56ab",
      "id": "CVE-2020-12653",
      "description": "An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e29067d-3ffc-4307-b16b-d2f5f597d63e",
      "id": "CVE-2020-14385",
      "description": "A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c5075e0-a1ca-4ac8-8a0d-e84428ee0f76",
      "id": "CVE-2022-49541",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential double free during failed mount\n\nRHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b56d504-83bc-46ed-9b13-40ad791ee82a",
      "id": "CVE-2020-25211",
      "description": "In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c8f2f37-28fb-40c3-aa7e-233d500b00e7",
      "id": "CVE-2020-27820",
      "description": "A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if \"unbind\" the driver).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aaf8adf1-d57e-4506-853f-0b879450ce83",
      "id": "CVE-2021-28038",
      "description": "An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ace01fca-bf41-4b14-9768-d14f09c368d6",
      "id": "CVE-2021-47190",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf bpf: Avoid memory leak from perf_env__insert_btf()\n\nperf_env__insert_btf() doesn't insert if a duplicate BTF id is\nencountered and this causes a memory leak. Modify the function to return\na success/error value and then free the memory if insertion didn't\nhappen.\n\nv2. Adds a return -1 when the insertion error occurs in\n    perf_env__fetch_btf. This doesn't affect anything as the result is\n    never checked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "925e219d-40b4-42db-98ea-1def2a26977f",
      "id": "CVE-2021-3736",
      "description": "A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "425df702-d434-4b81-8f90-bb682f7ac90e",
      "id": "CVE-2021-46998",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet:enic: Fix a use after free bug in enic_hard_start_xmit\n\nIn enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside\nenic_queue_wq_skb, if some error happens, the skb will be freed\nby dev_kfree_skb(skb). But the freed skb is still used in\nskb_tx_timestamp(skb).\n\nMy patch makes enic_queue_wq_skb() return error and goto spin_unlock()\nincase of error. The solution is provided by Govind.\nSee https://lkml.org/lkml/2021/4/30/961.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6b825bb-8dcb-4188-8fda-823be2b1ab17",
      "id": "CVE-2021-47180",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: fix memory leak in nci_allocate_device\n\nnfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev.\nFix this by freeing hci_dev in nci_free_device.\n\nBUG: memory leak\nunreferenced object 0xffff888111ea6800 (size 1024):\n  comm \"kworker/1:0\", pid 19, jiffies 4294942308 (age 13.580s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff  .........`......\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c000000004bc25d43\u003e] kmalloc include/linux/slab.h:552 [inline]\n    [\u003c000000004bc25d43\u003e] kzalloc include/linux/slab.h:682 [inline]\n    [\u003c000000004bc25d43\u003e] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784\n    [\u003c00000000c59cff92\u003e] nci_allocate_device net/nfc/nci/core.c:1170 [inline]\n    [\u003c00000000c59cff92\u003e] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132\n    [\u003c00000000006e0a8e\u003e] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153\n    [\u003c000000004da1b57e\u003e] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345\n    [\u003c00000000d506aed9\u003e] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [\u003c00000000bc632c92\u003e] really_probe+0x159/0x4a0 drivers/base/dd.c:554\n    [\u003c00000000f5009125\u003e] driver_probe_device+0x84/0x100 drivers/base/dd.c:740\n    [\u003c000000000ce658ca\u003e] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846\n    [\u003c000000007067d05f\u003e] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431\n    [\u003c00000000f8e13372\u003e] __device_attach+0x122/0x250 drivers/base/dd.c:914\n    [\u003c000000009cf68860\u003e] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491\n    [\u003c00000000359c965a\u003e] device_add+0x5be/0xc30 drivers/base/core.c:3109\n    [\u003c00000000086e4bd3\u003e] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164\n    [\u003c00000000ca036872\u003e] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [\u003c00000000d40d36f6\u003e] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [\u003c00000000bc632c92\u003e] really_probe+0x159/0x4a0 drivers/base/dd.c:554",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fdb27b4-85e7-42e5-a8c8-d4e01716e033",
      "id": "CVE-2022-48687",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix out-of-bounds read when setting HMAC data.\n\nThe SRv6 layer allows defining HMAC data that can later be used to sign IPv6\nSegment Routing Headers. This configuration is realised via netlink through\nfour attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and\nSEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual\nlength of the SECRET attribute, it is possible to provide invalid combinations\n(e.g., secret = \"\", secretlen = 64). This case is not checked in the code and\nwith an appropriately crafted netlink message, an out-of-bounds read of up\nto 64 bytes (max secret length) can occur past the skb end pointer and into\nskb_shared_info:\n\nBreakpoint 1, seg6_genl_sethmac (skb=\u003coptimized out\u003e, info=\u003coptimized out\u003e) at net/ipv6/seg6.c:208\n208\t\tmemcpy(hinfo-\u003esecret, secret, slen);\n(gdb) bt\n #0  seg6_genl_sethmac (skb=\u003coptimized out\u003e, info=\u003coptimized out\u003e) at net/ipv6/seg6.c:208\n #1  0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600,\n    extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 \u003cinit_net\u003e, family=\u003coptimized out\u003e,\n    family=\u003coptimized out\u003e) at net/netlink/genetlink.c:731\n #2  0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00,\n    family=0xffffffff82fef6c0 \u003cseg6_genl_family\u003e) at net/netlink/genetlink.c:775\n #3  genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792\n #4  0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 \u003cgenl_rcv_msg\u003e)\n    at net/netlink/af_netlink.c:2501\n #5  0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803\n #6  0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000)\n    at net/netlink/af_netlink.c:1319\n #7  netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=\u003coptimized out\u003e)\n    at net/netlink/af_netlink.c:1345\n #8  0xffffffff81dff9a4 in netlink_sendmsg (sock=\u003coptimized out\u003e, msg=0xffffc90000ba7e48, len=\u003coptimized out\u003e) at net/netlink/af_netlink.c:1921\n...\n(gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)-\u003ehead + ((struct sk_buff *)0xffff88800b1f9f00)-\u003eend\n$1 = 0xffff88800b1b76c0\n(gdb) p/x secret\n$2 = 0xffff88800b1b76c0\n(gdb) p slen\n$3 = 64 '@'\n\nThe OOB data can then be read back from userspace by dumping HMAC state. This\ncommit fixes this by ensuring SECRETLEN cannot exceed the actual length of\nSECRET.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c3e6709-82cf-4b09-9700-c8c79b7a02d0",
      "id": "CVE-2021-47276",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Do not blindly read the ip address in ftrace_bug()\n\nIt was reported that a bug on arm64 caused a bad ip address to be used for\nupdating into a nop in ftrace_init(), but the error path (rightfully)\nreturned -EINVAL and not -EFAULT, as the bug caused more than one error to\noccur. But because -EINVAL was returned, the ftrace_bug() tried to report\nwhat was at the location of the ip address, and read it directly. This\ncaused the machine to panic, as the ip was not pointing to a valid memory\naddress.\n\nInstead, read the ip address with copy_from_kernel_nofault() to safely\naccess the memory, and if it faults, report that the address faulted,\notherwise report what was in that location.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "968eda28-231f-439c-ae74-95e770a9bda4",
      "id": "CVE-2021-47284",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: netjet: Fix crash in nj_probe:\n\n'nj_setup' in netjet.c might fail with -EIO and in this case\n'card-\u003eirq' is initialized and is bigger than zero. A subsequent call to\n'nj_release' will free the irq that has not been requested.\n\nFix this bug by deleting the previous assignment to 'card-\u003eirq' and just\nkeep the assignment before 'request_irq'.\n\nThe KASAN's log reveals it:\n\n[    3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826\nfree_irq+0x100/0x480\n[    3.355112 ] Modules linked in:\n[    3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted\n5.13.0-rc1-00144-g25a1298726e #13\n[    3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[    3.356552 ] RIP: 0010:free_irq+0x100/0x480\n[    3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18\n4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5\nff \u003c0f\u003e 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80\n[    3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082\n[    3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:\n0000000000000000\n[    3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:\n00000000ffffffff\n[    3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:\n0000000000000000\n[    3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:\n0000000000000000\n[    3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:\nffff888104dc80a8\n[    3.360652 ] FS:  0000000000000000(0000) GS:ffff88817bc00000(0000)\nknlGS:0000000000000000\n[    3.361170 ] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4:\n00000000000006f0\n[    3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[    3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[    3.362175 ] Call Trace:\n[    3.362175 ]  nj_release+0x51/0x1e0\n[    3.362175 ]  nj_probe+0x450/0x950\n[    3.362175 ]  ? pci_device_remove+0x110/0x110\n[    3.362175 ]  local_pci_probe+0x45/0xa0\n[    3.362175 ]  pci_device_probe+0x12b/0x1d0\n[    3.362175 ]  really_probe+0x2a9/0x610\n[    3.362175 ]  driver_probe_device+0x90/0x1d0\n[    3.362175 ]  ? mutex_lock_nested+0x1b/0x20\n[    3.362175 ]  device_driver_attach+0x68/0x70\n[    3.362175 ]  __driver_attach+0x124/0x1b0\n[    3.362175 ]  ? device_driver_attach+0x70/0x70\n[    3.362175 ]  bus_for_each_dev+0xbb/0x110\n[    3.362175 ]  ? rdinit_setup+0x45/0x45\n[    3.362175 ]  driver_attach+0x27/0x30\n[    3.362175 ]  bus_add_driver+0x1eb/0x2a0\n[    3.362175 ]  driver_register+0xa9/0x180\n[    3.362175 ]  __pci_register_driver+0x82/0x90\n[    3.362175 ]  ? w6692_init+0x38/0x38\n[    3.362175 ]  nj_init+0x36/0x38\n[    3.362175 ]  do_one_initcall+0x7f/0x3d0\n[    3.362175 ]  ? rdinit_setup+0x45/0x45\n[    3.362175 ]  ? rcu_read_lock_sched_held+0x4f/0x80\n[    3.362175 ]  kernel_init_freeable+0x2aa/0x301\n[    3.362175 ]  ? rest_init+0x2c0/0x2c0\n[    3.362175 ]  kernel_init+0x18/0x190\n[    3.362175 ]  ? rest_init+0x2c0/0x2c0\n[    3.362175 ]  ? rest_init+0x2c0/0x2c0\n[    3.362175 ]  ret_from_fork+0x1f/0x30\n[    3.362175 ] Kernel panic - not syncing: panic_on_warn set ...\n[    3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted\n5.13.0-rc1-00144-g25a1298726e #13\n[    3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[    3.362175 ] Call Trace:\n[    3.362175 ]  dump_stack+0xba/0xf5\n[    3.362175 ]  ? free_irq+0x100/0x480\n[    3.362175 ]  panic+0x15a/0x3f2\n[    3.362175 ]  ? __warn+0xf2/0x150\n[    3.362175 ]  ? free_irq+0x100/0x480\n[    3.362175 ]  __warn+0x108/0x150\n[    3.362175 ]  ? free_irq+0x100/0x480\n[    3.362175 ]  report_bug+0x119/0x1c0\n[    3.362175 ]  handle_bug+0x3b/0x80\n[    3.362175 ]  exc_invalid_op+0x18/0x70\n[    3.362175 ]  asm_exc_invalid_op+0x12/0x20\n[    3.362175 ] RIP: 0010:free_irq+0x100\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c3d9e90-7547-4350-b054-e03dd196993d",
      "id": "CVE-2021-47345",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix rdma_resolve_route() memory leak\n\nFix a memory leak when \"mda_resolve_route() is called more than once on\nthe same \"rdma_cm_id\".\n\nThis is possible if cma_query_handler() triggers the\nRDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and\nallows rdma_resolve_route() to be called again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9feda5cd-7512-4d2c-aa67-49431b5f81c6",
      "id": "CVE-2021-47431",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix gart.bo pin_count leak\n\ngmc_v{9,10}_0_gart_disable() isn't called matched with\ncorrespoding gart_enbale function in SRIOV case. This will\nlead to gart.bo pin_count leak on driver unload.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e74f578e-8962-41fe-9355-ef85439f9d1d",
      "id": "CVE-2021-47455",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: Fix possible memory leak in ptp_clock_register()\n\nI got memory leak as follows when doing fault injection test:\n\nunreferenced object 0xffff88800906c618 (size 8):\n  comm \"i2c-idt82p33931\", pid 4421, jiffies 4294948083 (age 13.188s)\n  hex dump (first 8 bytes):\n    70 74 70 30 00 00 00 00                          ptp0....\n  backtrace:\n    [\u003c00000000312ed458\u003e] __kmalloc_track_caller+0x19f/0x3a0\n    [\u003c0000000079f6e2ff\u003e] kvasprintf+0xb5/0x150\n    [\u003c0000000026aae54f\u003e] kvasprintf_const+0x60/0x190\n    [\u003c00000000f323a5f7\u003e] kobject_set_name_vargs+0x56/0x150\n    [\u003c000000004e35abdd\u003e] dev_set_name+0xc0/0x100\n    [\u003c00000000f20cfe25\u003e] ptp_clock_register+0x9f4/0xd30 [ptp]\n    [\u003c000000008bb9f0de\u003e] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]\n\nWhen posix_clock_register() returns an error, the name allocated\nin dev_set_name() will be leaked, the put_device() should be used\nto give up the device reference, then the name will be freed in\nkobject_cleanup() and other memory will be freed in ptp_clock_release().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78cb9b26-0681-4ec1-bf67-8f3377365654",
      "id": "CVE-2022-48688",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix kernel crash during module removal\n\nThe driver incorrectly frees client instance and subsequent\ni40e module removal leads to kernel crash.\n\nReproducer:\n1. Do ethtool offline test followed immediately by another one\nhost# ethtool -t eth0 offline; ethtool -t eth0 offline\n2. Remove recursively irdma module that also removes i40e module\nhost# modprobe -r irdma\n\nResult:\n[ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting\n[ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished\n[ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting\n[ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished\n[ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init_state=2 status=-110\n[ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2\n[ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=0x3d dev=0x00 func=0x01\n[ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1\n[ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000030\n[ 8687.768755] #PF: supervisor read access in kernel mode\n[ 8687.773895] #PF: error_code(0x0000) - not-present page\n[ 8687.779034] PGD 0 P4D 0\n[ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G        W I        5.19.0+ #2\n[ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5C620.86B.0X.02.0001.051420190324 05/14/2019\n[ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e]\n[ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb \u003c48\u003e 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b\n[ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202\n[ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 0000000000000000\n[ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833b2000\n[ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 0000000000000000\n[ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833b2ef0\n[ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833b2008\n[ 8687.870342] FS:  00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:0000000000000000\n[ 8687.878427] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007706e0\n[ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 8687.905572] PKRU: 55555554\n[ 8687.908286] Call Trace:\n[ 8687.910737]  \u003cTASK\u003e\n[ 8687.912843]  i40e_remove+0x2c0/0x330 [i40e]\n[ 8687.917040]  pci_device_remove+0x33/0xa0\n[ 8687.920962]  device_release_driver_internal+0x1aa/0x230\n[ 8687.926188]  driver_detach+0x44/0x90\n[ 8687.929770]  bus_remove_driver+0x55/0xe0\n[ 8687.933693]  pci_unregister_driver+0x2a/0xb0\n[ 8687.937967]  i40e_exit_module+0xc/0xf48 [i40e]\n\nTwo offline tests cause IRDMA driver failure (ETIMEDOUT) and this\nfailure is indicated back to i40e_client_subtask() that calls\ni40e_client_del_instance() to free client instance referenced\nby pf-\u003ecinst and sets this pointer to NULL. During the module\nremoval i40e_remove() calls i40e_lan_del_device() that dereferences\npf-\u003ecinst that is NULL -\u003e crash.\nDo not remove client instance when client open callbacks fails and\njust clear __I40E_CLIENT_INSTANCE_OPENED bit. The driver also needs\nto take care about this situation (when netdev is up and client\nis NOT opened) in i40e_notify_client_of_netdev_close() and\ncalls client close callback only when __I40E_CLIENT_INSTANCE_OPENED\nis set.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55b04cb3-cdda-441b-a106-7f831a067680",
      "id": "CVE-2023-53393",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device\n\nCurrently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0),\nthere is a special handling in order to use the correct counters, but,\nport_num is being passed down the stack without any change.  Also, some\nfunctions assume that port_num \u003e=1. As a result, the following oops can\noccur.\n\n BUG: unable to handle page fault for address: ffff89510294f1a8\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP\n CPU: 8 PID: 1382 Comm: devlink Tainted: G W          6.1.0-rc4_for_upstream_base_2022_11_10_16_12 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:_raw_spin_lock+0xc/0x20\n Call Trace:\n  \u003cTASK\u003e\n  mlx5_ib_get_native_port_mdev+0x73/0xe0 [mlx5_ib]\n  do_get_hw_stats.constprop.0+0x109/0x160 [mlx5_ib]\n  mlx5_ib_get_hw_stats+0xad/0x180 [mlx5_ib]\n  ib_setup_device_attrs+0xf0/0x290 [ib_core]\n  ib_register_device+0x3bb/0x510 [ib_core]\n  ? atomic_notifier_chain_register+0x67/0x80\n  __mlx5_ib_add+0x2b/0x80 [mlx5_ib]\n  mlx5r_probe+0xb8/0x150 [mlx5_ib]\n  ? auxiliary_match_id+0x6a/0x90\n  auxiliary_bus_probe+0x3c/0x70\n  ? driver_sysfs_add+0x6b/0x90\n  really_probe+0xcd/0x380\n  __driver_probe_device+0x80/0x170\n  driver_probe_device+0x1e/0x90\n  __device_attach_driver+0x7d/0x100\n  ? driver_allows_async_probing+0x60/0x60\n  ? driver_allows_async_probing+0x60/0x60\n  bus_for_each_drv+0x7b/0xc0\n  __device_attach+0xbc/0x200\n  bus_probe_device+0x87/0xa0\n  device_add+0x404/0x940\n  ? dev_set_name+0x53/0x70\n  __auxiliary_device_add+0x43/0x60\n  add_adev+0x99/0xe0 [mlx5_core]\n  mlx5_attach_device+0xc8/0x120 [mlx5_core]\n  mlx5_load_one_devl_locked+0xb2/0xe0 [mlx5_core]\n  devlink_reload+0x133/0x250\n  devlink_nl_cmd_reload+0x480/0x570\n  ? devlink_nl_pre_doit+0x44/0x2b0\n  genl_family_rcv_msg_doit.isra.0+0xc2/0x110\n  genl_rcv_msg+0x180/0x2b0\n  ? devlink_nl_cmd_region_read_dumpit+0x540/0x540\n  ? devlink_reload+0x250/0x250\n  ? devlink_put+0x50/0x50\n  ? genl_family_rcv_msg_doit.isra.0+0x110/0x110\n  netlink_rcv_skb+0x54/0x100\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x1f6/0x2c0\n  netlink_sendmsg+0x237/0x490\n  sock_sendmsg+0x33/0x40\n  __sys_sendto+0x103/0x160\n  ? handle_mm_fault+0x10e/0x290\n  ? do_user_addr_fault+0x1c0/0x5f0\n  __x64_sys_sendto+0x25/0x30\n  do_syscall_64+0x3d/0x90\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nFix it by setting port_num to 1 in order to get device status and remove\nunused variable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f41cc15e-6752-4a62-b540-adebfef0073d",
      "id": "CVE-2021-47458",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: mount fails with buffer overflow in strlen\n\nStarting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an\nocfs2 filesystem with either o2cb or pcmk cluster stack fails with the\ntrace below.  Problem seems to be that strings for cluster stack and\ncluster name are not guaranteed to be null terminated in the disk\nrepresentation, while strlcpy assumes that the source string is always\nnull terminated.  This causes a read outside of the source string\ntriggering the buffer overflow detection.\n\n  detected buffer overflow in strlen\n  ------------[ cut here ]------------\n  kernel BUG at lib/string.c:1149!\n  invalid opcode: 0000 [#1] SMP PTI\n  CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1\n    Debian 5.14.6-2\n  RIP: 0010:fortify_panic+0xf/0x11\n  ...\n  Call Trace:\n   ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2]\n   ocfs2_fill_super+0x359/0x19b0 [ocfs2]\n   mount_bdev+0x185/0x1b0\n   legacy_get_tree+0x27/0x40\n   vfs_get_tree+0x25/0xb0\n   path_mount+0x454/0xa20\n   __x64_sys_mount+0x103/0x140\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d29d6c62-0b75-4ed6-beee-5992dbc2eb33",
      "id": "CVE-2021-47482",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: batman-adv: fix error handling\n\nSyzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was\nin wrong error handling in batadv_mesh_init().\n\nBefore this patch batadv_mesh_init() was calling batadv_mesh_free() in case\nof any batadv_*_init() calls failure. This approach may work well, when\nthere is some kind of indicator, which can tell which parts of batadv are\ninitialized; but there isn't any.\n\nAll written above lead to cleaning up uninitialized fields. Even if we hide\nODEBUG warning by initializing bat_priv-\u003enc.work, syzbot was able to hit\nGPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]\n\nTo fix these bugs we can unwind batadv_*_init() calls one by one.\nIt is good approach for 2 reasons: 1) It fixes bugs on error handling\npath 2) It improves the performance, since we won't call unneeded\nbatadv_*_free() functions.\n\nSo, this patch makes all batadv_*_init() clean up all allocated memory\nbefore returning with an error to no call correspoing batadv_*_free()\nand open-codes batadv_mesh_free() with proper order to avoid touching\nuninitialized fields.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6087dfed-7e76-4ced-ae84-48ee8c48d63f",
      "id": "CVE-2021-47668",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_restart: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the netif_rx_ni() in:\n      stats-\u003erx_bytes += cf-\u003elen;\n\nReordering the lines solves the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b185513-16eb-4f08-97e1-0be97cb403ec",
      "id": "CVE-2022-1116",
      "description": "Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45e8ad66-5fcb-4e44-8c8e-f93d371e9bf2",
      "id": "CVE-2022-3623",
      "description": "A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assigned to this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d75ff1e-4d62-4c94-a2b3-0f527b715d23",
      "id": "CVE-2022-48664",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix hang during unmount when stopping a space reclaim worker\n\nOften when running generic/562 from fstests we can hang during unmount,\nresulting in a trace like this:\n\n  Sep 07 11:52:00 debian9 unknown: run fstests generic/562 at 2022-09-07 11:52:00\n  Sep 07 11:55:32 debian9 kernel: INFO: task umount:49438 blocked for more than 120 seconds.\n  Sep 07 11:55:32 debian9 kernel:       Not tainted 6.0.0-rc2-btrfs-next-122 #1\n  Sep 07 11:55:32 debian9 kernel: \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  Sep 07 11:55:32 debian9 kernel: task:umount          state:D stack:    0 pid:49438 ppid: 25683 flags:0x00004000\n  Sep 07 11:55:32 debian9 kernel: Call Trace:\n  Sep 07 11:55:32 debian9 kernel:  \u003cTASK\u003e\n  Sep 07 11:55:32 debian9 kernel:  __schedule+0x3c8/0xec0\n  Sep 07 11:55:32 debian9 kernel:  ? rcu_read_lock_sched_held+0x12/0x70\n  Sep 07 11:55:32 debian9 kernel:  schedule+0x5d/0xf0\n  Sep 07 11:55:32 debian9 kernel:  schedule_timeout+0xf1/0x130\n  Sep 07 11:55:32 debian9 kernel:  ? lock_release+0x224/0x4a0\n  Sep 07 11:55:32 debian9 kernel:  ? lock_acquired+0x1a0/0x420\n  Sep 07 11:55:32 debian9 kernel:  ? trace_hardirqs_on+0x2c/0xd0\n  Sep 07 11:55:32 debian9 kernel:  __wait_for_common+0xac/0x200\n  Sep 07 11:55:32 debian9 kernel:  ? usleep_range_state+0xb0/0xb0\n  Sep 07 11:55:32 debian9 kernel:  __flush_work+0x26d/0x530\n  Sep 07 11:55:32 debian9 kernel:  ? flush_workqueue_prep_pwqs+0x140/0x140\n  Sep 07 11:55:32 debian9 kernel:  ? trace_clock_local+0xc/0x30\n  Sep 07 11:55:32 debian9 kernel:  __cancel_work_timer+0x11f/0x1b0\n  Sep 07 11:55:32 debian9 kernel:  ? close_ctree+0x12b/0x5b3 [btrfs]\n  Sep 07 11:55:32 debian9 kernel:  ? __trace_bputs+0x10b/0x170\n  Sep 07 11:55:32 debian9 kernel:  close_ctree+0x152/0x5b3 [btrfs]\n  Sep 07 11:55:32 debian9 kernel:  ? evict_inodes+0x166/0x1c0\n  Sep 07 11:55:32 debian9 kernel:  generic_shutdown_super+0x71/0x120\n  Sep 07 11:55:32 debian9 kernel:  kill_anon_super+0x14/0x30\n  Sep 07 11:55:32 debian9 kernel:  btrfs_kill_super+0x12/0x20 [btrfs]\n  Sep 07 11:55:32 debian9 kernel:  deactivate_locked_super+0x2e/0xa0\n  Sep 07 11:55:32 debian9 kernel:  cleanup_mnt+0x100/0x160\n  Sep 07 11:55:32 debian9 kernel:  task_work_run+0x59/0xa0\n  Sep 07 11:55:32 debian9 kernel:  exit_to_user_mode_prepare+0x1a6/0x1b0\n  Sep 07 11:55:32 debian9 kernel:  syscall_exit_to_user_mode+0x16/0x40\n  Sep 07 11:55:32 debian9 kernel:  do_syscall_64+0x48/0x90\n  Sep 07 11:55:32 debian9 kernel:  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  Sep 07 11:55:32 debian9 kernel: RIP: 0033:0x7fcde59a57a7\n  Sep 07 11:55:32 debian9 kernel: RSP: 002b:00007ffe914217c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\n  Sep 07 11:55:32 debian9 kernel: RAX: 0000000000000000 RBX: 00007fcde5ae8264 RCX: 00007fcde59a57a7\n  Sep 07 11:55:32 debian9 kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000055b57556cdd0\n  Sep 07 11:55:32 debian9 kernel: RBP: 000055b57556cba0 R08: 0000000000000000 R09: 00007ffe91420570\n  Sep 07 11:55:32 debian9 kernel: R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n  Sep 07 11:55:32 debian9 kernel: R13: 000055b57556cdd0 R14: 000055b57556ccb8 R15: 0000000000000000\n  Sep 07 11:55:32 debian9 kernel:  \u003c/TASK\u003e\n\nWhat happens is the following:\n\n1) The cleaner kthread tries to start a transaction to delete an unused\n   block group, but the metadata reservation can not be satisfied right\n   away, so a reservation ticket is created and it starts the async\n   metadata reclaim task (fs_info-\u003easync_reclaim_work);\n\n2) Writeback for all the filler inodes with an i_size of 2K starts\n   (generic/562 creates a lot of 2K files with the goal of filling\n   metadata space). We try to create an inline extent for them, but we\n   fail when trying to insert the inline extent with -ENOSPC (at\n   cow_file_range_inline()) - since this is not critical, we fallback\n   to non-inline mode (back to cow_file_range()), reserve extents\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc1a0c05-1486-4522-b0e9-84aa3e492454",
      "id": "CVE-2022-48697",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix a use-after-free\n\nFix the following use-after-free complaint triggered by blktests nvme/004:\n\nBUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350\nRead of size 4 at addr 0000607bd1835943 by task kworker/13:1/460\nWorkqueue: nvmet-wq nvme_loop_execute_work [nvme_loop]\nCall Trace:\n show_stack+0x52/0x58\n dump_stack_lvl+0x49/0x5e\n print_report.cold+0x36/0x1e2\n kasan_report+0xb9/0xf0\n __asan_load4+0x6b/0x80\n blk_mq_complete_request_remote+0xac/0x350\n nvme_loop_queue_response+0x1df/0x275 [nvme_loop]\n __nvmet_req_complete+0x132/0x4f0 [nvmet]\n nvmet_req_complete+0x15/0x40 [nvmet]\n nvmet_execute_io_connect+0x18a/0x1f0 [nvmet]\n nvme_loop_execute_work+0x20/0x30 [nvme_loop]\n process_one_work+0x56e/0xa70\n worker_thread+0x2d1/0x640\n kthread+0x183/0x1c0\n ret_from_fork+0x1f/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34b9d619-096b-46ed-9fea-b8775bc266f4",
      "id": "CVE-2022-48741",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix NULL pointer dereference in copy up warning\n\nThis patch is fixing a NULL pointer dereference to get a recently\nintroduced warning message working.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "420020a1-cee1-46f0-b521-40a3e170d620",
      "id": "CVE-2022-48791",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted TMF sas_task\n\nCurrently a use-after-free may occur if a TMF sas_task is aborted before we\nhandle the IO completion in mpi_ssp_completion(). The abort occurs due to\ntimeout.\n\nWhen the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the\nsas_task is freed in pm8001_exec_internal_tmf_task().\n\nHowever, if the I/O completion occurs later, the I/O completion still\nthinks that the sas_task is available. Fix this by clearing the ccb-\u003etask\nif the TMF times out - the I/O completion handler does nothing if this\npointer is cleared.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1808b61e-be02-46ed-905a-a2ae920b9c95",
      "id": "CVE-2022-48943",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: make apf token non-zero to fix bug\n\nIn current async pagefault logic, when a page is ready, KVM relies on\nkvm_arch_can_dequeue_async_page_present() to determine whether to deliver\na READY event to the Guest. This function test token value of struct\nkvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a\nREADY event is finished by Guest. If value is zero meaning that a READY\nevent is done, so the KVM can deliver another.\nBut the kvm_arch_setup_async_pf() may produce a valid token with zero\nvalue, which is confused with previous mention and may lead the loss of\nthis READY event.\n\nThis bug may cause task blocked forever in Guest:\n INFO: task stress:7532 blocked for more than 1254 seconds.\n       Not tainted 5.10.0 #16\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:stress          state:D stack:    0 pid: 7532 ppid:  1409\n flags:0x00000080\n Call Trace:\n  __schedule+0x1e7/0x650\n  schedule+0x46/0xb0\n  kvm_async_pf_task_wait_schedule+0xad/0xe0\n  ? exit_to_user_mode_prepare+0x60/0x70\n  __kvm_handle_async_pf+0x4f/0xb0\n  ? asm_exc_page_fault+0x8/0x30\n  exc_page_fault+0x6f/0x110\n  ? asm_exc_page_fault+0x8/0x30\n  asm_exc_page_fault+0x1e/0x30\n RIP: 0033:0x402d00\n RSP: 002b:00007ffd31912500 EFLAGS: 00010206\n RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0\n RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0\n RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086\n R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000\n R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96609ef4-cfb2-4e79-8047-bfdfd5545ddd",
      "id": "CVE-2022-48962",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: Fix potential use-after-free in hisi_femac_rx()\n\nThe skb is delivered to napi_gro_receive() which may free it, after\ncalling this, dereferencing skb may trigger use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "402df629-1646-4676-bcdf-2c39b434c9fb",
      "id": "CVE-2022-49027",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix error handling in iavf_init_module()\n\nThe iavf_init_module() won't destroy workqueue when pci_register_driver()\nfailed. Call destroy_workqueue() when pci_register_driver() failed to\nprevent the resource leak.\n\nSimilar to the handling of u132_hcd_init in commit f276e002793c\n(\"usb: u132-hcd: fix resource leak\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5c8e538-9ac8-45d3-b2f6-b3e48aa0ddd0",
      "id": "CVE-2022-49280",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: prevent underflow in nfssvc_decode_writeargs()\n\nSmatch complains:\n\n\tfs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs()\n\twarn: no lower bound on 'args-\u003elen'\n\nChange the type to unsigned to prevent this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99e3c9c5-9256-4c1f-ac7c-bc94bb86c79a",
      "id": "CVE-2022-49300",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between nbd_alloc_config() and module removal\n\nWhen nbd module is being removing, nbd_alloc_config() may be\ncalled concurrently by nbd_genl_connect(), although try_module_get()\nwill return false, but nbd_alloc_config() doesn't handle it.\n\nThe race may lead to the leak of nbd_config and its related\nresources (e.g, recv_workq) and oops in nbd_read_stat() due\nto the unload of nbd module as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  Oops: 0000 [#1] SMP PTI\n  CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  Workqueue: knbd16-recv recv_work [nbd]\n  RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]\n  Call Trace:\n   recv_work+0x3b/0xb0 [nbd]\n   process_one_work+0x1ed/0x390\n   worker_thread+0x4a/0x3d0\n   kthread+0x12a/0x150\n   ret_from_fork+0x22/0x30\n\nFixing it by checking the return value of try_module_get()\nin nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),\nassign nbd-\u003econfig only when nbd_alloc_config() succeeds to ensure\nthe value of nbd-\u003econfig is binary (valid or NULL).\n\nAlso adding a debug message to check the reference counter\nof nbd_config during module removal.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cce466d6-7055-4f64-a4ba-4de015a25f0c",
      "id": "CVE-2022-49312",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix a potential memory leak in r871xu_drv_init()\n\nIn r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory\nallocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not\nproperly released as there is no action will be performed by\nr8712_usb_dvobj_deinit().\nTo properly release it, we should call r8712_free_io_queue() in\nr8712_usb_dvobj_deinit().\n\nBesides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called\nby r871x_dev_unload() under condition `padapter-\u003ebup` and\nr8712_free_io_queue() is called by r8712_free_drv_sw().\nHowever, r8712_usb_dvobj_deinit() does not rely on `padapter-\u003ebup` and\ncalling r8712_free_io_queue() in r8712_free_drv_sw() is negative for\nbetter understading the code.\nSo I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove\nr8712_free_io_queue() from r8712_free_drv_sw().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c039d111-514a-4053-9f3b-7defff2364b1",
      "id": "CVE-2022-49521",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()\n\nIf no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a\nreceived frame, the frame is dropped and resources are leaked.\n\nFix by returning resources when discarding an unhandled frame type.  Update\nlpfc_fc_frame_check() handling of NOP basic link service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf0e6bba-6076-4bf8-9ed3-f91cf75f628b",
      "id": "CVE-2022-49525",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx25821: Fix the warning when removing the module\n\nWhen removing the module, we will get the following warning:\n\n[   14.746697] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'cx25821[1]'\n[   14.747449] WARNING: CPU: 4 PID: 368 at fs/proc/generic.c:717 remove_proc_entry+0x389/0x3f0\n[   14.751611] RIP: 0010:remove_proc_entry+0x389/0x3f0\n[   14.759589] Call Trace:\n[   14.759792]  \u003cTASK\u003e\n[   14.759975]  unregister_irq_proc+0x14c/0x170\n[   14.760340]  irq_free_descs+0x94/0xe0\n[   14.760640]  mp_unmap_irq+0xb6/0x100\n[   14.760937]  acpi_unregister_gsi_ioapic+0x27/0x40\n[   14.761334]  acpi_pci_irq_disable+0x1d3/0x320\n[   14.761688]  pci_disable_device+0x1ad/0x380\n[   14.762027]  ? _raw_spin_unlock_irqrestore+0x2d/0x60\n[   14.762442]  ? cx25821_shutdown+0x20/0x9f0 [cx25821]\n[   14.762848]  cx25821_finidev+0x48/0xc0 [cx25821]\n[   14.763242]  pci_device_remove+0x92/0x240\n\nFix this by freeing the irq before call pci_disable_device().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "817efcd3-f604-4590-88c9-673d4110d453",
      "id": "CVE-2022-49528",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: dw9714: Disable the regulator when the driver fails to probe\n\nWhen the driver fails to probe, we will get the following splat:\n\n[   59.305988] ------------[ cut here ]------------\n[   59.306417] WARNING: CPU: 2 PID: 395 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0\n[   59.310345] RIP: 0010:_regulator_put+0x3ec/0x4e0\n[   59.318362] Call Trace:\n[   59.318582]  \u003cTASK\u003e\n[   59.318765]  regulator_put+0x1f/0x30\n[   59.319058]  devres_release_group+0x319/0x3d0\n[   59.319420]  i2c_device_probe+0x766/0x940\n\nFix this by disabling the regulator in error handling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dfa81cac-cbb7-4416-8c90-3d3aa0f43f68",
      "id": "CVE-2022-49542",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg()\n\nIn an attempt to log message 0126 with LOG_TRACE_EVENT, the following hard\nlockup call trace hangs the system.\n\nCall Trace:\n _raw_spin_lock_irqsave+0x32/0x40\n lpfc_dmp_dbg.part.32+0x28/0x220 [lpfc]\n lpfc_cmpl_els_fdisc+0x145/0x460 [lpfc]\n lpfc_sli_cancel_jobs+0x92/0xd0 [lpfc]\n lpfc_els_flush_cmd+0x43c/0x670 [lpfc]\n lpfc_els_flush_all_cmd+0x37/0x60 [lpfc]\n lpfc_sli4_async_event_proc+0x956/0x1720 [lpfc]\n lpfc_do_work+0x1485/0x1d70 [lpfc]\n kthread+0x112/0x130\n ret_from_fork+0x1f/0x40\nKernel panic - not syncing: Hard LOCKUP\n\nThe same CPU tries to claim the phba-\u003eport_list_lock twice.\n\nMove the cfg_log_verbose checks as part of the lpfc_printf_vlog() and\nlpfc_printf_log() macros before calling lpfc_dmp_dbg().  There is no need\nto take the phba-\u003eport_list_lock within lpfc_dmp_dbg().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ac9cfd7-074a-4a24-8bcb-4d72aff1b26b",
      "id": "CVE-2022-49580",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.\n\nWhile reading sysctl_fib_multipath_use_neigh, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0790200e-5ba5-4449-9e95-d428eeca59d7",
      "id": "CVE-2022-49625",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix kernel panic when creating VF\n\nWhen creating VFs a kernel panic can happen when calling to\nefx_ef10_try_update_nic_stats_vf.\n\nWhen releasing a DMA coherent buffer, sometimes, I don't know in what\nspecific circumstances, it has to unmap memory with vunmap. It is\ndisallowed to do that in IRQ context or with BH disabled. Otherwise, we\nhit this line in vunmap, causing the crash:\n  BUG_ON(in_interrupt());\n\nThis patch reenables BH to release the buffer.\n\nLog messages when the bug is hit:\n kernel BUG at mm/vmalloc.c:2727!\n invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G          I      --------- ---  5.14.0-119.el9.x86_64 #1\n Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020\n RIP: 0010:vunmap+0x2e/0x30\n ...skip...\n Call Trace:\n  __iommu_dma_free+0x96/0x100\n  efx_nic_free_buffer+0x2b/0x40 [sfc]\n  efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc]\n  efx_ef10_update_stats_vf+0x18/0x40 [sfc]\n  efx_start_all+0x15e/0x1d0 [sfc]\n  efx_net_open+0x5a/0xe0 [sfc]\n  __dev_open+0xe7/0x1a0\n  __dev_change_flags+0x1d7/0x240\n  dev_change_flags+0x21/0x60\n  ...skip...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d54c11b2-3046-4503-944a-236639c29355",
      "id": "CVE-2022-49641",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Fix data races in proc_douintvec().\n\nA sysctl variable is accessed concurrently, and there is always a chance\nof data-race.  So, all readers and writers need some basic protection to\navoid load/store-tearing.\n\nThis patch changes proc_douintvec() to use READ_ONCE() and WRITE_ONCE()\ninternally to fix data-races on the sysctl side.  For now, proc_douintvec()\nitself is tolerant to a data-race, but we still need to add annotations on\nthe other subsystem's side.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef0059be-506e-4200-9508-3c4c24285a7c",
      "id": "CVE-2022-49693",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf\n\nof_graph_get_remote_node() returns remote device node pointer with\nrefcount incremented, we should use of_node_put() on it\nwhen not need anymore.\nAdd missing of_node_put() to avoid refcount leak.\n\nPatchwork: https://patchwork.freedesktop.org/patch/488473/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc85195c-6164-49bd-90c8-f1569b3966c4",
      "id": "CVE-2024-50246",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add rough attr alloc_size check",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7de7cf48-ca62-4e03-9680-65d229ae1dac",
      "id": "CVE-2022-49710",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror log: round up region bitmap size to BITS_PER_LONG\n\nThe code in dm-log rounds up bitset_size to 32 bits. It then uses\nfind_next_zero_bit_le on the allocated region. find_next_zero_bit_le\naccesses the bitmap using unsigned long pointers. So, on 64-bit\narchitectures, it may access 4 bytes beyond the allocated size.\n\nFix this bug by rounding up bitset_size to BITS_PER_LONG.\n\nThis bug was found by running the lvm2 testsuite with kasan.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f6c26680-894f-4403-b81e-68aa012b69fc",
      "id": "CVE-2022-49746",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init\n\nIf the function sdma_load_context() fails, the sdma_desc will be\nfreed, but the allocated desc-\u003ebd is forgot to be freed.\n\nWe already met the sdma_load_context() failure case and the log as\nbelow:\n[ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready\n...\n\nIn this case, the desc-\u003ebd will not be freed without this change.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39ccba4c-f82c-411e-82c3-efef93b7e6d1",
      "id": "CVE-2022-49776",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: enforce a consistent minimal mtu\n\nmacvlan should enforce a minimal mtu of 68, even at link creation.\n\nThis patch avoids the current behavior (which could lead to crashes\nin ipv6 stack if the link is brought up)\n\n$ ip link add macvlan1 link eno1 mtu 8 type macvlan  # This should fail !\n$ ip link sh dev macvlan1\n5: macvlan1@eno1: \u003cBROADCAST,MULTICAST\u003e mtu 8 qdisc noop\n    state DOWN mode DEFAULT group default qlen 1000\n    link/ether 02:47:6c:24:74:82 brd ff:ff:ff:ff:ff:ff\n$ ip link set macvlan1 mtu 67\nError: mtu less than device minimum.\n$ ip link set macvlan1 mtu 68\n$ ip link set macvlan1 mtu 8\nError: mtu less than device minimum.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd86206e-9d85-4cce-97fe-bcf8ec9d13d6",
      "id": "CVE-2022-49787",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()\n\npci_get_device() will increase the reference count for the returned\npci_dev. We need to use pci_dev_put() to decrease the reference count\nbefore amd_probe() returns. There is no problem for the 'smbus_dev ==\nNULL' branch because pci_dev_put() can also handle the NULL input\nparameter case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe427fac-7277-463d-a08b-ff1bfacb367a",
      "id": "CVE-2023-22996",
      "description": "In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e884d0a-5d73-47f3-bca2-064d1d877c57",
      "id": "CVE-2022-49912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix ulist leaks in error paths of qgroup self tests\n\nIn the test_no_shared_qgroup() and test_multiple_refs() qgroup self tests,\nif we fail to add the tree ref, remove the extent item or remove the\nextent ref, we are returning from the test function without freeing the\n\"old_roots\" ulist that was allocated by the previous calls to\nbtrfs_find_all_roots(). Fix that by calling ulist_free() before returning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "563eb4cd-44dd-4ce1-994b-0cf038753419",
      "id": "CVE-2023-3111",
      "description": "A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69f320c6-241a-45bc-8968-23b7b45e3048",
      "id": "CVE-2022-49978",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fb_pm2fb: Avoid potential divide by zero error\n\nIn `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be\ncopied from user, then go through `fb_set_var()` and\n`info-\u003efbops-\u003efb_check_var()` which could may be `pm2fb_check_var()`.\nAlong the path, `var-\u003epixclock` won't be modified. This function checks\nwhether reciprocal of `var-\u003epixclock` is too high. If `var-\u003epixclock` is\nzero, there will be a divide by zero error. So, it is necessary to check\nwhether denominator is zero to avoid crash. As this bug is found by\nSyzkaller, logs are listed below.\n\ndivide error in pm2fb_check_var\nCall Trace:\n \u003cTASK\u003e\n fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015\n do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110\n fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2332eef9-6952-41c6-9dd1-5b8fdea6d5a4",
      "id": "CVE-2022-50033",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: ohci-ppc-of: Fix refcount leak bug\n\nIn ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return\na node pointer with refcount incremented. We should use of_node_put()\nwhen it is not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46889c21-8296-4444-82b9-769cde704d94",
      "id": "CVE-2022-50053",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix reset error handling\n\nDo not call iavf_close in iavf_reset_task error handling. Doing so can\nlead to double call of napi_disable, which can lead to deadlock there.\nRemoving VF would lead to iavf_remove task being stuck, because it\nrequires crit_lock, which is held by iavf_close.\nCall iavf_disable_vf if reset fail, so that driver will clean up\nremaining invalid resources.\nDuring rapid VF resets, HW can fail to setup VF mailbox. Wrong\nerror handling can lead to iavf_remove being stuck with:\n[ 5218.999087] iavf 0000:82:01.0: Failed to init adminq: -53\n...\n[ 5267.189211] INFO: task repro.sh:11219 blocked for more than 30 seconds.\n[ 5267.189520]       Tainted: G S          E     5.18.0-04958-ga54ce3703613-dirty #1\n[ 5267.189764] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 5267.190062] task:repro.sh        state:D stack:    0 pid:11219 ppid:  8162 flags:0x00000000\n[ 5267.190347] Call Trace:\n[ 5267.190647]  \u003cTASK\u003e\n[ 5267.190927]  __schedule+0x460/0x9f0\n[ 5267.191264]  schedule+0x44/0xb0\n[ 5267.191563]  schedule_preempt_disabled+0x14/0x20\n[ 5267.191890]  __mutex_lock.isra.12+0x6e3/0xac0\n[ 5267.192237]  ? iavf_remove+0xf9/0x6c0 [iavf]\n[ 5267.192565]  iavf_remove+0x12a/0x6c0 [iavf]\n[ 5267.192911]  ? _raw_spin_unlock_irqrestore+0x1e/0x40\n[ 5267.193285]  pci_device_remove+0x36/0xb0\n[ 5267.193619]  device_release_driver_internal+0xc1/0x150\n[ 5267.193974]  pci_stop_bus_device+0x69/0x90\n[ 5267.194361]  pci_stop_and_remove_bus_device+0xe/0x20\n[ 5267.194735]  pci_iov_remove_virtfn+0xba/0x120\n[ 5267.195130]  sriov_disable+0x2f/0xe0\n[ 5267.195506]  ice_free_vfs+0x7d/0x2f0 [ice]\n[ 5267.196056]  ? pci_get_device+0x4f/0x70\n[ 5267.196496]  ice_sriov_configure+0x78/0x1a0 [ice]\n[ 5267.196995]  sriov_numvfs_store+0xfe/0x140\n[ 5267.197466]  kernfs_fop_write_iter+0x12e/0x1c0\n[ 5267.197918]  new_sync_write+0x10c/0x190\n[ 5267.198404]  vfs_write+0x24e/0x2d0\n[ 5267.198886]  ksys_write+0x5c/0xd0\n[ 5267.199367]  do_syscall_64+0x3a/0x80\n[ 5267.199827]  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n[ 5267.200317] RIP: 0033:0x7f5b381205c8\n[ 5267.200814] RSP: 002b:00007fff8c7e8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 5267.201981] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5b381205c8\n[ 5267.202620] RDX: 0000000000000002 RSI: 00005569420ee900 RDI: 0000000000000001\n[ 5267.203426] RBP: 00005569420ee900 R08: 000000000000000a R09: 00007f5b38180820\n[ 5267.204327] R10: 000000000000000a R11: 0000000000000246 R12: 00007f5b383c06e0\n[ 5267.205193] R13: 0000000000000002 R14: 00007f5b383bb880 R15: 0000000000000002\n[ 5267.206041]  \u003c/TASK\u003e\n[ 5267.206970] Kernel panic - not syncing: hung_task: blocked tasks\n[ 5267.207809] CPU: 48 PID: 551 Comm: khungtaskd Kdump: loaded Tainted: G S          E     5.18.0-04958-ga54ce3703613-dirty #1\n[ 5267.208726] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.11.0 11/02/2019\n[ 5267.209623] Call Trace:\n[ 5267.210569]  \u003cTASK\u003e\n[ 5267.211480]  dump_stack_lvl+0x33/0x42\n[ 5267.212472]  panic+0x107/0x294\n[ 5267.213467]  watchdog.cold.8+0xc/0xbb\n[ 5267.214413]  ? proc_dohung_task_timeout_secs+0x30/0x30\n[ 5267.215511]  kthread+0xf4/0x120\n[ 5267.216459]  ? kthread_complete_and_exit+0x20/0x20\n[ 5267.217505]  ret_from_fork+0x22/0x30\n[ 5267.218459]  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7b425da-710b-4ade-a3f0-e74edee759bc",
      "id": "CVE-2022-50093",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)\n\nKASAN reports:\n\n[ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)\n[    4.676149][    T0] Read of size 8 at addr 1fffffff85115558 by task swapper/0/0\n[    4.683454][    T0]\n[    4.685638][    T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc3-00004-g0e862838f290 #1\n[    4.694331][    T0] Hardware name: Supermicro SYS-5018D-FN4T/X10SDV-8C-TLN4F, BIOS 1.1 03/02/2016\n[    4.703196][    T0] Call Trace:\n[    4.706334][    T0]  \u003cTASK\u003e\n[ 4.709133][ T0] ? dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)\n\nafter converting the type of the first argument (@nr, bit number)\nof arch_test_bit() from `long` to `unsigned long`[0].\n\nUnder certain conditions (for example, when ACPI NUMA is disabled\nvia command line), pxm_to_node() can return %NUMA_NO_NODE (-1).\nIt is valid 'magic' number of NUMA node, but not valid bit number\nto use in bitops.\nnode_online() eventually descends to test_bit() without checking\nfor the input, assuming it's on caller side (which might be good\nfor perf-critical tasks). There, -1 becomes %ULONG_MAX which leads\nto an insane array index when calculating bit position in memory.\n\nFor now, add an explicit check for @node being not %NUMA_NO_NODE\nbefore calling test_bit(). The actual logics didn't change here\nat all.\n\n[0] https://github.com/norov/linux/commit/0e862838f290147ea9c16db852d8d494b552d38d",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10227839-b468-47c2-b816-f6928046e484",
      "id": "CVE-2024-57834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread\n\nsyzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1]\n\nIf dvb-\u003emux is not initialized successfully by vidtv_mux_init() in the\nvidtv_start_streaming(), it will trigger null pointer dereference about mux\nin vidtv_mux_stop_thread().\n\nAdjust the timing of streaming initialization and check it before\nstopping it.\n\n[1]\nKASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]\nCPU: 0 UID: 0 PID: 5842 Comm: syz-executor248 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nRIP: 0010:vidtv_mux_stop_thread+0x26/0x80 drivers/media/test-drivers/vidtv/vidtv_mux.c:471\nCode: 90 90 90 90 66 0f 1f 00 55 53 48 89 fb e8 82 2e c8 f9 48 8d bb 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 02 7e 3b 0f b6 ab 28 01 00 00 31 ff 89 ee e8\nRSP: 0018:ffffc90003f2faa8 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cfb125\nRDX: 0000000000000025 RSI: ffffffff87d120ce RDI: 0000000000000128\nRBP: ffff888029b8d220 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000003 R12: ffff888029b8d188\nR13: ffffffff8f590aa0 R14: ffffc9000581c5c8 R15: ffff888029a17710\nFS:  00007f7eef5156c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7eef5e635c CR3: 0000000076ca6000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n vidtv_stop_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:209 [inline]\n vidtv_stop_feed+0x151/0x250 drivers/media/test-drivers/vidtv/vidtv_bridge.c:252\n dmx_section_feed_stop_filtering+0x90/0x160 drivers/media/dvb-core/dvb_demux.c:1000\n dvb_dmxdev_feed_stop.isra.0+0x1ee/0x270 drivers/media/dvb-core/dmxdev.c:486\n dvb_dmxdev_filter_stop+0x22a/0x3a0 drivers/media/dvb-core/dmxdev.c:559\n dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline]\n dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246\n __fput+0x3f8/0xb60 fs/file_table.c:450\n task_work_run+0x14e/0x250 kernel/task_work.c:239\n get_signal+0x1d3/0x2610 kernel/signal.c:2790\n arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337\n exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218\n do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bbb09351-a3fb-404d-928c-9bb086ca1dc2",
      "id": "CVE-2022-50152",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54d94856-a5af-433a-9d17-232d17d5986f",
      "id": "CVE-2022-50271",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost/vsock: Use kvmalloc/kvfree for larger packets.\n\nWhen copying a large file over sftp over vsock, data size is usually 32kB,\nand kmalloc seems to fail to try to allocate 32 32kB regions.\n\n vhost-5837: page allocation failure: order:4, mode:0x24040c0\n Call Trace:\n  [\u003cffffffffb6a0df64\u003e] dump_stack+0x97/0xdb\n  [\u003cffffffffb68d6aed\u003e] warn_alloc_failed+0x10f/0x138\n  [\u003cffffffffb68d868a\u003e] ? __alloc_pages_direct_compact+0x38/0xc8\n  [\u003cffffffffb664619f\u003e] __alloc_pages_nodemask+0x84c/0x90d\n  [\u003cffffffffb6646e56\u003e] alloc_kmem_pages+0x17/0x19\n  [\u003cffffffffb6653a26\u003e] kmalloc_order_trace+0x2b/0xdb\n  [\u003cffffffffb66682f3\u003e] __kmalloc+0x177/0x1f7\n  [\u003cffffffffb66e0d94\u003e] ? copy_from_iter+0x8d/0x31d\n  [\u003cffffffffc0689ab7\u003e] vhost_vsock_handle_tx_kick+0x1fa/0x301 [vhost_vsock]\n  [\u003cffffffffc06828d9\u003e] vhost_worker+0xf7/0x157 [vhost]\n  [\u003cffffffffb683ddce\u003e] kthread+0xfd/0x105\n  [\u003cffffffffc06827e2\u003e] ? vhost_dev_set_owner+0x22e/0x22e [vhost]\n  [\u003cffffffffb683dcd1\u003e] ? flush_kthread_worker+0xf3/0xf3\n  [\u003cffffffffb6eb332e\u003e] ret_from_fork+0x4e/0x80\n  [\u003cffffffffb683dcd1\u003e] ? flush_kthread_worker+0xf3/0xf3\n\nWork around by doing kvmalloc instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2be9e74e-667e-46a2-a8bc-9cc032d1c882",
      "id": "CVE-2023-33288",
      "description": "An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bf0567c-4ca4-499e-903f-4c95b002d761",
      "id": "CVE-2022-50303",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix double release compute pasid\n\nIf kfd_process_device_init_vm returns failure after vm is converted to\ncompute vm and vm-\u003epasid set to compute pasid, KFD will not take\npdd-\u003edrm_file reference. As a result, drm close file handler maybe\ncalled to release the compute pasid before KFD process destroy worker to\nrelease the same pasid and set vm-\u003epasid to zero, this generates below\nWARNING backtrace and NULL pointer access.\n\nAdd helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step\nof kfd_process_device_init_vm, to ensure vm pasid is the original pasid\nif acquiring vm failed or is the compute pasid with pdd-\u003edrm_file\nreference taken to avoid double release same pasid.\n\n amdgpu: Failed to create process VM object\n ida_free called for id=32770 which is not allocated.\n WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140\n RIP: 0010:ida_free+0x96/0x140\n Call Trace:\n  amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]\n  amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]\n  drm_file_free.part.13+0x216/0x270 [drm]\n  drm_close_helper.isra.14+0x60/0x70 [drm]\n  drm_release+0x6e/0xf0 [drm]\n  __fput+0xcc/0x280\n  ____fput+0xe/0x20\n  task_work_run+0x96/0xc0\n  do_exit+0x3d0/0xc10\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n RIP: 0010:ida_free+0x76/0x140\n Call Trace:\n  amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu]\n  amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu]\n  drm_file_free.part.13+0x216/0x270 [drm]\n  drm_close_helper.isra.14+0x60/0x70 [drm]\n  drm_release+0x6e/0xf0 [drm]\n  __fput+0xcc/0x280\n  ____fput+0xe/0x20\n  task_work_run+0x96/0xc0\n  do_exit+0x3d0/0xc10",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78aca15b-c875-4bab-817f-75fa81e50106",
      "id": "CVE-2022-50330",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium - prevent integer overflow loading firmware\n\nThe \"code_length\" value comes from the firmware file.  If your firmware\nis untrusted realistically there is probably very little you can do to\nprotect yourself.  Still we try to limit the damage as much as possible.\nAlso Smatch marks any data read from the filesystem as untrusted and\nprints warnings if it not capped correctly.\n\nThe \"ntohl(ucode-\u003ecode_length) * 2\" multiplication can have an\ninteger overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "548a5224-7dbb-4d78-b747-ca37d1b413ca",
      "id": "CVE-2023-0615",
      "description": "A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8480dd7e-6721-46e6-bfea-78d5b2a64722",
      "id": "CVE-2023-2124",
      "description": "An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65ef9938-ae14-46d0-b2e7-978d12c5cbdb",
      "id": "CVE-2023-52696",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/powernv: Add a null pointer check in opal_powercap_init()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14a6797a-544e-48d5-887f-9edbd4278b46",
      "id": "CVE-2023-52698",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: fix memory leak in netlbl_calipso_add_pass()\n\nIf IPv6 support is disabled at boot (ipv6.disable=1),\nthe calipso_init() -\u003e netlbl_calipso_ops_register() function isn't called,\nand the netlbl_calipso_ops_get() function always returns NULL.\nIn this case, the netlbl_calipso_add_pass() function allocates memory\nfor the doi_def variable but doesn't free it with the calipso_doi_free().\n\nBUG: memory leak\nunreferenced object 0xffff888011d68180 (size 64):\n  comm \"syz-executor.1\", pid 10746, jiffies 4295410986 (age 17.928s)\n  hex dump (first 32 bytes):\n    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c...\u003e] kmalloc include/linux/slab.h:552 [inline]\n    [\u003c...\u003e] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]\n    [\u003c...\u003e] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111\n    [\u003c...\u003e] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739\n    [\u003c...\u003e] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n    [\u003c...\u003e] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800\n    [\u003c...\u003e] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515\n    [\u003c...\u003e] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811\n    [\u003c...\u003e] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]\n    [\u003c...\u003e] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339\n    [\u003c...\u003e] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934\n    [\u003c...\u003e] sock_sendmsg_nosec net/socket.c:651 [inline]\n    [\u003c...\u003e] sock_sendmsg+0x157/0x190 net/socket.c:671\n    [\u003c...\u003e] ____sys_sendmsg+0x712/0x870 net/socket.c:2342\n    [\u003c...\u003e] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396\n    [\u003c...\u003e] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429\n    [\u003c...\u003e] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n    [\u003c...\u003e] entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller\n\n[PM: merged via the LSM tree at Jakub Kicinski request]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6fa6d3f-dba0-4664-b835-f09554cc56fe",
      "id": "CVE-2023-52774",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: protect device queue against concurrent access\n\nIn dasd_profile_start() the amount of requests on the device queue are\ncounted. The access to the device queue is unprotected against\nconcurrent access. With a lot of parallel I/O, especially with alias\ndevices enabled, the device queue can change while dasd_profile_start()\nis accessing the queue. In the worst case this leads to a kernel panic\ndue to incorrect pointer accesses.\n\nFix this by taking the device lock before accessing the queue and\ncounting the requests. Additionally the check for a valid profile data\npointer can be done earlier to avoid unnecessary locking in a hot path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5843c4f6-352a-48ca-9c33-631c5f10d2b6",
      "id": "CVE-2023-52900",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix general protection fault in nilfs_btree_insert()\n\nIf nilfs2 reads a corrupted disk image and tries to reads a b-tree node\nblock by calling __nilfs_btree_get_block() against an invalid virtual\nblock address, it returns -ENOENT because conversion of the virtual block\naddress to a disk block address fails.  However, this return value is the\nsame as the internal code that b-tree lookup routines return to indicate\nthat the block being searched does not exist, so functions that operate on\nthat b-tree may misbehave.\n\nWhen nilfs_btree_insert() receives this spurious 'not found' code from\nnilfs_btree_do_lookup(), it misunderstands that the 'not found' check was\nsuccessful and continues the insert operation using incomplete lookup path\ndata, causing the following crash:\n\n general protection fault, probably for non-canonical address\n 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n ...\n RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline]\n RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline]\n RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238\n Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89\n ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 \u003c42\u003e 80 3c\n 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02\n ...\n Call Trace:\n \u003cTASK\u003e\n  nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline]\n  nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147\n  nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101\n  __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991\n  __block_write_begin fs/buffer.c:2041 [inline]\n  block_write_begin+0x93/0x1e0 fs/buffer.c:2102\n  nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261\n  generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772\n  __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900\n  generic_file_write_iter+0xab/0x310 mm/filemap.c:3932\n  call_write_iter include/linux/fs.h:2186 [inline]\n  new_sync_write fs/read_write.c:491 [inline]\n  vfs_write+0x7dc/0xc50 fs/read_write.c:584\n  ksys_write+0x177/0x2a0 fs/read_write.c:637\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n ...\n \u003c/TASK\u003e\n\nThis patch fixes the root cause of this problem by replacing the error\ncode that __nilfs_btree_get_block() returns on block address conversion\nfailure from -ENOENT to another internal code -EINVAL which means that the\nb-tree metadata is corrupted.\n\nBy returning -EINVAL, it propagates without glitches, and for all relevant\nb-tree operations, functions in the upper bmap layer output an error\nmessage indicating corrupted b-tree metadata via\nnilfs_bmap_convert_error(), and code -EIO will be eventually returned as\nit should be.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc8d5069-1655-4f5b-8f5f-aa2900e4c0c2",
      "id": "CVE-2023-52907",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()\n\nFix a use-after-free that occurs in hcd when in_urb sent from\npn533_usb_send_frame() is completed earlier than out_urb. Its callback\nfrees the skb data in pn533_send_async_complete() that is used as a\ntransfer buffer of out_urb. Wait before sending in_urb until the\ncallback of out_urb is called. To modify the callback of out_urb alone,\nseparate the complete function of out_urb and ack_urb.\n\nFound by a modified version of syzkaller.\n\nBUG: KASAN: use-after-free in dummy_timer\nCall Trace:\n memcpy (mm/kasan/shadow.c:65)\n dummy_perform_transfer (drivers/usb/gadget/udc/dummy_hcd.c:1352)\n transfer (drivers/usb/gadget/udc/dummy_hcd.c:1453)\n dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:1972)\n arch_static_branch (arch/x86/include/asm/jump_label.h:27)\n static_key_false (include/linux/jump_label.h:207)\n timer_expire_exit (include/trace/events/timer.h:127)\n call_timer_fn (kernel/time/timer.c:1475)\n expire_timers (kernel/time/timer.c:1519)\n __run_timers (kernel/time/timer.c:1790)\n run_timer_softirq (kernel/time/timer.c:1803)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e3044a2-90a2-4923-b051-9f179d0c4263",
      "id": "CVE-2023-52919",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix possible NULL pointer dereference in send_acknowledge()\n\nHandle memory allocation failure from nci_skb_alloc() (calling\nalloc_skb()) to avoid possible NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5df710d9-e328-44ee-8377-e353bb59f555",
      "id": "CVE-2024-35830",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tc358743: register v4l2 async device only after successful setup\n\nEnsure the device has been setup correctly before registering the v4l2\nasync device, thus allowing userspace to access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5efb5279-8f85-40ac-ae89-93674455374e",
      "id": "CVE-2023-52924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: don't skip expired elements during walk\n\nThere is an asymmetry between commit/abort and preparation phase if the\nfollowing conditions are met:\n\n1. set is a verdict map (\"1.2.3.4 : jump foo\")\n2. timeouts are enabled\n\nIn this case, following sequence is problematic:\n\n1. element E in set S refers to chain C\n2. userspace requests removal of set S\n3. kernel does a set walk to decrement chain-\u003euse count for all elements\n   from preparation phase\n4. kernel does another set walk to remove elements from the commit phase\n   (or another walk to do a chain-\u003euse increment for all elements from\n    abort phase)\n\nIf E has already expired in 1), it will be ignored during list walk, so its use count\nwon't have been changed.\n\nThen, when set is culled, -\u003edestroy callback will zap the element via\nnf_tables_set_elem_destroy(), but this function is only safe for\nelements that have been deactivated earlier from the preparation phase:\nlack of earlier deactivate removes the element but leaks the chain use\ncount, which results in a WARN splat when the chain gets removed later,\nplus a leak of the nft_chain structure.\n\nUpdate pipapo_get() not to skip expired elements, otherwise flush\ncommand reports bogus ENOENT errors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d7d8994-cd82-44dd-a102-158d1c7a7ed0",
      "id": "CVE-2023-52935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: fix -\u003eanon_vma race\n\nIf an -\u003eanon_vma is attached to the VMA, collapse_and_free_pmd() requires\nit to be locked.\n\nPage table traversal is allowed under any one of the mmap lock, the\nanon_vma lock (if the VMA is associated with an anon_vma), and the\nmapping lock (if the VMA is associated with a mapping); and so to be\nable to remove page tables, we must hold all three of them. \nretract_page_tables() bails out if an -\u003eanon_vma is attached, but does\nthis check before holding the mmap lock (as the comment above the check\nexplains).\n\nIf we racily merged an existing -\u003eanon_vma (shared with a child\nprocess) from a neighboring VMA, subsequent rmap traversals on pages\nbelonging to the child will be able to see the page tables that we are\nconcurrently removing while assuming that nothing else can access them.\n\nRepeat the -\u003eanon_vma check once we hold the mmap lock to ensure that\nthere really is no concurrent page table access.\n\nHitting this bug causes a lockdep warning in collapse_and_free_pmd(),\nin the line \"lockdep_assert_held_write(\u0026vma-\u003eanon_vma-\u003eroot-\u003erwsem)\". \nIt can also lead to use-after-free access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3498ddc8-cb45-469e-a36a-e215ef4ebd7a",
      "id": "CVE-2023-53226",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix OOB and integer underflow when rx packets\n\nMake sure mwifiex_process_mgmt_packet,\nmwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,\nmwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet\nnot out-of-bounds access the skb-\u003edata buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a545165-9a47-4b90-bc58-880573d6f33c",
      "id": "CVE-2024-26636",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: make llc_ui_sendmsg() more robust against bonding changes\n\nsyzbot was able to trick llc_ui_sendmsg(), allocating an skb with no\nheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]\n\nLike some others, llc_ui_sendmsg() releases the socket lock before\ncalling sock_alloc_send_skb().\nThen it acquires it again, but does not redo all the sanity checks\nthat were performed.\n\nThis fix:\n\n- Uses LL_RESERVED_SPACE() to reserve space.\n- Check all conditions again after socket lock is held again.\n- Do not account Ethernet header for mtu limitation.\n\n[1]\n\nskbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0\n\n kernel BUG at net/core/skbuff.c:193 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : skb_panic net/core/skbuff.c:189 [inline]\n pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n lr : skb_panic net/core/skbuff.c:189 [inline]\n lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\nsp : ffff800096f97000\nx29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000\nx26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2\nx23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0\nx20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce\nx17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001\nx14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400\nx8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000\nx5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714\nx2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089\nCall trace:\n  skb_panic net/core/skbuff.c:189 [inline]\n  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n  skb_push+0xf0/0x108 net/core/skbuff.c:2451\n  eth_header+0x44/0x1f8 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3188 [inline]\n  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33\n  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209\n  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270\n  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_sendmsg+0x194/0x274 net/socket.c:767\n  splice_to_socket+0x7cc/0xd58 fs/splice.c:881\n  do_splice_from fs/splice.c:933 [inline]\n  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142\n  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088\n  do_splice_direct+0x20c/0x348 fs/splice.c:1194\n  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254\n  __do_sys_sendfile64 fs/read_write.c:1322 [inline]\n  __se_sys_sendfile64 fs/read_write.c:1308 [inline]\n  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308\n  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51\n  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136\n  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155\n  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595\nCode: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "974b8305-8748-40d2-9e26-a3129de64978",
      "id": "CVE-2024-26988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninit/main.c: Fix potential static_command_line memory overflow\n\nWe allocate memory of size 'xlen + strlen(boot_command_line) + 1' for\nstatic_command_line, but the strings copied into static_command_line are\nextra_command_line and command_line, rather than extra_command_line and\nboot_command_line.\n\nWhen strlen(command_line) \u003e strlen(boot_command_line), static_command_line\nwill overflow.\n\nThis patch just recovers strlen(command_line) which was miss-consolidated\nwith strlen(boot_command_line) in the commit f5c7310ac73e (\"init/main: add\nchecks for the return value of memblock_alloc*()\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "791a01fb-b610-4f0e-b2a4-2532ab3c8473",
      "id": "CVE-2024-35995",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Use access_width over bit_width for system memory accesses\n\nTo align with ACPI 6.3+, since bit_width can be any 8-bit value, it\ncannot be depended on to be always on a clean 8b boundary. This was\nuncovered on the Cobalt 100 platform.\n\nSError Interrupt on CPU26, code 0xbe000011 -- SError\n CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1\n Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION\n pstate: 62400009 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)\n pc : cppc_get_perf_caps+0xec/0x410\n lr : cppc_get_perf_caps+0xe8/0x410\n sp : ffff8000155ab730\n x29: ffff8000155ab730 x28: ffff0080139d0038 x27: ffff0080139d0078\n x26: 0000000000000000 x25: ffff0080139d0058 x24: 00000000ffffffff\n x23: ffff0080139d0298 x22: ffff0080139d0278 x21: 0000000000000000\n x20: ffff00802b251910 x19: ffff0080139d0000 x18: ffffffffffffffff\n x17: 0000000000000000 x16: ffffdc7e111bad04 x15: ffff00802b251008\n x14: ffffffffffffffff x13: ffff013f1fd63300 x12: 0000000000000006\n x11: ffffdc7e128f4420 x10: 0000000000000000 x9 : ffffdc7e111badec\n x8 : ffff00802b251980 x7 : 0000000000000000 x6 : ffff0080139d0028\n x5 : 0000000000000000 x4 : ffff0080139d0018 x3 : 00000000ffffffff\n x2 : 0000000000000008 x1 : ffff8000155ab7a0 x0 : 0000000000000000\n Kernel panic - not syncing: Asynchronous SError Interrupt\n CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted\n5.15.2.1-13 #1\n Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION\n Call trace:\n  dump_backtrace+0x0/0x1e0\n  show_stack+0x24/0x30\n  dump_stack_lvl+0x8c/0xb8\n  dump_stack+0x18/0x34\n  panic+0x16c/0x384\n  add_taint+0x0/0xc0\n  arm64_serror_panic+0x7c/0x90\n  arm64_is_fatal_ras_serror+0x34/0xa4\n  do_serror+0x50/0x6c\n  el1h_64_error_handler+0x40/0x74\n  el1h_64_error+0x7c/0x80\n  cppc_get_perf_caps+0xec/0x410\n  cppc_cpufreq_cpu_init+0x74/0x400 [cppc_cpufreq]\n  cpufreq_online+0x2dc/0xa30\n  cpufreq_add_dev+0xc0/0xd4\n  subsys_interface_register+0x134/0x14c\n  cpufreq_register_driver+0x1b0/0x354\n  cppc_cpufreq_init+0x1a8/0x1000 [cppc_cpufreq]\n  do_one_initcall+0x50/0x250\n  do_init_module+0x60/0x27c\n  load_module+0x2300/0x2570\n  __do_sys_finit_module+0xa8/0x114\n  __arm64_sys_finit_module+0x2c/0x3c\n  invoke_syscall+0x78/0x100\n  el0_svc_common.constprop.0+0x180/0x1a0\n  do_el0_svc+0x84/0xa0\n  el0_svc+0x2c/0xc0\n  el0t_64_sync_handler+0xa4/0x12c\n  el0t_64_sync+0x1a4/0x1a8\n\nInstead, use access_width to determine the size and use the offset and\nwidth to shift and mask the bits to read/write out. Make sure to add a\ncheck for system memory since pcc redefines the access_width to\nsubspace id.\n\nIf access_width is not set, then fall back to using bit_width.\n\n[ rjw: Subject and changelog edits, comment adjustments ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5773a49a-1fd4-4bcf-9b75-b5b7a77b8bc7",
      "id": "CVE-2024-36960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix invalid reads in fence signaled events\n\nCorrectly set the length of the drm_event to the size of the structure\nthat's actually used.\n\nThe length of the drm_event was set to the parent structure instead of\nto the drm_vmw_event_fence which is supposed to be read. drm_read\nuses the length parameter to copy the event to the user space thus\nresuling in oob reads.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0000cd7b-247b-4bb9-bc48-b7dfe683524d",
      "id": "CVE-2024-38581",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/mes: fix use-after-free issue\n\nDelete fence fallback timer to fix the ramdom\nuse-after-free issue.\n\nv2: move to amdgpu_mes.c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a355a41a-61b6-45bb-85b1-115896a990d9",
      "id": "CVE-2024-38591",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix deadlock on SRQ async events.\n\nxa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/\nxa_erase_irq() to avoid deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "693eb0a6-634e-4f20-b378-ee5bc8204ba2",
      "id": "CVE-2024-39472",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix log recovery buffer allocation for the legacy h_size fixup\n\nCommit a70f9fe52daa (\"xfs: detect and handle invalid iclog size set by\nmkfs\") added a fixup for incorrect h_size values used for the initial\numount record in old xfsprogs versions.  Later commit 0c771b99d6c9\n(\"xfs: clean up calculation of LR header blocks\") cleaned up the log\nreover buffer calculation, but stoped using the fixed up h_size value\nto size the log recovery buffer, which can lead to an out of bounds\naccess when the incorrect h_size does not come from the old mkfs\ntool, but a fuzzer.\n\nFix this by open coding xlog_logrec_hblks and taking the fixed h_size\ninto account for this calculation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92ab7026-4369-434c-ac5c-e63d0b3d111f",
      "id": "CVE-2024-39475",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: savage: Handle err return when savagefb_check_var failed\n\nThe commit 04e5eac8f3ab(\"fbdev: savage: Error out if pixclock equals zero\")\nchecks the value of pixclock to avoid divide-by-zero error. However\nthe function savagefb_probe doesn't handle the error return of\nsavagefb_check_var. When pixclock is 0, it will cause divide-by-zero error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b832eb4e-ab83-4ce2-a394-83b2d87c1a48",
      "id": "CVE-2024-41061",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport\n\n[Why]\nPotential out of bounds access in dml2_calculate_rq_and_dlg_params()\nbecause the value of out_lowest_state_idx used as an index for FCLKChangeSupport\narray can be greater than 1.\n\n[How]\nCurrently dml2 core specifies identical values for all FCLKChangeSupport\nelements. Always use index 0 in the condition to avoid out of bounds access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "abe14f12-eb64-4413-8f48-3d787931a092",
      "id": "CVE-2022-49715",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions\n\nof_find_node_by_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02aac0d0-0c65-4d97-8939-71f31268a3ec",
      "id": "CVE-2024-41080",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix possible deadlock in io_register_iowq_max_workers()\n\nThe io_register_iowq_max_workers() function calls io_put_sq_data(),\nwhich acquires the sqd-\u003elock without releasing the uring_lock.\nSimilar to the commit 009ad9f0c6ee (\"io_uring: drop ctx-\u003euring_lock\nbefore acquiring sqd-\u003elock\"), this can lead to a potential deadlock\nsituation.\n\nTo resolve this issue, the uring_lock is released before calling\nio_put_sq_data(), and then it is re-acquired after the function call.\n\nThis change ensures that the locks are acquired in the correct\norder, preventing the possibility of a deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6f465f2-b93d-4268-b167-fab56d641fe2",
      "id": "CVE-2024-42098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ecdh - explicitly zeroize private_key\n\nprivate_key is overwritten with the key parameter passed in by the\ncaller (if present), or alternatively a newly generated private key.\nHowever, it is possible that the caller provides a key (or the newly\ngenerated key) which is shorter than the previous key. In that\nscenario, some key material from the previous key would not be\noverwritten. The easiest solution is to explicitly zeroize the entire\nprivate_key array first.\n\nNote that this patch slightly changes the behavior of this function:\npreviously, if the ecc_gen_privkey failed, the old private_key would\nremain. Now, the private_key is always zeroized. This behavior is\nconsistent with the case where params.key is set and ecc_is_key_valid\nfails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "425ea8fe-dbe3-401a-99c8-c4dc50672682",
      "id": "CVE-2024-42313",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free in vdec_close\n\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\n\nFix it by cancelling the work in vdec_close.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "44d1c0a9-3387-45dd-baed-769d2228aeb9",
      "id": "CVE-2024-43900",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: xc2028: avoid use-after-free in load_firmware_cb()\n\nsyzkaller reported use-after-free in load_firmware_cb() [1].\nThe reason is because the module allocated a struct tuner in tuner_probe(),\nand then the module initialization failed, the struct tuner was released.\nA worker which created during module initialization accesses this struct\ntuner later, it caused use-after-free.\n\nThe process is as follows:\n\ntask-6504           worker_thread\ntuner_probe                             \u003c= alloc dvb_frontend [2]\n...\nrequest_firmware_nowait                 \u003c= create a worker\n...\ntuner_remove                            \u003c= free dvb_frontend\n...\n                    request_firmware_work_func  \u003c= the firmware is ready\n                    load_firmware_cb    \u003c= but now the dvb_frontend has been freed\n\nTo fix the issue, check the dvd_frontend in load_firmware_cb(), if it is\nnull, report a warning and just return.\n\n[1]:\n    ==================================================================\n     BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0\n     Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504\n\n     Call trace:\n      load_firmware_cb+0x1310/0x17a0\n      request_firmware_work_func+0x128/0x220\n      process_one_work+0x770/0x1824\n      worker_thread+0x488/0xea0\n      kthread+0x300/0x430\n      ret_from_fork+0x10/0x20\n\n     Allocated by task 6504:\n      kzalloc\n      tuner_probe+0xb0/0x1430\n      i2c_device_probe+0x92c/0xaf0\n      really_probe+0x678/0xcd0\n      driver_probe_device+0x280/0x370\n      __device_attach_driver+0x220/0x330\n      bus_for_each_drv+0x134/0x1c0\n      __device_attach+0x1f4/0x410\n      device_initial_probe+0x20/0x30\n      bus_probe_device+0x184/0x200\n      device_add+0x924/0x12c0\n      device_register+0x24/0x30\n      i2c_new_device+0x4e0/0xc44\n      v4l2_i2c_new_subdev_board+0xbc/0x290\n      v4l2_i2c_new_subdev+0xc8/0x104\n      em28xx_v4l2_init+0x1dd0/0x3770\n\n     Freed by task 6504:\n      kfree+0x238/0x4e4\n      tuner_remove+0x144/0x1c0\n      i2c_device_remove+0xc8/0x290\n      __device_release_driver+0x314/0x5fc\n      device_release_driver+0x30/0x44\n      bus_remove_device+0x244/0x490\n      device_del+0x350/0x900\n      device_unregister+0x28/0xd0\n      i2c_unregister_device+0x174/0x1d0\n      v4l2_device_unregister+0x224/0x380\n      em28xx_v4l2_init+0x1d90/0x3770\n\n     The buggy address belongs to the object at ffff8000d7ca2000\n      which belongs to the cache kmalloc-2k of size 2048\n     The buggy address is located 776 bytes inside of\n      2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)\n     The buggy address belongs to the page:\n     page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0\n     flags: 0x7ff800000000100(slab)\n     raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000\n     raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000\n     page dumped because: kasan: bad access detected\n\n     Memory state around the buggy address:\n      ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n      ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n     \u003effff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                           ^\n      ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n      ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n     ==================================================================\n\n[2]\n    Actually, it is allocated for struct tuner, and dvb_frontend is inside.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "235fb6be-7a0e-4870-9504-64baa03d3e5e",
      "id": "CVE-2024-44940",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: remove warn in gue_gro_receive on unsupported protocol\n\nDrop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is\nnot known or does not have a GRO handler.\n\nSuch a packet is easily constructed. Syzbot generates them and sets\noff this warning.\n\nRemove the warning as it is expected and not actionable.\n\nThe warning was previously reduced from WARN_ON to WARN_ON_ONCE in\ncommit 270136613bf7 (\"fou: Do WARN_ON_ONCE in gue_gro_receive for bad\nproto callbacks\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bf81775-1fcb-4db4-9091-cdcdc8d85194",
      "id": "CVE-2024-49900",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of new_ea in ea_buffer\n\nsyzbot reports that lzo1x_1_do_compress is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178\n\n...\n\nUninit was stored to memory at:\n ea_put fs/jfs/xattr.c:639 [inline]\n\n...\n\nLocal variable ea_buf created at:\n __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662\n __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934\n\n=====================================================\n\nThe reason is ea_buf-\u003enew_ea is not initialized properly.\n\nFix this by using memset to empty its content at the beginning\nin ea_get().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "562b9d60-a24b-4ec8-a464-44762829cd55",
      "id": "CVE-2024-44942",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC\n\nsyzbot reports a f2fs bug as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/inline.c:258!\nCPU: 1 PID: 34 Comm: kworker/u8:2 Not tainted 6.9.0-rc6-syzkaller-00012-g9e4bc4bcae01 #0\nRIP: 0010:f2fs_write_inline_data+0x781/0x790 fs/f2fs/inline.c:258\nCall Trace:\n f2fs_write_single_data_page+0xb65/0x1d60 fs/f2fs/data.c:2834\n f2fs_write_cache_pages fs/f2fs/data.c:3133 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3288 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3315\n do_writepages+0x35b/0x870 mm/page-writeback.c:2612\n __writeback_single_inode+0x165/0x10b0 fs/fs-writeback.c:1650\n writeback_sb_inodes+0x905/0x1260 fs/fs-writeback.c:1941\n wb_writeback+0x457/0xce0 fs/fs-writeback.c:2117\n wb_do_writeback fs/fs-writeback.c:2264 [inline]\n wb_workfn+0x410/0x1090 fs/fs-writeback.c:2304\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0xa12/0x17c0 kernel/workqueue.c:3335\n worker_thread+0x86d/0xd70 kernel/workqueue.c:3416\n kthread+0x2f2/0x390 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nThe root cause is: inline_data inode can be fuzzed, so that there may\nbe valid blkaddr in its direct node, once f2fs triggers background GC\nto migrate the block, it will hit f2fs_bug_on() during dirty page\nwriteback.\n\nLet's add sanity check on F2FS_INLINE_DATA flag in inode during GC,\nso that, it can forbid migrating inline_data inode's data block for\nfixing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "67cd54cf-dd5e-4e7c-8401-344dc4203db6",
      "id": "CVE-2024-46695",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux,smack: don't bypass permissions check in inode_setsecctx hook\n\nMarek Gresko reports that the root user on an NFS client is able to\nchange the security labels on files on an NFS filesystem that is\nexported with root squashing enabled.\n\nThe end of the kerneldoc comment for __vfs_setxattr_noperm() states:\n\n *  This function requires the caller to lock the inode's i_mutex before it\n *  is executed. It also assumes that the caller will make the appropriate\n *  permission checks.\n\nnfsd_setattr() does do permissions checking via fh_verify() and\nnfsd_permission(), but those don't do all the same permissions checks\nthat are done by security_inode_setxattr() and its related LSM hooks do.\n\nSince nfsd_setattr() is the only consumer of security_inode_setsecctx(),\nsimplest solution appears to be to replace the call to\n__vfs_setxattr_noperm() with a call to __vfs_setxattr_locked().  This\nfixes the above issue and has the added benefit of causing nfsd to\nrecall conflicting delegations on a file when a client tries to change\nits security label.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5439f2e-2079-4980-8e83-23e087f986ec",
      "id": "CVE-2024-46832",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed\n\nThis avoids warning:\n\n[    0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283\n\nCaused by get_c0_compare_int on secondary CPU.\n\nWe also skipped saving IRQ number to struct clock_event_device *cd as\nit's never used by clockevent core, as per comments it's only meant\nfor \"non CPU local devices\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bb28210-2c4b-42e8-bb7a-be690fe7888f",
      "id": "CVE-2024-47704",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_res-\u003ehpo_dp_link_enc before using it\n\n[WHAT \u0026 HOW]\nFunctions dp_enable_link_phy and dp_disable_link_phy can pass link_res\nwithout initializing hpo_dp_link_enc and it is necessary to check for\nnull before dereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ea71816-3abb-4ec6-a6d7-dd162c95ec52",
      "id": "CVE-2024-49858",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefistub/tpm: Use ACPI reclaim memory for event log to avoid corruption\n\nThe TPM event log table is a Linux specific construct, where the data\nproduced by the GetEventLog() boot service is cached in memory, and\npassed on to the OS using an EFI configuration table.\n\nThe use of EFI_LOADER_DATA here results in the region being left\nunreserved in the E820 memory map constructed by the EFI stub, and this\nis the memory description that is passed on to the incoming kernel by\nkexec, which is therefore unaware that the region should be reserved.\n\nEven though the utility of the TPM2 event log after a kexec is\nquestionable, any corruption might send the parsing code off into the\nweeds and crash the kernel. So let's use EFI_ACPI_RECLAIM_MEMORY\ninstead, which is always treated as reserved by the E820 conversion\nlogic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c205f69-dbd6-4f76-8ef5-23a04860cacf",
      "id": "CVE-2024-49916",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr-\u003efuncs in dcn401_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn401_init_hw` function. The issue could occur when `dc-\u003eclk_mgr` or\n`dc-\u003eclk_mgr-\u003efuncs` is null.\n\nThe fix adds a check to ensure `dc-\u003eclk_mgr` and `dc-\u003eclk_mgr-\u003efuncs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416 dcn401_init_hw() error: we previously assumed 'dc-\u003eclk_mgr' could be null (see line 225)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7543b12c-fea8-4158-9d03-b5334577576a",
      "id": "CVE-2024-50111",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Enable IRQ if do_ale() triggered in irq-enabled context\n\nUnaligned access exception can be triggered in irq-enabled context such\nas user mode, in this case do_ale() may call get_user() which may cause\nsleep. Then we will get:\n\n BUG: sleeping function called from invalid context at arch/loongarch/kernel/access-helper.h:7\n in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 129, name: modprobe\n preempt_count: 0, expected: 0\n RCU nest depth: 0, expected: 0\n CPU: 0 UID: 0 PID: 129 Comm: modprobe Tainted: G        W          6.12.0-rc1+ #1723\n Tainted: [W]=WARN\n Stack : 9000000105e0bd48 0000000000000000 9000000003803944 9000000105e08000\n         9000000105e0bc70 9000000105e0bc78 0000000000000000 0000000000000000\n         9000000105e0bc78 0000000000000001 9000000185e0ba07 9000000105e0b890\n         ffffffffffffffff 9000000105e0bc78 73924b81763be05b 9000000100194500\n         000000000000020c 000000000000000a 0000000000000000 0000000000000003\n         00000000000023f0 00000000000e1401 00000000072f8000 0000007ffbb0e260\n         0000000000000000 0000000000000000 9000000005437650 90000000055d5000\n         0000000000000000 0000000000000003 0000007ffbb0e1f0 0000000000000000\n         0000005567b00490 0000000000000000 9000000003803964 0000007ffbb0dfec\n         00000000000000b0 0000000000000007 0000000000000003 0000000000071c1d\n         ...\n Call Trace:\n [\u003c9000000003803964\u003e] show_stack+0x64/0x1a0\n [\u003c9000000004c57464\u003e] dump_stack_lvl+0x74/0xb0\n [\u003c9000000003861ab4\u003e] __might_resched+0x154/0x1a0\n [\u003c900000000380c96c\u003e] emulate_load_store_insn+0x6c/0xf60\n [\u003c9000000004c58118\u003e] do_ale+0x78/0x180\n [\u003c9000000003801bc8\u003e] handle_ale+0x128/0x1e0\n\nSo enable IRQ if unaligned access exception is triggered in irq-enabled\ncontext to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a96dd92-c7d3-464c-8acf-66b65fd8fdd9",
      "id": "CVE-2024-50264",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: Initialization of the dangling pointer occurring in vsk-\u003etrans\n\nDuring loopback communication, a dangling pointer can be created in\nvsk-\u003etrans, potentially leading to a Use-After-Free condition.  This\nissue is resolved by initializing vsk-\u003etrans to NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e88bb30-8556-4bdf-ab73-94050c1784cb",
      "id": "CVE-2024-53148",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Flush partial mappings in error case\n\nIf some remap_pfn_range() calls succeeded before one failed, we still have\nbuffer pages mapped into the userspace page tables when we drop the buffer\nreference with comedi_buf_map_put(bm). The userspace mappings are only\ncleaned up later in the mmap error path.\n\nFix it by explicitly flushing all mappings in our VMA on the error path.\n\nSee commit 79a61cc3fc04 (\"mm: avoid leaving partial pfn mappings around in\nerror case\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "639a409a-ba5f-456f-9f04-2091690e9298",
      "id": "CVE-2024-53165",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: intc: Fix use-after-free bug in register_intc_controller()\n\nIn the error handling for this function, d is freed without ever\nremoving it from intc_list which would lead to a use after free.\nTo fix this, let's only add it to the list after everything has\nsucceeded.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "04c5a8bc-9910-44f4-9502-a2886b99ad98",
      "id": "CVE-2024-53685",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: give up on paths longer than PATH_MAX\n\nIf the full path to be built by ceph_mdsc_build_path() happens to be\nlonger than PATH_MAX, then this function will enter an endless (retry)\nloop, effectively blocking the whole task.  Most of the machine\nbecomes unusable, making this a very simple and effective DoS\nvulnerability.\n\nI cannot imagine why this retry was ever implemented, but it seems\nrather useless and harmful to me.  Let's remove it and fail with\nENAMETOOLONG instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a66f2b1d-5dde-44d0-a8ea-b0017a47bc59",
      "id": "CVE-2024-56584",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/tctx: work around xa_store() allocation error issue\n\nsyzbot triggered the following WARN_ON:\n\nWARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51\n\nwhich is the\n\nWARN_ON_ONCE(!xa_empty(\u0026tctx-\u003exa));\n\nsanity check in __io_uring_free() when a io_uring_task is going through\nits final put. The syzbot test case includes injecting memory allocation\nfailures, and it very much looks like xa_store() can fail one of its\nmemory allocations and end up with -\u003ehead being non-NULL even though no\nentries exist in the xarray.\n\nUntil this issue gets sorted out, work around it by attempting to\niterate entries in our xarray, and WARN_ON_ONCE() if one is found.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58f0c72e-1519-4081-847d-c2fcc18c43b6",
      "id": "CVE-2024-56688",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport\n\nSince transport-\u003esock has been set to NULL during reset transport,\nXPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the\nxs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request()\nto dereference the transport-\u003esock that has been set to NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5fa18e4d-df8a-4202-b90a-68139aee7920",
      "id": "CVE-2024-57888",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker\n\nAfter commit\n746ae46c1113 (\"drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM\")\namdgpu started seeing the following warning:\n\n [ ] workqueue: WQ_MEM_RECLAIM sdma0:drm_sched_run_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM events:amdgpu_device_delay_enable_gfx_off [amdgpu]\n...\n [ ] Workqueue: sdma0 drm_sched_run_job_work [gpu_sched]\n...\n [ ] Call Trace:\n [ ]  \u003cTASK\u003e\n...\n [ ]  ? check_flush_dependency+0xf5/0x110\n...\n [ ]  cancel_delayed_work_sync+0x6e/0x80\n [ ]  amdgpu_gfx_off_ctrl+0xab/0x140 [amdgpu]\n [ ]  amdgpu_ring_alloc+0x40/0x50 [amdgpu]\n [ ]  amdgpu_ib_schedule+0xf4/0x810 [amdgpu]\n [ ]  ? drm_sched_run_job_work+0x22c/0x430 [gpu_sched]\n [ ]  amdgpu_job_run+0xaa/0x1f0 [amdgpu]\n [ ]  drm_sched_run_job_work+0x257/0x430 [gpu_sched]\n [ ]  process_one_work+0x217/0x720\n...\n [ ]  \u003c/TASK\u003e\n\nThe intent of the verifcation done in check_flush_depedency is to ensure\nforward progress during memory reclaim, by flagging cases when either a\nmemory reclaim process, or a memory reclaim work item is flushed from a\ncontext not marked as memory reclaim safe.\n\nThis is correct when flushing, but when called from the\ncancel(_delayed)_work_sync() paths it is a false positive because work is\neither already running, or will not be running at all. Therefore\ncancelling it is safe and we can relax the warning criteria by letting the\nhelper know of the calling context.\n\nReferences: 746ae46c1113 (\"drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ece17e7-4b9e-4a56-a0e7-ac661cf366d3",
      "id": "CVE-2024-57913",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Remove WARN_ON in functionfs_bind\n\nThis commit addresses an issue related to below kernel panic where\npanic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON\nin functionsfs_bind, which easily leads to the following scenarios.\n\n1.adb_write in adbd               2. UDC write via configfs\n  =================\t             =====================\n\n-\u003eusb_ffs_open_thread()           -\u003eUDC write\n -\u003eopen_functionfs()               -\u003econfigfs_write_iter()\n  -\u003eadb_open()                      -\u003egadget_dev_desc_UDC_store()\n   -\u003eadb_write()                     -\u003eusb_gadget_register_driver_owner\n                                      -\u003edriver_register()\n-\u003eStartMonitor()                       -\u003ebus_add_driver()\n -\u003eadb_read()                           -\u003egadget_bind_driver()\n\u003ctimes-out without BIND event\u003e           -\u003econfigfs_composite_bind()\n                                          -\u003eusb_add_function()\n-\u003eopen_functionfs()                        -\u003effs_func_bind()\n -\u003eadb_open()                               -\u003efunctionfs_bind()\n                                       \u003cffs-\u003estate !=FFS_ACTIVE\u003e\n\nThe adb_open, adb_read, and adb_write operations are invoked from the\ndaemon, but trying to bind the function is a process that is invoked by\nUDC write through configfs, which opens up the possibility of a race\ncondition between the two paths. In this race scenario, the kernel panic\noccurs due to the WARN_ON from functionfs_bind when panic_on_warn is\nenabled. This commit fixes the kernel panic by removing the unnecessary\nWARN_ON.\n\nKernel panic - not syncing: kernel: panic_on_warn set ...\n[   14.542395] Call trace:\n[   14.542464]  ffs_func_bind+0x1c8/0x14a8\n[   14.542468]  usb_add_function+0xcc/0x1f0\n[   14.542473]  configfs_composite_bind+0x468/0x588\n[   14.542478]  gadget_bind_driver+0x108/0x27c\n[   14.542483]  really_probe+0x190/0x374\n[   14.542488]  __driver_probe_device+0xa0/0x12c\n[   14.542492]  driver_probe_device+0x3c/0x220\n[   14.542498]  __driver_attach+0x11c/0x1fc\n[   14.542502]  bus_for_each_dev+0x104/0x160\n[   14.542506]  driver_attach+0x24/0x34\n[   14.542510]  bus_add_driver+0x154/0x270\n[   14.542514]  driver_register+0x68/0x104\n[   14.542518]  usb_gadget_register_driver_owner+0x48/0xf4\n[   14.542523]  gadget_dev_desc_UDC_store+0xf8/0x144\n[   14.542526]  configfs_write_iter+0xf0/0x138",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0490f25-5dee-41ef-b666-6d704e5bf087",
      "id": "CVE-2024-58069",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\n\nThe nvmem interface supports variable buffer sizes, while the regmap\ninterface operates with fixed-size storage. If an nvmem client uses a\nbuffer size less than 4 bytes, regmap_read will write out of bounds\nas it expects the buffer to point at an unsigned int.\n\nFix this by using an intermediary unsigned int to hold the value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d63b0e76-7dc6-4117-9c8b-0ef09bd210ac",
      "id": "CVE-2025-21689",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()\n\nThis patch addresses a null-ptr-deref in qt2_process_read_urb() due to\nan incorrect bounds check in the following:\n\n       if (newport \u003e serial-\u003enum_ports) {\n               dev_err(\u0026port-\u003edev,\n                       \"%s - port change to invalid port: %i\\n\",\n                       __func__, newport);\n               break;\n       }\n\nThe condition doesn't account for the valid range of the serial-\u003eport\nbuffer, which is from 0 to serial-\u003enum_ports - 1. When newport is equal\nto serial-\u003enum_ports, the assignment of \"port\" in the\nfollowing code is out-of-bounds and NULL:\n\n       serial_priv-\u003ecurrent_port = newport;\n       port = serial-\u003eport[serial_priv-\u003ecurrent_port];\n\nThe fix checks if newport is greater than or equal to serial-\u003enum_ports\nindicating it is out-of-bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eac870f4-987e-45a4-8155-e18aaebbc652",
      "id": "CVE-2025-21711",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rose: prevent integer overflows in rose_setsockopt()\n\nIn case of possible unpredictably large arguments passed to\nrose_setsockopt() and multiplied by extra values on top of that,\ninteger overflows may occur.\n\nDo the safest minimum and fix these issues by checking the\ncontents of 'opt' and returning -EINVAL if they are too large. Also,\nswitch to unsigned int and remove useless check for negative 'opt'\nin ROSE_IDLE case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88ffe0f1-0e45-4c18-95b5-3d3c504260bd",
      "id": "CVE-2025-21718",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: fix timer races against user threads\n\nRose timers only acquire the socket spinlock, without\nchecking if the socket is owned by one user thread.\n\nAdd a check and rearm the timers if needed.\n\nBUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174\nRead of size 2 at addr ffff88802f09b82a by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cIRQ\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:489\n  kasan_report+0x143/0x180 mm/kasan/report.c:602\n  rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174\n  call_timer_fn+0x187/0x650 kernel/time/timer.c:1793\n  expire_timers kernel/time/timer.c:1844 [inline]\n  __run_timers kernel/time/timer.c:2418 [inline]\n  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430\n  run_timer_base kernel/time/timer.c:2439 [inline]\n  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449\n  handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561\n  __do_softirq kernel/softirq.c:595 [inline]\n  invoke_softirq kernel/softirq.c:435 [inline]\n  __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049\n \u003c/IRQ\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ed7fb31-25b9-435a-a980-210e2c25f097",
      "id": "CVE-2025-21891",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: ensure network headers are in skb linear part\n\nsyzbot found that ipvlan_process_v6_outbound() was assuming\nthe IPv6 network header isis present in skb-\u003ehead [1]\n\nAdd the needed pskb_network_may_pull() calls for both\nIPv4 and IPv6 handlers.\n\n[1]\nBUG: KMSAN: uninit-value in __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47\n  __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47\n  ipv6_addr_type include/net/ipv6.h:555 [inline]\n  ip6_route_output_flags_noref net/ipv6/route.c:2616 [inline]\n  ip6_route_output_flags+0x51/0x720 net/ipv6/route.c:2651\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ipvlan_route_v6_outbound+0x24e/0x520 drivers/net/ipvlan/ipvlan_core.c:476\n  ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:491 [inline]\n  ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:541 [inline]\n  ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:605 [inline]\n  ipvlan_queue_xmit+0xd72/0x1780 drivers/net/ipvlan/ipvlan_core.c:671\n  ipvlan_start_xmit+0x5b/0x210 drivers/net/ipvlan/ipvlan_main.c:223\n  __netdev_start_xmit include/linux/netdevice.h:5150 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5159 [inline]\n  xmit_one net/core/dev.c:3735 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3751\n  sch_direct_xmit+0x399/0xd40 net/sched/sch_generic.c:343\n  qdisc_restart net/sched/sch_generic.c:408 [inline]\n  __qdisc_run+0x14da/0x35d0 net/sched/sch_generic.c:416\n  qdisc_run+0x141/0x4d0 include/net/pkt_sched.h:127\n  net_tx_action+0x78b/0x940 net/core/dev.c:5484\n  handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561\n  __do_softirq+0x14/0x1a kernel/softirq.c:595\n  do_softirq+0x9a/0x100 kernel/softirq.c:462\n  __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\n  rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]\n  __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4611\n  dev_queue_xmit include/linux/netdevice.h:3311 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3132 [inline]\n  packet_sendmsg+0x93e0/0xa7e0 net/packet/af_packet.c:3164\n  sock_sendmsg_nosec net/socket.c:718 [inline]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2062d5f-e23f-423c-bf6e-ddd0fff2516a",
      "id": "CVE-2025-21914",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nslimbus: messaging: Free transaction ID in delayed interrupt scenario\n\nIn case of interrupt delay for any reason, slim_do_transfer()\nreturns timeout error but the transaction ID (TID) is not freed.\nThis results into invalid memory access inside\nqcom_slim_ngd_rx_msgq_cb() due to invalid TID.\n\nFix the issue by freeing the TID in slim_do_transfer() before\nreturning timeout error to avoid invalid memory access.\n\nCall trace:\n__memcpy_fromio+0x20/0x190\nqcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]\nvchan_complete+0x2a0/0x4a0\ntasklet_action_common+0x274/0x700\ntasklet_action+0x28/0x3c\n_stext+0x188/0x620\nrun_ksoftirqd+0x34/0x74\nsmpboot_thread_fn+0x1d8/0x464\nkthread+0x178/0x238\nret_from_fork+0x10/0x20\nCode: aa0003e8 91000429 f100044a 3940002b (3800150b)\n---[ end trace 0fe00bec2b975c99 ]---\nKernel panic - not syncing: Oops: Fatal exception in interrupt.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fefc7f5d-062c-4c66-a182-737ff40c6441",
      "id": "CVE-2022-50211",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd-raid10: fix KASAN warning\n\nThere's a KASAN warning in raid10_remove_disk when running the lvm\ntest lvconvert-raid-reshape.sh. We fix this warning by verifying that the\nvalue \"number\" is valid.\n\nBUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10]\nRead of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682\n\nCPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x45/0x57a\n ? __lock_text_start+0x18/0x18\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\n kasan_report+0xa8/0xe0\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\n raid10_remove_disk+0x61/0x2a0 [raid10]\nBuffer I/O error on dev dm-76, logical block 15344, async page read\n ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0\n remove_and_add_spares+0x367/0x8a0 [md_mod]\n ? super_written+0x1c0/0x1c0 [md_mod]\n ? mutex_trylock+0xac/0x120\n ? _raw_spin_lock+0x72/0xc0\n ? _raw_spin_lock_bh+0xc0/0xc0\n md_check_recovery+0x848/0x960 [md_mod]\n raid10d+0xcf/0x3360 [raid10]\n ? sched_clock_cpu+0x185/0x1a0\n ? rb_erase+0x4d4/0x620\n ? var_wake_function+0xe0/0xe0\n ? psi_group_change+0x411/0x500\n ? preempt_count_sub+0xf/0xc0\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? __lock_text_start+0x18/0x18\n ? raid10_sync_request+0x36c0/0x36c0 [raid10]\n ? preempt_count_sub+0xf/0xc0\n ? _raw_spin_unlock_irqrestore+0x19/0x40\n ? del_timer_sync+0xa9/0x100\n ? try_to_del_timer_sync+0xc0/0xc0\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? __lock_text_start+0x18/0x18\n ? _raw_spin_unlock_irq+0x11/0x24\n ? __list_del_entry_valid+0x68/0xa0\n ? finish_wait+0xa3/0x100\n md_thread+0x161/0x260 [md_mod]\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? prepare_to_wait_event+0x2c0/0x2c0\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\n kthread+0x148/0x180\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n \u003c/TASK\u003e\n\nAllocated by task 124495:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x80/0xa0\n setup_conf+0x140/0x5c0 [raid10]\n raid10_run+0x4cd/0x740 [raid10]\n md_run+0x6f9/0x1300 [md_mod]\n raid_ctr+0x2531/0x4ac0 [dm_raid]\n dm_table_add_target+0x2b0/0x620 [dm_mod]\n table_load+0x1c8/0x400 [dm_mod]\n ctl_ioctl+0x29e/0x560 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x20 [dm_mod]\n __do_compat_sys_ioctl+0xfa/0x160\n do_syscall_64+0x90/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x9e/0xc0\n kvfree_call_rcu+0x84/0x480\n timerfd_release+0x82/0x140\nL __fput+0xfa/0x400\n task_work_run+0x80/0xc0\n exit_to_user_mode_prepare+0x155/0x160\n syscall_exit_to_user_mode+0x12/0x40\n do_syscall_64+0x42/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nSecond to last potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x9e/0xc0\n kvfree_call_rcu+0x84/0x480\n timerfd_release+0x82/0x140\n __fput+0xfa/0x400\n task_work_run+0x80/0xc0\n exit_to_user_mode_prepare+0x155/0x160\n syscall_exit_to_user_mode+0x12/0x40\n do_syscall_64+0x42/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe buggy address belongs to the object at ffff889108f3d200\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 0 bytes to the right of\n 256-byte region [ffff889108f3d200, ffff889108f3d300)\n\nThe buggy address belongs to the physical page:\npage:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c\nhead:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0\nflags: 0x4000000000010200(slab|head|zone=2)\nraw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40\nraw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff889108f3d280: 00 00\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "114221e6-b6e2-4573-abd6-cc14f5ea019d",
      "id": "CVE-2025-21976",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: hyperv_fb: Allow graceful removal of framebuffer\n\nWhen a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to\nrelease the framebuffer forcefully. If this framebuffer is in use it\nproduce the following WARN and hence this framebuffer is never released.\n\n[   44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40\n\u003c snip \u003e\n[   44.111289] Call Trace:\n[   44.111290]  \u003cTASK\u003e\n[   44.111291]  ? show_regs+0x6c/0x80\n[   44.111295]  ? __warn+0x8d/0x150\n[   44.111298]  ? framebuffer_release+0x2c/0x40\n[   44.111300]  ? report_bug+0x182/0x1b0\n[   44.111303]  ? handle_bug+0x6e/0xb0\n[   44.111306]  ? exc_invalid_op+0x18/0x80\n[   44.111308]  ? asm_exc_invalid_op+0x1b/0x20\n[   44.111311]  ? framebuffer_release+0x2c/0x40\n[   44.111313]  ? hvfb_remove+0x86/0xa0 [hyperv_fb]\n[   44.111315]  vmbus_remove+0x24/0x40 [hv_vmbus]\n[   44.111323]  device_remove+0x40/0x80\n[   44.111325]  device_release_driver_internal+0x20b/0x270\n[   44.111327]  ? bus_find_device+0xb3/0xf0\n\nFix this by moving the release of framebuffer and assosiated memory\nto fb_ops.fb_destroy function, so that framebuffer framework handles\nit gracefully.\n\nWhile we fix this, also replace manual registrations/unregistration of\nframebuffer with devm_register_framebuffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86d24534-e696-4e22-94b9-f25ca4b474cf",
      "id": "CVE-2025-22027",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: streamzap: fix race between device disconnection and urb callback\n\nSyzkaller has reported a general protection fault at function\nir_raw_event_store_with_filter(). This crash is caused by a NULL pointer\ndereference of dev-\u003eraw pointer, even though it is checked for NULL in\nthe same function, which means there is a race condition. It occurs due\nto the incorrect order of actions in the streamzap_disconnect() function:\nrc_unregister_device() is called before usb_kill_urb(). The dev-\u003eraw\npointer is freed and set to NULL in rc_unregister_device(), and only\nafter that usb_kill_urb() waits for in-progress requests to finish.\n\nIf rc_unregister_device() is called while streamzap_callback() handler is\nnot finished, this can lead to accessing freed resources. Thus\nrc_unregister_device() should be called after usb_kill_urb().\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e133e2fa-310b-430a-a8dc-19dcc66a7de0",
      "id": "CVE-2025-22072",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix gang directory lifetimes\n\nprior to \"[POWERPC] spufs: Fix gang destroy leaks\" we used to have\na problem with gang lifetimes - creation of a gang returns opened\ngang directory, which normally gets removed when that gets closed,\nbut if somebody has created a context belonging to that gang and\nkept it alive until the gang got closed, removal failed and we\nended up with a leak.\n\nUnfortunately, it had been fixed the wrong way.  Dentry of gang\ndirectory was no longer pinned, and rmdir on close was gone.\nOne problem was that failure of open kept calling simple_rmdir()\nas cleanup, which meant an unbalanced dput().  Another bug was\nin the success case - gang creation incremented link count on\nroot directory, but that was no longer undone when gang got\ndestroyed.\n\nFix consists of\n\t* reverting the commit in question\n\t* adding a counter to gang, protected by -\u003ei_rwsem\nof gang directory inode.\n\t* having it set to 1 at creation time, dropped\nin both spufs_dir_close() and spufs_gang_close() and bumped\nin spufs_create_context(), provided that it's not 0.\n\t* using simple_recursive_removal() to take the gang\ndirectory out when counter reaches zero.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8134126-ac4e-4482-9d9b-bea0efbea5de",
      "id": "CVE-2025-22073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak on spufs_new_file() failure\n\nIt's called from spufs_fill_dir(), and caller of that will do\nspufs_rmdir() in case of failure.  That does remove everything\nwe'd managed to create, but... the problem dentry is still\nnegative.  IOW, it needs to be explicitly dropped.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "feb7cd4d-1fd9-40c2-9567-6a522ce529cb",
      "id": "CVE-2025-38422",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices\n\nMaximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb\nand 64 Kb respectively. Adjust max size definitions and return correct\nEEPROM length based on device. Also prevent out-of-bound read/write.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbd36205-8385-4907-83b8-f8dcb7f8f47e",
      "id": "CVE-2025-37857",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix array overflow in st_setup()\n\nChange the array size to follow parms size instead of a fixed value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "685c3620-5c60-40c2-829e-16f7ed485e3b",
      "id": "CVE-2025-37920",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix race condition in AF_XDP generic RX path\n\nMove rx_lock from xsk_socket to xsk_buff_pool.\nFix synchronization for shared umem mode in\ngeneric RX path where multiple sockets share\nsingle xsk_buff_pool.\n\nRX queue is exclusive to xsk_socket, while FILL\nqueue can be shared between multiple sockets.\nThis could result in race condition where two\nCPU cores access RX path of two different sockets\nsharing the same umem.\n\nProtect both queues by acquiring spinlock in shared\nxsk_buff_pool.\n\nLock contention may be minimized in the future by some\nper-thread FQ buffering.\n\nIt's safe and necessary to move spin_lock_bh(rx_lock)\nafter xsk_rcv_check():\n* xs-\u003epool and spinlock_init is synchronized by\n  xsk_bind() -\u003e xsk_is_bound() memory barriers.\n* xsk_rcv_check() may return true at the moment\n  of xsk_release() or xsk_unbind_dev(),\n  however this will not cause any data races or\n  race conditions. xsk_unbind_dev() removes xdp\n  socket from all maps and waits for completion\n  of all outstanding rx operations. Packets in\n  RX path will either complete safely or drop.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46ed73d8-dfed-42c6-9b04-93e7b29699ca",
      "id": "CVE-2025-38009",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: disable napi on driver removal\n\nA warning on driver removal started occurring after commit 9dd05df8403b\n(\"net: warn if NAPI instance wasn't shut down\"). Disable tx napi before\ndeleting it in mt76_dma_cleanup().\n\n WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100\n CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)\n Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024\n RIP: 0010:__netif_napi_del_locked+0xf0/0x100\n Call Trace:\n \u003cTASK\u003e\n mt76_dma_cleanup+0x54/0x2f0 [mt76]\n mt7921_pci_remove+0xd5/0x190 [mt7921e]\n pci_device_remove+0x47/0xc0\n device_release_driver_internal+0x19e/0x200\n driver_detach+0x48/0x90\n bus_remove_driver+0x6d/0xf0\n pci_unregister_driver+0x2e/0xb0\n __do_sys_delete_module.isra.0+0x197/0x2e0\n do_syscall_64+0x7b/0x160\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nTested with mt7921e but the same pattern can be actually applied to other\nmt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled\nin their *_dma_init() functions and only toggled off and on again inside\ntheir suspend/resume/reset paths. So it should be okay to disable tx\nnapi in such a generic way.\n\nFound by Linux Verification Center (linuxtesting.org).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc9707ec-84d9-487b-8d32-18cceec0102c",
      "id": "CVE-2025-38326",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: clean device rq_list in aoedev_downdev()\n\nAn aoe device's rq_list contains accepted block requests that are\nwaiting to be transmitted to the aoe target. This queue was added as\npart of the conversion to blk_mq. However, the queue was not cleaned out\nwhen an aoe device is downed which caused blk_mq_freeze_queue() to sleep\nindefinitely waiting for those requests to complete, causing a hang. This\nfix cleans out the queue before calling blk_mq_freeze_queue().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "851a748a-6b31-43eb-8b7d-5ae9c9fdd177",
      "id": "CVE-2025-38331",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Use TOE/TSO on all TCP\n\nIt is desireable to push the hardware accelerator to also\nprocess non-segmented TCP frames: we pass the skb-\u003elen\nto the \"TOE/TSO\" offloader and it will handle them.\n\nWithout this quirk the driver becomes unstable and lock\nup and and crash.\n\nI do not know exactly why, but it is probably due to the\nTOE (TCP offload engine) feature that is coupled with the\nsegmentation feature - it is not possible to turn one\npart off and not the other, either both TOE and TSO are\nactive, or neither of them.\n\nNot having the TOE part active seems detrimental, as if\nthat hardware feature is not really supposed to be turned\noff.\n\nThe datasheet says:\n\n  \"Based on packet parsing and TCP connection/NAT table\n   lookup results, the NetEngine puts the packets\n   belonging to the same TCP connection to the same queue\n   for the software to process. The NetEngine puts\n   incoming packets to the buffer or series of buffers\n   for a jumbo packet. With this hardware acceleration,\n   IP/TCP header parsing, checksum validation and\n   connection lookup are offloaded from the software\n   processing.\"\n\nAfter numerous tests with the hardware locking up after\nsomething between minutes and hours depending on load\nusing iperf3 I have concluded this is necessary to stabilize\nthe hardware.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41ab88a8-22f2-43fa-a708-3e5dc046363b",
      "id": "CVE-2025-38391",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: do not index invalid pin_assignments\n\nA poorly implemented DisplayPort Alt Mode port partner can indicate\nthat its pin assignment capabilities are greater than the maximum\nvalue, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show\nwill cause a BRK exception due to an out of bounds array access.\n\nPrevent for loop in pin_assignment_show from accessing\ninvalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX\nvalue in typec_dp.h and using i \u003c DP_PIN_ASSIGN_MAX as a loop\ncondition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36267977-958a-4d97-91c3-bc746f380df4",
      "id": "CVE-2024-56614",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix OOB map writes when deleting elements\n\nJordy says:\n\n\"\nIn the xsk_map_delete_elem function an unsigned integer\n(map-\u003emax_entries) is compared with a user-controlled signed integer\n(k). Due to implicit type conversion, a large unsigned value for\nmap-\u003emax_entries can bypass the intended bounds check:\n\n\tif (k \u003e= map-\u003emax_entries)\n\t\treturn -EINVAL;\n\nThis allows k to hold a negative value (between -2147483648 and -2),\nwhich is then used as an array index in m-\u003exsk_map[k], which results\nin an out-of-bounds access.\n\n\tspin_lock_bh(\u0026m-\u003elock);\n\tmap_entry = \u0026m-\u003exsk_map[k]; // Out-of-bounds map_entry\n\told_xs = unrcu_pointer(xchg(map_entry, NULL));  // Oob write\n\tif (old_xs)\n\t\txsk_map_sock_delete(old_xs, map_entry);\n\tspin_unlock_bh(\u0026m-\u003elock);\n\nThe xchg operation can then be used to cause an out-of-bounds write.\nMoreover, the invalid map_entry passed to xsk_map_sock_delete can lead\nto further memory corruption.\n\"\n\nIt indeed results in following splat:\n\n[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108\n[76612.904330] #PF: supervisor write access in kernel mode\n[76612.909639] #PF: error_code(0x0002) - not-present page\n[76612.914855] PGD 0 P4D 0\n[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP\n[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470\n[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019\n[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60\n[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff \u003c48\u003e 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31\n[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246\n[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000\n[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000\n[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007\n[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8\n[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0\n[76613.005303] FS:  00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000\n[76613.013517] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0\n[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[76613.041086] PKRU: 55555554\n[76613.043842] Call Trace:\n[76613.046331]  \u003cTASK\u003e\n[76613.048468]  ? __die+0x20/0x60\n[76613.051581]  ? page_fault_oops+0x15a/0x450\n[76613.055747]  ? search_extable+0x22/0x30\n[76613.059649]  ? search_bpf_extables+0x5f/0x80\n[76613.063988]  ? exc_page_fault+0xa9/0x140\n[76613.067975]  ? asm_exc_page_fault+0x22/0x30\n[76613.072229]  ? xsk_map_delete_elem+0x2d/0x60\n[76613.076573]  ? xsk_map_delete_elem+0x23/0x60\n[76613.080914]  __sys_bpf+0x19b7/0x23c0\n[76613.084555]  __x64_sys_bpf+0x1a/0x20\n[76613.088194]  do_syscall_64+0x37/0xb0\n[76613.091832]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[76613.096962] RIP: 0033:0x7f80b6d1e88d\n[76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141\n[76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d\n[76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003\n[76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000\n[76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8\n[76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84301afe-a995-4a22-bfae-3d93238d9b2d",
      "id": "CVE-2025-38467",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: exynos7_drm_decon: add vblank check in IRQ handling\n\nIf there's support for another console device (such as a TTY serial),\nthe kernel occasionally panics during boot. The panic message and a\nrelevant snippet of the call stack is as follows:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 000000000000000\n  Call trace:\n    drm_crtc_handle_vblank+0x10/0x30 (P)\n    decon_irq_handler+0x88/0xb4\n    [...]\n\nOtherwise, the panics don't happen. This indicates that it's some sort\nof race condition.\n\nAdd a check to validate if the drm device can handle vblanks before\ncalling drm_crtc_handle_vblank() to avoid this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30bc01d3-66d4-4fd9-959a-101105ddb7f9",
      "id": "CVE-2025-38470",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime\n\nAssuming the \"rx-vlan-filter\" feature is enabled on a net device, the\n8021q module will automatically add or remove VLAN 0 when the net device\nis put administratively up or down, respectively. There are a couple of\nproblems with the above scheme.\n\nThe first problem is a memory leak that can happen if the \"rx-vlan-filter\"\nfeature is disabled while the device is running:\n\n # ip link add bond1 up type bond mode 0\n # ethtool -K bond1 rx-vlan-filter off\n # ip link del dev bond1\n\nWhen the device is put administratively down the \"rx-vlan-filter\"\nfeature is disabled, so the 8021q module will not remove VLAN 0 and the\nmemory will be leaked [1].\n\nAnother problem that can happen is that the kernel can automatically\ndelete VLAN 0 when the device is put administratively down despite not\nadding it when the device was put administratively up since during that\ntime the \"rx-vlan-filter\" feature was disabled. null-ptr-unref or\nbug_on[2] will be triggered by unregister_vlan_dev() for refcount\nimbalance if toggling filtering during runtime:\n\n$ ip link add bond0 type bond mode 0\n$ ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q\n$ ethtool -K bond0 rx-vlan-filter off\n$ ifconfig bond0 up\n$ ethtool -K bond0 rx-vlan-filter on\n$ ifconfig bond0 down\n$ ip link del vlan0\n\nRoot cause is as below:\nstep1: add vlan0 for real_dev, such as bond, team.\nregister_vlan_dev\n    vlan_vid_add(real_dev,htons(ETH_P_8021Q),0) //refcnt=1\nstep2: disable vlan filter feature and enable real_dev\nstep3: change filter from 0 to 1\nvlan_device_event\n    vlan_filter_push_vids\n        ndo_vlan_rx_add_vid //No refcnt added to real_dev vlan0\nstep4: real_dev down\nvlan_device_event\n    vlan_vid_del(dev, htons(ETH_P_8021Q), 0); //refcnt=0\n        vlan_info_rcu_free //free vlan0\nstep5: delete vlan0\nunregister_vlan_dev\n    BUG_ON(!vlan_info); //vlan_info is null\n\nFix both problems by noting in the VLAN info whether VLAN 0 was\nautomatically added upon NETDEV_UP and based on that decide whether it\nshould be deleted upon NETDEV_DOWN, regardless of the state of the\n\"rx-vlan-filter\" feature.\n\n[1]\nunreferenced object 0xffff8880068e3100 (size 256):\n  comm \"ip\", pid 384, jiffies 4296130254\n  hex dump (first 32 bytes):\n    00 20 30 0d 80 88 ff ff 00 00 00 00 00 00 00 00  . 0.............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 81ce31fa):\n    __kmalloc_cache_noprof+0x2b5/0x340\n    vlan_vid_add+0x434/0x940\n    vlan_device_event.cold+0x75/0xa8\n    notifier_call_chain+0xca/0x150\n    __dev_notify_flags+0xe3/0x250\n    rtnl_configure_link+0x193/0x260\n    rtnl_newlink_create+0x383/0x8e0\n    __rtnl_newlink+0x22c/0xa40\n    rtnl_newlink+0x627/0xb00\n    rtnetlink_rcv_msg+0x6fb/0xb70\n    netlink_rcv_skb+0x11f/0x350\n    netlink_unicast+0x426/0x710\n    netlink_sendmsg+0x75a/0xc20\n    __sock_sendmsg+0xc1/0x150\n    ____sys_sendmsg+0x5aa/0x7b0\n    ___sys_sendmsg+0xfc/0x180\n\n[2]\nkernel BUG at net/8021q/vlan.c:99!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 382 Comm: ip Not tainted 6.16.0-rc3 #61 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:unregister_vlan_dev (net/8021q/vlan.c:99 (discriminator 1))\nRSP: 0018:ffff88810badf310 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff88810da84000 RCX: ffffffffb47ceb9a\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88810e8b43c8\nRBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6cefe80\nR10: ffffffffb677f407 R11: ffff88810badf3c0 R12: ffff88810e8b4000\nR13: 0000000000000000 R14: ffff88810642a5c0 R15: 000000000000017e\nFS:  00007f1ff68c20c0(0000) GS:ffff888163a24000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1ff5dad240 CR3: 0000000107e56000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02914f52-eccc-433e-aee9-e5927ee41f90",
      "id": "CVE-2025-38478",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements beyond the first `insn-\u003en` elements in some\ncases.  The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions\nallocate at least `MIN_SAMPLES` (16) data elements to deal with this,\nbut they do not initialize all of that.  For Comedi instruction codes\nthat write to the subdevice, the first `insn-\u003en` data elements are\ncopied from user-space, but the remaining elements are left\nuninitialized.  That could be a problem if the subdevice instruction\nhandler reads the uninitialized data.  Ensure that the first\n`MIN_SAMPLES` elements are initialized before calling these instruction\nhandlers, filling the uncopied elements with 0.  For\n`do_insnlist_ioctl()`, the same data buffer elements are used for\nhandling a list of instructions, so ensure the first `MIN_SAMPLES`\nelements are initialized for each instruction that writes to the\nsubdevice.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ecf749da-90a4-4879-a201-1ef757483193",
      "id": "CVE-2025-38483",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: das16m1: Fix bit shift out of bounds\n\nWhen checking for a supported IRQ number, the following test is used:\n\n\t/* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */\n\tif ((1 \u003c\u003c it-\u003eoptions[1]) \u0026 0xdcfc) {\n\nHowever, `it-\u003eoptions[i]` is an unchecked `int` value from userspace, so\nthe shift amount could be negative or out of bounds.  Fix the test by\nrequiring `it-\u003eoptions[1]` to be within bounds before proceeding with\nthe original test.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee42624b-d60c-49e1-a109-6c30d756753e",
      "id": "CVE-2025-39689",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Also allocate and copy hash for reading of filter files\n\nCurrently the reader of set_ftrace_filter and set_ftrace_notrace just adds\nthe pointer to the global tracer hash to its iterator. Unlike the writer\nthat allocates a copy of the hash, the reader keeps the pointer to the\nfilter hashes. This is problematic because this pointer is static across\nfunction calls that release the locks that can update the global tracer\nhashes. This can cause UAF and similar bugs.\n\nAllocate and copy the hash for reading the filter files like it is done\nfor the writers. This not only fixes UAF bugs, but also makes the code a\nbit simpler as it doesn't have to differentiate when to free the\niterator's hash between writers and readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c0557ee-90d2-401b-93f0-ef0a838da5c9",
      "id": "CVE-2025-39764",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n  if (!refcount_inc_not_zero(\u0026exp-\u003euse))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "401fa5c8-b08b-482f-a17d-28e1efadee61",
      "id": "CVE-2020-10690",
      "description": "There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66bce115-b238-498a-8dfc-526cc20f52df",
      "id": "CVE-2020-16120",
      "description": "Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef (\"ovl: stack file ops\"). This was fixed in kernel version 5.8 by commits 56230d9 (\"ovl: verify permissions in ovl_path_open()\"), 48bd024 (\"ovl: switch to mounter creds in readdir\") and 05acefb (\"ovl: check permission to open real file\"). Additionally, commits 130fdbc (\"ovl: pass correct flags for opening real directory\") and 292f902 (\"ovl: call secutiry hook in ovl_real_ioctl()\") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da (\"ovl: do not fail because of O_NOATIMEi\") in kernel 5.11.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0874bc7f-c55a-4890-97ad-2e3f406dc2db",
      "id": "CVE-2021-28952",
      "description": "An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dbd4f007-901f-4daa-860f-c0ddea374c07",
      "id": "CVE-2021-47254",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in gfs2_glock_shrink_scan\n\nThe GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to\nremove the glock from the lru list in __gfs2_glock_put().\n\nOn the shrink scan path, the same flag is cleared under lru_lock but because\nof cond_resched_lock(\u0026lru_lock) in gfs2_dispose_glock_lru(), progress on the\nput side can be made without deleting the glock from the lru list.\n\nKeep GLF_LRU across the race window opened by cond_resched_lock(\u0026lru_lock) to\nensure correct behavior on both sides - clear GLF_LRU after list_del under\nlru_lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "216c3b62-68a5-4aef-a2e5-5b3d77644c95",
      "id": "CVE-2021-33655",
      "description": "When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1798b982-6187-4849-b56a-195c745ab034",
      "id": "CVE-2021-4442",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add sanity tests to TCP_QUEUE_SEQ\n\nQingyu Li reported a syzkaller bug where the repro\nchanges RCV SEQ _after_ restoring data in the receive queue.\n\nmprotect(0x4aa000, 12288, PROT_READ)    = 0\nmmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000\nmmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000\nmmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000\nsocket(AF_INET6, SOCK_STREAM, IPPROTO_IP) = 3\nsetsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0\nconnect(3, {sa_family=AF_INET6, sin6_port=htons(0), sin6_flowinfo=htonl(0), inet_pton(AF_INET6, \"::1\", \u0026sin6_addr), sin6_scope_id=0}, 28) = 0\nsetsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [1], 4) = 0\nsendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=\"0x0000000000000003\\0\\0\", iov_len=20}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20\nsetsockopt(3, SOL_TCP, TCP_REPAIR, [0], 4) = 0\nsetsockopt(3, SOL_TCP, TCP_QUEUE_SEQ, [128], 4) = 0\nrecvfrom(3, NULL, 20, 0, NULL, NULL)    = -1 ECONNRESET (Connection reset by peer)\n\nsyslog shows:\n[  111.205099] TCP recvmsg seq # bug 2: copied 80, seq 0, rcvnxt 80, fl 0\n[  111.207894] WARNING: CPU: 1 PID: 356 at net/ipv4/tcp.c:2343 tcp_recvmsg_locked+0x90e/0x29a0\n\nThis should not be allowed. TCP_QUEUE_SEQ should only be used\nwhen queues are empty.\n\nThis patch fixes this case, and the tx path as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea2c1ff0-0701-48c3-8df8-2e138299fb05",
      "id": "CVE-2024-50289",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: av7110: fix a spectre vulnerability\n\nAs warned by smatch:\n\tdrivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110-\u003eci_slot' [w] (local cap)\n\nThere is a spectre-related vulnerability at the code. Fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac525daf-abec-4946-891b-c1552586397d",
      "id": "CVE-2021-45485",
      "description": "In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0cd40b9e-cde8-4f96-88e6-94760d41ff89",
      "id": "CVE-2021-46934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: validate user data in compat ioctl\n\nWrong user data may cause warning in i2c_transfer(), ex: zero msgs.\nUserspace should not be able to trigger warnings, so this patch adds\nvalidation checks for user data in compact ioctl to prevent reported\nwarnings",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2c2a7ff-6a02-4a51-ba3d-cce73e9ea9a9",
      "id": "CVE-2021-47183",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\n\nIf an FC link down transition while PLOGIs are outstanding to fabric well\nknown addresses, outstanding ABTS requests may result in a NULL pointer\ndereference. Driver unload requests may hang with repeated \"2878\" log\nmessages.\n\nThe Link down processing results in ABTS requests for outstanding ELS\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\nthe link state to down. Thus the driver is sending the Abort with the\nexpectation that an ABTS will be sent on the wire. The Abort request is\nstalled waiting for the link to come up. In some conditions the driver may\nauto-complete the ELSs thus if the link does come up, the Abort completions\nmay reference an invalid structure.\n\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\nto conditions where the link failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99667cb5-49ef-42c3-b6ba-f0056c4899d0",
      "id": "CVE-2022-49130",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: mhi: use mhi_sync_power_up()\n\nIf amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The\nreason for that was that we were using mhi_async_power_up() which does not\ncheck any errors. But mhi_sync_power_up() on the other hand does check for\nerrors so let's use that to fix the crash.\n\nI was not able to find a reason why an async version was used.\nath11k_mhi_start() (which enables state ATH11K_MHI_POWER_ON) is called from\nath11k_hif_power_up(), which can sleep. So sync version should be safe to use\nhere.\n\n[  145.569731] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI\n[  145.569789] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n[  145.569843] CPU: 2 PID: 1628 Comm: rmmod Kdump: loaded Tainted: G        W         5.16.0-wt-ath+ #567\n[  145.569898] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021\n[  145.569956] RIP: 0010:ath11k_hal_srng_access_begin+0xb5/0x2b0 [ath11k]\n[  145.570028] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ec 01 00 00 48 8b ab a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 \u003c0f\u003e b6 14 02 48 89 e8 83 e0 07 83 c0 03 45 85 ed 75 48 38 d0 7c 08\n[  145.570089] RSP: 0018:ffffc900025d7ac0 EFLAGS: 00010246\n[  145.570144] RAX: dffffc0000000000 RBX: ffff88814fca2dd8 RCX: 1ffffffff50cb455\n[  145.570196] RDX: 0000000000000000 RSI: ffff88814fca2dd8 RDI: ffff88814fca2e80\n[  145.570252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffa8659497\n[  145.570329] R10: fffffbfff50cb292 R11: 0000000000000001 R12: ffff88814fca0000\n[  145.570410] R13: 0000000000000000 R14: ffff88814fca2798 R15: ffff88814fca2dd8\n[  145.570465] FS:  00007fa399988540(0000) GS:ffff888233e00000(0000) knlGS:0000000000000000\n[  145.570519] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  145.570571] CR2: 00007fa399b51421 CR3: 0000000137898002 CR4: 00000000003706e0\n[  145.570623] Call Trace:\n[  145.570675]  \u003cTASK\u003e\n[  145.570727]  ? ath11k_ce_tx_process_cb+0x34b/0x860 [ath11k]\n[  145.570797]  ath11k_ce_tx_process_cb+0x356/0x860 [ath11k]\n[  145.570864]  ? tasklet_init+0x150/0x150\n[  145.570919]  ? ath11k_ce_alloc_pipes+0x280/0x280 [ath11k]\n[  145.570986]  ? tasklet_clear_sched+0x42/0xe0\n[  145.571042]  ? tasklet_kill+0xe9/0x1b0\n[  145.571095]  ? tasklet_clear_sched+0xe0/0xe0\n[  145.571148]  ? irq_has_action+0x120/0x120\n[  145.571202]  ath11k_ce_cleanup_pipes+0x45a/0x580 [ath11k]\n[  145.571270]  ? ath11k_pci_stop+0x10e/0x170 [ath11k_pci]\n[  145.571345]  ath11k_core_stop+0x8a/0xc0 [ath11k]\n[  145.571434]  ath11k_core_deinit+0x9e/0x150 [ath11k]\n[  145.571499]  ath11k_pci_remove+0xd2/0x260 [ath11k_pci]\n[  145.571553]  pci_device_remove+0x9a/0x1c0\n[  145.571605]  __device_release_driver+0x332/0x660\n[  145.571659]  driver_detach+0x1e7/0x2c0\n[  145.571712]  bus_remove_driver+0xe2/0x2d0\n[  145.571772]  pci_unregister_driver+0x21/0x250\n[  145.571826]  __do_sys_delete_module+0x30a/0x4b0\n[  145.571879]  ? free_module+0xac0/0xac0\n[  145.571933]  ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370\n[  145.571986]  ? syscall_enter_from_user_mode+0x1d/0x50\n[  145.572039]  ? lockdep_hardirqs_on+0x79/0x100\n[  145.572097]  do_syscall_64+0x3b/0x90\n[  145.572153]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d57d0e60-74ed-4fce-95e9-2a2a5f7e0db3",
      "id": "CVE-2021-47356",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible use-after-free in HFC_cleanup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0903e57d-a368-4f2c-bce9-3bdc99f266f7",
      "id": "CVE-2021-47387",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: schedutil: Use kobject release() method to free sugov_tunables\n\nThe struct sugov_tunables is protected by the kobject, so we can't free\nit directly. Otherwise we would get a call trace like this:\n  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30\n  WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100\n  Modules linked in:\n  CPU: 3 PID: 720 Comm: a.sh Tainted: G        W         5.14.0-rc1-next-20210715-yocto-standard+ #507\n  Hardware name: Marvell OcteonTX CN96XX board (DT)\n  pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)\n  pc : debug_print_object+0xb8/0x100\n  lr : debug_print_object+0xb8/0x100\n  sp : ffff80001ecaf910\n  x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80\n  x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000\n  x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20\n  x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010\n  x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365\n  x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69\n  x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0\n  x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001\n  x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000\n  x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000\n  Call trace:\n   debug_print_object+0xb8/0x100\n   __debug_check_no_obj_freed+0x1c0/0x230\n   debug_check_no_obj_freed+0x20/0x88\n   slab_free_freelist_hook+0x154/0x1c8\n   kfree+0x114/0x5d0\n   sugov_exit+0xbc/0xc0\n   cpufreq_exit_governor+0x44/0x90\n   cpufreq_set_policy+0x268/0x4a8\n   store_scaling_governor+0xe0/0x128\n   store+0xc0/0xf0\n   sysfs_kf_write+0x54/0x80\n   kernfs_fop_write_iter+0x128/0x1c0\n   new_sync_write+0xf0/0x190\n   vfs_write+0x2d4/0x478\n   ksys_write+0x74/0x100\n   __arm64_sys_write+0x24/0x30\n   invoke_syscall.constprop.0+0x54/0xe0\n   do_el0_svc+0x64/0x158\n   el0_svc+0x2c/0xb0\n   el0t_64_sync_handler+0xb0/0xb8\n   el0t_64_sync+0x198/0x19c\n  irq event stamp: 5518\n  hardirqs last  enabled at (5517): [\u003cffff8000100cbd7c\u003e] console_unlock+0x554/0x6c8\n  hardirqs last disabled at (5518): [\u003cffff800010fc0638\u003e] el1_dbg+0x28/0xa0\n  softirqs last  enabled at (5504): [\u003cffff8000100106e0\u003e] __do_softirq+0x4d0/0x6c0\n  softirqs last disabled at (5483): [\u003cffff800010049548\u003e] irq_exit+0x1b0/0x1b8\n\nSo split the original sugov_tunables_free() into two functions,\nsugov_clear_global_tunables() is just used to clear the global_tunables\nand the new sugov_tunables_free() is used as kobj_type::release to\nrelease the sugov_tunables safely.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af1ab616-7e5e-4212-9fe4-7eb9f21bb9cc",
      "id": "CVE-2021-47402",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: flower: protect fl_walk() with rcu\n\nPatch that refactored fl_walk() to use idr_for_each_entry_continue_ul()\nalso removed rcu protection of individual filters which causes following\nuse-after-free when filter is deleted concurrently. Fix fl_walk() to obtain\nrcu read lock while iterating and taking the filter reference and temporary\nrelease the lock while calling arg-\u003efn() callback that can sleep.\n\nKASAN trace:\n\n[  352.773640] ==================================================================\n[  352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]\n[  352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987\n\n[  352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2\n[  352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  352.781022] Call Trace:\n[  352.781573]  dump_stack_lvl+0x46/0x5a\n[  352.782332]  print_address_description.constprop.0+0x1f/0x140\n[  352.783400]  ? fl_walk+0x159/0x240 [cls_flower]\n[  352.784292]  ? fl_walk+0x159/0x240 [cls_flower]\n[  352.785138]  kasan_report.cold+0x83/0xdf\n[  352.785851]  ? fl_walk+0x159/0x240 [cls_flower]\n[  352.786587]  kasan_check_range+0x145/0x1a0\n[  352.787337]  fl_walk+0x159/0x240 [cls_flower]\n[  352.788163]  ? fl_put+0x10/0x10 [cls_flower]\n[  352.789007]  ? __mutex_unlock_slowpath.constprop.0+0x220/0x220\n[  352.790102]  tcf_chain_dump+0x231/0x450\n[  352.790878]  ? tcf_chain_tp_delete_empty+0x170/0x170\n[  352.791833]  ? __might_sleep+0x2e/0xc0\n[  352.792594]  ? tfilter_notify+0x170/0x170\n[  352.793400]  ? __mutex_unlock_slowpath.constprop.0+0x220/0x220\n[  352.794477]  tc_dump_tfilter+0x385/0x4b0\n[  352.795262]  ? tc_new_tfilter+0x1180/0x1180\n[  352.796103]  ? __mod_node_page_state+0x1f/0xc0\n[  352.796974]  ? __build_skb_around+0x10e/0x130\n[  352.797826]  netlink_dump+0x2c0/0x560\n[  352.798563]  ? netlink_getsockopt+0x430/0x430\n[  352.799433]  ? __mutex_unlock_slowpath.constprop.0+0x220/0x220\n[  352.800542]  __netlink_dump_start+0x356/0x440\n[  352.801397]  rtnetlink_rcv_msg+0x3ff/0x550\n[  352.802190]  ? tc_new_tfilter+0x1180/0x1180\n[  352.802872]  ? rtnl_calcit.isra.0+0x1f0/0x1f0\n[  352.803668]  ? tc_new_tfilter+0x1180/0x1180\n[  352.804344]  ? _copy_from_iter_nocache+0x800/0x800\n[  352.805202]  ? kasan_set_track+0x1c/0x30\n[  352.805900]  netlink_rcv_skb+0xc6/0x1f0\n[  352.806587]  ? rht_deferred_worker+0x6b0/0x6b0\n[  352.807455]  ? rtnl_calcit.isra.0+0x1f0/0x1f0\n[  352.808324]  ? netlink_ack+0x4d0/0x4d0\n[  352.809086]  ? netlink_deliver_tap+0x62/0x3d0\n[  352.809951]  netlink_unicast+0x353/0x480\n[  352.810744]  ? netlink_attachskb+0x430/0x430\n[  352.811586]  ? __alloc_skb+0xd7/0x200\n[  352.812349]  netlink_sendmsg+0x396/0x680\n[  352.813132]  ? netlink_unicast+0x480/0x480\n[  352.813952]  ? __import_iovec+0x192/0x210\n[  352.814759]  ? netlink_unicast+0x480/0x480\n[  352.815580]  sock_sendmsg+0x6c/0x80\n[  352.816299]  ____sys_sendmsg+0x3a5/0x3c0\n[  352.817096]  ? kernel_sendmsg+0x30/0x30\n[  352.817873]  ? __ia32_sys_recvmmsg+0x150/0x150\n[  352.818753]  ___sys_sendmsg+0xd8/0x140\n[  352.819518]  ? sendmsg_copy_msghdr+0x110/0x110\n[  352.820402]  ? ___sys_recvmsg+0xf4/0x1a0\n[  352.821110]  ? __copy_msghdr_from_user+0x260/0x260\n[  352.821934]  ? _raw_spin_lock+0x81/0xd0\n[  352.822680]  ? __handle_mm_fault+0xef3/0x1b20\n[  352.823549]  ? rb_insert_color+0x2a/0x270\n[  352.824373]  ? copy_page_range+0x16b0/0x16b0\n[  352.825209]  ? perf_event_update_userpage+0x2d0/0x2d0\n[  352.826190]  ? __fget_light+0xd9/0xf0\n[  352.826941]  __sys_sendmsg+0xb3/0x130\n[  352.827613]  ? __sys_sendmsg_sock+0x20/0x20\n[  352.828377]  ? do_user_addr_fault+0x2c5/0x8a0\n[  352.829184]  ? fpregs_assert_state_consistent+0x52/0x60\n[  352.830001]  ? exit_to_user_mode_prepare+0x32/0x160\n[  352.830845]  do_syscall_64+0x35/0x80\n[  352.831445]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[  352.832331] RIP: 0033:0x7f7bee973c17\n[ \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e45aad9c-33b1-402e-b56e-c81538f8e2d0",
      "id": "CVE-2021-47516",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: Fix memory leak in nfp_cpp_area_cache_add()\n\nIn line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a\nCPP area structure. But in line 807 (#2), when the cache is allocated\nfailed, this CPP area structure is not freed, which will result in\nmemory leak.\n\nWe can fix it by freeing the CPP area when the cache is allocated\nfailed (#2).\n\n792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size)\n793 {\n794 \tstruct nfp_cpp_area_cache *cache;\n795 \tstruct nfp_cpp_area *area;\n\n800\tarea = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0),\n801 \t\t\t\t  0, size);\n\t// #1: allocates and initializes\n\n802 \tif (!area)\n803 \t\treturn -ENOMEM;\n\n805 \tcache = kzalloc(sizeof(*cache), GFP_KERNEL);\n806 \tif (!cache)\n807 \t\treturn -ENOMEM; // #2: missing free\n\n817\treturn 0;\n818 }",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f652a293-4ed8-45cc-b50c-fbb7a0d8d42b",
      "id": "CVE-2021-47523",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr\n\nThis buffer is currently allocated in hfi1_init():\n\n\tif (reinit)\n\t\tret = init_after_reset(dd);\n\telse\n\t\tret = loadtime_init(dd);\n\tif (ret)\n\t\tgoto done;\n\n\t/* allocate dummy tail memory for all receive contexts */\n\tdd-\u003ercvhdrtail_dummy_kvaddr = dma_alloc_coherent(\u0026dd-\u003epcidev-\u003edev,\n\t\t\t\t\t\t\t sizeof(u64),\n\t\t\t\t\t\t\t \u0026dd-\u003ercvhdrtail_dummy_dma,\n\t\t\t\t\t\t\t GFP_KERNEL);\n\n\tif (!dd-\u003ercvhdrtail_dummy_kvaddr) {\n\t\tdd_dev_err(dd, \"cannot allocate dummy tail memory\\n\");\n\t\tret = -ENOMEM;\n\t\tgoto done;\n\t}\n\nThe reinit triggered path will overwrite the old allocation and leak it.\n\nFix by moving the allocation to hfi1_alloc_devdata() and the deallocation\nto hfi1_free_devdata().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58d87019-aa60-44e8-9f75-d39cc37cbf03",
      "id": "CVE-2021-47620",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: refactor malicious adv data check\n\nCheck for out-of-bound read was being performed at the end of while\nnum_reports loop, and would fill journal with false positives. Added\ncheck to beginning of loop processing so that it doesn't get checked\nafter ptr has been advanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65e1650d-3fe1-466c-9894-69c71d0218a2",
      "id": "CVE-2021-47624",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change\n\nThe refcount leak issues take place in an error handling path. When the\n3rd argument buf doesn't match with \"offline\", \"online\" or \"remove\", the\nfunction simply returns -EINVAL and forgets to decrease the reference\ncount of a rpc_xprt object and a rpc_xprt_switch object increased by\nrpc_sysfs_xprt_kobj_get_xprt() and\nrpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of\nboth unused objects.\n\nFix this issue by jumping to the error handling path labelled with\nout_put when buf matches none of \"offline\", \"online\" or \"remove\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8aa43c8-1d9f-49a6-861c-2cebef2c2e54",
      "id": "CVE-2023-52516",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock\n\n__dma_entry_alloc_check_leak() calls into printk -\u003e serial console\noutput (qcom geni) and grabs port-\u003elock under free_entries_lock\nspin lock, which is a reverse locking dependency chain as qcom_geni\nIRQ handler can call into dma-debug code and grab free_entries_lock\nunder port-\u003elock.\n\nMove __dma_entry_alloc_check_leak() call out of free_entries_lock\nscope so that we don't acquire serial console's port-\u003elock under it.\n\nTrimmed-down lockdep splat:\n\n The existing dependency chain (in reverse order) is:\n\n               -\u003e #2 (free_entries_lock){-.-.}-{2:2}:\n        _raw_spin_lock_irqsave+0x60/0x80\n        dma_entry_alloc+0x38/0x110\n        debug_dma_map_page+0x60/0xf8\n        dma_map_page_attrs+0x1e0/0x230\n        dma_map_single_attrs.constprop.0+0x6c/0xc8\n        geni_se_rx_dma_prep+0x40/0xcc\n        qcom_geni_serial_isr+0x310/0x510\n        __handle_irq_event_percpu+0x110/0x244\n        handle_irq_event_percpu+0x20/0x54\n        handle_irq_event+0x50/0x88\n        handle_fasteoi_irq+0xa4/0xcc\n        handle_irq_desc+0x28/0x40\n        generic_handle_domain_irq+0x24/0x30\n        gic_handle_irq+0xc4/0x148\n        do_interrupt_handler+0xa4/0xb0\n        el1_interrupt+0x34/0x64\n        el1h_64_irq_handler+0x18/0x24\n        el1h_64_irq+0x64/0x68\n        arch_local_irq_enable+0x4/0x8\n        ____do_softirq+0x18/0x24\n        ...\n\n               -\u003e #1 (\u0026port_lock_key){-.-.}-{2:2}:\n        _raw_spin_lock_irqsave+0x60/0x80\n        qcom_geni_serial_console_write+0x184/0x1dc\n        console_flush_all+0x344/0x454\n        console_unlock+0x94/0xf0\n        vprintk_emit+0x238/0x24c\n        vprintk_default+0x3c/0x48\n        vprintk+0xb4/0xbc\n        _printk+0x68/0x90\n        register_console+0x230/0x38c\n        uart_add_one_port+0x338/0x494\n        qcom_geni_serial_probe+0x390/0x424\n        platform_probe+0x70/0xc0\n        really_probe+0x148/0x280\n        __driver_probe_device+0xfc/0x114\n        driver_probe_device+0x44/0x100\n        __device_attach_driver+0x64/0xdc\n        bus_for_each_drv+0xb0/0xd8\n        __device_attach+0xe4/0x140\n        device_initial_probe+0x1c/0x28\n        bus_probe_device+0x44/0xb0\n        device_add+0x538/0x668\n        of_device_add+0x44/0x50\n        of_platform_device_create_pdata+0x94/0xc8\n        of_platform_bus_create+0x270/0x304\n        of_platform_populate+0xac/0xc4\n        devm_of_platform_populate+0x60/0xac\n        geni_se_probe+0x154/0x160\n        platform_probe+0x70/0xc0\n        ...\n\n               -\u003e #0 (console_owner){-...}-{0:0}:\n        __lock_acquire+0xdf8/0x109c\n        lock_acquire+0x234/0x284\n        console_flush_all+0x330/0x454\n        console_unlock+0x94/0xf0\n        vprintk_emit+0x238/0x24c\n        vprintk_default+0x3c/0x48\n        vprintk+0xb4/0xbc\n        _printk+0x68/0x90\n        dma_entry_alloc+0xb4/0x110\n        debug_dma_map_sg+0xdc/0x2f8\n        __dma_map_sg_attrs+0xac/0xe4\n        dma_map_sgtable+0x30/0x4c\n        get_pages+0x1d4/0x1e4 [msm]\n        msm_gem_pin_pages_locked+0x38/0xac [msm]\n        msm_gem_pin_vma_locked+0x58/0x88 [msm]\n        msm_ioctl_gem_submit+0xde4/0x13ac [msm]\n        drm_ioctl_kernel+0xe0/0x15c\n        drm_ioctl+0x2e8/0x3f4\n        vfs_ioctl+0x30/0x50\n        ...\n\n Chain exists of:\n   console_owner --\u003e \u0026port_lock_key --\u003e free_entries_lock\n\n  Possible unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n   lock(free_entries_lock);\n                                lock(\u0026port_lock_key);\n                                lock(free_entries_lock);\n   lock(console_owner);\n\n                *** DEADLOCK ***\n\n Call trace:\n  dump_backtrace+0xb4/0xf0\n  show_stack+0x20/0x30\n  dump_stack_lvl+0x60/0x84\n  dump_stack+0x18/0x24\n  print_circular_bug+0x1cc/0x234\n  check_noncircular+0x78/0xac\n  __lock_acquire+0xdf8/0x109c\n  lock_acquire+0x234/0x284\n  console_flush_all+0x330/0x454\n  consol\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3ff5bc8-f176-4bec-ba7a-1dc312be479e",
      "id": "CVE-2022-50407",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - increase the memory of local variables\n\nIncrease the buffer to prevent stack overflow by fuzz test. The maximum\nlength of the qos configuration buffer is 256 bytes. Currently, the value\nof the 'val buffer' is only 32 bytes. The sscanf does not check the dest\nmemory length. So the 'val buffer' may stack overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "305d602a-8b58-4991-8cad-c5d2e221413b",
      "id": "CVE-2021-47651",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: rpmpd: Check for null return of devm_kcalloc\n\nBecause of the possible failure of the allocation, data-\u003edomains might\nbe NULL pointer and will cause the dereference of the NULL pointer\nlater.\nTherefore, it might be better to check it and directly return -ENOMEM\nwithout releasing data manually if fails, because the comment of the\ndevm_kmalloc() says \"Memory allocated with this function is\nautomatically freed on driver detach.\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76cdd47b-7cf9-4256-a0f7-ef17ae4517cb",
      "id": "CVE-2021-47652",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()\n\nI got a null-ptr-deref report:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\nRIP: 0010:fb_destroy_modelist+0x38/0x100\n...\nCall Trace:\n ufx_usb_probe.cold+0x2b5/0xac1 [smscufx]\n usb_probe_interface+0x1aa/0x3c0 [usbcore]\n really_probe+0x167/0x460\n...\n ret_from_fork+0x1f/0x30\n\nIf fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will\nbe called to destroy modelist in the error handling path. But modelist\nhas not been initialized yet, so it will result in null-ptr-deref.\n\nInitialize modelist before calling fb_alloc_cmap() to fix this bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd003d0d-7ebe-47ad-adb9-14513443643d",
      "id": "CVE-2022-0322",
      "description": "A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e069a718-1281-447b-924f-da832f15d49e",
      "id": "CVE-2022-1016",
      "description": "A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "80dffced-2469-4003-aa2f-d8ca64d957ae",
      "id": "CVE-2022-49325",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add accessors to read/set tp-\u003esnd_cwnd\n\nWe had various bugs over the years with code\nbreaking the assumption that tp-\u003esnd_cwnd is greater\nthan zero.\n\nLately, syzbot reported the WARN_ON_ONCE(!tp-\u003eprior_cwnd) added\nin commit 8b8a321ff72c (\"tcp: fix zero cwnd in tcp_cwnd_reduction\")\ncan trigger, and without a repro we would have to spend\nconsiderable time finding the bug.\n\nInstead of complaining too late, we want to catch where\nand when tp-\u003esnd_cwnd is set to an illegal value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1bac3376-bc61-4936-8a2e-cef40e47df02",
      "id": "CVE-2022-24448",
      "description": "An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a70037e0-9083-4b41-ac07-dbd8b36f1f23",
      "id": "CVE-2022-49331",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling\n\nError paths do not free previously allocated memory. Add devm_kfree() to\nthose failure paths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71457abd-a2cb-47f2-90e6-ea60fedfd069",
      "id": "CVE-2022-2978",
      "description": "A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4f35299-cae6-4561-ad32-c4e7ea563315",
      "id": "CVE-2022-41674",
      "description": "An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f96da13-a4cf-4702-88e8-a5629e323d5b",
      "id": "CVE-2022-48701",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()\n\nThere may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and\nthe number of it's interfaces less than 4, an out-of-bounds read bug occurs\nwhen parsing the interface descriptor for this device.\n\nFix this by checking the number of interfaces.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "358990a0-f6ee-4c3d-b0b8-541a5aa2336f",
      "id": "CVE-2022-48771",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix stale file descriptors on failed usercopy\n\nA failing usercopy of the fence_rep object will lead to a stale entry in\nthe file descriptor table as put_unused_fd() won't release it. This\nenables userland to refer to a dangling 'file' object through that still\nvalid file descriptor, leading to all kinds of use-after-free\nexploitation scenarios.\n\nFix this by deferring the call to fd_install() until after the usercopy\nhas succeeded.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34dc6582-df09-486b-a6ea-6f3a2a35a16b",
      "id": "CVE-2022-49368",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()\n\nThe \"fsp-\u003elocation\" variable comes from user via ethtool_get_rxnfc().\nCheck that it is valid to prevent an out of bounds read.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9e60827-a0f5-4797-a694-b7e4169c7bcc",
      "id": "CVE-2022-48827",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix the behavior of READ near OFFSET_MAX\n\nDan Aloni reports:\n\u003e Due to commit 8cfb9015280d (\"NFS: Always provide aligned buffers to\n\u003e the RPC read layers\") on the client, a read of 0xfff is aligned up\n\u003e to server rsize of 0x1000.\n\u003e\n\u003e As a result, in a test where the server has a file of size\n\u003e 0x7fffffffffffffff, and the client tries to read from the offset\n\u003e 0x7ffffffffffff000, the read causes loff_t overflow in the server\n\u003e and it returns an NFS code of EINVAL to the client. The client as\n\u003e a result indefinitely retries the request.\n\nThe Linux NFS client does not handle NFS?ERR_INVAL, even though all\nNFS specifications permit servers to return that status code for a\nREAD.\n\nInstead of NFS?ERR_INVAL, have out-of-range READ requests succeed\nand return a short result. Set the EOF flag in the result to prevent\nthe client from retrying the READ request. This behavior appears to\nbe consistent with Solaris NFS servers.\n\nNote that NFSv3 and NFSv4 use u64 offset values on the wire. These\nmust be converted to loff_t internally before use -- an implicit\ntype cast is not adequate for this purpose. Otherwise VFS checks\nagainst sb-\u003es_maxbytes do not work properly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36b56115-545f-43be-b8ce-03d9d0995b98",
      "id": "CVE-2022-48852",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Unregister codec device on unbind\n\nOn bind we will register the HDMI codec device but we don't unregister\nit on unbind, leading to a device leakage. Unregister our device at\nunbind.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "418fc3e4-437a-4cd9-b1b0-228494231462",
      "id": "CVE-2022-49074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3: Fix GICR_CTLR.RWP polling\n\nIt turns out that our polling of RWP is totally wrong when checking\nfor it in the redistributors, as we test the *distributor* bit index,\nwhereas it is a different bit number in the RDs... Oopsie boo.\n\nThis is embarassing. Not only because it is wrong, but also because\nit took *8 years* to notice the blunder...\n\nJust fix the damn thing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f409140f-7dbc-4977-971d-53908ff3eb08",
      "id": "CVE-2022-49121",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix tag leaks on error\n\nIn pm8001_chip_set_dev_state_req(), pm8001_chip_fw_flash_update_req(),\npm80xx_chip_phy_ctl_req() and pm8001_chip_reg_dev_req() add missing calls\nto pm8001_tag_free() to free the allocated tag when pm8001_mpi_build_cmd()\nfails.\n\nSimilarly, in pm8001_exec_internal_task_abort(), if the chip -\u003etask_abort\nmethod fails, the tag allocated for the abort request task must be\nfreed. Add the missing call to pm8001_tag_free().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71fe5c07-47a6-47f2-9d9d-944f4000720f",
      "id": "CVE-2022-49411",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: Make sure bfqg for which we are queueing requests is online\n\nBios queued into BFQ IO scheduler can be associated with a cgroup that\nwas already offlined. This may then cause insertion of this bfq_group\ninto a service tree. But this bfq_group will get freed as soon as last\nbio associated with it is completed leading to use after free issues for\nservice tree users. Fix the problem by making sure we always operate on\nonline bfq_group. If the bfq_group associated with the bio is not\nonline, we pick the first online parent.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ffc6a8f-5c7d-4a15-89bd-9a5148a2c5d9",
      "id": "CVE-2022-49445",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()\n\nIt will cause null-ptr-deref when using 'res', if platform_get_resource()\nreturns NULL, so move using 'res' after devm_ioremap_resource() that\nwill check it to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8dd13902-3e87-4c04-bfcc-2a1186a2b846",
      "id": "CVE-2022-49501",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Run unregister_netdev() before unbind() again\n\nCommit 2c9d6c2b871d (\"usbnet: run unbind() before unregister_netdev()\")\nsought to fix a use-after-free on disconnect of USB Ethernet adapters.\n\nIt turns out that a different fix is necessary to address the issue:\nhttps://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/\n\nSo the commit was not necessary.\n\nThe commit made binding and unbinding of USB Ethernet asymmetrical:\nBefore, usbnet_probe() first invoked the -\u003ebind() callback and then\nregister_netdev().  usbnet_disconnect() mirrored that by first invoking\nunregister_netdev() and then -\u003eunbind().\n\nSince the commit, the order in usbnet_disconnect() is reversed and no\nlonger mirrors usbnet_probe().\n\nOne consequence is that a PHY disconnected (and stopped) in -\u003eunbind()\nis afterwards stopped once more by unregister_netdev() as it closes the\nnetdev before unregistering.  That necessitates a contortion in -\u003estop()\nbecause the PHY may only be stopped if it hasn't already been\ndisconnected.\n\nReverting the commit allows making the call to phy_stop() unconditional\nin -\u003estop().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "178b4a09-f303-4f54-a37a-4c000f8c5650",
      "id": "CVE-2022-49544",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipw2x00: Fix potential NULL dereference in libipw_xmit()\n\ncrypt and crypt-\u003eops could be null, so we need to checking null\nbefore dereference",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d473d51-b968-41fd-9186-af55a2960303",
      "id": "CVE-2022-49581",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: Fix buffer overflow in be_get_module_eeprom\n\nbe_cmd_read_port_transceiver_data assumes that it is given a buffer that\nis at least PAGE_DATA_LEN long, or twice that if the module supports SFF\n8472. However, this is not always the case.\n\nFix this by passing the desired offset and length to\nbe_cmd_read_port_transceiver_data so that we only copy the bytes once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a890de3e-3b3b-462a-b4c0-4e45c9859221",
      "id": "CVE-2022-49668",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nThis function only calls of_node_put() in normal path,\nmissing it in error paths.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bbd4322-2f62-4167-aa8c-8707393ebfee",
      "id": "CVE-2022-49765",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: use a dedicated spinlock for trans_fd\n\nShamelessly copying the explanation from Tetsuo Handa's suggested\npatch[1] (slightly reworded):\nsyzbot is reporting inconsistent lock state in p9_req_put()[2],\nfor p9_tag_remove() from p9_req_put() from IRQ context is using\nspin_lock_irqsave() on \"struct p9_client\"-\u003elock but trans_fd\n(not from IRQ context) is using spin_lock().\n\nSince the locks actually protect different things in client.c and in\ntrans_fd.c, just replace trans_fd.c's lock by a new one specific to the\ntransport (client.c's protect the idr for fid/tag allocations,\nwhile trans_fd.c's protects its own req list and request status field\nthat acts as the transport's state machine)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b69c3fe-61ef-406a-93ef-4b15d25b8ec1",
      "id": "CVE-2022-49779",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case\n\nIn __unregister_kprobe_top(), if the currently unregistered probe has\npost_handler but other child probes of the aggrprobe do not have\npost_handler, the post_handler of the aggrprobe is cleared. If this is\na ftrace-based probe, there is a problem. In later calls to\ndisarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is\nNULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in\n__disarm_kprobe_ftrace() and may even cause use-after-free:\n\n  Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2)\n  WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0\n  Modules linked in: testKprobe_007(-)\n  CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18\n  [...]\n  Call Trace:\n   \u003cTASK\u003e\n   __disable_kprobe+0xcd/0xe0\n   __unregister_kprobe_top+0x12/0x150\n   ? mutex_lock+0xe/0x30\n   unregister_kprobes.part.23+0x31/0xa0\n   unregister_kprobe+0x32/0x40\n   __x64_sys_delete_module+0x15e/0x260\n   ? do_user_addr_fault+0x2cd/0x6b0\n   do_syscall_64+0x3a/0x90\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n   [...]\n\nFor the kprobe-on-ftrace case, we keep the post_handler setting to\nidentify this aggrprobe armed with kprobe_ipmodify_ops. This way we\ncan disarm it correctly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b7aabff-6a9a-4813-b0d1-7184c9db9380",
      "id": "CVE-2022-49841",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: imx: Add missing .thaw_noirq hook\n\nThe following warning is seen with non-console UART instance when\nsystem hibernates.\n\n[   37.371969] ------------[ cut here ]------------\n[   37.376599] uart3_root_clk already disabled\n[   37.380810] WARNING: CPU: 0 PID: 296 at drivers/clk/clk.c:952 clk_core_disable+0xa4/0xb0\n...\n[   37.506986] Call trace:\n[   37.509432]  clk_core_disable+0xa4/0xb0\n[   37.513270]  clk_disable+0x34/0x50\n[   37.516672]  imx_uart_thaw+0x38/0x5c\n[   37.520250]  platform_pm_thaw+0x30/0x6c\n[   37.524089]  dpm_run_callback.constprop.0+0x3c/0xd4\n[   37.528972]  device_resume+0x7c/0x160\n[   37.532633]  dpm_resume+0xe8/0x230\n[   37.536036]  hibernation_snapshot+0x288/0x430\n[   37.540397]  hibernate+0x10c/0x2e0\n[   37.543798]  state_store+0xc4/0xd0\n[   37.547203]  kobj_attr_store+0x1c/0x30\n[   37.550953]  sysfs_kf_write+0x48/0x60\n[   37.554619]  kernfs_fop_write_iter+0x118/0x1ac\n[   37.559063]  new_sync_write+0xe8/0x184\n[   37.562812]  vfs_write+0x230/0x290\n[   37.566214]  ksys_write+0x68/0xf4\n[   37.569529]  __arm64_sys_write+0x20/0x2c\n[   37.573452]  invoke_syscall.constprop.0+0x50/0xf0\n[   37.578156]  do_el0_svc+0x11c/0x150\n[   37.581648]  el0_svc+0x30/0x140\n[   37.584792]  el0t_64_sync_handler+0xe8/0xf0\n[   37.588976]  el0t_64_sync+0x1a0/0x1a4\n[   37.592639] ---[ end trace 56e22eec54676d75 ]---\n\nOn hibernating, pm core calls into related hooks in sequence like:\n\n    .freeze\n    .freeze_noirq\n    .thaw_noirq\n    .thaw\n\nWith .thaw_noirq hook being absent, the clock will be disabled in a\nunbalanced call which results the warning above.\n\n    imx_uart_freeze()\n        clk_prepare_enable()\n    imx_uart_suspend_noirq()\n        clk_disable()\n    imx_uart_thaw\n        clk_disable_unprepare()\n\nAdding the missing .thaw_noirq hook as imx_uart_resume_noirq() will have\nthe call sequence corrected as below and thus fix the warning.\n\n    imx_uart_freeze()\n        clk_prepare_enable()\n    imx_uart_suspend_noirq()\n        clk_disable()\n    imx_uart_resume_noirq()\n        clk_enable()\n    imx_uart_thaw\n        clk_disable_unprepare()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2fc9a6a8-2b19-4f01-91c3-3d2264470d30",
      "id": "CVE-2022-49842",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: core: Fix use-after-free in snd_soc_exit()\n\nKASAN reports a use-after-free:\n\nBUG: KASAN: use-after-free in device_del+0xb5b/0xc60\nRead of size 8 at addr ffff888008655050 by task rmmod/387\nCPU: 2 PID: 387 Comm: rmmod\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x79/0x9a\nprint_report+0x17f/0x47b\nkasan_report+0xbb/0xf0\ndevice_del+0xb5b/0xc60\nplatform_device_del.part.0+0x24/0x200\nplatform_device_unregister+0x2e/0x40\nsnd_soc_exit+0xa/0x22 [snd_soc_core]\n__do_sys_delete_module.constprop.0+0x34f/0x5b0\ndo_syscall_64+0x3a/0x90\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n...\n\u003c/TASK\u003e\n\nIt's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail,\nbut its ret is ignored, which makes soc_dummy_dev unregistered twice.\n\nsnd_soc_init()\n    snd_soc_util_init()\n        platform_device_register_simple(soc_dummy_dev)\n        platform_driver_register() # fail\n    \tplatform_device_unregister(soc_dummy_dev)\n    platform_driver_register() # success\n...\nsnd_soc_exit()\n    snd_soc_util_exit()\n    # soc_dummy_dev will be unregistered for second time\n\nTo fix it, handle error and stop snd_soc_init() when util_init() fail.\nAlso clean debugfs when util_init() or driver_register() fail.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cba6e38f-b90f-4826-ab0e-5f731a77a6db",
      "id": "CVE-2023-53229",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta\n\nAvoid potential data corruption issues caused by uninitialized driver\nprivate data structures.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ef1b67e-e11f-46d3-9f2e-802d97774bf8",
      "id": "CVE-2022-49890",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncapabilities: fix potential memleak on error path from vfs_getxattr_alloc()\n\nIn cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to\ncomplete the memory allocation of tmpbuf, if we have completed\nthe memory allocation of tmpbuf, but failed to call handler-\u003eget(...),\nthere will be a memleak in below logic:\n\n  |-- ret = (int)vfs_getxattr_alloc(mnt_userns, ...)\n    |           /* ^^^ alloc for tmpbuf */\n    |-- value = krealloc(*xattr_value, error + 1, flags)\n    |           /* ^^^ alloc memory */\n    |-- error = handler-\u003eget(handler, ...)\n    |           /* error! */\n    |-- *xattr_value = value\n    |           /* xattr_value is \u0026tmpbuf (memory leak!) */\n\nSo we will try to free(tmpbuf) after vfs_getxattr_alloc() fails to fix it.\n\n[PM: subject line and backtrace tweaks]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb781196-1785-4952-960e-aa4b7f9e7c60",
      "id": "CVE-2022-49898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix tree mod log mishandling of reallocated nodes\n\nWe have been seeing the following panic in production\n\n  kernel BUG at fs/btrfs/tree-mod-log.c:677!\n  invalid opcode: 0000 [#1] SMP\n  RIP: 0010:tree_mod_log_rewind+0x1b4/0x200\n  RSP: 0000:ffffc9002c02f890 EFLAGS: 00010293\n  RAX: 0000000000000003 RBX: ffff8882b448c700 RCX: 0000000000000000\n  RDX: 0000000000008000 RSI: 00000000000000a7 RDI: ffff88877d831c00\n  RBP: 0000000000000002 R08: 000000000000009f R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000100c40 R12: 0000000000000001\n  R13: ffff8886c26d6a00 R14: ffff88829f5424f8 R15: ffff88877d831a00\n  FS:  00007fee1d80c780(0000) GS:ffff8890400c0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fee1963a020 CR3: 0000000434f33002 CR4: 00000000007706e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n   btrfs_get_old_root+0x12b/0x420\n   btrfs_search_old_slot+0x64/0x2f0\n   ? tree_mod_log_oldest_root+0x3d/0xf0\n   resolve_indirect_ref+0xfd/0x660\n   ? ulist_alloc+0x31/0x60\n   ? kmem_cache_alloc_trace+0x114/0x2c0\n   find_parent_nodes+0x97a/0x17e0\n   ? ulist_alloc+0x30/0x60\n   btrfs_find_all_roots_safe+0x97/0x150\n   iterate_extent_inodes+0x154/0x370\n   ? btrfs_search_path_in_tree+0x240/0x240\n   iterate_inodes_from_logical+0x98/0xd0\n   ? btrfs_search_path_in_tree+0x240/0x240\n   btrfs_ioctl_logical_to_ino+0xd9/0x180\n   btrfs_ioctl+0xe2/0x2ec0\n   ? __mod_memcg_lruvec_state+0x3d/0x280\n   ? do_sys_openat2+0x6d/0x140\n   ? kretprobe_dispatcher+0x47/0x70\n   ? kretprobe_rethook_handler+0x38/0x50\n   ? rethook_trampoline_handler+0x82/0x140\n   ? arch_rethook_trampoline_callback+0x3b/0x50\n   ? kmem_cache_free+0xfb/0x270\n   ? do_sys_openat2+0xd5/0x140\n   __x64_sys_ioctl+0x71/0xb0\n   do_syscall_64+0x2d/0x40\n\nWhich is this code in tree_mod_log_rewind()\n\n\tswitch (tm-\u003eop) {\n        case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING:\n\t\tBUG_ON(tm-\u003eslot \u003c n);\n\nThis occurs because we replay the nodes in order that they happened, and\nwhen we do a REPLACE we will log a REMOVE_WHILE_FREEING for every slot,\nstarting at 0.  'n' here is the number of items in this block, which in\nthis case was 1, but we had 2 REMOVE_WHILE_FREEING operations.\n\nThe actual root cause of this was that we were replaying operations for\na block that shouldn't have been replayed.  Consider the following\nsequence of events\n\n1. We have an already modified root, and we do a btrfs_get_tree_mod_seq().\n2. We begin removing items from this root, triggering KEY_REPLACE for\n   it's child slots.\n3. We remove one of the 2 children this root node points to, thus triggering\n   the root node promotion of the remaining child, and freeing this node.\n4. We modify a new root, and re-allocate the above node to the root node of\n   this other root.\n\nThe tree mod log looks something like this\n\n\tlogical 0\top KEY_REPLACE (slot 1)\t\t\tseq 2\n\tlogical 0\top KEY_REMOVE (slot 1)\t\t\tseq 3\n\tlogical 0\top KEY_REMOVE_WHILE_FREEING (slot 0)\tseq 4\n\tlogical 4096\top LOG_ROOT_REPLACE (old logical 0)\tseq 5\n\tlogical 8192\top KEY_REMOVE_WHILE_FREEING (slot 1)\tseq 6\n\tlogical 8192\top KEY_REMOVE_WHILE_FREEING (slot 0)\tseq 7\n\tlogical 0\top LOG_ROOT_REPLACE (old logical 8192)\tseq 8\n\n\u003eFrom here the bug is triggered by the following steps\n\n1.  Call btrfs_get_old_root() on the new_root.\n2.  We call tree_mod_log_oldest_root(btrfs_root_node(new_root)), which is\n    currently logical 0.\n3.  tree_mod_log_oldest_root() calls tree_mod_log_search_oldest(), which\n    gives us the KEY_REPLACE seq 2, and since that's not a\n    LOG_ROOT_REPLACE we incorrectly believe that we don't have an old\n    root, because we expect that the most recent change should be a\n    LOG_ROOT_REPLACE.\n4.  Back in tree_mod_log_oldest_root() we don't have a LOG_ROOT_REPLACE,\n    so we don't set old_root, we simply use our e\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d2826ec-e6c2-49f8-8234-aed9a5e0dde3",
      "id": "CVE-2022-50025",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix a memory leak in an error handling path\n\nA bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the\nerror handling path of afu_allocate_irqs().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a99cc9e-6709-4461-ba6b-ff94fb1458b9",
      "id": "CVE-2022-50129",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix a use-after-free\n\nChange the LIO port members inside struct srpt_port from regular members\ninto pointers. Allocate the LIO port data structures from inside\nsrpt_make_tport() and free these from inside srpt_make_tport(). Keep\nstruct srpt_device as long as either an RDMA port or a LIO target port is\nassociated with it. This patch decouples the lifetime of struct srpt_port\n(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).\nThis patch fixes the following KASAN complaint:\n\n  BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]\n  Read of size 8 at addr ffff888141cc34b8 by task check/5093\n\n  Call Trace:\n   \u003cTASK\u003e\n   show_stack+0x4e/0x53\n   dump_stack_lvl+0x51/0x66\n   print_address_description.constprop.0.cold+0xea/0x41e\n   print_report.cold+0x90/0x205\n   kasan_report+0xb9/0xf0\n   __asan_load8+0x69/0x90\n   srpt_enable_tpg+0x31/0x70 [ib_srpt]\n   target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod]\n   configfs_write_iter+0x18b/0x210\n   new_sync_write+0x1f2/0x2f0\n   vfs_write+0x3e3/0x540\n   ksys_write+0xbb/0x140\n   __x64_sys_write+0x42/0x50\n   do_syscall_64+0x34/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n   \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce386a24-be7f-44ab-9e03-051c5e75b8a2",
      "id": "CVE-2022-50134",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: fix potential memory leak in setup_base_ctxt()\n\nsetup_base_ctxt() allocates a memory chunk for uctxt-\u003egroups with\nhfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt-\u003egroups\nis not released, which will lead to a memory leak.\n\nWe should release the uctxt-\u003egroups with hfi1_free_ctxt_rcv_groups()\nwhen init_user_ctxt() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d90dd82-3e1d-4db4-89c5-49afc409807a",
      "id": "CVE-2022-50161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: maps: Fix refcount leak in of_flash_probe_versatile\n\nof_find_matching_node_and_match() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98a3e8b9-f06e-44bf-8c59-5086429dcc1e",
      "id": "CVE-2024-46860",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change\n\nWhen disabling wifi mt7921_ipv6_addr_change() is called as a notifier.\nAt this point mvif-\u003ephy is already NULL so we cannot use it here.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c4e029c-0399-4d8c-a8d5-765694bbd71c",
      "id": "CVE-2022-50261",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed. A\nproposed warning in clang aims to catch these at compile time, which\nreveals:\n\n  drivers/gpu/drm/sti/sti_hda.c:637:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n          .mode_valid = sti_hda_connector_mode_valid,\n                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~\n  drivers/gpu/drm/sti/sti_dvo.c:376:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n          .mode_valid = sti_dvo_connector_mode_valid,\n                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~\n  drivers/gpu/drm/sti/sti_hdmi.c:1035:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n          .mode_valid = sti_hdmi_connector_mode_valid,\n                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n-\u003emode_valid() in 'struct drm_connector_helper_funcs' expects a return\ntype of 'enum drm_mode_status', not 'int'. Adjust the return type of\nsti_{dvo,hda,hdmi}_connector_mode_valid() to match the prototype's to\nresolve the warning and CFI failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c2d0c4f-7902-49dc-926d-32ec4a56a590",
      "id": "CVE-2022-50352",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns: fix possible memory leak in hnae_ae_register()\n\nInject fault while probing module, if device_register() fails,\nbut the refcount of kobject is not decreased to 0, the name\nallocated in dev_set_name() is leaked. Fix this by calling\nput_device(), so that name can be freed in callback function\nkobject_cleanup().\n\nunreferenced object 0xffff00c01aba2100 (size 128):\n  comm \"systemd-udevd\", pid 1259, jiffies 4294903284 (age 294.152s)\n  hex dump (first 32 bytes):\n    68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff  hnae0....!......\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000034783f26\u003e] slab_post_alloc_hook+0xa0/0x3e0\n    [\u003c00000000748188f2\u003e] __kmem_cache_alloc_node+0x164/0x2b0\n    [\u003c00000000ab0743e8\u003e] __kmalloc_node_track_caller+0x6c/0x390\n    [\u003c000000006c0ffb13\u003e] kvasprintf+0x8c/0x118\n    [\u003c00000000fa27bfe1\u003e] kvasprintf_const+0x60/0xc8\n    [\u003c0000000083e10ed7\u003e] kobject_set_name_vargs+0x3c/0xc0\n    [\u003c000000000b87affc\u003e] dev_set_name+0x7c/0xa0\n    [\u003c000000003fd8fe26\u003e] hnae_ae_register+0xcc/0x190 [hnae]\n    [\u003c00000000fe97edc9\u003e] hns_dsaf_ae_init+0x9c/0x108 [hns_dsaf]\n    [\u003c00000000c36ff1eb\u003e] hns_dsaf_probe+0x548/0x748 [hns_dsaf]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f2afceb9-e217-4fd2-ae48-4b8dbea5507e",
      "id": "CVE-2022-50388",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix multipath crash caused by flush request when blktrace is enabled\n\nThe flush request initialized by blk_kick_flush has NULL bio,\nand it may be dealt with nvme_end_req during io completion.\nWhen blktrace is enabled, nvme_trace_bio_complete with multipath\nactivated trying to access NULL pointer bio from flush request\nresults in the following crash:\n\n[ 2517.831677] BUG: kernel NULL pointer dereference, address: 000000000000001a\n[ 2517.835213] #PF: supervisor read access in kernel mode\n[ 2517.838724] #PF: error_code(0x0000) - not-present page\n[ 2517.842222] PGD 7b2d51067 P4D 0\n[ 2517.845684] Oops: 0000 [#1] SMP NOPTI\n[ 2517.849125] CPU: 2 PID: 732 Comm: kworker/2:1H Kdump: loaded Tainted: G S                5.15.67-0.cl9.x86_64 #1\n[ 2517.852723] Hardware name: XFUSION 2288H V6/BC13MBSBC, BIOS 1.13 07/27/2022\n[ 2517.856358] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp]\n[ 2517.859993] RIP: 0010:blk_add_trace_bio_complete+0x6/0x30\n[ 2517.863628] Code: 1f 44 00 00 48 8b 46 08 31 c9 ba 04 00 10 00 48 8b 80 50 03 00 00 48 8b 78 50 e9 e5 fe ff ff 0f 1f 44 00 00 41 54 49 89 f4 55 \u003c0f\u003e b6 7a 1a 48 89 d5 e8 3e 1c 2b 00 48 89 ee 4c 89 e7 5d 89 c1 ba\n[ 2517.871269] RSP: 0018:ff7f6a008d9dbcd0 EFLAGS: 00010286\n[ 2517.875081] RAX: ff3d5b4be00b1d50 RBX: 0000000002040002 RCX: ff3d5b0a270f2000\n[ 2517.878966] RDX: 0000000000000000 RSI: ff3d5b0b021fb9f8 RDI: 0000000000000000\n[ 2517.882849] RBP: ff3d5b0b96a6fa00 R08: 0000000000000001 R09: 0000000000000000\n[ 2517.886718] R10: 000000000000000c R11: 000000000000000c R12: ff3d5b0b021fb9f8\n[ 2517.890575] R13: 0000000002000000 R14: ff3d5b0b021fb1b0 R15: 0000000000000018\n[ 2517.894434] FS:  0000000000000000(0000) GS:ff3d5b42bfc80000(0000) knlGS:0000000000000000\n[ 2517.898299] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2517.902157] CR2: 000000000000001a CR3: 00000004f023e005 CR4: 0000000000771ee0\n[ 2517.906053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 2517.909930] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 2517.913761] PKRU: 55555554\n[ 2517.917558] Call Trace:\n[ 2517.921294]  \u003cTASK\u003e\n[ 2517.924982]  nvme_complete_rq+0x1c3/0x1e0 [nvme_core]\n[ 2517.928715]  nvme_tcp_recv_pdu+0x4d7/0x540 [nvme_tcp]\n[ 2517.932442]  nvme_tcp_recv_skb+0x4f/0x240 [nvme_tcp]\n[ 2517.936137]  ? nvme_tcp_recv_pdu+0x540/0x540 [nvme_tcp]\n[ 2517.939830]  tcp_read_sock+0x9c/0x260\n[ 2517.943486]  nvme_tcp_try_recv+0x65/0xa0 [nvme_tcp]\n[ 2517.947173]  nvme_tcp_io_work+0x64/0x90 [nvme_tcp]\n[ 2517.950834]  process_one_work+0x1e8/0x390\n[ 2517.954473]  worker_thread+0x53/0x3c0\n[ 2517.958069]  ? process_one_work+0x390/0x390\n[ 2517.961655]  kthread+0x10c/0x130\n[ 2517.965211]  ? set_kthread_struct+0x40/0x40\n[ 2517.968760]  ret_from_fork+0x1f/0x30\n[ 2517.972285]  \u003c/TASK\u003e\n\nTo avoid this situation, add a NULL check for req-\u003ebio before\ncalling trace_block_bio_complete.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3afcdd1-1968-4d71-9914-9d197ff7f75a",
      "id": "CVE-2020-36775",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadlock\n\nUsing f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential\ndeadlock like we did in f2fs_write_single_data_page().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20be970c-7da1-4b59-8d18-a9a718e4fe35",
      "id": "CVE-2023-42753",
      "description": "An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h-\u003enets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e22c0cec-f962-441a-b810-ae598e42b217",
      "id": "CVE-2023-52623",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix a suspicious RCU usage warning\n\nI received the following warning while running cthon against an ontap\nserver running pNFS:\n\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\n\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u003cTASK\u003e\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a83d734-dc54-4f09-a3bd-bcacbc78a43d",
      "id": "CVE-2023-52644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\n\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\n\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 \u003c0f\u003e 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cea59a4a-ab1b-4773-8efb-07a1d70d485b",
      "id": "CVE-2023-52840",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - fix use after free in rmi_unregister_function()\n\nThe put_device() calls rmi_release_function() which frees \"fn\" so the\ndereference on the next line \"fn-\u003enum_of_irqs\" is a use after free.\nMove the put_device() to the end to fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "875f5a73-0d4f-4031-a44d-1e2b8227de0f",
      "id": "CVE-2023-52973",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF\n\nAfter a call to console_unlock() in vcs_read() the vc_data struct can be\nfreed by vc_deallocate(). Because of that, the struct vc_data pointer\nload must be done at the top of while loop in vcs_read() to avoid a UAF\nwhen vcs_size() is called.\n\nSyzkaller reported a UAF in vcs_size().\n\nBUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215)\nRead of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537\n\nCPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1\nHardware name: Red Hat KVM, BIOS 1.15.0-2.module\nCall Trace:\n  \u003cTASK\u003e\n__asan_report_load4_noabort (mm/kasan/report_generic.c:350)\nvcs_size (drivers/tty/vt/vc_screen.c:215)\nvcs_read (drivers/tty/vt/vc_screen.c:415)\nvfs_read (fs/read_write.c:468 fs/read_write.c:450)\n...\n  \u003c/TASK\u003e\n\nAllocated by task 1191:\n...\nkmalloc_trace (mm/slab_common.c:1069)\nvc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720\n     drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108)\ncon_install (drivers/tty/vt/vt.c:3383)\ntty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413\n     drivers/tty/tty_io.c:1390)\ntty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126)\nchrdev_open (fs/char_dev.c:415)\ndo_dentry_open (fs/open.c:883)\nvfs_open (fs/open.c:1014)\n...\n\nFreed by task 1548:\n...\nkfree (mm/slab_common.c:1021)\nvc_port_destruct (drivers/tty/vt/vt.c:1094)\ntty_port_destructor (drivers/tty/tty_port.c:296)\ntty_port_put (drivers/tty/tty_port.c:312)\nvt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2))\nvt_ioctl (drivers/tty/vt/vt_ioctl.c:903)\ntty_ioctl (drivers/tty/tty_io.c:2776)\n...\n\nThe buggy address belongs to the object at ffff888113747800\n  which belongs to the cache kmalloc-1k of size 1024\nThe buggy address is located 424 bytes inside of\n  1024-byte region [ffff888113747800, ffff888113747c00)\n\nThe buggy address belongs to the physical page:\npage:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000\n     index:0x0 pfn:0x113740\nhead:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0\n     compound_pincount:0\nanon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff)\nraw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001\nraw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n  ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003e ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                   ^\n  ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\nDisabling lock debugging due to kernel taint",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4b1e193-d47f-4886-a244-40ed78529ffb",
      "id": "CVE-2023-53105",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix cleanup null-ptr deref on encap lock\n\nDuring module is unloaded while a peer tc flow is still offloaded,\nfirst the peer uplink rep profile is changed to a nic profile, and so\nneigh encap lock is destroyed. Next during unload, the VF reps netdevs\nare unregistered which causes the original non-peer tc flow to be deleted,\nwhich deletes the peer flow. The peer flow deletion detaches the encap\nentry and try to take the already destroyed encap lock, causing the\nbelow trace.\n\nFix this by clearing peer flows during tc eswitch cleanup\n(mlx5e_tc_esw_cleanup()).\n\nRelevant trace:\n[ 4316.837128] BUG: kernel NULL pointer dereference, address: 00000000000001d8\n[ 4316.842239] RIP: 0010:__mutex_lock+0xb5/0xc40\n[ 4316.851897] Call Trace:\n[ 4316.852481]  \u003cTASK\u003e\n[ 4316.857214]  mlx5e_rep_neigh_entry_release+0x93/0x790 [mlx5_core]\n[ 4316.858258]  mlx5e_rep_encap_entry_detach+0xa7/0xf0 [mlx5_core]\n[ 4316.859134]  mlx5e_encap_dealloc+0xa3/0xf0 [mlx5_core]\n[ 4316.859867]  clean_encap_dests.part.0+0x5c/0xe0 [mlx5_core]\n[ 4316.860605]  mlx5e_tc_del_fdb_flow+0x32a/0x810 [mlx5_core]\n[ 4316.862609]  __mlx5e_tc_del_fdb_peer_flow+0x1a2/0x250 [mlx5_core]\n[ 4316.863394]  mlx5e_tc_del_flow+0x(/0x630 [mlx5_core]\n[ 4316.864090]  mlx5e_flow_put+0x5f/0x100 [mlx5_core]\n[ 4316.864771]  mlx5e_delete_flower+0x4de/0xa40 [mlx5_core]\n[ 4316.865486]  tc_setup_cb_reoffload+0x20/0x80\n[ 4316.865905]  fl_reoffload+0x47c/0x510 [cls_flower]\n[ 4316.869181]  tcf_block_playback_offloads+0x91/0x1d0\n[ 4316.869649]  tcf_block_unbind+0xe7/0x1b0\n[ 4316.870049]  tcf_block_offload_cmd.isra.0+0x1ee/0x270\n[ 4316.879266]  tcf_block_offload_unbind+0x61/0xa0\n[ 4316.879711]  __tcf_block_put+0xa4/0x310",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7e9b0eb-a6ae-48b8-b1ce-552c7911ee82",
      "id": "CVE-2025-23141",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses\n\nAcquire a lock on kvm-\u003esrcu when userspace is getting MP state to handle a\nrather extreme edge case where \"accepting\" APIC events, i.e. processing\npending INIT or SIPI, can trigger accesses to guest memory.  If the vCPU\nis in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP\nstate will trigger a nested VM-Exit by way of -\u003echeck_nested_events(), and\nemuating the nested VM-Exit can access guest memory.\n\nThe splat was originally hit by syzkaller on a Google-internal kernel, and\nreproduced on an upstream kernel by hacking the triple_fault_event_test\nselftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a\nmemory access on VMX), and do vcpu_mp_state_get() to trigger the scenario.\n\n  =============================\n  WARNING: suspicious RCU usage\n  6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted\n  -----------------------------\n  include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage!\n\n  other info that might help us debug this:\n\n  rcu_scheduler_active = 2, debug_locks = 1\n  1 lock held by triple_fault_ev/1256:\n   #0: ffff88810df5a330 (\u0026vcpu-\u003emutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm]\n\n  stack backtrace:\n  CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x7f/0x90\n   lockdep_rcu_suspicious+0x144/0x190\n   kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm]\n   kvm_vcpu_read_guest+0x3e/0x90 [kvm]\n   read_and_check_msr_entry+0x2e/0x180 [kvm_intel]\n   __nested_vmx_vmexit+0x550/0xde0 [kvm_intel]\n   kvm_check_nested_events+0x1b/0x30 [kvm]\n   kvm_apic_accept_events+0x33/0x100 [kvm]\n   kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm]\n   kvm_vcpu_ioctl+0x33e/0x9a0 [kvm]\n   __x64_sys_ioctl+0x8b/0xb0\n   do_syscall_64+0x6c/0x170\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21af9aaa-df21-417f-babf-8a471d270b2d",
      "id": "CVE-2023-53285",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add bounds checking in get_max_inline_xattr_value_size()\n\nNormally the extended attributes in the inode body would have been\nchecked when the inode is first opened, but if someone is writing to\nthe block device while the file system is mounted, it's possible for\nthe inode table to get corrupted.  Add bounds checking to avoid\nreading beyond the end of allocated memory if this happens.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03cd1af2-9001-429a-ab93-c4b0daead338",
      "id": "CVE-2024-26597",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: fix global oob in rmnet_policy\n\nThe variable rmnet_link_ops assign a *bigger* maxtype which leads to a\nglobal out-of-bounds read when parsing the netlink attributes. See bug\ntrace below:\n\n==================================================================\nBUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]\nBUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600\nRead of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207\n\nCPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G                 N 6.1.0 #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x172/0x475 mm/kasan/report.c:395\n kasan_report+0xbb/0x1c0 mm/kasan/report.c:495\n validate_nla lib/nlattr.c:386 [inline]\n __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600\n __nla_parse+0x3e/0x50 lib/nlattr.c:697\n nla_parse_nested_deprecated include/net/netlink.h:1248 [inline]\n __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485\n rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594\n rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091\n netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg+0x154/0x190 net/socket.c:734\n ____sys_sendmsg+0x6df/0x840 net/socket.c:2482\n ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536\n __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fdcf2072359\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359\nRDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003\nRBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000\n \u003c/TASK\u003e\n\nThe buggy address belongs to the variable:\n rmnet_policy+0x30/0xe0\n\nThe buggy address belongs to the physical page:\npage:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243\nflags: 0x200000000001000(reserved|node=0|zone=2)\nraw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000\nraw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07\n ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9\n\u003effffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9\n                                                 ^\n ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9\n ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9\n\nAccording to the comment of `nla_parse_nested_deprecated`, the maxtype\nshould be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc1ce1df-aedc-449f-b7cd-94d10c928353",
      "id": "CVE-2024-26622",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntomoyo: fix UAF write bug in tomoyo_write_control()\n\nSince tomoyo_write_control() updates head-\u003ewrite_buf when write()\nof long lines is requested, we need to fetch head-\u003ewrite_buf after\nhead-\u003eio_sem is held.  Otherwise, concurrent write() requests can\ncause use-after-free-write and double-free problems.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "44fe5660-8812-4102-b38e-2ca65c1b73ae",
      "id": "CVE-2024-26640",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add sanity checks to rx zerocopy\n\nTCP rx zerocopy intent is to map pages initially allocated\nfrom NIC drivers, not pages owned by a fs.\n\nThis patch adds to can_map_frag() these additional checks:\n\n- Page must not be a compound one.\n- page-\u003emapping must be NULL.\n\nThis fixes the panic reported by ZhangPeng.\n\nsyzbot was able to loopback packets built with sendfile(),\nmapping pages owned by an ext4 file to TCP rx zerocopy.\n\nr3 = socket$inet_tcp(0x2, 0x1, 0x0)\nmmap(\u0026(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0)\nr4 = socket$inet_tcp(0x2, 0x1, 0x0)\nbind$inet(r4, \u0026(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10)\nconnect$inet(r4, \u0026(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10)\nr5 = openat$dir(0xffffffffffffff9c, \u0026(0x7f00000000c0)='./file0\\x00',\n    0x181e42, 0x0)\nfallocate(r5, 0x0, 0x0, 0x85b8)\nsendfile(r4, r5, 0x0, 0x8ba0)\ngetsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23,\n    \u0026(0x7f00000001c0)={\u0026(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0,\n    0x0, 0x0, 0x0, 0x0}, \u0026(0x7f0000000440)=0x40)\nr6 = openat$dir(0xffffffffffffff9c, \u0026(0x7f00000000c0)='./file0\\x00',\n    0x181e42, 0x0)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1deb2146-443c-40b1-bd1f-51edf7329cba",
      "id": "CVE-2024-26765",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Disable IRQ before init_fn() for nonboot CPUs\n\nDisable IRQ before init_fn() for nonboot CPUs when hotplug, in order to\nsilence such warnings (and also avoid potential errors due to unexpected\ninterrupts):\n\nWARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:4503 rcu_cpu_starting+0x214/0x280\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198\npc 90000000048e3334 ra 90000000047bd56c tp 900000010039c000 sp 900000010039fdd0\na0 0000000000000001 a1 0000000000000006 a2 900000000802c040 a3 0000000000000000\na4 0000000000000001 a5 0000000000000004 a6 0000000000000000 a7 90000000048e3f4c\nt0 0000000000000001 t1 9000000005c70968 t2 0000000004000000 t3 000000000005e56e\nt4 00000000000002e4 t5 0000000000001000 t6 ffffffff80000000 t7 0000000000040000\nt8 9000000007931638 u0 0000000000000006 s9 0000000000000004 s0 0000000000000001\ns1 9000000006356ac0 s2 9000000007244000 s3 0000000000000001 s4 0000000000000001\ns5 900000000636f000 s6 7fffffffffffffff s7 9000000002123940 s8 9000000001ca55f8\n   ra: 90000000047bd56c tlb_init+0x24c/0x528\n  ERA: 90000000048e3334 rcu_cpu_starting+0x214/0x280\n CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n PRMD: 00000000 (PPLV0 -PIE -PWE)\n EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n ECFG: 00071000 (LIE=12 VS=7)\nESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)\n PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198\nStack : 0000000000000000 9000000006375000 9000000005b61878 900000010039c000\n        900000010039fa30 0000000000000000 900000010039fa38 900000000619a140\n        9000000006456888 9000000006456880 900000010039f950 0000000000000001\n        0000000000000001 cb0cb028ec7e52e1 0000000002b90000 9000000100348700\n        0000000000000000 0000000000000001 ffffffff916d12f1 0000000000000003\n        0000000000040000 9000000007930370 0000000002b90000 0000000000000004\n        9000000006366000 900000000619a140 0000000000000000 0000000000000004\n        0000000000000000 0000000000000009 ffffffffffc681f2 9000000002123940\n        9000000001ca55f8 9000000006366000 90000000047a4828 00007ffff057ded8\n        00000000000000b0 0000000000000000 0000000000000000 0000000000071000\n        ...\nCall Trace:\n[\u003c90000000047a4828\u003e] show_stack+0x48/0x1a0\n[\u003c9000000005b61874\u003e] dump_stack_lvl+0x84/0xcc\n[\u003c90000000047f60ac\u003e] __warn+0x8c/0x1e0\n[\u003c9000000005b0ab34\u003e] report_bug+0x1b4/0x280\n[\u003c9000000005b63110\u003e] do_bp+0x2d0/0x480\n[\u003c90000000047a2e20\u003e] handle_bp+0x120/0x1c0\n[\u003c90000000048e3334\u003e] rcu_cpu_starting+0x214/0x280\n[\u003c90000000047bd568\u003e] tlb_init+0x248/0x528\n[\u003c90000000047a4c44\u003e] per_cpu_trap_init+0x124/0x160\n[\u003c90000000047a19f4\u003e] cpu_probe+0x494/0xa00\n[\u003c90000000047b551c\u003e] start_secondary+0x3c/0xc0\n[\u003c9000000005b66134\u003e] smpboot_entry+0x50/0x58",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3929bd45-4682-47a1-a95b-51e0cef9b7ab",
      "id": "CVE-2024-26769",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: avoid deadlock on delete association path\n\nWhen deleting an association the shutdown path is deadlocking because we\ntry to flush the nvmet_wq nested. Avoid this by deadlock by deferring\nthe put work into its own work item.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f580bee-afa2-46bd-a5f3-36daa2d9450b",
      "id": "CVE-2022-48841",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats()\n\nIt is possible to do NULL pointer dereference in routine that updates\nTx ring stats. Currently only stats and bytes are updated when ring\npointer is valid, but later on ring is accessed to propagate gathered Tx\nstats onto VSI stats.\n\nChange the existing logic to move to next ring when ring is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "951ce595-c286-4d05-a820-96f15047f583",
      "id": "CVE-2024-26776",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\n\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\n\n    Unable to handle kernel NULL pointer dereference at virtual\n  address 0000000000000008\n    Call trace:\n        complete+0x54/0x100\n        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n        __handle_irq_event_percpu+0x64/0x1e0\n        handle_irq_event+0x7c/0x1cc",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5180dfd3-8e52-4e8b-aa6b-eef98ac3bc77",
      "id": "CVE-2024-26804",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_tunnel: prevent perpetual headroom growth\n\nsyzkaller triggered following kasan splat:\nBUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\nRead of size 1 at addr ffff88812fb4000e by task syz-executor183/5191\n[..]\n kasan_report+0xda/0x110 mm/kasan/report.c:588\n __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\n skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline]\n ___skb_get_hash net/core/flow_dissector.c:1791 [inline]\n __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856\n skb_get_hash include/linux/skbuff.h:1556 [inline]\n ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748\n ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592\n ...\n ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n ..\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831\n ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n ...\n\nThe splat occurs because skb-\u003edata points past skb-\u003ehead allocated area.\nThis is because neigh layer does:\n  __skb_pull(skb, skb_network_offset(skb));\n\n... but skb_network_offset() returns a negative offset and __skb_pull()\narg is unsigned.  IOW, we skb-\u003edata gets \"adjusted\" by a huge value.\n\nThe negative value is returned because skb-\u003ehead and skb-\u003edata distance is\nmore than 64k and skb-\u003enetwork_header (u16) has wrapped around.\n\nThe bug is in the ip_tunnel infrastructure, which can cause\ndev-\u003eneeded_headroom to increment ad infinitum.\n\nThe syzkaller reproducer consists of packets getting routed via a gre\ntunnel, and route of gre encapsulated packets pointing at another (ipip)\ntunnel.  The ipip encapsulation finds gre0 as next output device.\n\nThis results in the following pattern:\n\n1). First packet is to be sent out via gre0.\nRoute lookup found an output device, ipip0.\n\n2).\nip_tunnel_xmit for gre0 bumps gre0-\u003eneeded_headroom based on the future\noutput device, rt.dev-\u003eneeded_headroom (ipip0).\n\n3).\nip output / start_xmit moves skb on to ipip0. which runs the same\ncode path again (xmit recursion).\n\n4).\nRouting step for the post-gre0-encap packet finds gre0 as output device\nto use for ipip0 encapsulated packet.\n\ntunl0-\u003eneeded_headroom is then incremented based on the (already bumped)\ngre0 device headroom.\n\nThis repeats for every future packet:\n\ngre0-\u003eneeded_headroom gets inflated because previous packets' ipip0 step\nincremented rt-\u003edev (gre0) headroom, and ipip0 incremented because gre0\nneeded_headroom was increased.\n\nFor each subsequent packet, gre/ipip0-\u003eneeded_headroom grows until\npost-expand-head reallocations result in a skb-\u003ehead/data distance of\nmore than 64k.\n\nOnce that happens, skb-\u003enetwork_header (u16) wraps around when\npskb_expand_head tries to make sure that skb_network_offset() is unchanged\nafter the headroom expansion/reallocation.\n\nAfter this skb_network_offset(skb) returns a different (and negative)\nresult post headroom expansion.\n\nThe next trip to neigh layer (or anything else that would __skb_pull the\nnetwork header) makes skb-\u003edata point to a memory location outside\nskb-\u003ehead area.\n\nv2: Cap the needed_headroom update to an arbitarily chosen upperlimit to\nprevent perpetual increase instead of dropping the headroom increment\ncompletely.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a061ff8-43a3-46da-90b0-aaa67fd1fcf5",
      "id": "CVE-2024-26805",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: Fix kernel-infoleak-after-free in __skb_datagram_iter\n\nsyzbot reported the following uninit-value access issue [1]:\n\nnetlink_to_full_skb() creates a new `skb` and puts the `skb-\u003edata`\npassed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data\nsize is specified as `len` and passed to skb_put_data(). This `len`\nis based on `skb-\u003eend` that is not data offset but buffer offset. The\n`skb-\u003eend` contains data and tailroom. Since the tailroom is not\ninitialized when the new `skb` created, KMSAN detects uninitialized\nmemory area when copying the data.\n\nThis patch resolved this issue by correct the len from `skb-\u003eend` to\n`skb-\u003elen`, which is the actual data offset.\n\nBUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186\n copy_to_iter include/linux/uio.h:197 [inline]\n simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532\n __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420\n skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]\n packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg net/socket.c:1066 [inline]\n sock_read_iter+0x467/0x580 net/socket.c:1136\n call_read_iter include/linux/fs.h:2014 [inline]\n new_sync_read fs/read_write.c:389 [inline]\n vfs_read+0x8f6/0xe00 fs/read_write.c:470\n ksys_read+0x20f/0x4c0 fs/read_write.c:613\n __do_sys_read fs/read_write.c:623 [inline]\n __se_sys_read fs/read_write.c:621 [inline]\n __x64_sys_read+0x93/0xd0 fs/read_write.c:621\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was stored to memory at:\n skb_put_data include/linux/skbuff.h:2622 [inline]\n netlink_to_full_skb net/netlink/af_netlink.c:181 [inline]\n __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline]\n __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325\n netlink_deliver_tap net/netlink/af_netlink.c:338 [inline]\n netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n free_pages_prepare mm/page_alloc.c:1087 [inline]\n free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347\n free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533\n release_pages+0x23d3/0x2410 mm/swap.c:1042\n free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316\n tlb_batch_pages\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac620296-66fc-47a9-ada8-b35d319039a7",
      "id": "CVE-2024-26811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a1d6543-c25e-4310-8268-766d9a3d6cee",
      "id": "CVE-2024-26966",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c187753e-0d40-48de-9297-207434d984d8",
      "id": "CVE-2024-26982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check the inode number is not the invalid value of zero\n\nSyskiller has produced an out of bounds access in fill_meta_index().\n\nThat out of bounds access is ultimately caused because the inode\nhas an inode number with the invalid value of zero, which was not checked.\n\nThe reason this causes the out of bounds access is due to following\nsequence of events:\n\n1. Fill_meta_index() is called to allocate (via empty_meta_index())\n   and fill a metadata index.  It however suffers a data read error\n   and aborts, invalidating the newly returned empty metadata index.\n   It does this by setting the inode number of the index to zero,\n   which means unused (zero is not a valid inode number).\n\n2. When fill_meta_index() is subsequently called again on another\n   read operation, locate_meta_index() returns the previous index\n   because it matches the inode number of 0.  Because this index\n   has been returned it is expected to have been filled, and because\n   it hasn't been, an out of bounds access is performed.\n\nThis patch adds a sanity check which checks that the inode number\nis not zero when the inode is created and returns -EINVAL if it is.\n\n[phillip@squashfs.org.uk: whitespace fix]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94363bbe-5819-4316-963a-0858c53a12b9",
      "id": "CVE-2024-27001",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix incomplete endpoint checking\n\nWhile vmk80xx does have endpoint checking implemented, some things\ncan fall through the cracks. Depending on the hardware model,\nURBs can have either bulk or interrupt type, and current version\nof vmk80xx_find_usb_endpoints() function does not take that fully\ninto account. While this warning does not seem to be too harmful,\nat the very least it will crash systems with 'panic_on_warn' set on\nthem.\n\nFix the issue found by Syzkaller [1] by somewhat simplifying the\nendpoint checking process with usb_find_common_endpoints() and\nensuring that only expected endpoint types are present.\n\nThis patch has not been tested on real hardware.\n\n[1] Syzkaller report:\nusb 1-1: BOGUS urb xfer, pipe 1 != type 3\nWARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503\n...\nCall Trace:\n \u003cTASK\u003e\n usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59\n vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline]\n vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818\n comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067\n usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399\n...\n\nSimilar issue also found by Syzkaller:",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07dd4ff2-6696-4c6b-aa54-a5d0a6b605bd",
      "id": "CVE-2024-35868",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_stats_proc_write()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4e97cf35-c789-4149-95c2-48b32753e994",
      "id": "CVE-2024-38621",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stk1160: fix bounds checking in stk1160_copy_video()\n\nThe subtract in this condition is reversed.  The -\u003elength is the length\nof the buffer.  The -\u003ebytesused is how many bytes we have copied thus\nfar.  When the condition is reversed that means the result of the\nsubtraction is always negative but since it's unsigned then the result\nis a very high positive value.  That means the overflow check is never\ntrue.\n\nAdditionally, the -\u003ebytesused doesn't actually work for this purpose\nbecause we're not writing to \"buf-\u003emem + buf-\u003ebytesused\".  Instead, the\nmath to calculate the destination where we are writing is a bit\ninvolved.  You calculate the number of full lines already written,\nmultiply by two, skip a line if necessary so that we start on an odd\nnumbered line, and add the offset into the line.\n\nTo fix this buffer overflow, just take the actual destination where we\nare writing, if the offset is already out of bounds print an error and\nreturn.  Otherwise, write up to buf-\u003elength bytes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd6b8fb9-227f-4f08-b18d-f03fec0a2385",
      "id": "CVE-2024-39276",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()\n\nSyzbot reports a warning as follows:\n\n============================================\nWARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cache_destroy+0x224/0x290\nModules linked in:\nCPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7\nRIP: 0010:mb_cache_destroy+0x224/0x290 fs/mbcache.c:419\nCall Trace:\n \u003cTASK\u003e\n ext4_put_super+0x6d4/0xcd0 fs/ext4/super.c:1375\n generic_shutdown_super+0x136/0x2d0 fs/super.c:641\n kill_block_super+0x44/0x90 fs/super.c:1675\n ext4_kill_sb+0x68/0xa0 fs/ext4/super.c:7327\n[...]\n============================================\n\nThis is because when finding an entry in ext4_xattr_block_cache_find(), if\next4_sb_bread() returns -ENOMEM, the ce's e_refcnt, which has already grown\nin the __entry_find(), won't be put away, and eventually trigger the above\nissue in mb_cache_destroy() due to reference count leakage.\n\nSo call mb_cache_entry_put() on the -ENOMEM error branch as a quick fix.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c48224b7-9c1c-401d-9c91-41fab25e050b",
      "id": "CVE-2024-40984",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Revert \"ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.\"\n\nUndo the modifications made in commit d410ee5109a1 (\"ACPICA: avoid\n\"Info: mapping multiple BARs. Your kernel is fine.\"\"). The initial\npurpose of this commit was to stop memory mappings for operation\nregions from overlapping page boundaries, as it can trigger warnings\nif different page attributes are present.\n\nHowever, it was found that when this situation arises, mapping\ncontinues until the boundary's end, but there is still an attempt to\nread/write the entire length of the map, leading to a NULL pointer\ndeference. For example, if a four-byte mapping request is made but\nonly one byte is mapped because it hits the current page boundary's\nend, a four-byte read/write attempt is still made, resulting in a NULL\npointer deference.\n\nInstead, map the entire length, as the ACPI specification does not\nmandate that it must be within the same page boundary. It is\npermissible for it to be mapped across different regions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88de5f03-251a-4d67-8324-1bd22e98bec6",
      "id": "CVE-2022-49851",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix reserved memory setup\n\nCurrently, RISC-V sets up reserved memory using the \"early\" copy of the\ndevice tree. As a result, when trying to get a reserved memory region\nusing of_reserved_mem_lookup(), the pointer to reserved memory regions\nis using the early, pre-virtual-memory address which causes a kernel\npanic when trying to use the buffer's name:\n\n Unable to handle kernel paging request at virtual address 00000000401c31ac\n Oops [#1]\n Modules linked in:\n CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc1-00001-g0d9d6953d834 #1\n Hardware name: Microchip PolarFire-SoC Icicle Kit (DT)\n epc : string+0x4a/0xea\n  ra : vsnprintf+0x1e4/0x336\n epc : ffffffff80335ea0 ra : ffffffff80338936 sp : ffffffff81203be0\n  gp : ffffffff812e0a98 tp : ffffffff8120de40 t0 : 0000000000000000\n  t1 : ffffffff81203e28 t2 : 7265736572203a46 s0 : ffffffff81203c20\n  s1 : ffffffff81203e28 a0 : ffffffff81203d22 a1 : 0000000000000000\n  a2 : ffffffff81203d08 a3 : 0000000081203d21 a4 : ffffffffffffffff\n  a5 : 00000000401c31ac a6 : ffff0a00ffffff04 a7 : ffffffffffffffff\n  s2 : ffffffff81203d08 s3 : ffffffff81203d00 s4 : 0000000000000008\n  s5 : ffffffff000000ff s6 : 0000000000ffffff s7 : 00000000ffffff00\n  s8 : ffffffff80d9821a s9 : ffffffff81203d22 s10: 0000000000000002\n  s11: ffffffff80d9821c t3 : ffffffff812f3617 t4 : ffffffff812f3617\n  t5 : ffffffff812f3618 t6 : ffffffff81203d08\n status: 0000000200000100 badaddr: 00000000401c31ac cause: 000000000000000d\n [\u003cffffffff80338936\u003e] vsnprintf+0x1e4/0x336\n [\u003cffffffff80055ae2\u003e] vprintk_store+0xf6/0x344\n [\u003cffffffff80055d86\u003e] vprintk_emit+0x56/0x192\n [\u003cffffffff80055ed8\u003e] vprintk_default+0x16/0x1e\n [\u003cffffffff800563d2\u003e] vprintk+0x72/0x80\n [\u003cffffffff806813b2\u003e] _printk+0x36/0x50\n [\u003cffffffff8068af48\u003e] print_reserved_mem+0x1c/0x24\n [\u003cffffffff808057ec\u003e] paging_init+0x528/0x5bc\n [\u003cffffffff808031ae\u003e] setup_arch+0xd0/0x592\n [\u003cffffffff8080070e\u003e] start_kernel+0x82/0x73c\n\nearly_init_fdt_scan_reserved_mem() takes no arguments as it operates on\ninitial_boot_params, which is populated by early_init_dt_verify(). On\nRISC-V, early_init_dt_verify() is called twice. Once, directly, in\nsetup_arch() if CONFIG_BUILTIN_DTB is not enabled and once indirectly,\nvery early in the boot process, by parse_dtb() when it calls\nearly_init_dt_scan_nodes().\n\nThis first call uses dtb_early_va to set initial_boot_params, which is\nnot usable later in the boot process when\nearly_init_fdt_scan_reserved_mem() is called. On arm64 for example, the\ncorresponding call to early_init_dt_scan_nodes() uses fixmap addresses\nand doesn't suffer the same fate.\n\nMove early_init_fdt_scan_reserved_mem() further along the boot sequence,\nafter the direct call to early_init_dt_verify() in setup_arch() so that\nthe names use the correct virtual memory addresses. The above supposed\nthat CONFIG_BUILTIN_DTB was not set, but should work equally in the case\nwhere it is - unflatted_and_copy_device_tree() also updates\ninitial_boot_params.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "50b11fed-7b03-47be-985f-a89ce605d4dc",
      "id": "CVE-2024-42131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid overflows in dirty throttling logic\n\nThe dirty throttling logic is interspersed with assumptions that dirty\nlimits in PAGE_SIZE units fit into 32-bit (so that various multiplications\nfit into 64-bits).  If limits end up being larger, we will hit overflows,\npossible divisions by 0 etc.  Fix these problems by never allowing so\nlarge dirty limits as they have dubious practical value anyway.  For\ndirty_bytes / dirty_background_bytes interfaces we can just refuse to set\nso large limits.  For dirty_ratio / dirty_background_ratio it isn't so\nsimple as the dirty limit is computed from the amount of available memory\nwhich can change due to memory hotplug etc.  So when converting dirty\nlimits from ratios to numbers of pages, we just don't allow the result to\nexceed UINT_MAX.\n\nThis is root-only triggerable problem which occurs when the operator\nsets dirty limits to \u003e16 TB.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3cebe066-3ec0-437d-a1ef-f141be78865a",
      "id": "CVE-2024-42265",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of -\u003efd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than -\u003emax_fds;\nhowever, misprediction might end up with\n        tofree = fdt-\u003efd[fd];\nbeing speculatively executed.  That's wrong for the same reasons\nwhy it's wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt-\u003emax_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56d25aa8-ffbe-444d-93a1-3cde9eec1d34",
      "id": "CVE-2024-42286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: validate nvme_local_port correctly\n\nThe driver load failed with error message,\n\nqla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef\n\nand with a kernel crash,\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000070\n\tWorkqueue: events_unbound qla_register_fcport_fn [qla2xxx]\n\tRIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]\n\tRSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282\n\tRAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000\n\tRDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000\n\tRBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030\n\tR10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4\n\tR13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8\n\tFS:  0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000\n\tCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\tCR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0\n\tCall Trace:\n\tqla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]\n\t? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]\n\tqla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx]\n\tqla_register_fcport_fn+0x54/0xc0 [qla2xxx]\n\nExit the qla_nvme_register_remote() function when qla_nvme_register_hba()\nfails and correctly validate nvme_local_port.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce4b8d25-ed3a-4d14-a480-ded4ae8d9ef3",
      "id": "CVE-2024-42296",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix return value of f2fs_convert_inline_inode()\n\nIf device is readonly, make f2fs_convert_inline_inode()\nreturn EROFS instead of zero, otherwise it may trigger\npanic during writeback of inline inode's dirty page as\nbelow:\n\n f2fs_write_single_data_page+0xbb6/0x1e90 fs/f2fs/data.c:2888\n f2fs_write_cache_pages fs/f2fs/data.c:3187 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3342 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3369\n do_writepages+0x359/0x870 mm/page-writeback.c:2634\n filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:397\n __filemap_fdatawrite_range mm/filemap.c:430 [inline]\n file_write_and_wait_range+0x1aa/0x290 mm/filemap.c:788\n f2fs_do_sync_file+0x68a/0x1ae0 fs/f2fs/file.c:276\n generic_write_sync include/linux/fs.h:2806 [inline]\n f2fs_file_write_iter+0x7bd/0x24e0 fs/f2fs/file.c:4977\n call_write_iter include/linux/fs.h:2114 [inline]\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xa72/0xc90 fs/read_write.c:590\n ksys_write+0x1a0/0x2c0 fs/read_write.c:643\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b176fce-1c3d-4916-9d8d-c67ed3f972a9",
      "id": "CVE-2024-46863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item\n\nThere is no links_num in struct snd_soc_acpi_mach {}, and we test\n!link-\u003enum_adr as a condition to end the loop in hda_sdw_machine_select().\nSo an empty item in struct snd_soc_acpi_link_adr array is required.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30df6207-7b76-49f7-9c1d-4edca862da5c",
      "id": "CVE-2024-49906",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointer before try to access it\n\n[why \u0026 how]\nChange the order of the pipe_ctx-\u003eplane_state check to ensure that\nplane_state is not null before accessing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d5a35d0-1c33-43b9-ab3a-54fc37baa8b8",
      "id": "CVE-2024-49936",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/xen-netback: prevent UAF in xenvif_flush_hash()\n\nDuring the list_for_each_entry_rcu iteration call of xenvif_flush_hash,\nkfree_rcu does not exist inside the rcu read critical section, so if\nkfree_rcu is called when the rcu grace period ends during the iteration,\nUAF occurs when accessing head-\u003enext after the entry becomes free.\n\nTherefore, to solve this, you need to change it to list_for_each_entry_safe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3aaa3603-24e3-4de0-ac6c-8efa9e3efd73",
      "id": "CVE-2024-50009",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate: add check for cpufreq_cpu_get's return value\n\ncpufreq_cpu_get may return NULL. To avoid NULL-dereference check it\nand return in case of error.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f24f7a64-77c1-4bc7-96e5-f995f5f2540d",
      "id": "CVE-2024-50038",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\n\nsyzbot managed to call xt_cluster match via ebtables:\n\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\n [..]\n ebt_do_table+0x174b/0x2a40\n\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\nprocessing.  As this is only useful to restrict locally terminating\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\n\nPablo points out that this is a general issue, direct users of the\nset/getsockopt interface can call into targets/matches that were only\nintended for use with ip(6)tables.\n\nCheck all UNSPEC matches and targets for similar issues:\n\n- matches and targets are fine except if they assume skb_network_header()\n  is valid -- this is only true when called from inet layer: ip(6) stack\n  pulls the ip/ipv6 header into linear data area.\n- targets that return XT_CONTINUE or other xtables verdicts must be\n  restricted too, they are incompatbile with the ebtables traverser, e.g.\n  EBT_CONTINUE is a completely different value than XT_CONTINUE.\n\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\nthey are provided for use by ip(6)tables.\n\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\n\nWhile at it, bail out if connbytes fails to enable the corresponding\nconntrack family.\n\nThis change passes the selftests in iptables.git.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f012062-1f35-4c90-9d71-13f04e5fc97d",
      "id": "CVE-2020-10768",
      "description": "A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82c057db-b4a8-4a6c-aeaf-f990240cb6aa",
      "id": "CVE-2024-50244",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Additional check in ni_clear()\n\nChecking of NTFS_FLAGS_LOG_REPLAYING added to prevent access to\nuninitialized bitmap during replay process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3837666f-81a1-4925-9ca6-2aa2b536987a",
      "id": "CVE-2024-53224",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Move events notifier registration to be after device registration\n\nMove pkey change work initialization and cleanup from device resources\nstage to notifier stage, since this is the stage which handles this work\nevents.\n\nFix a race between the device deregistration and pkey change work by moving\nMLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to\nensure that the notifier is deregistered before the device during cleanup.\nWhich ensures there are no works that are being executed after the\ndevice has already unregistered which can cause the panic below.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1\nHardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023\nWorkqueue: events pkey_change_handler [mlx5_ib]\nRIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib]\nCode: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 \u003c4c\u003e 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40\nRSP: 0018:ffffbcc54068be20 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36\nRDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128\nRBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001\nR10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000\nR13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905\nFS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\nmlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib]\nprocess_one_work+0x1e8/0x3c0\nworker_thread+0x50/0x3b0\n? rescuer_thread+0x380/0x380\nkthread+0x149/0x170\n? set_kthread_struct+0x50/0x50\nret_from_fork+0x22/0x30\nModules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core]\nCR2: 0000000000000000\n---[ end trace f6f8be4eae12f7bc ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41023552-f3f4-41e3-9429-145412238550",
      "id": "CVE-2024-56565",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to drop all discards after creating snapshot on lvm device\n\nPiergiorgio reported a bug in bugzilla as below:\n\n------------[ cut here ]------------\nWARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330\nRIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs]\nCall Trace:\n __issue_discard_cmd+0x1ca/0x350 [f2fs]\n issue_discard_thread+0x191/0x480 [f2fs]\n kthread+0xcf/0x100\n ret_from_fork+0x31/0x50\n ret_from_fork_asm+0x1a/0x30\n\nw/ below testcase, it can reproduce this bug quickly:\n- pvcreate /dev/vdb\n- vgcreate myvg1 /dev/vdb\n- lvcreate -L 1024m -n mylv1 myvg1\n- mount /dev/myvg1/mylv1 /mnt/f2fs\n- dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20\n- sync\n- rm /mnt/f2fs/file\n- sync\n- lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1\n- umount /mnt/f2fs\n\nThe root cause is: it will update discard_max_bytes of mounted lvm\ndevice to zero after creating snapshot on this lvm device, then,\n__submit_discard_cmd() will pass parameter @nr_sects w/ zero value\nto __blkdev_issue_discard(), it returns a NULL bio pointer, result\nin panic.\n\nThis patch changes as below for fixing:\n1. Let's drop all remained discards in f2fs_unfreeze() if snapshot\nof lvm device is created.\n2. Checking discard_max_bytes before submitting discard during\n__submit_discard_cmd().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4f56a925-bc12-4852-9988-aaf0cd986672",
      "id": "CVE-2024-56590",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb-\u003edata.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2c63db2-4b53-4698-a76a-77edd273107d",
      "id": "CVE-2022-26966",
      "description": "An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54908cfa-ce7b-4861-ba98-beb65cff5a3d",
      "id": "CVE-2024-56704",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/xen: fix release of IRQ\n\nKernel logs indicate an IRQ was double-freed.\n\nPass correct device ID during IRQ release.\n\n[Dominique: remove confusing variable reset to 0]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e9aeeeb-7a00-4e41-b0e5-e1751e63e642",
      "id": "CVE-2024-57807",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix for a potential deadlock\n\nThis fixes a 'possible circular locking dependency detected' warning\n      CPU0                    CPU1\n      ----                    ----\n lock(\u0026instance-\u003ereset_mutex);\n                              lock(\u0026shost-\u003escan_mutex);\n                              lock(\u0026instance-\u003ereset_mutex);\n lock(\u0026shost-\u003escan_mutex);\n\nFix this by temporarily releasing the reset_mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bef0d14a-3a87-4a0c-98b4-ae497bc19e32",
      "id": "CVE-2024-58013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync\n\nThis fixes the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543\nRead of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961\n\nCPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nAllocated by task 16026:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314\n kmalloc_noprof include/linux/slab.h:901 [inline]\n kzalloc_noprof include/linux/slab.h:1037 [inline]\n mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269\n mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296\n remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568\n hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712\n hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:726\n sock_write_iter+0x2d7/0x3f0 net/socket.c:1147\n new_sync_write fs/read_write.c:586 [inline]\n vfs_write+0xaeb/0xd30 fs/read_write.c:679\n ksys_write+0x18f/0x2b0 fs/read_write.c:731\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 16022:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2338 [inline]\n slab_free mm/slub.c:4598 [inline]\n kfree+0x196/0x420 mm/slub.c:4746\n mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259\n __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550\n hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208\n hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]\n hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508\n sock_do_ioctl+0x158/0x460 net/socket.c:1209\n sock_ioctl+0x626/0x8e0 net/socket.c:1328\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "403f0526-82d2-47e8-ad75-9d77209b1759",
      "id": "CVE-2025-21758",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: add RCU protection to mld_newpack()\n\nmld_newpack() can be called without RTNL or RCU being held.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net-\u003eipv6.igmp_sk\nsocket under RCU protection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8daa3d47-bd7e-4c59-9c9c-e9e6951dcb0a",
      "id": "CVE-2025-21760",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nndisc: extend RCU protection in ndisc_send_skb()\n\nndisc_send_skb() can be called without RTNL or RCU held.\n\nAcquire rcu_read_lock() earlier, so that we can use dev_net_rcu()\nand avoid a potential UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b1a14fb-02bc-4a34-9ea0-ddc4c7a350ee",
      "id": "CVE-2025-21812",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: rcu protect dev-\u003eax25_ptr\n\nsyzbot found a lockdep issue [1].\n\nWe should remove ax25 RTNL dependency in ax25_setsockopt()\n\nThis should also fix a variety of possible UAF in ax25.\n\n[1]\n\nWARNING: possible circular locking dependency detected\n6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted\n------------------------------------------------------\nsyz.5.1818/12806 is trying to acquire lock:\n ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n\nbut task is already holding lock:\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #1 (sk_lock-AF_AX25){+.+.}-{0:0}:\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n        lock_sock_nested+0x48/0x100 net/core/sock.c:3642\n        lock_sock include/net/sock.h:1618 [inline]\n        ax25_kill_by_device net/ax25/af_ax25.c:101 [inline]\n        ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146\n        notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85\n       __dev_notify_flags+0x207/0x400\n        dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026\n        dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563\n        dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820\n        sock_do_ioctl+0x240/0x460 net/socket.c:1234\n        sock_ioctl+0x626/0x8e0 net/socket.c:1339\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:906 [inline]\n        __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-\u003e #0 (rtnl_mutex){+.+.}-{4:4}:\n        check_prev_add kernel/locking/lockdep.c:3161 [inline]\n        check_prevs_add kernel/locking/lockdep.c:3280 [inline]\n        validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904\n        __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n        __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n        __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735\n        ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680\n        do_sock_setsockopt+0x3af/0x720 net/socket.c:2324\n        __sys_setsockopt net/socket.c:2349 [inline]\n        __do_sys_setsockopt net/socket.c:2355 [inline]\n        __se_sys_setsockopt net/socket.c:2352 [inline]\n        __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nother info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(sk_lock-AF_AX25);\n                               lock(rtnl_mutex);\n                               lock(sk_lock-AF_AX25);\n  lock(rtnl_mutex);\n\n *** DEADLOCK ***\n\n1 lock held by syz.5.1818/12806:\n  #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]\n  #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074\n  check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206\n  check_prev_add kernel/locking/lockdep.c:3161 [inline]\n  check_prevs_add kernel/lockin\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cf0720a-96ee-4855-bfef-0662b75c0834",
      "id": "CVE-2025-21928",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()\n\nThe system can experience a random crash a few minutes after the driver is\nremoved. This issue occurs due to improper handling of memory freeing in\nthe ishtp_hid_remove() function.\n\nThe function currently frees the `driver_data` directly within the loop\nthat destroys the HID devices, which can lead to accessing freed memory.\nSpecifically, `hid_destroy_device()` uses `driver_data` when it calls\n`hid_ishtp_set_feature()` to power off the sensor, so freeing\n`driver_data` beforehand can result in accessing invalid memory.\n\nThis patch resolves the issue by storing the `driver_data` in a temporary\nvariable before calling `hid_destroy_device()`, and then freeing the\n`driver_data` after the device is destroyed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16294436-f25d-49a0-b563-0f869bba17dc",
      "id": "CVE-2025-21992",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: ignore non-functional sensor in HP 5MP Camera\n\nThe HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that\nis not actually implemented. Attempting to access this non-functional\nsensor via iio_info causes system hangs as runtime PM tries to wake up\nan unresponsive sensor.\n\n  [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff\n  [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff\n\nAdd this device to the HID ignore list since the sensor interface is\nnon-functional by design and should not be exposed to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d161b6b-abaa-4b33-9624-8cd4899dd3ae",
      "id": "CVE-2025-22107",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()\n\nThere are actually 2 problems:\n- deleting the last element doesn't require the memmove of elements\n  [i + 1, end) over it. Actually, element i+1 is out of bounds.\n- The memmove itself should move size - i - 1 elements, because the last\n  element is out of bounds.\n\nThe out-of-bounds element still remains out of bounds after being\naccessed, so the problem is only that we touch it, not that it becomes\nin active use. But I suppose it can lead to issues if the out-of-bounds\nelement is part of an unmapped page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "909b40bf-f3bf-4395-aabd-273dcfbd95c0",
      "id": "CVE-2025-37839",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: remove wrong sb-\u003es_sequence check\n\nJournal emptiness is not determined by sb-\u003es_sequence == 0 but rather by\nsb-\u003es_start == 0 (which is set a few lines above). Furthermore 0 is a\nvalid transaction ID so the check can spuriously trigger. Remove the\ninvalid WARN_ON.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b58103b7-c826-44a7-921b-175216fa4f52",
      "id": "CVE-2025-37841",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npm: cpupower: bench: Prevent NULL dereference on malloc failure\n\nIf malloc returns NULL due to low memory, 'config' pointer can be NULL.\nAdd a check to prevent NULL dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fdf87e30-55d8-4c63-8f6c-2ab9823f66ea",
      "id": "CVE-2023-3220",
      "description": "An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3af3ad6-dd21-45cd-86c5-806ddc342b92",
      "id": "CVE-2025-37967",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix deadlock\n\nThis patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock\nfunctions to the UCSI driver. ucsi_con_mutex_lock ensures the connector\nmutex is only locked if a connection is established and the partner pointer\nis valid. This resolves a deadlock scenario where\nucsi_displayport_remove_partner holds con-\u003emutex waiting for\ndp_altmode_work to complete while dp_altmode_work attempts to acquire it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4cdeb73-5a9c-4ee4-8faa-68ac3576d13a",
      "id": "CVE-2025-37995",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: ensure that kobject_put() is safe for module type kobjects\n\nIn 'lookup_or_create_module_kobject()', an internal kobject is created\nusing 'module_ktype'. So call to 'kobject_put()' on error handling\npath causes an attempt to use an uninitialized completion pointer in\n'module_kobject_release()'. In this scenario, we just want to release\nkobject without an extra synchronization required for a regular module\nunloading process, so adding an extra check whether 'complete()' is\nactually required makes 'kobject_put()' safe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65d1202d-897f-4f1c-bc1c-c3a890a8aa49",
      "id": "CVE-2025-38004",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "175c7563-60e0-4724-a5ab-136f26e7ac8e",
      "id": "CVE-2025-38103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()\n\nUpdate struct hid_descriptor to better reflect the mandatory and\noptional parts of the HID Descriptor as per USB HID 1.11 specification.\nNote: the kernel currently does not parse any optional HID class\ndescriptors, only the mandatory report descriptor.\n\nUpdate all references to member element desc[0] to rpt_desc.\n\nAdd test to verify bLength and bNumDescriptors values are valid.\n\nReplace the for loop with direct access to the mandatory HID class\ndescriptor member for the report descriptor. This eliminates the\npossibility of getting an out-of-bounds fault.\n\nAdd a warning message if the HID descriptor contains any unsupported\noptional HID class descriptors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1153a83d-a58d-46fb-98dc-4d98944d04ef",
      "id": "CVE-2025-38147",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: Don't call calipso functions for AF_INET sk.\n\nsyzkaller reported a null-ptr-deref in txopt_get(). [0]\n\nThe offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo,\nso struct ipv6_pinfo was NULL there.\n\nHowever, this never happens for IPv6 sockets as inet_sk(sk)-\u003epinet6\nis always set in inet6_create(), meaning the socket was not IPv6 one.\n\nThe root cause is missing validation in netlbl_conn_setattr().\n\nnetlbl_conn_setattr() switches branches based on struct\nsockaddr.sa_family, which is passed from userspace.  However,\nnetlbl_conn_setattr() does not check if the address family matches\nthe socket.\n\nThe syzkaller must have called connect() for an IPv6 address on\nan IPv4 socket.\n\nWe have a proper validation in tcp_v[46]_connect(), but\nsecurity_socket_connect() is called in the earlier stage.\n\nLet's copy the validation to netlbl_conn_setattr().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]\nCPU: 2 UID: 0 PID: 12928 Comm: syz.9.1677 Not tainted 6.12.0 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:txopt_get include/net/ipv6.h:390 [inline]\nRIP: 0010:\nCode: 02 00 00 49 8b ac 24 f8 02 00 00 e8 84 69 2a fd e8 ff 00 16 fd 48 8d 7d 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 53 02 00 00 48 8b 6d 70 48 85 ed 0f 84 ab 01 00\nRSP: 0018:ffff88811b8afc48 EFLAGS: 00010212\nRAX: dffffc0000000000 RBX: 1ffff11023715f8a RCX: ffffffff841ab00c\nRDX: 000000000000000e RSI: ffffc90007d9e000 RDI: 0000000000000070\nRBP: 0000000000000000 R08: ffffed1023715f9d R09: ffffed1023715f9e\nR10: ffffed1023715f9d R11: 0000000000000003 R12: ffff888123075f00\nR13: ffff88810245bd80 R14: ffff888113646780 R15: ffff888100578a80\nFS:  00007f9019bd7640(0000) GS:ffff8882d2d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f901b927bac CR3: 0000000104788003 CR4: 0000000000770ef0\nPKRU: 80000000\nCall Trace:\n \u003cTASK\u003e\n calipso_sock_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:557\n netlbl_conn_setattr+0x10c/0x280 net/netlabel/netlabel_kapi.c:1177\n selinux_netlbl_socket_connect_helper+0xd3/0x1b0 security/selinux/netlabel.c:569\n selinux_netlbl_socket_connect_locked security/selinux/netlabel.c:597 [inline]\n selinux_netlbl_socket_connect+0xb6/0x100 security/selinux/netlabel.c:615\n selinux_socket_connect+0x5f/0x80 security/selinux/hooks.c:4931\n security_socket_connect+0x50/0xa0 security/security.c:4598\n __sys_connect_file+0xa4/0x190 net/socket.c:2067\n __sys_connect+0x12c/0x170 net/socket.c:2088\n __do_sys_connect net/socket.c:2098 [inline]\n __se_sys_connect net/socket.c:2095 [inline]\n __x64_sys_connect+0x73/0xb0 net/socket.c:2095\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f901b61a12d\nCode: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f9019bd6fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: 00007f901b925fa0 RCX: 00007f901b61a12d\nRDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003\nRBP: 00007f901b701505 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f901b5b62a0 R15: 00007f9019bb7000\n \u003c/TASK\u003e\nModules linked in:",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7dd3005a-f9b6-428d-8bcd-13ae19028dc2",
      "id": "CVE-2025-38190",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Revert atm_account_tx() if copy_from_iter_full() fails.\n\nIn vcc_sendmsg(), we account skb-\u003etruesize to sk-\u003esk_wmem_alloc by\natm_account_tx().\n\nIt is expected to be reverted by atm_pop_raw() later called by\nvcc-\u003edev-\u003eops-\u003esend(vcc, skb).\n\nHowever, vcc_sendmsg() misses the same revert when copy_from_iter_full()\nfails, and then we will leak a socket.\n\nLet's factorise the revert part as atm_return_tx() and call it in\nthe failure path.\n\nNote that the corresponding sk_wmem_alloc operation can be found in\nalloc_tx() as of the blamed commit.\n\n  $ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14e70b8b-9b3b-480b-89a5-683c95d953e1",
      "id": "CVE-2025-38261",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: save the SR_SUM status over switches\n\nWhen threads/tasks are switched we need to ensure the old execution's\nSR_SUM state is saved and the new thread has the old SR_SUM state\nrestored.\n\nThe issue was seen under heavy load especially with the syz-stress tool\nrunning, with crashes as follows in schedule_tail:\n\nUnable to handle kernel access to user memory without uaccess routines\nat virtual address 000000002749f0d0\nOops [#1]\nModules linked in:\nCPU: 1 PID: 4875 Comm: syz-executor.0 Not tainted\n5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 #0\nHardware name: riscv-virtio,qemu (DT)\nepc : schedule_tail+0x72/0xb2 kernel/sched/core.c:4264\n ra : task_pid_vnr include/linux/sched.h:1421 [inline]\n ra : schedule_tail+0x70/0xb2 kernel/sched/core.c:4264\nepc : ffffffe00008c8b0 ra : ffffffe00008c8ae sp : ffffffe025d17ec0\n gp : ffffffe005d25378 tp : ffffffe00f0d0000 t0 : 0000000000000000\n t1 : 0000000000000001 t2 : 00000000000f4240 s0 : ffffffe025d17ee0\n s1 : 000000002749f0d0 a0 : 000000000000002a a1 : 0000000000000003\n a2 : 1ffffffc0cfac500 a3 : ffffffe0000c80cc a4 : 5ae9db91c19bbe00\n a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffe000082eba\n s2 : 0000000000040000 s3 : ffffffe00eef96c0 s4 : ffffffe022c77fe0\n s5 : 0000000000004000 s6 : ffffffe067d74e00 s7 : ffffffe067d74850\n s8 : ffffffe067d73e18 s9 : ffffffe067d74e00 s10: ffffffe00eef96e8\n s11: 000000ae6cdf8368 t3 : 5ae9db91c19bbe00 t4 : ffffffc4043cafb2\n t5 : ffffffc4043cafba t6 : 0000000000040000\nstatus: 0000000000000120 badaddr: 000000002749f0d0 cause:\n000000000000000f\nCall Trace:\n[\u003cffffffe00008c8b0\u003e] schedule_tail+0x72/0xb2 kernel/sched/core.c:4264\n[\u003cffffffe000005570\u003e] ret_from_exception+0x0/0x14\nDumping ftrace buffer:\n   (ftrace buffer empty)\n---[ end trace b5f8f9231dc87dda ]---\n\nThe issue comes from the put_user() in schedule_tail\n(kernel/sched/core.c) doing the following:\n\nasmlinkage __visible void schedule_tail(struct task_struct *prev)\n{\n...\n        if (current-\u003eset_child_tid)\n                put_user(task_pid_vnr(current), current-\u003eset_child_tid);\n...\n}\n\nthe put_user() macro causes the code sequence to come out as follows:\n\n1:\t__enable_user_access()\n2:\treg = task_pid_vnr(current);\n3:\t*current-\u003eset_child_tid = reg;\n4:\t__disable_user_access()\n\nThe problem is that we may have a sleeping function as argument which\ncould clear SR_SUM causing the panic above. This was fixed by\nevaluating the argument of the put_user() macro outside the user-enabled\nsection in commit 285a76bb2cf5 (\"riscv: evaluate put_user() arg before\nenabling user access\")\"\n\nIn order for riscv to take advantage of unsafe_get/put_XXX() macros and\nto avoid the same issue we had with put_user() and sleeping functions we\nmust ensure code flow can go through switch_to() from within a region of\ncode with SR_SUM enabled and come back with SR_SUM still enabled. This\npatch addresses the problem allowing future work to enable full use of\nunsafe_get/put_XXX() macros without needing to take a CSR bit flip cost\non every access. Make switch_to() save and restore SR_SUM.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1795b590-e22f-48f8-988c-d06f3a4ede26",
      "id": "CVE-2025-38342",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoftware node: Correct a OOB check in software_node_get_reference_args()\n\nsoftware_node_get_reference_args() wants to get @index-th element, so\nthe property value requires at least '(index + 1) * sizeof(*ref)' bytes\nbut that can not be guaranteed by current OOB check, and may cause OOB\nfor malformed property.\n\nFix by using as OOB check '((index + 1) * sizeof(*ref) \u003e prop-\u003elength)'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd62408d-81e7-42f1-a8b7-dccd6b0d2d14",
      "id": "CVE-2025-38406",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: remove WARN on bad firmware input\n\nIf the firmware gives bad input, that's nothing to do with\nthe driver's stack at this point etc., so the WARN_ON()\ndoesn't add any value. Additionally, this is one of the\ntop syzbot reports now. Just print a message, and as an\nadded bonus, print the sizes too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b81b269-5a3b-4e01-83d0-842c220bdd57",
      "id": "CVE-2025-38527",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in cifs_oplock_break\n\nA race condition can occur in cifs_oplock_break() leading to a\nuse-after-free of the cinode structure when unmounting:\n\n  cifs_oplock_break()\n    _cifsFileInfo_put(cfile)\n      cifsFileInfo_put_final()\n        cifs_sb_deactive()\n          [last ref, start releasing sb]\n            kill_sb()\n              kill_anon_super()\n                generic_shutdown_super()\n                  evict_inodes()\n                    dispose_list()\n                      evict()\n                        destroy_inode()\n                          call_rcu(\u0026inode-\u003ei_rcu, i_callback)\n    spin_lock(\u0026cinode-\u003eopen_file_lock)  \u003c- OK\n                            [later] i_callback()\n                              cifs_free_inode()\n                                kmem_cache_free(cinode)\n    spin_unlock(\u0026cinode-\u003eopen_file_lock)  \u003c- UAF\n    cifs_done_oplock_break(cinode)       \u003c- UAF\n\nThe issue occurs when umount has already released its reference to the\nsuperblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this\nreleases the last reference, triggering the immediate cleanup of all\ninodes under RCU. However, cifs_oplock_break() continues to access the\ncinode after this point, resulting in use-after-free.\n\nFix this by holding an extra reference to the superblock during the\nentire oplock break operation. This ensures that the superblock and\nits inodes remain valid until the oplock break completes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea3cff45-0d23-4af4-849c-61f53d43c05f",
      "id": "CVE-2024-53216",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release svc_expkey/svc_export with rcu_work\n\nThe last reference for `cache_head` can be reduced to zero in `c_show`\nand `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,\n`svc_export_put` and `expkey_put` will be invoked, leading to two\nissues:\n\n1. The `svc_export_put` will directly free ex_uuid. However,\n   `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can\n   trigger a use-after-free issue, shown below.\n\n   ==================================================================\n   BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]\n   Read of size 1 at addr ff11000010fdc120 by task cat/870\n\n   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1\n   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n   1.16.1-2.fc37 04/01/2014\n   Call Trace:\n    \u003cTASK\u003e\n    dump_stack_lvl+0x53/0x70\n    print_address_description.constprop.0+0x2c/0x3a0\n    print_report+0xb9/0x280\n    kasan_report+0xae/0xe0\n    svc_export_show+0x362/0x430 [nfsd]\n    c_show+0x161/0x390 [sunrpc]\n    seq_read_iter+0x589/0x770\n    seq_read+0x1e5/0x270\n    proc_reg_read+0xe1/0x140\n    vfs_read+0x125/0x530\n    ksys_read+0xc1/0x160\n    do_syscall_64+0x5f/0x170\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n   Allocated by task 830:\n    kasan_save_stack+0x20/0x40\n    kasan_save_track+0x14/0x30\n    __kasan_kmalloc+0x8f/0xa0\n    __kmalloc_node_track_caller_noprof+0x1bc/0x400\n    kmemdup_noprof+0x22/0x50\n    svc_export_parse+0x8a9/0xb80 [nfsd]\n    cache_do_downcall+0x71/0xa0 [sunrpc]\n    cache_write_procfs+0x8e/0xd0 [sunrpc]\n    proc_reg_write+0xe1/0x140\n    vfs_write+0x1a5/0x6d0\n    ksys_write+0xc1/0x160\n    do_syscall_64+0x5f/0x170\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n   Freed by task 868:\n    kasan_save_stack+0x20/0x40\n    kasan_save_track+0x14/0x30\n    kasan_save_free_info+0x3b/0x60\n    __kasan_slab_free+0x37/0x50\n    kfree+0xf3/0x3e0\n    svc_export_put+0x87/0xb0 [nfsd]\n    cache_purge+0x17f/0x1f0 [sunrpc]\n    nfsd_destroy_serv+0x226/0x2d0 [nfsd]\n    nfsd_svc+0x125/0x1e0 [nfsd]\n    write_threads+0x16a/0x2a0 [nfsd]\n    nfsctl_transaction_write+0x74/0xa0 [nfsd]\n    vfs_write+0x1a5/0x6d0\n    ksys_write+0xc1/0x160\n    do_syscall_64+0x5f/0x170\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.\n   However, `svc_export_put`/`expkey_put` will call path_put, which\n   subsequently triggers a sleeping operation due to the following\n   `dput`.\n\n   =============================\n   WARNING: suspicious RCU usage\n   5.10.0-dirty #141 Not tainted\n   -----------------------------\n   ...\n   Call Trace:\n   dump_stack+0x9a/0xd0\n   ___might_sleep+0x231/0x240\n   dput+0x39/0x600\n   path_put+0x1b/0x30\n   svc_export_put+0x17/0x80\n   e_show+0x1c9/0x200\n   seq_read_iter+0x63f/0x7c0\n   seq_read+0x226/0x2d0\n   vfs_read+0x113/0x2c0\n   ksys_read+0xc9/0x170\n   do_syscall_64+0x33/0x40\n   entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFix these issues by using `rcu_work` to help release\n`svc_expkey`/`svc_export`. This approach allows for an asynchronous\ncontext to invoke `path_put` and also facilitates the freeing of\n`uuid/exp/key` after an RCU grace period.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9412a900-e7cf-43b4-86be-c8f75b8ef646",
      "id": "CVE-2025-38630",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref\n\nfb_add_videomode() can fail with -ENOMEM when its internal kmalloc() cannot\nallocate a struct fb_modelist.  If that happens, the modelist stays empty but\nthe driver continues to register.  Add a check for its return value to prevent\npoteintial null-ptr-deref, which is similar to the commit 17186f1f90d3 (\"fbdev:\nFix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "121d3d05-0c87-47c0-b078-9805289c95ca",
      "id": "CVE-2025-38663",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: reject invalid file types when reading inodes\n\nTo prevent inodes with invalid file types from tripping through the vfs\nand causing malfunctions or assertion failures, add a missing sanity check\nwhen reading an inode from a block device.  If the file type is not valid,\ntreat it as a filesystem error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a0ed5c0-f2e7-4806-abe9-2ecce13c1c04",
      "id": "CVE-2025-39705",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix a Null pointer dereference vulnerability\n\n[Why]\nA null pointer dereference vulnerability exists in the AMD display driver's\n(DC module) cleanup function dc_destruct().\nWhen display control context (dc-\u003ectx) construction fails\n(due to memory allocation failure), this pointer remains NULL.\nDuring subsequent error handling when dc_destruct() is called,\nthere's no NULL check before dereferencing the perf_trace member\n(dc-\u003ectx-\u003eperf_trace), causing a kernel null pointer dereference crash.\n\n[How]\nCheck if dc-\u003ectx is non-NULL before dereferencing.\n\n(Updated commit text and removed unnecessary error message)\n(cherry picked from commit 9dd8e2ba268c636c240a918e0a31e6feaee19404)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16f5a8ad-4975-40f8-9237-9b28f1843cd8",
      "id": "CVE-2021-27363",
      "description": "An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f5de384c-50d2-487c-aa33-9e98a956e27d",
      "id": "CVE-2021-3347",
      "description": "An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6534523a-60f2-4451-a10b-9946d090aa6d",
      "id": "CVE-2021-40490",
      "description": "A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f48edf57-4852-4453-9472-209480426f9c",
      "id": "CVE-2021-46905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hso: fix NULL-deref on disconnect regression\n\nCommit 8a12f8836145 (\"net: hso: fix null-ptr-deref during tty device\nunregistration\") fixed the racy minor allocation reported by syzbot, but\nintroduced an unconditional NULL-pointer dereference on every disconnect\ninstead.\n\nSpecifically, the serial device table must no longer be accessed after\nthe minor has been released by hso_serial_tty_unregister().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23ee472f-1728-4061-99a3-752b354b4189",
      "id": "CVE-2021-47118",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npid: take a reference when initializing `cad_pid`\n\nDuring boot, kernel_init_freeable() initializes `cad_pid` to the init\ntask's struct pid.  Later on, we may change `cad_pid` via a sysctl, and\nwhen this happens proc_do_cad_pid() will increment the refcount on the\nnew pid via get_pid(), and will decrement the refcount on the old pid\nvia put_pid().  As we never called get_pid() when we initialized\n`cad_pid`, we decrement a reference we never incremented, can therefore\nfree the init task's struct pid early.  As there can be dangling\nreferences to the struct pid, we can later encounter a use-after-free\n(e.g.  when delivering signals).\n\nThis was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to\nhave been around since the conversion of `cad_pid` to struct pid in\ncommit 9ec52099e4b8 (\"[PATCH] replace cad_pid by a struct pid\") from the\npre-KASAN stone age of v2.6.19.\n\nFix this by getting a reference to the init task's struct pid when we\nassign it to `cad_pid`.\n\nFull KASAN splat below.\n\n   ==================================================================\n   BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline]\n   BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509\n   Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273\n\n   CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1\n   Hardware name: linux,dummy-virt (DT)\n   Call trace:\n    ns_of_pid include/linux/pid.h:153 [inline]\n    task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509\n    do_notify_parent+0x308/0xe60 kernel/signal.c:1950\n    exit_notify kernel/exit.c:682 [inline]\n    do_exit+0x2334/0x2bd0 kernel/exit.c:845\n    do_group_exit+0x108/0x2c8 kernel/exit.c:922\n    get_signal+0x4e4/0x2a88 kernel/signal.c:2781\n    do_signal arch/arm64/kernel/signal.c:882 [inline]\n    do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936\n    work_pending+0xc/0x2dc\n\n   Allocated by task 0:\n    slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516\n    slab_alloc_node mm/slub.c:2907 [inline]\n    slab_alloc mm/slub.c:2915 [inline]\n    kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920\n    alloc_pid+0xdc/0xc00 kernel/pid.c:180\n    copy_process+0x2794/0x5e18 kernel/fork.c:2129\n    kernel_clone+0x194/0x13c8 kernel/fork.c:2500\n    kernel_thread+0xd4/0x110 kernel/fork.c:2552\n    rest_init+0x44/0x4a0 init/main.c:687\n    arch_call_rest_init+0x1c/0x28\n    start_kernel+0x520/0x554 init/main.c:1064\n    0x0\n\n   Freed by task 270:\n    slab_free_hook mm/slub.c:1562 [inline]\n    slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600\n    slab_free mm/slub.c:3161 [inline]\n    kmem_cache_free+0x224/0x8e0 mm/slub.c:3177\n    put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114\n    put_pid+0x30/0x48 kernel/pid.c:109\n    proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401\n    proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591\n    proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617\n    call_write_iter include/linux/fs.h:1977 [inline]\n    new_sync_write+0x3ac/0x510 fs/read_write.c:518\n    vfs_write fs/read_write.c:605 [inline]\n    vfs_write+0x9c4/0x1018 fs/read_write.c:585\n    ksys_write+0x124/0x240 fs/read_write.c:658\n    __do_sys_write fs/read_write.c:670 [inline]\n    __se_sys_write fs/read_write.c:667 [inline]\n    __arm64_sys_write+0x78/0xb0 fs/read_write.c:667\n    __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n    invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]\n    el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129\n    do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168\n    el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416\n    el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432\n    el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701\n\n   The buggy address belongs to the object at ffff23794dda0000\n    which belongs to the cache pid of size 224\n   The buggy address is located 4 bytes inside of\n    224-byte region [ff\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad0c7033-67c1-4155-baee-54e20e1d9457",
      "id": "CVE-2021-47599",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: use latest_dev in btrfs_show_devname\n\nThe test case btrfs/238 reports the warning below:\n\n WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs]\n CPU: 2 PID: 1 Comm: systemd Tainted: G        W  O 5.14.0-rc1-custom #72\n Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n Call trace:\n   btrfs_show_devname+0x108/0x1b4 [btrfs]\n   show_mountinfo+0x234/0x2c4\n   m_show+0x28/0x34\n   seq_read_iter+0x12c/0x3c4\n   vfs_read+0x29c/0x2c8\n   ksys_read+0x80/0xec\n   __arm64_sys_read+0x28/0x34\n   invoke_syscall+0x50/0xf8\n   do_el0_svc+0x88/0x138\n   el0_svc+0x2c/0x8c\n   el0t_64_sync_handler+0x84/0xe4\n   el0t_64_sync+0x198/0x19c\n\nReason:\nWhile btrfs_prepare_sprout() moves the fs_devices::devices into\nfs_devices::seed_list, the btrfs_show_devname() searches for the devices\nand found none, leading to the warning as in above.\n\nFix:\nlatest_dev is updated according to the changes to the device list.\nThat means we could use the latest_dev-\u003ename to show the device name in\n/proc/self/mounts, the pointer will be always valid as it's assigned\nbefore the device is deleted from the list in remove or replace.\nThe RCU protection is sufficient as the device structure is freed after\nsynchronization.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eabe3753-b5c0-4f59-a56d-0de2bf9ef8d5",
      "id": "CVE-2021-47603",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: improve robustness of the audit queue handling\n\nIf the audit daemon were ever to get stuck in a stopped state the\nkernel's kauditd_thread() could get blocked attempting to send audit\nrecords to the userspace audit daemon.  With the kernel thread\nblocked it is possible that the audit queue could grow unbounded as\ncertain audit record generating events must be exempt from the queue\nlimits else the system enter a deadlock state.\n\nThis patch resolves this problem by lowering the kernel thread's\nsocket sending timeout from MAX_SCHEDULE_TIMEOUT to HZ/10 and tweaks\nthe kauditd_send_queue() function to better manage the various audit\nqueues when connection problems occur between the kernel and the\naudit daemon.  With this patch, the backlog may temporarily grow\nbeyond the defined limits when the audit daemon is stopped and the\nsystem is under heavy audit pressure, but kauditd_thread() will\ncontinue to make progress and drain the queues as it would for other\nconnection problems.  For example, with the audit daemon put into a\nstopped state and the system configured to audit every syscall it\nwas still possible to shutdown the system without a kernel panic,\ndeadlock, etc.; granted, the system was slow to shutdown but that is\nto be expected given the extreme pressure of recording every syscall.\n\nThe timeout value of HZ/10 was chosen primarily through\nexperimentation and this developer's \"gut feeling\".  There is likely\nno one perfect value, but as this scenario is limited in scope (root\nprivileges would be needed to send SIGSTOP to the audit daemon), it\nis likely not worth exposing this as a tunable at present.  This can\nalways be done at a later date if it proves necessary.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d58c95a5-5aa4-482d-b4a4-cf88f730b4eb",
      "id": "CVE-2022-48865",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix kernel panic when enabling bearer\n\nWhen enabling a bearer on a node, a kernel panic is observed:\n\n[    4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc]\n...\n[    4.520030] Call Trace:\n[    4.520689]  \u003cIRQ\u003e\n[    4.521236]  tipc_link_build_proto_msg+0x375/0x750 [tipc]\n[    4.522654]  tipc_link_build_state_msg+0x48/0xc0 [tipc]\n[    4.524034]  __tipc_node_link_up+0xd7/0x290 [tipc]\n[    4.525292]  tipc_rcv+0x5da/0x730 [tipc]\n[    4.526346]  ? __netif_receive_skb_core+0xb7/0xfc0\n[    4.527601]  tipc_l2_rcv_msg+0x5e/0x90 [tipc]\n[    4.528737]  __netif_receive_skb_list_core+0x20b/0x260\n[    4.530068]  netif_receive_skb_list_internal+0x1bf/0x2e0\n[    4.531450]  ? dev_gro_receive+0x4c2/0x680\n[    4.532512]  napi_complete_done+0x6f/0x180\n[    4.533570]  virtnet_poll+0x29c/0x42e [virtio_net]\n...\n\nThe node in question is receiving activate messages in another\nthread after changing bearer status to allow message sending/\nreceiving in current thread:\n\n         thread 1           |              thread 2\n         --------           |              --------\n                            |\ntipc_enable_bearer()        |\n  test_and_set_bit_lock()   |\n    tipc_bearer_xmit_skb()  |\n                            | tipc_l2_rcv_msg()\n                            |   tipc_rcv()\n                            |     __tipc_node_link_up()\n                            |       tipc_link_build_state_msg()\n                            |         tipc_link_build_proto_msg()\n                            |           tipc_mon_prep()\n                            |           {\n                            |             ...\n                            |             // null-pointer dereference\n                            |             u16 gen = mon-\u003edom_gen;\n                            |             ...\n                            |           }\n  // Not being executed yet |\n  tipc_mon_create()         |\n  {                         |\n    ...                     |\n    // allocate             |\n    mon = kzalloc();        |\n    ...                     |\n  }                         |\n\nMonitoring pointer in thread 2 is dereferenced before monitoring data\nis allocated in thread 1. This causes kernel panic.\n\nThis commit fixes it by allocating the monitoring data before enabling\nthe bearer to receive messages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f5714cc-5a6f-43ef-8bb7-00406b23d335",
      "id": "CVE-2022-49317",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: avoid infinite loop to flush node pages\n\nxfstests/generic/475 can give EIO all the time which give an infinite loop\nto flush node page like below. Let's avoid it.\n\n[16418.518551] Call Trace:\n[16418.518553]  ? dm_submit_bio+0x48/0x400\n[16418.518574]  ? submit_bio_checks+0x1ac/0x5a0\n[16418.525207]  __submit_bio+0x1a9/0x230\n[16418.525210]  ? kmem_cache_alloc+0x29e/0x3c0\n[16418.525223]  submit_bio_noacct+0xa8/0x2b0\n[16418.525226]  submit_bio+0x4d/0x130\n[16418.525238]  __submit_bio+0x49/0x310 [f2fs]\n[16418.525339]  ? bio_add_page+0x6a/0x90\n[16418.525344]  f2fs_submit_page_bio+0x134/0x1f0 [f2fs]\n[16418.525365]  read_node_page+0x125/0x1b0 [f2fs]\n[16418.525388]  __get_node_page.part.0+0x58/0x3f0 [f2fs]\n[16418.525409]  __get_node_page+0x2f/0x60 [f2fs]\n[16418.525431]  f2fs_get_dnode_of_data+0x423/0x860 [f2fs]\n[16418.525452]  ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n[16418.525458]  ? __mod_memcg_state.part.0+0x2a/0x30\n[16418.525465]  ? __mod_memcg_lruvec_state+0x27/0x40\n[16418.525467]  ? __xa_set_mark+0x57/0x70\n[16418.525472]  f2fs_do_write_data_page+0x10e/0x7b0 [f2fs]\n[16418.525493]  f2fs_write_single_data_page+0x555/0x830 [f2fs]\n[16418.525514]  ? sysvec_apic_timer_interrupt+0x4e/0x90\n[16418.525518]  ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n[16418.525523]  f2fs_write_cache_pages+0x303/0x880 [f2fs]\n[16418.525545]  ? blk_flush_plug_list+0x47/0x100\n[16418.525548]  f2fs_write_data_pages+0xfd/0x320 [f2fs]\n[16418.525569]  do_writepages+0xd5/0x210\n[16418.525648]  filemap_fdatawrite_wbc+0x7d/0xc0\n[16418.525655]  filemap_fdatawrite+0x50/0x70\n[16418.525658]  f2fs_sync_dirty_inodes+0xa4/0x230 [f2fs]\n[16418.525679]  f2fs_write_checkpoint+0x16d/0x1720 [f2fs]\n[16418.525699]  ? ttwu_do_wakeup+0x1c/0x160\n[16418.525709]  ? ttwu_do_activate+0x6d/0xd0\n[16418.525711]  ? __wait_for_common+0x11d/0x150\n[16418.525715]  kill_f2fs_super+0xca/0x100 [f2fs]\n[16418.525733]  deactivate_locked_super+0x3b/0xb0\n[16418.525739]  deactivate_super+0x40/0x50\n[16418.525741]  cleanup_mnt+0x139/0x190\n[16418.525747]  __cleanup_mnt+0x12/0x20\n[16418.525749]  task_work_run+0x6d/0xa0\n[16418.525765]  exit_to_user_mode_prepare+0x1ad/0x1b0\n[16418.525771]  syscall_exit_to_user_mode+0x27/0x50\n[16418.525774]  do_syscall_64+0x48/0xc0\n[16418.525776]  entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c92929ea-11f9-48e2-8818-95d0b5781a89",
      "id": "CVE-2022-49370",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle\n\nkobject_init_and_add() takes reference even when it fails.\nAccording to the doc of kobject_init_and_add()\n\n   If this function returns an error, kobject_put() must be called to\n   properly clean up the memory associated with the object.\n\nFix this issue by calling kobject_put().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d061790d-bfd3-4118-ac7f-0c6dfde4cf5c",
      "id": "CVE-2022-49453",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc\n\nThe allocation funciton devm_kcalloc may fail and return a null pointer,\nwhich would cause a null-pointer dereference later.\nIt might be better to check it and directly return -ENOMEM just like the\nusage of devm_kcalloc in previous code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27f10f3d-57c4-4125-bac2-89ff976fe550",
      "id": "CVE-2022-49478",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init\n\nSyzbot reported that -1 is used as array index. The problem was in\nmissing validation check.\n\nhdw-\u003eunit_number is initialized with -1 and then if init table walk fails\nthis value remains unchanged. Since code blindly uses this member for\narray indexing adding sanity check is the easiest fix for that.\n\nhdw-\u003eworkpoll initialization moved upper to prevent warning in\n__flush_work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dea58a8d-b598-437d-955f-ef4880aa29b0",
      "id": "CVE-2022-49490",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected\n\nmdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring\nthe modeset lock, but currently mdp5_pipe_release doesn't check for if\nan error is returned. Because of this, there is a possibility of\nmdp5_pipe_release hitting a NULL dereference error.\n\nTo avoid this, let's have mdp5_pipe_release check if\nmdp5_get_global_state returns an error and propogate that error.\n\nChanges since v1:\n- Separated declaration and initialization of *new_state to avoid\n  compiler warning\n- Fixed some spelling mistakes in commit message\n\nChanges since v2:\n- Return 0 in case where hwpipe is NULL as this is considered normal\n  behavior\n- Added 2nd patch in series to fix a similar NULL dereference issue in\n  mdp5_mixer_release\n\nPatchwork: https://patchwork.freedesktop.org/patch/485179/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e8c5182-66b9-483a-9a75-fea30f0205a2",
      "id": "CVE-2024-57802",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: check buffer length before accessing it\n\nSyzkaller reports an uninit value read from ax25cmp when sending raw message\nthrough ieee802154 implementation.\n\n=====================================================\nBUG: KMSAN: uninit-value in ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119\n ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119\n nr_dev_get+0x20e/0x450 net/netrom/nr_route.c:601\n nr_route_frame+0x1a2/0xfc0 net/netrom/nr_route.c:774\n nr_xmit+0x5a/0x1c0 net/netrom/nr_dev.c:144\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n raw_sendmsg+0x654/0xc10 net/ieee802154/socket.c:299\n ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n alloc_skb include/linux/skbuff.h:1286 [inline]\n alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2780\n sock_alloc_send_skb include/net/sock.h:1884 [inline]\n raw_sendmsg+0x36d/0xc10 net/ieee802154/socket.c:282\n ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nCPU: 0 PID: 5037 Comm: syz-executor166 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\n=====================================================\n\nThis issue occurs because the skb buffer is too small, and it's actual\nallocation is aligned. This hides an actual issue, which is that nr_route_frame\ndoes not validate the buffer size before using it.\n\nFix this issue by checking skb-\u003elen before accessing any fields in skb-\u003edata.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d42a9e6d-7b1d-4748-b7e1-c08d11dfe98a",
      "id": "CVE-2022-49530",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix double free in si_parse_power_table()\n\nIn function si_parse_power_table(), array adev-\u003epm.dpm.ps and its member\nis allocated. If the allocation of each member fails, the array itself\nis freed and returned with an error code. However, the array is later\nfreed again in si_dpm_fini() function which is called when the function\nreturns an error.\n\nThis leads to potential double free of the array adev-\u003epm.dpm.ps, as\nwell as leak of its array members, since the members are not freed in\nthe allocation function and the array is not nulled when freed.\nIn addition adev-\u003epm.dpm.num_ps, which keeps track of the allocated\narray member, is not updated until the member allocation is\nsuccessfully finished, this could also lead to either use after free,\nor uninitialized variable access in si_dpm_fini().\n\nFix this by postponing the free of the array until si_dpm_fini() and\nincrement adev-\u003epm.dpm.num_ps everytime the array member is allocated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba8a6d97-2f6c-459e-adf2-6ed712a97be8",
      "id": "CVE-2022-49534",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT\n\nThere is a potential memory leak in lpfc_ignore_els_cmpl() and\nlpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT\n(lpfc_rcv_plogi()'s login_mbox).\n\nCheck if cmdiocb-\u003econtext_un.mbox was allocated in lpfc_ignore_els_cmpl(),\nand then free it back to phba-\u003embox_mem_pool along with mbox-\u003ectx_buf for\nservice parameters.\n\nFor lpfc_els_rsp_reject() failure, free both the ctx_buf for service\nparameters and the login_mbox.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "526e801f-b184-4fcc-80b0-0e9ac98918cf",
      "id": "CVE-2022-49640",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Fix data races in proc_douintvec_minmax().\n\nA sysctl variable is accessed concurrently, and there is always a chance\nof data-race.  So, all readers and writers need some basic protection to\navoid load/store-tearing.\n\nThis patch changes proc_douintvec_minmax() to use READ_ONCE() and\nWRITE_ONCE() internally to fix data-races on the sysctl side.  For now,\nproc_douintvec_minmax() itself is tolerant to a data-race, but we still\nneed to add annotations on the other subsystem's side.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a337076e-bef3-4d61-988d-30d74f6e4fa7",
      "id": "CVE-2022-49936",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Prevent nested device-reset calls\n\nAutomatic kernel fuzzing revealed a recursive locking violation in\nusb-storage:\n\n============================================\nWARNING: possible recursive locking detected\n5.18.0 #3 Not tainted\n--------------------------------------------\nkworker/1:3/1205 is trying to acquire lock:\nffff888018638db8 (\u0026us_interface_key[i]){+.+.}-{3:3}, at:\nusb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230\n\nbut task is already holding lock:\nffff888018638db8 (\u0026us_interface_key[i]){+.+.}-{3:3}, at:\nusb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230\n\n...\n\nstack backtrace:\nCPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\nprint_deadlock_bug kernel/locking/lockdep.c:2988 [inline]\ncheck_deadlock kernel/locking/lockdep.c:3031 [inline]\nvalidate_chain kernel/locking/lockdep.c:3816 [inline]\n__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053\nlock_acquire kernel/locking/lockdep.c:5665 [inline]\nlock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630\n__mutex_lock_common kernel/locking/mutex.c:603 [inline]\n__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747\nusb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230\nusb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109\nr871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622\nusb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458\ndevice_remove drivers/base/dd.c:545 [inline]\ndevice_remove+0x11f/0x170 drivers/base/dd.c:537\n__device_release_driver drivers/base/dd.c:1222 [inline]\ndevice_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248\nusb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627\nusb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118\nusb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114\n\nThis turned out not to be an error in usb-storage but rather a nested\ndevice reset attempt.  That is, as the rtl8712 driver was being\nunbound from a composite device in preparation for an unrelated USB\nreset (that driver does not have pre_reset or post_reset callbacks),\nits -\u003eremove routine called usb_reset_device() -- thus nesting one\nreset call within another.\n\nPerforming a reset as part of disconnect processing is a questionable\npractice at best.  However, the bug report points out that the USB\ncore does not have any protection against nested resets.  Adding a\nreset_in_progress flag and testing it will prevent such errors in the\nfuture.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83ba9e99-ae2c-4ac2-8c48-eb55f5c65220",
      "id": "CVE-2022-50406",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: iomap: fix memory corruption when recording errors during writeback\n\nEvery now and then I see this crash on arm64:\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000f8\nBuffer I/O error on dev dm-0, logical block 8733687, async page read\nMem abort info:\n  ESR = 0x0000000096000006\n  EC = 0x25: DABT (current EL), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x06: level 2 translation fault\nData abort info:\n  ISV = 0, ISS = 0x00000006\n  CM = 0, WnR = 0\nuser pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000\n[00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000\nInternal error: Oops: 96000006 [#1] PREEMPT SMP\nBuffer I/O error on dev dm-0, logical block 8733688, async page read\nDumping ftrace buffer:\nBuffer I/O error on dev dm-0, logical block 8733689, async page read\n   (ftrace buffer empty)\nXFS (dm-0): log I/O error -5\nModules linked in: dm_thin_pool dm_persistent_data\nXFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296).\n dm_bio_prison\nXFS (dm-0): Please unmount the filesystem and rectify the problem(s)\nXFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0\n dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT\npotentially unexpected fatal signal 6.\n nf_reject_ipv6\npotentially unexpected fatal signal 6.\n ipt_REJECT nf_reject_ipv4\nCPU: 1 PID: 122166 Comm: fsstress Tainted: G        W          6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7\n rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables\nHardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021\npstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)\n ip_tables\npc : 000003fd6d7df200\n x_tables\nlr : 000003fd6d7df1ec\n overlay nfsv4\nCPU: 0 PID: 54031 Comm: u4:3 Tainted: G        W          6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405\nHardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021\nWorkqueue: writeback wb_workfn\nsp : 000003ffd9522fd0\n (flush-253:0)\npstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--)\npc : errseq_set+0x1c/0x100\nx29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780\nx26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000\nx23: 00000000ffffffff x22: 0000000000000005\nlr : __filemap_set_wb_err+0x24/0xe0\n x21: 0000000000000006\nsp : fffffe000f80f760\nx29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8\nx26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868\nx23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000\nx20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000\n\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000\nx11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288\nx8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000\nx5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8\nx20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001\nx17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668\nx2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8\nCall trace:\n errseq_set+0x1c/0x100\n __filemap_set_wb_err+0x24/0xe0\n iomap_do_writepage+0x5e4/0xd5c\n write_cache_pages+0x208/0x674\n iomap_writepages+0x34/0x60\n xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b]\nx14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180\nx11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288\nx8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee\nx5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020\nx2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000\nCPU: \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c17a892e-5cac-49f1-8552-5a789e770e11",
      "id": "CVE-2023-23455",
      "description": "atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58fbf7be-ae74-4fcf-8958-292e86e077ef",
      "id": "CVE-2023-33952",
      "description": "A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16fcbcaf-728c-4f11-9d7c-e8e16776263a",
      "id": "CVE-2023-4132",
      "description": "A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0fcca774-ca14-4048-96aa-6f679ef27fe1",
      "id": "CVE-2023-52485",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wake DMCUB before sending a command\n\n[Why]\nWe can hang in place trying to send commands when the DMCUB isn't\npowered on.\n\n[How]\nFor functions that execute within a DC context or DC lock we can\nwrap the direct calls to dm_execute_dmub_cmd/list with code that\nexits idle power optimizations and reallows once we're done with\nthe command submission on success.\n\nFor DM direct submissions the DM will need to manage the enter/exit\nsequencing manually.\n\nWe cannot invoke a DMCUB command directly within the DM execution\nhelper or we can deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97dd05ab-5b03-4a02-bfa9-eadb3ba53734",
      "id": "CVE-2023-52669",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: s390/aes - Fix buffer overread in CTR mode\n\nWhen processing the last block, the s390 ctr code will always read\na whole block, even if there isn't a whole block of data left.  Fix\nthis by using the actual length left and copy it into a buffer first\nfor processing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d2d7da24-691e-4dda-9c5c-f0f9bf425fcd",
      "id": "CVE-2023-52899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nAdd exception protection processing for vd in axi_chan_handle_err function\n\nSince there is no protection for vd, a kernel panic will be\ntriggered here in exceptional cases.\n\nYou can refer to the processing of axi_chan_block_xfer_complete function\n\nThe triggered kernel panic is as follows:\n\n[   67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n[   67.848447] Mem abort info:\n[   67.848449]   ESR = 0x96000004\n[   67.848451]   EC = 0x25: DABT (current EL), IL = 32 bits\n[   67.848454]   SET = 0, FnV = 0\n[   67.848456]   EA = 0, S1PTW = 0\n[   67.848458] Data abort info:\n[   67.848460]   ISV = 0, ISS = 0x00000004\n[   67.848462]   CM = 0, WnR = 0\n[   67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000\n[   67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000\n[   67.848472] Internal error: Oops: 96000004 [#1] SMP\n[   67.848475] Modules linked in: dmatest\n[   67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11\n[   67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--)\n[   67.848487] pc : axi_chan_handle_err+0xc4/0x230\n[   67.848491] lr : axi_chan_handle_err+0x30/0x230\n[   67.848493] sp : ffff0803fe55ae50\n[   67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200\n[   67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080\n[   67.848504] x25: ffff800010d33880 x24: ffff80001139d850\n[   67.848508] x23: ffff0800c097c168 x22: 0000000000000000\n[   67.848512] x21: 0000000000000080 x20: 0000000000002000\n[   67.848517] x19: ffff0800c097c080 x18: 0000000000000000\n[   67.848521] x17: 0000000000000000 x16: 0000000000000000\n[   67.848525] x15: 0000000000000000 x14: 0000000000000000\n[   67.848529] x13: 0000000000000000 x12: 0000000000000040\n[   67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a\n[   67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270\n[   67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0\n[   67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480\n[   67.848550] x3 : dead000000000100 x2 : dead000000000122\n[   67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168\n[   67.848559] Call trace:\n[   67.848562]  axi_chan_handle_err+0xc4/0x230\n[   67.848566]  dw_axi_dma_interrupt+0xf4/0x590\n[   67.848569]  __handle_irq_event_percpu+0x60/0x220\n[   67.848573]  handle_irq_event+0x64/0x120\n[   67.848576]  handle_fasteoi_irq+0xc4/0x220\n[   67.848580]  __handle_domain_irq+0x80/0xe0\n[   67.848583]  gic_handle_irq+0xc0/0x138\n[   67.848585]  el1_irq+0xc8/0x180\n[   67.848588]  arch_cpu_idle+0x14/0x2c\n[   67.848591]  default_idle_call+0x40/0x16c\n[   67.848594]  do_idle+0x1f0/0x250\n[   67.848597]  cpu_startup_entry+0x2c/0x60\n[   67.848600]  rest_init+0xc0/0xcc\n[   67.848603]  arch_call_rest_init+0x14/0x1c\n[   67.848606]  start_kernel+0x4cc/0x500\n[   67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1)\n[   67.848613] ---[ end trace 585a97036f88203a ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4225dda5-7228-49d5-88fc-64ccd6ffe545",
      "id": "CVE-2023-53265",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ensure that VID header offset + VID header size \u003c= alloc, size\n\nEnsure that the VID header offset + VID header size does not exceed\nthe allocated area to avoid slab OOB.\n\nBUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline]\nBUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline]\nBUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197\nRead of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555\n\nCPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G        W\n6.0.0-1868 #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29\n04/01/2014\nCall Trace:\n  \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x85/0xad lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:317 [inline]\n  print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433\n  kasan_report+0xa7/0x11b mm/kasan/report.c:495\n  crc32_body lib/crc32.c:111 [inline]\n  crc32_le_generic lib/crc32.c:179 [inline]\n  crc32_le_base+0x58c/0x626 lib/crc32.c:197\n  ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067\n  create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317\n  create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]\n  ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812\n  ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601\n  ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965\n  ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:870 [inline]\n  __se_sys_ioctl fs/ioctl.c:856 [inline]\n  __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0x0\nRIP: 0033:0x7f96d5cf753d\nCode:\nRSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d\nRDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003\nRBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0\nR13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000\n  \u003c/TASK\u003e\n\nAllocated by task 1555:\n  kasan_save_stack+0x20/0x3d mm/kasan/common.c:38\n  kasan_set_track mm/kasan/common.c:45 [inline]\n  set_alloc_info mm/kasan/common.c:437 [inline]\n  ____kasan_kmalloc mm/kasan/common.c:516 [inline]\n  __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525\n  kasan_kmalloc include/linux/kasan.h:234 [inline]\n  __kmalloc+0x138/0x257 mm/slub.c:4429\n  kmalloc include/linux/slab.h:605 [inline]\n  ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline]\n  create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295\n  create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]\n  ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812\n  ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601\n  ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965\n  ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:870 [inline]\n  __se_sys_ioctl fs/ioctl.c:856 [inline]\n  __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0x0\n\nThe buggy address belongs to the object at ffff88802bb36e00\n  which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 0 bytes to the right of\n  256-byte region [ffff88802bb36e00, ffff88802bb36f00)\n\nThe buggy address belongs to the physical page:\npage:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000\nindex:0x0 pfn:0x2bb36\nhead:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0\nflags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)\nraw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40\nraw: 0000000000000000 00000000001\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7fbefb1-5f03-4689-99fe-f69ba0bc8631",
      "id": "CVE-2023-53338",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlwt: Fix return values of BPF xmit ops\n\nBPF encap ops can return different types of positive values, such like\nNET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function\nskb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return\nvalues would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in\nip(6)_finish_output2. When this happens, skbs that have been freed would\ncontinue to the neighbor subsystem, causing use-after-free bug and\nkernel crashes.\n\nTo fix the incorrect behavior, skb_do_redirect return values can be\nsimply discarded, the same as tc-egress behavior. On the other hand,\nbpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU\ninformation. Thus convert its return values to avoid the conflict with\nLWTUNNEL_XMIT_CONTINUE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84e18741-8767-41c0-847e-5f090ec5287b",
      "id": "CVE-2023-6270",
      "description": "A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e2f51c5-f575-4e3e-9e7d-1565c10fb142",
      "id": "CVE-2023-6531",
      "description": "A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14dbe2b1-57bf-412f-9814-83cac80dc1fc",
      "id": "CVE-2024-0607",
      "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20b9e5d7-b16c-4d14-a486-ef5a7deadd37",
      "id": "CVE-2024-26625",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: call sock_orphan() at release time\n\nsyzbot reported an interesting trace [1] caused by a stale sk-\u003esk_wq\npointer in a closed llc socket.\n\nIn commit ff7b11aa481f (\"net: socket: set sock-\u003esk to NULL after\ncalling proto_ops::release()\") Eric Biggers hinted that some protocols\nare missing a sock_orphan(), we need to perform a full audit.\n\nIn net-next, I plan to clear sock-\u003esk from sock_orphan() and\namend Eric patch to add a warning.\n\n[1]\n BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline]\n BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]\n BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline]\n BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468\nRead of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27\n\nCPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0xc4/0x620 mm/kasan/report.c:488\n  kasan_report+0xda/0x110 mm/kasan/report.c:601\n  list_empty include/linux/list.h:373 [inline]\n  waitqueue_active include/linux/wait.h:127 [inline]\n  sock_def_write_space_wfree net/core/sock.c:3384 [inline]\n  sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468\n  skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080\n  skb_release_all net/core/skbuff.c:1092 [inline]\n  napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404\n  e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970\n  e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline]\n  e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801\n  __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576\n  napi_poll net/core/dev.c:6645 [inline]\n  net_rx_action+0x956/0xe90 net/core/dev.c:6778\n  __do_softirq+0x21a/0x8de kernel/softirq.c:553\n  run_ksoftirqd kernel/softirq.c:921 [inline]\n  run_ksoftirqd+0x31/0x60 kernel/softirq.c:913\n  smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164\n  kthread+0x2c6/0x3a0 kernel/kthread.c:388\n  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242\n \u003c/TASK\u003e\n\nAllocated by task 5167:\n  kasan_save_stack+0x33/0x50 mm/kasan/common.c:47\n  kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n  unpoison_slab_object mm/kasan/common.c:314 [inline]\n  __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340\n  kasan_slab_alloc include/linux/kasan.h:201 [inline]\n  slab_post_alloc_hook mm/slub.c:3813 [inline]\n  slab_alloc_node mm/slub.c:3860 [inline]\n  kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879\n  alloc_inode_sb include/linux/fs.h:3019 [inline]\n  sock_alloc_inode+0x25/0x1c0 net/socket.c:308\n  alloc_inode+0x5d/0x220 fs/inode.c:260\n  new_inode_pseudo+0x16/0x80 fs/inode.c:1005\n  sock_alloc+0x40/0x270 net/socket.c:634\n  __sock_create+0xbc/0x800 net/socket.c:1535\n  sock_create net/socket.c:1622 [inline]\n  __sys_socket_create net/socket.c:1659 [inline]\n  __sys_socket+0x14c/0x260 net/socket.c:1706\n  __do_sys_socket net/socket.c:1720 [inline]\n  __se_sys_socket net/socket.c:1718 [inline]\n  __x64_sys_socket+0x72/0xb0 net/socket.c:1718\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nFreed by task 0:\n  kasan_save_stack+0x33/0x50 mm/kasan/common.c:47\n  kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n  kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\n  poison_slab_object mm/kasan/common.c:241 [inline]\n  __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257\n  kasan_slab_free include/linux/kasan.h:184 [inline]\n  slab_free_hook mm/slub.c:2121 [inlin\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00b40af6-b92d-431f-9777-b40cece1b11c",
      "id": "CVE-2024-27002",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: Do a runtime PM get on controllers during probe\n\nmt8183-mfgcfg has a mutual dependency with genpd during the probing\nstage, which leads to a deadlock in the following call stack:\n\nCPU0:  genpd_lock --\u003e clk_prepare_lock\ngenpd_power_off_work_fn()\n genpd_lock()\n generic_pm_domain::power_off()\n    clk_unprepare()\n      clk_prepare_lock()\n\nCPU1: clk_prepare_lock --\u003e genpd_lock\nclk_register()\n  __clk_core_init()\n    clk_prepare_lock()\n    clk_pm_runtime_get()\n      genpd_lock()\n\nDo a runtime PM get at the probe function to make sure clk_register()\nwon't acquire the genpd lock. Instead of only modifying mt8183-mfgcfg,\ndo this on all mediatek clock controller probings because we don't\nbelieve this would cause any regression.\n\nVerified on MT8183 and MT8192 Chromebooks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "531c1a01-9e57-4c2b-b85a-90252dab74da",
      "id": "CVE-2024-35861",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3af7780-1e07-47ca-9985-bdb0a05e5ee9",
      "id": "CVE-2024-38661",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ap: Fix crash in AP internal function modify_bitmap()\n\nA system crash like this\n\n  Failing address: 200000cb7df6f000 TEID: 200000cb7df6f403\n  Fault in home space mode while using kernel ASCE.\n  AS:00000002d71bc007 R3:00000003fe5b8007 S:000000011a446000 P:000000015660c13d\n  Oops: 0038 ilc:3 [#1] PREEMPT SMP\n  Modules linked in: mlx5_ib ...\n  CPU: 8 PID: 7556 Comm: bash Not tainted 6.9.0-rc7 #8\n  Hardware name: IBM 3931 A01 704 (LPAR)\n  Krnl PSW : 0704e00180000000 0000014b75e7b606 (ap_parse_bitmap_str+0x10e/0x1f8)\n  R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\n  Krnl GPRS: 0000000000000001 ffffffffffffffc0 0000000000000001 00000048f96b75d3\n  000000cb00000100 ffffffffffffffff ffffffffffffffff 000000cb7df6fce0\n  000000cb7df6fce0 00000000ffffffff 000000000000002b 00000048ffffffff\n  000003ff9b2dbc80 200000cb7df6fcd8 0000014bffffffc0 000000cb7df6fbc8\n  Krnl Code: 0000014b75e7b5fc: a7840047            brc     8,0000014b75e7b68a\n  0000014b75e7b600: 18b2                lr      %r11,%r2\n  #0000014b75e7b602: a7f4000a            brc     15,0000014b75e7b616\n  \u003e0000014b75e7b606: eb22d00000e6        laog    %r2,%r2,0(%r13)\n  0000014b75e7b60c: a7680001            lhi     %r6,1\n  0000014b75e7b610: 187b                lr      %r7,%r11\n  0000014b75e7b612: 84960021            brxh    %r9,%r6,0000014b75e7b654\n  0000014b75e7b616: 18e9                lr      %r14,%r9\n  Call Trace:\n  [\u003c0000014b75e7b606\u003e] ap_parse_bitmap_str+0x10e/0x1f8\n  ([\u003c0000014b75e7b5dc\u003e] ap_parse_bitmap_str+0xe4/0x1f8)\n  [\u003c0000014b75e7b758\u003e] apmask_store+0x68/0x140\n  [\u003c0000014b75679196\u003e] kernfs_fop_write_iter+0x14e/0x1e8\n  [\u003c0000014b75598524\u003e] vfs_write+0x1b4/0x448\n  [\u003c0000014b7559894c\u003e] ksys_write+0x74/0x100\n  [\u003c0000014b7618a440\u003e] __do_syscall+0x268/0x328\n  [\u003c0000014b761a3558\u003e] system_call+0x70/0x98\n  INFO: lockdep is turned off.\n  Last Breaking-Event-Address:\n  [\u003c0000014b75e7b636\u003e] ap_parse_bitmap_str+0x13e/0x1f8\n  Kernel panic - not syncing: Fatal exception: panic_on_oops\n\noccured when /sys/bus/ap/a[pq]mask was updated with a relative mask value\n(like +0x10-0x12,+60,-90) with one of the numeric values exceeding INT_MAX.\n\nThe fix is simple: use unsigned long values for the internal variables. The\ncorrect checks are already in place in the function but a simple int for\nthe internal variables was used with the possibility to overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "461e3ad2-edab-4f51-932c-5ad06e0efd85",
      "id": "CVE-2024-39499",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmci: prevent speculation leaks by sanitizing event in event_deliver()\n\nCoverity spotted that event_msg is controlled by user-space,\nevent_msg-\u003eevent_data.event is passed to event_deliver() and used\nas an index without sanitization.\n\nThis change ensures that the event index is sanitized to mitigate any\npossibility of speculative information leaks.\n\nThis bug was discovered and resolved using Coverity Static Analysis\nSecurity Testing (SAST) by Synopsys, Inc.\n\nOnly compile tested, no access to HW.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63919160-f0ac-4cd2-891a-50a06ebd1466",
      "id": "CVE-2024-46836",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed_udc: validate endpoint index for ast udc\n\nWe should verify the bound of the array to assure that host\nmay not manipulate the index to point past endpoint array.\n\nFound by static analysis.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db0e6cba-9ac2-4f73-b1a8-4c3db7101381",
      "id": "CVE-2024-41001",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/sqpoll: work around a potential audit memory leak\n\nkmemleak complains that there's a memory leak related to connect\nhandling:\n\nunreferenced object 0xffff0001093bdf00 (size 128):\ncomm \"iou-sqp-455\", pid 457, jiffies 4294894164\nhex dump (first 32 bytes):\n02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00  ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nbacktrace (crc 2e481b1a):\n[\u003c00000000c0a26af4\u003e] kmemleak_alloc+0x30/0x38\n[\u003c000000009c30bb45\u003e] kmalloc_trace+0x228/0x358\n[\u003c000000009da9d39f\u003e] __audit_sockaddr+0xd0/0x138\n[\u003c0000000089a93e34\u003e] move_addr_to_kernel+0x1a0/0x1f8\n[\u003c000000000b4e80e6\u003e] io_connect_prep+0x1ec/0x2d4\n[\u003c00000000abfbcd99\u003e] io_submit_sqes+0x588/0x1e48\n[\u003c00000000e7c25e07\u003e] io_sq_thread+0x8a4/0x10e4\n[\u003c00000000d999b491\u003e] ret_from_fork+0x10/0x20\n\nwhich can can happen if:\n\n1) The command type does something on the prep side that triggers an\n   audit call.\n2) The thread hasn't done any operations before this that triggered\n   an audit call inside -\u003eissue(), where we have audit_uring_entry()\n   and audit_uring_exit().\n\nWork around this by issuing a blanket NOP operation before the SQPOLL\ndoes anything.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "542de636-fc50-4d7f-9a68-dabab6f61ed8",
      "id": "CVE-2024-41081",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nila: block BH in ila_output()\n\nAs explained in commit 1378817486d6 (\"tipc: block BH\nbefore using dst_cache\"), net/core/dst_cache.c\nhelpers need to be called with BH disabled.\n\nila_output() is called from lwtunnel_output()\npossibly from process context, and under rcu_read_lock().\n\nWe might be interrupted by a softirq, re-enter ila_output()\nand corrupt dst_cache data structures.\n\nFix the race by using local_bh_disable().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77327065-7af0-4105-abad-eeffa86b0826",
      "id": "CVE-2024-42066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix potential integer overflow in page size calculation\n\nExplicitly cast tbo-\u003epage_alignment to u64 before bit-shifting to\nprevent overflow when assigning to min_page_size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec09fb73-bbf5-401b-acc5-8ddfcb5d091d",
      "id": "CVE-2024-42075",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix remap of arena.\n\nThe bpf arena logic didn't account for mremap operation. Add a refcnt for\nmultiple mmap events to prevent use-after-free in arena_vm_close.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be5ffbf6-8a4d-4b58-aedf-f1371ce6031f",
      "id": "CVE-2023-53413",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: isp116x: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06435d04-4e3f-4f91-9f0b-0a9a3f11e917",
      "id": "CVE-2024-42153",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr\n\nWhen del_timer_sync() is called in an interrupt context it throws a warning\nbecause of potential deadlock. The timer is used only to exit from\nwait_for_completion() after a timeout so replacing the call with\nwait_for_completion_timeout() allows to remove the problematic timer and\nits related functions altogether.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2967d36d-4df5-424e-bba2-694e85e186eb",
      "id": "CVE-2024-42246",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket\n\nWhen using a BPF program on kernel_connect(), the call can return -EPERM. This\ncauses xs_tcp_setup_socket() to loop forever, filling up the syslog and causing\nthe kernel to potentially freeze up.\n\nNeil suggested:\n\n  This will propagate -EPERM up into other layers which might not be ready\n  to handle it. It might be safer to map EPERM to an error we would be more\n  likely to expect from the network system - such as ECONNREFUSED or ENETDOWN.\n\nECONNREFUSED as error seems reasonable. For programs setting a different error\ncan be out of reach (see handling in 4fbac77d2d09) in particular on kernels\nwhich do not have f10d05966196 (\"bpf: Make BPF_PROG_RUN_ARRAY return -err\ninstead of allow boolean\"), thus given that it is better to simply remap for\nconsistent behavior. UDP does handle EPERM in xs_udp_send_request().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92012a99-c3dd-464b-a39e-267bcebec485",
      "id": "CVE-2024-43901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL pointer dereference for DTN log in DCN401\n\nWhen users run the command:\n\ncat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log\n\nThe following NULL pointer dereference happens:\n\n[  +0.000003] BUG: kernel NULL pointer dereference, address: NULL\n[  +0.000005] #PF: supervisor instruction fetch in kernel mode\n[  +0.000002] #PF: error_code(0x0010) - not-present page\n[  +0.000002] PGD 0 P4D 0\n[  +0.000004] Oops: 0010 [#1] PREEMPT SMP NOPTI\n[  +0.000003] RIP: 0010:0x0\n[  +0.000008] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[...]\n[  +0.000002] PKRU: 55555554\n[  +0.000002] Call Trace:\n[  +0.000002]  \u003cTASK\u003e\n[  +0.000003]  ? show_regs+0x65/0x70\n[  +0.000006]  ? __die+0x24/0x70\n[  +0.000004]  ? page_fault_oops+0x160/0x470\n[  +0.000006]  ? do_user_addr_fault+0x2b5/0x690\n[  +0.000003]  ? prb_read_valid+0x1c/0x30\n[  +0.000005]  ? exc_page_fault+0x8c/0x1a0\n[  +0.000005]  ? asm_exc_page_fault+0x27/0x30\n[  +0.000012]  dcn10_log_color_state+0xf9/0x510 [amdgpu]\n[  +0.000306]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000003]  ? vsnprintf+0x2fb/0x600\n[  +0.000009]  dcn10_log_hw_state+0xfd0/0xfe0 [amdgpu]\n[  +0.000218]  ? __mod_memcg_lruvec_state+0xe8/0x170\n[  +0.000008]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? debug_smp_processor_id+0x17/0x20\n[  +0.000003]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? set_ptes.isra.0+0x2b/0x90\n[  +0.000004]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? _raw_spin_unlock+0x19/0x40\n[  +0.000004]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? do_anonymous_page+0x337/0x700\n[  +0.000004]  dtn_log_read+0x82/0x120 [amdgpu]\n[  +0.000207]  full_proxy_read+0x66/0x90\n[  +0.000007]  vfs_read+0xb0/0x340\n[  +0.000005]  ? __count_memcg_events+0x79/0xe0\n[  +0.000002]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000003]  ? count_memcg_events.constprop.0+0x1e/0x40\n[  +0.000003]  ? handle_mm_fault+0xb2/0x370\n[  +0.000003]  ksys_read+0x6b/0xf0\n[  +0.000004]  __x64_sys_read+0x19/0x20\n[  +0.000003]  do_syscall_64+0x60/0x130\n[  +0.000004]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[  +0.000003] RIP: 0033:0x7fdf32f147e2\n[...]\n\nThis error happens when the color log tries to read the gamut remap\ninformation from DCN401 which is not initialized in the dcn401_dpp_funcs\nwhich leads to a null pointer dereference. This commit addresses this\nissue by adding a proper guard to access the gamut_remap callback in\ncase the specific ASIC did not implement this function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4dfd8d3e-1eb1-4fdb-9f33-3021d4358201",
      "id": "CVE-2024-46713",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/aux: Fix AUX buffer serialization\n\nOle reported that event-\u003emmap_mutex is strictly insufficient to\nserialize the AUX buffer, add a per RB mutex to fully serialize it.\n\nNote that in the lock order comment the perf_event::mmap_mutex order\nwas already wrong, that is, it nesting under mmap_lock is not new with\nthis patch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc1e0df9-cc1b-46d4-8596-3862a9b21d06",
      "id": "CVE-2024-46717",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix incorrect page release\n\nUnder the following conditions:\n1) No skb created yet\n2) header_size == 0 (no SHAMPO header)\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\n   last page fragment of a SHAMPO header page)\n\na new skb is formed with a page that is NOT a SHAMPO header page (it\nis a regular data page). Further down in the same function\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\nheader_index is released. This is wrong and it leads to SHAMPO header\npages being released more than once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c2e7a1f-0c32-47a3-8967-e31e6ad67f79",
      "id": "CVE-2024-46859",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\n\nThe panasonic laptop code in various places uses the SINF array with index\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\nis big enough.\n\nNot all panasonic laptops have this many SINF array entries, for example\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\nsupports the AC+DC brightness entries and mute.\n\nCheck that the SINF array has a minimum size which covers all AC+DC\nbrightness entries and refuse to load if the SINF array is smaller.\n\nFor higher SINF indexes hide the sysfs attributes when the SINF array\ndoes not contain an entry for that attribute, avoiding show()/store()\naccessing the array out of bounds and add bounds checking to the probe()\nand resume() code accessing these.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c06c4caa-7d88-48e0-a2ba-f9db30f265ff",
      "id": "CVE-2024-49895",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_degamma_hw_format` function in the DCN30\ncolor  management module. The issue could occur when the index 'i'\nexceeds the  number of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.red' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.green' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.blue' 1025 \u003c= s32max",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb528402-2812-4374-89b0-ea34e4da50e2",
      "id": "CVE-2024-49927",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ioapic: Handle allocation failures gracefully\n\nBreno observed panics when using failslab under certain conditions during\nruntime:\n\n   can not alloc irq_pin_list (-1,0,20)\n   Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed\n\n   panic+0x4e9/0x590\n   mp_irqdomain_alloc+0x9ab/0xa80\n   irq_domain_alloc_irqs_locked+0x25d/0x8d0\n   __irq_domain_alloc_irqs+0x80/0x110\n   mp_map_pin_to_irq+0x645/0x890\n   acpi_register_gsi_ioapic+0xe6/0x150\n   hpet_open+0x313/0x480\n\nThat's a pointless panic which is a leftover of the historic IO/APIC code\nwhich panic'ed during early boot when the interrupt allocation failed.\n\nThe only place which might justify panic is the PIT/HPET timer_check() code\nwhich tries to figure out whether the timer interrupt is delivered through\nthe IO/APIC. But that code does not require to handle interrupt allocation\nfailures. If the interrupt cannot be allocated then timer delivery fails\nand it either panics due to that or falls back to legacy mode.\n\nCure this by removing the panic wrapper around __add_pin_to_irq_node() and\nmaking mp_irqdomain_alloc() aware of the failure condition and handle it as\nany other failure in this function gracefully.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3dcae99a-3462-4576-b093-232f86df9862",
      "id": "CVE-2024-49975",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes: fix kernel info leak via \"[uprobes]\" vma\n\nxol_add_vma() maps the uninitialized page allocated by __create_xol_area()\ninto userspace. On some architectures (x86) this memory is readable even\nwithout VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,\nalthough this doesn't really matter, debugger can read this memory anyway.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff04c6f0-d7c3-44ff-bac1-12c6829e718f",
      "id": "CVE-2024-56604",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()\n\nbt_sock_alloc() attaches allocated sk object to the provided sock object.\nIf rfcomm_dlc_alloc() fails, we release the sk object, but leave the\ndangling pointer in the sock object, which may cause use-after-free.\n\nFix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0e2be31-0531-47c5-83d9-ea33d04f81db",
      "id": "CVE-2024-57903",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: restrict SO_REUSEPORT to inet sockets\n\nAfter blamed commit, crypto sockets could accidentally be destroyed\nfrom RCU call back, as spotted by zyzbot [1].\n\nTrying to acquire a mutex in RCU callback is not allowed.\n\nRestrict SO_REUSEPORT socket option to inet sockets.\n\nv1 of this patch supported TCP, UDP and SCTP sockets,\nbut fcnal-test.sh test needed RAW and ICMP support.\n\n[1]\nBUG: sleeping function called from invalid context at kernel/locking/mutex.c:562\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24, name: ksoftirqd/1\npreempt_count: 100, expected: 0\nRCU nest depth: 0, expected: 0\n1 lock held by ksoftirqd/1/24:\n  #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]\n  #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2561 [inline]\n  #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xa37/0x17a0 kernel/rcu/tree.c:2823\nPreemption disabled at:\n [\u003cffffffff8161c8c8\u003e] softirq_handle_begin kernel/softirq.c:402 [inline]\n [\u003cffffffff8161c8c8\u003e] handle_softirqs+0x128/0x9b0 kernel/softirq.c:537\nCPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  __might_resched+0x5d4/0x780 kernel/sched/core.c:8758\n  __mutex_lock_common kernel/locking/mutex.c:562 [inline]\n  __mutex_lock+0x131/0xee0 kernel/locking/mutex.c:735\n  crypto_put_default_null_skcipher+0x18/0x70 crypto/crypto_null.c:179\n  aead_release+0x3d/0x50 crypto/algif_aead.c:489\n  alg_do_release crypto/af_alg.c:118 [inline]\n  alg_sock_destruct+0x86/0xc0 crypto/af_alg.c:502\n  __sk_destruct+0x58/0x5f0 net/core/sock.c:2260\n  rcu_do_batch kernel/rcu/tree.c:2567 [inline]\n  rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823\n  handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561\n  run_ksoftirqd+0xca/0x130 kernel/softirq.c:950\n  smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164\n  kthread+0x2f0/0x390 kernel/kthread.c:389\n  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1a8bdcf-32af-4d86-9e03-9b823aaeb889",
      "id": "CVE-2025-21751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e76fddcb-f65b-4393-8270-b88fcf22add1",
      "id": "CVE-2025-21855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Don't reference skb after sending to VIOS\n\nPreviously, after successfully flushing the xmit buffer to VIOS,\nthe tx_bytes stat was incremented by the length of the skb.\n\nIt is invalid to access the skb memory after sending the buffer to\nthe VIOS because, at any point after sending, the VIOS can trigger\nan interrupt to free this memory. A race between reading skb-\u003elen\nand freeing the skb is possible (especially during LPM) and will\nresult in use-after-free:\n ==================================================================\n BUG: KASAN: slab-use-after-free in ibmvnic_xmit+0x75c/0x1808 [ibmvnic]\n Read of size 4 at addr c00000024eb48a70 by task hxecom/14495\n \u003c...\u003e\n Call Trace:\n [c000000118f66cf0] [c0000000018cba6c] dump_stack_lvl+0x84/0xe8 (unreliable)\n [c000000118f66d20] [c0000000006f0080] print_report+0x1a8/0x7f0\n [c000000118f66df0] [c0000000006f08f0] kasan_report+0x128/0x1f8\n [c000000118f66f00] [c0000000006f2868] __asan_load4+0xac/0xe0\n [c000000118f66f20] [c0080000046eac84] ibmvnic_xmit+0x75c/0x1808 [ibmvnic]\n [c000000118f67340] [c0000000014be168] dev_hard_start_xmit+0x150/0x358\n \u003c...\u003e\n Freed by task 0:\n kasan_save_stack+0x34/0x68\n kasan_save_track+0x2c/0x50\n kasan_save_free_info+0x64/0x108\n __kasan_mempool_poison_object+0x148/0x2d4\n napi_skb_cache_put+0x5c/0x194\n net_tx_action+0x154/0x5b8\n handle_softirqs+0x20c/0x60c\n do_softirq_own_stack+0x6c/0x88\n \u003c...\u003e\n The buggy address belongs to the object at c00000024eb48a00 which\n  belongs to the cache skbuff_head_cache of size 224\n==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d10ce11-f19f-4a69-bd1e-20ed1872001e",
      "id": "CVE-2024-42076",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: can: j1939: Initialize unused data in j1939_send_one()\n\nsyzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one()\ncreates full frame including unused data, but it doesn't initialize\nit. This causes the kernel-infoleak issue. Fix this by initializing\nunused data.\n\n[1]\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185\n copy_to_iter include/linux/uio.h:196 [inline]\n memcpy_to_msg include/linux/skbuff.h:4113 [inline]\n raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008\n sock_recvmsg_nosec net/socket.c:1046 [inline]\n sock_recvmsg+0x2c4/0x340 net/socket.c:1068\n ____sys_recvmsg+0x18a/0x620 net/socket.c:2803\n ___sys_recvmsg+0x223/0x840 net/socket.c:2845\n do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939\n __sys_recvmmsg net/socket.c:3018 [inline]\n __do_sys_recvmmsg net/socket.c:3041 [inline]\n __se_sys_recvmmsg net/socket.c:3034 [inline]\n __x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034\n x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3804 [inline]\n slab_alloc_node mm/slub.c:3845 [inline]\n kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n alloc_skb include/linux/skbuff.h:1313 [inline]\n alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n sock_alloc_send_skb include/net/sock.h:1842 [inline]\n j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]\n j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]\n j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:745\n ____sys_sendmsg+0x877/0xb60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674\n x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nBytes 12-15 of 16 are uninitialized\nMemory access of size 16 starts at ffff888120969690\nData copied to user address 00000000200017c0\n\nCPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a32c9b8c-4c70-4865-80de-f23fb83160ab",
      "id": "CVE-2025-22021",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "64271bd1-b912-46c5-ad16-4fe0bc432c67",
      "id": "CVE-2025-37851",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: Add 'plane' value check\n\nFunction dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB\nof the enum parameter plane.\n\nThe value of this parameter is initialized in dss_init_overlays and in the\ncurrent state of the code it cannot take this value so it's not a real\nproblem.\n\nFor the purposes of defensive coding it wouldn't be superfluous to check\nthe parameter value, because some functions down the call stack process\nthis value correctly and some not.\n\nFor example, in dispc_ovl_setup_global_alpha it may lead to buffer\noverflow.\n\nAdd check for this value.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed29983b-1fb5-428d-8e3e-c26f2cbe2b0b",
      "id": "CVE-2025-37867",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Silence oversized kvmalloc() warning\n\nsyzkaller triggered an oversized kvmalloc() warning.\nSilence it by adding __GFP_NOWARN.\n\nsyzkaller log:\n WARNING: CPU: 7 PID: 518 at mm/util.c:665 __kvmalloc_node_noprof+0x175/0x180\n CPU: 7 UID: 0 PID: 518 Comm: c_repro Not tainted 6.11.0-rc6+ #6\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__kvmalloc_node_noprof+0x175/0x180\n RSP: 0018:ffffc90001e67c10 EFLAGS: 00010246\n RAX: 0000000000000100 RBX: 0000000000000400 RCX: ffffffff8149d46b\n RDX: 0000000000000000 RSI: ffff8881030fae80 RDI: 0000000000000002\n RBP: 000000712c800000 R08: 0000000000000100 R09: 0000000000000000\n R10: ffffc90001e67c10 R11: 0030ae0601000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000\n FS:  00007fde79159740(0000) GS:ffff88813bdc0000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000020000180 CR3: 0000000105eb4005 CR4: 00000000003706b0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cTASK\u003e\n  ib_umem_odp_get+0x1f6/0x390\n  mlx5_ib_reg_user_mr+0x1e8/0x450\n  ib_uverbs_reg_mr+0x28b/0x440\n  ib_uverbs_write+0x7d3/0xa30\n  vfs_write+0x1ac/0x6c0\n  ksys_write+0x134/0x170\n  ? __sanitizer_cov_trace_pc+0x1c/0x50\n  do_syscall_64+0x50/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10bdf30b-cd30-4140-b5e8-ed92bc49fd05",
      "id": "CVE-2025-37911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW.  The segment list is then DMA'ed by\nthe FW and the length of the DMA is returned by FW.  The driver then\ncopies this DMA'ed segment list to info-\u003edest_buf.\n\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\nand cause the above BUG condition.  Fix it by capping the copy\nlength to not exceed the length of info-\u003edest_buf.  The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\nfor these 2 FW commands.  To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5770385-2b88-432d-acd2-608c70bf25ba",
      "id": "CVE-2025-38061",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix access outside of user given buffer in pktgen_thread_write()\n\nHonour the user given buffer size for the strn_len() calls (otherwise\nstrn_len() will access memory outside of the user given buffer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5721b44-0fe3-44ee-9e22-8e19b5d80305",
      "id": "CVE-2025-38495",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: ensure the allocated report buffer can contain the reserved report ID\n\nWhen the report ID is not used, the low level transport drivers expect\nthe first byte to be 0. However, currently the allocated buffer not\naccount for that extra byte, meaning that instead of having 8 guaranteed\nbytes for implement to be working, we only have 7.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0334023c-3a43-4682-8059-b48b11a9c747",
      "id": "CVE-2025-38531",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: common: st_sensors: Fix use of uninitialize device structs\n\nThroughout the various probe functions \u0026indio_dev-\u003edev is used before it\nis initialized. This caused a kernel panic in st_sensors_power_enable()\nwhen the call to devm_regulator_bulk_get_enable() fails and then calls\ndev_err_probe() with the uninitialized device.\n\nThis seems to only cause a panic with dev_err_probe(), dev_err(),\ndev_warn() and dev_info() don't seem to cause a panic, but are fixed\nas well.\n\nThe issue is reported and traced here: [1]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef1fb40b-7c0c-48ea-be64-ee08dbfc11ae",
      "id": "CVE-2020-25645",
      "description": "A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69dda2ca-7c11-49dc-869e-cc8a11595c62",
      "id": "CVE-2020-29371",
      "description": "An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89072e09-518d-4b83-8a64-e252513a8592",
      "id": "CVE-2021-47235",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: fix potential use-after-free in ec_bhf_remove\n\nstatic void ec_bhf_remove(struct pci_dev *dev)\n{\n...\n\tstruct ec_bhf_priv *priv = netdev_priv(net_dev);\n\n\tunregister_netdev(net_dev);\n\tfree_netdev(net_dev);\n\n\tpci_iounmap(dev, priv-\u003edma_io);\n\tpci_iounmap(dev, priv-\u003eio);\n...\n}\n\npriv is netdev private data, but it is used\nafter free_netdev(). It can cause use-after-free when accessing priv\npointer. So, fix it by moving free_netdev() after pci_iounmap()\ncalls.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d230b9e8-9332-49a5-b19d-05305f8dd1ce",
      "id": "CVE-2021-22555",
      "description": "A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0eb1ebd-35a9-4aeb-912e-c854e34012f6",
      "id": "CVE-2021-33034",
      "description": "In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8483dc6e-268f-4772-8058-48202b7c5019",
      "id": "CVE-2021-3444",
      "description": "The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 (\"bpf: Fix truncation handling for mod32 dst reg wrt zero\") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ede6f555-c079-4eeb-b189-117025bb44f7",
      "id": "CVE-2021-3635",
      "description": "A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1cefd814-25b8-4d5b-ae30-4fcbfc1d03f8",
      "id": "CVE-2021-38166",
      "description": "In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a685d3a1-9b3e-42c5-b27f-45f861511045",
      "id": "CVE-2021-47162",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: skb_linearize the head skb when reassembling msgs\n\nIt's not a good idea to append the frag skb to a skb's frag_list if\nthe frag_list already has skbs from elsewhere, such as this skb was\ncreated by pskb_copy() where the frag_list was cloned (all the skbs\nin it were skb_get'ed) and shared by multiple skbs.\n\nHowever, the new appended frag skb should have been only seen by the\ncurrent skb. Otherwise, it will cause use after free crashes as this\nappended frag skb are seen by multiple skbs but it only got skb_get\ncalled once.\n\nThe same thing happens with a skb updated by pskb_may_pull() with a\nskb_cloned skb. Li Shuang has reported quite a few crashes caused\nby this when doing testing over macvlan devices:\n\n  [] kernel BUG at net/core/skbuff.c:1970!\n  [] Call Trace:\n  []  skb_clone+0x4d/0xb0\n  []  macvlan_broadcast+0xd8/0x160 [macvlan]\n  []  macvlan_process_broadcast+0x148/0x150 [macvlan]\n  []  process_one_work+0x1a7/0x360\n  []  worker_thread+0x30/0x390\n\n  [] kernel BUG at mm/usercopy.c:102!\n  [] Call Trace:\n  []  __check_heap_object+0xd3/0x100\n  []  __check_object_size+0xff/0x16b\n  []  simple_copy_to_iter+0x1c/0x30\n  []  __skb_datagram_iter+0x7d/0x310\n  []  __skb_datagram_iter+0x2a5/0x310\n  []  skb_copy_datagram_iter+0x3b/0x90\n  []  tipc_recvmsg+0x14a/0x3a0 [tipc]\n  []  ____sys_recvmsg+0x91/0x150\n  []  ___sys_recvmsg+0x7b/0xc0\n\n  [] kernel BUG at mm/slub.c:305!\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  kmem_cache_free+0x3ff/0x400\n  []  __netif_receive_skb_core+0x12c/0xc40\n  []  ? kmem_cache_alloc+0x12e/0x270\n  []  netif_receive_skb_internal+0x3d/0xb0\n  []  ? get_rx_page_info+0x8e/0xa0 [be2net]\n  []  be_poll+0x6ef/0xd00 [be2net]\n  []  ? irq_exit+0x4f/0x100\n  []  net_rx_action+0x149/0x3b0\n\n  ...\n\nThis patch is to fix it by linearizing the head skb if it has frag_list\nset in tipc_buf_append(). Note that we choose to do this before calling\nskb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can\nnot just drop the frag_list either as the early time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a5ec0cc-6f9c-4086-81a1-d0009863c5bd",
      "id": "CVE-2021-47291",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n\nWhile running the self-tests on a KASAN enabled kernel, I observed a\nslab-out-of-bounds splat very similar to the one reported in\ncommit 821bbf79fe46 (\"ipv6: Fix KASAN: slab-out-of-bounds Read in\n fib6_nh_flush_exceptions\").\n\nWe additionally need to take care of fib6_metrics initialization\nfailure when the caller provides an nh.\n\nThe fix is similar, explicitly free the route instead of calling\nfib6_info_release on a half-initialized object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c52d58cd-0343-4484-ab9e-3cc233a69369",
      "id": "CVE-2021-47297",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix uninit-value in caif_seqpkt_sendmsg\n\nWhen nr_segs equal to zero in iovec_from_user, the object\nmsg-\u003emsg_iter.iov is uninit stack memory in caif_seqpkt_sendmsg\nwhich is defined in ___sys_sendmsg. So we cann't just judge\nmsg-\u003emsg_iter.iov-\u003ebase directlly. We can use nr_segs to judge\nmsg in caif_seqpkt_sendmsg whether has data buffers.\n\n=====================================================\nBUG: KMSAN: uninit-value in caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c9/0x220 lib/dump_stack.c:118\n kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:118\n __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215\n caif_seqpkt_sendmsg+0x693/0xf60 net/caif/caif_socket.c:542\n sock_sendmsg_nosec net/socket.c:652 [inline]\n sock_sendmsg net/socket.c:672 [inline]\n ____sys_sendmsg+0x12b6/0x1350 net/socket.c:2343\n ___sys_sendmsg net/socket.c:2397 [inline]\n __sys_sendmmsg+0x808/0xc90 net/socket.c:2480\n __compat_sys_sendmmsg net/compat.c:656 [inline]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "242aa656-e0b3-4a1a-86d3-7fcaca664996",
      "id": "CVE-2021-47360",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: make sure fd closes complete\n\nDuring BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object\ncleanup may close 1 or more fds. The close operations are\ncompleted using the task work mechanism -- which means the thread\nneeds to return to userspace or the file object may never be\ndereferenced -- which can lead to hung processes.\n\nForce the binder thread back to userspace if an fd is closed during\nBC_FREE_BUFFER handling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69e3dadd-d265-44c0-9321-1e66241ca655",
      "id": "CVE-2022-3521",
      "description": "A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59fbd041-51cc-4123-a0f4-a4255a8decdb",
      "id": "CVE-2022-48828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix ia_size underflow\n\niattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and\nNFSv4 both define file size as an unsigned 64-bit type. Thus there\nis a range of valid file size values an NFS client can send that is\nalready larger than Linux can handle.\n\nCurrently decode_fattr4() dumps a full u64 value into ia_size. If\nthat value happens to be larger than S64_MAX, then ia_size\nunderflows. I'm about to fix up the NFSv3 behavior as well, so let's\ncatch the underflow in the common code path: nfsd_setattr().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94b9304e-e017-4aba-84c8-f4a4c9c4b8f0",
      "id": "CVE-2022-3533",
      "description": "A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a97d6aae-5c68-43d4-a94a-083e10f00a07",
      "id": "CVE-2022-4662",
      "description": "A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5373d5bf-55b7-4a10-aed0-7ed5ed21571a",
      "id": "CVE-2022-48655",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Harden accesses to the reset domains\n\nAccessing reset domains descriptors by the index upon the SCMI drivers\nrequests through the SCMI reset operations interface can potentially\nlead to out-of-bound violations if the SCMI driver misbehave.\n\nAdd an internal consistency check before any such domains descriptors\naccesses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "921fd705-213c-4271-ad51-da55c098872a",
      "id": "CVE-2022-48826",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix deadlock on DSI device attach error\n\nDSI device attach to DSI host will be done with host device's lock\nheld.\n\nUn-registering host in \"device attach\" error path (ex: probe retry)\nwill result in deadlock with below call trace and non operational\nDSI display.\n\nStartup Call trace:\n[   35.043036]  rt_mutex_slowlock.constprop.21+0x184/0x1b8\n[   35.043048]  mutex_lock_nested+0x7c/0xc8\n[   35.043060]  device_del+0x4c/0x3e8\n[   35.043075]  device_unregister+0x20/0x40\n[   35.043082]  mipi_dsi_remove_device_fn+0x18/0x28\n[   35.043093]  device_for_each_child+0x68/0xb0\n[   35.043105]  mipi_dsi_host_unregister+0x40/0x90\n[   35.043115]  vc4_dsi_host_attach+0xf0/0x120 [vc4]\n[   35.043199]  mipi_dsi_attach+0x30/0x48\n[   35.043209]  tc358762_probe+0x128/0x164 [tc358762]\n[   35.043225]  mipi_dsi_drv_probe+0x28/0x38\n[   35.043234]  really_probe+0xc0/0x318\n[   35.043244]  __driver_probe_device+0x80/0xe8\n[   35.043254]  driver_probe_device+0xb8/0x118\n[   35.043263]  __device_attach_driver+0x98/0xe8\n[   35.043273]  bus_for_each_drv+0x84/0xd8\n[   35.043281]  __device_attach+0xf0/0x150\n[   35.043290]  device_initial_probe+0x1c/0x28\n[   35.043300]  bus_probe_device+0xa4/0xb0\n[   35.043308]  deferred_probe_work_func+0xa0/0xe0\n[   35.043318]  process_one_work+0x254/0x700\n[   35.043330]  worker_thread+0x4c/0x448\n[   35.043339]  kthread+0x19c/0x1a8\n[   35.043348]  ret_from_fork+0x10/0x20\n\nShutdown Call trace:\n[  365.565417] Call trace:\n[  365.565423]  __switch_to+0x148/0x200\n[  365.565452]  __schedule+0x340/0x9c8\n[  365.565467]  schedule+0x48/0x110\n[  365.565479]  schedule_timeout+0x3b0/0x448\n[  365.565496]  wait_for_completion+0xac/0x138\n[  365.565509]  __flush_work+0x218/0x4e0\n[  365.565523]  flush_work+0x1c/0x28\n[  365.565536]  wait_for_device_probe+0x68/0x158\n[  365.565550]  device_shutdown+0x24/0x348\n[  365.565561]  kernel_restart_prepare+0x40/0x50\n[  365.565578]  kernel_restart+0x20/0x70\n[  365.565591]  __do_sys_reboot+0x10c/0x220\n[  365.565605]  __arm64_sys_reboot+0x2c/0x38\n[  365.565619]  invoke_syscall+0x4c/0x110\n[  365.565634]  el0_svc_common.constprop.3+0xfc/0x120\n[  365.565648]  do_el0_svc+0x2c/0x90\n[  365.565661]  el0_svc+0x4c/0xf0\n[  365.565671]  el0t_64_sync_handler+0x90/0xb8\n[  365.565682]  el0t_64_sync+0x180/0x184",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4fd880b8-1cf4-4ce3-8833-ddb555477b19",
      "id": "CVE-2022-48855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix kernel-infoleak for SCTP sockets\n\nsyzbot reported a kernel infoleak [1] of 4 bytes.\n\nAfter analysis, it turned out r-\u003eidiag_expires is not initialized\nif inet_sctp_diag_fill() calls inet_diag_msg_common_fill()\n\nMake sure to clear idiag_timer/idiag_retrans/idiag_expires\nand let inet_diag_msg_sctpasoc_fill() fill them again if needed.\n\n[1]\n\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]\nBUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:154 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668\n instrument_copy_to_user include/linux/instrumented.h:121 [inline]\n copyout lib/iov_iter.c:154 [inline]\n _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668\n copy_to_iter include/linux/uio.h:162 [inline]\n simple_copy_to_iter+0xf3/0x140 net/core/datagram.c:519\n __skb_datagram_iter+0x2d5/0x11b0 net/core/datagram.c:425\n skb_copy_datagram_iter+0xdc/0x270 net/core/datagram.c:533\n skb_copy_datagram_msg include/linux/skbuff.h:3696 [inline]\n netlink_recvmsg+0x669/0x1c80 net/netlink/af_netlink.c:1977\n sock_recvmsg_nosec net/socket.c:948 [inline]\n sock_recvmsg net/socket.c:966 [inline]\n __sys_recvfrom+0x795/0xa10 net/socket.c:2097\n __do_sys_recvfrom net/socket.c:2115 [inline]\n __se_sys_recvfrom net/socket.c:2111 [inline]\n __x64_sys_recvfrom+0x19d/0x210 net/socket.c:2111\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:737 [inline]\n slab_alloc_node mm/slub.c:3247 [inline]\n __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4975\n kmalloc_reserve net/core/skbuff.c:354 [inline]\n __alloc_skb+0x545/0xf90 net/core/skbuff.c:426\n alloc_skb include/linux/skbuff.h:1158 [inline]\n netlink_dump+0x3e5/0x16c0 net/netlink/af_netlink.c:2248\n __netlink_dump_start+0xcf8/0xe90 net/netlink/af_netlink.c:2373\n netlink_dump_start include/linux/netlink.h:254 [inline]\n inet_diag_handler_cmd+0x2e7/0x400 net/ipv4/inet_diag.c:1341\n sock_diag_rcv_msg+0x24a/0x620\n netlink_rcv_skb+0x40c/0x7e0 net/netlink/af_netlink.c:2494\n sock_diag_rcv+0x63/0x80 net/core/sock_diag.c:277\n netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]\n netlink_unicast+0x1093/0x1360 net/netlink/af_netlink.c:1343\n netlink_sendmsg+0x14d9/0x1720 net/netlink/af_netlink.c:1919\n sock_sendmsg_nosec net/socket.c:705 [inline]\n sock_sendmsg net/socket.c:725 [inline]\n sock_write_iter+0x594/0x690 net/socket.c:1061\n do_iter_readv_writev+0xa7f/0xc70\n do_iter_write+0x52c/0x1500 fs/read_write.c:851\n vfs_writev fs/read_write.c:924 [inline]\n do_writev+0x645/0xe00 fs/read_write.c:967\n __do_sys_writev fs/read_write.c:1040 [inline]\n __se_sys_writev fs/read_write.c:1037 [inline]\n __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBytes 68-71 of 2508 are uninitialized\nMemory access of size 2508 starts at ffff888114f9b000\nData copied to user address 00007f7fe09ff2e0\n\nCPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79b19dc1-6700-4630-be94-cb35f88241de",
      "id": "CVE-2022-48856",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngianfar: ethtool: Fix refcount leak in gfar_get_ts_info\n\nThe of_find_compatible_node() function returns a node pointer with\nrefcount incremented, We should use of_node_put() on it when done\nAdd the missing of_node_put() to release the refcount.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3bc46a9b-13a3-4557-8b1c-0e32171bb495",
      "id": "CVE-2022-48872",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix use-after-free race condition for maps\n\nIt is possible that in between calling fastrpc_map_get() until\nmap-\u003efl-\u003elock is taken in fastrpc_free_map(), another thread can call\nfastrpc_map_lookup() and get a reference to a map that is about to be\ndeleted.\n\nRewrite fastrpc_map_get() to only increase the reference count of a map\nif it's non-zero. Propagate this to callers so they can know if a map is\nabout to be deleted.\n\nFixes this warning:\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate\n...\nCall trace:\n refcount_warn_saturate\n [fastrpc_map_get inlined]\n [fastrpc_map_lookup inlined]\n fastrpc_map_create\n fastrpc_internal_invoke\n fastrpc_device_ioctl\n __arm64_sys_ioctl\n invoke_syscall",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c8b535d-4c1a-41ae-a13f-300f26fcb154",
      "id": "CVE-2022-48891",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: da9211: Use irq handler when ready\n\nIf the system does not come from reset (like when it is kexec()), the\nregulator might have an IRQ waiting for us.\n\nIf we enable the IRQ handler before its structures are ready, we crash.\n\nThis patch fixes:\n\n[    1.141839] Unable to handle kernel read from unreadable memory at virtual address 0000000000000078\n[    1.316096] Call trace:\n[    1.316101]  blocking_notifier_call_chain+0x20/0xa8\n[    1.322757] cpu cpu0: dummy supplies not allowed for exclusive requests\n[    1.327823]  regulator_notifier_call_chain+0x1c/0x2c\n[    1.327825]  da9211_irq_handler+0x68/0xf8\n[    1.327829]  irq_thread+0x11c/0x234\n[    1.327833]  kthread+0x13c/0x154",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ff4d4f1-d4d0-4894-8b89-08a75132ef1d",
      "id": "CVE-2022-49161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: Fix error handling in mt8183_da7219_max98357_dev_probe\n\nThe device_node pointer is returned by of_parse_phandle()  with refcount\nincremented. We should use of_node_put() on it when done.\n\nThis function only calls of_node_put() in the regular path.\nAnd it will cause refcount leak in error paths.\nFix this by calling of_node_put() in error handling too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20c3994d-93fb-4044-85ab-2dd9e37ad1b1",
      "id": "CVE-2023-53443",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak\n\nIn arizona_clk32k_enable(), we should use pm_runtime_resume_and_get()\nas pm_runtime_get_sync() will increase the refcnt even when it\nreturns an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6041afc-8188-4ff3-be95-6ede147aad6b",
      "id": "CVE-2022-49172",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix non-access data TLB cache flush faults\n\nWhen a page is not present, we get non-access data TLB faults from\nthe fdc and fic instructions in flush_user_dcache_range_asm and\nflush_user_icache_range_asm. When these occur, the cache line is\nnot invalidated and potentially we get memory corruption. The\nproblem was hidden by the nullification of the flush instructions.\n\nThese faults also affect performance. With pa8800/pa8900 processors,\nthere will be 32 faults per 4 KB page since the cache line is 128\nbytes.  There will be more faults with earlier processors.\n\nThe problem is fixed by using flush_cache_pages(). It does the flush\nusing a tmp alias mapping.\n\nThe flush_cache_pages() call in flush_cache_range() flushed too\nlarge a range.\n\nV2: Remove unnecessary preempt_disable() and preempt_enable() calls.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f39e31bb-5bd9-4b03-a516-0bb7183327de",
      "id": "CVE-2022-49206",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix memory leak in error flow for subscribe event routine\n\nIn case the second xa_insert() fails, the obj_event is not released.  Fix\nthe error unwind flow to free that memory to avoid a memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eff095be-a707-4fbe-bf37-90911a5b0d61",
      "id": "CVE-2022-49434",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()\n\nThe sysfs sriov_numvfs_store() path acquires the device lock before the\nconfig space access lock:\n\n  sriov_numvfs_store\n    device_lock                 # A (1) acquire device lock\n    sriov_configure\n      vfio_pci_sriov_configure  # (for example)\n        vfio_pci_core_sriov_configure\n          pci_disable_sriov\n            sriov_disable\n              pci_cfg_access_lock\n                pci_wait_cfg    # B (4) wait for dev-\u003eblock_cfg_access == 0\n\nPreviously, pci_dev_lock() acquired the config space access lock before the\ndevice lock:\n\n  pci_dev_lock\n    pci_cfg_access_lock\n      dev-\u003eblock_cfg_access = 1 # B (2) set dev-\u003eblock_cfg_access = 1\n    device_lock                 # A (3) wait for device lock\n\nAny path that uses pci_dev_lock(), e.g., pci_reset_function(), may\ndeadlock with sriov_numvfs_store() if the operations occur in the sequence\n(1) (2) (3) (4).\n\nAvoid the deadlock by reversing the order in pci_dev_lock() so it acquires\nthe device lock before the config space access lock, the same as the\nsriov_numvfs_store() path.\n\n[bhelgaas: combined and adapted commit log from Jay Zhou's independent\nsubsequent posting:\nhttps://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb04ef24-1442-4914-b553-9f08bf12328d",
      "id": "CVE-2022-49457",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: versatile: Add missing of_node_put in dcscb_init\n\nThe device_node pointer is returned by of_find_compatible_node\nwith refcount incremented. We should use of_node_put() to avoid\nthe refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24ac3878-c7b2-4053-b3a4-7e7ec293a00f",
      "id": "CVE-2022-49538",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: jack: Access input_dev under mutex\n\nIt is possible when using ASoC that input_dev is unregistered while\ncalling snd_jack_report, which causes NULL pointer dereference.\nIn order to prevent this serialize access to input_dev using mutex lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8de63ee6-19e4-4133-acc1-6b87e80174f5",
      "id": "CVE-2024-1086",
      "description": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nThe nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.\n\nWe recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7af6219a-914a-45e5-bb98-189ccdf2b594",
      "id": "CVE-2024-26687",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/events: close evtchn after mapping cleanup\n\nshutdown_pirq and startup_pirq are not taking the\nirq_mapping_update_lock because they can't due to lock inversion. Both\nare called with the irq_desc-\u003elock being taking. The lock order,\nhowever, is first irq_mapping_update_lock and then irq_desc-\u003elock.\n\nThis opens multiple races:\n- shutdown_pirq can be interrupted by a function that allocates an event\n  channel:\n\n  CPU0                        CPU1\n  shutdown_pirq {\n    xen_evtchn_close(e)\n                              __startup_pirq {\n                                EVTCHNOP_bind_pirq\n                                  -\u003e returns just freed evtchn e\n                                set_evtchn_to_irq(e, irq)\n                              }\n    xen_irq_info_cleanup() {\n      set_evtchn_to_irq(e, -1)\n    }\n  }\n\n  Assume here event channel e refers here to the same event channel\n  number.\n  After this race the evtchn_to_irq mapping for e is invalid (-1).\n\n- __startup_pirq races with __unbind_from_irq in a similar way. Because\n  __startup_pirq doesn't take irq_mapping_update_lock it can grab the\n  evtchn that __unbind_from_irq is currently freeing and cleaning up. In\n  this case even though the event channel is allocated, its mapping can\n  be unset in evtchn_to_irq.\n\nThe fix is to first cleanup the mappings and then close the event\nchannel. In this way, when an event channel gets allocated it's\npotential previous evtchn_to_irq mappings are guaranteed to be unset already.\nThis is also the reverse order of the allocation where first the event\nchannel is allocated and then the mappings are setup.\n\nOn a 5.10 kernel prior to commit 3fcdaf3d7634 (\"xen/events: modify internal\n[un]bind interfaces\"), we hit a BUG like the following during probing of NVMe\ndevices. The issue is that during nvme_setup_io_queues, pci_free_irq\nis called for every device which results in a call to shutdown_pirq.\nWith many nvme devices it's therefore likely to hit this race during\nboot because there will be multiple calls to shutdown_pirq and\nstartup_pirq are running potentially in parallel.\n\n  ------------[ cut here ]------------\n  blkfront: xvda: barrier or flush: disabled; persistent grants: enabled; indirect descriptors: enabled; bounce buffer: enabled\n  kernel BUG at drivers/xen/events/events_base.c:499!\n  invalid opcode: 0000 [#1] SMP PTI\n  CPU: 44 PID: 375 Comm: kworker/u257:23 Not tainted 5.10.201-191.748.amzn2.x86_64 #1\n  Hardware name: Xen HVM domU, BIOS 4.11.amazon 08/24/2006\n  Workqueue: nvme-reset-wq nvme_reset_work\n  RIP: 0010:bind_evtchn_to_cpu+0xdf/0xf0\n  Code: 5d 41 5e c3 cc cc cc cc 44 89 f7 e8 2b 55 ad ff 49 89 c5 48 85 c0 0f 84 64 ff ff ff 4c 8b 68 30 41 83 fe ff 0f 85 60 ff ff ff \u003c0f\u003e 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00\n  RSP: 0000:ffffc9000d533b08 EFLAGS: 00010046\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006\n  RDX: 0000000000000028 RSI: 00000000ffffffff RDI: 00000000ffffffff\n  RBP: ffff888107419680 R08: 0000000000000000 R09: ffffffff82d72b00\n  R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000001ed\n  R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000002\n  FS:  0000000000000000(0000) GS:ffff88bc8b500000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 0000000002610001 CR4: 00000000001706e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   ? show_trace_log_lvl+0x1c1/0x2d9\n   ? show_trace_log_lvl+0x1c1/0x2d9\n   ? set_affinity_irq+0xdc/0x1c0\n   ? __die_body.cold+0x8/0xd\n   ? die+0x2b/0x50\n   ? do_trap+0x90/0x110\n   ? bind_evtchn_to_cpu+0xdf/0xf0\n   ? do_error_trap+0x65/0x80\n   ? bind_evtchn_to_cpu+0xdf/0xf0\n   ? exc_invalid_op+0x4e/0x70\n   ? bind_evtchn_to_cpu+0xdf/0xf0\n   ? asm_exc_invalid_op+0x12/0x20\n   ? bind_evtchn_to_cpu+0xdf/0x\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "718372ef-dfd8-42f1-980e-907fb969dc5d",
      "id": "CVE-2022-49711",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()\n\nIn fsl_mc_bus_remove(), mc-\u003eroot_mc_bus_dev-\u003emc_io is passed to\nfsl_destroy_mc_io(). However, mc-\u003eroot_mc_bus_dev is already freed in\nfsl_mc_device_remove(). Then reference to mc-\u003eroot_mc_bus_dev-\u003emc_io\ntriggers KASAN use-after-free. To avoid the use-after-free, keep the\nreference to mc-\u003eroot_mc_bus_dev-\u003emc_io in a local variable and pass to\nfsl_destroy_mc_io().\n\nThis patch needs rework to apply to kernels older than v5.15.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d116cc85-9f13-47f9-9b60-09035ed3f429",
      "id": "CVE-2022-49755",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait\n\nWhile performing fast composition switch, there is a possibility that the\nprocess of ffs_ep0_write/ffs_ep0_read get into a race condition\ndue to ep0req being freed up from functionfs_unbind.\n\nConsider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait\nby taking a lock \u0026ffs-\u003eev.waitq.lock. However, the functionfs_unbind isn't\nbounded so it can go ahead and mark the ep0req to NULL, and since there\nis no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.\n\nFix this by making a serialized execution between the two functions using\na mutex_lock(ffs-\u003emutex).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9146f789-e0af-4b38-982b-005a35d8879f",
      "id": "CVE-2022-50141",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.\nof_node_put() checks null pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83330067-29c4-4743-8768-6ced61e91aca",
      "id": "CVE-2022-50256",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/meson: remove drm bridges at aggregate driver unbind time\n\ndrm bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init\nwere not manually removed at module unload time, which caused dangling\nreferences to freed memory to remain linked in the global bridge_list.\n\nWhen loading the driver modules back in, the same functions would again\ncall drm_bridge_add, and when traversing the global bridge_list, would\nend up peeking into freed memory.\n\nOnce again KASAN revealed the problem:\n\n[  +0.000095] =============================================================\n[  +0.000008] BUG: KASAN: use-after-free in __list_add_valid+0x9c/0x120\n[  +0.000018] Read of size 8 at addr ffff00003da291f0 by task modprobe/2483\n\n[  +0.000018] CPU: 3 PID: 2483 Comm: modprobe Tainted: G         C O      5.19.0-rc6-lrmbkasan+ #1\n[  +0.000011] Hardware name: Hardkernel ODROID-N2Plus (DT)\n[  +0.000008] Call trace:\n[  +0.000006]  dump_backtrace+0x1ec/0x280\n[  +0.000012]  show_stack+0x24/0x80\n[  +0.000008]  dump_stack_lvl+0x98/0xd4\n[  +0.000011]  print_address_description.constprop.0+0x80/0x520\n[  +0.000011]  print_report+0x128/0x260\n[  +0.000008]  kasan_report+0xb8/0xfc\n[  +0.000008]  __asan_report_load8_noabort+0x3c/0x50\n[  +0.000009]  __list_add_valid+0x9c/0x120\n[  +0.000009]  drm_bridge_add+0x6c/0x104 [drm]\n[  +0.000165]  dw_hdmi_probe+0x1900/0x2360 [dw_hdmi]\n[  +0.000022]  meson_dw_hdmi_bind+0x520/0x814 [meson_dw_hdmi]\n[  +0.000014]  component_bind+0x174/0x520\n[  +0.000012]  component_bind_all+0x1a8/0x38c\n[  +0.000010]  meson_drv_bind_master+0x5e8/0xb74 [meson_drm]\n[  +0.000032]  meson_drv_bind+0x20/0x2c [meson_drm]\n[  +0.000027]  try_to_bring_up_aggregate_device+0x19c/0x390\n[  +0.000010]  component_master_add_with_match+0x1c8/0x284\n[  +0.000009]  meson_drv_probe+0x274/0x280 [meson_drm]\n[  +0.000026]  platform_probe+0xd0/0x220\n[  +0.000009]  really_probe+0x3ac/0xa80\n[  +0.000009]  __driver_probe_device+0x1f8/0x400\n[  +0.000009]  driver_probe_device+0x68/0x1b0\n[  +0.000009]  __driver_attach+0x20c/0x480\n[  +0.000008]  bus_for_each_dev+0x114/0x1b0\n[  +0.000009]  driver_attach+0x48/0x64\n[  +0.000008]  bus_add_driver+0x390/0x564\n[  +0.000009]  driver_register+0x1a8/0x3e4\n[  +0.000009]  __platform_driver_register+0x6c/0x94\n[  +0.000008]  meson_drm_platform_driver_init+0x3c/0x1000 [meson_drm]\n[  +0.000027]  do_one_initcall+0xc4/0x2b0\n[  +0.000011]  do_init_module+0x154/0x570\n[  +0.000011]  load_module+0x1a78/0x1ea4\n[  +0.000008]  __do_sys_init_module+0x184/0x1cc\n[  +0.000009]  __arm64_sys_init_module+0x78/0xb0\n[  +0.000009]  invoke_syscall+0x74/0x260\n[  +0.000009]  el0_svc_common.constprop.0+0xcc/0x260\n[  +0.000008]  do_el0_svc+0x50/0x70\n[  +0.000007]  el0_svc+0x68/0x1a0\n[  +0.000012]  el0t_64_sync_handler+0x11c/0x150\n[  +0.000008]  el0t_64_sync+0x18c/0x190\n\n[  +0.000016] Allocated by task 879:\n[  +0.000008]  kasan_save_stack+0x2c/0x5c\n[  +0.000011]  __kasan_kmalloc+0x90/0xd0\n[  +0.000007]  __kmalloc+0x278/0x4a0\n[  +0.000011]  mpi_resize+0x13c/0x1d0\n[  +0.000011]  mpi_powm+0xd24/0x1570\n[  +0.000009]  rsa_enc+0x1a4/0x30c\n[  +0.000009]  pkcs1pad_verify+0x3f0/0x580\n[  +0.000009]  public_key_verify_signature+0x7a8/0xba4\n[  +0.000010]  public_key_verify_signature_2+0x40/0x60\n[  +0.000008]  verify_signature+0xb4/0x114\n[  +0.000008]  pkcs7_validate_trust_one.constprop.0+0x3b8/0x574\n[  +0.000009]  pkcs7_validate_trust+0xb8/0x15c\n[  +0.000008]  verify_pkcs7_message_sig+0xec/0x1b0\n[  +0.000012]  verify_pkcs7_signature+0x78/0xac\n[  +0.000007]  mod_verify_sig+0x110/0x190\n[  +0.000009]  module_sig_check+0x114/0x1e0\n[  +0.000009]  load_module+0xa0/0x1ea4\n[  +0.000008]  __do_sys_init_module+0x184/0x1cc\n[  +0.000008]  __arm64_sys_init_module+0x78/0xb0\n[  +0.000008]  invoke_syscall+0x74/0x260\n[  +0.000009]  el0_svc_common.constprop.0+0x1a8/0x260\n[  +0.000008]  do_el0_svc+0x50/0x70\n[  +0.000007]  el0_svc+0x68/0x1a0\n[  +0.000009]  el0t_64_sync_handler+0x11c/0x150\n[  +0.000009]  el0t_64\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6778a51-9551-46ff-b26b-9344bd44e7d4",
      "id": "CVE-2022-49834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free bug of ns_writer on remount\n\nIf a nilfs2 filesystem is downgraded to read-only due to metadata\ncorruption on disk and is remounted read/write, or if emergency read-only\nremount is performed, detaching a log writer and synchronizing the\nfilesystem can be done at the same time.\n\nIn these cases, use-after-free of the log writer (hereinafter\nnilfs-\u003ens_writer) can happen as shown in the scenario below:\n\n Task1                               Task2\n --------------------------------    ------------------------------\n nilfs_construct_segment\n   nilfs_segctor_sync\n     init_wait\n     init_waitqueue_entry\n     add_wait_queue\n     schedule\n                                     nilfs_remount (R/W remount case)\n\t\t\t\t       nilfs_attach_log_writer\n                                         nilfs_detach_log_writer\n                                           nilfs_segctor_destroy\n                                             kfree\n     finish_wait\n       _raw_spin_lock_irqsave\n         __raw_spin_lock_irqsave\n           do_raw_spin_lock\n             debug_spin_lock_before  \u003c-- use-after-free\n\nWhile Task1 is sleeping, nilfs-\u003ens_writer is freed by Task2.  After Task1\nwaked up, Task1 accesses nilfs-\u003ens_writer which is already freed.  This\nscenario diagram is based on the Shigeru Yoshida's post [1].\n\nThis patch fixes the issue by not detaching nilfs-\u003ens_writer on remount so\nthat this UAF race doesn't happen.  Along with this change, this patch\nalso inserts a few necessary read-only checks with superblock instance\nwhere only the ns_writer pointer was used to check if the filesystem is\nread-only.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20f0ba9f-8358-4cbf-8a38-2948b9621fa6",
      "id": "CVE-2022-49982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix memory leak in pvr_probe\n\nThe error handling code in pvr2_hdw_create forgets to unregister the\nv4l2 device. When pvr2_hdw_create returns back to pvr2_context_create,\nit calls pvr2_context_destroy to destroy context, but mp-\u003ehdw is NULL,\nwhich leads to that pvr2_hdw_destroy directly returns.\n\nFix this by adding v4l2_device_unregister to decrease the refcount of\nusb interface.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03593ccb-99d6-4153-aff1-e93dd861c3ba",
      "id": "CVE-2022-50082",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix warning in ext4_iomap_begin as race between bmap and write\n\nWe got issue as follows:\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 9310 at fs/ext4/inode.c:3441 ext4_iomap_begin+0x182/0x5d0\nRIP: 0010:ext4_iomap_begin+0x182/0x5d0\nRSP: 0018:ffff88812460fa08 EFLAGS: 00010293\nRAX: ffff88811f168000 RBX: 0000000000000000 RCX: ffffffff97793c12\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: ffff88812c669160 R08: ffff88811f168000 R09: ffffed10258cd20f\nR10: ffff88812c669077 R11: ffffed10258cd20e R12: 0000000000000001\nR13: 00000000000000a4 R14: 000000000000000c R15: ffff88812c6691ee\nFS:  00007fd0d6ff3740(0000) GS:ffff8883af180000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fd0d6dda290 CR3: 0000000104a62000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n iomap_apply+0x119/0x570\n iomap_bmap+0x124/0x150\n ext4_bmap+0x14f/0x250\n bmap+0x55/0x80\n do_vfs_ioctl+0x952/0xbd0\n __x64_sys_ioctl+0xc6/0x170\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nAbove issue may happen as follows:\n          bmap                    write\nbmap\n  ext4_bmap\n    iomap_bmap\n      ext4_iomap_begin\n                            ext4_file_write_iter\n\t\t\t      ext4_buffered_write_iter\n\t\t\t        generic_perform_write\n\t\t\t\t  ext4_da_write_begin\n\t\t\t\t    ext4_da_write_inline_data_begin\n\t\t\t\t      ext4_prepare_inline_data\n\t\t\t\t        ext4_create_inline_data\n\t\t\t\t\t  ext4_set_inode_flag(inode,\n\t\t\t\t\t\tEXT4_INODE_INLINE_DATA);\n      if (WARN_ON_ONCE(ext4_has_inline_data(inode))) -\u003etrigger bug_on\n\nTo solved above issue hold inode lock in ext4_bamp.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d85f1113-0144-46b8-80a7-077dacc19f8b",
      "id": "CVE-2022-50085",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix address sanitizer warning in raid_resume\n\nThere is a KASAN warning in raid_resume when running the lvm test\nlvconvert-raid.sh. The reason for the warning is that mddev-\u003eraid_disks\nis greater than rs-\u003eraid_disks, so the loop touches one entry beyond\nthe allocated length.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3204ae58-e487-48ae-af5c-c8ab3ea6764d",
      "id": "CVE-2022-50136",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event\n\nIf siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't\nbeen received completely, and should not report IW_CM_EVENT_CONNECT_REPLY\nin this case. This may trigger a call trace in iw_cm. A simple way to\ntrigger this:\n server: ib_send_lat\n client: ib_send_lat -R \u003cserver_ip\u003e\n\nThe call trace looks like this:\n\n kernel BUG at drivers/infiniband/core/iwcm.c:894!\n invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n \u003c...\u003e\n Workqueue: iw_cm_wq cm_work_handler [iw_cm]\n Call Trace:\n  \u003cTASK\u003e\n  cm_work_handler+0x1dd/0x370 [iw_cm]\n  process_one_work+0x1e2/0x3b0\n  worker_thread+0x49/0x2e0\n  ? rescuer_thread+0x370/0x370\n  kthread+0xe5/0x110\n  ? kthread_complete_and_exit+0x20/0x20\n  ret_from_fork+0x1f/0x30\n  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66cfc794-08e7-4a57-a2bd-7532cc4b0251",
      "id": "CVE-2022-50276",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: fix null pointer dereferencing in power_supply_get_battery_info\n\nwhen kmalloc() fail to allocate memory in kasprintf(), propname\nwill be NULL, strcmp() called by of_get_property() will cause\nnull pointer dereference.\n\nSo return ENOMEM if kasprintf() return NULL pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae505d22-c94f-4a23-a0d7-4c73eafab209",
      "id": "CVE-2022-50359",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx88: Fix a null-ptr-deref bug in buffer_prepare()\n\nWhen the driver calls cx88_risc_buffer() to prepare the buffer, the\nfunction call may fail, resulting in a empty buffer and null-ptr-deref\nlater in buffer_queue().\n\nThe following log can reveal it:\n\n[   41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\n[   41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n[   41.828027] RIP: 0010:buffer_queue+0xc2/0x500\n[   41.836311] Call Trace:\n[   41.836945]  __enqueue_in_driver+0x141/0x360\n[   41.837262]  vb2_start_streaming+0x62/0x4a0\n[   41.838216]  vb2_core_streamon+0x1da/0x2c0\n[   41.838516]  __vb2_init_fileio+0x981/0xbc0\n[   41.839141]  __vb2_perform_fileio+0xbf9/0x1120\n[   41.840072]  vb2_fop_read+0x20e/0x400\n[   41.840346]  v4l2_read+0x215/0x290\n[   41.840603]  vfs_read+0x162/0x4c0\n\nFix this by checking the return value of cx88_risc_buffer()\n\n[hverkuil: fix coding style issues]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "854cb703-4636-4db8-9047-b79172fc59f0",
      "id": "CVE-2023-51782",
      "description": "An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf64c324-e88b-4f0b-b96e-5261688edee6",
      "id": "CVE-2023-52603",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUBSAN: array-index-out-of-bounds in dtSplitRoot\n\nSyzkaller reported the following issue:\n\noop0: detected capacity change from 0 to 32768\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9\nindex -2 is out of range for type 'struct dtslot [128]'\nCPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283\n dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971\n dtSplitUp fs/jfs/jfs_dtree.c:985 [inline]\n dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863\n jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270\n vfs_mkdir+0x3b3/0x590 fs/namei.c:4013\n do_mkdirat+0x279/0x550 fs/namei.c:4038\n __do_sys_mkdirat fs/namei.c:4053 [inline]\n __se_sys_mkdirat fs/namei.c:4051 [inline]\n __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fcdc0113fd9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9\nRDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003\nRBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0\nR10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000\nR13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000\n \u003c/TASK\u003e\n\nThe issue is caused when the value of fsi becomes less than -1.\nThe check to break the loop when fsi value becomes -1 is present\nbut syzbot was able to produce value less than -1 which cause the error.\nThis patch simply add the change for the values less than 0.\n\nThe patch is tested via syzbot.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b668621-bbc9-4ee9-ba28-f88c62b5559b",
      "id": "CVE-2024-1312",
      "description": "A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e398ad6d-a035-4821-b1bc-3c8e4c2e1680",
      "id": "CVE-2023-52652",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: fix possible name leak in ntb_register_device()\n\nIf device_register() fails in ntb_register_device(), the device name\nallocated by dev_set_name() should be freed. As per the comment in\ndevice_register(), callers should use put_device() to give up the\nreference in the error path. So fix this by calling put_device() in the\nerror path so that the name can be freed in kobject_cleanup().\n\nAs a result of this, put_device() in the error path of\nntb_register_device() is removed and the actual error is returned.\n\n[mani: reworded commit message]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae30df6d-3fd6-4a50-a38e-b48e3a812545",
      "id": "CVE-2024-27062",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: lock the client object tree.\n\nIt appears the client object tree has no locking unless I've missed\nsomething else. Fix races around adding/removing client objects,\nmostly vram bar mappings.\n\n 4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1] PREEMPT SMP PTI\n[ 4562.099314] CPU: 2 PID: 23171 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27\n[ 4562.099324] Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021\n[ 4562.099330] RIP: 0010:nvkm_object_search+0x1d/0x70 [nouveau]\n[ 4562.099503] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 48 89 f8 48 85 f6 74 39 48 8b 87 a0 00 00 00 48 85 c0 74 12 \u003c48\u003e 8b 48 f8 48 39 ce 73 15 48 8b 40 10 48 85 c0 75 ee 48 c7 c0 fe\n[ 4562.099506] RSP: 0000:ffffa94cc420bbf8 EFLAGS: 00010206\n[ 4562.099512] RAX: 6677ed422bceb814 RBX: ffff98108791f400 RCX: ffff9810f26b8f58\n[ 4562.099517] RDX: 0000000000000000 RSI: ffff9810f26b9158 RDI: ffff98108791f400\n[ 4562.099519] RBP: ffff9810f26b9158 R08: 0000000000000000 R09: 0000000000000000\n[ 4562.099521] R10: ffffa94cc420bc48 R11: 0000000000000001 R12: ffff9810f02a7cc0\n[ 4562.099526] R13: 0000000000000000 R14: 00000000000000ff R15: 0000000000000007\n[ 4562.099528] FS:  00007f629c5017c0(0000) GS:ffff98142c700000(0000) knlGS:0000000000000000\n[ 4562.099534] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4562.099536] CR2: 00007f629a882000 CR3: 000000017019e004 CR4: 00000000003706f0\n[ 4562.099541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 4562.099542] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 4562.099544] Call Trace:\n[ 4562.099555]  \u003cTASK\u003e\n[ 4562.099573]  ? die_addr+0x36/0x90\n[ 4562.099583]  ? exc_general_protection+0x246/0x4a0\n[ 4562.099593]  ? asm_exc_general_protection+0x26/0x30\n[ 4562.099600]  ? nvkm_object_search+0x1d/0x70 [nouveau]\n[ 4562.099730]  nvkm_ioctl+0xa1/0x250 [nouveau]\n[ 4562.099861]  nvif_object_map_handle+0xc8/0x180 [nouveau]\n[ 4562.099986]  nouveau_ttm_io_mem_reserve+0x122/0x270 [nouveau]\n[ 4562.100156]  ? dma_resv_test_signaled+0x26/0xb0\n[ 4562.100163]  ttm_bo_vm_fault_reserved+0x97/0x3c0 [ttm]\n[ 4562.100182]  ? __mutex_unlock_slowpath+0x2a/0x270\n[ 4562.100189]  nouveau_ttm_fault+0x69/0xb0 [nouveau]\n[ 4562.100356]  __do_fault+0x32/0x150\n[ 4562.100362]  do_fault+0x7c/0x560\n[ 4562.100369]  __handle_mm_fault+0x800/0xc10\n[ 4562.100382]  handle_mm_fault+0x17c/0x3e0\n[ 4562.100388]  do_user_addr_fault+0x208/0x860\n[ 4562.100395]  exc_page_fault+0x7f/0x200\n[ 4562.100402]  asm_exc_page_fault+0x26/0x30\n[ 4562.100412] RIP: 0033:0x9b9870\n[ 4562.100419] Code: 85 a8 f7 ff ff 8b 8d 80 f7 ff ff 89 08 e9 18 f2 ff ff 0f 1f 84 00 00 00 00 00 44 89 32 e9 90 fa ff ff 0f 1f 84 00 00 00 00 00 \u003c44\u003e 89 32 e9 f8 f1 ff ff 0f 1f 84 00 00 00 00 00 66 44 89 32 e9 e7\n[ 4562.100422] RSP: 002b:00007fff9ba2dc70 EFLAGS: 00010246\n[ 4562.100426] RAX: 0000000000000004 RBX: 000000000dd65e10 RCX: 000000fff0000000\n[ 4562.100428] RDX: 00007f629a882000 RSI: 00007f629a882000 RDI: 0000000000000066\n[ 4562.100432] RBP: 00007fff9ba2e570 R08: 0000000000000000 R09: 0000000123ddf000\n[ 4562.100434] R10: 0000000000000001 R11: 0000000000000246 R12: 000000007fffffff\n[ 4562.100436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[ 4562.100446]  \u003c/TASK\u003e\n[ 4562.100448] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink cmac bnep sunrpc iwlmvm intel_rapl_msr intel_rapl_common snd_sof_pci_intel_cnl x86_pkg_temp_thermal intel_powerclamp snd_sof_intel_hda_common mac80211 coretemp snd_soc_acpi_intel_match kvm_intel snd_soc_acpi snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda_mlink \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51a42041-c5e3-40e7-ad4a-cbdd2fa28948",
      "id": "CVE-2023-52708",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmc_spi: fix error handling in mmc_spi_probe()\n\nIf mmc_add_host() fails, it doesn't need to call mmc_remove_host(),\nor it will cause null-ptr-deref, because of deleting a not added\ndevice in mmc_remove_host().\n\nTo fix this, goto label 'fail_glue_init', if mmc_add_host() fails,\nand change the label 'fail_add_host' to 'fail_gpiod_request'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c39c0541-602c-43a6-8a27-99a5499fa35e",
      "id": "CVE-2023-52821",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel: fix a possible null pointer dereference\n\nIn versatile_panel_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e939e1dd-ec7d-4b07-b572-1d4cf3b5f1d3",
      "id": "CVE-2023-52880",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\n\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\n\nRequire initial namespace CAP_NET_ADMIN to do that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51d2af64-ae4f-44d8-8525-7deee7612c92",
      "id": "CVE-2023-52920",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\n\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\n\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don't touch idx field for maximum performance, as it's\nchecked most frequently during backtracking.\n\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\n\nThere are only three differences in selftests' BPF object files\naccording to veristat, all in the positive direction (less states).\n\nFile                                    Program        Insns (A)  Insns (B)  Insns  (DIFF)  States (A)  States (B)  States (DIFF)\n--------------------------------------  -------------  ---------  ---------  -------------  ----------  ----------  -------------\ntest_cls_redirect_dynptr.bpf.linked3.o  cls_redirect        2987       2864  -123 (-4.12%)         240         231    -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o         syncookie_tc       82848      82661  -187 (-0.23%)        5107        5073   -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o         syncookie_xdp      85116      84964  -152 (-0.18%)        5162        5130   -32 (-0.62%)\n\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\n\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry's insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon't want to entries, so we need to reuse last added entry, if it is\npresent.\n\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n\n  [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46a54ea3-bd7f-4b06-a45f-a7a01a26cf0b",
      "id": "CVE-2024-38546",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: vc4: Fix possible null pointer dereference\n\nIn vc4_hdmi_audio_init() of_get_address() may return\nNULL which is later dereferenced. Fix this bug by adding NULL check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d252074-0aad-4e81-87bd-92cc71b7dd29",
      "id": "CVE-2023-53051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm crypt: add cond_resched() to dmcrypt_write()\n\nThe loop in dmcrypt_write may be running for unbounded amount of time,\nthus we need cond_resched() in it.\n\nThis commit fixes the following warning:\n\n[ 3391.153255][   C12] watchdog: BUG: soft lockup - CPU#12 stuck for 23s! [dmcrypt_write/2:2897]\n...\n[ 3391.387210][   C12] Call trace:\n[ 3391.390338][   C12]  blk_attempt_bio_merge.part.6+0x38/0x158\n[ 3391.395970][   C12]  blk_attempt_plug_merge+0xc0/0x1b0\n[ 3391.401085][   C12]  blk_mq_submit_bio+0x398/0x550\n[ 3391.405856][   C12]  submit_bio_noacct+0x308/0x380\n[ 3391.410630][   C12]  dmcrypt_write+0x1e4/0x208 [dm_crypt]\n[ 3391.416005][   C12]  kthread+0x130/0x138\n[ 3391.419911][   C12]  ret_from_fork+0x10/0x18",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cff94d6c-c4f2-48e9-8544-f243238f52e0",
      "id": "CVE-2023-53261",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: Fix memory leak in acpi_buffer-\u003epointer\n\nThere are memory leaks reported by kmemleak:\n...\nunreferenced object 0xffff00213c141000 (size 1024):\n  comm \"systemd-udevd\", pid 2123, jiffies 4294909467 (age 6062.160s)\n  hex dump (first 32 bytes):\n    04 00 00 00 02 00 00 00 18 10 14 3c 21 00 ff ff  ...........\u003c!...\n    00 00 00 00 00 00 00 00 03 00 00 00 10 00 00 00  ................\n  backtrace:\n    [\u003c000000004b7c9001\u003e] __kmem_cache_alloc_node+0x2f8/0x348\n    [\u003c00000000b0fc7ceb\u003e] __kmalloc+0x58/0x108\n    [\u003c0000000064ff4695\u003e] acpi_os_allocate+0x2c/0x68\n    [\u003c000000007d57d116\u003e] acpi_ut_initialize_buffer+0x54/0xe0\n    [\u003c0000000024583908\u003e] acpi_evaluate_object+0x388/0x438\n    [\u003c0000000017b2e72b\u003e] acpi_evaluate_object_typed+0xe8/0x240\n    [\u003c000000005df0eac2\u003e] coresight_get_platform_data+0x1b4/0x988 [coresight]\n...\n\nThe ACPI buffer memory (buf.pointer) should be freed. But the buffer\nis also used after returning from acpi_get_dsd_graph().\nMove the temporary variables buf to acpi_coresight_parse_graph(),\nand free it before the function return to prevent memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c7671b95-a7b5-480d-847b-96e8cca16f97",
      "id": "CVE-2024-35799",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Prevent crash when disable stream\n\n[Why]\nDisabling stream encoder invokes a function that no longer exists.\n\n[How]\nCheck if the function declaration is NULL in disable stream encoder.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "793423e3-acaa-4484-93dd-9d9dce07b3a1",
      "id": "CVE-2023-53280",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Remove unused nvme_ls_waitq wait queue\n\nSystem crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up\ngets called for uninitialized wait queue sp-\u003envme_ls_waitq.\n\n    qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0\n    qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11\n    BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n    PGD 0 P4D 0\n    Oops: 0000 [#1] SMP NOPTI\n    Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021\n    Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]\n    RIP: 0010:__wake_up_common+0x4c/0x190\n    RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086\n    RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000\n    RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320\n    RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8\n    R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20\n    R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000\n    FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    PKRU: 55555554\n    Call Trace:\n     __wake_up_common_lock+0x7c/0xc0\n     qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]\n     ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]\n     ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]\n     ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]\n\nRemove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed\npreviously in the commits tagged Fixed: below.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ac9e044-2705-4150-9010-c89a4ca2e211",
      "id": "CVE-2023-53403",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntime/debug: Fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "755e6b6d-65e7-43ca-8eac-e5602d297bf1",
      "id": "CVE-2022-49871",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: Fix memory leaks of napi_get_frags\n\nkmemleak reports after running test_progs:\n\nunreferenced object 0xffff8881b1672dc0 (size 232):\n  comm \"test_progs\", pid 394388, jiffies 4354712116 (age 841.975s)\n  hex dump (first 32 bytes):\n    e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff  .........,g.....\n    00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............\n  backtrace:\n    [\u003c00000000c8f01748\u003e] napi_skb_cache_get+0xd4/0x150\n    [\u003c0000000041c7fc09\u003e] __napi_build_skb+0x15/0x50\n    [\u003c00000000431c7079\u003e] __napi_alloc_skb+0x26e/0x540\n    [\u003c000000003ecfa30e\u003e] napi_get_frags+0x59/0x140\n    [\u003c0000000099b2199e\u003e] tun_get_user+0x183d/0x3bb0 [tun]\n    [\u003c000000008a5adef0\u003e] tun_chr_write_iter+0xc0/0x1b1 [tun]\n    [\u003c0000000049993ff4\u003e] do_iter_readv_writev+0x19f/0x320\n    [\u003c000000008f338ea2\u003e] do_iter_write+0x135/0x630\n    [\u003c000000008a3377a4\u003e] vfs_writev+0x12e/0x440\n    [\u003c00000000a6b5639a\u003e] do_writev+0x104/0x280\n    [\u003c00000000ccf065d8\u003e] do_syscall_64+0x3b/0x90\n    [\u003c00000000d776e329\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe issue occurs in the following scenarios:\ntun_get_user()\n  napi_gro_frags()\n    napi_frags_finish()\n      case GRO_NORMAL:\n        gro_normal_one()\n          list_add_tail(\u0026skb-\u003elist, \u0026napi-\u003erx_list);\n          \u003c-- While napi-\u003erx_count \u003c READ_ONCE(gro_normal_batch),\n          \u003c-- gro_normal_list() is not called, napi-\u003erx_list is not empty\n  \u003c-- not ask to complete the gro work, will cause memory leaks in\n  \u003c-- following tun_napi_del()\n...\ntun_napi_del()\n  netif_napi_del()\n    __netif_napi_del()\n    \u003c-- \u0026napi-\u003erx_list is not empty, which caused memory leaks\n\nTo fix, add napi_complete() after napi_gro_frags().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac280c14-da81-4086-b07f-2c523869b1ab",
      "id": "CVE-2024-26777",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sis: Error out if pixclock equals zero\n\nThe userspace program could pass any values to the driver through\nioctl() interface. If the driver doesn't check the value of pixclock,\nit may cause divide-by-zero error.\n\nIn sisfb_check_var(), var-\u003epixclock is used as a divisor to caculate\ndrate before it is checked against zero. Fix this by checking it\nat the beginning.\n\nThis is similar to CVE-2022-3061 in i740fb which was fixed by\ncommit 15cf0b8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03246307-b433-4704-b8ae-89bc8a7f8ff6",
      "id": "CVE-2024-35934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()\n\nMany syzbot reports show extreme rtnl pressure, and many of them hint\nthat smc acquires rtnl in netns creation for no good reason [1]\n\nThis patch returns early from smc_pnet_net_init()\nif there is no netdevice yet.\n\nI am not even sure why smc_pnet_create_pnetids_list() even exists,\nbecause smc_pnet_netdev_event() is also calling\nsmc_pnet_add_base_pnetid() when handling NETDEV_UP event.\n\n[1] extract of typical syzbot reports\n\n2 locks held by syz-executor.3/12252:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.4/12253:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.1/12257:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.2/12261:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.0/12265:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.3/12268:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.4/12271:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.1/12274:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.2/12280:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94508c81-82f9-40ce-a0bf-d64e41fd57ae",
      "id": "CVE-2024-35940",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/zone: Add a null pointer check to the psz_kmsg_read\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfea4e7a-58c4-4793-aa22-b29ed6fe407e",
      "id": "CVE-2024-36023",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nJulia Lawall reported this null pointer dereference, this should fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98fc8cf0-26f6-4131-8432-12802dd62d44",
      "id": "CVE-2024-36910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Don't free decrypted memory\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus device UIO driver could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the gpadl\nto decide whether to free the memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efb20978-348c-43c1-93c6-c312b1d29547",
      "id": "CVE-2024-37354",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix crash on racing fsync and size-extending write into prealloc\n\nWe have been seeing crashes on duplicate keys in\nbtrfs_set_item_key_safe():\n\n  BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192)\n  ------------[ cut here ]------------\n  kernel BUG at fs/btrfs/ctree.c:2620!\n  invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs]\n\nWith the following stack trace:\n\n  #0  btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4)\n  #1  btrfs_drop_extents (fs/btrfs/file.c:411:4)\n  #2  log_one_extent (fs/btrfs/tree-log.c:4732:9)\n  #3  btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9)\n  #4  btrfs_log_inode (fs/btrfs/tree-log.c:6626:9)\n  #5  btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8)\n  #6  btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8)\n  #7  btrfs_sync_file (fs/btrfs/file.c:1933:8)\n  #8  vfs_fsync_range (fs/sync.c:188:9)\n  #9  vfs_fsync (fs/sync.c:202:9)\n  #10 do_fsync (fs/sync.c:212:9)\n  #11 __do_sys_fdatasync (fs/sync.c:225:9)\n  #12 __se_sys_fdatasync (fs/sync.c:223:1)\n  #13 __x64_sys_fdatasync (fs/sync.c:223:1)\n  #14 do_syscall_x64 (arch/x86/entry/common.c:52:14)\n  #15 do_syscall_64 (arch/x86/entry/common.c:83:7)\n  #16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)\n\nSo we're logging a changed extent from fsync, which is splitting an\nextent in the log tree. But this split part already exists in the tree,\ntriggering the BUG().\n\nThis is the state of the log tree at the time of the crash, dumped with\ndrgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py)\nto get more details than btrfs_print_leaf() gives us:\n\n  \u003e\u003e\u003e print_extent_buffer(prog.crashed_thread().stack_trace()[0][\"eb\"])\n  leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610\n  leaf 33439744 flags 0x100000000000000\n  fs uuid e5bd3946-400c-4223-8923-190ef1f18677\n  chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da\n          item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160\n                  generation 7 transid 9 size 8192 nbytes 8473563889606862198\n                  block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0\n                  sequence 204 flags 0x10(PREALLOC)\n                  atime 1716417703.220000000 (2024-05-22 15:41:43)\n                  ctime 1716417704.983333333 (2024-05-22 15:41:44)\n                  mtime 1716417704.983333333 (2024-05-22 15:41:44)\n                  otime 17592186044416.000000000 (559444-03-08 01:40:16)\n          item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13\n                  index 195 namelen 3 name: 193\n          item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37\n                  location key (0 UNKNOWN.0 0) type XATTR\n                  transid 7 data_len 1 name_len 6\n                  name: user.a\n                  data a\n          item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53\n                  generation 9 type 1 (regular)\n                  extent data disk byte 303144960 nr 12288\n                  extent data offset 0 nr 4096 ram 12288\n                  extent compression 0 (none)\n          item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53\n                  generation 9 type 2 (prealloc)\n                  prealloc data disk byte 303144960 nr 12288\n                  prealloc data offset 4096 nr 8192\n          item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53\n                  generation 9 type 2 (prealloc)\n                  prealloc data disk byte 303144960 nr 12288\n                  prealloc data offset 8192 nr 4096\n  ...\n\nSo the real problem happened earlier: notice that items 4 (4k-12k) and 5\n(8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size and\nitem 5 starts at i_size.\n\nHere is the state of \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bda51d85-a998-4cb6-a5b8-0928064867a7",
      "id": "CVE-2024-42322",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: properly dereference pe in ip_vs_add_service\n\nUse pe directly to resolve sparse warning:\n\n  net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94e62609-4cb8-483c-b838-f086daae4832",
      "id": "CVE-2024-38618",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Set lower bound of start tick time\n\nCurrently ALSA timer doesn't have the lower limit of the start tick\ntime, and it allows a very small size, e.g. 1 tick with 1ns resolution\nfor hrtimer.  Such a situation may lead to an unexpected RCU stall,\nwhere  the callback repeatedly queuing the expire update, as reported\nby fuzzer.\n\nThis patch introduces a sanity check of the timer start tick time, so\nthat the system returns an error when a too small start size is set.\nAs of this patch, the lower limit is hard-coded to 100us, which is\nsmall enough but can still work somehow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c989756-0692-47cd-8b60-226255a98520",
      "id": "CVE-2024-39489",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix memleak in seg6_hmac_init_algo\n\nseg6_hmac_init_algo returns without cleaning up the previous allocations\nif one fails, so it's going to leak all that memory and the crypto tfms.\n\nUpdate seg6_hmac_exit to only free the memory when allocated, so we can\nreuse the code directly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "192134a9-2e56-415a-80f9-b4f722acc1aa",
      "id": "CVE-2024-41935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to shrink read extent node in batches\n\nWe use rwlock to protect core structure data of extent tree during\nits shrink, however, if there is a huge number of extent nodes in\nextent tree, during shrink of extent tree, it may hold rwlock for\na very long time, which may trigger kernel hang issue.\n\nThis patch fixes to shrink read extent node in batches, so that,\ncritical region of the rwlock can be shrunk to avoid its extreme\nlong time hold.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37bf0890-cb4a-4f10-b0a2-e8a0ecc92ab1",
      "id": "CVE-2024-42068",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()\n\nset_memory_ro() can fail, leaving memory unprotected.\n\nCheck its return and take it into account as an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "abcc4586-f5a8-4b03-95c7-1d37a4f8a69f",
      "id": "CVE-2024-42073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems\n\nThe following two shared buffer operations make use of the Shared Buffer\nStatus Register (SBSR):\n\n # devlink sb occupancy snapshot pci/0000:01:00.0\n # devlink sb occupancy clearmax pci/0000:01:00.0\n\nThe register has two masks of 256 bits to denote on which ingress /\negress ports the register should operate on. Spectrum-4 has more than\n256 ports, so the register was extended by cited commit with a new\n'port_page' field.\n\nHowever, when filling the register's payload, the driver specifies the\nports as absolute numbers and not relative to the first port of the port\npage, resulting in memory corruptions [1].\n\nFix by specifying the ports relative to the first port of the port page.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0\nRead of size 1 at addr ffff8881068cb00f by task devlink/1566\n[...]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0\n mlxsw_devlink_sb_occ_snapshot+0x75/0xb0\n devlink_nl_sb_occ_snapshot_doit+0x1f9/0x2a0\n genl_family_rcv_msg_doit+0x20c/0x300\n genl_rcv_msg+0x567/0x800\n netlink_rcv_skb+0x170/0x450\n genl_rcv+0x2d/0x40\n netlink_unicast+0x547/0x830\n netlink_sendmsg+0x8d4/0xdb0\n __sys_sendto+0x49b/0x510\n __x64_sys_sendto+0xe5/0x1c0\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[...]\nAllocated by task 1:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n copy_verifier_state+0xbc2/0xfb0\n do_check_common+0x2c51/0xc7e0\n bpf_check+0x5107/0x9960\n bpf_prog_load+0xf0e/0x2690\n __sys_bpf+0x1a61/0x49d0\n __x64_sys_bpf+0x7d/0xc0\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x109/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xca/0x2b0\n free_verifier_state+0xce/0x270\n do_check_common+0x4828/0xc7e0\n bpf_check+0x5107/0x9960\n bpf_prog_load+0xf0e/0x2690\n __sys_bpf+0x1a61/0x49d0\n __x64_sys_bpf+0x7d/0xc0\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71828724-a79e-4e03-b54e-87f9645c6501",
      "id": "CVE-2025-38516",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: qcom: msm: mark certain pins as invalid for interrupts\n\nOn some platforms, the UFS-reset pin has no interrupt logic in TLMM but\nis nevertheless registered as a GPIO in the kernel. This enables the\nuser-space to trigger a BUG() in the pinctrl-msm driver by running, for\nexample: `gpiomon -c 0 113` on RB2.\n\nThe exact culprit is requesting pins whose intr_detection_width setting\nis not 1 or 2 for interrupts. This hits a BUG() in\nmsm_gpio_irq_set_type(). Potentially crashing the kernel due to an\ninvalid request from user-space is not optimal, so let's go through the\npins and mark those that would fail the check as invalid for the irq chip\nas we should not even register them as available irqs.\n\nThis function can be extended if we determine that there are more\ncorner-cases like this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "982d5af7-63bb-431e-8dee-cfb0f1e09fec",
      "id": "CVE-2024-50061",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition\n\nIn the cdns_i3c_master_probe function, \u0026master-\u003ehj_work is bound with\ncdns_i3c_master_hj. And cdns_i3c_master_interrupt can call\ncnds_i3c_master_demux_ibis function to start the work.\n\nIf we remove the module which will call cdns_i3c_master_remove to\nmake cleanup, it will free master-\u003ebase through i3c_master_unregister\nwhile the work mentioned above will be used. The sequence of operations\nthat may lead to a UAF bug is as follows:\n\nCPU0                                      CPU1\n\n                                     | cdns_i3c_master_hj\ncdns_i3c_master_remove               |\ni3c_master_unregister(\u0026master-\u003ebase) |\ndevice_unregister(\u0026master-\u003edev)      |\ndevice_release                       |\n//free master-\u003ebase                  |\n                                     | i3c_master_do_daa(\u0026master-\u003ebase)\n                                     | //use master-\u003ebase\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in cdns_i3c_master_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1848fe2-f7bc-444d-b4e7-321313e9205f",
      "id": "CVE-2024-44949",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: fix a possible DMA corruption\n\nARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be\npossible that two unrelated 16-byte allocations share a cache line. If\none of these allocations is written using DMA and the other is written\nusing cached write, the value that was written with DMA may be\ncorrupted.\n\nThis commit changes ARCH_DMA_MINALIGN to be 128 on PA20 and 32 on PA1.1 -\nthat's the largest possible cache line size.\n\nAs different parisc microarchitectures have different cache line size, we\ndefine arch_slab_minalign(), cache_line_size() and\ndma_get_cache_alignment() so that the kernel may tune slab cache\nparameters dynamically, based on the detected cache line size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9fdb0be3-c598-442e-9271-da71fd46460a",
      "id": "CVE-2024-44956",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/preempt_fence: enlarge the fence critical section\n\nIt is really easy to introduce subtle deadlocks in\npreempt_fence_work_func() since we operate on single global ordered-wq\nfor signalling our preempt fences behind the scenes, so even though we\nsignal a particular fence, everything in the callback should be in the\nfence critical section, since blocking in the callback will prevent\nother published fences from signalling. If we enlarge the fence critical\nsection to cover the entire callback, then lockdep should be able to\nunderstand this better, and complain if we grab a sensitive lock like\nvm-\u003elock, which is also held when waiting on preempt fences.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8981e972-69f5-4473-8c77-272fe838dbdc",
      "id": "CVE-2024-46841",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()\n\nWe handle errors here properly, ENOMEM isn't fatal, return the error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec6e9997-c132-41ae-ace5-5f7c035e5bde",
      "id": "CVE-2024-46848",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Limit the period on Haswell\n\nRunning the ltp test cve-2015-3290 concurrently reports the following\nwarnings.\n\nperfevents: irq loop stuck!\n  WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174\n  intel_pmu_handle_irq+0x285/0x370\n  Call Trace:\n   \u003cNMI\u003e\n   ? __warn+0xa4/0x220\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? __report_bug+0x123/0x130\n   ? intel_pmu_handle_irq+0x285/0x370\n   ? report_bug+0x3e/0xa0\n   ? handle_bug+0x3c/0x70\n   ? exc_invalid_op+0x18/0x50\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? irq_work_claim+0x1e/0x40\n   ? intel_pmu_handle_irq+0x285/0x370\n   perf_event_nmi_handler+0x3d/0x60\n   nmi_handle+0x104/0x330\n\nThanks to Thomas Gleixner's analysis, the issue is caused by the low\ninitial period (1) of the frequency estimation algorithm, which triggers\nthe defects of the HW, specifically erratum HSW11 and HSW143. (For the\ndetails, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/)\n\nThe HSW11 requires a period larger than 100 for the INST_RETIRED.ALL\nevent, but the initial period in the freq mode is 1. The erratum is the\nsame as the BDM11, which has been supported in the kernel. A minimum\nperiod of 128 is enforced as well on HSW.\n\nHSW143 is regarding that the fixed counter 1 may overcount 32 with the\nHyper-Threading is enabled. However, based on the test, the hardware\nhas more issues than it tells. Besides the fixed counter 1, the message\n'interrupt took too long' can be observed on any counter which was armed\nwith a period \u003c 32 and two events expired in the same NMI. A minimum\nperiod of 32 is enforced for the rest of the events.\nThe recommended workaround code of the HSW143 is not implemented.\nBecause it only addresses the issue for the fixed counter. It brings\nextra overhead through extra MSR writing. No related overcounting issue\nhas been reported so far.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17e73c01-ba10-4cbd-acc7-fab2e7eac785",
      "id": "CVE-2024-47678",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: change the order of rate limits\n\nICMP messages are ratelimited :\n\nAfter the blamed commits, the two rate limiters are applied in this order:\n\n1) host wide ratelimit (icmp_global_allow())\n\n2) Per destination ratelimit (inetpeer based)\n\nIn order to avoid side-channels attacks, we need to apply\nthe per destination check first.\n\nThis patch makes the following change :\n\n1) icmp_global_allow() checks if the host wide limit is reached.\n   But credits are not yet consumed. This is deferred to 3)\n\n2) The per destination limit is checked/updated.\n   This might add a new node in inetpeer tree.\n\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\n\nThis means that host wide ratelimit is still effective\nin keeping inetpeer tree small even under DDOS.\n\nAs a bonus, I removed icmp_global.lock as the fast path\ncan use a lock-free operation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16512601-9c18-4006-97c1-6ee99839f360",
      "id": "CVE-2024-47697",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error\n\nEnsure index in rtl2830_pid_filter does not exceed 31 to prevent\nout-of-bounds access.\n\ndev-\u003efilters is a 32-bit value, so set_bit and clear_bit functions should\nonly operate on indices from 0 to 31. If index is 32, it will attempt to\naccess a non-existent 33rd bit, leading to out-of-bounds access.\nChange the boundary check from index \u003e 32 to index \u003e= 32 to resolve this\nissue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c730af2e-f211-405d-96c6-1ae067e23a33",
      "id": "CVE-2024-47699",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential null-ptr-deref in nilfs_btree_insert()\n\nPatch series \"nilfs2: fix potential issues with empty b-tree nodes\".\n\nThis series addresses three potential issues with empty b-tree nodes that\ncan occur with corrupted filesystem images, including one recently\ndiscovered by syzbot.\n\n\nThis patch (of 3):\n\nIf a b-tree is broken on the device, and the b-tree height is greater than\n2 (the level of the root node is greater than 1) even if the number of\nchild nodes of the b-tree root is 0, a NULL pointer dereference occurs in\nnilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().\n\nThis is because, when the number of child nodes of the b-tree root is 0,\nnilfs_btree_do_lookup() does not set the block buffer head in any of\npath[x].bp_bh, leaving it as the initial value of NULL, but if the level\nof the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),\nwhich accesses the buffer memory of path[x].bp_bh, is called.\n\nFix this issue by adding a check to nilfs_btree_root_broken(), which\nperforms sanity checks when reading the root node from the device, to\ndetect this inconsistency.\n\nThanks to Lizhi Xu for trying to solve the bug and clarifying the cause\nearly on.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce1137f8-0b44-4a8c-94b3-c2e6740e801f",
      "id": "CVE-2024-47701",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid OOB when system.data xattr changes underneath the filesystem\n\nWhen looking up for an entry in an inlined directory, if e_value_offs is\nchanged underneath the filesystem by some change in the block device, it\nwill lead to an out-of-bounds access that KASAN detects as an UAF.\n\nEXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.\nloop0: detected capacity change from 2048 to 2047\n==================================================================\nBUG: KASAN: use-after-free in ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500\nRead of size 1 at addr ffff88803e91130f by task syz-executor269/5103\n\nCPU: 0 UID: 0 PID: 5103 Comm: syz-executor269 Not tainted 6.11.0-rc4-syzkaller #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500\n ext4_find_inline_entry+0x4be/0x5e0 fs/ext4/inline.c:1697\n __ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1573\n ext4_lookup_entry fs/ext4/namei.c:1727 [inline]\n ext4_lookup+0x15f/0x750 fs/ext4/namei.c:1795\n lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633\n filename_create+0x297/0x540 fs/namei.c:3980\n do_symlinkat+0xf9/0x3a0 fs/namei.c:4587\n __do_sys_symlinkat fs/namei.c:4610 [inline]\n __se_sys_symlinkat fs/namei.c:4607 [inline]\n __x64_sys_symlinkat+0x95/0xb0 fs/namei.c:4607\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f3e73ced469\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff4d40c258 EFLAGS: 00000246 ORIG_RAX: 000000000000010a\nRAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f3e73ced469\nRDX: 0000000020000200 RSI: 00000000ffffff9c RDI: 00000000200001c0\nRBP: 0000000000000000 R08: 00007fff4d40c290 R09: 00007fff4d40c290\nR10: 0023706f6f6c2f76 R11: 0000000000000246 R12: 00007fff4d40c27c\nR13: 0000000000000003 R14: 431bde82d7b634db R15: 00007fff4d40c2b0\n \u003c/TASK\u003e\n\nCalling ext4_xattr_ibody_find right after reading the inode with\next4_get_inode_loc will lead to a check of the validity of the xattrs,\navoiding this problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e4aaa57-4cb8-461a-92cc-87c23250d030",
      "id": "CVE-2024-49905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)\n\nThis commit adds a null check for the 'afb' variable in the\namdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was\nassumed to be null, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could be null (see line 1252)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4932622d-bf1a-4f7f-90da-c20d742834ec",
      "id": "CVE-2024-50006",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix i_data_sem unlock order in ext4_ind_migrate()\n\nFuzzing reports a possible deadlock in jbd2_log_wait_commit.\n\nThis issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require\nsynchronous updates because the file descriptor is opened with O_SYNC.\nThis can lead to the jbd2_journal_stop() function calling\njbd2_might_wait_for_commit(), potentially causing a deadlock if the\nEXT4_IOC_MIGRATE call races with a write(2) system call.\n\nThis problem only arises when CONFIG_PROVE_LOCKING is enabled. In this\ncase, the jbd2_might_wait_for_commit macro locks jbd2_handle in the\njbd2_journal_stop function while i_data_sem is locked. This triggers\nlockdep because the jbd2_journal_start function might also lock the same\njbd2_handle simultaneously.\n\nFound by Linux Verification Center (linuxtesting.org) with syzkaller.\n\nRule: add",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "240d8d46-6334-41df-b93e-d7cf106486ca",
      "id": "CVE-2024-50024",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n  ...\n  NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n  LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n  Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4b02486-e8b1-4703-9830-53fceaac8323",
      "id": "CVE-2024-50108",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Disable PSR-SU on Parade 08-01 TCON too\n\nStuart Hayhurst has found that both at bootup and fullscreen VA-API video\nis leading to black screens for around 1 second and kernel WARNING [1] traces\nwhen calling dmub_psr_enable() with Parade 08-01 TCON.\n\nThese symptoms all go away with PSR-SU disabled for this TCON, so disable\nit for now while DMUB traces [2] from the failure can be analyzed and the failure\nstate properly root caused.\n\n(cherry picked from commit afb634a6823d8d9db23c5fb04f79c5549349628b)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "440dbb9a-3a1e-4bf2-b222-fd5c2c848bd4",
      "id": "CVE-2024-50199",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swapfile: skip HugeTLB pages for unuse_vma\n\nI got a bad pud error and lost a 1GB HugeTLB when calling swapoff.  The\nproblem can be reproduced by the following steps:\n\n 1. Allocate an anonymous 1GB HugeTLB and some other anonymous memory.\n 2. Swapout the above anonymous memory.\n 3. run swapoff and we will get a bad pud error in kernel message:\n\n  mm/pgtable-generic.c:42: bad pud 00000000743d215d(84000001400000e7)\n\nWe can tell that pud_clear_bad is called by pud_none_or_clear_bad in\nunuse_pud_range() by ftrace.  And therefore the HugeTLB pages will never\nbe freed because we lost it from page table.  We can skip HugeTLB pages\nfor unuse_vma to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb85efc6-a095-459e-bbfe-6fe19e3a11aa",
      "id": "CVE-2024-53138",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\"nfs: add support for large folios\")).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc0a573c-4ff8-4bb8-9215-06e26e7a8ffe",
      "id": "CVE-2024-53171",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit\n\nAfter an insertion in TNC, the tree might split and cause a node to\nchange its `znode-\u003eparent`. A further deletion of other nodes in the\ntree (which also could free the nodes), the aforementioned node's\n`znode-\u003ecparent` could still point to a freed node. This\n`znode-\u003ecparent` may not be updated when getting nodes to commit in\n`ubifs_tnc_start_commit()`. This could then trigger a use-after-free\nwhen accessing the `znode-\u003ecparent` in `write_index()` in\n`ubifs_tnc_end_commit()`.\n\nThis can be triggered by running\n\n  rm -f /etc/test-file.bin\n  dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync\n\nin a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then\nreports:\n\n  BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950\n  Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153\n\n  Call trace:\n   dump_backtrace+0x0/0x340\n   show_stack+0x18/0x24\n   dump_stack_lvl+0x9c/0xbc\n   print_address_description.constprop.0+0x74/0x2b0\n   kasan_report+0x1d8/0x1f0\n   kasan_check_range+0xf8/0x1a0\n   memcpy+0x84/0xf4\n   ubifs_tnc_end_commit+0xa5c/0x1950\n   do_commit+0x4e0/0x1340\n   ubifs_bg_thread+0x234/0x2e0\n   kthread+0x36c/0x410\n   ret_from_fork+0x10/0x20\n\n  Allocated by task 401:\n   kasan_save_stack+0x38/0x70\n   __kasan_kmalloc+0x8c/0xd0\n   __kmalloc+0x34c/0x5bc\n   tnc_insert+0x140/0x16a4\n   ubifs_tnc_add+0x370/0x52c\n   ubifs_jnl_write_data+0x5d8/0x870\n   do_writepage+0x36c/0x510\n   ubifs_writepage+0x190/0x4dc\n   __writepage+0x58/0x154\n   write_cache_pages+0x394/0x830\n   do_writepages+0x1f0/0x5b0\n   filemap_fdatawrite_wbc+0x170/0x25c\n   file_write_and_wait_range+0x140/0x190\n   ubifs_fsync+0xe8/0x290\n   vfs_fsync_range+0xc0/0x1e4\n   do_fsync+0x40/0x90\n   __arm64_sys_fsync+0x34/0x50\n   invoke_syscall.constprop.0+0xa8/0x260\n   do_el0_svc+0xc8/0x1f0\n   el0_svc+0x34/0x70\n   el0t_64_sync_handler+0x108/0x114\n   el0t_64_sync+0x1a4/0x1a8\n\n  Freed by task 403:\n   kasan_save_stack+0x38/0x70\n   kasan_set_track+0x28/0x40\n   kasan_set_free_info+0x28/0x4c\n   __kasan_slab_free+0xd4/0x13c\n   kfree+0xc4/0x3a0\n   tnc_delete+0x3f4/0xe40\n   ubifs_tnc_remove_range+0x368/0x73c\n   ubifs_tnc_remove_ino+0x29c/0x2e0\n   ubifs_jnl_delete_inode+0x150/0x260\n   ubifs_evict_inode+0x1d4/0x2e4\n   evict+0x1c8/0x450\n   iput+0x2a0/0x3c4\n   do_unlinkat+0x2cc/0x490\n   __arm64_sys_unlinkat+0x90/0x100\n   invoke_syscall.constprop.0+0xa8/0x260\n   do_el0_svc+0xc8/0x1f0\n   el0_svc+0x34/0x70\n   el0t_64_sync_handler+0x108/0x114\n   el0t_64_sync+0x1a4/0x1a8\n\nThe offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free\nwhen a node becomes root in TNC but still has a `cparent` to an already\nfreed node. More specifically, consider the following TNC:\n\n         zroot\n         /\n        /\n      zp1\n      /\n     /\n    zn\n\nInserting a new node `zn_new` with a key smaller then `zn` will trigger\na split in `tnc_insert()` if `zp1` is full:\n\n         zroot\n         /   \\\n        /     \\\n      zp1     zp2\n      /         \\\n     /           \\\n  zn_new          zn\n\n`zn-\u003eparent` has now been moved to `zp2`, *but* `zn-\u003ecparent` still\npoints to `zp1`.\n\nNow, consider a removal of all the nodes _except_ `zn`. Just when\n`tnc_delete()` is about to delete `zroot` and `zp2`:\n\n         zroot\n             \\\n              \\\n              zp2\n                \\\n                 \\\n                 zn\n\n`zroot` and `zp2` get freed and the tree collapses:\n\n           zn\n\n`zn` now becomes the new `zroot`.\n\n`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and\n`write_index()` will check its `znode-\u003ecparent` that wrongly points to\nthe already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called\nwith `znode-\u003ecparent-\u003ezbranch[znode-\u003eiip].hash` that triggers the\nuse-after-free!\n\nFix this by explicitly setting `znode-\u003ecparent` to `NULL` in\n`get_znodes_to_commit()` for the root node. The search for the dirty\nnodes\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3d6e1d9-005c-4d76-b30e-1bcd4149c798",
      "id": "CVE-2024-53180",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Add sanity NULL check for the default mmap fault handler\n\nA driver might allow the mmap access before initializing its\nruntime-\u003edma_area properly.  Add a proper NULL check before passing to\nvirt_to_page() for avoiding a panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f935a12-e2cd-4afa-bf39-ab4016b0cab8",
      "id": "CVE-2024-56601",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: inet: do not leave a dangling sk pointer in inet_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If inet_create() fails later, the sk object is freed, but the\nsock object retains the dangling pointer, which may create use-after-free\nlater.\n\nClear the sk pointer in the sock object on error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1927903-44ad-4f92-9905-55653980fa4d",
      "id": "CVE-2024-56759",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\n\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\nbuffer while inside the tracepoint code. This is because in some paths\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\ndrops the last reference on the @buf extent buffer when it calls\nfree_extent_buffer_stale(buf), which schedules the release of the extent\nbuffer with RCU. This means that if we are on a kernel with preemption,\nthe current task may be preempted before calling trace_btrfs_cow_block()\nand the extent buffer already released by the time trace_btrfs_cow_block()\nis called, resulting in a use-after-free.\n\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\nThis also has a side effect of invoking the tracepoint in the tree defrag\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\ncalled there, but this is fine and it was actually missing there.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "281d5fca-9274-45e4-aa96-4fa69a4cb750",
      "id": "CVE-2024-56778",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check\n\nThe return value of drm_atomic_get_crtc_state() needs to be\nchecked. To avoid use of error pointer 'crtc_state' in case\nof the failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dcfa749-a60a-4950-885b-583c7c513b97",
      "id": "CVE-2024-57838",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/entry: Mark IRQ entries to fix stack depot warnings\n\nThe stack depot filters out everything outside of the top interrupt\ncontext as an uninteresting or irrelevant part of the stack traces. This\nhelps with stack trace de-duplication, avoiding an explosion of saved\nstack traces that share the same IRQ context code path but originate\nfrom different randomly interrupted points, eventually exhausting the\nstack depot.\n\nFiltering uses in_irqentry_text() to identify functions within the\n.irqentry.text and .softirqentry.text sections, which then become the\nlast stack trace entries being saved.\n\nWhile __do_softirq() is placed into the .softirqentry.text section by\ncommon code, populating .irqentry.text is architecture-specific.\n\nCurrently, the .irqentry.text section on s390 is empty, which prevents\nstack depot filtering and de-duplication and could result in warnings\nlike:\n\nStack depot reached limit capacity\nWARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8\n\nwith PREEMPT and KASAN enabled.\n\nFix this by moving the IO/EXT interrupt handlers from .kprobes.text into\nthe .irqentry.text section and updating the kprobes blacklist to include\nthe .irqentry.text section.\n\nThis is done only for asynchronous interrupts and explicitly not for\nprogram checks, which are synchronous and where the context beyond the\nprogram check is important to preserve. Despite machine checks being\nsomewhat in between, they are extremely rare, and preserving context\nwhen possible is also of value.\n\nSVCs and Restart Interrupts are not relevant, one being always at the\nboundary to user space and the other being a one-time thing.\n\nIRQ entries filtering is also optionally used in ftrace function graph,\nwhere the same logic applies.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b66821d-3a9f-4aaf-aa79-20e1afbb1ee7",
      "id": "CVE-2025-21759",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net-\u003eipv6.igmp_sk\nsocket under RCU protection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d2a674a7-e782-4166-8a4a-c0b9ec8ab85c",
      "id": "CVE-2025-21941",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in resource_build_scaling_params\n\nNull pointer dereference issue could occur when pipe_ctx-\u003eplane_state\nis null. The fix adds a check to ensure 'pipe_ctx-\u003eplane_state' is not\nnull before accessing. This prevents a null pointer dereference.\n\nFound by code review.\n\n(cherry picked from commit 63e6a77ccf239337baa9b1e7787cde9fa0462092)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8837f79e-7c37-42a6-981e-afb49374f3a2",
      "id": "CVE-2025-21948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: Fix potential NULL dereference at raw event handle\n\nSyzkaller reports a NULL pointer dereference issue in input_event().\n\nBUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline]\nBUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395\nRead of size 8 at addr 0000000000000028 by task syz-executor199/2949\n\nCPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n kasan_report+0xd9/0x110 mm/kasan/report.c:602\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n is_event_supported drivers/input/input.c:67 [inline]\n input_event+0x42/0xa0 drivers/input/input.c:395\n input_report_key include/linux/input.h:439 [inline]\n key_down drivers/hid/hid-appleir.c:159 [inline]\n appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232\n __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111\n hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484\n __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650\n usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734\n dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993\n __run_hrtimer kernel/time/hrtimer.c:1739 [inline]\n __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803\n hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820\n handle_softirqs+0x206/0x8d0 kernel/softirq.c:561\n __do_softirq kernel/softirq.c:595 [inline]\n invoke_softirq kernel/softirq.c:435 [inline]\n __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662\n irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\n __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185\n add_timer+0x62/0x90 kernel/time/timer.c:1295\n schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98\n usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645\n usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784\n hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nThis happens due to the malformed report items sent by the emulated device\nwhich results in a report, that has no fields, being added to the report list.\nDue to this appleir_input_configured() is never called, hidinput_connect()\nfails which results in the HID_CLAIMED_INPUT flag is not being set. However,\nit  does not make appleir_probe() fail and lets the event callback to be\ncalled without the associated input device.\n\nThus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook\nearly if the driver didn't claim any input_dev for some reason. Moreover,\nsome other hid drivers accessing input_dev in their event callbacks do have\nsimilar checks, too.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87db25ce-de07-41b8-a97b-570cdd9c652e",
      "id": "CVE-2025-37838",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition\n\nIn the ssi_protocol_probe() function, \u0026ssi-\u003ework is bound with\nssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function\nwithin the ssip_pn_ops structure is capable of starting the\nwork.\n\nIf we remove the module which will call ssi_protocol_remove()\nto make a cleanup, it will free ssi through kfree(ssi),\nwhile the work mentioned above will be used. The sequence\nof operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                        | ssip_xmit_work\nssi_protocol_remove     |\nkfree(ssi);             |\n                        | struct hsi_client *cl = ssi-\u003ecl;\n                        | // use ssi\n\nFix it by ensuring that the work is canceled before proceeding\nwith the cleanup in ssi_protocol_remove().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d401adff-1b61-428d-9f33-76381e1d3af6",
      "id": "CVE-2025-38051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_fill_dirent\n\nThere is a race condition in the readdir concurrency process, which may\naccess the rsp buffer after it has been released, triggering the\nfollowing KASAN warning.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\n\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x53/0x70\n  print_report+0xce/0x640\n  kasan_report+0xb8/0xf0\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\n  cifs_readdir+0x12cb/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f996f64b9f9\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\n  \u003c/TASK\u003e\n\n Allocated by task 408:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  __kasan_slab_alloc+0x6e/0x70\n  kmem_cache_alloc_noprof+0x117/0x3d0\n  mempool_alloc_noprof+0xf2/0x2c0\n  cifs_buf_get+0x36/0x80 [cifs]\n  allocate_buffers+0x1d2/0x330 [cifs]\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\n  kthread+0x394/0x720\n  ret_from_fork+0x34/0x70\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 342979:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x37/0x50\n  kmem_cache_free+0x2b8/0x500\n  cifs_buf_release+0x3c/0x70 [cifs]\n  cifs_readdir+0x1c97/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents64+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n The buggy address belongs to the object at ffff8880099b8000\n  which belongs to the cache cifs_request of size 16588\n The buggy address is located 412 bytes inside of\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n anon flags: 0x80000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n \u003effff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                             ^\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ==================================================================\n\nPOC is available in the link [1].\n\nThe problem triggering process is as follows:\n\nProcess 1                       Process 2\n-----------------------------------\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "692b935a-75f2-4184-b6cc-6df6fc603bea",
      "id": "CVE-2025-38230",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: validate AG parameters in dbMount() to prevent crashes\n\nValidate db_agheight, db_agwidth, and db_agstart in dbMount to catch\ncorrupted metadata early and avoid undefined behavior in dbAllocAG.\nLimits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE:\n\n- agheight: 0 to L2LPERCTL/2 (0 to 5) ensures shift\n  (L2LPERCTL - 2*agheight) \u003e= 0.\n- agwidth: 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight))\n  ensures agperlev \u003e= 1.\n  - Ranges: 1-8 (agheight 0-3), 1-4 (agheight 4), 1 (agheight 5).\n  - LPERCTL/MAXAG = 1024/128 = 8 limits leaves per AG;\n    2^(10 - 2*agheight) prevents division to 0.\n- agstart: 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1) keeps ti within\n  stree (size 1365).\n  - Ranges: 0-1237 (agwidth 1), 0-348 (agwidth 8).\n\nUBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1400:9\nshift exponent -335544310 is negative\nCPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n ubsan_epilogue lib/ubsan.c:231 [inline]\n __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468\n dbAllocAG+0x1087/0x10b0 fs/jfs/jfs_dmap.c:1400\n dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613\n jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105\n jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "22adfc25-22f7-44bf-9790-0eb894650ecd",
      "id": "CVE-2025-38263",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix NULL pointer in cache_set_flush()\n\n1. LINE#1794 - LINE#1887 is some codes about function of\n   bch_cache_set_alloc().\n2. LINE#2078 - LINE#2142 is some codes about function of\n   register_cache_set().\n3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.\n\n 1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)\n 1795 {\n ...\n 1860         if (!(c-\u003edevices = kcalloc(c-\u003enr_uuids, sizeof(void *), GFP_KERNEL)) ||\n 1861             mempool_init_slab_pool(\u0026c-\u003esearch, 32, bch_search_cache) ||\n 1862             mempool_init_kmalloc_pool(\u0026c-\u003ebio_meta, 2,\n 1863                                 sizeof(struct bbio) + sizeof(struct bio_vec) *\n 1864                                 bucket_pages(c)) ||\n 1865             mempool_init_kmalloc_pool(\u0026c-\u003efill_iter, 1, iter_size) ||\n 1866             bioset_init(\u0026c-\u003ebio_split, 4, offsetof(struct bbio, bio),\n 1867                         BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) ||\n 1868             !(c-\u003euuids = alloc_bucket_pages(GFP_KERNEL, c)) ||\n 1869             !(c-\u003emoving_gc_wq = alloc_workqueue(\"bcache_gc\",\n 1870                                                 WQ_MEM_RECLAIM, 0)) ||\n 1871             bch_journal_alloc(c) ||\n 1872             bch_btree_cache_alloc(c) ||\n 1873             bch_open_buckets_alloc(c) ||\n 1874             bch_bset_sort_state_init(\u0026c-\u003esort, ilog2(c-\u003ebtree_pages)))\n 1875                 goto err;\n                      ^^^^^^^^\n 1876\n ...\n 1883         return c;\n 1884 err:\n 1885         bch_cache_set_unregister(c);\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^\n 1886         return NULL;\n 1887 }\n ...\n 2078 static const char *register_cache_set(struct cache *ca)\n 2079 {\n ...\n 2098         c = bch_cache_set_alloc(\u0026ca-\u003esb);\n 2099         if (!c)\n 2100                 return err;\n                      ^^^^^^^^^^\n ...\n 2128         ca-\u003eset = c;\n 2129         ca-\u003eset-\u003ecache[ca-\u003esb.nr_this_dev] = ca;\n              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n ...\n 2138         return NULL;\n 2139 err:\n 2140         bch_cache_set_unregister(c);\n 2141         return err;\n 2142 }\n\n(1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and\n    call bch_cache_set_unregister()(LINE#1885).\n(2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return.\n(3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the\n    value to c-\u003ecache[], it means that c-\u003ecache[] is NULL.\n\nLINE#1624 - LINE#1665 is some codes about function of cache_set_flush().\nAs (1), in LINE#1885 call\nbch_cache_set_unregister()\n---\u003e bch_cache_set_stop()\n     ---\u003e closure_queue()\n          -.-\u003e cache_set_flush() (as below LINE#1624)\n\n 1624 static void cache_set_flush(struct closure *cl)\n 1625 {\n ...\n 1654         for_each_cache(ca, c, i)\n 1655                 if (ca-\u003ealloc_thread)\n                          ^^\n 1656                         kthread_stop(ca-\u003ealloc_thread);\n ...\n 1665 }\n\n(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the\n    kernel crash occurred as below:\n[  846.712887] bcache: register_cache() error drbd6: cannot allocate memory\n[  846.713242] bcache: register_bcache() error : failed to register device\n[  846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered\n[  846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8\n[  846.714790] PGD 0 P4D 0\n[  846.715129] Oops: 0000 [#1] SMP PTI\n[  846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1\n[  846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018\n[  846.716451] Workqueue: events cache_set_flush [bcache]\n[  846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache]\n[  846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd 3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 \u003c48\u003e 8b b8 f8 09 00 0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "081fc2f2-83ce-4223-9a7e-35a7d3cf89b8",
      "id": "CVE-2025-38529",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: aio_iiro_16: Fix bit shift out of bounds\n\nWhen checking for a supported IRQ number, the following test is used:\n\n\tif ((1 \u003c\u003c it-\u003eoptions[1]) \u0026 0xdcfc) {\n\nHowever, `it-\u003eoptions[i]` is an unchecked `int` value from userspace, so\nthe shift amount could be negative or out of bounds.  Fix the test by\nrequiring `it-\u003eoptions[1]` to be within bounds before proceeding with\nthe original test.  Valid `it-\u003eoptions[1]` values that select the IRQ\nwill be in the range [1,15]. The value 0 explicitly disables the use of\ninterrupts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b01df504-dcc0-46b7-ac25-e595715ddb0c",
      "id": "CVE-2019-19338",
      "description": "A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1bca124-af19-4880-8a3c-0e9fc9c353ff",
      "id": "CVE-2020-28374",
      "description": "In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5da53c3b-9017-4210-aa91-666e6d706be8",
      "id": "CVE-2020-29374",
      "description": "An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b774bce-cffe-483b-b299-fa584d72e5a9",
      "id": "CVE-2020-36385",
      "description": "An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9869566a-3f2b-45b9-aba2-bd5fd2703bbd",
      "id": "CVE-2021-28972",
      "description": "In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\\0' termination, aka CID-cc7a0bb058b8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3fc6c2f-af1c-45fa-a342-b889a94456b2",
      "id": "CVE-2021-4083",
      "description": "A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcf7bd72-559e-4bc6-a930-07a64827ff52",
      "id": "CVE-2021-47004",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid touching checkpointed data in get_victim()\n\nIn CP disabling mode, there are two issues when using LFS or SSR | AT_SSR\nmode to select victim:\n\n1. LFS is set to find source section during GC, the victim should have\nno checkpointed data, since after GC, section could not be set free for\nreuse.\n\nPreviously, we only check valid chpt blocks in current segment rather\nthan section, fix it.\n\n2. SSR | AT_SSR are set to find target segment for writes which can be\nfully filled by checkpointed and newly written blocks, we should never\nselect such segment, otherwise it can cause panic or data corruption\nduring allocation, potential case is described as below:\n\n a) target segment has 'n' (n \u003c 512) ckpt valid blocks\n b) GC migrates 'n' valid blocks to other segment (segment is still\n    in dirty list)\n c) GC migrates '512 - n' blocks to target segment (segment has 'n'\n    cp_vblocks and '512 - n' vblocks)\n d) If GC selects target segment via {AT,}SSR allocator, however there\n    is no free space in targe segment.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9615b043-9536-4b60-aeed-72c8a396dd71",
      "id": "CVE-2021-47015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix RX consumer index logic in the error path.\n\nIn bnxt_rx_pkt(), the RX buffers are expected to complete in order.\nIf the RX consumer index indicates an out of order buffer completion,\nit means we are hitting a hardware bug and the driver will abort all\nremaining RX packets and reset the RX ring.  The RX consumer index\nthat we pass to bnxt_discard_rx() is not correct.  We should be\npassing the current index (tmp_raw_cons) instead of the old index\n(raw_cons).  This bug can cause us to be at the wrong index when\ntrying to abort the next RX packet.  It can crash like this:\n\n #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007\n #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232\n #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e\n #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978\n #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0\n #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e\n #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24\n #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e\n #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12\n #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5\n    [exception RIP: bnxt_rx_pkt+237]\n    RIP: ffffffffc0259cdd  RSP: ffff9bbcdf5c3d98  RFLAGS: 00010213\n    RAX: 000000005dd8097f  RBX: ffff9ba4cb11b7e0  RCX: ffffa923cf6e9000\n    RDX: 0000000000000fff  RSI: 0000000000000627  RDI: 0000000000001000\n    RBP: ffff9bbcdf5c3e60   R8: 0000000000420003   R9: 000000000000020d\n    R10: ffffa923cf6ec138  R11: ffff9bbcdf5c3e83  R12: ffff9ba4d6f928c0\n    R13: ffff9ba4cac28080  R14: ffff9ba4cb11b7f0  R15: ffff9ba4d5a30000\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e07f614b-2f65-4859-87c5-a8e4c1d16019",
      "id": "CVE-2021-47074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-loop: fix memory leak in nvme_loop_create_ctrl()\n\nWhen creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl()\nfails, the loop ctrl should be freed before jumping to the \"out\" label.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d55dfea-04c3-4095-aa57-693aa42ae002",
      "id": "CVE-2021-47250",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix memory leak in netlbl_cipsov4_add_std\n\nReported by syzkaller:\nBUG: memory leak\nunreferenced object 0xffff888105df7000 (size 64):\ncomm \"syz-executor842\", pid 360, jiffies 4294824824 (age 22.546s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n[\u003c00000000e67ed558\u003e] kmalloc include/linux/slab.h:590 [inline]\n[\u003c00000000e67ed558\u003e] kzalloc include/linux/slab.h:720 [inline]\n[\u003c00000000e67ed558\u003e] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]\n[\u003c00000000e67ed558\u003e] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416\n[\u003c0000000006040154\u003e] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739\n[\u003c00000000204d7a1c\u003e] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n[\u003c00000000204d7a1c\u003e] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800\n[\u003c00000000c0d6a995\u003e] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504\n[\u003c00000000d78b9d2c\u003e] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811\n[\u003c000000009733081b\u003e] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n[\u003c000000009733081b\u003e] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340\n[\u003c00000000d5fd43b8\u003e] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929\n[\u003c000000000a2d1e40\u003e] sock_sendmsg_nosec net/socket.c:654 [inline]\n[\u003c000000000a2d1e40\u003e] sock_sendmsg+0x139/0x170 net/socket.c:674\n[\u003c00000000321d1969\u003e] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350\n[\u003c00000000964e16bc\u003e] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404\n[\u003c000000001615e288\u003e] __sys_sendmsg+0xd3/0x190 net/socket.c:2433\n[\u003c000000004ee8b6a5\u003e] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47\n[\u003c00000000171c7cee\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe memory of doi_def-\u003emap.std pointing is allocated in\nnetlbl_cipsov4_add_std, but no place has freed it. It should be\nfreed in cipso_v4_doi_free which frees the cipso DOI resource.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7adb354-7534-469f-b28d-8734069d3366",
      "id": "CVE-2024-57889",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking\n\nIf a device uses MCP23xxx IO expander to receive IRQs, the following\nbug can happen:\n\n  BUG: sleeping function called from invalid context\n    at kernel/locking/mutex.c:283\n  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ...\n  preempt_count: 1, expected: 0\n  ...\n  Call Trace:\n  ...\n  __might_resched+0x104/0x10e\n  __might_sleep+0x3e/0x62\n  mutex_lock+0x20/0x4c\n  regmap_lock_mutex+0x10/0x18\n  regmap_update_bits_base+0x2c/0x66\n  mcp23s08_irq_set_type+0x1ae/0x1d6\n  __irq_set_trigger+0x56/0x172\n  __setup_irq+0x1e6/0x646\n  request_threaded_irq+0xb6/0x160\n  ...\n\nWe observed the problem while experimenting with a touchscreen driver which\nused MCP23017 IO expander (I2C).\n\nThe regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from\nconcurrent accesses, which is the default for regmaps without .fast_io,\n.disable_locking, etc.\n\nmcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter\nlocks the mutex.\n\nHowever, __setup_irq() locks desc-\u003elock spinlock before calling these\nfunctions. As a result, the system tries to lock the mutex whole holding\nthe spinlock.\n\nIt seems, the internal regmap locks are not needed in this driver at all.\nmcp-\u003elock seems to protect the regmap from concurrent accesses already,\nexcept, probably, in mcp_pinconf_get/set.\n\nmcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under\nchip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes\nmcp-\u003elock and enables regmap caching, so that the potentially slow I2C\naccesses are deferred until chip_bus_unlock().\n\nThe accesses to the regmap from mcp23s08_probe_one() do not need additional\nlocking.\n\nIn all remaining places where the regmap is accessed, except\nmcp_pinconf_get/set(), the driver already takes mcp-\u003elock.\n\nThis patch adds locking in mcp_pinconf_get/set() and disables internal\nlocking in the regmap config. Among other things, it fixes the sleeping\nin atomic context described above.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00048a8b-3122-4b20-b840-716b151f6a39",
      "id": "CVE-2021-47289",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: fix NULL pointer dereference\n\nCommit 71f642833284 (\"ACPI: utils: Fix reference counting in\nfor_each_acpi_dev_match()\") started doing \"acpi_dev_put()\" on a pointer\nthat was possibly NULL.  That fails miserably, because that helper\ninline function is not set up to handle that case.\n\nJust make acpi_dev_put() silently accept a NULL pointer, rather than\ncalling down to put_device() with an invalid offset off that NULL\npointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ffa7df3-fc40-4954-ac12-348e0b223877",
      "id": "CVE-2021-47296",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\nvcpu_put is not called if the user copy fails. This can result in preempt\nnotifier corruption and crashes, among other issues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9a11b96-9eef-4a5c-9954-c170cff3d689",
      "id": "CVE-2021-47320",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix acl memory leak of posix_acl_create()\n\nWhen looking into another nfs xfstests report, I found acl and\ndefault_acl in nfs3_proc_create() and nfs3_proc_mknod() error\npaths are possibly leaked. Fix them in advance.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08bbd868-10e6-4955-8175-1442762c8499",
      "id": "CVE-2021-47344",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: zr364xx: fix memory leak in zr364xx_start_readpipe\n\nsyzbot reported memory leak in zr364xx driver.\nThe problem was in non-freed urb in case of\nusb_submit_urb() fail.\n\nbacktrace:\n  [\u003cffffffff82baedf6\u003e] kmalloc include/linux/slab.h:561 [inline]\n  [\u003cffffffff82baedf6\u003e] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74\n  [\u003cffffffff82f7cce8\u003e] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022\n  [\u003cffffffff84251dfc\u003e] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]\n  [\u003cffffffff84251dfc\u003e] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516\n  [\u003cffffffff82bb6507\u003e] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n  [\u003cffffffff826018a9\u003e] really_probe+0x159/0x500 drivers/base/dd.c:576",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa63114f-8221-4fac-af74-19e62d68db70",
      "id": "CVE-2021-47359",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix soft lockup during fsstress\n\nBelow traces are observed during fsstress and system got hung.\n[  130.698396] watchdog: BUG: soft lockup - CPU#6 stuck for 26s!",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11f43cc3-0ef1-4924-b360-2f6c4dae0357",
      "id": "CVE-2021-47375",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: Fix uaf in blk_trace access after removing by sysfs\n\nThere is an use-after-free problem triggered by following process:\n\n      P1(sda)\t\t\t\tP2(sdb)\n\t\t\techo 0 \u003e /sys/block/sdb/trace/enable\n\t\t\t  blk_trace_remove_queue\n\t\t\t    synchronize_rcu\n\t\t\t    blk_trace_free\n\t\t\t      relay_close\nrcu_read_lock\n__blk_add_trace\n  trace_note_tsk\n  (Iterate running_trace_list)\n\t\t\t        relay_close_buf\n\t\t\t\t  relay_destroy_buf\n\t\t\t\t    kfree(buf)\n    trace_note(sdb's bt)\n      relay_reserve\n        buf-\u003eoffset \u003c- nullptr deference (use-after-free) !!!\nrcu_read_unlock\n\n[  502.714379] BUG: kernel NULL pointer dereference, address:\n0000000000000010\n[  502.715260] #PF: supervisor read access in kernel mode\n[  502.715903] #PF: error_code(0x0000) - not-present page\n[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\n[  502.717252] Oops: 0000 [#1] SMP\n[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\n[  502.732872] Call Trace:\n[  502.733193]  __blk_add_trace.cold+0x137/0x1a3\n[  502.733734]  blk_add_trace_rq+0x7b/0xd0\n[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0\n[  502.734755]  blk_mq_start_request+0xde/0x1b0\n[  502.735287]  scsi_queue_rq+0x528/0x1140\n...\n[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0\n[  502.747501]  sg_ioctl+0x466/0x1100\n\nReproduce method:\n  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n  ioctl(/dev/sda, BLKTRACESTART)\n  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n  ioctl(/dev/sdb, BLKTRACESTART)\n\n  echo 0 \u003e /sys/block/sdb/trace/enable \u0026\n  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\n\n  ioctl$SG_IO(/dev/sda, SG_IO, ...)\n  // Enters trace_note_tsk() after blk_trace_free() returned\n  // Use mdelay in rcu region rather than msleep(which may schedule out)\n\nRemove blk_trace from running_list before calling blk_trace_free() by\nsysfs if blk_trace is at Blktrace_running state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b7ce0e6-2db4-44ea-b9a9-d350cb26ed11",
      "id": "CVE-2021-47548",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()\n\nThe if statement:\n  if (port \u003e= DSAF_GE_NUM)\n        return;\n\nlimits the value of port less than DSAF_GE_NUM (i.e., 8).\nHowever, if the value of port is 6 or 7, an array overflow could occur:\n  port_rst_off = dsaf_dev-\u003emac_cb[port]-\u003eport_rst_off;\n\nbecause the length of dsaf_dev-\u003emac_cb is DSAF_MAX_PORT_NUM (i.e., 6).\n\nTo fix this possible array overflow, we first check port and if it is\ngreater than or equal to DSAF_MAX_PORT_NUM, the function returns.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c95c709-6d65-4233-827f-eb65ab5e682e",
      "id": "CVE-2021-47632",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/set_memory: Avoid spinlock recursion in change_page_attr()\n\nCommit 1f9ad21c3b38 (\"powerpc/mm: Implement set_memory() routines\")\nincluded a spin_lock() to change_page_attr() in order to\nsafely perform the three step operations. But then\ncommit 9f7853d7609d (\"powerpc/mm: Fix set_memory_*() against\nconcurrent accesses\") modify it to use pte_update() and do\nthe operation safely against concurrent access.\n\nIn the meantime, Maxime reported some spinlock recursion.\n\n[   15.351649] BUG: spinlock recursion on CPU#0, kworker/0:2/217\n[   15.357540]  lock: init_mm+0x3c/0x420, .magic: dead4ead, .owner: kworker/0:2/217, .owner_cpu: 0\n[   15.366563] CPU: 0 PID: 217 Comm: kworker/0:2 Not tainted 5.15.0+ #523\n[   15.373350] Workqueue: events do_free_init\n[   15.377615] Call Trace:\n[   15.380232] [e4105ac0] [800946a4] do_raw_spin_lock+0xf8/0x120 (unreliable)\n[   15.387340] [e4105ae0] [8001f4ec] change_page_attr+0x40/0x1d4\n[   15.393413] [e4105b10] [801424e0] __apply_to_page_range+0x164/0x310\n[   15.400009] [e4105b60] [80169620] free_pcp_prepare+0x1e4/0x4a0\n[   15.406045] [e4105ba0] [8016c5a0] free_unref_page+0x40/0x2b8\n[   15.411979] [e4105be0] [8018724c] kasan_depopulate_vmalloc_pte+0x6c/0x94\n[   15.418989] [e4105c00] [801424e0] __apply_to_page_range+0x164/0x310\n[   15.425451] [e4105c50] [80187834] kasan_release_vmalloc+0xbc/0x134\n[   15.431898] [e4105c70] [8015f7a8] __purge_vmap_area_lazy+0x4e4/0xdd8\n[   15.438560] [e4105d30] [80160d10] _vm_unmap_aliases.part.0+0x17c/0x24c\n[   15.445283] [e4105d60] [801642d0] __vunmap+0x2f0/0x5c8\n[   15.450684] [e4105db0] [800e32d0] do_free_init+0x68/0x94\n[   15.456181] [e4105dd0] [8005d094] process_one_work+0x4bc/0x7b8\n[   15.462283] [e4105e90] [8005d614] worker_thread+0x284/0x6e8\n[   15.468227] [e4105f00] [8006aaec] kthread+0x1f0/0x210\n[   15.473489] [e4105f40] [80017148] ret_from_kernel_thread+0x14/0x1c\n\nRemove the read / modify / write sequence to make the operation atomic\nand remove the spin_lock() in change_page_attr().\n\nTo do the operation atomically, we can't use pte modification helpers\nanymore. Because all platforms have different combination of bits, it\nis not easy to use those bits directly. But all have the\n_PAGE_KERNEL_{RO/ROX/RW/RWX} set of flags. All we need it to compare\ntwo sets to know which bits are set or cleared.\n\nFor instance, by comparing _PAGE_KERNEL_ROX and _PAGE_KERNEL_RO you\nknow which bit gets cleared and which bit get set when changing exec\npermission.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "85e05e16-17ed-40ef-a784-9d9ecebb732d",
      "id": "CVE-2022-1184",
      "description": "A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29f61ae0-415e-4577-abdf-2a9bc9eb6e7c",
      "id": "CVE-2022-28388",
      "description": "usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81f89ec4-d026-47c4-9410-91fc900d7e87",
      "id": "CVE-2022-3202",
      "description": "A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bef5ab42-9987-459b-9e59-f66ed340f00c",
      "id": "CVE-2022-33742",
      "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1737cf8-e28e-4b3a-818e-a6274f008415",
      "id": "CVE-2022-48949",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Initialize mailbox message for VF reset\n\nWhen a MAC address is not assigned to the VF, that portion of the message\nsent to the VF is not set. The memory, however, is allocated from the\nstack meaning that information may be leaked to the VM. Initialize the\nmessage buffer to 0 so that no information is passed to the VM in this\ncase.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49edc8cb-70bd-4676-989b-d77a02112984",
      "id": "CVE-2022-49028",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: Fix resource leak in ixgbevf_init_module()\n\nixgbevf_init_module() won't destroy the workqueue created by\ncreate_singlethread_workqueue() when pci_register_driver() failed. Add\ndestroy_workqueue() in fail path to prevent the resource leak.\n\nSimilar to the handling of u132_hcd_init in commit f276e002793c\n(\"usb: u132-hcd: fix resource leak\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48b23044-4384-4743-b647-37f1ef511a4c",
      "id": "CVE-2022-49196",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Fix use after free in remove_phb_dynamic()\n\nIn remove_phb_dynamic() we use \u0026phb-\u003eio_resource, after we've called\ndevice_unregister(\u0026host_bridge-\u003edev). But the unregister may have freed\nphb, because pcibios_free_controller_deferred() is the release function\nfor the host_bridge.\n\nIf there are no outstanding references when we call device_unregister()\nthen phb will be freed out from under us.\n\nThis has gone mainly unnoticed, but with slub_debug and page_poison\nenabled it can lead to a crash:\n\n  PID: 7574   TASK: c0000000d492cb80  CPU: 13  COMMAND: \"drmgr\"\n   #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc\n   #1 [c0000000e4f075d0] oops_end at c000000000029608\n   #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4\n   #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8\n   #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30\n   Data SLB Access [380] exception frame:\n   R0:  c000000000167250    R1:  c0000000e4f07a00    R2:  c000000002a46100\n   R3:  c000000002b39ce8    R4:  00000000000000c0    R5:  00000000000000a9\n   R6:  3894674d000000c0    R7:  0000000000000000    R8:  00000000000000ff\n   R9:  0000000000000100    R10: 6b6b6b6b6b6b6b6b    R11: 0000000000008000\n   R12: c00000000023da80    R13: c0000009ffd38b00    R14: 0000000000000000\n   R15: 000000011c87f0f0    R16: 0000000000000006    R17: 0000000000000003\n   R18: 0000000000000002    R19: 0000000000000004    R20: 0000000000000005\n   R21: 000000011c87ede8    R22: 000000011c87c5a8    R23: 000000011c87d3a0\n   R24: 0000000000000000    R25: 0000000000000001    R26: c0000000e4f07cc8\n   R27: c00000004d1cc400    R28: c0080000031d00e8    R29: c00000004d23d800\n   R30: c00000004d1d2400    R31: c00000004d1d2540\n   NIP: c000000000167258    MSR: 8000000000009033    OR3: c000000000e9f474\n   CTR: 0000000000000000    LR:  c000000000167250    XER: 0000000020040003\n   CCR: 0000000024088420    MQ:  0000000000000000    DAR: 6b6b6b6b6b6b6ba3\n   DSISR: c0000000e4f07920     Syscall Result: fffffffffffffff2\n   [NIP  : release_resource+56]\n   [LR   : release_resource+48]\n   #5 [c0000000e4f07a00] release_resource at c000000000167258  (unreliable)\n   #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648\n   #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io]\n   #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io]\n   #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c\n  #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504\n  #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868\n  #12 [c0000000e4f07c70] new_sync_write at c00000000054339c\n  #13 [c0000000e4f07d10] vfs_write at c000000000546624\n  #14 [c0000000e4f07d60] ksys_write at c0000000005469f4\n  #15 [c0000000e4f07db0] system_call_exception at c000000000030840\n  #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168\n\nTo avoid it, we can take a reference to the host_bridge-\u003edev until we're\ndone using phb. Then when we drop the reference the phb will be freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc52e6ea-f068-4b04-8f00-de7e89fc3ed2",
      "id": "CVE-2022-49200",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt\n\nFix the following kernel oops in btmtksdio_interrrupt\n\n[   14.339134]  btmtksdio_interrupt+0x28/0x54\n[   14.339139]  process_sdio_pending_irqs+0x68/0x1a0\n[   14.339144]  sdio_irq_work+0x40/0x70\n[   14.339154]  process_one_work+0x184/0x39c\n[   14.339160]  worker_thread+0x228/0x3e8\n[   14.339168]  kthread+0x148/0x3ac\n[   14.339176]  ret_from_fork+0x10/0x30\n\nThat happened because hdev-\u003epower_on is already called before\nsdio_set_drvdata which btmtksdio_interrupt handler relies on is not\nproperly set up.\n\nThe details are shown as the below: hci_register_dev would run\nqueue_work(hdev-\u003ereq_workqueue, \u0026hdev-\u003epower_on) as WQ_HIGHPRI\nworkqueue_struct to complete the power-on sequeunce and thus hci_power_on\nmay run before sdio_set_drvdata is done in btmtksdio_probe.\n\nThe hci_dev_do_open in hci_power_on would initialize the device and enable\nthe interrupt and thus it is possible that btmtksdio_interrupt is being\ncalled right before sdio_set_drvdata is filled out.\n\nWhen btmtksdio_interrupt is being called and sdio_set_drvdata is not filled\n, the kernel oops is going to happen because btmtksdio_interrupt access an\nuninitialized pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db0aceb1-b887-4077-bc5c-f7caef8e9365",
      "id": "CVE-2022-49220",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndax: make sure inodes are flushed before destroy cache\n\nA bug can be triggered by following command\n\n$ modprobe nd_pmem \u0026\u0026 modprobe -r nd_pmem\n\n[   10.060014] BUG dax_cache (Not tainted): Objects remaining in dax_cache on __kmem_cache_shutdown()\n[   10.060938] Slab 0x0000000085b729ac objects=9 used=1 fp=0x000000004f5ae469 flags=0x200000000010200(slab|head|node)\n[   10.062433] Call Trace:\n[   10.062673]  dump_stack_lvl+0x34/0x44\n[   10.062865]  slab_err+0x90/0xd0\n[   10.063619]  __kmem_cache_shutdown+0x13b/0x2f0\n[   10.063848]  kmem_cache_destroy+0x4a/0x110\n[   10.064058]  __x64_sys_delete_module+0x265/0x300\n\nThis is caused by dax_fs_exit() not flushing inodes before destroy cache.\nTo fix this issue, call rcu_barrier() before destroy cache.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b9a79dc-1e7c-4173-bf96-2a1c170da865",
      "id": "CVE-2022-49241",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe\n\nThe device_node pointer is returned by of_parse_phandle()  with refcount\nincremented. We should use of_node_put() on it when done.\n\nThis function only calls of_node_put() in the regular path.\nAnd it will cause refcount leak in error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59330506-4057-41ab-a19a-21e904afdf74",
      "id": "CVE-2022-49516",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: always check VF VSI pointer values\n\nThe ice_get_vf_vsi function can return NULL in some cases, such as if\nhandling messages during a reset where the VSI is being removed and\nrecreated.\n\nSeveral places throughout the driver do not bother to check whether this\nVSI pointer is valid. Static analysis tools maybe report issues because\nthey detect paths where a potentially NULL pointer could be dereferenced.\n\nFix this by checking the return value of ice_get_vf_vsi everywhere.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2371bf88-1018-4170-ba3b-df97c88fde99",
      "id": "CVE-2022-49537",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix call trace observed during I/O with CMF enabled\n\nThe following was seen with CMF enabled:\n\nBUG: using smp_processor_id() in preemptible\ncode: systemd-udevd/31711\nkernel: caller is lpfc_update_cmf_cmd+0x214/0x420  [lpfc]\nkernel: CPU: 12 PID: 31711 Comm: systemd-udevd\nkernel: Call Trace:\nkernel: \u003cTASK\u003e\nkernel: dump_stack_lvl+0x44/0x57\nkernel: check_preemption_disabled+0xbf/0xe0\nkernel: lpfc_update_cmf_cmd+0x214/0x420 [lpfc]\nkernel: lpfc_nvme_fcp_io_submit+0x23b4/0x4df0 [lpfc]\n\nthis_cpu_ptr() calls smp_processor_id() in a preemptible context.\n\nFix by using per_cpu_ptr() with raw_smp_processor_id() instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc68cff0-e6e4-4859-a4e8-7975ac5f05ed",
      "id": "CVE-2022-49579",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix data-races around sysctl_fib_multipath_hash_policy.\n\nWhile reading sysctl_fib_multipath_hash_policy, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af010592-5676-4858-8b08-25c26818f13a",
      "id": "CVE-2022-49645",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix shrinker list corruption by madvise IOCTL\n\nCalling madvise IOCTL twice on BO causes memory shrinker list corruption\nand crashes kernel because BO is already on the list and it's added to\nthe list again, while BO should be removed from the list before it's\nre-added. Fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cc4d12e-bb55-472e-b49a-1c3f3cdabd6f",
      "id": "CVE-2022-49738",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on i_extra_isize in is_alive()\n\nsyzbot found a f2fs bug:\n\nBUG: KASAN: slab-out-of-bounds in data_blkaddr fs/f2fs/f2fs.h:2891 [inline]\nBUG: KASAN: slab-out-of-bounds in is_alive fs/f2fs/gc.c:1117 [inline]\nBUG: KASAN: slab-out-of-bounds in gc_data_segment fs/f2fs/gc.c:1520 [inline]\nBUG: KASAN: slab-out-of-bounds in do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734\nRead of size 4 at addr ffff888076557568 by task kworker/u4:3/52\n\nCPU: 1 PID: 52 Comm: kworker/u4:3 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nWorkqueue: writeback wb_workfn (flush-7:0)\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\nprint_address_description mm/kasan/report.c:284 [inline]\nprint_report+0x15e/0x45d mm/kasan/report.c:395\nkasan_report+0xbb/0x1f0 mm/kasan/report.c:495\ndata_blkaddr fs/f2fs/f2fs.h:2891 [inline]\nis_alive fs/f2fs/gc.c:1117 [inline]\ngc_data_segment fs/f2fs/gc.c:1520 [inline]\ndo_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734\nf2fs_gc+0x88c/0x20a0 fs/f2fs/gc.c:1831\nf2fs_balance_fs+0x544/0x6b0 fs/f2fs/segment.c:410\nf2fs_write_inode+0x57e/0xe20 fs/f2fs/inode.c:753\nwrite_inode fs/fs-writeback.c:1440 [inline]\n__writeback_single_inode+0xcfc/0x1440 fs/fs-writeback.c:1652\nwriteback_sb_inodes+0x54d/0xf90 fs/fs-writeback.c:1870\nwb_writeback+0x2c5/0xd70 fs/fs-writeback.c:2044\nwb_do_writeback fs/fs-writeback.c:2187 [inline]\nwb_workfn+0x2dc/0x12f0 fs/fs-writeback.c:2227\nprocess_one_work+0x9bf/0x1710 kernel/workqueue.c:2289\nworker_thread+0x665/0x1080 kernel/workqueue.c:2436\nkthread+0x2e4/0x3a0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nThe root cause is that we forgot to do sanity check on .i_extra_isize\nin below path, result in accessing invalid address later, fix it.\n- gc_data_segment\n - is_alive\n  - data_blkaddr\n   - offset_in_addr",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f740884-c033-4802-95d0-84297398a0b8",
      "id": "CVE-2022-49762",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: check overflow when iterating ATTR_RECORDs\n\nKernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). \nBecause the ATTR_RECORDs are next to each other, kernel can get the next\nATTR_RECORD from end address of current ATTR_RECORD, through current\nATTR_RECORD length field.\n\nThe problem is that during iteration, when kernel calculates the end\naddress of current ATTR_RECORD, kernel may trigger an integer overflow bug\nin executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a-\u003elength))`.  This\nmay wrap, leading to a forever iteration on 32bit systems.\n\nThis patch solves it by adding some checks on calculating end address\nof current ATTR_RECORD during iteration.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06fc7e61-35e3-4b0f-bb48-609c36f78d3e",
      "id": "CVE-2022-49879",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix BUG_ON() when directory entry has invalid rec_len\n\nThe rec_len field in the directory entry has to be a multiple of 4.  A\ncorrupted filesystem image can be used to hit a BUG() in\next4_rec_len_to_disk(), called from make_indexed_dir().\n\n ------------[ cut here ]------------\n kernel BUG at fs/ext4/ext4.h:2413!\n ...\n RIP: 0010:make_indexed_dir+0x53f/0x5f0\n ...\n Call Trace:\n  \u003cTASK\u003e\n  ? add_dirent_to_buf+0x1b2/0x200\n  ext4_add_entry+0x36e/0x480\n  ext4_add_nondir+0x2b/0xc0\n  ext4_create+0x163/0x200\n  path_openat+0x635/0xe90\n  do_filp_open+0xb4/0x160\n  ? __create_object.isra.0+0x1de/0x3b0\n  ? _raw_spin_unlock+0x12/0x30\n  do_sys_openat2+0x91/0x150\n  __x64_sys_open+0x6c/0xa0\n  do_syscall_64+0x3c/0x80\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe fix simply adds a call to ext4_check_dir_entry() to validate the\ndirectory entry, returning -EFSCORRUPTED if the entry is invalid.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ecd410e-62fa-49f9-928d-7fb8e86a383d",
      "id": "CVE-2022-49899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfscrypt: stop using keyrings subsystem for fscrypt_master_key\n\nThe approach of fs/crypto/ internally managing the fscrypt_master_key\nstructs as the payloads of \"struct key\" objects contained in a\n\"struct key\" keyring has outlived its usefulness.  The original idea was\nto simplify the code by reusing code from the keyrings subsystem.\nHowever, several issues have arisen that can't easily be resolved:\n\n- When a master key struct is destroyed, blk_crypto_evict_key() must be\n  called on any per-mode keys embedded in it.  (This started being the\n  case when inline encryption support was added.)  Yet, the keyrings\n  subsystem can arbitrarily delay the destruction of keys, even past the\n  time the filesystem was unmounted.  Therefore, currently there is no\n  easy way to call blk_crypto_evict_key() when a master key is\n  destroyed.  Currently, this is worked around by holding an extra\n  reference to the filesystem's request_queue(s).  But it was overlooked\n  that the request_queue reference is *not* guaranteed to pin the\n  corresponding blk_crypto_profile too; for device-mapper devices that\n  support inline crypto, it doesn't.  This can cause a use-after-free.\n\n- When the last inode that was using an incompletely-removed master key\n  is evicted, the master key removal is completed by removing the key\n  struct from the keyring.  Currently this is done via key_invalidate().\n  Yet, key_invalidate() takes the key semaphore.  This can deadlock when\n  called from the shrinker, since in fscrypt_ioctl_add_key(), memory is\n  allocated with GFP_KERNEL under the same semaphore.\n\n- More generally, the fact that the keyrings subsystem can arbitrarily\n  delay the destruction of keys (via garbage collection delay, or via\n  random processes getting temporary key references) is undesirable, as\n  it means we can't strictly guarantee that all secrets are ever wiped.\n\n- Doing the master key lookups via the keyrings subsystem results in the\n  key_permission LSM hook being called.  fscrypt doesn't want this, as\n  all access control for encrypted files is designed to happen via the\n  files themselves, like any other files.  The workaround which SELinux\n  users are using is to change their SELinux policy to grant key search\n  access to all domains.  This works, but it is an odd extra step that\n  shouldn't really have to be done.\n\nThe fix for all these issues is to change the implementation to what I\nshould have done originally: don't use the keyrings subsystem to keep\ntrack of the filesystem's fscrypt_master_key structs.  Instead, just\nstore them in a regular kernel data structure, and rework the reference\ncounting, locking, and lifetime accordingly.  Retain support for\nRCU-mode key lookups by using a hash table.  Replace fscrypt_sb_free()\nwith fscrypt_sb_delete(), which releases the keys synchronously and runs\na bit earlier during unmount, so that block devices are still available.\n\nA side effect of this patch is that neither the master keys themselves\nnor the filesystem keyrings will be listed in /proc/keys anymore.\n(\"Master key users\" and the master key users keyrings will still be\nlisted.)  However, this was mostly an implementation detail, and it was\nintended just for debugging purposes.  I don't know of anyone using it.\n\nThis patch does *not* change how \"master key users\" (-\u003emk_users) works;\nthat still uses the keyrings subsystem.  That is still needed for key\nquotas, and changing that isn't necessary to solve the issues listed\nabove.  If we decide to change that too, it would be a separate patch.\n\nI've marked this as fixing the original commit that added the fscrypt\nkeyring, but as noted above the most important issue that this patch\nfixes wasn't introduced until the addition of inline encryption support.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2912f6ed-a8ce-4e5d-a5b7-4ac02229cfd7",
      "id": "CVE-2022-49918",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix WARNING in __ip_vs_cleanup_batch()\n\nDuring the initialization of ip_vs_conn_net_init(), if file ip_vs_conn\nor ip_vs_conn_sync fails to be created, the initialization is successful\nby default. Therefore, the ip_vs_conn or ip_vs_conn_sync file doesn't\nbe found during the remove.\n\nThe following is the stack information:\nname 'ip_vs_conn_sync'\nWARNING: CPU: 3 PID: 9 at fs/proc/generic.c:712\nremove_proc_entry+0x389/0x460\nModules linked in:\nWorkqueue: netns cleanup_net\nRIP: 0010:remove_proc_entry+0x389/0x460\nCall Trace:\n\u003cTASK\u003e\n__ip_vs_cleanup_batch+0x7d/0x120\nops_exit_list+0x125/0x170\ncleanup_net+0x4ea/0xb00\nprocess_one_work+0x9bf/0x1710\nworker_thread+0x665/0x1080\nkthread+0x2e4/0x3a0\nret_from_fork+0x1f/0x30\n\u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9478485f-570d-4d84-8802-8ddf152ec09f",
      "id": "CVE-2022-50032",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas: Fix refcount leak bug\n\nIn usbhs_rza1_hardware_init(), of_find_node_by_name() will return\na node pointer with refcount incremented. We should use of_node_put()\nwhen it is not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92cbc53b-259a-4505-9007-8c705528e453",
      "id": "CVE-2022-50402",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/md/md-bitmap: check the return value of md_bitmap_get_counter()\n\nCheck the return value of md_bitmap_get_counter() in case it returns\nNULL pointer, which will result in a null pointer dereference.\n\nv2: update the check to include other dereference",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d200aa7e-f537-480f-aeea-fd144e034c59",
      "id": "CVE-2022-50094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspmi: trace: fix stack-out-of-bound access in SPMI tracing functions\n\ntrace_spmi_write_begin() and trace_spmi_read_end() both call\nmemcpy() with a length of \"len + 1\".  This leads to one extra\nbyte being read beyond the end of the specified buffer.  Fix\nthis out-of-bound memory access by using a length of \"len\"\ninstead.\n\nHere is a KASAN log showing the issue:\n\nBUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234\nRead of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314\n...\nCall trace:\n dump_backtrace+0x0/0x3e8\n show_stack+0x2c/0x3c\n dump_stack_lvl+0xdc/0x11c\n print_address_description+0x74/0x384\n kasan_report+0x188/0x268\n kasan_check_range+0x270/0x2b0\n memcpy+0x90/0xe8\n trace_event_raw_event_spmi_read_end+0x1d0/0x234\n spmi_read_cmd+0x294/0x3ac\n spmi_ext_register_readl+0x84/0x9c\n regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi]\n _regmap_raw_read+0x40c/0x754\n regmap_raw_read+0x3a0/0x514\n regmap_bulk_read+0x418/0x494\n adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3]\n ...\n __arm64_sys_read+0x4c/0x60\n invoke_syscall+0x80/0x218\n el0_svc_common+0xec/0x1c8\n ...\n\naddr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame:\n adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3]\n\nthis frame has 1 object:\n [32, 33) 'status'\n\nMemory state around the buggy address:\n ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1\n ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n\u003effffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00\n                                           ^\n ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00\n==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "685e5e31-9901-4159-8e40-a315a20fca0f",
      "id": "CVE-2022-50102",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()\n\nSince the user can control the arguments of the ioctl() from the user\nspace, under special arguments that may result in a divide-by-zero bug\nin:\n  drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info-\u003evar.pixclock) / hmul);\nwith hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0.\nand then in:\n  drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par-\u003edac, 0, 1000000000 / pixclock);\nwe'll get a division-by-zero.\n\nThe following log can reveal it:\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nRIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline]\nRIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784\nCall Trace:\n fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034\n do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110\n fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189\n\nFix this by checking the argument of ark_set_pixclock() first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a322b63e-9fba-41ba-848b-72b1894505c7",
      "id": "CVE-2022-50209",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmeson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73bde2d0-4d11-43fb-a9ed-d487817c3fb6",
      "id": "CVE-2022-50274",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: adopts refcnt to avoid UAF\n\ndvb_unregister_device() is known that prone to use-after-free.\nThat is, the cleanup from dvb_unregister_device() releases the dvb_device\neven if there are pointers stored in file-\u003eprivate_data still refer to it.\n\nThis patch adds a reference counter into struct dvb_device and delays its\ndeallocation until no pointer refers to the object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a8fdbd9-395b-4fea-9ce4-ef82d65e8511",
      "id": "CVE-2022-50341",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix oops during encryption\n\nWhen running xfstests against Azure the following oops occurred on an\narm64 system\n\n  Unable to handle kernel write to read-only memory at virtual address\n  ffff0001221cf000\n  Mem abort info:\n    ESR = 0x9600004f\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x0f: level 3 permission fault\n  Data abort info:\n    ISV = 0, ISS = 0x0000004f\n    CM = 0, WnR = 1\n  swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000\n  [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003,\n  pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787\n  Internal error: Oops: 9600004f [#1] PREEMPT SMP\n  ...\n  pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)\n  pc : __memcpy+0x40/0x230\n  lr : scatterwalk_copychunks+0xe0/0x200\n  sp : ffff800014e92de0\n  x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008\n  x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008\n  x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000\n  x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014\n  x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058\n  x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590\n  x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580\n  x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005\n  x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001\n  x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000\n  Call trace:\n   __memcpy+0x40/0x230\n   scatterwalk_map_and_copy+0x98/0x100\n   crypto_ccm_encrypt+0x150/0x180\n   crypto_aead_encrypt+0x2c/0x40\n   crypt_message+0x750/0x880\n   smb3_init_transform_rq+0x298/0x340\n   smb_send_rqst.part.11+0xd8/0x180\n   smb_send_rqst+0x3c/0x100\n   compound_send_recv+0x534/0xbc0\n   smb2_query_info_compound+0x32c/0x440\n   smb2_set_ea+0x438/0x4c0\n   cifs_xattr_set+0x5d4/0x7c0\n\nThis is because in scatterwalk_copychunks(), we attempted to write to\na buffer (@sign) that was allocated in the stack (vmalloc area) by\ncrypt_message() and thus accessing its remaining 8 (x2) bytes ended up\ncrossing a page boundary.\n\nTo simply fix it, we could just pass @sign kmalloc'd from\ncrypt_message() and then we're done.  Luckily, we don't seem to pass\nany other vmalloc'd buffers in smb_rqst::rq_iov...\n\nInstead, let's map the correct pages and offsets from vmalloc buffers\nas well in cifs_sg_set_buf() and then avoiding such oopses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5905938f-5567-4ef6-97e8-7906c825c066",
      "id": "CVE-2022-50349",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: tifm: fix possible memory leak in tifm_7xx1_switch_media()\n\nIf device_register() returns error in tifm_7xx1_switch_media(),\nname of kobject which is allocated in dev_set_name() called in device_add()\nis leaked.\n\nNever directly free @dev after calling device_register(), even\nif it returned an error! Always use put_device() to give up the\nreference initialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29b5a0b8-406f-4906-9ca7-ce0161f52948",
      "id": "CVE-2023-1078",
      "description": "A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bbfc573-7215-4c98-879c-6802ad3c2f45",
      "id": "CVE-2023-2177",
      "description": "A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b21cd202-21cc-4d45-bdaf-a246904b478b",
      "id": "CVE-2023-26607",
      "description": "In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f426666-fb5a-4868-9044-0aea5868269b",
      "id": "CVE-2023-46343",
      "description": "In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81e39f60-8ff1-4a63-9fe1-5fe04dcba88a",
      "id": "CVE-2023-53032",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.\n\nWhen first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of\nan arithmetic expression 2 \u003c\u003c (netmask - mask_bits - 1) is subject\nto overflow due to a failure casting operands to a larger data type\nbefore performing the arithmetic.\n\nNote that it's harmless since the value will be checked at the next step.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1267f73-3efc-4224-9a1e-94b24754085f",
      "id": "CVE-2023-52515",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66fa421e-1c69-4294-9a30-a4e2ab644e08",
      "id": "CVE-2023-52700",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix kernel warning when sending SYN message\n\nWhen sending a SYN message, this kernel stack trace is observed:\n\n...\n[   13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550\n...\n[   13.398494] Call Trace:\n[   13.398630]  \u003cTASK\u003e\n[   13.398630]  ? __alloc_skb+0xed/0x1a0\n[   13.398630]  tipc_msg_build+0x12c/0x670 [tipc]\n[   13.398630]  ? shmem_add_to_page_cache.isra.71+0x151/0x290\n[   13.398630]  __tipc_sendmsg+0x2d1/0x710 [tipc]\n[   13.398630]  ? tipc_connect+0x1d9/0x230 [tipc]\n[   13.398630]  ? __local_bh_enable_ip+0x37/0x80\n[   13.398630]  tipc_connect+0x1d9/0x230 [tipc]\n[   13.398630]  ? __sys_connect+0x9f/0xd0\n[   13.398630]  __sys_connect+0x9f/0xd0\n[   13.398630]  ? preempt_count_add+0x4d/0xa0\n[   13.398630]  ? fpregs_assert_state_consistent+0x22/0x50\n[   13.398630]  __x64_sys_connect+0x16/0x20\n[   13.398630]  do_syscall_64+0x42/0x90\n[   13.398630]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIt is because commit a41dad905e5a (\"iov_iter: saner checks for attempt\nto copy to/from iterator\") has introduced sanity check for copying\nfrom/to iov iterator. Lacking of copy direction from the iterator\nviewpoint would lead to kernel stack trace like above.\n\nThis commit fixes this issue by initializing the iov iterator with\nthe correct copy direction when sending SYN or ACK without data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ccb6a140-ca35-44e7-8261-9d0358b4758a",
      "id": "CVE-2023-52735",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself\n\nsock_map proto callbacks should never call themselves by design. Protect\nagainst bugs like [1] and break out of the recursive loop to avoid a stack\noverflow in favor of a resource leak.\n\n[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac0d43d2-b1a5-4e95-ae6a-f1bb4dfde205",
      "id": "CVE-2023-52736",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Do not unset preset when cleaning up codec\n\nSeveral functions that take part in codec's initialization and removal\nare re-used by ASoC codec drivers implementations. Drivers mimic the\nbehavior of hda_codec_driver_probe/remove() found in\nsound/pci/hda/hda_bind.c with their component-\u003eprobe/remove() instead.\n\nOne of the reasons for that is the expectation of\nsnd_hda_codec_device_new() to receive a valid pointer to an instance of\nstruct snd_card. This expectation can be met only once sound card\ncomponents probing commences.\n\nAs ASoC sound card may be unbound without codec device being actually\nremoved from the system, unsetting -\u003epreset in\nsnd_hda_codec_cleanup_for_unbind() interferes with module unload -\u003e load\nscenario causing null-ptr-deref. Preset is assigned only once, during\ndevice/driver matching whereas ASoC codec driver's module reloading may\noccur several times throughout the lifetime of an audio stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d985465-47f9-4bff-b40c-7b6b3a65166c",
      "id": "CVE-2023-52834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natl1c: Work around the DMA RX overflow issue\n\nThis is based on alx driver commit 881d0327db37 (\"net: alx: Work around\nthe DMA RX overflow issue\").\n\nThe alx and atl1c drivers had RX overflow error which was why a custom\nallocator was created to avoid certain addresses. The simpler workaround\nthen created for alx driver, but not for atl1c due to lack of tester.\n\nInstead of using a custom allocator, check the allocated skb address and\nuse skb_reserve() to move away from problematic 0x...fc0 address.\n\nTested on AR8131 on Acer 4540.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "362a7898-65c5-49bd-ad74-607d1bcf60f6",
      "id": "CVE-2023-52868",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: prevent potential string overflow\n\nThe dev-\u003eid value comes from ida_alloc() so it's a number between zero\nand INT_MAX.  If it's too high then these sprintf()s will overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fca6ce2f-39c3-4db9-8729-36da75696b41",
      "id": "CVE-2024-42078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialise nfsd_info.mutex early.\n\nnfsd_info.mutex can be dereferenced by svc_pool_stats_start()\nimmediately after the new netns is created.  Currently this can\ntrigger an oops.\n\nMove the initialisation earlier before it can possibly be dereferenced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86be05b1-4254-420c-b49f-917cbcdbc661",
      "id": "CVE-2023-53125",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: smsc75xx: Limit packet length to skb-\u003elen\n\nPacket length retrieved from skb data may be larger than\nthe actual socket buffer length (up to 9026 bytes). In such\ncase the cloned skb passed up the network stack will leak\nkernel memory contents.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f2a74c9-3a4e-418a-801c-73a991bbb946",
      "id": "CVE-2023-53215",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/fair: Don't balance task to its current running CPU\n\nWe've run into the case that the balancer tries to balance a migration\ndisabled task and trigger the warning in set_task_cpu() like below:\n\n ------------[ cut here ]------------\n WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240\n Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 \u003c...snip\u003e\n CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G           O       6.1.0-rc4+ #1\n Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021\n pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : set_task_cpu+0x188/0x240\n lr : load_balance+0x5d0/0xc60\n sp : ffff80000803bc70\n x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040\n x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001\n x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78\n x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000\n x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000\n x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530\n x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e\n x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a\n x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001\n Call trace:\n  set_task_cpu+0x188/0x240\n  load_balance+0x5d0/0xc60\n  rebalance_domains+0x26c/0x380\n  _nohz_idle_balance.isra.0+0x1e0/0x370\n  run_rebalance_domains+0x6c/0x80\n  __do_softirq+0x128/0x3d8\n  ____do_softirq+0x18/0x24\n  call_on_irq_stack+0x2c/0x38\n  do_softirq_own_stack+0x24/0x3c\n  __irq_exit_rcu+0xcc/0xf4\n  irq_exit_rcu+0x18/0x24\n  el1_interrupt+0x4c/0xe4\n  el1h_64_irq_handler+0x18/0x2c\n  el1h_64_irq+0x74/0x78\n  arch_cpu_idle+0x18/0x4c\n  default_idle_call+0x58/0x194\n  do_idle+0x244/0x2b0\n  cpu_startup_entry+0x30/0x3c\n  secondary_start_kernel+0x14c/0x190\n  __secondary_switched+0xb0/0xb4\n ---[ end trace 0000000000000000 ]---\n\nFurther investigation shows that the warning is superfluous, the migration\ndisabled task is just going to be migrated to its current running CPU.\nThis is because that on load balance if the dst_cpu is not allowed by the\ntask, we'll re-select a new_dst_cpu as a candidate. If no task can be\nbalanced to dst_cpu we'll try to balance the task to the new_dst_cpu\ninstead. In this case when the migration disabled task is not on CPU it\nonly allows to run on its current CPU, load balance will select its\ncurrent CPU as new_dst_cpu and later triggers the warning above.\n\nThe new_dst_cpu is chosen from the env-\u003edst_grpmask. Currently it\ncontains CPUs in sched_group_span() and if we have overlapped groups it's\npossible to run into this case. This patch makes env-\u003edst_grpmask of\ngroup_balance_mask() which exclude any CPUs from the busiest group and\nsolve the issue. For balancing in a domain with no overlapped groups\nthe behaviour keeps same as before.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ace7728-7fbf-4f29-93c2-598d6cb6e29b",
      "id": "CVE-2023-53222",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: jfs_dmap: Validate db_l2nbperpage while mounting\n\nIn jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block\nnumber inside dbFree(). db_l2nbperpage, which is the log2 number of\nblocks per page, is passed as an argument to BLKTODMAP which uses it\nfor shifting.\n\nSyzbot reported a shift out-of-bounds crash because db_l2nbperpage is\ntoo big. This happens because the large value is set without any\nvalidation in dbMount() at line 181.\n\nThus, make sure that db_l2nbperpage is correct while mounting.\n\nMax number of blocks per page = Page size / Min block size\n=\u003e log2(Max num_block per page) = log2(Page size / Min block size)\n\t\t\t\t= log2(Page size) - log2(Min block size)\n\n=\u003e Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1e70e0b-2c22-4ea3-b902-b8971f2b6ff2",
      "id": "CVE-2023-53245",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Fix handling of virtual Fibre Channel timeouts\n\nHyper-V provides the ability to connect Fibre Channel LUNs to the host\nsystem and present them in a guest VM as a SCSI device. I/O to the vFC\ndevice is handled by the storvsc driver. The storvsc driver includes a\npartial integration with the FC transport implemented in the generic\nportion of the Linux SCSI subsystem so that FC attributes can be displayed\nin /sys.  However, the partial integration means that some aspects of vFC\ndon't work properly. Unfortunately, a full and correct integration isn't\npractical because of limitations in what Hyper-V provides to the guest.\n\nIn particular, in the context of Hyper-V storvsc, the FC transport timeout\nfunction fc_eh_timed_out() causes a kernel panic because it can't find the\nrport and dereferences a NULL pointer. The original patch that added the\ncall from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this\nregard.\n\nIn many cases a timeout is due to a transient condition, so the situation\ncan be improved by just continuing to wait like with other I/O requests\nissued by storvsc, and avoiding the guaranteed panic. For a permanent\nfailure, continuing to wait may result in a hung thread instead of a panic,\nwhich again may be better.\n\nSo fix the panic by removing the storvsc call to fc_eh_timed_out().  This\nallows storvsc to keep waiting for a response.  The change has been tested\nby users who experienced a panic in fc_eh_timed_out() due to transient\ntimeouts, and it solves their problem.\n\nIn the future we may want to deprecate the vFC functionality in storvsc\nsince it can't be fully fixed. But it has current users for whom it is\nworking well enough, so it should probably stay for a while longer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09622551-1670-4e3f-b057-a704e75c964d",
      "id": "CVE-2023-53270",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix i_disksize exceeding i_size problem in paritally written case\n\nIt is possible for i_disksize can exceed i_size, triggering a warning.\n\ngeneric_perform_write\n copied = iov_iter_copy_from_user_atomic(len) // copied \u003c len\n ext4_da_write_end\n | ext4_update_i_disksize\n |  new_i_size = pos + copied;\n |  WRITE_ONCE(EXT4_I(inode)-\u003ei_disksize, newsize) // update i_disksize\n | generic_write_end\n |  copied = block_write_end(copied, len) // copied = 0\n |   if (unlikely(copied \u003c len))\n |    if (!PageUptodate(page))\n |     copied = 0;\n |  if (pos + copied \u003e inode-\u003ei_size) // return false\n if (unlikely(copied == 0))\n  goto again;\n if (unlikely(iov_iter_fault_in_readable(i, bytes))) {\n  status = -EFAULT;\n  break;\n }\n\nWe get i_disksize greater than i_size here, which could trigger WARNING\ncheck 'i_size_read(inode) \u003c EXT4_I(inode)-\u003ei_disksize' while doing dio:\n\next4_dio_write_iter\n iomap_dio_rw\n  __iomap_dio_rw // return err, length is not aligned to 512\n ext4_handle_inode_extension\n  WARN_ON_ONCE(i_size_read(inode) \u003c EXT4_I(inode)-\u003ei_disksize) // Oops\n\n WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319\n CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2\n RIP: 0010:ext4_file_write_iter+0xbc7\n Call Trace:\n  vfs_write+0x3b1\n  ksys_write+0x77\n  do_syscall_64+0x39\n\nFix it by updating 'copied' value before updating i_disksize just like\next4_write_inline_data_end() does.\n\nA reproducer can be found in the buganizer link below.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a83278df-56c3-4725-be21-71669e0b8afb",
      "id": "CVE-2023-53271",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()\n\nThere is a memory leaks problem reported by kmemleak:\n\nunreferenced object 0xffff888102007a00 (size 128):\n  comm \"ubirsvol\", pid 32090, jiffies 4298464136 (age 2361.231s)\n  hex dump (first 32 bytes):\nff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................\nff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................\n  backtrace:\n[\u003cffffffff8176cecd\u003e] __kmalloc+0x4d/0x150\n[\u003cffffffffa02a9a36\u003e] ubi_eba_create_table+0x76/0x170 [ubi]\n[\u003cffffffffa029764e\u003e] ubi_resize_volume+0x1be/0xbc0 [ubi]\n[\u003cffffffffa02a3321\u003e] ubi_cdev_ioctl+0x701/0x1850 [ubi]\n[\u003cffffffff81975d2d\u003e] __x64_sys_ioctl+0x11d/0x170\n[\u003cffffffff83c142a5\u003e] do_syscall_64+0x35/0x80\n[\u003cffffffff83e0006a\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis is due to a mismatch between create and destroy interfaces, and\nin detail that \"new_eba_tbl\" created by ubi_eba_create_table() but\ndestroyed by kfree(), while will causing \"new_eba_tbl-\u003eentries\" not\nfreed.\n\nFix it by replacing kfree(new_eba_tbl) with\nubi_eba_destroy_table(new_eba_tbl)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96aed0b2-c140-4f63-9083-c350738924f7",
      "id": "CVE-2024-26758",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Don't ignore suspended array in md_check_recovery()\n\nmddev_suspend() never stop sync_thread, hence it doesn't make sense to\nignore suspended array in md_check_recovery(), which might cause\nsync_thread can't be unregistered.\n\nAfter commit f52f5c71f3d4 (\"md: fix stopping sync thread\"), following\nhang can be triggered by test shell/integrity-caching.sh:\n\n1) suspend the array:\nraid_postsuspend\n mddev_suspend\n\n2) stop the array:\nraid_dtr\n md_stop\n  __md_stop_writes\n   stop_sync_thread\n    set_bit(MD_RECOVERY_INTR, \u0026mddev-\u003erecovery);\n    md_wakeup_thread_directly(mddev-\u003esync_thread);\n    wait_event(..., !test_bit(MD_RECOVERY_RUNNING, \u0026mddev-\u003erecovery))\n\n3) sync thread done:\nmd_do_sync\n set_bit(MD_RECOVERY_DONE, \u0026mddev-\u003erecovery);\n md_wakeup_thread(mddev-\u003ethread);\n\n4) daemon thread can't unregister sync thread:\nmd_check_recovery\n if (mddev-\u003esuspended)\n   return; -\u003e return directly\n md_read_sync_thread\n clear_bit(MD_RECOVERY_RUNNING, \u0026mddev-\u003erecovery);\n -\u003e MD_RECOVERY_RUNNING can't be cleared, hence step 2 hang;\n\nThis problem is not just related to dm-raid, fix it by ignoring\nsuspended array in md_check_recovery(). And follow up patches will\nimprove dm-raid better to frozen sync thread during suspend.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7dc0672-2753-4ae2-9867-ec374805434b",
      "id": "CVE-2024-26801",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Avoid potential use-after-free in hci_error_reset\n\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\n\nHere's the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u003cHASH:3b4a6\u003e]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u003cHASH:3b4a 6\u003e]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u003cHASH:3b4a 6\u003e]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\n\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09d0a177-3c05-4f82-b3e7-ca9ef77e3153",
      "id": "CVE-2024-26945",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: iaa - Fix nr_cpus \u003c nr_iaa case\n\nIf nr_cpus \u003c nr_iaa, the calculated cpus_per_iaa will be 0, which\ncauses a divide-by-0 in rebalance_wq_table().\n\nMake sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0\ncase, even though cpus_per_iaa is never used if nr_iaa == 0, for\nparanoia.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83915419-9bbe-4445-8726-2dacc8d6953d",
      "id": "CVE-2024-38552",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential index out of bounds in color transformation function\n\nFixes index out of bounds issue in the color transformation function.\nThe issue could occur when the index 'i' exceeds the number of transfer\nfunction points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, an error message is\nlogged and the function returns false to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.red' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.green' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.blue' 1025 \u003c= s32max",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7efb021-b727-411a-9383-aef17e0b0176",
      "id": "CVE-2024-40968",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: Octeon: Add PCIe link status check\n\nThe standard PCIe configuration read-write interface is used to\naccess the configuration space of the peripheral PCIe devices\nof the mips processor after the PCIe link surprise down, it can\ngenerate kernel panic caused by \"Data bus error\". So it is\nnecessary to add PCIe link status check for system protection.\nWhen the PCIe link is down or in training, assigning a value\nof 0 to the configuration address can prevent read-write behavior\nto the configuration space of peripheral PCIe devices, thereby\npreventing kernel panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26e1ba0e-ef6c-46bd-8c8f-492b9ebdbe74",
      "id": "CVE-2021-34693",
      "description": "net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4fa61a2d-29cc-44e6-ab15-ff19253e9b3f",
      "id": "CVE-2024-41007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: avoid too many retransmit packets\n\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\nretracted its window to zero, tcp_retransmit_timer() can\nretransmit a packet every two jiffies (2 ms for HZ=1000),\nfor about 4 minutes after TCP_USER_TIMEOUT has 'expired'.\n\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\nicsk-\u003eicsk_user_timeout into account.\n\nBefore blamed commit, the socket would not timeout after\nicsk-\u003eicsk_user_timeout, but would use standard exponential\nbackoff for the retransmits.\n\nAlso worth noting that before commit e89688e3e978 (\"net: tcp:\nfix unexcepted socket die when snd_wnd is 0\"), the issue\nwould last 2 minutes instead of 4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03dc661a-620d-43f5-9ed5-df3cbccef9ab",
      "id": "CVE-2024-41015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: add bounds checking to ocfs2_check_dir_entry()\n\nThis adds sanity checks for ocfs2_dir_entry to make sure all members of\nocfs2_dir_entry don't stray beyond valid memory region.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4718e8b8-3b7a-4b25-b920-d695fdd14b2a",
      "id": "CVE-2024-41066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Add tx check to prevent skb leak\n\nBelow is a summary of how the driver stores a reference to an skb during\ntransmit:\n    tx_buff[free_map[consumer_index]]-\u003eskb = new_skb;\n    free_map[consumer_index] = IBMVNIC_INVALID_MAP;\n    consumer_index ++;\nWhere variable data looks like this:\n    free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3]\n                                               \tconsumer_index^\n    tx_buff == [skb=null, skb=\u003cptr\u003e, skb=\u003cptr\u003e, skb=null, skb=null]\n\nThe driver has checks to ensure that free_map[consumer_index] pointed to\na valid index but there was no check to ensure that this index pointed\nto an unused/null skb address. So, if, by some chance, our free_map and\ntx_buff lists become out of sync then we were previously risking an\nskb memory leak. This could then cause tcp congestion control to stop\nsending packets, eventually leading to ETIMEDOUT.\n\nTherefore, add a conditional to ensure that the skb address is null. If\nnot then warn the user (because this is still a bug that should be\npatched) and free the old pointer to prevent memleak/tcp problems.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c2976a4-ace3-4bd9-a17a-1311a5d0050a",
      "id": "CVE-2024-42096",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86: stop playing stack games in profile_pc()\n\nThe 'profile_pc()' function is used for timer-based profiling, which\nisn't really all that relevant any more to begin with, but it also ends\nup making assumptions based on the stack layout that aren't necessarily\nvalid.\n\nBasically, the code tries to account the time spent in spinlocks to the\ncaller rather than the spinlock, and while I support that as a concept,\nit's not worth the code complexity or the KASAN warnings when no serious\nprofiling is done using timers anyway these days.\n\nAnd the code really does depend on stack layout that is only true in the\nsimplest of cases.  We've lost the comment at some point (I think when\nthe 32-bit and 64-bit code was unified), but it used to say:\n\n\tAssume the lock function has either no stack frame or a copy\n\tof eflags from PUSHF.\n\nwhich explains why it just blindly loads a word or two straight off the\nstack pointer and then takes a minimal look at the values to just check\nif they might be eflags or the return pc:\n\n\tEflags always has bits 22 and up cleared unlike kernel addresses\n\nbut that basic stack layout assumption assumes that there isn't any lock\ndebugging etc going on that would complicate the code and cause a stack\nframe.\n\nIt causes KASAN unhappiness reported for years by syzkaller [1] and\nothers [2].\n\nWith no real practical reason for this any more, just remove the code.\n\nJust for historical interest, here's some background commits relating to\nthis code from 2006:\n\n  0cb91a229364 (\"i386: Account spinlocks to the caller during profiling for !FP kernels\")\n  31679f38d886 (\"Simplify profile_pc on x86-64\")\n\nand a code unification from 2009:\n\n  ef4512882dbe (\"x86: time_32/64.c unify profile_pc\")\n\nbut the basics of this thing actually goes back to before the git tree.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ba0d873-393f-42d2-8428-0ef92058186c",
      "id": "CVE-2024-42105",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix inode number range checks\n\nPatch series \"nilfs2: fix potential issues related to reserved inodes\".\n\nThis series fixes one use-after-free issue reported by syzbot, caused by\nnilfs2's internal inode being exposed in the namespace on a corrupted\nfilesystem, and a couple of flaws that cause problems if the starting\nnumber of non-reserved inodes written in the on-disk super block is\nintentionally (or corruptly) changed from its default value.  \n\n\nThis patch (of 3):\n\nIn the current implementation of nilfs2, \"nilfs-\u003ens_first_ino\", which\ngives the first non-reserved inode number, is read from the superblock,\nbut its lower limit is not checked.\n\nAs a result, if a number that overlaps with the inode number range of\nreserved inodes such as the root directory or metadata files is set in the\nsuper block parameter, the inode number test macros (NILFS_MDT_INODE and\nNILFS_VALID_INODE) will not function properly.\n\nIn addition, these test macros use left bit-shift calculations using with\nthe inode number as the shift count via the BIT macro, but the result of a\nshift calculation that exceeds the bit width of an integer is undefined in\nthe C specification, so if \"ns_first_ino\" is set to a large value other\nthan the default value NILFS_USER_INO (=11), the macros may potentially\nmalfunction depending on the environment.\n\nFix these issues by checking the lower bound of \"nilfs-\u003ens_first_ino\" and\nby preventing bit shifts equal to or greater than the NILFS_USER_INO\nconstant in the inode number test macros.\n\nAlso, change the type of \"ns_first_ino\" from signed integer to unsigned\ninteger to avoid the need for type casting in comparisons such as the\nlower bound check introduced this time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cbccf8f-3100-48cd-9ff0-49984c6a9ef5",
      "id": "CVE-2024-41073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: avoid double free special payload\n\nIf a discard request needs to be retried, and that retry may fail before\na new special payload is added, a double free will result. Clear the\nRQF_SPECIAL_LOAD when the request is cleaned.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8bf5644-4429-4479-b84e-f387932ff108",
      "id": "CVE-2024-41091",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tun_xdp_one() path, which could cause a corrupted skb to be sent\ndownstack. Even before the skb is transmitted, the\ntun_xdp_one--\u003eeth_type_trans() may access the Ethernet header although it\ncan be less than ETH_HLEN. Once transmitted, this could either cause\nout-of-bound access beyond the actual length, or confuse the underlayer\nwith incorrect or inconsistent header length in the skb metadata.\n\nIn the alternative path, tun_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted for\nIFF_TAP.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tun_get_user() does.\n\nCVE: CVE-2024-41091",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a75ca327-494b-4747-8d87-3620ead6c880",
      "id": "CVE-2022-45884",
      "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9e33ec3-c288-4ddf-8657-b1772f50ac71",
      "id": "CVE-2024-42101",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix null pointer dereference in nouveau_connector_get_modes\n\nIn nouveau_connector_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a possible NULL pointer\ndereference on failure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1b25c1b-04aa-49af-b024-b18511c2b730",
      "id": "CVE-2024-42129",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: mlxreg: Use devm_mutex_init() for mutex initialization\n\nIn this driver LEDs are registered using devm_led_classdev_register()\nso they are automatically unregistered after module's remove() is done.\nled_classdev_unregister() calls module's led_set_brightness() to turn off\nthe LEDs and that callback uses mutex which was destroyed already\nin module's remove() so use devm API instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "132c3600-0b42-4dc0-a899-e6d97395e606",
      "id": "CVE-2024-42227",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix overlapping copy within dml_core_mode_programming\n\n[WHY]\n\u0026mode_lib-\u003emp.Watermark and \u0026locals-\u003eWatermark are\nthe same address. memcpy may lead to unexpected behavior.\n\n[HOW]\nmemmove should be used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cc9a08d-1373-443f-ace7-96386688a644",
      "id": "CVE-2024-42232",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix race between delayed_work() and ceph_monc_stop()\n\nThe way the delayed work is handled in ceph_monc_stop() is prone to\nraces with mon_fault() and possibly also finish_hunting().  Both of\nthese can requeue the delayed work which wouldn't be canceled by any of\nthe following code in case that happens after cancel_delayed_work_sync()\nruns -- __close_session() doesn't mess with the delayed work in order\nto avoid interfering with the hunting interval logic.  This part was\nmissed in commit b5d91704f53e (\"libceph: behave in mon_fault() if\ncur_mon \u003c 0\") and use-after-free can still ensue on monc and objects\nthat hang off of it, with monc-\u003eauth and monc-\u003emonmap being\nparticularly susceptible to quickly being reused.\n\nTo fix this:\n\n- clear monc-\u003ecur_mon and monc-\u003ehunting as part of closing the session\n  in ceph_monc_stop()\n- bail from delayed_work() if monc-\u003ecur_mon is cleared, similar to how\n  it's done in mon_fault() and finish_hunting() (based on monc-\u003ehunting)\n- call cancel_delayed_work_sync() after the session is closed",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8897e3c3-b072-459d-a889-2949a85d0d31",
      "id": "CVE-2024-42236",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Prevent OOB read/write in usb_string_copy()\n\nUserspace provided string 's' could trivially have the length zero. Left\nunchecked this will firstly result in an OOB read in the form\n`if (str[0 - 1] == '\\n') followed closely by an OOB write in the form\n`str[0 - 1] = '\\0'`.\n\nThere is already a validating check to catch strings that are too long.\nLet's supply an additional check for invalid strings that are too short.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1d0bfc4-e5bf-4297-a5cd-c351f47c1a7c",
      "id": "CVE-2024-42276",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20458faf-d1cd-4bc6-9fc4-65b453573f05",
      "id": "CVE-2024-42305",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: check dot and dotdot of dx_root before making dir indexed\n\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n \u003cTASK\u003e\n make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\n ext4_rename fs/ext4/namei.c:3936 [inline]\n ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\n\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\n\n    do_split\n      unsigned split\n      dx_make_map\n       count = 1\n      split = count/2 = 0;\n      continued = hash2 == map[split - 1].hash;\n       ---\u003e map[4294967295]\n\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\n\nBut syzbot's crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\n\n  bus     dentry1          hole           dentry2           free\n|xx--|xx-------------|...............|xx-------------|...............|\n0   12 (8+248)=256  268     256     524 (8+256)=264 788     236     1024\n\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\n\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That's why count is equal to 1.\n\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "377587ef-8c64-407f-b251-48ca174d9d9d",
      "id": "CVE-2024-43866",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Always drain health in shutdown callback\n\nThere is no point in recovery during device shutdown. if health\nwork started need to wait for it to avoid races and NULL pointer\naccess.\n\nHence, drain health WQ on shutdown callback.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f2e2daa-777c-4d60-84a0-9844ec476f57",
      "id": "CVE-2024-46674",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: st: fix probed platform device ref count on probe error path\n\nThe probe function never performs any paltform device allocation, thus\nerror path \"undo_platform_dev_alloc\" is entirely bogus.  It drops the\nreference count from the platform device being probed.  If error path is\ntriggered, this will lead to unbalanced device reference counts and\npremature release of device resources, thus possible use-after-free when\nreleasing remaining devm-managed resources.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e94c34c-f6b0-40df-98c9-03d51ba97006",
      "id": "CVE-2024-46689",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: cmd-db: Map shared memory as WC, not WB\n\nLinux does not write into cmd-db region. This region of memory is write\nprotected by XPU. XPU may sometime falsely detect clean cache eviction\nas \"write\" into the write protected region leading to secure interrupt\nwhich causes an endless loop somewhere in Trust Zone.\n\nThe only reason it is working right now is because Qualcomm Hypervisor\nmaps the same region as Non-Cacheable memory in Stage 2 translation\ntables. The issue manifests if we want to use another hypervisor (like\nXen or KVM), which does not know anything about those specific mappings.\n\nChanging the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC\nremoves dependency on correct mappings in Stage 2 tables. This patch\nfixes the issue by updating the mapping to MEMREMAP_WC.\n\nI tested this on SA8155P with Xen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19ae1263-d0fd-4a08-8449-616fab640f8e",
      "id": "CVE-2025-21785",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array\n\nThe loop that detects/populates cache information already has a bounds\ncheck on the array size but does not account for cache levels with\nseparate data/instructions cache. Fix this by incrementing the index\nfor any populated leaf (instead of any populated level).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e9eab41-7331-4e12-97f6-829bfb8ef31f",
      "id": "CVE-2024-46730",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Ensure array index tg_inst won't be -1\n\n[WHY \u0026 HOW]\ntg_inst will be a negative if timing_generator_count equals 0, which\nshould be checked before used.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be6e4fe6-d1be-4bf6-97ca-1e947fdaf9ff",
      "id": "CVE-2024-46775",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate function returns\n\n[WHAT \u0026 HOW]\nFunction return values must be checked before data can be used\nin subsequent functions.\n\nThis fixes 4 CHECKED_RETURN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "577a30cc-d632-4729-be16-b18aebdceb6f",
      "id": "CVE-2024-46822",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry\n\nIn a review discussion of the changes to support vCPU hotplug where\na check was added on the GICC being enabled if was online, it was\nnoted that there is need to map back to the cpu and use that to index\ninto a cpumask. As such, a valid ID is needed.\n\nIf an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible\nfor the entry in cpu_madt_gicc[cpu] == NULL.  This function would\nthen cause a NULL pointer dereference.   Whilst a path to trigger\nthis has not been established, harden this caller against the\npossibility.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ed41dbf-e2e3-465d-bd98-eff586e56b22",
      "id": "CVE-2024-47669",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix state management in error path of log writing function\n\nAfter commit a694291a6211 (\"nilfs2: separate wait function from\nnilfs_segctor_write\") was applied, the log writing function\nnilfs_segctor_do_construct() was able to issue I/O requests continuously\neven if user data blocks were split into multiple logs across segments,\nbut two potential flaws were introduced in its error handling.\n\nFirst, if nilfs_segctor_begin_construction() fails while creating the\nsecond or subsequent logs, the log writing function returns without\ncalling nilfs_segctor_abort_construction(), so the writeback flag set on\npages/folios will remain uncleared.  This causes page cache operations to\nhang waiting for the writeback flag.  For example,\ntruncate_inode_pages_final(), which is called via nilfs_evict_inode() when\nan inode is evicted from memory, will hang.\n\nSecond, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. \nAs a result, if the next log write involves checkpoint creation, that's\nfine, but if a partial log write is performed that does not, inodes with\nNILFS_I_COLLECTED set are erroneously removed from the \"sc_dirty_files\"\nlist, and their data and b-tree blocks may not be written to the device,\ncorrupting the block mapping.\n\nFix these issues by uniformly calling nilfs_segctor_abort_construction()\non failure of each step in the loop in nilfs_segctor_do_construct(),\nhaving it clean up logs and segment usages according to progress, and\ncorrecting the conditions for calling nilfs_redirty_inodes() to ensure\nthat the NILFS_I_COLLECTED flag is cleared.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9e9fcdd-314a-49d3-813c-32a84d1338eb",
      "id": "CVE-2024-47671",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: usbtmc: prevent kernel-usb-infoleak\n\nThe syzbot reported a kernel-usb-infoleak in usbtmc_write,\nwe need to clear the structure before filling fields.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4b45d76-89ac-4247-b23d-79a8dc741c9f",
      "id": "CVE-2024-49987",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpftool: Fix undefined behavior in qsort(NULL, 0, ...)\n\nWhen netfilter has no entry to display, qsort is called with\nqsort(NULL, 0, ...). This results in undefined behavior, as UBSan\nreports:\n\nnet.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null\n\nAlthough the C standard does not explicitly state whether calling qsort\nwith a NULL pointer when the size is 0 constitutes undefined behavior,\nSection 7.1.4 of the C standard (Use of library functions) mentions:\n\n\"Each of the following statements applies unless explicitly stated\notherwise in the detailed descriptions that follow: If an argument to a\nfunction has an invalid value (such as a value outside the domain of\nthe function, or a pointer outside the address space of the program, or\na null pointer, or a pointer to non-modifiable storage when the\ncorresponding parameter is not const-qualified) or a type (after\npromotion) not expected by a function with variable number of\narguments, the behavior is undefined.\"\n\nTo avoid this, add an early return when nf_link_info is NULL to prevent\ncalling qsort with a NULL pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1172393-666c-47e5-9a60-e937e90c41c3",
      "id": "CVE-2024-50142",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate new SA's prefixlen using SA family when sel.family is unset\n\nThis expands the validation introduced in commit 07bf7908950a (\"xfrm:\nValidate address prefix lengths in the xfrm selector.\")\n\nsyzbot created an SA with\n    usersa.sel.family = AF_UNSPEC\n    usersa.sel.prefixlen_s = 128\n    usersa.family = AF_INET\n\nBecause of the AF_UNSPEC selector, verify_newsa_info doesn't put\nlimits on prefixlen_{s,d}. But then copy_from_user_state sets\nx-\u003esel.family to usersa.family (AF_INET). Do the same conversion in\nverify_newsa_info before validating prefixlen_{s,d}, since that's how\nprefixlen is going to be used later on.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41f88856-8fd3-42c1-87e0-3c7c01983d4a",
      "id": "CVE-2024-50290",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx24116: prevent overflows on SNR calculus\n\nas reported by Coverity, if reading SNR registers fail, a negative\nnumber will be returned, causing an underflow when reading SNR\nregisters.\n\nPrevent that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88521392-22cc-4801-8ebe-a5c8c232e25b",
      "id": "CVE-2024-53158",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()\n\nThis loop is supposed to break if the frequency returned from\nclk_round_rate() is the same as on the previous iteration.  However,\nthat check doesn't make sense on the first iteration through the loop.\nIt leads to reading before the start of these-\u003eclk_perf_tbl[] array.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77b34bdd-5799-4315-80fe-1116c15e611f",
      "id": "CVE-2024-57982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: state: fix out-of-bounds read during lookup\n\nlookup and resize can run in parallel.\n\nThe xfrm_state_hash_generation seqlock ensures a retry, but the hash\nfunctions can observe a hmask value that is too large for the new hlist\narray.\n\nrehash does:\n  rcu_assign_pointer(net-\u003exfrm.state_bydst, ndst) [..]\n  net-\u003exfrm.state_hmask = nhashmask;\n\nWhile state lookup does:\n  h = xfrm_dst_hash(net, daddr, saddr, tmpl-\u003ereqid, encap_family);\n  hlist_for_each_entry_rcu(x, net-\u003exfrm.state_bydst + h, bydst) {\n\nThis is only safe in case the update to state_bydst is larger than\nnet-\u003exfrm.xfrm_state_hmask (or if the lookup function gets\nserialized via state spinlock again).\n\nFix this by prefetching state_hmask and the associated pointers.\nThe xfrm_state_hash_generation seqlock retry will ensure that the pointer\nand the hmask will be consistent.\n\nThe existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side,\nadd lockdep assertions to document that they are only safe for insert\nside.\n\nxfrm_state_lookup_byaddr() uses the spinlock rather than RCU.\nAFAICS this is an oversight from back when state lookup was converted to\nRCU, this lock should be replaced with RCU in a future patch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "991c8772-2688-4027-9883-9d788682308a",
      "id": "CVE-2025-37766",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d285a7a7-652c-4e89-983c-ea4b14440106",
      "id": "CVE-2025-37810",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: check that event count does not exceed event buffer length\n\nThe event count is read from register DWC3_GEVNTCOUNT.\nThere is a check for the count being zero, but not for exceeding the\nevent buffer length.\nCheck that event count does not exceed event buffer length,\navoiding an out-of-bounds access when memcpy'ing the event.\nCrash log:\nUnable to handle kernel paging request at virtual address ffffffc0129be000\npc : __memcpy+0x114/0x180\nlr : dwc3_check_event_buf+0xec/0x348\nx3 : 0000000000000030 x2 : 000000000000dfc4\nx1 : ffffffc0129be000 x0 : ffffff87aad60080\nCall trace:\n__memcpy+0x114/0x180\ndwc3_interrupt+0x24/0x34",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "920f92dc-5de5-4450-8c17-41af660281df",
      "id": "CVE-2025-37853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: debugfs hang_hws skip GPU with MES\n\ndebugfs hang_hws is used by GPU reset test with HWS, for MES this crash\nthe kernel with NULL pointer access because dqm-\u003epacket_mgr is not setup\nfor MES path.\n\nSkip GPU with MES for now, MES hang_hws debugfs interface will be\nsupported later.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "05b35406-5c22-4df4-bbb9-c37ed23f758e",
      "id": "CVE-2025-37928",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-bufio: don't schedule in atomic context\n\nA BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and\ntry_verify_in_tasklet are enabled.\n[  129.444685][  T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421\n[  129.444723][  T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4\n[  129.444740][  T934] preempt_count: 201, expected: 0\n[  129.444756][  T934] RCU nest depth: 0, expected: 0\n[  129.444781][  T934] Preemption disabled at:\n[  129.444789][  T934] [\u003cffffffd816231900\u003e] shrink_work+0x21c/0x248\n[  129.445167][  T934] kernel BUG at kernel/sched/walt/walt_debug.c:16!\n[  129.445183][  T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n[  129.445204][  T934] Skip md ftrace buffer dump for: 0x1609e0\n[  129.447348][  T934] CPU: 1 PID: 934 Comm: kworker/1:4 Tainted: G        W  OE      6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8\n[  129.447362][  T934] Hardware name: Qualcomm Technologies, Inc. Parrot QRD, Alpha-M (DT)\n[  129.447373][  T934] Workqueue: dm_bufio_cache shrink_work\n[  129.447394][  T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  129.447406][  T934] pc : android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug]\n[  129.447435][  T934] lr : __traceiter_android_rvh_schedule_bug+0x44/0x6c\n[  129.447451][  T934] sp : ffffffc0843dbc90\n[  129.447459][  T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b\n[  129.447479][  T934] x26: 0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68\n[  129.447497][  T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900\n[  129.447517][  T934] x20: ffffff80306ba898 x19: 0000000000000000 x18: ffffffc084159030\n[  129.447535][  T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358\n[  129.447554][  T934] x14: 0000000000000004 x13: ffffff89ef978000 x12: 0000000000000003\n[  129.447572][  T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400\n[  129.447591][  T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8\n[  129.447610][  T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0\n[  129.447629][  T934] x2 : 0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000\n[  129.447647][  T934] Call trace:\n[  129.447655][  T934]  android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug 1400000003000000474e550080cce8a8a78606b6]\n[  129.447681][  T934]  __might_resched+0x190/0x1a8\n[  129.447694][  T934]  shrink_work+0x180/0x248\n[  129.447706][  T934]  process_one_work+0x260/0x624\n[  129.447718][  T934]  worker_thread+0x28c/0x454\n[  129.447729][  T934]  kthread+0x118/0x158\n[  129.447742][  T934]  ret_from_fork+0x10/0x20\n[  129.447761][  T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000)\n[  129.447772][  T934] ---[ end trace 0000000000000000 ]---\n\ndm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet\nis enabled, and __scan will be called in atomic context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "325ae9c7-e29e-4845-9d76-68a727b58a3c",
      "id": "CVE-2025-37958",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix dereferencing invalid pmd migration entry\n\nWhen migrating a THP, concurrent access to the PMD migration entry during\na deferred split scan can lead to an invalid address access, as\nillustrated below.  To prevent this invalid access, it is necessary to\ncheck the PMD migration entry and return early.  In this context, there is\nno need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the\nequality of the target folio.  Since the PMD migration entry is locked, it\ncannot be served as the target.\n\nMailing list discussion and explanation from Hugh Dickins: \"An anon_vma\nlookup points to a location which may contain the folio of interest, but\nmight instead contain another folio: and weeding out those other folios is\nprecisely what the \"folio != pmd_folio((*pmd)\" check (and the \"risk of\nreplacing the wrong folio\" comment a few lines above it) is for.\"\n\nBUG: unable to handle page fault for address: ffffea60001db008\nCPU: 0 UID: 0 PID: 2199114 Comm: tee Not tainted 6.14.0+ #4 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:split_huge_pmd_locked+0x3b5/0x2b60\nCall Trace:\n\u003cTASK\u003e\ntry_to_migrate_one+0x28c/0x3730\nrmap_walk_anon+0x4f6/0x770\nunmap_folio+0x196/0x1f0\nsplit_huge_page_to_list_to_order+0x9f6/0x1560\ndeferred_split_scan+0xac5/0x12a0\nshrinker_debugfs_scan_write+0x376/0x470\nfull_proxy_write+0x15c/0x220\nvfs_write+0x2fc/0xcb0\nksys_write+0x146/0x250\ndo_syscall_64+0x6a/0x120\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe bug is found by syzkaller on an internal kernel, then confirmed on\nupstream.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4288ebd9-70c3-46cf-8d99-4242ebccfb1c",
      "id": "CVE-2025-37990",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()\n\nThe function brcmf_usb_dl_writeimage() calls the function\nbrcmf_usb_dl_cmd() but dose not check its return value. The\n'state.state' and the 'state.bytes' are uninitialized if the\nfunction brcmf_usb_dl_cmd() fails. It is dangerous to use\nuninitialized variables in the conditions.\n\nAdd error handling for brcmf_usb_dl_cmd() to jump to error\nhandling path if the brcmf_usb_dl_cmd() fails and the\n'state.state' and the 'state.bytes' are uninitialized.\n\nImprove the error message to report more detailed error\ninformation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2265bf0-dc09-4dfd-b162-196c3ac31ac6",
      "id": "CVE-2025-38062",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie\n\nThe IOMMU translation for MSI message addresses has been a 2-step process,\nseparated in time:\n\n 1) iommu_dma_prepare_msi(): A cookie pointer containing the IOVA address\n    is stored in the MSI descriptor when an MSI interrupt is allocated.\n\n 2) iommu_dma_compose_msi_msg(): this cookie pointer is used to compute a\n    translated message address.\n\nThis has an inherent lifetime problem for the pointer stored in the cookie\nthat must remain valid between the two steps. However, there is no locking\nat the irq layer that helps protect the lifetime. Today, this works under\nthe assumption that the iommu domain is not changed while MSI interrupts\nbeing programmed. This is true for normal DMA API users within the kernel,\nas the iommu domain is attached before the driver is probed and cannot be\nchanged while a driver is attached.\n\nClassic VFIO type1 also prevented changing the iommu domain while VFIO was\nrunning as it does not support changing the \"container\" after starting up.\n\nHowever, iommufd has improved this so that the iommu domain can be changed\nduring VFIO operation. This potentially allows userspace to directly race\nVFIO_DEVICE_ATTACH_IOMMUFD_PT (which calls iommu_attach_group()) and\nVFIO_DEVICE_SET_IRQS (which calls into iommu_dma_compose_msi_msg()).\n\nThis potentially causes both the cookie pointer and the unlocked call to\niommu_get_domain_for_dev() on the MSI translation path to become UAFs.\n\nFix the MSI cookie UAF by removing the cookie pointer. The translated IOVA\naddress is already known during iommu_dma_prepare_msi() and cannot change.\nThus, it can simply be stored as an integer in the MSI descriptor.\n\nThe other UAF related to iommu_get_domain_for_dev() will be addressed in\npatch \"iommu: Make iommu_dma_prepare_msi() into a generic operation\" by\nusing the IOMMU group mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfd5a0ea-a914-4bb6-b53a-85593f4a52c9",
      "id": "CVE-2025-38204",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e3f0753-c4a2-410c-975d-0acdf6e2fab3",
      "id": "CVE-2025-38328",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check jffs2_prealloc_raw_node_refs() result in few other places\n\nFuzzing hit another invalid pointer dereference due to the lack of\nchecking whether jffs2_prealloc_raw_node_refs() completed successfully.\nSubsequent logic implies that the node refs have been allocated.\n\nHandle that. The code is ready for propagating the error upwards.\n\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600\nCall Trace:\n jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline]\n jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118\n jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253\n jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302\n generic_perform_write+0x2c2/0x500 mm/filemap.c:3347\n __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465\n generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497\n call_write_iter include/linux/fs.h:2039 [inline]\n do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740\n do_iter_write+0x18c/0x710 fs/read_write.c:866\n vfs_writev+0x1db/0x6a0 fs/read_write.c:939\n do_pwritev fs/read_write.c:1036 [inline]\n __do_sys_pwritev fs/read_write.c:1083 [inline]\n __se_sys_pwritev fs/read_write.c:1078 [inline]\n __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078\n do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5e38104-fe6f-4551-b016-05f675a7a4fd",
      "id": "CVE-2025-38361",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check dce_hwseq before dereferencing it\n\n[WHAT]\n\nhws was checked for null earlier in dce110_blank_stream, indicating hws\ncan be null, and should be checked whenever it is used.\n\n(cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03cf931d-4897-47dc-8318-f7bf13b2fe39",
      "id": "CVE-2025-38401",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtk-sd: Prevent memory corruption from DMA map failure\n\nIf msdc_prepare_data() fails to map the DMA region, the request is\nnot prepared for data receiving, but msdc_start_data() proceeds\nthe DMA with previous setting.\nSince this will lead a memory corruption, we have to stop the\nrequest operation soon after the msdc_prepare_data() fails to\nprepare it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11123595-9807-4e4a-ba9f-c582a9efeba2",
      "id": "CVE-2025-38538",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: nbpfaxi: Fix memory corruption in probe()\n\nThe nbpf-\u003echan[] array is allocated earlier in the nbpf_probe() function\nand it has \"num_channels\" elements.  These three loops iterate one\nelement farther than they should and corrupt memory.\n\nThe changes to the second loop are more involved.  In this case, we're\ncopying data from the irqbuf[] array into the nbpf-\u003echan[] array.  If\nthe data in irqbuf[i] is the error IRQ then we skip it, so the iterators\nare not in sync.  I added a check to ensure that we don't go beyond the\nend of the irqbuf[] array.  I'm pretty sure this can't happen, but it\nseemed harmless to add a check.\n\nOn the other hand, after the loop has ended there is a check to ensure\nthat the \"chan\" iterator is where we expect it to be.  In the original\ncode we went one element beyond the end of the array so the iterator\nwasn't in the correct place and it would always return -EINVAL.  However,\nnow it will always be in the correct place.  I deleted the check since\nwe know the result.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "22df9ae7-cef5-483e-9fe6-7c15ca86872a",
      "id": "CVE-2025-38539",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add down_write(trace_event_sem) when adding trace event\n\nWhen a module is loaded, it adds trace events defined by the module. It\nmay also need to modify the modules trace printk formats to replace enum\nnames with their values.\n\nIf two modules are loaded at the same time, the adding of the event to the\nftrace_events list can corrupt the walking of the list in the code that is\nmodifying the printk format strings and crash the kernel.\n\nThe addition of the event should take the trace_event_sem for write while\nit adds the new event.\n\nAlso add a lockdep_assert_held() on that semaphore in\n__trace_add_event_dirs() as it iterates the list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f6cd7ef-53ce-4314-accd-03249dcb4b15",
      "id": "CVE-2025-38542",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: Fix device refcount leak in atrtr_create()\n\nWhen updating an existing route entry in atrtr_create(), the old device\nreference was not being released before assigning the new device,\nleading to a device refcount leak. Fix this by calling dev_put() to\nrelease the old device reference before holding the new one.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78f6e3a8-7c4c-470c-8380-97d70b1b6fdf",
      "id": "CVE-2025-38637",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: skbprio: Remove overly strict queue assertions\n\nIn the current implementation, skbprio enqueue/dequeue contains an assertion\nthat fails under certain conditions when SKBPRIO is used as a child qdisc under\nTBF with specific parameters. The failure occurs because TBF sometimes peeks at\npackets in the child qdisc without actually dequeuing them when tokens are\nunavailable.\n\nThis peek operation creates a discrepancy between the parent and child qdisc\nqueue length counters. When TBF later receives a high-priority packet,\nSKBPRIO's queue length may show a different value than what's reflected in its\ninternal priority queue tracking, triggering the assertion.\n\nThe fix removes this overly strict assertions in SKBPRIO, they are not\nnecessary at all.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d07ec3d-d65f-44c1-b40d-d8da6ae3f8fc",
      "id": "CVE-2025-38650",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: remove mutex_lock check in hfsplus_free_extents\n\nSyzbot reported an issue in hfsplus filesystem:\n\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346\n\thfsplus_free_extents+0x700/0xad0\nCall Trace:\n\u003cTASK\u003e\nhfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606\nhfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56\ncont_expand_zero fs/buffer.c:2383 [inline]\ncont_write_begin+0x2cf/0x860 fs/buffer.c:2446\nhfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52\ngeneric_cont_expand_simple+0x151/0x250 fs/buffer.c:2347\nhfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263\nnotify_change+0xe38/0x10f0 fs/attr.c:420\ndo_truncate+0x1fb/0x2e0 fs/open.c:65\ndo_sys_ftruncate+0x2eb/0x380 fs/open.c:193\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nTo avoid deadlock, Commit 31651c607151 (\"hfsplus: avoid deadlock\non file truncation\") unlock extree before hfsplus_free_extents(),\nand add check wheather extree is locked in hfsplus_free_extents().\n\nHowever, when operations such as hfsplus_file_release,\nhfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed\nconcurrently in different files, it is very likely to trigger the\nWARN_ON, which will lead syzbot and xfstest to consider it as an\nabnormality.\n\nThe comment above this warning also describes one of the easy\ntriggering situations, which can easily trigger and cause\nxfstest\u0026syzbot to report errors.\n\n[task A]\t\t\t[task B]\n-\u003ehfsplus_file_release\n  -\u003ehfsplus_file_truncate\n    -\u003ehfs_find_init\n      -\u003emutex_lock\n    -\u003emutex_unlock\n\t\t\t\t-\u003ehfsplus_write_begin\n\t\t\t\t  -\u003ehfsplus_get_block\n\t\t\t\t    -\u003ehfsplus_file_extend\n\t\t\t\t      -\u003ehfsplus_ext_read_extent\n\t\t\t\t        -\u003ehfs_find_init\n\t\t\t\t\t  -\u003emutex_lock\n    -\u003ehfsplus_free_extents\n      WARN_ON(mutex_is_locked) !!!\n\nSeveral threads could try to lock the shared extents tree.\nAnd warning can be triggered in one thread when another thread\nhas locked the tree. This is the wrong behavior of the code and\nwe need to remove the warning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fba9ebe3-209a-492b-a0da-3c2f88fb858a",
      "id": "CVE-2020-36766",
      "description": "An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f1e72da-5473-4ce7-a62c-25f939a8c2a5",
      "id": "CVE-2021-28971",
      "description": "In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "165ff6d6-b5cb-4b9f-857b-691c37708cf0",
      "id": "CVE-2023-5158",
      "description": "A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed18f5d8-a870-4aec-babc-42cf2c7921ea",
      "id": "CVE-2021-29265",
      "description": "An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ccea3b01-09bf-4b66-942b-3fe4d8b24c7f",
      "id": "CVE-2021-46960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Return correct error code from smb2_get_enc_key\n\nAvoid a warning if the error percolates back up:\n\n[440700.376476] CIFS VFS: \\\\otters.example.com crypt_message: Could not get encryption key\n[440700.386947] ------------[ cut here ]------------\n[440700.386948] err = 1\n[440700.386977] WARNING: CPU: 11 PID: 2733 at /build/linux-hwe-5.4-p6lk6L/linux-hwe-5.4-5.4.0/lib/errseq.c:74 errseq_set+0x5c/0x70\n...\n[440700.397304] CPU: 11 PID: 2733 Comm: tar Tainted: G           OE     5.4.0-70-generic #78~18.04.1-Ubuntu\n...\n[440700.397334] Call Trace:\n[440700.397346]  __filemap_set_wb_err+0x1a/0x70\n[440700.397419]  cifs_writepages+0x9c7/0xb30 [cifs]\n[440700.397426]  do_writepages+0x4b/0xe0\n[440700.397444]  __filemap_fdatawrite_range+0xcb/0x100\n[440700.397455]  filemap_write_and_wait+0x42/0xa0\n[440700.397486]  cifs_setattr+0x68b/0xf30 [cifs]\n[440700.397493]  notify_change+0x358/0x4a0\n[440700.397500]  utimes_common+0xe9/0x1c0\n[440700.397510]  do_utimes+0xc5/0x150\n[440700.397520]  __x64_sys_utimensat+0x88/0xd0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "826b26b3-3b9d-4413-9d6e-6e03013d0bef",
      "id": "CVE-2021-47160",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mt7530: fix VLAN traffic leaks\n\nPCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but\nwas not reset when it is disabled, which may cause traffic leaks:\n\n\tip link add br0 type bridge vlan_filtering 1\n\tip link add br1 type bridge vlan_filtering 1\n\tip link set swp0 master br0\n\tip link set swp1 master br1\n\tip link set br0 type bridge vlan_filtering 0\n\tip link set br1 type bridge vlan_filtering 0\n\t# traffic in br0 and br1 will start leaking to each other\n\nAs port_bridge_{add,del} have set up PCR_MATRIX properly, remove the\nPCR_MATRIX write from mt7530_port_set_vlan_aware.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f322a3b9-f18b-4bb7-85c1-aeed84f5abdd",
      "id": "CVE-2021-47168",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix an incorrect limit in filelayout_decode_layout()\n\nThe \"sizeof(struct nfs_fh)\" is two bytes too large and could lead to\nmemory corruption.  It should be NFS_MAXFHSIZE because that's the size\nof the -\u003edata[] buffer.\n\nI reversed the size of the arguments to put the variable on the left.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40f8cda0-0a63-42bc-8bb3-4364f80d4fb1",
      "id": "CVE-2021-47202",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: Fix NULL pointer dereferences in of_thermal_ functions\n\nof_parse_thermal_zones() parses the thermal-zones node and registers a\nthermal_zone device for each subnode. However, if a thermal zone is\nconsuming a thermal sensor and that thermal sensor device hasn't probed\nyet, an attempt to set trip_point_*_temp for that thermal zone device\ncan cause a NULL pointer dereference. Fix it.\n\n console:/sys/class/thermal/thermal_zone87 # echo 120000 \u003e trip_point_0_temp\n ...\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020\n ...\n Call trace:\n  of_thermal_set_trip_temp+0x40/0xc4\n  trip_point_temp_store+0xc0/0x1dc\n  dev_attr_store+0x38/0x88\n  sysfs_kf_write+0x64/0xc0\n  kernfs_fop_write_iter+0x108/0x1d0\n  vfs_write+0x2f4/0x368\n  ksys_write+0x7c/0xec\n  __arm64_sys_write+0x20/0x30\n  el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc\n  do_el0_svc+0x28/0xa0\n  el0_svc+0x14/0x24\n  el0_sync_handler+0x88/0xec\n  el0_sync+0x1c0/0x200\n\nWhile at it, fix the possible NULL pointer dereference in other\nfunctions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(),\nof_thermal_get_trend().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c848f25b-0b05-4a98-a647-cc77d31701f9",
      "id": "CVE-2021-47226",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer\n\nBoth Intel and AMD consider it to be architecturally valid for XRSTOR to\nfail with #PF but nonetheless change the register state.  The actual\nconditions under which this might occur are unclear [1], but it seems\nplausible that this might be triggered if one sibling thread unmaps a page\nand invalidates the shared TLB while another sibling thread is executing\nXRSTOR on the page in question.\n\n__fpu__restore_sig() can execute XRSTOR while the hardware registers\nare preserved on behalf of a different victim task (using the\nfpu_fpregs_owner_ctx mechanism), and, in theory, XRSTOR could fail but\nmodify the registers.\n\nIf this happens, then there is a window in which __fpu__restore_sig()\ncould schedule out and the victim task could schedule back in without\nreloading its own FPU registers. This would result in part of the FPU\nstate that __fpu__restore_sig() was attempting to load leaking into the\nvictim task's user-visible state.\n\nInvalidate preserved FPU registers on XRSTOR failure to prevent this\nsituation from corrupting any state.\n\n[1] Frequent readers of the errata lists might imagine \"complex\n    microarchitectural conditions\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ceed321-9fbc-4c01-a553-f0ac5b165c5f",
      "id": "CVE-2021-47267",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: fix various gadget panics on 10gbps cabling\n\nusb_assign_descriptors() is called with 5 parameters,\nthe last 4 of which are the usb_descriptor_header for:\n  full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps),\n  high-speed (USB2.0 - 480Mbps),\n  super-speed (USB3.0 - 5Gbps),\n  super-speed-plus (USB3.1 - 10Gbps).\n\nThe differences between full/high/super-speed descriptors are usually\nsubstantial (due to changes in the maximum usb block size from 64 to 512\nto 1024 bytes and other differences in the specs), while the difference\nbetween 5 and 10Gbps descriptors may be as little as nothing\n(in many cases the same tuning is simply good enough).\n\nHowever if a gadget driver calls usb_assign_descriptors() with\na NULL descriptor for super-speed-plus and is then used on a max 10gbps\nconfiguration, the kernel will crash with a null pointer dereference,\nwhen a 10gbps capable device port + cable + host port combination shows up.\n(This wouldn't happen if the gadget max-speed was set to 5gbps, but\nit of course defaults to the maximum, and there's no real reason to\nartificially limit it)\n\nThe fix is to simply use the 5gbps descriptor as the 10gbps descriptor,\nif a 10gbps descriptor wasn't provided.\n\nObviously this won't fix the problem if the 5gbps descriptor is also\nNULL, but such cases can't be so trivially solved (and any such gadgets\nare unlikely to be used with USB3 ports any way).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "887144ac-0d0a-4cb2-8e1c-3257be09a5d4",
      "id": "CVE-2021-47283",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet:sfc: fix non-freed irq in legacy irq mode\n\nSFC driver can be configured via modparam to work using MSI-X, MSI or\nlegacy IRQ interrupts. In the last one, the interrupt was not properly\nreleased on module remove.\n\nIt was not freed because the flag irqs_hooked was not set during\ninitialization in the case of using legacy IRQ.\n\nExample of (trimmed) trace during module remove without this fix:\n\nremove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1'\nWARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170\n...trimmed...\nCall Trace:\n unregister_irq_proc+0xe3/0x100\n free_desc+0x29/0x70\n irq_free_descs+0x47/0x70\n mp_unmap_irq+0x58/0x60\n acpi_unregister_gsi_ioapic+0x2a/0x40\n acpi_pci_irq_disable+0x78/0xb0\n pci_disable_device+0xd1/0x100\n efx_pci_remove+0xa1/0x1e0 [sfc]\n pci_device_remove+0x38/0xa0\n __device_release_driver+0x177/0x230\n driver_detach+0xcb/0x110\n bus_remove_driver+0x58/0xd0\n pci_unregister_driver+0x2a/0xb0\n efx_exit_module+0x24/0xf40 [sfc]\n __do_sys_delete_module.constprop.0+0x171/0x280\n ? exit_to_user_mode_prepare+0x83/0x1d0\n do_syscall_64+0x3d/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f9f9385800b\n...trimmed...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "18d723a9-91d7-4f41-952a-edfc11e2d909",
      "id": "CVE-2021-47329",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix resource leak in case of probe failure\n\nThe driver doesn't clean up all the allocated resources properly when\nscsi_add_host(), megasas_start_aen() function fails during the PCI device\nprobe.\n\nClean up all those resources.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2fab6a0-cf9d-47cc-94b2-0462c36efad7",
      "id": "CVE-2021-47348",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid HDCP over-read and corruption\n\nInstead of reading the desired 5 bytes of the actual target field,\nthe code was reading 8. This could result in a corrupted value if the\ntrailing 3 bytes were non-zero, so instead use an appropriately sized\nand zero-initialized bounce buffer, and read only 5 bytes before casting\nto u64.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "591176bb-d52c-4883-b1f8-936c5991e0b6",
      "id": "CVE-2021-47485",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\n\nOverflowing either addrlimit or bytes_togo can allow userspace to trigger\na buffer overflow of kernel memory. Check for overflows in all the places\ndoing math on user controlled buffers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "150f51f7-1420-498a-9265-93b1d2c38c92",
      "id": "CVE-2022-49336",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem\n\nWhen the mapping is already reaped the unmap must be a no-op, as we\nwould otherwise try to remove the mapping twice, corrupting the involved\ndata structures.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f068f78-97d9-45c9-954d-88ef328d4a46",
      "id": "CVE-2021-47583",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mxl111sf: change mutex_init() location\n\nSyzbot reported, that mxl111sf_ctrl_msg() uses uninitialized\nmutex. The problem was in wrong mutex_init() location.\n\nPrevious mutex_init(\u0026state-\u003emsg_lock) call was in -\u003einit() function, but\ndvb_usbv2_init() has this order of calls:\n\n\tdvb_usbv2_init()\n\t  dvb_usbv2_adapter_init()\n\t    dvb_usbv2_adapter_frontend_init()\n\t      props-\u003efrontend_attach()\n\n\t  props-\u003einit()\n\nSince mxl111sf_* devices call mxl111sf_ctrl_msg() in -\u003efrontend_attach()\ninternally we need to initialize state-\u003emsg_lock before\nfrontend_attach(). To achieve it, -\u003eprobe() call added to all mxl111sf_*\ndevices, which will simply initiaize mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb1c563a-e9e7-42a7-916e-62bc938a329e",
      "id": "CVE-2021-47649",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: validate ubuf-\u003epagecount\n\nSyzbot has reported GPF in sg_alloc_append_table_from_pages(). The\nproblem was in ubuf-\u003epages == ZERO_PTR.\n\nubuf-\u003epagecount is calculated from arguments passed from user-space. If\nuser creates udmabuf with list.size == 0 then ubuf-\u003epagecount will be\nalso equal to zero; it causes kmalloc_array() to return ZERO_PTR.\n\nFix it by validating ubuf-\u003epagecount before passing it to\nkmalloc_array().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8d558d8-79f3-4c8c-9c8b-d677ecd246cc",
      "id": "CVE-2021-47659",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/plane: Move range check for format_count earlier\n\nWhile the check for format_count \u003e 64 in __drm_universal_plane_init()\nshouldn't be hit (it's a WARN_ON), in its current position it will then\nleak the plane-\u003eformat_types array and fail to call\ndrm_mode_object_unregister() leaking the modeset identifier. Move it to\nthe start of the function to avoid allocating those resources in the\nfirst place.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5654f41-6d7f-44e8-8221-6e8f9ef99b11",
      "id": "CVE-2022-34918",
      "description": "An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69e83915-c9b9-4ff7-ae0b-0174a8be7119",
      "id": "CVE-2022-39842",
      "description": "An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8829c3ec-e20d-4903-9af5-2563acf173dc",
      "id": "CVE-2022-44033",
      "description": "An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b77a958-6c94-4d19-9853-de9eb5f53c7b",
      "id": "CVE-2022-48642",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()\n\nIt seems to me that percpu memory for chain stats started leaking since\ncommit 3bc158f8d0330f0a (\"netfilter: nf_tables: map basechain priority to\nhardware priority\") when nft_chain_offload_priority() returned an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c819f9ec-16e4-4292-ac7f-f8e83d3f3aff",
      "id": "CVE-2022-48836",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: aiptek - properly check endpoint type\n\nSyzbot reported warning in usb_submit_urb() which is caused by wrong\nendpoint type. There was a check for the number of endpoints, but not\nfor the type of endpoint.\n\nFix it by replacing old desc.bNumEndpoints check with\nusb_find_common_endpoints() helper for finding endpoints\n\nFail log:\n\nusb 5-1: BOGUS urb xfer, pipe 1 != type 3\nWARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\nModules linked in:\nCPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014\nWorkqueue: usb_hub_wq hub_event\n...\nCall Trace:\n \u003cTASK\u003e\n aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830\n input_open_device+0x1bb/0x320 drivers/input/input.c:629\n kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f402061-695e-4219-a9b2-43a2a7b7293f",
      "id": "CVE-2022-48992",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: soc-pcm: Add NULL check in BE reparenting\n\nAdd NULL check in dpcm_be_reparent API, to handle\nkernel NULL pointer dereference error.\nThe issue occurred in fuzzing test.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "130dcb74-a21d-42bb-bcb4-72bb873cb25d",
      "id": "CVE-2022-49013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix memory leak in sctp_stream_outq_migrate()\n\nWhen sctp_stream_outq_migrate() is called to release stream out resources,\nthe memory pointed to by prio_head in stream out is not released.\n\nThe memory leak information is as follows:\n unreferenced object 0xffff88801fe79f80 (size 64):\n   comm \"sctp_repo\", pid 7957, jiffies 4294951704 (age 36.480s)\n   hex dump (first 32 bytes):\n     80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff  ................\n     90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff  ................\n   backtrace:\n     [\u003cffffffff81b215c6\u003e] kmalloc_trace+0x26/0x60\n     [\u003cffffffff88ae517c\u003e] sctp_sched_prio_set+0x4cc/0x770\n     [\u003cffffffff88ad64f2\u003e] sctp_stream_init_ext+0xd2/0x1b0\n     [\u003cffffffff88aa2604\u003e] sctp_sendmsg_to_asoc+0x1614/0x1a30\n     [\u003cffffffff88ab7ff1\u003e] sctp_sendmsg+0xda1/0x1ef0\n     [\u003cffffffff87f765ed\u003e] inet_sendmsg+0x9d/0xe0\n     [\u003cffffffff8754b5b3\u003e] sock_sendmsg+0xd3/0x120\n     [\u003cffffffff8755446a\u003e] __sys_sendto+0x23a/0x340\n     [\u003cffffffff87554651\u003e] __x64_sys_sendto+0xe1/0x1b0\n     [\u003cffffffff89978b49\u003e] do_syscall_64+0x39/0xb0\n     [\u003cffffffff89a0008b\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "033eb71c-6cd3-46a8-85e7-e98519717a88",
      "id": "CVE-2022-49741",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n  comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n  hex dump (first 32 bytes):\n    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............\n    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................\n  backtrace:\n    [\u003cffffffff814c99a0\u003e] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n    [\u003cffffffff824d219c\u003e] kmalloc include/linux/slab.h:553 [inline]\n    [\u003cffffffff824d219c\u003e] kzalloc include/linux/slab.h:689 [inline]\n    [\u003cffffffff824d219c\u003e] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n    [\u003cffffffff824d219c\u003e] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n    [\u003cffffffff82d17927\u003e] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [\u003cffffffff82712f0d\u003e] call_driver_probe drivers/base/dd.c:560 [inline]\n    [\u003cffffffff82712f0d\u003e] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [\u003cffffffff8271322f\u003e] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n    [\u003cffffffff827132da\u003e] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n    [\u003cffffffff82713c27\u003e] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n    [\u003cffffffff82710137\u003e] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n    [\u003cffffffff827136b5\u003e] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n    [\u003cffffffff82711d36\u003e] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n    [\u003cffffffff8270e242\u003e] device_add+0x642/0xdc0 drivers/base/core.c:3517\n    [\u003cffffffff82d14d5f\u003e] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n    [\u003cffffffff82d2576c\u003e] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [\u003cffffffff82d16ffc\u003e] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [\u003cffffffff82712f0d\u003e] call_driver_probe drivers/base/dd.c:560 [inline]\n    [\u003cffffffff82712f0d\u003e] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [\u003cffffffff8271322f\u003e] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa13e5b3-b62b-4b44-932f-f81c6d2a9632",
      "id": "CVE-2022-49015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: Fix potential use-after-free\n\nThe skb is delivered to netif_rx() which may free it, after calling this,\ndereferencing skb may trigger use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "60198a27-5941-4556-b4ae-22045f001f88",
      "id": "CVE-2022-49092",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix route with nexthop object delete warning\n\nFRR folks have hit a kernel warning[1] while deleting routes[2] which is\ncaused by trying to delete a route pointing to a nexthop id without\nspecifying nhid but matching on an interface. That is, a route is found\nbut we hit a warning while matching it. The warning is from\nfib_info_nh() in include/net/nexthop.h because we run it on a fib_info\nwith nexthop object. The call chain is:\n inet_rtm_delroute -\u003e fib_table_delete -\u003e fib_nh_match (called with a\nnexthop fib_info and also with fc_oif set thus calling fib_info_nh on\nthe fib_info and triggering the warning). The fix is to not do any\nmatching in that branch if the fi has a nexthop object because those are\nmanaged separately. I.e. we should match when deleting without nh spec and\nshould fail when deleting a nexthop route with old-style nh spec because\nnexthop objects are managed separately, e.g.:\n $ ip r show 1.2.3.4/32\n 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0\n\n $ ip r del 1.2.3.4/32\n $ ip r del 1.2.3.4/32 nhid 12\n \u003cboth should work\u003e\n\n $ ip r del 1.2.3.4/32 dev dummy0\n \u003cshould fail with ESRCH\u003e\n\n[1]\n [  523.462226] ------------[ cut here ]------------\n [  523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460\n [  523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep binfmt_misc xfs vfat fat squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(POE) intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm snd_hda_intel edac_mce_amd\n [  523.462274]  videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi bluetooth snd_usb_audio snd_hda_codec mac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd snd_rawmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc snd_pcm kvm iwlwifi snd_timer drm_kms_helper snd cfg80211 cec soundcore irqbypass rapl wmi_bmof i2c_piix4 rfkill k10temp pcspkr acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core wmi ipmi_devintf ipmi_msghandler fuse\n [  523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P           OE     5.16.18-200.fc35.x86_64 #1\n [  523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/MPG X570 GAMING EDGE WIFI (MS-7C37), BIOS 1.C0 10/29/2020\n [  523.462303] RIP: 0010:fib_nh_match+0x210/0x460\n [  523.462304] Code: 7c 24 20 48 8b b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff ff ff \u003c0f\u003e 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00\n [  523.462306] RSP: 0018:ffffaa53d4d87928 EFLAGS: 00010286\n [  523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX: ffffaa53d4d87bb0\n [  523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff920ed380\n [  523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000000000\n [  523.462310] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000031\n [  523.462310] R13: 0000000000000020 R14: 0000000000000000 R15: ffff9e3d331054e0\n [  523.462311] FS:  00007f2455\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4e49bfdf-6933-4362-84d8-2ed9237ae30b",
      "id": "CVE-2022-49168",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not clean up repair bio if submit fails\n\nThe submit helper will always run bio_endio() on the bio if it fails to\nsubmit, so cleaning up the bio just leads to a variety of use-after-free\nand NULL pointer dereference bugs because we race with the endio\nfunction that is cleaning up the bio.  Instead just return BLK_STS_OK as\nthe repair function has to continue to process the rest of the pages,\nand the endio for the repair bio will do the appropriate cleanup for the\npage that it was given.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "314138af-9992-4b74-a4ed-ea988041647a",
      "id": "CVE-2022-49235",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath9k_htc: fix uninit value bugs\n\nSyzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing\nfield initialization.\n\nIn htc_connect_service() svc_meta_len and pad are not initialized. Based\non code it looks like in current skb there is no service data, so simply\ninitialize svc_meta_len to 0.\n\nhtc_issue_send() does not initialize htc_frame_hdr::control array. Based\non firmware code, it will initialize it by itself, so simply zero whole\narray to make KMSAN happy\n\nFail logs:\n\nBUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430\n usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430\n hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]\n hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479\n htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]\n htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275\n...\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974\n kmalloc_reserve net/core/skbuff.c:354 [inline]\n __alloc_skb+0x545/0xf90 net/core/skbuff.c:426\n alloc_skb include/linux/skbuff.h:1126 [inline]\n htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258\n...\n\nBytes 4-7 of 18 are uninitialized\nMemory access of size 18 starts at ffff888027377e00\n\nBUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430\n usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430\n hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]\n hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479\n htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]\n htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275\n...\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974\n kmalloc_reserve net/core/skbuff.c:354 [inline]\n __alloc_skb+0x545/0xf90 net/core/skbuff.c:426\n alloc_skb include/linux/skbuff.h:1126 [inline]\n htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258\n...\n\nBytes 16-17 of 18 are uninitialized\nMemory access of size 18 starts at ffff888027377e00",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cdcf709b-bd46-46e4-9bec-e8d8914d9b0f",
      "id": "CVE-2022-49255",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix missing free nid in f2fs_handle_failed_inode\n\nThis patch fixes xfstests/generic/475 failure.\n\n[  293.680694] F2FS-fs (dm-1): May loss orphan inode, run fsck to fix.\n[  293.685358] Buffer I/O error on dev dm-1, logical block 8388592, async page read\n[  293.691527] Buffer I/O error on dev dm-1, logical block 8388592, async page read\n[  293.691764] sh (7615): drop_caches: 3\n[  293.691819] sh (7616): drop_caches: 3\n[  293.694017] Buffer I/O error on dev dm-1, logical block 1, async page read\n[  293.695659] sh (7618): drop_caches: 3\n[  293.696979] sh (7617): drop_caches: 3\n[  293.700290] sh (7623): drop_caches: 3\n[  293.708621] sh (7626): drop_caches: 3\n[  293.711386] sh (7628): drop_caches: 3\n[  293.711825] sh (7627): drop_caches: 3\n[  293.716738] sh (7630): drop_caches: 3\n[  293.719613] sh (7632): drop_caches: 3\n[  293.720971] sh (7633): drop_caches: 3\n[  293.727741] sh (7634): drop_caches: 3\n[  293.730783] sh (7636): drop_caches: 3\n[  293.732681] sh (7635): drop_caches: 3\n[  293.732988] sh (7637): drop_caches: 3\n[  293.738836] sh (7639): drop_caches: 3\n[  293.740568] sh (7641): drop_caches: 3\n[  293.743053] sh (7640): drop_caches: 3\n[  293.821889] ------------[ cut here ]------------\n[  293.824654] kernel BUG at fs/f2fs/node.c:3334!\n[  293.826226] invalid opcode: 0000 [#1] PREEMPT SMP PTI\n[  293.828713] CPU: 0 PID: 7653 Comm: umount Tainted: G           OE     5.17.0-rc1-custom #1\n[  293.830946] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n[  293.832526] RIP: 0010:f2fs_destroy_node_manager+0x33f/0x350 [f2fs]\n[  293.833905] Code: e8 d6 3d f9 f9 48 8b 45 d0 65 48 2b 04 25 28 00 00 00 75 1a 48 81 c4 28 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b\n[  293.837783] RSP: 0018:ffffb04ec31e7a20 EFLAGS: 00010202\n[  293.839062] RAX: 0000000000000001 RBX: ffff9df947db2eb8 RCX: 0000000080aa0072\n[  293.840666] RDX: 0000000000000000 RSI: ffffe86c0432a140 RDI: ffffffffc0b72a21\n[  293.842261] RBP: ffffb04ec31e7d70 R08: ffff9df94ca85780 R09: 0000000080aa0072\n[  293.843909] R10: ffff9df94ca85700 R11: ffff9df94e1ccf58 R12: ffff9df947db2e00\n[  293.845594] R13: ffff9df947db2ed0 R14: ffff9df947db2eb8 R15: ffff9df947db2eb8\n[  293.847855] FS:  00007f5a97379800(0000) GS:ffff9dfa77c00000(0000) knlGS:0000000000000000\n[  293.850647] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  293.852940] CR2: 00007f5a97528730 CR3: 000000010bc76005 CR4: 0000000000370ef0\n[  293.854680] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  293.856423] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  293.858380] Call Trace:\n[  293.859302]  \u003cTASK\u003e\n[  293.860311]  ? ttwu_do_wakeup+0x1c/0x170\n[  293.861800]  ? ttwu_do_activate+0x6d/0xb0\n[  293.863057]  ? _raw_spin_unlock_irqrestore+0x29/0x40\n[  293.864411]  ? try_to_wake_up+0x9d/0x5e0\n[  293.865618]  ? debug_smp_processor_id+0x17/0x20\n[  293.866934]  ? debug_smp_processor_id+0x17/0x20\n[  293.868223]  ? free_unref_page+0xbf/0x120\n[  293.869470]  ? __free_slab+0xcb/0x1c0\n[  293.870614]  ? preempt_count_add+0x7a/0xc0\n[  293.871811]  ? __slab_free+0xa0/0x2d0\n[  293.872918]  ? __wake_up_common_lock+0x8a/0xc0\n[  293.874186]  ? __slab_free+0xa0/0x2d0\n[  293.875305]  ? free_inode_nonrcu+0x20/0x20\n[  293.876466]  ? free_inode_nonrcu+0x20/0x20\n[  293.877650]  ? debug_smp_processor_id+0x17/0x20\n[  293.878949]  ? call_rcu+0x11a/0x240\n[  293.880060]  ? f2fs_destroy_stats+0x59/0x60 [f2fs]\n[  293.881437]  ? kfree+0x1fe/0x230\n[  293.882674]  f2fs_put_super+0x160/0x390 [f2fs]\n[  293.883978]  generic_shutdown_super+0x7a/0x120\n[  293.885274]  kill_block_super+0x27/0x50\n[  293.886496]  kill_f2fs_super+0x7f/0x100 [f2fs]\n[  293.887806]  deactivate_locked_super+0x35/0xa0\n[  293.889271]  deactivate_super+0x40/0x50\n[  293.890513]  cleanup_mnt+0x139/0x190\n[  293.891689]  __cleanup_mnt+0x12/0x20\n[  293.892850]  task_work_run+0x64/0xa0\n[  293.894035]  exit_to_user_mode_prepare+0x1b7/\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c4351826-da2d-463e-9ff9-1a8dea7a822a",
      "id": "CVE-2022-49268",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM\n\nDo not call snd_dma_free_pages() when snd_dma_alloc_pages() returns\n-ENOMEM because it leads to a NULL pointer dereference bug.\n\nThe dmesg says:\n\n  [ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12\n  [ T1387] BUG: kernel NULL pointer dereference, address: 0000000000000000\n  [ T1387] #PF: supervisor read access in kernel mode\n  [ T1387] #PF: error_code(0x0000) - not-present page\n  [ T1387] PGD 0 P4D 0\n  [ T1387] Oops: 0000 [#1] PREEMPT SMP NOPTI\n  [ T1387] CPU: 6 PID: 1387 Comm: alsa-sink-HDA A Tainted: G        W         5.17.0-rc4-superb-owl-00055-g80d47f5de5e3\n  [ T1387] Hardware name: HP HP Laptop 14s-dq2xxx/87FD, BIOS F.15 09/15/2021\n  [ T1387] RIP: 0010:dma_free_noncontiguous+0x37/0x80\n  [ T1387] Code: [... snip ...]\n  [ T1387] RSP: 0000:ffffc90002b87770 EFLAGS: 00010246\n  [ T1387] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  [ T1387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888101db30d0\n  [ T1387] RBP: 00000000fffffff4 R08: 0000000000000000 R09: 0000000000000000\n  [ T1387] R10: 0000000000000000 R11: ffffc90002b874d0 R12: 0000000000000001\n  [ T1387] R13: 0000000000058000 R14: ffff888105260c68 R15: ffff888105260828\n  [ T1387] FS:  00007f42e2ffd640(0000) GS:ffff888466b80000(0000) knlGS:0000000000000000\n  [ T1387] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [ T1387] CR2: 0000000000000000 CR3: 000000014acf0003 CR4: 0000000000770ee0\n  [ T1387] PKRU: 55555554\n  [ T1387] Call Trace:\n  [ T1387]  \u003cTASK\u003e\n  [ T1387]  cl_stream_prepare+0x10a/0x120 [snd_sof_intel_hda_common 146addf995b9279ae7f509621078cccbe4f875e1]\n  [... snip ...]\n  [ T1387]  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "417efde5-7021-4bb9-9fe2-cc50a66deb8e",
      "id": "CVE-2022-49363",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on block address in f2fs_do_zero_range()\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215894\n\nI have encountered a bug in F2FS file system in kernel v5.17.\n\nI have uploaded the system call sequence as case.c, and a fuzzed image can\nbe found in google net disk\n\nThe kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can\nreproduce the bug by running the following commands:\n\nkernel BUG at fs/f2fs/segment.c:2291!\nCall Trace:\n f2fs_invalidate_blocks+0x193/0x2d0\n f2fs_fallocate+0x2593/0x4a70\n vfs_fallocate+0x2a5/0xac0\n ksys_fallocate+0x35/0x70\n __x64_sys_fallocate+0x8e/0xf0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is, after image was fuzzed, block mapping info in inode\nwill be inconsistent with SIT table, so in f2fs_fallocate(), it will cause\npanic when updating SIT with invalid blkaddr.\n\nLet's fix the issue by adding sanity check on block address before updating\nSIT table with it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a36fef5a-ce8e-4236-8a13-7cfa3862e1be",
      "id": "CVE-2022-49428",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on inline_dots inode\n\nAs Wenqing reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215765\n\nIt will cause a kernel panic with steps:\n- mkdir mnt\n- mount tmp40.img mnt\n- ls mnt\n\nfolio_mark_dirty+0x33/0x50\nf2fs_add_regular_entry+0x541/0xad0 [f2fs]\nf2fs_add_dentry+0x6c/0xb0 [f2fs]\nf2fs_do_add_link+0x182/0x230 [f2fs]\n__recover_dot_dentries+0x2d6/0x470 [f2fs]\nf2fs_lookup+0x5af/0x6a0 [f2fs]\n__lookup_slow+0xac/0x200\nlookup_slow+0x45/0x70\nwalk_component+0x16c/0x250\npath_lookupat+0x8b/0x1f0\nfilename_lookup+0xef/0x250\nuser_path_at_empty+0x46/0x70\nvfs_statx+0x98/0x190\n__do_sys_newlstat+0x41/0x90\n__x64_sys_newlstat+0x1a/0x30\ndo_syscall_64+0x37/0xb0\nentry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is for special file: e.g. character, block, fifo or\nsocket file, f2fs doesn't assign address space operations pointer array\nfor mapping-\u003ea_ops field, so, in a fuzzed image, if inline_dots flag was\ntagged in special file, during lookup(), when f2fs runs into\n__recover_dot_dentries(), it will cause NULL pointer access once\nf2fs_add_regular_entry() calls a_ops-\u003eset_dirty_page().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2f088bb-c539-4e41-a494-5a43e579f249",
      "id": "CVE-2022-49438",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: sparcspkr - fix refcount leak in bbc_beep_probe\n\nof_find_node_by_path() calls of_find_node_opts_by_path(),\nwhich returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34987703-6621-4544-8379-fcb5cb1f2989",
      "id": "CVE-2022-49658",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals\n\nKuee reported a corner case where the tnum becomes constant after the call\nto __reg_bound_offset(), but the register's bounds are not, that is, its\nmin bounds are still not equal to the register's max bounds.\n\nThis in turn allows to leak pointers through turning a pointer register as\nis into an unknown scalar via adjust_ptr_min_max_vals().\n\nBefore:\n\n  func#0 @0\n  0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  0: (b7) r0 = 1                        ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))\n  1: (b7) r3 = 0                        ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))\n  2: (87) r3 = -r3                      ; R3_w=scalar()\n  3: (87) r3 = -r3                      ; R3_w=scalar()\n  4: (47) r3 |= 32767                   ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)\n  5: (75) if r3 s\u003e= 0x0 goto pc+1       ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  6: (95) exit\n\n  from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  7: (d5) if r3 s\u003c= 0x8000 goto pc+1    ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  8: (95) exit\n\n  from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  9: (07) r3 += -32767                  ; R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0))  \u003c--- [*]\n  10: (95) exit\n\nWhat can be seen here is that R3=scalar(umin=32767,umax=32768,var_off=(0x7fff;\n0x8000)) after the operation R3 += -32767 results in a 'malformed' constant, that\nis, R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)). Intersecting with var_off has\nnot been done at that point via __update_reg_bounds(), which would have improved\nthe umax to be equal to umin.\n\nRefactor the tnum \u003c\u003e min/max bounds information flow into a reg_bounds_sync()\nhelper and use it consistently everywhere. After the fix, bounds have been\ncorrected to R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) and thus the register\nis regarded as a 'proper' constant scalar of 0.\n\nAfter:\n\n  func#0 @0\n  0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  0: (b7) r0 = 1                        ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))\n  1: (b7) r3 = 0                        ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))\n  2: (87) r3 = -r3                      ; R3_w=scalar()\n  3: (87) r3 = -r3                      ; R3_w=scalar()\n  4: (47) r3 |= 32767                   ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)\n  5: (75) if r3 s\u003e= 0x0 goto pc+1       ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  6: (95) exit\n\n  from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  7: (d5) if r3 s\u003c= 0x8000 goto pc+1    ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  8: (95) exit\n\n  from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92564ba3-132e-4a50-9527-835c08591b89",
      "id": "CVE-2022-49729",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred\n\nSimilar to the handling of play_deferred in commit 19cfe912c37b\n(\"Bluetooth: btusb: Fix memory leak in play_deferred\"), we thought\na patch might be needed here as well.\n\nCurrently usb_submit_urb is called directly to submit deferred tx\nurbs after unanchor them.\n\nSo the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb\nand cause memory leak.\n\nPut those urbs in tx_anchor to avoid the leak, and also fix the error\nhandling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58baf0b4-d685-4d2c-9ed4-b93f519d22d9",
      "id": "CVE-2022-49749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: designware: use casting of u64 in clock multiplication to avoid overflow\n\nIn functions i2c_dw_scl_lcnt() and i2c_dw_scl_hcnt() may have overflow\nby depending on the values of the given parameters including the ic_clk.\nFor example in our use case where ic_clk is larger than one million,\nmultiplication of ic_clk * 4700 will result in 32 bit overflow.\n\nAdd cast of u64 to the calculation to avoid multiplication overflow, and\nuse the corresponding define for divide.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea6cc906-7a40-40e5-b1df-7b45cccc46ad",
      "id": "CVE-2022-49775",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: cdg: allow tcp_cdg_release() to be called multiple times\n\nApparently, mptcp is able to call tcp_disconnect() on an already\ndisconnected flow. This is generally fine, unless current congestion\ncontrol is CDG, because it might trigger a double-free [1]\n\nInstead of fixing MPTCP, and future bugs, we can make tcp_disconnect()\nmore resilient.\n\n[1]\nBUG: KASAN: double-free in slab_free mm/slub.c:3539 [inline]\nBUG: KASAN: double-free in kfree+0xe2/0x580 mm/slub.c:4567\n\nCPU: 0 PID: 3645 Comm: kworker/0:7 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\nWorkqueue: events mptcp_worker\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\nprint_address_description mm/kasan/report.c:317 [inline]\nprint_report.cold+0x2ba/0x719 mm/kasan/report.c:433\nkasan_report_invalid_free+0x81/0x190 mm/kasan/report.c:462\n____kasan_slab_free+0x18b/0x1c0 mm/kasan/common.c:356\nkasan_slab_free include/linux/kasan.h:200 [inline]\nslab_free_hook mm/slub.c:1759 [inline]\nslab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785\nslab_free mm/slub.c:3539 [inline]\nkfree+0xe2/0x580 mm/slub.c:4567\ntcp_disconnect+0x980/0x1e20 net/ipv4/tcp.c:3145\n__mptcp_close_ssk+0x5ca/0x7e0 net/mptcp/protocol.c:2327\nmptcp_do_fastclose net/mptcp/protocol.c:2592 [inline]\nmptcp_worker+0x78c/0xff0 net/mptcp/protocol.c:2627\nprocess_one_work+0x991/0x1610 kernel/workqueue.c:2289\nworker_thread+0x665/0x1080 kernel/workqueue.c:2436\nkthread+0x2e4/0x3a0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\u003c/TASK\u003e\n\nAllocated by task 3671:\nkasan_save_stack+0x1e/0x40 mm/kasan/common.c:38\nkasan_set_track mm/kasan/common.c:45 [inline]\nset_alloc_info mm/kasan/common.c:437 [inline]\n____kasan_kmalloc mm/kasan/common.c:516 [inline]\n____kasan_kmalloc mm/kasan/common.c:475 [inline]\n__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525\nkmalloc_array include/linux/slab.h:640 [inline]\nkcalloc include/linux/slab.h:671 [inline]\ntcp_cdg_init+0x10d/0x170 net/ipv4/tcp_cdg.c:380\ntcp_init_congestion_control+0xab/0x550 net/ipv4/tcp_cong.c:193\ntcp_reinit_congestion_control net/ipv4/tcp_cong.c:217 [inline]\ntcp_set_congestion_control+0x96c/0xaa0 net/ipv4/tcp_cong.c:391\ndo_tcp_setsockopt+0x505/0x2320 net/ipv4/tcp.c:3513\ntcp_setsockopt+0xd4/0x100 net/ipv4/tcp.c:3801\nmptcp_setsockopt+0x35f/0x2570 net/mptcp/sockopt.c:844\n__sys_setsockopt+0x2d6/0x690 net/socket.c:2252\n__do_sys_setsockopt net/socket.c:2263 [inline]\n__se_sys_setsockopt net/socket.c:2260 [inline]\n__x64_sys_setsockopt+0xba/0x150 net/socket.c:2260\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nFreed by task 16:\nkasan_save_stack+0x1e/0x40 mm/kasan/common.c:38\nkasan_set_track+0x21/0x30 mm/kasan/common.c:45\nkasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370\n____kasan_slab_free mm/kasan/common.c:367 [inline]\n____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329\nkasan_slab_free include/linux/kasan.h:200 [inline]\nslab_free_hook mm/slub.c:1759 [inline]\nslab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1785\nslab_free mm/slub.c:3539 [inline]\nkfree+0xe2/0x580 mm/slub.c:4567\ntcp_cleanup_congestion_control+0x70/0x120 net/ipv4/tcp_cong.c:226\ntcp_v4_destroy_sock+0xdd/0x750 net/ipv4/tcp_ipv4.c:2254\ntcp_v6_destroy_sock+0x11/0x20 net/ipv6/tcp_ipv6.c:1969\ninet_csk_destroy_sock+0x196/0x440 net/ipv4/inet_connection_sock.c:1157\ntcp_done+0x23b/0x340 net/ipv4/tcp.c:4649\ntcp_rcv_state_process+0x40e7/0x4990 net/ipv4/tcp_input.c:6624\ntcp_v6_do_rcv+0x3fc/0x13c0 net/ipv6/tcp_ipv6.c:1525\ntcp_v6_rcv+0x2e8e/0x3830 net/ipv6/tcp_ipv6.c:1759\nip6_protocol_deliver_rcu+0x2db/0x1950 net/ipv6/ip6_input.c:439\nip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:484\nNF_HOOK include/linux/netfilter.h:302 [inline]\nNF_HOOK include/linux/netfilter.h:296 [inline]\nip6_input+0x9c/0xd\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c2ee79f-07e0-4380-93d8-190a94bc9194",
      "id": "CVE-2022-49823",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-transport: fix error handling in ata_tdev_add()\n\nIn ata_tdev_add(), the return value of transport_add_device() is\nnot checked. As a result, it causes null-ptr-deref while removing\nthe module, because transport_remove_device() is called to remove\nthe device that was not added.\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000d0\nCPU: 13 PID: 13603 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc3+ #36\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : device_del+0x48/0x3a0\nlr : device_del+0x44/0x3a0\nCall trace:\n device_del+0x48/0x3a0\n attribute_container_class_device_del+0x28/0x40\n transport_remove_classdev+0x60/0x7c\n attribute_container_device_trigger+0x118/0x120\n transport_remove_device+0x20/0x30\n ata_tdev_delete+0x24/0x50 [libata]\n ata_tlink_delete+0x40/0xa0 [libata]\n ata_tport_delete+0x2c/0x60 [libata]\n ata_port_detach+0x148/0x1b0 [libata]\n ata_pci_remove_one+0x50/0x80 [libata]\n ahci_remove_one+0x4c/0x8c [ahci]\n\nFix this by checking and handling return value of transport_add_device()\nin ata_tdev_add(). In the error path, device_del() is called to delete\nthe device which was added earlier in this function, and ata_tdev_free()\nis called to free ata_dev.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ce0c965-a73d-407e-829e-2e6cdc7d1f70",
      "id": "CVE-2022-50009",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix null-ptr-deref in f2fs_get_dnode_of_data\n\nThere is issue as follows when test f2fs atomic write:\nF2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock\nF2FS-fs (loop0): invalid crc_offset: 0\nF2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.\nF2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.\n==================================================================\nBUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0\nRead of size 8 at addr 0000000000000028 by task rep/1990\n\nCPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6e/0x91\n print_report.cold+0x49a/0x6bb\n kasan_report+0xa8/0x130\n f2fs_get_dnode_of_data+0xac/0x16d0\n f2fs_do_write_data_page+0x2a5/0x1030\n move_data_page+0x3c5/0xdf0\n do_garbage_collect+0x2015/0x36c0\n f2fs_gc+0x554/0x1d30\n f2fs_balance_fs+0x7f5/0xda0\n f2fs_write_single_data_page+0xb66/0xdc0\n f2fs_write_cache_pages+0x716/0x1420\n f2fs_write_data_pages+0x84f/0x9a0\n do_writepages+0x130/0x3a0\n filemap_fdatawrite_wbc+0x87/0xa0\n file_write_and_wait_range+0x157/0x1c0\n f2fs_do_sync_file+0x206/0x12d0\n f2fs_sync_file+0x99/0xc0\n vfs_fsync_range+0x75/0x140\n f2fs_file_write_iter+0xd7b/0x1850\n vfs_write+0x645/0x780\n ksys_write+0xf1/0x1e0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAs 3db1de0e582c commit changed atomic write way which new a cow_inode for\natomic write file, and also mark cow_inode as FI_ATOMIC_FILE.\nWhen f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode\nwhich is NULL. Then will trigger null-ptr-deref.\nTo solve above issue, introduce FI_COW_FILE flag for COW inode.\n\nFiexes: 3db1de0e582c(\"f2fs: change the current atomic write way\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89de5bf6-4eb0-4a55-ba72-43a1b34a22f9",
      "id": "CVE-2022-50036",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sun4i: dsi: Prevent underflow when computing packet sizes\n\nCurrently, the packet overhead is subtracted using unsigned arithmetic.\nWith a short sync pulse, this could underflow and wrap around to near\nthe maximal u16 value. Fix this by using signed subtraction. The call to\nmax() will correctly handle any negative numbers that are produced.\n\nApply the same fix to the other timings, even though those subtractions\nare less likely to underflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5902f03-277b-4208-b30c-94fb38d58300",
      "id": "CVE-2022-50074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix memleak in aa_simple_write_to_buffer()\n\nWhen copy_from_user failed, the memory is freed by kvfree. however the\nmanagement struct and data blob are allocated independently, so only\nkvfree(data) cause a memleak issue here. Use aa_put_loaddata(data) to\nfix this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc94210b-a0be-432a-9c29-3226393a107c",
      "id": "CVE-2022-50162",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: Fix possible refcount leak in if_usb_probe()\n\nusb_get_dev will be called before lbs_get_firmware_async which means that\nusb_put_dev need to be called when lbs_get_firmware_async fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "404ccaa3-b722-4e29-a2d7-76f8a3391a79",
      "id": "CVE-2022-50244",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()\n\nIf device_register() fails in cxl_pci_afu|adapter(), the device\nis not added, device_unregister() can not be called in the error\npath, otherwise it will cause a null-ptr-deref because of removing\nnot added device.\n\nAs comment of device_register() says, it should use put_device() to give\nup the reference in the error path. So split device_unregister() into\ndevice_del() and put_device(), then goes to put dev when register fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "044057eb-c841-42c9-8260-00bf4bc9185a",
      "id": "CVE-2022-50299",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Replace snprintf with scnprintf\n\nCurrent code produces a warning as shown below when total characters\nin the constituent block device names plus the slashes exceeds 200.\nsnprintf() returns the number of characters generated from the given\ninput, which could cause the expression “200 – len” to wrap around\nto a large positive number. Fix this by using scnprintf() instead,\nwhich returns the actual number of characters written into the buffer.\n\n[ 1513.267938] ------------[ cut here ]------------\n[ 1513.267943] WARNING: CPU: 15 PID: 37247 at \u003csnip\u003e/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510\n[ 1513.267944] Modules linked in:  \u003csnip\u003e\n[ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu\n[ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022\n[ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510\n\u003c-snip-\u003e\n[ 1513.267982] Call Trace:\n[ 1513.267986]  snprintf+0x45/0x70\n[ 1513.267990]  ? disk_name+0x71/0xa0\n[ 1513.267993]  dump_zones+0x114/0x240 [raid0]\n[ 1513.267996]  ? _cond_resched+0x19/0x40\n[ 1513.267998]  raid0_run+0x19e/0x270 [raid0]\n[ 1513.268000]  md_run+0x5e0/0xc50\n[ 1513.268003]  ? security_capable+0x3f/0x60\n[ 1513.268005]  do_md_run+0x19/0x110\n[ 1513.268006]  md_ioctl+0x195e/0x1f90\n[ 1513.268007]  blkdev_ioctl+0x91f/0x9f0\n[ 1513.268010]  block_ioctl+0x3d/0x50\n[ 1513.268012]  do_vfs_ioctl+0xa9/0x640\n[ 1513.268014]  ? __fput+0x162/0x260\n[ 1513.268016]  ksys_ioctl+0x75/0x80\n[ 1513.268017]  __x64_sys_ioctl+0x1a/0x20\n[ 1513.268019]  do_syscall_64+0x5e/0x200\n[ 1513.268021]  entry_SYSCALL_64_after_hwframe+0x44/0xa9",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6fa0f0fb-5d06-495d-8799-dec02c0879b6",
      "id": "CVE-2022-50408",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()\n\n\u003e ret = brcmf_proto_tx_queue_data(drvr, ifp-\u003eifidx, skb);\n\nmay be schedule, and then complete before the line\n\n\u003e ndev-\u003estats.tx_bytes += skb-\u003elen;\n\n[   46.912801] ==================================================================\n[   46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328\n[   46.935991]\n[   46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G           O      5.4.199-[REDACTED] #1\n[   46.947255] Hardware name: [REDACTED]\n[   46.954568] Call trace:\n[   46.957037]  dump_backtrace+0x0/0x2b8\n[   46.960719]  show_stack+0x24/0x30\n[   46.964052]  dump_stack+0x128/0x194\n[   46.967557]  print_address_description.isra.0+0x64/0x380\n[   46.972877]  __kasan_report+0x1d4/0x240\n[   46.976723]  kasan_report+0xc/0x18\n[   46.980138]  __asan_report_load4_noabort+0x18/0x20\n[   46.985027]  brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.990613]  dev_hard_start_xmit+0x1bc/0xda0\n[   46.994894]  sch_direct_xmit+0x198/0xd08\n[   46.998827]  __qdisc_run+0x37c/0x1dc0\n[   47.002500]  __dev_queue_xmit+0x1528/0x21f8\n[   47.006692]  dev_queue_xmit+0x24/0x30\n[   47.010366]  neigh_resolve_output+0x37c/0x678\n[   47.014734]  ip_finish_output2+0x598/0x2458\n[   47.018927]  __ip_finish_output+0x300/0x730\n[   47.023118]  ip_output+0x2e0/0x430\n[   47.026530]  ip_local_out+0x90/0x140\n[   47.030117]  igmpv3_sendpack+0x14c/0x228\n[   47.034049]  igmpv3_send_cr+0x384/0x6b8\n[   47.037895]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.042262]  call_timer_fn+0x1cc/0xbe8\n[   47.046021]  __run_timers+0x4d8/0xb28\n[   47.049693]  run_timer_softirq+0x24/0x40\n[   47.053626]  __do_softirq+0x2c0/0x117c\n[   47.057387]  irq_exit+0x2dc/0x388\n[   47.060715]  __handle_domain_irq+0xb4/0x158\n[   47.064908]  gic_handle_irq+0x58/0xb0\n[   47.068581]  el0_irq_naked+0x50/0x5c\n[   47.072162]\n[   47.073665] Allocated by task 328:\n[   47.077083]  save_stack+0x24/0xb0\n[   47.080410]  __kasan_kmalloc.isra.0+0xc0/0xe0\n[   47.084776]  kasan_slab_alloc+0x14/0x20\n[   47.088622]  kmem_cache_alloc+0x15c/0x468\n[   47.092643]  __alloc_skb+0xa4/0x498\n[   47.096142]  igmpv3_newpack+0x158/0xd78\n[   47.099987]  add_grhead+0x210/0x288\n[   47.103485]  add_grec+0x6b0/0xb70\n[   47.106811]  igmpv3_send_cr+0x2e0/0x6b8\n[   47.110657]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.115027]  call_timer_fn+0x1cc/0xbe8\n[   47.118785]  __run_timers+0x4d8/0xb28\n[   47.122457]  run_timer_softirq+0x24/0x40\n[   47.126389]  __do_softirq+0x2c0/0x117c\n[   47.130142]\n[   47.131643] Freed by task 180:\n[   47.134712]  save_stack+0x24/0xb0\n[   47.138041]  __kasan_slab_free+0x108/0x180\n[   47.142146]  kasan_slab_free+0x10/0x18\n[   47.145904]  slab_free_freelist_hook+0xa4/0x1b0\n[   47.150444]  kmem_cache_free+0x8c/0x528\n[   47.154292]  kfree_skbmem+0x94/0x108\n[   47.157880]  consume_skb+0x10c/0x5a8\n[   47.161466]  __dev_kfree_skb_any+0x88/0xa0\n[   47.165598]  brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil]\n[   47.171023]  brcmf_txfinalize+0xec/0x190 [brcmfmac]\n[   47.176016]  brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac]\n[   47.182056]  brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac]\n[   47.187568]  brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac]\n[   47.192529]  brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac]\n[   47.197859]  process_one_work+0x7fc/0x1a80\n[   47.201965]  worker_thread+0x31c/0xc40\n[   47.205726]  kthread+0x2d8/0x370\n[   47.208967]  ret_from_fork+0x10/0x18\n[   47.212546]\n[   47.214051] The buggy address belongs to the object at ffffff803f588280\n[   47.214051]  which belongs to the cache skbuff_head_cache of size 208\n[   47.227086] The buggy address is located 104 bytes inside of\n[   47.227086]  208-byte region [ffffff803f588280, ffffff803f588350)\n[   47.238814] The buggy address belongs to the page:\n[   47.243618] page:ffffffff00dd6200 refcount:1 mapcou\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6017cf7-7b1f-47cb-ba06-06c91d9a8a3b",
      "id": "CVE-2023-51781",
      "description": "An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1909f90-93a7-4adc-94ca-3ad3ef773bee",
      "id": "CVE-2023-52591",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nreiserfs: Avoid touching renamed directory if parent does not change\n\nThe VFS will not be locking moved directory if its parent does not\nchange. Change reiserfs rename code to avoid touching renamed directory\nif its parent does not change as without locking that can corrupt the\nfilesystem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc365a58-847a-47b7-88b7-5fa083c4452b",
      "id": "CVE-2023-52766",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler\n\nDo not loop over ring headers in hci_dma_irq_handler() that are not\nallocated and enabled in hci_dma_init(). Otherwise out of bounds access\nwill occur from rings-\u003eheaders[i] access when i \u003e= number of allocated\nring headers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd107f9d-1b55-4ef3-881b-5844a6fd5b84",
      "id": "CVE-2023-52875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data\n\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b42af6de-8b06-4339-bb4f-31a4a13cc9e3",
      "id": "CVE-2023-52885",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix UAF in svc_tcp_listen_data_ready()\n\nAfter the listener svc_sock is freed, and before invoking svc_tcp_accept()\nfor the established child sock, there is a window that the newsock\nretaining a freed listener svc_sock in sk_user_data which cloning from\nparent. In the race window, if data is received on the newsock, we will\nobserve use-after-free report in svc_tcp_listen_data_ready().\n\nReproduce by two tasks:\n\n1. while :; do rpc.nfsd 0 ; rpc.nfsd; done\n2. while :; do echo \"\" | ncat -4 127.0.0.1 2049 ; done\n\nKASAN report:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]\n  Read of size 8 at addr ffff888139d96228 by task nc/102553\n  CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18\n  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n  Call Trace:\n   \u003cIRQ\u003e\n   dump_stack_lvl+0x33/0x50\n   print_address_description.constprop.0+0x27/0x310\n   print_report+0x3e/0x70\n   kasan_report+0xae/0xe0\n   svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]\n   tcp_data_queue+0x9f4/0x20e0\n   tcp_rcv_established+0x666/0x1f60\n   tcp_v4_do_rcv+0x51c/0x850\n   tcp_v4_rcv+0x23fc/0x2e80\n   ip_protocol_deliver_rcu+0x62/0x300\n   ip_local_deliver_finish+0x267/0x350\n   ip_local_deliver+0x18b/0x2d0\n   ip_rcv+0x2fb/0x370\n   __netif_receive_skb_one_core+0x166/0x1b0\n   process_backlog+0x24c/0x5e0\n   __napi_poll+0xa2/0x500\n   net_rx_action+0x854/0xc90\n   __do_softirq+0x1bb/0x5de\n   do_softirq+0xcb/0x100\n   \u003c/IRQ\u003e\n   \u003cTASK\u003e\n   ...\n   \u003c/TASK\u003e\n\n  Allocated by task 102371:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   __kasan_kmalloc+0x7b/0x90\n   svc_setup_socket+0x52/0x4f0 [sunrpc]\n   svc_addsock+0x20d/0x400 [sunrpc]\n   __write_ports_addfd+0x209/0x390 [nfsd]\n   write_ports+0x239/0x2c0 [nfsd]\n   nfsctl_transaction_write+0xac/0x110 [nfsd]\n   vfs_write+0x1c3/0xae0\n   ksys_write+0xed/0x1c0\n   do_syscall_64+0x38/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n  Freed by task 102551:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   kasan_save_free_info+0x2a/0x50\n   __kasan_slab_free+0x106/0x190\n   __kmem_cache_free+0x133/0x270\n   svc_xprt_free+0x1e2/0x350 [sunrpc]\n   svc_xprt_destroy_all+0x25a/0x440 [sunrpc]\n   nfsd_put+0x125/0x240 [nfsd]\n   nfsd_svc+0x2cb/0x3c0 [nfsd]\n   write_threads+0x1ac/0x2a0 [nfsd]\n   nfsctl_transaction_write+0xac/0x110 [nfsd]\n   vfs_write+0x1c3/0xae0\n   ksys_write+0xed/0x1c0\n   do_syscall_64+0x38/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nFix the UAF by simply doing nothing in svc_tcp_listen_data_ready()\nif state != TCP_LISTEN, that will avoid dereferencing svsk for all\nchild socket.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "882e8919-7ed6-46de-8c81-41b456e62f6f",
      "id": "CVE-2023-52889",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: Fix null pointer deref when receiving skb during sock creation\n\nThe panic below is observed when receiving ICMP packets with secmark set\nwhile an ICMP raw socket is being created. SK_CTX(sk)-\u003elabel is updated\nin apparmor_socket_post_create(), but the packet is delivered to the\nsocket before that, causing the null pointer dereference.\nDrop the packet if label context is not set.\n\n    BUG: kernel NULL pointer dereference, address: 000000000000004c\n    #PF: supervisor read access in kernel mode\n    #PF: error_code(0x0000) - not-present page\n    PGD 0 P4D 0\n    Oops: 0000 [#1] PREEMPT SMP NOPTI\n    CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df\n    Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020\n    RIP: 0010:aa_label_next_confined+0xb/0x40\n    Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 89 f0 \u003c8b\u003e 77 4c 39 c6 7e 1f 48 63 d0 48 8d 14 d7 eb 0b 83 c0 01 48 83 c2\n    RSP: 0018:ffffa92940003b08 EFLAGS: 00010246\n    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000e\n    RDX: ffffa92940003be8 RSI: 0000000000000000 RDI: 0000000000000000\n    RBP: ffff8b57471e7800 R08: ffff8b574c642400 R09: 0000000000000002\n    R10: ffffffffbd820eeb R11: ffffffffbeb7ff00 R12: ffff8b574c642400\n    R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000\n    FS:  00007fb092ea7640(0000) GS:ffff8b577bc00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 000000000000004c CR3: 00000001020f2005 CR4: 00000000007706f0\n    PKRU: 55555554\n    Call Trace:\n     \u003cIRQ\u003e\n     ? __die+0x23/0x70\n     ? page_fault_oops+0x171/0x4e0\n     ? exc_page_fault+0x7f/0x180\n     ? asm_exc_page_fault+0x26/0x30\n     ? aa_label_next_confined+0xb/0x40\n     apparmor_secmark_check+0xec/0x330\n     security_sock_rcv_skb+0x35/0x50\n     sk_filter_trim_cap+0x47/0x250\n     sock_queue_rcv_skb_reason+0x20/0x60\n     raw_rcv+0x13c/0x210\n     raw_local_deliver+0x1f3/0x250\n     ip_protocol_deliver_rcu+0x4f/0x2f0\n     ip_local_deliver_finish+0x76/0xa0\n     __netif_receive_skb_one_core+0x89/0xa0\n     netif_receive_skb+0x119/0x170\n     ? __netdev_alloc_skb+0x3d/0x140\n     vmxnet3_rq_rx_complete+0xb23/0x1010 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]\n     vmxnet3_poll_rx_only+0x36/0xb0 [vmxnet3 56a84f9c97178c57a43a24ec073b45a9d6f01f3a]\n     __napi_poll+0x28/0x1b0\n     net_rx_action+0x2a4/0x380\n     __do_softirq+0xd1/0x2c8\n     __irq_exit_rcu+0xbb/0xf0\n     common_interrupt+0x86/0xa0\n     \u003c/IRQ\u003e\n     \u003cTASK\u003e\n     asm_common_interrupt+0x26/0x40\n    RIP: 0010:apparmor_socket_post_create+0xb/0x200\n    Code: 08 48 85 ff 75 a1 eb b1 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 \u003c55\u003e 48 89 fd 53 45 85 c0 0f 84 b2 00 00 00 48 8b 1d 80 56 3f 02 48\n    RSP: 0018:ffffa92940ce7e50 EFLAGS: 00000286\n    RAX: ffffffffbc756440 RBX: 0000000000000000 RCX: 0000000000000001\n    RDX: 0000000000000003 RSI: 0000000000000002 RDI: ffff8b574eaab740\n    RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\n    R10: ffff8b57444cec70 R11: 0000000000000000 R12: 0000000000000003\n    R13: 0000000000000002 R14: ffff8b574eaab740 R15: ffffffffbd8e4748\n     ? __pfx_apparmor_socket_post_create+0x10/0x10\n     security_socket_post_create+0x4b/0x80\n     __sock_create+0x176/0x1f0\n     __sys_socket+0x89/0x100\n     __x64_sys_socket+0x17/0x20\n     do_syscall_64+0x5d/0x90\n     ? do_syscall_64+0x6c/0x90\n     ? do_syscall_64+0x6c/0x90\n     ? do_syscall_64+0x6c/0x90\n     entry_SYSCALL_64_after_hwframe+0x72/0xdc",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7dd7fc6f-8f79-4c8e-af2a-c20b04f319b6",
      "id": "CVE-2023-53053",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerspan: do not use skb_mac_header() in ndo_start_xmit()\n\nDrivers should not assume skb_mac_header(skb) == skb-\u003edata in their\nndo_start_xmit().\n\nUse skb_network_offset() and skb_transport_offset() which\nbetter describe what is needed in erspan_fb_xmit() and\nip6erspan_tunnel_xmit()\n\nsyzbot reported:\nWARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline]\nWARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962\nModules linked in:\nCPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023\nRIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline]\nRIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962\nCode: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 \u003c0f\u003e 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00\nRSP: 0018:ffffc90003b2f830 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000\nRDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003\nRBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff\nR10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00\nR13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000\nFS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\n__netdev_start_xmit include/linux/netdevice.h:4900 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4914 [inline]\n__dev_direct_xmit+0x504/0x730 net/core/dev.c:4300\ndev_direct_xmit include/linux/netdevice.h:3088 [inline]\npacket_xmit+0x20a/0x390 net/packet/af_packet.c:285\npacket_snd net/packet/af_packet.c:3075 [inline]\npacket_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107\nsock_sendmsg_nosec net/socket.c:724 [inline]\nsock_sendmsg+0xde/0x190 net/socket.c:747\n__sys_sendto+0x23a/0x340 net/socket.c:2142\n__do_sys_sendto net/socket.c:2154 [inline]\n__se_sys_sendto net/socket.c:2150 [inline]\n__x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f123aaa1039\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0\nR13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a62160f9-0b16-4661-9d96-885bf67215b6",
      "id": "CVE-2023-53143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix another off-by-one fsmap error on 1k block filesystems\n\nApparently syzbot figured out that issuing this FSMAP call:\n\nstruct fsmap_head cmd = {\n\t.fmh_count\t= ...;\n\t.fmh_keys\t= {\n\t\t{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },\n\t\t{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },\n\t},\n...\n};\nret = ioctl(fd, FS_IOC_GETFSMAP, \u0026cmd);\n\nProduces this crash if the underlying filesystem is a 1k-block ext4\nfilesystem:\n\nkernel BUG at fs/ext4/ext4.h:3331!\ninvalid opcode: 0000 [#1] PREEMPT SMP\nCPU: 3 PID: 3227965 Comm: xfs_io Tainted: G        W  O       6.2.0-rc8-achx\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]\nRSP: 0018:ffffc90007c03998 EFLAGS: 00010246\nRAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000\nRDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11\nRBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400\nR10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001\nR13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398\nFS:  00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0\nCall Trace:\n \u003cTASK\u003e\n ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]\n __x64_sys_ioctl+0x82/0xa0\n do_syscall_64+0x2b/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7fdf20558aff\nRSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff\nRDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003\nRBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010\nR13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000\n\nFor GETFSMAP calls, the caller selects a physical block device by\nwriting its block number into fsmap_head.fmh_keys[01].fmr_device.\nTo query mappings for a subrange of the device, the starting byte of the\nrange is written to fsmap_head.fmh_keys[0].fmr_physical and the last\nbyte of the range goes in fsmap_head.fmh_keys[1].fmr_physical.\n\nIOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you'd\nset the inputs as follows:\n\n\tfmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3},\n\tfmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14},\n\nWhich would return you whatever is mapped in the 12 bytes starting at\nphysical offset 3.\n\nThe crash is due to insufficient range validation of keys[1] in\next4_getfsmap_datadev.  On 1k-block filesystems, block 0 is not part of\nthe filesystem, which means that s_first_data_block is nonzero.\next4_get_group_no_and_offset subtracts this quantity from the blocknr\nargument before cracking it into a group number and a block number\nwithin a group.  IOWs, block group 0 spans blocks 1-8192 (1-based)\ninstead of 0-8191 (0-based) like what happens with larger blocksizes.\n\nThe net result of this encoding is that blocknr \u003c s_first_data_block is\nnot a valid input to this function.  The end_fsb variable is set from\nthe keys that are copied from userspace, which means that in the above\nexample, its value is zero.  That leads to an underflow here:\n\n\tblocknr = blocknr - le32_to_cpu(es-\u003es_first_data_block);\n\nThe division then operates on -1:\n\n\toffset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) \u003e\u003e\n\t\tEXT4_SB(sb)-\u003es_cluster_bits;\n\nLeaving an impossibly large group number (2^32-1) in blocknr.\next4_getfsmap_check_keys checked that keys[0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dabfdf1d-784f-4c25-aa37-511f52a3ba30",
      "id": "CVE-2023-53249",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe\n\nUse devm_of_iomap() instead of of_iomap() to automatically handle\nthe unused ioremap region.\n\nIf any error occurs, regions allocated by kzalloc() will leak,\nbut using devm_kzalloc() instead will automatically free the memory\nusing devm_kfree().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6243e7a3-463f-4ce1-b765-e394c1dee159",
      "id": "CVE-2024-49922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using them\n\n[WHAT \u0026 HOW]\nThese pointers are null checked previously in the same function,\nindicating they might be null as reported by Coverity. As a result,\nthey need to be checked when used again.\n\nThis fixes 3 FORWARD_NULL issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1fad56b-2732-44b3-a28a-c0b48c27564d",
      "id": "CVE-2023-53299",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix leak of 'r10bio-\u003eremaining' for recovery\n\nraid10_sync_request() will add 'r10bio-\u003eremaining' for both rdev and\nreplacement rdev. However, if the read io fails, recovery_request_write()\nreturns without issuing the write io, in this case, end_sync_request()\nis only called once and 'remaining' is leaked, cause an io hang.\n\nFix the problem by decreasing 'remaining' according to if 'bio' and\n'repl_bio' is valid.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f06b689-007e-4d56-a364-4e9e796e6c06",
      "id": "CVE-2023-53308",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: Better handle pm_runtime_get() failing in .remove()\n\nIn the (unlikely) event that pm_runtime_get() (disguised as\npm_runtime_resume_and_get()) fails, the remove callback returned an\nerror early. The problem with this is that the driver core ignores the\nerror value and continues removing the device. This results in a\nresource leak. Worse the devm allocated resources are freed and so if a\ncallback of the driver is called later the register mapping is already\ngone which probably results in a crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "53fe1c0d-bae5-4b70-9baf-b9a51ce2bd2f",
      "id": "CVE-2023-53383",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4\n\nThe T241 platform suffers from the T241-FABRIC-4 erratum which causes\nunexpected behavior in the GIC when multiple transactions are received\nsimultaneously from different sources. This hardware issue impacts\nNVIDIA server platforms that use more than two T241 chips\ninterconnected. Each chip has support for 320 {E}SPIs.\n\nThis issue occurs when multiple packets from different GICs are\nincorrectly interleaved at the target chip. The erratum text below\nspecifies exactly what can cause multiple transfer packets susceptible\nto interleaving and GIC state corruption. GIC state corruption can\nlead to a range of problems, including kernel panics, and unexpected\nbehavior.\n\n\u003eFrom the erratum text:\n  \"In some cases, inter-socket AXI4 Stream packets with multiple\n  transfers, may be interleaved by the fabric when presented to ARM\n  Generic Interrupt Controller. GIC expects all transfers of a packet\n  to be delivered without any interleaving.\n\n  The following GICv3 commands may result in multiple transfer packets\n  over inter-socket AXI4 Stream interface:\n   - Register reads from GICD_I* and GICD_N*\n   - Register writes to 64-bit GICD registers other than GICD_IROUTERn*\n   - ITS command MOVALL\n\n  Multiple commands in GICv4+ utilize multiple transfer packets,\n  including VMOVP, VMOVI, VMAPP, and 64-bit register accesses.\"\n\n  This issue impacts system configurations with more than 2 sockets,\n  that require multi-transfer packets to be sent over inter-socket\n  AXI4 Stream interface between GIC instances on different sockets.\n  GICv4 cannot be supported. GICv3 SW model can only be supported\n  with the workaround. Single and Dual socket configurations are not\n  impacted by this issue and support GICv3 and GICv4.\"\n\n\nWriting to the chip alias region of the GICD_In{E} registers except\nGICD_ICENABLERn has an equivalent effect as writing to the global\ndistributor. The SPI interrupt deactivate path is not impacted by\nthe erratum.\n\nTo fix this problem, implement a workaround that ensures read accesses\nto the GICD_In{E} registers are directed to the chip that owns the\nSPI, and disable GICv4.x features. To simplify code changes, the\ngic_configure_irq() function uses the same alias region for both read\nand write operations to GICD_ICFGR.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4c1078e-5f5b-4a6b-b2e1-da37af0b8517",
      "id": "CVE-2024-26585",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between tx work scheduling and socket close\n\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete().\nReorder scheduling the work before calling complete().\nThis seems more logical in the first place, as it's\nthe inverse order of what the submitting thread will do.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e84edc62-99f8-4880-bc00-0b9b6eec5dd8",
      "id": "CVE-2024-26704",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix double-free of blocks due to wrong extents moved_len\n\nIn ext4_move_extents(), moved_len is only updated when all moves are\nsuccessfully executed, and only discards orig_inode and donor_inode\npreallocations when moved_len is not zero. When the loop fails to exit\nafter successfully moving some extents, moved_len is not updated and\nremains at 0, so it does not discard the preallocations.\n\nIf the moved extents overlap with the preallocated extents, the\noverlapped extents are freed twice in ext4_mb_release_inode_pa() and\next4_process_freed_data() (as described in commit 94d7c16cbbbd (\"ext4:\nFix double-free of blocks with EXT4_IOC_MOVE_EXT\")), and bb_free is\nincremented twice. Hence when trim is executed, a zero-division bug is\ntriggered in mb_update_avg_fragment_size() because bb_free is not zero\nand bb_fragments is zero.\n\nTherefore, update move_len after each extent move to avoid the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "155fd0fe-be1b-4dcf-9bf2-e9eeaa98e54f",
      "id": "CVE-2024-43853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Prevent UAF in proc_cpuset_show()\n\nAn UAF can happen when /proc/cpuset is read as reported in [1].\n\nThis can be reproduced by the following methods:\n1.add an mdelay(1000) before acquiring the cgroup_lock In the\n cgroup_path_ns function.\n2.$cat /proc/\u003cpid\u003e/cpuset   repeatly.\n3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/\n$umount /sys/fs/cgroup/cpuset/   repeatly.\n\nThe race that cause this bug can be shown as below:\n\n(umount)\t\t|\t(cat /proc/\u003cpid\u003e/cpuset)\ncss_release\t\t|\tproc_cpuset_show\ncss_release_work_fn\t|\tcss = task_get_css(tsk, cpuset_cgrp_id);\ncss_free_rwork_fn\t|\tcgroup_path_ns(css-\u003ecgroup, ...);\ncgroup_destroy_root\t|\tmutex_lock(\u0026cgroup_mutex);\nrebind_subsystems\t|\ncgroup_free_root \t|\n\t\t\t|\t// cgrp was freed, UAF\n\t\t\t|\tcgroup_path_ns_locked(cgrp,..);\n\nWhen the cpuset is initialized, the root node top_cpuset.css.cgrp\nwill point to \u0026cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will\nallocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated\n\u0026cgroup_root.cgrp. When the umount operation is executed,\ntop_cpuset.css.cgrp will be rebound to \u0026cgrp_dfl_root.cgrp.\n\nThe problem is that when rebinding to cgrp_dfl_root, there are cases\nwhere the cgroup_root allocated by setting up the root for cgroup v1\nis cached. This could lead to a Use-After-Free (UAF) if it is\nsubsequently freed. The descendant cgroups of cgroup v1 can only be\nfreed after the css is released. However, the css of the root will never\nbe released, yet the cgroup_root should be freed when it is unmounted.\nThis means that obtaining a reference to the css of the root does\nnot guarantee that css.cgrp-\u003eroot will not be freed.\n\nFix this problem by using rcu_read_lock in proc_cpuset_show().\nAs cgroup_root is kfree_rcu after commit d23b5c577715\n(\"cgroup: Make operations on the cgroup root_list RCU safe\"),\ncss-\u003ecgroup won't be freed during the critical section.\nTo call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to\nreplace task_get_css with task_css.\n\n[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "766273d0-878b-485d-a08c-97a4096d09cf",
      "id": "CVE-2024-26764",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio\n\nIf kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the\nfollowing kernel warning appears:\n\nWARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8\nCall trace:\n kiocb_set_cancel_fn+0x9c/0xa8\n ffs_epfile_read_iter+0x144/0x1d0\n io_read+0x19c/0x498\n io_issue_sqe+0x118/0x27c\n io_submit_sqes+0x25c/0x5fc\n __arm64_sys_io_uring_enter+0x104/0xab0\n invoke_syscall+0x58/0x11c\n el0_svc_common+0xb4/0xf4\n do_el0_svc+0x2c/0xb0\n el0_svc+0x2c/0xa4\n el0t_64_sync_handler+0x68/0xb4\n el0t_64_sync+0x1a4/0x1a8\n\nFix this by setting the IOCB_AIO_RW flag for read and write I/O that is\nsubmitted by libaio.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ab535df-4216-4f90-b1d2-c58464ecff79",
      "id": "CVE-2024-50073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: Fix use-after-free in gsm_cleanup_mux\n\nBUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0\ndrivers/tty/n_gsm.c:3160 [n_gsm]\nRead of size 8 at addr ffff88815fe99c00 by task poc/3379\nCPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56\nHardware name: VMware, Inc. VMware Virtual Platform/440BX\nDesktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n \u003cTASK\u003e\n gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]\n __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]\n __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389\n update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500\n __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846\n __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161\n gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]\n _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107\n __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]\n ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195\n ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79\n __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338\n __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805\n tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818\n\nAllocated by task 65:\n gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]\n gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]\n gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]\n gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]\n tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391\n tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39\n flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445\n process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229\n worker_thread+0x3dc/0x950 kernel/workqueue.c:3391\n kthread+0x2a3/0x370 kernel/kthread.c:389\n ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257\n\nFreed by task 3367:\n kfree+0x126/0x420 mm/slub.c:4580\n gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]\n gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]\n tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818\n\n[Analysis]\ngsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux\ncan be freed by multi threads through ioctl,which leads\nto the occurrence of uaf. Protect it by gsm tx lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c6f2a75-fa32-4c15-a1d6-be211fc018f0",
      "id": "CVE-2024-27436",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Stop parsing channels bits when all channels are found.\n\nIf a usb audio device sets more bits than the amount of channels\nit could write outside of the map array.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6b15004-8b56-48fd-b351-28a0490600d7",
      "id": "CVE-2024-35790",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group\n\nThe DisplayPort driver's sysfs nodes may be present to the userspace before\ntypec_altmode_set_drvdata() completes in dp_altmode_probe. This means that\na sysfs read can trigger a NULL pointer error by deferencing dp-\u003ehpd in\nhpd_show or dp-\u003elock in pin_assignment_show, as dev_get_drvdata() returns\nNULL in those cases.\n\nRemove manual sysfs node creation in favor of adding attribute group as\ndefault for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is\nnot used here otherwise the path to the sysfs nodes is no longer compliant\nwith the ABI.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2697c6e4-ee51-409a-a452-91c3900afbef",
      "id": "CVE-2024-35807",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix corruption during on-line resize\n\nWe observed a corruption during on-line resize of a file system that is\nlarger than 16 TiB with 4k block size. With having more then 2^32 blocks\nresize_inode is turned off by default by mke2fs. The issue can be\nreproduced on a smaller file system for convenience by explicitly\nturning off resize_inode. An on-line resize across an 8 GiB boundary (the\nsize of a meta block group in this setup) then leads to a corruption:\n\n  dev=/dev/\u003csome_dev\u003e # should be \u003e= 16 GiB\n  mkdir -p /corruption\n  /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15))\n  mount -t ext4 $dev /corruption\n\n  dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15))\n  sha1sum /corruption/test\n  # 79d2658b39dcfd77274e435b0934028adafaab11  /corruption/test\n\n  /sbin/resize2fs $dev $((2*2**21))\n  # drop page cache to force reload the block from disk\n  echo 1 \u003e /proc/sys/vm/drop_caches\n\n  sha1sum /corruption/test\n  # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3  /corruption/test\n\n2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per\nblock group and 2^6 are the number of block groups that make a meta\nblock group.\n\nThe last checksum might be different depending on how the file is laid\nout across the physical blocks. The actual corruption occurs at physical\nblock 63*2^15 = 2064384 which would be the location of the backup of the\nmeta block group's block descriptor. During the on-line resize the file\nsystem will be converted to meta_bg starting at s_first_meta_bg which is\n2 in the example - meaning all block groups after 16 GiB. However, in\next4_flex_group_add we might add block groups that are not part of the\nfirst meta block group yet. In the reproducer we achieved this by\nsubstracting the size of a whole block group from the point where the\nmeta block group would start. This must be considered when updating the\nbackup block group descriptors to follow the non-meta_bg layout. The fix\nis to add a test whether the group to add is already part of the meta\nblock group or not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "907a61d2-6314-43fe-ace4-3f8df6bee2c9",
      "id": "CVE-2024-35822",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: udc: remove warning when queue disabled ep\n\nIt is possible trigger below warning message from mass storage function,\n\nWARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104\npc : usb_ep_queue+0x7c/0x104\nlr : fsg_main_thread+0x494/0x1b3c\n\nRoot cause is mass storage function try to queue request from main thread,\nbut other thread may already disable ep when function disable.\n\nAs there is no function failure in the driver, in order to avoid effort\nto fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1af80004-48f0-480d-9034-0e8af542566e",
      "id": "CVE-2024-35835",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa701b15-b3ae-47ab-93d2-bff3d1604203",
      "id": "CVE-2024-35960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Properly link new fs rules into the tree\n\nPreviously, add_rule_fg would only add newly created rules from the\nhandle into the tree when they had a refcount of 1. On the other hand,\ncreate_flow_handle tries hard to find and reference already existing\nidentical rules instead of creating new ones.\n\nThese two behaviors can result in a situation where create_flow_handle\n1) creates a new rule and references it, then\n2) in a subsequent step during the same handle creation references it\n   again,\nresulting in a rule with a refcount of 2 that is not linked into the\ntree, will have a NULL parent and root and will result in a crash when\nthe flow group is deleted because del_sw_hw_rule, invoked on rule\ndeletion, assumes node-\u003eparent is != NULL.\n\nThis happened in the wild, due to another bug related to incorrect\nhandling of duplicate pkt_reformat ids, which lead to the code in\ncreate_flow_handle incorrectly referencing a just-added rule in the same\nflow handle, resulting in the problem described above. Full details are\nat [1].\n\nThis patch changes add_rule_fg to add new rules without parents into\nthe tree, properly initializing them and avoiding the crash. This makes\nit more consistent with how rules are added to an FTE in\ncreate_flow_handle.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2aa30240-1bcf-4136-bed6-5f00c5e635db",
      "id": "CVE-2024-50195",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-clock: Fix missing timespec64 check in pc_clock_settime()\n\nAs Andrew pointed out, it will make sense that the PTP core\nchecked timespec64 struct's tv_sec and tv_nsec range before calling\nptp-\u003einfo-\u003esettime64().\n\nAs the man manual of clock_settime() said, if tp.tv_sec is negative or\ntp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL,\nwhich include dynamic clocks which handles PTP clock, and the condition is\nconsistent with timespec64_valid(). As Thomas suggested, timespec64_valid()\nonly check the timespec is valid, but not ensure that the time is\nin a valid range, so check it ahead using timespec64_valid_strict()\nin pc_clock_settime() and return -EINVAL if not valid.\n\nThere are some drivers that use tp-\u003etv_sec and tp-\u003etv_nsec directly to\nwrite registers without validity checks and assume that the higher layer\nhas checked it, which is dangerous and will benefit from this, such as\nhclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(),\nand some drivers can remove the checks of itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa8875f2-946f-4900-9aa2-2b664be2ed22",
      "id": "CVE-2024-35978",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix memory leak in hci_req_sync_complete()\n\nIn 'hci_req_sync_complete()', always free the previous sync\nrequest state before assigning reference to a new one.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96eb63f8-6a0b-4e86-8762-288147568e5a",
      "id": "CVE-2024-36017",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation\n\nEach attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a\nstruct ifla_vf_vlan_info so the size of such attribute needs to be at least\nof sizeof(struct ifla_vf_vlan_info) which is 14 bytes.\nThe current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)\nwhich is less than sizeof(struct ifla_vf_vlan_info) so this validation\nis not enough and a too small attribute might be cast to a\nstruct ifla_vf_vlan_info, this might result in an out of bands\nread access when accessing the saved (casted) entry in ivvl.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96caa4e9-e2c5-4555-b345-ef31667231ad",
      "id": "CVE-2024-36939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Handle error of rpc_proc_register() in nfs_net_init().\n\nsyzkaller reported a warning [0] triggered while destroying immature\nnetns.\n\nrpc_proc_register() was called in init_nfs_fs(), but its error\nhas been ignored since at least the initial commit 1da177e4c3f4\n(\"Linux-2.6.12-rc2\").\n\nRecently, commit d47151b79e32 (\"nfs: expose /proc/net/sunrpc/nfs\nin net namespaces\") converted the procfs to per-netns and made\nthe problem more visible.\n\nEven when rpc_proc_register() fails, nfs_net_init() could succeed,\nand thus nfs_net_exit() will be called while destroying the netns.\n\nThen, remove_proc_entry() will be called for non-existing proc\ndirectory and trigger the warning below.\n\nLet's handle the error of rpc_proc_register() properly in nfs_net_init().\n\n[0]:\nname 'nfs'\nWARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711\nModules linked in:\nCPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711\nCode: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff \u003c0f\u003e 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb\nRSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c\nRDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc\nR13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8\nFS:  00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310\n nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438\n ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170\n setup_net+0x46c/0x660 net/core/net_namespace.c:372\n copy_net_ns+0x244/0x590 net/core/net_namespace.c:505\n create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228\n ksys_unshare+0x342/0x760 kernel/fork.c:3322\n __do_sys_unshare kernel/fork.c:3393 [inline]\n __se_sys_unshare kernel/fork.c:3391 [inline]\n __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\nRIP: 0033:0x7f30d0febe5d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48\nRSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600\nRBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002\nR13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b231115a-a0a6-491f-81e2-6ec27ef9c75c",
      "id": "CVE-2024-38601",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix a race between readers and resize checks\n\nThe reader code in rb_get_reader_page() swaps a new reader page into the\nring buffer by doing cmpxchg on old-\u003elist.prev-\u003enext to point it to the\nnew page. Following that, if the operation is successful,\nold-\u003elist.next-\u003eprev gets updated too. This means the underlying\ndoubly-linked list is temporarily inconsistent, page-\u003eprev-\u003enext or\npage-\u003enext-\u003eprev might not be equal back to page for some page in the\nring buffer.\n\nThe resize operation in ring_buffer_resize() can be invoked in parallel.\nIt calls rb_check_pages() which can detect the described inconsistency\nand stop further tracing:\n\n[  190.271762] ------------[ cut here ]------------\n[  190.271771] WARNING: CPU: 1 PID: 6186 at kernel/trace/ring_buffer.c:1467 rb_check_pages.isra.0+0x6a/0xa0\n[  190.271789] Modules linked in: [...]\n[  190.271991] Unloaded tainted modules: intel_uncore_frequency(E):1 skx_edac(E):1\n[  190.272002] CPU: 1 PID: 6186 Comm: cmd.sh Kdump: loaded Tainted: G            E      6.9.0-rc6-default #5 158d3e1e6d0b091c34c3b96bfd99a1c58306d79f\n[  190.272011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552c-rebuilt.opensuse.org 04/01/2014\n[  190.272015] RIP: 0010:rb_check_pages.isra.0+0x6a/0xa0\n[  190.272023] Code: [...]\n[  190.272028] RSP: 0018:ffff9c37463abb70 EFLAGS: 00010206\n[  190.272034] RAX: ffff8eba04b6cb80 RBX: 0000000000000007 RCX: ffff8eba01f13d80\n[  190.272038] RDX: ffff8eba01f130c0 RSI: ffff8eba04b6cd00 RDI: ffff8eba0004c700\n[  190.272042] RBP: ffff8eba0004c700 R08: 0000000000010002 R09: 0000000000000000\n[  190.272045] R10: 00000000ffff7f52 R11: ffff8eba7f600000 R12: ffff8eba0004c720\n[  190.272049] R13: ffff8eba00223a00 R14: 0000000000000008 R15: ffff8eba067a8000\n[  190.272053] FS:  00007f1bd64752c0(0000) GS:ffff8eba7f680000(0000) knlGS:0000000000000000\n[  190.272057] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  190.272061] CR2: 00007f1bd6662590 CR3: 000000010291e001 CR4: 0000000000370ef0\n[  190.272070] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  190.272073] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  190.272077] Call Trace:\n[  190.272098]  \u003cTASK\u003e\n[  190.272189]  ring_buffer_resize+0x2ab/0x460\n[  190.272199]  __tracing_resize_ring_buffer.part.0+0x23/0xa0\n[  190.272206]  tracing_resize_ring_buffer+0x65/0x90\n[  190.272216]  tracing_entries_write+0x74/0xc0\n[  190.272225]  vfs_write+0xf5/0x420\n[  190.272248]  ksys_write+0x67/0xe0\n[  190.272256]  do_syscall_64+0x82/0x170\n[  190.272363]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  190.272373] RIP: 0033:0x7f1bd657d263\n[  190.272381] Code: [...]\n[  190.272385] RSP: 002b:00007ffe72b643f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[  190.272391] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1bd657d263\n[  190.272395] RDX: 0000000000000002 RSI: 0000555a6eb538e0 RDI: 0000000000000001\n[  190.272398] RBP: 0000555a6eb538e0 R08: 000000000000000a R09: 0000000000000000\n[  190.272401] R10: 0000555a6eb55190 R11: 0000000000000246 R12: 00007f1bd6662500\n[  190.272404] R13: 0000000000000002 R14: 00007f1bd6667c00 R15: 0000000000000002\n[  190.272412]  \u003c/TASK\u003e\n[  190.272414] ---[ end trace 0000000000000000 ]---\n\nNote that ring_buffer_resize() calls rb_check_pages() only if the parent\ntrace_buffer has recording disabled. Recent commit d78ab792705c\n(\"tracing: Stop current tracer when resizing buffer\") causes that it is\nnow always the case which makes it more likely to experience this issue.\n\nThe window to hit this race is nonetheless very small. To help\nreproducing it, one can add a delay loop in rb_get_reader_page():\n\n ret = rb_head_page_replace(reader, cpu_buffer-\u003ereader_page);\n if (!ret)\n \tgoto spin;\n for (unsigned i = 0; i \u003c 1U \u003c\u003c 26; i++)  /* inserted delay loop */\n \t__asm__ __volatile__ (\"\" : : : \"memory\");\n rb_list_head(reader-\u003elist.next)-\u003eprev = \u0026cpu_buffer-\u003ereader_page-\u003elist;\n\n.. \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bda721d9-460f-40c9-ae64-91e0f26534b1",
      "id": "CVE-2024-39468",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix deadlock in smb2_find_smb_tcon()\n\nUnlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such\ndeadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fd6ce17-6985-4408-926e-d6650633b795",
      "id": "CVE-2024-40932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos/vidi: fix memory leak in .get_modes()\n\nThe duplicated EDID is never freed. Fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f9d7c3ab-86cf-4c51-82c1-26ae0e062eaf",
      "id": "CVE-2024-40958",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetns: Make get_net_ns() handle zero refcount net\n\nSyzkaller hit a warning:\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0\nModules linked in:\nCPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xdf/0x1d0\nCode: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 \u003c0f\u003e 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1\nRSP: 0018:ffff8881067b7da0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac\nRDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001\nRBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139\nR10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4\nR13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040\nFS:  00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? show_regs+0xa3/0xc0\n ? __warn+0xa5/0x1c0\n ? refcount_warn_saturate+0xdf/0x1d0\n ? report_bug+0x1fc/0x2d0\n ? refcount_warn_saturate+0xdf/0x1d0\n ? handle_bug+0xa1/0x110\n ? exc_invalid_op+0x3c/0xb0\n ? asm_exc_invalid_op+0x1f/0x30\n ? __warn_printk+0xcc/0x140\n ? __warn_printk+0xd5/0x140\n ? refcount_warn_saturate+0xdf/0x1d0\n get_net_ns+0xa4/0xc0\n ? __pfx_get_net_ns+0x10/0x10\n open_related_ns+0x5a/0x130\n __tun_chr_ioctl+0x1616/0x2370\n ? __sanitizer_cov_trace_switch+0x58/0xa0\n ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30\n ? __pfx_tun_chr_ioctl+0x10/0x10\n tun_chr_ioctl+0x2f/0x40\n __x64_sys_ioctl+0x11b/0x160\n x64_sys_call+0x1211/0x20d0\n do_syscall_64+0x9e/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f5b28f165d7\nCode: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8\nRSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7\nRDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003\nRBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0\nR10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730\nR13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e\nKernel panic - not syncing: kernel: panic_on_warn set ...\n\nThis is trigger as below:\n          ns0                                    ns1\ntun_set_iff() //dev is tun0\n   tun-\u003edev = dev\n//ip link set tun0 netns ns1\n                                       put_net() //ref is 0\n__tun_chr_ioctl() //TUNGETDEVNETNS\n   net = dev_net(tun-\u003edev);\n   open_related_ns(\u0026net-\u003ens, get_net_ns); //ns1\n     get_net_ns()\n        get_net() //addition on 0\n\nUse maybe_get_net() in get_net_ns in case net's ref is zero to fix this",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c7c732c-f34f-4b26-b8ed-bf758f443aac",
      "id": "CVE-2024-42065",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Add a NULL check in xe_ttm_stolen_mgr_init\n\nAdd an explicit check to ensure that the mgr is not NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c6f0e4c-7a54-4f24-b335-22270f5e75e1",
      "id": "CVE-2024-40965",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: lpi2c: Avoid calling clk_get_rate during transfer\n\nInstead of repeatedly calling clk_get_rate for each transfer, lock\nthe clock rate and cache the value.\nA deadlock has been observed while adding tlv320aic32x4 audio codec to\nthe system. When this clock provider adds its clock, the clk mutex is\nlocked already, it needs to access i2c, which in return needs the mutex\nfor clk_get_rate as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e194f04-097d-483d-960b-7facd2e318c3",
      "id": "CVE-2024-41016",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\n\nxattr in ocfs2 maybe 'non-indexed', which saved with additional space\nrequested.  It's better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ae5c482-b7e7-435b-80f0-7b7986c08b8a",
      "id": "CVE-2024-41034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug on rename operation of broken directory\n\nSyzbot reported that in rename directory operation on broken directory on\nnilfs2, __block_write_begin_int() called to prepare block write may fail\nBUG_ON check for access exceeding the folio/page size.\n\nThis is because nilfs_dotdot(), which gets parent directory reference\nentry (\"..\") of the directory to be moved or renamed, does not check\nconsistency enough, and may return location exceeding folio/page size for\nbroken directories.\n\nFix this issue by checking required directory entries (\".\" and \"..\") in\nthe first chunk of the directory in nilfs_dotdot().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "146513f7-f91a-49cc-b5e5-e97faead1643",
      "id": "CVE-2024-41082",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fabrics: use reserved tag for reg read/write command\n\nIn some scenarios, if too many commands are issued by nvme command in\nthe same time by user tasks, this may exhaust all tags of admin_q. If\na reset (nvme reset or IO timeout) occurs before these commands finish,\nreconnect routine may fail to update nvme regs due to insufficient tags,\nwhich will cause kernel hang forever. In order to workaround this issue,\nmaybe we can let reg_read32()/reg_read64()/reg_write32() use reserved\ntags. This maybe safe for nvmf:\n\n1. For the disable ctrl path,  we will not issue connect command\n2. For the enable ctrl / fw activate path, since connect and reg_xx()\n   are called serially.\n\nSo the reserved tags may still be enough while reg_xx() use reserved tags.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41c4af58-0e10-438c-854e-9235a81d2ab6",
      "id": "CVE-2024-41097",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix endpoint checking in cxacru_bind()\n\nSyzbot is still reporting quite an old issue [1] that occurs due to\nincomplete checking of present usb endpoints. As such, wrong\nendpoints types may be used at urb sumbitting stage which in turn\ntriggers a warning in usb_submit_urb().\n\nFix the issue by verifying that required endpoint types are present\nfor both in and out endpoints, taking into account cmd endpoint type.\n\nUnfortunately, this patch has not been tested on real hardware.\n\n[1] Syzbot report:\nusb 1-1: BOGUS urb xfer, pipe 1 != type 3\nWARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\nModules linked in:\nCPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\n...\nCall Trace:\n cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649\n cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760\n cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209\n usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055\n cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363\n usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396\n call_driver_probe drivers/base/dd.c:517 [inline]\n really_probe+0x23c/0xcd0 drivers/base/dd.c:595\n __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747\n driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777\n __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894\n bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427\n __device_attach+0x228/0x4a0 drivers/base/dd.c:965\n bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487\n device_add+0xc2f/0x2180 drivers/base/core.c:3354\n usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238\n usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91eb05a7-d99e-4c26-8d68-c3bf00166d0d",
      "id": "CVE-2024-42120",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check pipe offset before setting vblank\n\npipe_ctx has a size of MAX_PIPES so checking its index before accessing\nthe array.\n\nThis fixes an OVERRUN issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e57da5ab-1d70-42c8-afba-f535c0860771",
      "id": "CVE-2024-42229",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: aead,cipher - zeroize key buffer after use\n\nI.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding\ncryptographic information should be zeroized once they are no longer\nneeded. Accomplish this by using kfree_sensitive for buffers that\npreviously held the private key.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ecfc5b2-e042-497f-9a9a-7a321959acb6",
      "id": "CVE-2024-42295",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: handle inconsistent state in nilfs_btnode_create_block()\n\nSyzbot reported that a buffer state inconsistency was detected in\nnilfs_btnode_create_block(), triggering a kernel bug.\n\nIt is not appropriate to treat this inconsistency as a bug; it can occur\nif the argument block address (the buffer index of the newly created\nblock) is a virtual block number and has been reallocated due to\ncorruption of the bitmap used to manage its allocation state.\n\nSo, modify nilfs_btnode_create_block() and its callers to treat it as a\npossible filesystem error, rather than triggering a kernel bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48375e98-bd65-4500-9bfd-43b4f6f3a9b3",
      "id": "CVE-2024-44941",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to cover read extent cache access with lock\n\nsyzbot reports a f2fs bug as below:\n\nBUG: KASAN: slab-use-after-free in sanity_check_extent_cache+0x370/0x410 fs/f2fs/extent_cache.c:46\nRead of size 4 at addr ffff8880739ab220 by task syz-executor200/5097\n\nCPU: 0 PID: 5097 Comm: syz-executor200 Not tainted 6.9.0-rc6-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n sanity_check_extent_cache+0x370/0x410 fs/f2fs/extent_cache.c:46\n do_read_inode fs/f2fs/inode.c:509 [inline]\n f2fs_iget+0x33e1/0x46e0 fs/f2fs/inode.c:560\n f2fs_nfs_get_inode+0x74/0x100 fs/f2fs/super.c:3237\n generic_fh_to_dentry+0x9f/0xf0 fs/libfs.c:1413\n exportfs_decode_fh_raw+0x152/0x5f0 fs/exportfs/expfs.c:444\n exportfs_decode_fh+0x3c/0x80 fs/exportfs/expfs.c:584\n do_handle_to_path fs/fhandle.c:155 [inline]\n handle_to_path fs/fhandle.c:210 [inline]\n do_handle_open+0x495/0x650 fs/fhandle.c:226\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nWe missed to cover sanity_check_extent_cache() w/ extent cache lock,\nso, below race case may happen, result in use after free issue.\n\n- f2fs_iget\n - do_read_inode\n  - f2fs_init_read_extent_tree\n  : add largest extent entry in to cache\n\t\t\t\t\t- shrink\n\t\t\t\t\t - f2fs_shrink_read_extent_tree\n\t\t\t\t\t  - __shrink_extent_tree\n\t\t\t\t\t   - __detach_extent_node\n\t\t\t\t\t   : drop largest extent entry\n  - sanity_check_extent_cache\n  : access et-\u003elargest w/o lock\n\nlet's refactor sanity_check_extent_cache() to avoid extent cache access\nand call it before f2fs_init_read_extent_tree() to fix this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98e3c8eb-1804-4237-b10f-80acbf7ff571",
      "id": "CVE-2024-44970",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\n\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\nto receive CQEs with 0 consumed strides for the same WQE even after the\nWQE is fully consumed and unlinked. This triggers an additional unlink\nfor the same wqe which corrupts the linked list.\n\nFix this scenario by accepting 0 sized consumed strides without\nunlinking the WQE again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6fd5a2ec-3d8a-429f-9307-8411f1b9aefe",
      "id": "CVE-2024-45026",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: fix error recovery leading to data corruption on ESE devices\n\nExtent Space Efficient (ESE) or thin provisioned volumes need to be\nformatted on demand during usual IO processing.\n\nThe dasd_ese_needs_format function checks for error codes that signal\nthe non existence of a proper track format.\n\nThe check for incorrect length is to imprecise since other error cases\nleading to transport of insufficient data also have this flag set.\nThis might lead to data corruption in certain error cases for example\nduring a storage server warmstart.\n\nFix by removing the check for incorrect length and replacing by\nexplicitly checking for invalid track format in transport mode.\n\nAlso remove the check for file protected since this is not a valid\nESE handling case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1cf46117-c9fa-4925-b867-0d980aca4820",
      "id": "CVE-2024-46751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()\n\nInstead of doing a BUG_ON() handle the error by returning -EUCLEAN,\naborting the transaction and logging an error message.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02e47d1f-af8c-4097-92a2-099eabd508f8",
      "id": "CVE-2024-46754",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Remove tst_run from lwt_seg6local_prog_ops.\n\nThe syzbot reported that the lwt_seg6 related BPF ops can be invoked\nvia bpf_test_run() without without entering input_action_end_bpf()\nfirst.\n\nMartin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL\nprobably didn't work since it was introduced in commit 04d4b274e2a\n(\"ipv6: sr: Add seg6local action End.BPF\"). The reason is that the\nper-CPU variable seg6_bpf_srh_states::srh is never assigned in the self\ntest case but each BPF function expects it.\n\nRemove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11c6c552-a4e3-4b4f-9f49-80f329e6fb60",
      "id": "CVE-2023-6932",
      "description": "A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.\n\nA race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.\n\nWe recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19d84f3a-3ce0-4282-a7f1-18d05f72dc42",
      "id": "CVE-2024-46776",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Run DC_LOG_DC after checking link-\u003elink_enc\n\n[WHAT]\nThe DC_LOG_DC should be run after link-\u003elink_enc is checked, not before.\n\nThis fixes 1 REVERSE_INULL issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "623412e5-c6f3-4011-9097-76c0fc8cc24a",
      "id": "CVE-2024-50211",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: refactor inode_bmap() to handle error\n\nRefactor inode_bmap() to handle error since udf_next_aext() can return\nerror now. On situations like ftruncate, udf_extend_file() can now\ndetect errors and bail out early without resorting to checking for\nparticular offsets and assuming internal behavior of these functions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c79f81d-a16d-41e2-96f9-a0fb08573af5",
      "id": "CVE-2024-58012",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params\n\nEach cpu DAI should associate with a widget. However, the topology might\nnot create the right number of DAI widgets for aggregated amps. And it\nwill cause NULL pointer deference.\nCheck that the DAI widget associated with the CPU DAI is valid to prevent\nNULL pointer deference due to missing DAI widgets in topologies with\naggregated amps.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "352f0af9-1680-44fb-a8d4-ffd95698f97a",
      "id": "CVE-2024-50258",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix crash when config small gso_max_size/gso_ipv4_max_size\n\nConfig a small gso_max_size/gso_ipv4_max_size will lead to an underflow\nin sk_dst_gso_max_size(), which may trigger a BUG_ON crash,\nbecause sk-\u003esk_gso_max_size would be much bigger than device limits.\nCall Trace:\ntcp_write_xmit\n    tso_segs = tcp_init_tso_segs(skb, mss_now);\n        tcp_set_skb_tso_segs\n            tcp_skb_pcount_set\n                // skb-\u003elen = 524288, mss_now = 8\n                // u16 tso_segs = 524288/8 = 65535 -\u003e 0\n                tso_segs = DIV_ROUND_UP(skb-\u003elen, mss_now)\n    BUG_ON(!tso_segs)\nAdd check for the minimum value of gso_max_size and gso_ipv4_max_size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8429d627-a830-4d7d-ae72-de15405e171e",
      "id": "CVE-2024-53057",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT\n\nIn qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed\nto be either root or ingress. This assumption is bogus since it's valid\nto create egress qdiscs with major handle ffff:\nBudimir Markovic found that for qdiscs like DRR that maintain an active\nclass list, it will cause a UAF with a dangling class pointer.\n\nIn 066a3b5b2346, the concern was to avoid iterating over the ingress\nqdisc since its parent is itself. The proper fix is to stop when parent\nTC_H_ROOT is reached because the only way to retrieve ingress is when a\nhierarchy which does not contain a ffff: major handle call into\nqdisc_lookup with TC_H_MAJ(TC_H_ROOT).\n\nIn the scenario where major ffff: is an egress qdisc in any of the tree\nlevels, the updates will also propagate to TC_H_ROOT, which then the\niteration must stop.\n\n\n net/sched/sch_api.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb212b95-3db6-4392-bf7a-4b5c39e19fc3",
      "id": "CVE-2024-53145",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix potential integer overflow during physmem setup\n\nThis issue happens when the real map size is greater than LONG_MAX,\nwhich can be easily triggered on UML/i386.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9059587-9779-4b6b-8a4b-1cc3c72b005b",
      "id": "CVE-2024-53680",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()\n\nUnder certain kernel configurations when building with Clang/LLVM, the\ncompiler does not generate a return or jump as the terminator\ninstruction for ip_vs_protocol_init(), triggering the following objtool\nwarning during build time:\n\n  vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6()\n\nAt runtime, this either causes an oops when trying to load the ipvs\nmodule or a boot-time panic if ipvs is built-in. This same issue has\nbeen reported by the Intel kernel test robot previously.\n\nDigging deeper into both LLVM and the kernel code reveals this to be a\nundefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer\nof 64 chars to store the registered protocol names and leaves it\nuninitialized after definition. The function calls strnlen() when\nconcatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE\nstrnlen() performs an extra step to check whether the last byte of the\ninput char buffer is a null character (commit 3009f891bb9f (\"fortify:\nAllow strlen() and strnlen() to pass compile-time known lengths\")).\nThis, together with possibly other configurations, cause the following\nIR to be generated:\n\n  define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section \".init.text\" align 16 !kcfi_type !29 {\n    %1 = alloca [64 x i8], align 16\n    ...\n\n  14:                                               ; preds = %11\n    %15 = getelementptr inbounds i8, ptr %1, i64 63\n    %16 = load i8, ptr %15, align 1\n    %17 = tail call i1 @llvm.is.constant.i8(i8 %16)\n    %18 = icmp eq i8 %16, 0\n    %19 = select i1 %17, i1 %18, i1 false\n    br i1 %19, label %20, label %23\n\n  20:                                               ; preds = %14\n    %21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23\n    ...\n\n  23:                                               ; preds = %14, %11, %20\n    %24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24\n    ...\n  }\n\nThe above code calculates the address of the last char in the buffer\n(value %15) and then loads from it (value %16). Because the buffer is\nnever initialized, the LLVM GVN pass marks value %16 as undefined:\n\n  %13 = getelementptr inbounds i8, ptr %1, i64 63\n  br i1 undef, label %14, label %17\n\nThis gives later passes (SCCP, in particular) more DCE opportunities by\npropagating the undef value further, and eventually removes everything\nafter the load on the uninitialized stack location:\n\n  define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section \".init.text\" align 16 !kcfi_type !11 {\n    %1 = alloca [64 x i8], align 16\n    ...\n\n  12:                                               ; preds = %11\n    %13 = getelementptr inbounds i8, ptr %1, i64 63\n    unreachable\n  }\n\nIn this way, the generated native code will just fall through to the\nnext function, as LLVM does not generate any code for the unreachable IR\ninstruction and leaves the function without a terminator.\n\nZero the on-stack buffer to avoid this possible UB.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "884fa99d-93c0-491e-b2a7-b2da23651b9f",
      "id": "CVE-2024-56724",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device\n\nWhile design wise the idea of converting the driver to use\nthe hierarchy of the IRQ chips is correct, the implementation\nhas (inherited) flaws. This was unveiled when platform_get_irq()\nhad started WARN() on IRQ 0 that is supposed to be a Linux\nIRQ number (also known as vIRQ).\n\nRework the driver to respect IRQ domain when creating each MFD\ndevice separately, as the domain is not the same for all of them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a8c9f43-34e2-44a0-b97d-34c99f14c682",
      "id": "CVE-2024-57857",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Remove direct link to net_device\n\nDo not manage a per device direct link to net_device. Rely\non associated ib_devices net_device management, not doubling\nthe effort locally. A badly managed local link to net_device\nwas causing a 'KASAN: slab-use-after-free' exception during\nsiw_query_port() call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cd2313c-aa17-41da-8bad-2584997a3b3c",
      "id": "CVE-2024-58053",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we've received.  Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection.  Whilst the propagation bit is performed, the calls aren't then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7adcb0b7-ffa9-4766-801f-d0925a3ecd87",
      "id": "CVE-2024-58085",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntomoyo: don't emit warning in tomoyo_write_control()\n\nsyzbot is reporting too large allocation warning at tomoyo_write_control(),\nfor one can write a very very long line without new line character. To fix\nthis warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE,\nfor practically a valid line should be always shorter than 32KB where the\n\"too small to fail\" memory-allocation rule applies.\n\nOne might try to write a valid line that is longer than 32KB, but such\nrequest will likely fail with -ENOMEM. Therefore, I feel that separately\nreturning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant.\nThere is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9978642a-586b-4934-a75b-ac412b918e5f",
      "id": "CVE-2022-1852",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "155ebec0-bccf-4e33-814b-dcd5f4d2e8f7",
      "id": "CVE-2025-21667",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: avoid avoid truncating 64-bit offset to 32 bits\n\non 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a\n32-bit position due to folio_next_index() returning an unsigned long.\nThis could lead to an infinite loop when writing to an xfs filesystem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "200bc162-9e64-4bbd-861d-f047e4f6f87b",
      "id": "CVE-2025-21744",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()\n\nOn removal of the device or unloading of the kernel module a potential NULL\npointer dereference occurs.\n\nThe following sequence deletes the interface:\n\n  brcmf_detach()\n    brcmf_remove_interface()\n      brcmf_del_if()\n\nInside the brcmf_del_if() function the drvr-\u003eif2bss[ifidx] is updated to\nBRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.\n\nAfter brcmf_remove_interface() call the brcmf_proto_detach() function is\ncalled providing the following sequence:\n\n  brcmf_detach()\n    brcmf_proto_detach()\n      brcmf_proto_msgbuf_detach()\n        brcmf_flowring_detach()\n          brcmf_msgbuf_delete_flowring()\n            brcmf_msgbuf_remove_flowring()\n              brcmf_flowring_delete()\n                brcmf_get_ifp()\n                brcmf_txfinalize()\n\nSince brcmf_get_ip() can and actually will return NULL in this case the\ncall to brcmf_txfinalize() will result in a NULL pointer dereference inside\nbrcmf_txfinalize() when trying to update ifp-\u003endev-\u003estats.tx_errors.\n\nThis will only happen if a flowring still has an skb.\n\nAlthough the NULL pointer dereference has only been seen when trying to\nupdate the tx statistic, all other uses of the ifp pointer have been\nguarded as well with an early return if ifp is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb7c7269-6c3d-4e48-b798-e0c57410dd67",
      "id": "CVE-2025-21764",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nndisc: use RCU protection in ndisc_alloc_skb()\n\nndisc_alloc_skb() can be called without RTNL or RCU being held.\n\nAdd RCU protection to avoid possible UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "75739231-01d1-43d7-a3eb-ae6bd8e3aaa3",
      "id": "CVE-2020-10942",
      "description": "In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcb2fc28-cfe7-47dc-a107-16f2cadd28ae",
      "id": "CVE-2025-21831",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1\n\ncommit 9d26d3a8f1b0 (\"PCI: Put PCIe ports into D3 during suspend\") sets the\npolicy that all PCIe ports are allowed to use D3.  When the system is\nsuspended if the port is not power manageable by the platform and won't be\nused for wakeup via a PME this sets up the policy for these ports to go\ninto D3hot.\n\nThis policy generally makes sense from an OSPM perspective but it leads to\nproblems with wakeup from suspend on the TUXEDO Sirius 16 Gen 1 with a\nspecific old BIOS. This manifests as a system hang.\n\nOn the affected Device + BIOS combination, add a quirk for the root port of\nthe problematic controller to ensure that these root ports are not put into\nD3hot at suspend.\n\nThis patch is based on\n\n  https://lore.kernel.org/linux-pci/20230708214457.1229-2-mario.limonciello@amd.com\n\nbut with the added condition both in the documentation and in the code to\napply only to the TUXEDO Sirius 16 Gen 1 with a specific old BIOS and only\nthe affected root ports.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82cd5508-2c8c-4055-a564-1fc5e5ee68c6",
      "id": "CVE-2025-22007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix error code in chan_alloc_skb_cb()\n\nThe chan_alloc_skb_cb() function is supposed to return error pointers on\nerror.  Returning NULL will lead to a NULL dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efde9c48-ac22-4cfa-a167-20b29067cd2f",
      "id": "CVE-2025-23132",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: quota: fix to avoid warning in dquot_writeback_dquots()\n\nF2FS-fs (dm-59): checkpoint=enable has some unwritten data.\n\n------------[ cut here ]------------\nWARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308\npc : dquot_writeback_dquots+0x2fc/0x308\nlr : f2fs_quota_sync+0xcc/0x1c4\nCall trace:\ndquot_writeback_dquots+0x2fc/0x308\nf2fs_quota_sync+0xcc/0x1c4\nf2fs_write_checkpoint+0x3d4/0x9b0\nf2fs_issue_checkpoint+0x1bc/0x2c0\nf2fs_sync_fs+0x54/0x150\nf2fs_do_sync_file+0x2f8/0x814\n__f2fs_ioctl+0x1960/0x3244\nf2fs_ioctl+0x54/0xe0\n__arm64_sys_ioctl+0xa8/0xe4\ninvoke_syscall+0x58/0x114\n\ncheckpoint and f2fs_remount may race as below, resulting triggering warning\nin dquot_writeback_dquots().\n\natomic write                                    remount\n                                                - do_remount\n                                                 - down_write(\u0026sb-\u003es_umount);\n                                                  - f2fs_remount\n- ioctl\n - f2fs_do_sync_file\n  - f2fs_sync_fs\n   - f2fs_write_checkpoint\n    - block_operations\n     - locked = down_read_trylock(\u0026sbi-\u003esb-\u003es_umount)\n       : fail to lock due to the write lock was held by remount\n                                                 - up_write(\u0026sb-\u003es_umount);\n     - f2fs_quota_sync\n      - dquot_writeback_dquots\n       - WARN_ON_ONCE(!rwsem_is_locked(\u0026sb-\u003es_umount))\n       : trigger warning because s_umount lock was unlocked by remount\n\nIf checkpoint comes from mount/umount/remount/freeze/quotactl, caller of\ncheckpoint has already held s_umount lock, calling dquot_writeback_dquots()\nin the context should be safe.\n\nSo let's record task to sbi-\u003eumount_lock_holder, so that checkpoint can\nknow whether the lock has held in the context or not by checking current\nw/ it.\n\nIn addition, in order to not misrepresent caller of checkpoint, we should\nnot allow to trigger async checkpoint for those callers: mount/umount/remount/\nfreeze/quotactl.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c20a944b-7c35-4390-813f-fb63340af6a5",
      "id": "CVE-2025-23140",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error\n\nAfter devm_request_irq() fails with error in pci_endpoint_test_request_irq(),\nthe pci_endpoint_test_free_irq_vectors() is called assuming that all IRQs\nhave been released.\n\nHowever, some requested IRQs remain unreleased, so there are still\n/proc/irq/* entries remaining, and this results in WARN() with the\nfollowing message:\n\n  remove_proc_entry: removing non-empty directory 'irq/30', leaking at least 'pci-endpoint-test.0'\n  WARNING: CPU: 0 PID: 202 at fs/proc/generic.c:719 remove_proc_entry +0x190/0x19c\n\nTo solve this issue, set the number of remaining IRQs to test-\u003enum_irqs,\nand release IRQs in advance by calling pci_endpoint_test_release_irq().\n\n[kwilczynski: commit log]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c0704af-59fb-4dd2-be46-ba2f612f6bd8",
      "id": "CVE-2025-37770",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "763cb81d-f65a-4f8a-9e0a-2345c5dbc8f8",
      "id": "CVE-2022-49532",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes\n\ndrm_cvt_mode may return NULL and we should check it.\n\nThis bug is found by syzkaller:\n\nFAULT_INJECTION stacktrace:\n[  168.567394] FAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 1\n[  168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1\n[  168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n[  168.567408] Call trace:\n[  168.567414]  dump_backtrace+0x0/0x310\n[  168.567418]  show_stack+0x28/0x38\n[  168.567423]  dump_stack+0xec/0x15c\n[  168.567427]  should_fail+0x3ac/0x3d0\n[  168.567437]  __should_failslab+0xb8/0x120\n[  168.567441]  should_failslab+0x28/0xc0\n[  168.567445]  kmem_cache_alloc_trace+0x50/0x640\n[  168.567454]  drm_mode_create+0x40/0x90\n[  168.567458]  drm_cvt_mode+0x48/0xc78\n[  168.567477]  virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu]\n[  168.567485]  drm_helper_probe_single_connector_modes+0x3a4/0xd80\n[  168.567492]  drm_mode_getconnector+0x2e0/0xa70\n[  168.567496]  drm_ioctl_kernel+0x11c/0x1d8\n[  168.567514]  drm_ioctl+0x558/0x6d0\n[  168.567522]  do_vfs_ioctl+0x160/0xf30\n[  168.567525]  ksys_ioctl+0x98/0xd8\n[  168.567530]  __arm64_sys_ioctl+0x50/0xc8\n[  168.567536]  el0_svc_common+0xc8/0x320\n[  168.567540]  el0_svc_handler+0xf8/0x160\n[  168.567544]  el0_svc+0x10/0x218\n\nKASAN stacktrace:\n[  168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]\n[  168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425\n[  168.567566]\n[  168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1\n[  168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n[  168.567575] Call trace:\n[  168.567578]  dump_backtrace+0x0/0x310\n[  168.567582]  show_stack+0x28/0x38\n[  168.567586]  dump_stack+0xec/0x15c\n[  168.567591]  kasan_report+0x244/0x2f0\n[  168.567594]  __asan_load4+0x58/0xb0\n[  168.567607]  virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]\n[  168.567612]  drm_helper_probe_single_connector_modes+0x3a4/0xd80\n[  168.567617]  drm_mode_getconnector+0x2e0/0xa70\n[  168.567621]  drm_ioctl_kernel+0x11c/0x1d8\n[  168.567624]  drm_ioctl+0x558/0x6d0\n[  168.567628]  do_vfs_ioctl+0x160/0xf30\n[  168.567632]  ksys_ioctl+0x98/0xd8\n[  168.567636]  __arm64_sys_ioctl+0x50/0xc8\n[  168.567641]  el0_svc_common+0xc8/0x320\n[  168.567645]  el0_svc_handler+0xf8/0x160\n[  168.567649]  el0_svc+0x10/0x218",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec701fbf-be2b-452a-b64b-4d9d92509931",
      "id": "CVE-2025-37992",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Flush gso_skb list too during -\u003echange()\n\nPreviously, when reducing a qdisc's limit via the -\u003echange() operation, only\nthe main skb queue was trimmed, potentially leaving packets in the gso_skb\nlist. This could result in NULL pointer dereference when we only check\nsch-\u003elimit against sch-\u003eq.qlen.\n\nThis patch introduces a new helper, qdisc_dequeue_internal(), which ensures\nboth the gso_skb list and the main queue are properly flushed when trimming\nexcess packets. All relevant qdiscs (codel, fq, fq_codel, fq_pie, hhf, pie)\nare updated to use this helper in their -\u003echange() routines.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13b182ef-5ff0-4de5-aecf-08a747787015",
      "id": "CVE-2025-38044",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: set device_caps for 417\n\nThe video_device for the MPEG encoder did not set device_caps.\n\nAdd this, otherwise the video device can't be registered (you get a\nWARN_ON instead).\n\nNot seen before since currently 417 support is disabled, but I found\nthis while experimenting with it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "585dadfe-11a4-496b-b55c-72fa81da577f",
      "id": "CVE-2025-38218",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on sit_bitmap_size\n\nw/ below testcase, resize will generate a corrupted image which\ncontains inconsistent metadata, so when mounting such image, it\nwill trigger kernel panic:\n\ntouch img\ntruncate -s $((512*1024*1024*1024)) img\nmkfs.f2fs -f img $((256*1024*1024))\nresize.f2fs -s -i img -t $((1024*1024*1024))\nmount img /mnt/f2fs\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.h:863!\nOops: invalid opcode: 0000 [#1] SMP PTI\nCPU: 11 UID: 0 PID: 3922 Comm: mount Not tainted 6.15.0-rc1+ #191 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:f2fs_ra_meta_pages+0x47c/0x490\n\nCall Trace:\n f2fs_build_segment_manager+0x11c3/0x2600\n f2fs_fill_super+0xe97/0x2840\n mount_bdev+0xf4/0x140\n legacy_get_tree+0x2b/0x50\n vfs_get_tree+0x29/0xd0\n path_mount+0x487/0xaf0\n __x64_sys_mount+0x116/0x150\n do_syscall_64+0x82/0x190\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fdbfde1bcfe\n\nThe reaseon is:\n\nsit_i-\u003ebitmap_size is 192, so size of sit bitmap is 192*8=1536, at maximum\nthere are 1536 sit blocks, however MAIN_SEGS is 261893, so that sit_blk_cnt\nis 4762, build_sit_entries() -\u003e current_sit_addr() tries to access\nout-of-boundary in sit_bitmap at offset from [1536, 4762), once sit_bitmap\nand sit_bitmap_mirror is not the same, it will trigger f2fs_bug_on().\n\nLet's add sanity check in f2fs_sanity_check_ckpt() to avoid panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "372125be-59a4-4418-8f06-35dd43cbea90",
      "id": "CVE-2025-38409",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix another leak in the submit error path\n\nput_unused_fd() doesn't free the installed file, if we've already done\nfd_install().  So we need to also free the sync_file.\n\nPatchwork: https://patchwork.freedesktop.org/patch/653583/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1105f2f0-1118-4383-bcbb-f044de5cee7f",
      "id": "CVE-2025-38608",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls\n\nWhen sending plaintext data, we initially calculated the corresponding\nciphertext length. However, if we later reduced the plaintext data length\nvia socket policy, we failed to recalculate the ciphertext length.\n\nThis results in transmitting buffers containing uninitialized data during\nciphertext transmission.\n\nThis causes uninitialized bytes to be appended after a complete\n\"Application Data\" packet, leading to errors on the receiving end when\nparsing TLS record.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87a116a2-845d-4682-9078-0c92b4822c06",
      "id": "CVE-2025-38652",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n  /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01,      511,        0 -    3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi-\u003edevs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet's add one byte space for sbi-\u003edevs.path[] to store null\ncharacter of device path string.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1076c791-b4e2-4fb7-ba1a-3cc1bacb43c8",
      "id": "CVE-2021-28715",
      "description": "Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "854abe74-b30d-4a93-8660-df0c70b8420d",
      "id": "CVE-2021-38300",
      "description": "arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dff1c11e-494c-4471-b5e0-d666796a0421",
      "id": "CVE-2021-46926",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: intel-sdw-acpi: harden detection of controller\n\nThe existing code currently sets a pointer to an ACPI handle before\nchecking that it's actually a SoundWire controller. This can lead to\nissues where the graph walk continues and eventually fails, but the\npointer was set already.\n\nThis patch changes the logic so that the information provided to\nthe caller is set when a controller is found.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d49af8c-3064-472b-9a4a-bd5b7541b65a",
      "id": "CVE-2021-46928",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Clear stale IIR value on instruction access rights trap\n\nWhen a trap 7 (Instruction access rights) occurs, this means the CPU\ncouldn't execute an instruction due to missing execute permissions on\nthe memory region.  In this case it seems the CPU didn't even fetched\nthe instruction from memory and thus did not store it in the cr19 (IIR)\nregister before calling the trap handler. So, the trap handler will find\nsome random old stale value in cr19.\n\nThis patch simply overwrites the stale IIR value with a constant magic\n\"bad food\" value (0xbaadf00d), in the hope people don't start to try to\nunderstand the various random IIR values in trap 7 dumps.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c29a1ed-395b-47f0-9d5f-b97bb61f6e1d",
      "id": "CVE-2021-47231",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcba_usb: fix memory leak in mcba_usb\n\nSyzbot reported memory leak in SocketCAN driver for Microchip CAN BUS\nAnalyzer Tool. The problem was in unfreed usb_coherent.\n\nIn mcba_usb_start() 20 coherent buffers are allocated and there is\nnothing, that frees them:\n\n1) In callback function the urb is resubmitted and that's all\n2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER\n   is not set (see mcba_usb_start) and this flag cannot be used with\n   coherent buffers.\n\nFail log:\n| [ 1354.053291][ T8413] mcba_usb 1-1:0.0 can0: device disconnected\n| [ 1367.059384][ T8420] kmemleak: 20 new suspected memory leaks (see /sys/kernel/debug/kmem)\n\nSo, all allocated buffers should be freed with usb_free_coherent()\nexplicitly\n\nNOTE:\nThe same pattern for allocating and freeing coherent buffers\nis used in drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b93573a-4b61-4c8e-ade4-4c2d58b5389a",
      "id": "CVE-2022-49562",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits\n\nUse the recently introduced __try_cmpxchg_user() to update guest PTE A/D\nbits instead of mapping the PTE into kernel address space.  The VM_PFNMAP\npath is broken as it assumes that vm_pgoff is the base pfn of the mapped\nVMA range, which is conceptually wrong as vm_pgoff is the offset relative\nto the file and has nothing to do with the pfn.  The horrific hack worked\nfor the original use case (backing guest memory with /dev/mem), but leads\nto accessing \"random\" pfns for pretty much any other VM_PFNMAP case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23e24896-90af-43ab-b1ac-ed5eef361e41",
      "id": "CVE-2021-47309",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: validate lwtstate-\u003edata before returning from skb_tunnel_info()\n\nskb_tunnel_info() returns pointer of lwtstate-\u003edata as ip_tunnel_info\ntype without validation. lwtstate-\u003edata can have various types such as\nmpls_iptunnel_encap, etc and these are not compatible.\nSo skb_tunnel_info() should validate before returning that pointer.\n\nSplat looks like:\nBUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]\nRead of size 2 at addr ffff888106ec2698 by task ping/811\n\nCPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195\nCall Trace:\n dump_stack_lvl+0x56/0x7b\n print_address_description.constprop.8.cold.13+0x13/0x2ee\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n kasan_report.cold.14+0x83/0xdf\n ? vxlan_get_route+0x418/0x4b0 [vxlan]\n vxlan_get_route+0x418/0x4b0 [vxlan]\n [ ... ]\n vxlan_xmit_one+0x148b/0x32b0 [vxlan]\n [ ... ]\n vxlan_xmit+0x25c5/0x4780 [vxlan]\n [ ... ]\n dev_hard_start_xmit+0x1ae/0x6e0\n __dev_queue_xmit+0x1f39/0x31a0\n [ ... ]\n neigh_xmit+0x2f9/0x940\n mpls_xmit+0x911/0x1600 [mpls_iptunnel]\n lwtunnel_xmit+0x18f/0x450\n ip_finish_output2+0x867/0x2040\n [ ... ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e1303a6-7e5b-4aea-82d0-362758b78fd4",
      "id": "CVE-2023-39194",
      "description": "A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ca33237-7274-44d6-a0cd-d2f80334f09f",
      "id": "CVE-2021-47336",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmackfs: restrict bytes count in smk_set_cipso()\n\nOops, I failed to update subject line.\n\nFrom 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001\nDate: Mon, 12 Apr 2021 22:25:06 +0900\nSubject: [PATCH] smackfs: restrict bytes count in smk_set_cipso()\n\nCommit 7ef4c19d245f3dc2 (\"smackfs: restrict bytes count in smackfs write\nfunctions\") missed that count \u003e SMK_CIPSOMAX check applies to only\nformat == SMK_FIXED24_FMT case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ea8d32f-b327-422b-9bf8-9430d0f491af",
      "id": "CVE-2021-47357",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: iphase: fix possible use-after-free in ia_module_exit()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c88c7287-28d3-48ca-ab8c-a52320bcd8f2",
      "id": "CVE-2021-47381",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Fix DSP oops stack dump output contents\n\nFix @buf arg given to hex_dump_to_buffer() and stack address used\nin dump error output.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc36db68-1630-43aa-8746-10af9e3f804b",
      "id": "CVE-2022-49622",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: avoid skb access on nf_stolen\n\nWhen verdict is NF_STOLEN, the skb might have been freed.\n\nWhen tracing is enabled, this can result in a use-after-free:\n1. access to skb-\u003enf_trace\n2. access to skb-\u003emark\n3. computation of trace id\n4. dump of packet payload\n\nTo avoid 1, keep a cached copy of skb-\u003enf_trace in the\ntrace state struct.\nRefresh this copy whenever verdict is != STOLEN.\n\nAvoid 2 by skipping skb-\u003emark access if verdict is STOLEN.\n\n3 is avoided by precomputing the trace id.\n\nOnly dump the packet when verdict is not \"STOLEN\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7306556-9144-4c4b-875c-e5870a916cce",
      "id": "CVE-2021-47424",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix freeing of uninitialized misc IRQ vector\n\nWhen VSI set up failed in i40e_probe() as part of PF switch set up\ndriver was trying to free misc IRQ vectors in\ni40e_clear_interrupt_scheme and produced a kernel Oops:\n\n   Trying to free already-free IRQ 266\n   WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300\n   Workqueue: events work_for_cpu_fn\n   RIP: 0010:__free_irq+0x9a/0x300\n   Call Trace:\n   ? synchronize_irq+0x3a/0xa0\n   free_irq+0x2e/0x60\n   i40e_clear_interrupt_scheme+0x53/0x190 [i40e]\n   i40e_probe.part.108+0x134b/0x1a40 [i40e]\n   ? kmem_cache_alloc+0x158/0x1c0\n   ? acpi_ut_update_ref_count.part.1+0x8e/0x345\n   ? acpi_ut_update_object_reference+0x15e/0x1e2\n   ? strstr+0x21/0x70\n   ? irq_get_irq_data+0xa/0x20\n   ? mp_check_pin_attr+0x13/0xc0\n   ? irq_get_irq_data+0xa/0x20\n   ? mp_map_pin_to_irq+0xd3/0x2f0\n   ? acpi_register_gsi_ioapic+0x93/0x170\n   ? pci_conf1_read+0xa4/0x100\n   ? pci_bus_read_config_word+0x49/0x70\n   ? do_pci_enable_device+0xcc/0x100\n   local_pci_probe+0x41/0x90\n   work_for_cpu_fn+0x16/0x20\n   process_one_work+0x1a7/0x360\n   worker_thread+0x1cf/0x390\n   ? create_worker+0x1a0/0x1a0\n   kthread+0x112/0x130\n   ? kthread_flush_work_fn+0x10/0x10\n   ret_from_fork+0x1f/0x40\n\nThe problem is that at that point misc IRQ vectors\nwere not allocated yet and we get a call trace\nthat driver is trying to free already free IRQ vectors.\n\nAdd a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED\nPF state before calling i40e_free_misc_vector. This state is set only if\nmisc IRQ vectors were properly initialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9df9b90f-f44f-41ee-b11b-26bb1b0d1141",
      "id": "CVE-2022-50374",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure\n\nsyzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1],\nfor rcu_sync_enter() is called without rcu_sync_init() due to\nhci_uart_tty_open() ignoring percpu_init_rwsem() failure.\n\nWhile we are at it, fix that hci_uart_register_device() ignores\npercpu_init_rwsem() failure and hci_uart_unregister_device() does not\ncall percpu_free_rwsem().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bfbb30c-c1b5-4409-bdcf-9d2911bd278e",
      "id": "CVE-2021-47459",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv\n\nIt will trigger UAF for rx_kref of j1939_priv as following.\n\n        cpu0                                    cpu1\nj1939_sk_bind(socket0, ndev0, ...)\nj1939_netdev_start\n                                        j1939_sk_bind(socket1, ndev0, ...)\n                                        j1939_netdev_start\nj1939_priv_set\n                                        j1939_priv_get_by_ndev_locked\nj1939_jsk_add\n.....\nj1939_netdev_stop\nkref_put_lock(\u0026priv-\u003erx_kref, ...)\n                                        kref_get(\u0026priv-\u003erx_kref, ...)\n                                        REFCOUNT_WARN(\"addition on 0;...\")\n\n====================================================\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0\nRIP: 0010:refcount_warn_saturate+0x169/0x1e0\nCall Trace:\n j1939_netdev_start+0x68b/0x920\n j1939_sk_bind+0x426/0xeb0\n ? security_socket_bind+0x83/0xb0\n\nThe rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to\nprotect.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6700217c-01b7-41d2-ae16-5a435084a71f",
      "id": "CVE-2021-47577",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check for wq exit after adding new worker task_work\n\nWe check IO_WQ_BIT_EXIT before attempting to create a new worker, and\nwq exit cancels pending work if we have any. But it's possible to have\na race between the two, where creation checks exit finding it not set,\nbut we're in the process of exiting. The exit side will cancel pending\ncreation task_work, but there's a gap where we add task_work after we've\ncanceled existing creations at exit time.\n\nFix this by checking the EXIT bit post adding the creation task_work.\nIf it's set, run the same cancelation that exit does.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d696c82b-88b2-4891-b169-c90fdfa27171",
      "id": "CVE-2021-47611",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: validate extended element ID is present\n\nBefore attempting to parse an extended element, verify that\nthe extended element ID is present.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c114809f-071e-4223-ad79-e087c98b7e58",
      "id": "CVE-2021-47619",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix queues reservation for XDP\n\nWhen XDP was configured on a system with large number of CPUs\nand X722 NIC there was a call trace with NULL pointer dereference.\n\ni40e 0000:87:00.0: failed to get tracking for 256 queues for VSI 0 err -12\ni40e 0000:87:00.0: setup of MAIN VSI failed\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: 0010:i40e_xdp+0xea/0x1b0 [i40e]\nCall Trace:\n? i40e_reconfig_rss_queues+0x130/0x130 [i40e]\ndev_xdp_install+0x61/0xe0\ndev_xdp_attach+0x18a/0x4c0\ndev_change_xdp_fd+0x1e6/0x220\ndo_setlink+0x616/0x1030\n? ahci_port_stop+0x80/0x80\n? ata_qc_issue+0x107/0x1e0\n? lock_timer_base+0x61/0x80\n? __mod_timer+0x202/0x380\nrtnl_setlink+0xe5/0x170\n? bpf_lsm_binder_transaction+0x10/0x10\n? security_capable+0x36/0x50\nrtnetlink_rcv_msg+0x121/0x350\n? rtnl_calcit.isra.0+0x100/0x100\nnetlink_rcv_skb+0x50/0xf0\nnetlink_unicast+0x1d3/0x2a0\nnetlink_sendmsg+0x22a/0x440\nsock_sendmsg+0x5e/0x60\n__sys_sendto+0xf0/0x160\n? __sys_getsockname+0x7e/0xc0\n? _copy_from_user+0x3c/0x80\n? __sys_setsockopt+0xc8/0x1a0\n__x64_sys_sendto+0x20/0x30\ndo_syscall_64+0x33/0x40\nentry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f83fa7a39e0\n\nThis was caused by PF queue pile fragmentation due to\nflow director VSI queue being placed right after main VSI.\nBecause of this main VSI was not able to resize its\nqueue allocation for XDP resulting in no queues allocated\nfor main VSI when XDP was turned on.\n\nFix this by always allocating last queue in PF queue pile\nfor a flow director VSI.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "689e6cfa-7aff-4bf1-8c21-02c84a565168",
      "id": "CVE-2022-3104",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "894e4c91-6451-4fb1-94a5-c34b11216df9",
      "id": "CVE-2022-3106",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "70cd3bd9-7981-4f7c-918e-d0e2aef0892a",
      "id": "CVE-2024-44947",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: Initialize beyond-EOF page contents before setting uptodate\n\nfuse_notify_store(), unlike fuse_do_readpage(), does not enable page\nzeroing (because it can be used to change partial page contents).\n\nSo fuse_notify_store() must be more careful to fully initialize page\ncontents (including parts of the page that are beyond end-of-file)\nbefore marking the page uptodate.\n\nThe current code can leave beyond-EOF page contents uninitialized, which\nmakes these uninitialized page contents visible to userspace via mmap().\n\nThis is an information leak, but only affects systems which do not\nenable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the\ncorresponding kernel command line parameter).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45d27134-1d19-4442-818d-9bfaf455ba28",
      "id": "CVE-2022-33741",
      "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5b4dad0-69e8-4479-b8ec-04baf9743689",
      "id": "CVE-2022-42703",
      "description": "mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b72a78b2-25c9-4a01-9348-38d178798f52",
      "id": "CVE-2022-48698",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix memory leak when using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  Fix this up by properly\ncalling dput().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1707f1ff-27ce-43b1-8dfe-e4d0d443a8f1",
      "id": "CVE-2022-49681",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxtensa: xtfpga: Fix refcount leak bug in setup\n\nIn machine_setup(), of_find_compatible_node() will return a node\npointer with refcount incremented. We should use of_node_put() when\nit is not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f411d80c-62d5-4a3c-a780-a769d6985630",
      "id": "CVE-2022-49065",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix the svc_deferred_event trace class\n\nFix a NULL deref crash that occurs when an svc_rqst is deferred\nwhile the sunrpc tracing subsystem is enabled. svc_revisit() sets\ndr-\u003exprt to NULL, so it can't be relied upon in the tracepoint to\nprovide the remote's address.\n\nUnfortunately we can't revert the \"svc_deferred_class\" hunk in\ncommit ece200ddd54b (\"sunrpc: Save remote presentation address in\nsvc_xprt for trace events\") because there is now a specific check\nof event format specifiers for unsafe dereferences. The warning\nthat check emits is:\n\n  event svc_defer_recv has unsafe dereference of argument 1\n\nA \"%pISpc\" format specifier with a \"struct sockaddr *\" is indeed\nflagged by this check.\n\nInstead, take the brute-force approach used by the svcrdma_qp_error\ntracepoint. Convert the dr::addr field into a presentation address\nin the TP_fast_assign() arm of the trace event, and store that as\na string. This fix can be backported to -stable kernels.\n\nIn the meantime, commit c6ced22997ad (\"tracing: Update print fmt\ncheck to handle new __get_sockaddr() macro\") is now in v5.18, so\nthis wonky fix can be replaced with __sockaddr() and friends\nproperly during the v5.19 merge window.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9148661f-8f9b-4e30-8c0a-d70578ca70ee",
      "id": "CVE-2022-49139",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix null ptr deref on hci_sync_conn_complete_evt\n\nThis event is just specified for SCO and eSCO link types.\nOn the reception of a HCI_Synchronous_Connection_Complete for a BDADDR\nof an existing LE connection, LE link type and a status that triggers the\nsecond case of the packet processing a NULL pointer dereference happens,\nas conn-\u003elink is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89a8bcef-b3b4-4e94-89b5-cdb4f17014a7",
      "id": "CVE-2022-49164",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/tm: Fix more userspace r13 corruption\n\nCommit cf13435b730a (\"powerpc/tm: Fix userspace r13 corruption\") fixes a\nproblem in treclaim where a SLB miss can occur on the\nthread_struct-\u003eckpt_regs while SCRATCH0 is live with the saved user r13\nvalue, clobbering it with the kernel r13 and ultimately resulting in\nkernel r13 being stored in ckpt_regs.\n\nThere is an equivalent problem in trechkpt where the user r13 value is\nloaded into r13 from chkpt_regs to be recheckpointed, but a SLB miss\ncould occur on ckpt_regs accesses after that, which will result in r13\nbeing clobbered with a kernel value and that will get recheckpointed and\nthen restored to user registers.\n\nThe same memory page is accessed right before this critical window where\na SLB miss could cause corruption, so hitting the bug requires the SLB\nentry be removed within a small window of instructions, which is\npossible if a SLB related MCE hits there. PAPR also permits the\nhypervisor to discard this SLB entry (because slb_shadow-\u003epersistent is\nonly set to SLB_NUM_BOLTED) although it's not known whether any\nimplementations would do this (KVM does not). So this is an extremely\nunlikely bug, only found by inspection.\n\nFix this by also storing user r13 in a temporary location on the kernel\nstack and don't change the r13 register from kernel r13 until the RI=0\ncritical section that does not fault.\n\nThe SCRATCH0 change is not strictly part of the fix, it's only used in\nthe RI=0 section so it does not have the same problem as the previous\nSCRATCH0 bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c39cd878-8ec2-415e-8b60-aa26e6ad8317",
      "id": "CVE-2022-49224",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init\n\nkobject_init_and_add() takes reference even when it fails.\nAccording to the doc of kobject_init_and_add()：\n\n   If this function returns an error, kobject_put() must be called to\n   properly clean up the memory associated with the object.\n\nFix memory leak by calling kobject_put().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b3b37d1-0f13-4b7f-88b4-de4044cb1601",
      "id": "CVE-2022-49420",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: annotate races around sk-\u003esk_bound_dev_if\n\nUDP sendmsg() is lockless, and reads sk-\u003esk_bound_dev_if while\nthis field can be changed by another thread.\n\nAdds minimal annotations to avoid KCSAN splats for UDP.\nFollowing patches will add more annotations to potential lockless readers.\n\nBUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg\n\nwrite to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0:\n __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221\n ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272\n inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576\n __sys_connect_file net/socket.c:1900 [inline]\n __sys_connect+0x197/0x1b0 net/socket.c:1917\n __do_sys_connect net/socket.c:1927 [inline]\n __se_sys_connect net/socket.c:1924 [inline]\n __x64_sys_connect+0x3d/0x50 net/socket.c:1924\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nread to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1:\n udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436\n inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652\n sock_sendmsg_nosec net/socket.c:705 [inline]\n sock_sendmsg net/socket.c:725 [inline]\n ____sys_sendmsg+0x39a/0x510 net/socket.c:2413\n ___sys_sendmsg net/socket.c:2467 [inline]\n __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553\n __do_sys_sendmmsg net/socket.c:2582 [inline]\n __se_sys_sendmmsg net/socket.c:2579 [inline]\n __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nvalue changed: 0x00000000 -\u003e 0xffffff9b\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G        W         5.18.0-rc1-syzkaller-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n\nI chose to not add Fixes: tag because race has minor consequences\nand stable teams busy enough.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "127fd7f8-451b-4120-b851-0f9f49adbf29",
      "id": "CVE-2022-49802",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix null pointer dereference in ftrace_add_mod()\n\nThe @ftrace_mod is allocated by kzalloc(), so both the members {prev,next}\nof @ftrace_mode-\u003elist are NULL, it's not a valid state to call list_del().\nIf kstrdup() for @ftrace_mod-\u003e{func|module} fails, it goes to @out_free\ntag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del()\nwill write prev-\u003enext and next-\u003eprev, where null pointer dereference\nhappens.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nOops: 0002 [#1] PREEMPT SMP NOPTI\nCall Trace:\n \u003cTASK\u003e\n ftrace_mod_callback+0x20d/0x220\n ? do_filp_open+0xd9/0x140\n ftrace_process_regex.isra.51+0xbf/0x130\n ftrace_regex_write.isra.52.part.53+0x6e/0x90\n vfs_write+0xee/0x3a0\n ? __audit_filter_op+0xb1/0x100\n ? auditd_test_task+0x38/0x50\n ksys_write+0xa5/0xe0\n do_syscall_64+0x3a/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nKernel panic - not syncing: Fatal exception\n\nSo call INIT_LIST_HEAD() to initialize the list member to fix this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29190f9e-27de-4e5c-ab41-77bf06d5f71d",
      "id": "CVE-2022-49910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu\n\nFix the race condition between the following two flows that run in\nparallel:\n\n1. l2cap_reassemble_sdu -\u003e chan-\u003eops-\u003erecv (l2cap_sock_recv_cb) -\u003e\n   __sock_queue_rcv_skb.\n\n2. bt_sock_recvmsg -\u003e skb_recv_datagram, skb_free_datagram.\n\nAn SKB can be queued by the first flow and immediately dequeued and\nfreed by the second flow, therefore the callers of l2cap_reassemble_sdu\ncan't use the SKB after that function returns. However, some places\ncontinue accessing struct l2cap_ctrl that resides in the SKB's CB for a\nshort time after l2cap_reassemble_sdu returns, leading to a\nuse-after-free condition (the stack trace is below, line numbers for\nkernel 5.19.8).\n\nFix it by keeping a local copy of struct l2cap_ctrl.\n\nBUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\nRead of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169\n\nWorkqueue: hci0 hci_rx_work [bluetooth]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))\n print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429)\n ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\n kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493)\n ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\n l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth\n l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth\n ret_from_fork (arch/x86/entry/entry_64.S:306)\n \u003c/TASK\u003e\n\nAllocated by task 43169:\n kasan_save_stack (mm/kasan/common.c:39)\n __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)\n kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293)\n __alloc_skb (net/core/skbuff.c:414)\n l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth\n l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth\n hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth\n process_one_work (kernel/workqueue.c:2289)\n worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437)\n kthread (kernel/kthread.c:376)\n ret_from_fork (arch/x86/entry/entry_64.S:306)\n\nFreed by task 27920:\n kasan_save_stack (mm/kasan/common.c:39)\n kasan_set_track (mm/kasan/common.c:45)\n kasan_set_free_info (mm/kasan/generic.c:372)\n ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328)\n slab_free_freelist_hook (mm/slub.c:1780)\n kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553)\n skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323)\n bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth\n l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth\n sock_read_iter (net/socket.c:1087)\n new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401)\n vfs_read (fs/read_write.c:482)\n ksys_read (fs/read_write.c:620)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21e7fada-823c-46d3-baa6-1e9e124ea9b6",
      "id": "CVE-2022-49932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace\n\nCall kvm_init() only after _all_ setup is complete, as kvm_init() exposes\n/dev/kvm to userspace and thus allows userspace to create VMs (and call\nother ioctls).  E.g. KVM will encounter a NULL pointer when attempting to\nadd a vCPU to the per-CPU loaded_vmcss_on_cpu list if userspace is able to\ncreate a VM before vmx_init() configures said list.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP\n CPU: 6 PID: 1143 Comm: stable Not tainted 6.0.0-rc7+ #988\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vmx_vcpu_load_vmcs+0x68/0x230 [kvm_intel]\n  \u003cTASK\u003e\n  vmx_vcpu_load+0x16/0x60 [kvm_intel]\n  kvm_arch_vcpu_load+0x32/0x1f0 [kvm]\n  vcpu_load+0x2f/0x40 [kvm]\n  kvm_arch_vcpu_create+0x231/0x310 [kvm]\n  kvm_vm_ioctl+0x79f/0xe10 [kvm]\n  ? handle_mm_fault+0xb1/0x220\n  __x64_sys_ioctl+0x80/0xb0\n  do_syscall_64+0x2b/0x50\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n RIP: 0033:0x7f5a6b05743b\n  \u003c/TASK\u003e\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel(+) kvm irqbypass",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8533b78d-6827-4b8b-bf07-a5b80e1ac5f9",
      "id": "CVE-2022-50028",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngadgetfs: ep_io - wait until IRQ finishes\n\nafter usb_ep_queue() if wait_for_completion_interruptible() is\ninterrupted we need to wait until IRQ gets finished.\n\nOtherwise complete() from epio_complete() can corrupt stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad17a456-df73-45fc-aec7-eb69f113bf58",
      "id": "CVE-2022-50166",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: When HCI work queue is drained, only queue chained work\n\nThe HCI command, event, and data packet processing workqueue is drained\nto avoid deadlock in commit\n76727c02c1e1 (\"Bluetooth: Call drain_workqueue() before resetting state\").\n\nThere is another delayed work, which will queue command to this drained\nworkqueue. Which results in the following error report:\n\nBluetooth: hci2: command 0x040f tx timeout\nWARNING: CPU: 1 PID: 18374 at kernel/workqueue.c:1438 __queue_work+0xdad/0x1140\nWorkqueue: events hci_cmd_timeout\nRIP: 0010:__queue_work+0xdad/0x1140\nRSP: 0000:ffffc90002cffc60 EFLAGS: 00010093\nRAX: 0000000000000000 RBX: ffff8880b9d3ec00 RCX: 0000000000000000\nRDX: ffff888024ba0000 RSI: ffffffff814e048d RDI: ffff8880b9d3ec08\nRBP: 0000000000000008 R08: 0000000000000000 R09: 00000000b9d39700\nR10: ffffffff814f73c6 R11: 0000000000000000 R12: ffff88807cce4c60\nR13: 0000000000000000 R14: ffff8880796d8800 R15: ffff8880796d8800\nFS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000c0174b4000 CR3: 000000007cae9000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? queue_work_on+0xcb/0x110\n ? lockdep_hardirqs_off+0x90/0xd0\n queue_work_on+0xee/0x110\n process_one_work+0x996/0x1610\n ? pwq_dec_nr_in_flight+0x2a0/0x2a0\n ? rwlock_bug.part.0+0x90/0x90\n ? _raw_spin_lock_irq+0x41/0x50\n worker_thread+0x665/0x1080\n ? process_one_work+0x1610/0x1610\n kthread+0x2e9/0x3a0\n ? kthread_complete_and_exit+0x40/0x40\n ret_from_fork+0x1f/0x30\n \u003c/TASK\u003e\n\nTo fix this, we can add a new HCI_DRAIN_WQ flag, and don't queue the\ntimeout workqueue while command workqueue is draining.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efa8cb94-17c4-4e03-ae58-5a15c98060a0",
      "id": "CVE-2025-38034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref\n\nbtrfs_prelim_ref() calls the old and new reference variables in the\nincorrect order. This causes a NULL pointer dereference because oldref\nis passed as NULL to trace_btrfs_prelim_ref_insert().\n\nNote, trace_btrfs_prelim_ref_insert() is being called with newref as\noldref (and oldref as NULL) on purpose in order to print out\nthe values of newref.\n\nTo reproduce:\necho 1 \u003e /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable\n\nPerform some writeback operations.\n\nBacktrace:\nBUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 115949067 P4D 115949067 PUD 11594a067 PMD 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 1 UID: 0 PID: 1188 Comm: fsstress Not tainted 6.15.0-rc2-tester+ #47 PREEMPT(voluntary)  7ca2cef72d5e9c600f0c7718adb6462de8149622\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014\n RIP: 0010:trace_event_raw_event_btrfs__prelim_ref+0x72/0x130\n Code: e8 43 81 9f ff 48 85 c0 74 78 4d 85 e4 0f 84 8f 00 00 00 49 8b 94 24 c0 06 00 00 48 8b 0a 48 89 48 08 48 8b 52 08 48 89 50 10 \u003c49\u003e 8b 55 18 48 89 50 18 49 8b 55 20 48 89 50 20 41 0f b6 55 28 88\n RSP: 0018:ffffce44820077a0 EFLAGS: 00010286\n RAX: ffff8c6b403f9014 RBX: ffff8c6b55825730 RCX: 304994edf9cf506b\n RDX: d8b11eb7f0fdb699 RSI: ffff8c6b403f9010 RDI: ffff8c6b403f9010\n RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000010\n R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8c6b4e8fb000\n R13: 0000000000000000 R14: ffffce44820077a8 R15: ffff8c6b4abd1540\n FS:  00007f4dc6813740(0000) GS:ffff8c6c1d378000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000018 CR3: 000000010eb42000 CR4: 0000000000750ef0\n PKRU: 55555554\n Call Trace:\n  \u003cTASK\u003e\n  prelim_ref_insert+0x1c1/0x270\n  find_parent_nodes+0x12a6/0x1ee0\n  ? __entry_text_end+0x101f06/0x101f09\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  btrfs_is_data_extent_shared+0x167/0x640\n  ? fiemap_process_hole+0xd0/0x2c0\n  extent_fiemap+0xa5c/0xbc0\n  ? __entry_text_end+0x101f05/0x101f09\n  btrfs_fiemap+0x7e/0xd0\n  do_vfs_ioctl+0x425/0x9d0\n  __x64_sys_ioctl+0x75/0xc0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9905feda-fed3-4244-9604-f00a60a44c78",
      "id": "CVE-2022-50242",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()\n\nIf vp alloc failed in qlcnic_sriov_init(), all previously allocated vp\nneeds to be freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad388eba-306b-45ca-97b5-593896cc6d0f",
      "id": "CVE-2022-50343",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix possible name leaks when rio_add_device() fails\n\nPatch series \"rapidio: fix three possible memory leaks\".\n\nThis patchset fixes three name leaks in error handling.\n - patch #1 fixes two name leaks while rio_add_device() fails.\n - patch #2 fixes a name leak while  rio_register_mport() fails.\n\n\nThis patch (of 2):\n\nIf rio_add_device() returns error, the name allocated by dev_set_name()\nneed be freed.  It should use put_device() to give up the reference in the\nerror path, so that the name can be freed in kobject_cleanup(), and the\n'rdev' can be freed in rio_release_dev().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f41b78a-e590-4c0d-a563-1789c3cf0af2",
      "id": "CVE-2022-50414",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fcoe: Fix transport not deattached when fcoe_if_init() fails\n\nfcoe_init() calls fcoe_transport_attach(\u0026fcoe_sw_transport), but when\nfcoe_if_init() fails, \u0026fcoe_sw_transport is not detached and leaves freed\n\u0026fcoe_sw_transport on fcoe_transports list. This causes panic when\nreinserting module.\n\n BUG: unable to handle page fault for address: fffffbfff82e2213\n RIP: 0010:fcoe_transport_attach+0xe1/0x230 [libfcoe]\n Call Trace:\n  \u003cTASK\u003e\n  do_one_initcall+0xd0/0x4e0\n  load_module+0x5eee/0x7210\n  ...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d80f2dda-f728-4ebc-a77f-f8fe11191466",
      "id": "CVE-2023-0394",
      "description": "A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3441110f-d39f-4ca1-b5e3-2b25f93bc501",
      "id": "CVE-2023-28772",
      "description": "An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61dfaa33-2a9b-4344-b274-c5740bb0f31d",
      "id": "CVE-2023-3268",
      "description": "An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cff79665-80ff-4320-910f-168374698432",
      "id": "CVE-2023-3359",
      "description": "An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab88e06e-caf5-42b7-8418-62a1bdfd2b5a",
      "id": "CVE-2023-52504",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/alternatives: Disable KASAN in apply_alternatives()\n\nFei has reported that KASAN triggers during apply_alternatives() on\na 5-level paging machine:\n\n\tBUG: KASAN: out-of-bounds in rcu_is_watching()\n\tRead of size 4 at addr ff110003ee6419a0 by task swapper/0/0\n\t...\n\t__asan_load4()\n\trcu_is_watching()\n\ttrace_hardirqs_on()\n\ttext_poke_early()\n\tapply_alternatives()\n\t...\n\nOn machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)\ngets patched. It includes KASAN code, where KASAN_SHADOW_START depends on\n__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().\n\nKASAN gets confused when apply_alternatives() patches the\nKASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START\nstatic, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.\n\nFix it for real by disabling KASAN while the kernel is patching alternatives.\n\n[ mingo: updated the changelog ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dae015a3-b081-4673-9dff-4a7df55a40e6",
      "id": "CVE-2023-52530",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix potential key use-after-free\n\nWhen ieee80211_key_link() is called by ieee80211_gtk_rekey_add()\nbut returns 0 due to KRACK protection (identical key reinstall),\nieee80211_gtk_rekey_add() will still return a pointer into the\nkey, in a potential use-after-free. This normally doesn't happen\nsince it's only called by iwlwifi in case of WoWLAN rekey offload\nwhich has its own KRACK protection, but still better to fix, do\nthat by returning an error code and converting that to success on\nthe cfg80211 boundary only, leaving the error for bad callers of\nieee80211_gtk_rekey_add().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6689f45a-1b6b-4d3f-ab74-f05de9427c3c",
      "id": "CVE-2023-52650",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tegra: dsi: Add missing check for of_find_device_by_node\n\nAdd check for the return value of of_find_device_by_node() and return\nthe error if it fails in order to avoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e330b16-947c-46f7-9795-a82af9948dad",
      "id": "CVE-2023-3355",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "522608db-a6d6-4a56-a4aa-54b32170b8ae",
      "id": "CVE-2023-52664",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: eliminate double free in error handling logic\n\nDriver has a logic leak in ring data allocation/free,\nwhere aq_ring_free could be called multiple times on same ring,\nif system is under stress and got memory allocation error.\n\nRing pointer was used as an indicator of failure, but this is\nnot correct since only ring data is allocated/deallocated.\nRing itself is an array member.\n\nChanging ring allocation functions to return error code directly.\nThis simplifies error handling and eliminates aq_ring_free\non higher layer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bc10d75-eea1-4eea-9517-39c258ddece9",
      "id": "CVE-2023-52828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Detect IP == ksym.end as part of BPF program\n\nNow that bpf_throw kfunc is the first such call instruction that has\nnoreturn semantics within the verifier, this also kicks in dead code\nelimination in unprecedented ways. For one, any instruction following\na bpf_throw call will never be marked as seen. Moreover, if a callchain\nends up throwing, any instructions after the call instruction to the\neventually throwing subprog in callers will also never be marked as\nseen.\n\nThe tempting way to fix this would be to emit extra 'int3' instructions\nwhich bump the jited_len of a program, and ensure that during runtime\nwhen a program throws, we can discover its boundaries even if the call\ninstruction to bpf_throw (or to subprogs that always throw) is emitted\nas the final instruction in the program.\n\nAn example of such a program would be this:\n\ndo_something():\n\t...\n\tr0 = 0\n\texit\n\nfoo():\n\tr1 = 0\n\tcall bpf_throw\n\tr0 = 0\n\texit\n\nbar(cond):\n\tif r1 != 0 goto pc+2\n\tcall do_something\n\texit\n\tcall foo\n\tr0 = 0  // Never seen by verifier\n\texit\t//\n\nmain(ctx):\n\tr1 = ...\n\tcall bar\n\tr0 = 0\n\texit\n\nHere, if we do end up throwing, the stacktrace would be the following:\n\nbpf_throw\nfoo\nbar\nmain\n\nIn bar, the final instruction emitted will be the call to foo, as such,\nthe return address will be the subsequent instruction (which the JIT\nemits as int3 on x86). This will end up lying outside the jited_len of\nthe program, thus, when unwinding, we will fail to discover the return\naddress as belonging to any program and end up in a panic due to the\nunreliable stack unwinding of BPF programs that we never expect.\n\nTo remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as\npart of the BPF program, so that is_bpf_text_address returns true when\nsuch a case occurs, and we are able to unwind reliably when the final\ninstruction ends up being a call instruction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a0e2100-9202-47aa-98a4-096c3ac4b4f1",
      "id": "CVE-2023-52989",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region\n\nThis patch is fix for Linux kernel v2.6.33 or later.\n\nFor request subaction to IEC 61883-1 FCP region, Linux FireWire subsystem\nhave had an issue of use-after-free. The subsystem allows multiple\nuser space listeners to the region, while data of the payload was likely\nreleased before the listeners execute read(2) to access to it for copying\nto user space.\n\nThe issue was fixed by a commit 281e20323ab7 (\"firewire: core: fix\nuse-after-free regression in FCP handler\"). The object of payload is\nduplicated in kernel space for each listener. When the listener executes\nioctl(2) with FW_CDEV_IOC_SEND_RESPONSE request, the object is going to\nbe released.\n\nHowever, it causes memory leak since the commit relies on call of\nrelease_request() in drivers/firewire/core-cdev.c. Against the\nexpectation, the function is never called due to the design of\nrelease_client_resource(). The function delegates release task\nto caller when called with non-NULL fourth argument. The implementation\nof ioctl_send_response() is the case. It should release the object\nexplicitly.\n\nThis commit fixes the bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c83078a8-77dd-42d5-8cc1-c64dae5e455b",
      "id": "CVE-2023-6039",
      "description": "A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63f8b9a7-cc4e-4ea2-a1d3-e38cdeaf300c",
      "id": "CVE-2023-6560",
      "description": "An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01c9e686-4498-4776-92c1-277a8ef2eac9",
      "id": "CVE-2024-26671",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix IO hang from sbitmap wakeup race\n\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\n\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can't get driver tag successfully.\n\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in \u003c 30min when running it on my test VM\nin laptop.\n\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\"$dev\" --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\n\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "804fbd99-bdf5-44da-a166-30bd087f7772",
      "id": "CVE-2024-26675",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp_async: limit MRU to 64K\n\nsyzbot triggered a warning [1] in __alloc_pages():\n\nWARN_ON_ONCE_GFP(order \u003e MAX_PAGE_ORDER, gfp)\n\nWillem fixed a similar issue in commit c0a2a1b0d631 (\"ppp: limit MRU to 64K\")\n\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\n\n[1]:\n\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c07a806-fabb-4b08-84ab-1b02307e8eef",
      "id": "CVE-2024-26679",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: read sk-\u003esk_family once in inet_recv_error()\n\ninet_recv_error() is called without holding the socket lock.\n\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7dca547-9b3c-4adf-a317-95adab65104a",
      "id": "CVE-2024-26763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: don't modify the data when using authenticated encryption\n\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\n\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\n\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0970efa-7b58-42eb-8b81-3adfa5827694",
      "id": "CVE-2024-26791",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: dev-replace: properly validate device names\n\nThere's a syzbot report that device name buffers passed to device\nreplace are not properly checked for string termination which could lead\nto a read out of bounds in getname_kernel().\n\nAdd a helper that validates both source and target device name buffers.\nFor devid as the source initialize the buffer to empty string in case\nsomething tries to read it later.\n\nThis was originally analyzed and fixed in a different way by Edward Adam\nDavis (see links).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19fb0bc4-051f-4aaf-91a3-d7accad5c537",
      "id": "CVE-2024-39471",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add error handle to avoid out-of-bounds\n\nif the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should\nbe stop to avoid out-of-bounds read, so directly return -EINVAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61247be7-fca2-45a0-8a6b-c5a3d043a7e7",
      "id": "CVE-2024-26906",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()\n\nWhen trying to use copy_from_kernel_nofault() to read vsyscall page\nthrough a bpf program, the following oops was reported:\n\n  BUG: unable to handle page fault for address: ffffffffff600000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0\n  Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:copy_from_kernel_nofault+0x6f/0x110\n  ......\n  Call Trace:\n   \u003cTASK\u003e\n   ? copy_from_kernel_nofault+0x6f/0x110\n   bpf_probe_read_kernel+0x1d/0x50\n   bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d\n   trace_call_bpf+0xc5/0x1c0\n   perf_call_bpf_enter.isra.0+0x69/0xb0\n   perf_syscall_enter+0x13e/0x200\n   syscall_trace_enter+0x188/0x1c0\n   do_syscall_64+0xb5/0xe0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n   \u003c/TASK\u003e\n  ......\n  ---[ end trace 0000000000000000 ]---\n\nThe oops is triggered when:\n\n1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall\npage and invokes copy_from_kernel_nofault() which in turn calls\n__get_user_asm().\n\n2) Because the vsyscall page address is not readable from kernel space,\na page fault exception is triggered accordingly.\n\n3) handle_page_fault() considers the vsyscall page address as a user\nspace address instead of a kernel space address. This results in the\nfix-up setup by bpf not being applied and a page_fault_oops() is invoked\ndue to SMAP.\n\nConsidering handle_page_fault() has already considered the vsyscall page\naddress as a userspace address, fix the problem by disallowing vsyscall\npage read for copy_from_kernel_nofault().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e5ceb124-a467-48fe-a142-86407cfc9d58",
      "id": "CVE-2024-26907",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix fortify source warning while accessing Eth segment\n\n ------------[ cut here ]------------\n memcpy: detected field-spanning write (size 56) of single field \"eseg-\u003einline_hdr.start\" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2)\n WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy\n  [last unloaded: mlx_compat(OE)]\n CPU: 0 PID: 293779 Comm: ssh Tainted: G           OE      6.2.0-32-generic #32~22.04.1-Ubuntu\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da \u003c0f\u003e 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7\n RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8\n R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80\n FS:  00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cTASK\u003e\n  ? show_regs+0x72/0x90\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? __warn+0x8d/0x160\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? report_bug+0x1bb/0x1d0\n  ? handle_bug+0x46/0x90\n  ? exc_invalid_op+0x19/0x80\n  ? asm_exc_invalid_op+0x1b/0x20\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib]\n  ipoib_send+0x2ec/0x770 [ib_ipoib]\n  ipoib_start_xmit+0x5a0/0x770 [ib_ipoib]\n  dev_hard_start_xmit+0x8e/0x1e0\n  ? validate_xmit_skb_list+0x4d/0x80\n  sch_direct_xmit+0x116/0x3a0\n  __dev_xmit_skb+0x1fd/0x580\n  __dev_queue_xmit+0x284/0x6b0\n  ? _raw_spin_unlock_irq+0xe/0x50\n  ? __flush_work.isra.0+0x20d/0x370\n  ? push_pseudo_header+0x17/0x40 [ib_ipoib]\n  neigh_connected_output+0xcd/0x110\n  ip_finish_output2+0x179/0x480\n  ? __smp_call_single_queue+0x61/0xa0\n  __ip_finish_output+0xc3/0x190\n  ip_finish_output+0x2e/0xf0\n  ip_output+0x78/0x110\n  ? __pfx_ip_finish_output+0x10/0x10\n  ip_local_out+0x64/0x70\n  __ip_queue_xmit+0x18a/0x460\n  ip_queue_xmit+0x15/0x30\n  __tcp_transmit_skb+0x914/0x9c0\n  tcp_write_xmit+0x334/0x8d0\n  tcp_push_one+0x3c/0x60\n  tcp_sendmsg_locked+0x2e1/0xac0\n  tcp_sendmsg+0x2d/0x50\n  inet_sendmsg+0x43/0x90\n  sock_sendmsg+0x68/0x80\n  sock_write_iter+0x93/0x100\n  vfs_write+0x326/0x3c0\n  ksys_write+0xbd/0xf0\n  ? do_syscall_64+0x69/0x90\n  __x64_sys_write+0x19/0x30\n  do_syscall_\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90433aca-e229-4955-bbd0-7aea406a7ee0",
      "id": "CVE-2024-27028",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-mt65xx: Fix NULL pointer access in interrupt handler\n\nThe TX buffer in spi_transfer can be a NULL pointer, so the interrupt\nhandler may end up writing to the invalid memory and cause crashes.\n\nAdd a check to trans-\u003etx_buf before using it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "998aaa9e-595b-4161-a7e8-b5c718995b3b",
      "id": "CVE-2024-27077",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity\n\nThe entity-\u003ename (i.e. name) is allocated in v4l2_m2m_register_entity\nbut isn't freed in its following error-handling paths. This patch\nadds such deallocation to prevent memleak of entity-\u003ename.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b786ea21-20f9-48ac-ae27-6adbc58d20cc",
      "id": "CVE-2024-27419",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Fix data-races around sysctl_net_busy_read\n\nWe need to protect the reader reading the sysctl value because the\nvalue can be changed concurrently.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "219f71f5-67b0-41e4-a85d-b69a5a4fe2ae",
      "id": "CVE-2024-35848",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\neeprom: at24: fix memory corruption race condition\n\nIf the eeprom is not accessible, an nvmem device will be registered, the\nread will fail, and the device will be torn down. If another driver\naccesses the nvmem device after the teardown, it will reference\ninvalid memory.\n\nMove the failure point before registering the nvmem device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c6bc253-d92b-45e4-878b-6b685a09d18d",
      "id": "CVE-2024-35849",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix information leak in btrfs_ioctl_logical_to_ino()\n\nSyzbot reported the following information leak for in\nbtrfs_ioctl_logical_to_ino():\n\n  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n  BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n   _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   copy_to_user include/linux/uaccess.h:191 [inline]\n   btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  Uninit was created at:\n   __kmalloc_large_node+0x231/0x370 mm/slub.c:3921\n   __do_kmalloc_node mm/slub.c:3954 [inline]\n   __kmalloc_node+0xb07/0x1060 mm/slub.c:3973\n   kmalloc_node include/linux/slab.h:648 [inline]\n   kvmalloc_node+0xc0/0x2d0 mm/util.c:634\n   kvmalloc include/linux/slab.h:766 [inline]\n   init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779\n   btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  Bytes 40-65535 of 65536 are uninitialized\n  Memory access of size 65536 starts at ffff888045a40000\n\nThis happens, because we're copying a 'struct btrfs_data_container' back\nto user-space. This btrfs_data_container is allocated in\n'init_data_container()' via kvmalloc(), which does not zero-fill the\nmemory.\n\nFix this by using kvzalloc() which zeroes out the memory on allocation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ec73444-409f-453c-9da4-8891d0d5e4ee",
      "id": "CVE-2024-35853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\n\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\n\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\n\nEach virtual chunk references two chunks: The currently used one\n('vchunk-\u003echunk') and a backup ('vchunk-\u003echunk2'). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\n\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\n\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\n\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "560be383-47f1-4803-9aaa-32721ffb7358",
      "id": "CVE-2024-35854",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\n\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\n\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\n\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\n\nFix by not destroying the region if migration failed.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\n\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "231a9b02-6336-44bf-9d76-148318cd4e86",
      "id": "CVE-2024-35904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: avoid dereference of garbage after mount failure\n\nIn case kern_mount() fails and returns an error pointer return in the\nerror branch instead of continuing and dereferencing the error pointer.\n\nWhile on it drop the never read static variable selinuxfs_mount.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e824cc5a-878c-40be-9bc3-fed938fe14c2",
      "id": "CVE-2024-35943",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: ti: Add a null pointer check to the omap_prm_domain_init\n\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20d7a9aa-5308-45f2-ac93-f01081182520",
      "id": "CVE-2024-36894",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete\n\nFFS based applications can utilize the aio_cancel() callback to dequeue\npending USB requests submitted to the UDC.  There is a scenario where the\nFFS application issues an AIO cancel call, while the UDC is handling a\nsoft disconnect.  For a DWC3 based implementation, the callstack looks\nlike the following:\n\n    DWC3 Gadget                               FFS Application\ndwc3_gadget_soft_disconnect()              ...\n  --\u003e dwc3_stop_active_transfers()\n    --\u003e dwc3_gadget_giveback(-ESHUTDOWN)\n      --\u003e ffs_epfile_async_io_complete()   ffs_aio_cancel()\n        --\u003e usb_ep_free_request()            --\u003e usb_ep_dequeue()\n\nThere is currently no locking implemented between the AIO completion\nhandler and AIO cancel, so the issue occurs if the completion routine is\nrunning in parallel to an AIO cancel call coming from the FFS application.\nAs the completion call frees the USB request (io_data-\u003ereq) the FFS\napplication is also referencing it for the usb_ep_dequeue() call.  This can\nlead to accessing a stale/hanging pointer.\n\ncommit b566d38857fc (\"usb: gadget: f_fs: use io_data-\u003estatus consistently\")\nrelocated the usb_ep_free_request() into ffs_epfile_async_io_complete().\nHowever, in order to properly implement locking to mitigate this issue, the\nspinlock can't be added to ffs_epfile_async_io_complete(), as\nusb_ep_dequeue() (if successfully dequeuing a USB request) will call the\nfunction driver's completion handler in the same context.  Hence, leading\ninto a deadlock.\n\nFix this issue by moving the usb_ep_free_request() back to\nffs_user_copy_worker(), and ensuring that it explicitly sets io_data-\u003ereq\nto NULL after freeing it within the ffs-\u003eeps_lock.  This resolves the race\ncondition above, as the ffs_aio_cancel() routine will not continue\nattempting to dequeue a request that has already been freed, or the\nffs_user_copy_work() not freeing the USB request until the AIO cancel is\ndone referencing it.\n\nThis fix depends on\n  commit b566d38857fc (\"usb: gadget: f_fs: use io_data-\u003estatus\n  consistently\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f8ac06c-5c36-46ab-986e-1f76bb10d06d",
      "id": "CVE-2024-36950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: ohci: mask bus reset interrupts between ISR and bottom half\n\nIn the FireWire OHCI interrupt handler, if a bus reset interrupt has\noccurred, mask bus reset interrupts until bus_reset_work has serviced and\ncleared the interrupt.\n\nNormally, we always leave bus reset interrupts masked. We infer the bus\nreset from the self-ID interrupt that happens shortly thereafter. A\nscenario where we unmask bus reset interrupts was introduced in 2008 in\na007bb857e0b26f5d8b73c2ff90782d9c0972620: If\nOHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we\nwill unmask bus reset interrupts so we can log them.\n\nirq_handler logs the bus reset interrupt. However, we can't clear the bus\nreset event flag in irq_handler, because we won't service the event until\nlater. irq_handler exits with the event flag still set. If the\ncorresponding interrupt is still unmasked, the first bus reset will\nusually freeze the system due to irq_handler being called again each\ntime it exits. This freeze can be reproduced by loading firewire_ohci\nwith \"modprobe firewire_ohci debug=-1\" (to enable all debugging output).\nApparently there are also some cases where bus_reset_work will get called\nsoon enough to clear the event, and operation will continue normally.\n\nThis freeze was first reported a few months after a007bb85 was committed,\nbut until now it was never fixed. The debug level could safely be set\nto -1 through sysfs after the module was loaded, but this would be\nineffectual in logging bus reset interrupts since they were only\nunmasked during initialization.\n\nirq_handler will now leave the event flag set but mask bus reset\ninterrupts, so irq_handler won't be called again and there will be no\nfreeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will\nunmask the interrupt after servicing the event, so future interrupts\nwill be caught as desired.\n\nAs a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be\nenabled through sysfs in addition to during initial module loading.\nHowever, when enabled through sysfs, logging of bus reset interrupts will\nbe effective only starting with the second bus reset, after\nbus_reset_work has executed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc35d940-f99b-4e64-a50a-0714f7cac271",
      "id": "CVE-2024-41077",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix validation of block size\n\nBlock size should be between 512 and PAGE_SIZE and be a power of 2. The current\ncheck does not validate this, so update the check.\n\nWithout this patch, null_blk would Oops due to a null pointer deref when\nloaded with bs=1536 [1].\n\n\n[axboe: remove unnecessary braces and != 0 check]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d3ac49c-8b44-43a8-80c8-7ab464042fdd",
      "id": "CVE-2024-42077",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix DIO failure due to insufficient transaction credits\n\nThe code in ocfs2_dio_end_io_write() estimates number of necessary\ntransaction credits using ocfs2_calc_extend_credits().  This however does\nnot take into account that the IO could be arbitrarily large and can\ncontain arbitrary number of extents.\n\nExtent tree manipulations do often extend the current transaction but not\nin all of the cases.  For example if we have only single block extents in\nthe tree, ocfs2_mark_extent_written() will end up calling\nocfs2_replace_extent_rec() all the time and we will never extend the\ncurrent transaction and eventually exhaust all the transaction credits if\nthe IO contains many single block extents.  Once that happens a\nWARN_ON(jbd2_handle_buffer_credits(handle) \u003c= 0) is triggered in\njbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to\nthis error.  This was actually triggered by one of our customers on a\nheavily fragmented OCFS2 filesystem.\n\nTo fix the issue make sure the transaction always has enough credits for\none extent insert before each call of ocfs2_mark_extent_written().\n\nHeming Zhao said:\n\n------\nPANIC: \"Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error\"\n\nPID: xxx  TASK: xxxx  CPU: 5  COMMAND: \"SubmitThread-CA\"\n  #0 machine_kexec at ffffffff8c069932\n  #1 __crash_kexec at ffffffff8c1338fa\n  #2 panic at ffffffff8c1d69b9\n  #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]\n  #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]\n  #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]\n  #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]\n  #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]\n  #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]\n  #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]\n#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]\n#11 dio_complete at ffffffff8c2b9fa7\n#12 do_blockdev_direct_IO at ffffffff8c2bc09f\n#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]\n#14 generic_file_direct_write at ffffffff8c1dcf14\n#15 __generic_file_write_iter at ffffffff8c1dd07b\n#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]\n#17 aio_write at ffffffff8c2cc72e\n#18 kmem_cache_alloc at ffffffff8c248dde\n#19 do_io_submit at ffffffff8c2ccada\n#20 do_syscall_64 at ffffffff8c004984\n#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7fa833f8-3465-4737-b61c-9eb794269f65",
      "id": "CVE-2024-42321",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: flow_dissector: use DEBUG_NET_WARN_ON_ONCE\n\nThe following splat is easy to reproduce upstream as well as in -stable\nkernels. Florian Westphal provided the following commit:\n\n  d1dab4f71d37 (\"net: add and use __skb_get_hash_symmetric_net\")\n\nbut this complementary fix has been also suggested by Willem de Bruijn\nand it can be easily backported to -stable kernel which consists in\nusing DEBUG_NET_WARN_ON_ONCE instead to silence the following splat\ngiven __skb_get_hash() is used by the nftables tracing infrastructure to\nto identify packets in traces.\n\n[69133.561393] ------------[ cut here ]------------\n[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/\n[...]\n[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379\n[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0\n[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff\nff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff \u003c0f\u003e 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8\n[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246\n[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19\n[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418\n[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000\n[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400\n[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28\n[69133.562020] FS:  00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000\n[69133.562027] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0\n[69133.562040] Call Trace:\n[69133.562044]  \u003cIRQ\u003e\n[69133.562049]  ? __warn+0x9f/0x1a0\n[ 1211.841384]  ? __skb_flow_dissect+0x107e/0x2860\n[...]\n[ 1211.841496]  ? bpf_flow_dissect+0x160/0x160\n[ 1211.841753]  __skb_get_hash+0x97/0x280\n[ 1211.841765]  ? __skb_get_hash_symmetric+0x230/0x230\n[ 1211.841776]  ? mod_find+0xbf/0xe0\n[ 1211.841786]  ? get_stack_info_noinstr+0x12/0xe0\n[ 1211.841798]  ? bpf_ksym_find+0x56/0xe0\n[ 1211.841807]  ? __rcu_read_unlock+0x2a/0x70\n[ 1211.841819]  nft_trace_init+0x1b9/0x1c0 [nf_tables]\n[ 1211.841895]  ? nft_trace_notify+0x830/0x830 [nf_tables]\n[ 1211.841964]  ? get_stack_info+0x2b/0x80\n[ 1211.841975]  ? nft_do_chain_arp+0x80/0x80 [nf_tables]\n[ 1211.842044]  nft_do_chain+0x79c/0x850 [nf_tables]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4418274b-b85f-4933-a855-729f71edb92e",
      "id": "CVE-2024-43846",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib: objagg: Fix general protection fault\n\nThe library supports aggregation of objects into other objects only if\nthe parent object does not have a parent itself. That is, nesting is not\nsupported.\n\nAggregation happens in two cases: Without and with hints, where hints\nare a pre-computed recommendation on how to aggregate the provided\nobjects.\n\nNesting is not possible in the first case due to a check that prevents\nit, but in the second case there is no check because the assumption is\nthat nesting cannot happen when creating objects based on hints. The\nviolation of this assumption leads to various warnings and eventually to\na general protection fault [1].\n\nBefore fixing the root cause, error out when nesting happens and warn.\n\n[1]\ngeneral protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI\nCPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G        W          6.9.0-rc6-custom-gd9b4f1cca7fb #7\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09991b12-35f9-44a0-a2fc-250f6c07d68b",
      "id": "CVE-2024-43893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: check uartclk for zero to avoid divide by zero\n\nCalling ioctl TIOCSSERIAL with an invalid baud_base can\nresult in uartclk being zero, which will result in a\ndivide by zero error in uart_get_divisor(). The check for\nuartclk being zero in uart_set_info() needs to be done\nbefore other settings are made as subsequent calls to\nioctl TIOCSSERIAL for the same port would be impacted if\nthe uartclk check was done where uartclk gets set.\n\nOops: divide error: 0000  PREEMPT SMP KASAN PTI\nRIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580)\nCall Trace:\n \u003cTASK\u003e\nserial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576\n    drivers/tty/serial/8250/8250_port.c:2589)\nserial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502\n    drivers/tty/serial/8250/8250_port.c:2741)\nserial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862)\nuart_change_line_settings (./include/linux/spinlock.h:376\n    ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222)\nuart_port_startup (drivers/tty/serial/serial_core.c:342)\nuart_startup (drivers/tty/serial/serial_core.c:368)\nuart_set_info (drivers/tty/serial/serial_core.c:1034)\nuart_set_info_user (drivers/tty/serial/serial_core.c:1059)\ntty_set_serial (drivers/tty/tty_io.c:2637)\ntty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)\n__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907\n    fs/ioctl.c:893 fs/ioctl.c:893)\ndo_syscall_64 (arch/x86/entry/common.c:52\n    (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nRule: add",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a77f5c49-c302-48c3-9cef-11cb6e2fd723",
      "id": "CVE-2024-46727",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update\n\n[Why]\nCoverity reports NULL_RETURN warning.\n\n[How]\nAdd otg_master NULL check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bb74506-1d1c-429c-8d15-e50c7d2f4798",
      "id": "CVE-2024-46774",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()\n\nSmatch warns:\n\n  arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential\n  spectre issue 'args.args' [r] (local cap)\n\nThe 'nargs' and 'nret' locals come directly from a user-supplied\nbuffer and are used as indexes into a small stack-based array and as\ninputs to copy_to_user() after they are subject to bounds checks.\n\nUse array_index_nospec() after the bounds checks to clamp these values\nfor speculative execution.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d33fab90-b6bb-4ce1-bc34-aaa05f6e6b43",
      "id": "CVE-2024-49901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/adreno: Assign msm_gpu-\u003epdev earlier to avoid nullptrs\n\nThere are some cases, such as the one uncovered by Commit 46d4efcccc68\n(\"drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails\")\nwhere\n\nmsm_gpu_cleanup() : platform_set_drvdata(gpu-\u003epdev, NULL);\n\nis called on gpu-\u003epdev == NULL, as the GPU device has not been fully\ninitialized yet.\n\nTurns out that there's more than just the aforementioned path that\ncauses this to happen (e.g. the case when there's speedbin data in the\ncatalog, but opp-supported-hw is missing in DT).\n\nAssigning msm_gpu-\u003epdev earlier seems like the least painful solution\nto this, therefore do so.\n\nPatchwork: https://patchwork.freedesktop.org/patch/602742/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77acb7bd-09e5-4b06-81c2-d841253a675c",
      "id": "CVE-2024-50099",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: probes: Remove broken LDR (literal) uprobe support\n\nThe simulate_ldr_literal() and simulate_ldrsw_literal() functions are\nunsafe to use for uprobes. Both functions were originally written for\nuse with kprobes, and access memory with plain C accesses. When uprobes\nwas added, these were reused unmodified even though they cannot safely\naccess user memory.\n\nThere are three key problems:\n\n1) The plain C accesses do not have corresponding extable entries, and\n   thus if they encounter a fault the kernel will treat these as\n   unintentional accesses to user memory, resulting in a BUG() which\n   will kill the kernel thread, and likely lead to further issues (e.g.\n   lockup or panic()).\n\n2) The plain C accesses are subject to HW PAN and SW PAN, and so when\n   either is in use, any attempt to simulate an access to user memory\n   will fault. Thus neither simulate_ldr_literal() nor\n   simulate_ldrsw_literal() can do anything useful when simulating a\n   user instruction on any system with HW PAN or SW PAN.\n\n3) The plain C accesses are privileged, as they run in kernel context,\n   and in practice can access a small range of kernel virtual addresses.\n   The instructions they simulate have a range of +/-1MiB, and since the\n   simulated instructions must itself be a user instructions in the\n   TTBR0 address range, these can address the final 1MiB of the TTBR1\n   acddress range by wrapping downwards from an address in the first\n   1MiB of the TTBR0 address range.\n\n   In contemporary kernels the last 8MiB of TTBR1 address range is\n   reserved, and accesses to this will always fault, meaning this is no\n   worse than (1).\n\n   Historically, it was theoretically possible for the linear map or\n   vmemmap to spill into the final 8MiB of the TTBR1 address range, but\n   in practice this is extremely unlikely to occur as this would\n   require either:\n\n   * Having enough physical memory to fill the entire linear map all the\n     way to the final 1MiB of the TTBR1 address range.\n\n   * Getting unlucky with KASLR randomization of the linear map such\n     that the populated region happens to overlap with the last 1MiB of\n     the TTBR address range.\n\n   ... and in either case if we were to spill into the final page there\n   would be larger problems as the final page would alias with error\n   pointers.\n\nPractically speaking, (1) and (2) are the big issues. Given there have\nbeen no reports of problems since the broken code was introduced, it\nappears that no-one is relying on probing these instructions with\nuprobes.\n\nAvoid these issues by not allowing uprobes on LDR (literal) and LDRSW\n(literal), limiting the use of simulate_ldr_literal() and\nsimulate_ldrsw_literal() to kprobes. Attempts to place uprobes on LDR\n(literal) and LDRSW (literal) will be rejected as\narm_probe_decode_insn() will return INSN_REJECTED. In future we can\nconsider introducing working uprobes support for these instructions, but\nthis will require more significant work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fe9a8bb-2bf2-4ca2-8dbb-e2478c4c63e6",
      "id": "CVE-2024-50131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Consider the NULL character when validating the event length\n\nstrlen() returns a string length excluding the null byte. If the string\nlength equals to the maximum buffer length, the buffer will have no\nspace for the NULL terminating character.\n\nThis commit checks this condition and returns failure for it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20c9b1bf-3d85-4173-87b1-b141f50c30d2",
      "id": "CVE-2024-50168",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sun3_82586: fix potential memory leak in sun3_82586_send_packet()\n\nThe sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb\nin case of skb-\u003elen being too long, add dev_kfree_skb() to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72ccb178-a118-49cc-a455-9cc756059d7b",
      "id": "CVE-2024-50183",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance\n\nDeleting an NPIV instance requires all fabric ndlps to be released before\nan NPIV's resources can be torn down.  Failure to release fabric ndlps\nbeforehand opens kref imbalance race conditions.  Fix by forcing the DA_ID\nto complete synchronously with usage of wait_queue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d39ac35f-abc1-49b6-b9f4-41c9345d4fa2",
      "id": "CVE-2024-50202",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: propagate directory read errors from nilfs_find_entry()\n\nSyzbot reported that a task hang occurs in vcs_open() during a fuzzing\ntest for nilfs2.\n\nThe root cause of this problem is that in nilfs_find_entry(), which\nsearches for directory entries, ignores errors when loading a directory\npage/folio via nilfs_get_folio() fails.\n\nIf the filesystem images is corrupted, and the i_size of the directory\ninode is large, and the directory page/folio is successfully read but\nfails the sanity check, for example when it is zero-filled,\nnilfs_check_folio() may continue to spit out error messages in bursts.\n\nFix this issue by propagating the error to the callers when loading a\npage/folio fails in nilfs_find_entry().\n\nThe current interface of nilfs_find_entry() and its callers is outdated\nand cannot propagate error codes such as -EIO and -ENOMEM returned via\nnilfs_find_entry(), so fix it together.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d1488f6-6cb9-4390-961c-6dc82c5a356a",
      "id": "CVE-2024-50262",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds write in trie_get_next_key()\n\ntrie_get_next_key() allocates a node stack with size trie-\u003emax_prefixlen,\nwhile it writes (trie-\u003emax_prefixlen + 1) nodes to the stack when it has\nfull paths from the root to leaves. For example, consider a trie with\nmax_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ...\n0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with\n.prefixlen = 8 make 9 nodes be written on the node stack with size 8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54659815-6f95-4cb1-918f-c99459dcb304",
      "id": "CVE-2024-53164",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix ordering of qlen adjustment\n\nChanges to sch-\u003eq.qlen around qdisc_tree_reduce_backlog() need to happen\n_before_ a call to said function because otherwise it may fail to notify\nparent qdiscs when the child is about to become empty.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "298790c3-ca6f-4a81-ae3c-314582e8aacb",
      "id": "CVE-2024-53183",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: net: Do not use drvdata in release\n\nThe drvdata is not available in release. Let's just use container_of()\nto get the uml_net instance. Otherwise, removing a network device will\nresult in a crash:\n\nRIP: 0033:net_device_release+0x10/0x6f\nRSP: 00000000e20c7c40  EFLAGS: 00010206\nRAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0\nRDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028\nRBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70\nR10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000\nR13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1\nWorkqueue: events mc_work_proc\nStack:\n 627af028 62c7af00 e20c7c80 60276fcd\n 62778000 603f5820 627af028 00000000\n e20c7cb0 603a2bcd 627af000 62770010\nCall Trace:\n [\u003c60276fcd\u003e] device_release+0x70/0xba\n [\u003c603a2bcd\u003e] kobject_put+0xba/0xe7\n [\u003c60277265\u003e] put_device+0x19/0x1c\n [\u003c60281266\u003e] platform_device_put+0x26/0x29\n [\u003c60281e5f\u003e] platform_device_unregister+0x2c/0x2e\n [\u003c6002ec9c\u003e] net_remove+0x63/0x69\n [\u003c60031316\u003e] ? mconsole_reply+0x0/0x50\n [\u003c600310c8\u003e] mconsole_remove+0x160/0x1cc\n [\u003c60087d40\u003e] ? __remove_hrtimer+0x38/0x74\n [\u003c60087ff8\u003e] ? hrtimer_try_to_cancel+0x8c/0x98\n [\u003c6006b3cf\u003e] ? dl_server_stop+0x3f/0x48\n [\u003c6006b390\u003e] ? dl_server_stop+0x0/0x48\n [\u003c600672e8\u003e] ? dequeue_entities+0x327/0x390\n [\u003c60038fa6\u003e] ? um_set_signals+0x0/0x43\n [\u003c6003070c\u003e] mc_work_proc+0x77/0x91\n [\u003c60057664\u003e] process_scheduled_works+0x1b3/0x2dd\n [\u003c60055f32\u003e] ? assign_work+0x0/0x58\n [\u003c60057f0a\u003e] worker_thread+0x1e9/0x293\n [\u003c6005406f\u003e] ? set_pf_worker+0x0/0x64\n [\u003c6005d65d\u003e] ? arch_local_irq_save+0x0/0x2d\n [\u003c6005d748\u003e] ? kthread_exit+0x0/0x3a\n [\u003c60057d21\u003e] ? worker_thread+0x0/0x293\n [\u003c6005dbf1\u003e] kthread+0x126/0x12b\n [\u003c600219c5\u003e] new_thread_handler+0x85/0xb6",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3282b84-01cb-49d9-b391-e23a608bdcac",
      "id": "CVE-2024-53190",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures\n\nSyzkaller reported a hung task with uevent_show() on stack trace. That\nspecific issue was addressed by another commit [0], but even with that\nfix applied (for example, running v6.12-rc5) we face another type of hung\ntask that comes from the same reproducer [1]. By investigating that, we\ncould narrow it to the following path:\n\n(a) Syzkaller emulates a Realtek USB WiFi adapter using raw-gadget and\ndummy_hcd infrastructure.\n\n(b) During the probe of rtl8192cu, the driver ends-up performing an efuse\nread procedure (which is related to EEPROM load IIUC), and here lies the\nissue: the function read_efuse() calls read_efuse_byte() many times, as\nloop iterations depending on the efuse size (in our example, 512 in total).\n\nThis procedure for reading efuse bytes relies in a loop that performs an\nI/O read up to *10k* times in case of failures. We measured the time of\nthe loop inside read_efuse_byte() alone, and in this reproducer (which\ninvolves the dummy_hcd emulation layer), it takes 15 seconds each. As a\nconsequence, we have the driver stuck in its probe routine for big time,\nexposing a stack trace like below if we attempt to reboot the system, for\nexample:\n\ntask:kworker/0:3 state:D stack:0 pid:662 tgid:662 ppid:2 flags:0x00004000\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n __schedule+0xe22/0xeb6\n schedule_timeout+0xe7/0x132\n __wait_for_common+0xb5/0x12e\n usb_start_wait_urb+0xc5/0x1ef\n ? usb_alloc_urb+0x95/0xa4\n usb_control_msg+0xff/0x184\n _usbctrl_vendorreq_sync+0xa0/0x161\n _usb_read_sync+0xb3/0xc5\n read_efuse_byte+0x13c/0x146\n read_efuse+0x351/0x5f0\n efuse_read_all_map+0x42/0x52\n rtl_efuse_shadow_map_update+0x60/0xef\n rtl_get_hwinfo+0x5d/0x1c2\n rtl92cu_read_eeprom_info+0x10a/0x8d5\n ? rtl92c_read_chip_version+0x14f/0x17e\n rtl_usb_probe+0x323/0x851\n usb_probe_interface+0x278/0x34b\n really_probe+0x202/0x4a4\n __driver_probe_device+0x166/0x1b2\n driver_probe_device+0x2f/0xd8\n [...]\n\nWe propose hereby to drastically reduce the attempts of doing the I/O\nreads in case of failures, restricted to USB devices (given that\nthey're inherently slower than PCIe ones). By retrying up to 10 times\n(instead of 10000), we got reponsiveness in the reproducer, while seems\nreasonable to believe that there's no sane USB device implementation in\nthe field requiring this amount of retries at every I/O read in order\nto properly work. Based on that assumption, it'd be good to have it\nbackported to stable but maybe not since driver implementation (the 10k\nnumber comes from day 0), perhaps up to 6.x series makes sense.\n\n[0] Commit 15fffc6a5624 (\"driver core: Fix uevent_show() vs driver detach race\")\n\n[1] A note about that: this syzkaller report presents multiple reproducers\nthat differs by the type of emulated USB device. For this specific case,\ncheck the entry from 2024/08/08 06:23 in the list of crashes; the C repro\nis available at https://syzkaller.appspot.com/text?tag=ReproC\u0026x=1521fc83980000.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5aa179f1-d284-4138-b035-a204302e3440",
      "id": "CVE-2024-56532",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us122l: Use snd_card_free_when_closed() at disconnection\n\nThe USB disconnect callback is supposed to be short and not too-long\nwaiting.  OTOH, the current code uses snd_card_free() at\ndisconnection, but this waits for the close of all used fds, hence it\ncan take long.  It eventually blocks the upper layer USB ioctls, which\nmay trigger a soft lockup.\n\nAn easy workaround is to replace snd_card_free() with\nsnd_card_free_when_closed().  This variant returns immediately while\nthe release of resources is done asynchronously by the card device\nrelease at the last close.\n\nThe loop of us122l-\u003emmap_count check is dropped as well.  The check is\nuseless for the asynchronous operation with *_when_closed().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29bd562f-b061-49b7-a05a-0a0680c1896d",
      "id": "CVE-2024-56645",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: j1939_session_new(): fix skb reference counting\n\nSince j1939_session_skb_queue() does an extra skb_get() for each new\nskb, do the same for the initial one in j1939_session_new() to avoid\nrefcount underflow.\n\n[mkl: clean up commit message]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0fa4670-5b8f-4250-bcdd-4401aa791418",
      "id": "CVE-2024-56751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: release nexthop on device removal\n\nThe CI is hitting some aperiodic hangup at device removal time in the\npmtu.sh self-test:\n\nunregister_netdevice: waiting for veth_A-R1 to become free. Usage count = 6\nref_tracker: veth_A-R1@ffff888013df15d8 has 1/5 users at\n\tdst_init+0x84/0x4a0\n\tdst_alloc+0x97/0x150\n\tip6_dst_alloc+0x23/0x90\n\tip6_rt_pcpu_alloc+0x1e6/0x520\n\tip6_pol_route+0x56f/0x840\n\tfib6_rule_lookup+0x334/0x630\n\tip6_route_output_flags+0x259/0x480\n\tip6_dst_lookup_tail.constprop.0+0x5c2/0x940\n\tip6_dst_lookup_flow+0x88/0x190\n\tudp_tunnel6_dst_lookup+0x2a7/0x4c0\n\tvxlan_xmit_one+0xbde/0x4a50 [vxlan]\n\tvxlan_xmit+0x9ad/0xf20 [vxlan]\n\tdev_hard_start_xmit+0x10e/0x360\n\t__dev_queue_xmit+0xf95/0x18c0\n\tarp_solicit+0x4a2/0xe00\n\tneigh_probe+0xaa/0xf0\n\nWhile the first suspect is the dst_cache, explicitly tracking the dst\nowing the last device reference via probes proved such dst is held by\nthe nexthop in the originating fib6_info.\n\nSimilar to commit f5b51fe804ec (\"ipv6: route: purge exception on\nremoval\"), we need to explicitly release the originating fib info when\ndisconnecting a to-be-removed device from a live ipv6 dst: move the\nfib6_info cleanup into ip6_dst_ifdown().\n\nTested running:\n\n./pmtu.sh cleanup_ipv6_exception\n\nin a tight loop for more than 400 iterations with no spat, running an\nunpatched kernel  I observed a splat every ~10 iterations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbd97f05-ad6c-49b3-a1dc-6a5b704de54c",
      "id": "CVE-2024-57976",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when cow_file_range() failed\n\n[BUG]\nWhen testing with COW fixup marked as BUG_ON() (this is involved with the\nnew pin_user_pages*() change, which should not result new out-of-band\ndirty pages), I hit a crash triggered by the BUG_ON() from hitting COW\nfixup path.\n\nThis BUG_ON() happens just after a failed btrfs_run_delalloc_range():\n\n  BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28\n  ------------[ cut here ]------------\n  kernel BUG at fs/btrfs/extent_io.c:1444!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G           OE      6.12.0-rc7-custom+ #86\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : extent_writepage_io+0x2d4/0x308 [btrfs]\n  lr : extent_writepage_io+0x2d4/0x308 [btrfs]\n  Call trace:\n   extent_writepage_io+0x2d4/0x308 [btrfs]\n   extent_writepage+0x218/0x330 [btrfs]\n   extent_write_cache_pages+0x1d4/0x4b0 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x180/0x3b0 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThat failure is mostly from cow_file_range(), where we can hit -ENOSPC.\n\nAlthough the -ENOSPC is already a bug related to our space reservation\ncode, let's just focus on the error handling.\n\nFor example, we have the following dirty range [0, 64K) of an inode,\nwith 4K sector size and 4K page size:\n\n   0        16K        32K       48K       64K\n   |///////////////////////////////////////|\n   |#######################################|\n\nWhere |///| means page are still dirty, and |###| means the extent io\ntree has EXTENT_DELALLOC flag.\n\n- Enter extent_writepage() for page 0\n\n- Enter btrfs_run_delalloc_range() for range [0, 64K)\n\n- Enter cow_file_range() for range [0, 64K)\n\n- Function btrfs_reserve_extent() only reserved one 16K extent\n  So we created extent map and ordered extent for range [0, 16K)\n\n   0        16K        32K       48K       64K\n   |////////|//////////////////////////////|\n   |\u003c- OE -\u003e|##############################|\n\n   And range [0, 16K) has its delalloc flag cleared.\n   But since we haven't yet submit any bio, involved 4 pages are still\n   dirty.\n\n- Function btrfs_reserve_extent() returns with -ENOSPC\n  Now we have to run error cleanup, which will clear all\n  EXTENT_DELALLOC* flags and clear the dirty flags for the remaining\n  ranges:\n\n   0        16K        32K       48K       64K\n   |////////|                              |\n   |        |                              |\n\n  Note that range [0, 16K) still has its pages dirty.\n\n- Some time later, writeback is triggered again for the range [0, 16K)\n  since the page range still has dirty flags.\n\n- btrfs_run_delalloc_range() will do nothing because there is no\n  EXTENT_DELALLOC flag.\n\n- extent_writepage_io() finds page 0 has no ordered flag\n  Which falls into the COW fixup path, triggering the BUG_ON().\n\nUnfortunately this error handling bug dates back to the introduction of\nbtrfs.  Thankfully with the abuse of COW fixup, at least it won't crash\nthe kernel.\n\n[FIX]\nInstead of immediately unlocking the extent and folios, we keep the extent\nand folios locked until either erroring out or the whole delalloc range\nfinished.\n\nWhen the whole delalloc range finished without error, we just unlock the\nwhole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked\ncases)\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c952e0ff-96af-46af-9808-1ad3ebd6f6c6",
      "id": "CVE-2025-22022",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Apply the link chain quirk on NEC isoc endpoints\n\nTwo clearly different specimens of NEC uPD720200 (one with start/stop\nbug, one without) were seen to cause IOMMU faults after some Missed\nService Errors. Faulting address is immediately after a transfer ring\nsegment and patched dynamic debug messages revealed that the MSE was\nreceived when waiting for a TD near the end of that segment:\n\n[ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0\n[ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000]\n[ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000]\n\nIt gets even funnier if the next page is a ring segment accessible to\nthe HC. Below, it reports MSE in segment at ff1e8000, plows through a\nzero-filled page at ff1e9000 and starts reporting events for TRBs in\npage at ff1ea000 every microframe, instead of jumping to seg ff1e6000.\n\n[ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag.\n[ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n\nAt some point completion events change from Isoch Buffer Overrun to\nShort Packet and the HC finally finds cycle bit mismatch in ff1ec000.\n\n[ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2\n\nIt's possible that data from the isochronous device were written to\nrandom buffers of pending TDs on other endpoints (either IN or OUT),\nother devices or even other HCs in the same IOMMU domain.\n\nLastly, an error from a different USB device on another HC. Was it\ncaused by the above? I don't know, but it may have been. The disk\nwas working without any other issues and generated PCIe traffic to\nstarve the NEC of upstream BW and trigger those MSEs. The two HCs\nshared one x1 slot by means of a commercial \"PCIe splitter\" board.\n\n[ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd\n[ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s\n[ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00\n[ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0\n\nFortunately, it appears that this ridiculous bug is avoided by setting\nthe chain bit of Link TRBs on isochronous rings. Other ancient HCs are\nknown which also expect the bit to be set and they ignore Link TRBs if\nit's not. Reportedly, 0.95 spec guaranteed that the bit is set.\n\nThe bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports\ntens of MSEs per second and runs into the bug within seconds. Chaining\nLink TRBs allows the same workload to run for many minutes, many times.\n\nNo ne\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a0cf4d8-1cc8-4385-a010-497d1bfde112",
      "id": "CVE-2025-22103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix NULL pointer dereference in l3mdev_l3_rcv\n\nWhen delete l3s ipvlan:\n\n    ip link del link eth0 ipvlan1 type ipvlan mode l3s\n\nThis may cause a null pointer dereference:\n\n    Call trace:\n     ip_rcv_finish+0x48/0xd0\n     ip_rcv+0x5c/0x100\n     __netif_receive_skb_one_core+0x64/0xb0\n     __netif_receive_skb+0x20/0x80\n     process_backlog+0xb4/0x204\n     napi_poll+0xe8/0x294\n     net_rx_action+0xd8/0x22c\n     __do_softirq+0x12c/0x354\n\nThis is because l3mdev_l3_rcv() visit dev-\u003el3mdev_ops after\nipvlan_l3s_unregister() assign the dev-\u003el3mdev_ops to NULL. The process\nlike this:\n\n    (CPU1)                     | (CPU2)\n    l3mdev_l3_rcv()            |\n      check dev-\u003epriv_flags:   |\n        master = skb-\u003edev;     |\n                               |\n                               | ipvlan_l3s_unregister()\n                               |   set dev-\u003epriv_flags\n                               |   dev-\u003el3mdev_ops = NULL;\n                               |\n      visit master-\u003el3mdev_ops |\n\nTo avoid this by do not set dev-\u003el3mdev_ops when unregister l3s ipvlan.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e5dd689c-3a50-4cf3-8de8-70f64c1ad6d9",
      "id": "CVE-2025-37830",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy-\u003ecpus mask. scmi_cpufreq_get_rate() does not check for\nthis case, which results in a NULL pointer dereference.\n\nAdd NULL check after cpufreq_cpu_get_raw() to prevent this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2be857f-9bbe-4cc2-884b-955927368274",
      "id": "CVE-2025-37961",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix uninit-value for saddr in do_output_route4\n\nsyzbot reports for uninit-value for the saddr argument [1].\ncommit 4754957f04f5 (\"ipvs: do not use random local source address for\ntunnels\") already implies that the input value of saddr\nshould be ignored but the code is still reading it which can prevent\nto connect the route. Fix it by changing the argument to ret_saddr.\n\n[1]\nBUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147\n do_output_route4+0x42c/0x4d0 net/netfilter/ipvs/ip_vs_xmit.c:147\n __ip_vs_get_out_rt+0x403/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:330\n ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136\n ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626\n nf_hook include/linux/netfilter.h:269 [inline]\n __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118\n ip_local_out net/ipv4/ip_output.c:127 [inline]\n ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501\n udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195\n udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483\n inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x267/0x380 net/socket.c:727\n ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620\n __sys_sendmmsg+0x41d/0x880 net/socket.c:2702\n __compat_sys_sendmmsg net/compat.c:360 [inline]\n __do_compat_sys_sendmmsg net/compat.c:367 [inline]\n __se_compat_sys_sendmmsg net/compat.c:364 [inline]\n __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364\n ia32_sys_call+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:346\n do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306\n do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4167 [inline]\n slab_alloc_node mm/slub.c:4210 [inline]\n __kmalloc_cache_noprof+0x8fa/0xe00 mm/slub.c:4367\n kmalloc_noprof include/linux/slab.h:905 [inline]\n ip_vs_dest_dst_alloc net/netfilter/ipvs/ip_vs_xmit.c:61 [inline]\n __ip_vs_get_out_rt+0x35d/0x21d0 net/netfilter/ipvs/ip_vs_xmit.c:323\n ip_vs_tunnel_xmit+0x205/0x2380 net/netfilter/ipvs/ip_vs_xmit.c:1136\n ip_vs_in_hook+0x1aa5/0x35b0 net/netfilter/ipvs/ip_vs_core.c:2063\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf7/0x400 net/netfilter/core.c:626\n nf_hook include/linux/netfilter.h:269 [inline]\n __ip_local_out+0x758/0x7e0 net/ipv4/ip_output.c:118\n ip_local_out net/ipv4/ip_output.c:127 [inline]\n ip_send_skb+0x6a/0x3c0 net/ipv4/ip_output.c:1501\n udp_send_skb+0xfda/0x1b70 net/ipv4/udp.c:1195\n udp_sendmsg+0x2fe3/0x33c0 net/ipv4/udp.c:1483\n inet_sendmsg+0x1fc/0x280 net/ipv4/af_inet.c:851\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x267/0x380 net/socket.c:727\n ____sys_sendmsg+0x91b/0xda0 net/socket.c:2566\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2620\n __sys_sendmmsg+0x41d/0x880 net/socket.c:2702\n __compat_sys_sendmmsg net/compat.c:360 [inline]\n __do_compat_sys_sendmmsg net/compat.c:367 [inline]\n __se_compat_sys_sendmmsg net/compat.c:364 [inline]\n __ia32_compat_sys_sendmmsg+0xc8/0x140 net/compat.c:364\n ia32_sys_call+0x3ffa/0x41f0 arch/x86/include/generated/asm/syscalls_32.h:346\n do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/syscall_32.c:306\n do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:369\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n\nCPU: 0 UID: 0 PID: 22408 Comm: syz.4.5165 Not tainted 6.15.0-rc3-syzkaller-00019-gbc3372351d0c #0 PREEMPT(undef)\nHardware name: Google Google Compute Engi\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf909f6a-3342-45ef-8dca-8140bfeb39cf",
      "id": "CVE-2021-43975",
      "description": "In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "334b9700-1d72-4e19-8453-26d5d2216f37",
      "id": "CVE-2025-38163",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on sbi-\u003etotal_valid_block_count\n\nsyzbot reported a f2fs bug as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/f2fs.h:2521!\nRIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521\nCall Trace:\n f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695\n truncate_dnode+0x417/0x740 fs/f2fs/node.c:973\n truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014\n f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197\n f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810\n f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838\n f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888\n f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112\n notify_change+0xbca/0xe90 fs/attr.c:552\n do_truncate+0x222/0x310 fs/open.c:65\n handle_truncate fs/namei.c:3466 [inline]\n do_open fs/namei.c:3849 [inline]\n path_openat+0x2e4f/0x35d0 fs/namei.c:4004\n do_filp_open+0x284/0x4e0 fs/namei.c:4031\n do_sys_openat2+0x12b/0x1d0 fs/open.c:1429\n do_sys_open fs/open.c:1444 [inline]\n __do_sys_creat fs/open.c:1522 [inline]\n __se_sys_creat fs/open.c:1516 [inline]\n __x64_sys_creat+0x124/0x170 fs/open.c:1516\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94\n\nThe reason is: in fuzzed image, sbi-\u003etotal_valid_block_count is\ninconsistent w/ mapped blocks indexed by inode, so, we should\nnot trigger panic for such case, instead, let's print log and\nset fsck flag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "952f5427-2bc0-4ba8-8d53-fc25e3795058",
      "id": "CVE-2025-38319",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table\n\nThe function atomctrl_initialize_mc_reg_table() and\natomctrl_initialize_mc_reg_table_v2_2() does not check the return\nvalue of smu_atom_get_data_table(). If smu_atom_get_data_table()\nfails to retrieve vram_info, it returns NULL which is later\ndereferenced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec70b64a-0c7b-4c5a-97b1-25911bd11b7f",
      "id": "CVE-2025-38386",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Refuse to evaluate a method if arguments are missing\n\nAs reported in [1], a platform firmware update that increased the number\nof method parameters and forgot to update a least one of its callers,\ncaused ACPICA to crash due to use-after-free.\n\nSince this a result of a clear AML issue that arguably cannot be fixed\nup by the interpreter (it cannot produce missing data out of thin air),\naddress it by making ACPICA refuse to evaluate a method if the caller\nattempts to pass fewer arguments than expected to it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be06d1a2-9fa9-4243-9214-daff563e9b01",
      "id": "CVE-2025-38449",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gem: Acquire references on GEM handles for framebuffers\n\nA GEM handle can be released while the GEM buffer object is attached\nto a DRM framebuffer. This leads to the release of the dma-buf backing\nthe buffer object, if any. [1] Trying to use the framebuffer in further\nmode-setting operations leads to a segmentation fault. Most easily\nhappens with driver that use shadow planes for vmap-ing the dma-buf\nduring a page flip. An example is shown below.\n\n[  156.791968] ------------[ cut here ]------------\n[  156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430\n[...]\n[  156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430\n[  157.043420] Call Trace:\n[  157.045898]  \u003cTASK\u003e\n[  157.048030]  ? show_trace_log_lvl+0x1af/0x2c0\n[  157.052436]  ? show_trace_log_lvl+0x1af/0x2c0\n[  157.056836]  ? show_trace_log_lvl+0x1af/0x2c0\n[  157.061253]  ? drm_gem_shmem_vmap+0x74/0x710\n[  157.065567]  ? dma_buf_vmap+0x224/0x430\n[  157.069446]  ? __warn.cold+0x58/0xe4\n[  157.073061]  ? dma_buf_vmap+0x224/0x430\n[  157.077111]  ? report_bug+0x1dd/0x390\n[  157.080842]  ? handle_bug+0x5e/0xa0\n[  157.084389]  ? exc_invalid_op+0x14/0x50\n[  157.088291]  ? asm_exc_invalid_op+0x16/0x20\n[  157.092548]  ? dma_buf_vmap+0x224/0x430\n[  157.096663]  ? dma_resv_get_singleton+0x6d/0x230\n[  157.101341]  ? __pfx_dma_buf_vmap+0x10/0x10\n[  157.105588]  ? __pfx_dma_resv_get_singleton+0x10/0x10\n[  157.110697]  drm_gem_shmem_vmap+0x74/0x710\n[  157.114866]  drm_gem_vmap+0xa9/0x1b0\n[  157.118763]  drm_gem_vmap_unlocked+0x46/0xa0\n[  157.123086]  drm_gem_fb_vmap+0xab/0x300\n[  157.126979]  drm_atomic_helper_prepare_planes.part.0+0x487/0xb10\n[  157.133032]  ? lockdep_init_map_type+0x19d/0x880\n[  157.137701]  drm_atomic_helper_commit+0x13d/0x2e0\n[  157.142671]  ? drm_atomic_nonblocking_commit+0xa0/0x180\n[  157.147988]  drm_mode_atomic_ioctl+0x766/0xe40\n[...]\n[  157.346424] ---[ end trace 0000000000000000 ]---\n\nAcquiring GEM handles for the framebuffer's GEM buffer objects prevents\nthis from happening. The framebuffer's cleanup later puts the handle\nreferences.\n\nCommit 1a148af06000 (\"drm/gem-shmem: Use dma_buf from GEM object\ninstance\") triggers the segmentation fault easily by using the dma-buf\nfield more widely. The underlying issue with reference counting has\nbeen present before.\n\nv2:\n- acquire the handle instead of the BO (Christian)\n- fix comment style (Christian)\n- drop the Fixes tag (Christian)\n- rename err_ gotos\n- add missing Link tag",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f904bf32-2a1f-4bd8-bb4d-60e242f4cb37",
      "id": "CVE-2025-38595",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: fix UAF in dmabuf_exp_from_pages()\n\n[dma_buf_fd() fixes; no preferences regarding the tree it goes through -\nup to xen folks]\n\nAs soon as we'd inserted a file reference into descriptor table, another\nthread could close it.  That's fine for the case when all we are doing is\nreturning that descriptor to userland (it's a race, but it's a userland\nrace and there's nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\ngntdev dmabuf_exp_from_pages() calls it and then proceeds to access the\nobjects destroyed on close - starting with gntdev_dmabuf itself.\n\nFix that by doing reserving descriptor before anything else and do\nfd_install() only when everything had been set up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ba03fe8-d275-4c12-92c7-08146ef0c81d",
      "id": "CVE-2021-47150",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: fix the potential memory leak in fec_enet_init()\n\nIf the memory allocated for cbd_base is failed, it should\nfree the memory allocated for the queues, otherwise it causes\nmemory leak.\n\nAnd if the memory allocated for the queues is failed, it can\nreturn error directly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "413dcbca-a5e5-492c-ba6b-f204bbebddba",
      "id": "CVE-2025-39677",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix backlog accounting in qdisc_dequeue_internal\n\nThis issue applies for the following qdiscs: hhf, fq, fq_codel, and\nfq_pie, and occurs in their change handlers when adjusting to the new\nlimit. The problem is the following in the values passed to the\nsubsequent qdisc_tree_reduce_backlog call given a tbf parent:\n\n   When the tbf parent runs out of tokens, skbs of these qdiscs will\n   be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,\n   which accounts for both qlen and backlog. However, in the case of\n   qdisc_dequeue_internal, ONLY qlen is accounted for when pulling\n   from gso_skb. This means that these qdiscs are missing a\n   qdisc_qstats_backlog_dec when dropping packets to satisfy the\n   new limit in their change handlers.\n\n   One can observe this issue with the following (with tc patched to\n   support a limit of 0):\n\n   export TARGET=fq\n   tc qdisc del dev lo root\n   tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms\n   tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000\n   echo ''; echo 'add child'; tc -s -d qdisc show dev lo\n   ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2\u003e\u00261 \u003e/dev/null\n   echo ''; echo 'after ping'; tc -s -d qdisc show dev lo\n   tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0\n   echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo\n   tc qdisc replace dev lo handle 2: parent 1:1 sfq\n   echo ''; echo 'post graft'; tc -s -d qdisc show dev lo\n\n   The second to last show command shows 0 packets but a positive\n   number (74) of backlog bytes. The problem becomes clearer in the\n   last show command, where qdisc_purge_queue triggers\n   qdisc_tree_reduce_backlog with the positive backlog and causes an\n   underflow in the tbf parent's backlog (4096 Mb instead of 0).\n\nTo fix this issue, the codepath for all clients of qdisc_dequeue_internal\nhas been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.\nqdisc_dequeue_internal handles the backlog adjustments for all cases that\ndo not directly use the dequeue handler.\n\nThe old fq_codel_change limit adjustment loop accumulated the arguments to\nthe subsequent qdisc_tree_reduce_backlog call through the cstats field.\nHowever, this is confusing and error prone as fq_codel_dequeue could also\npotentially mutate this field (which qdisc_dequeue_internal calls in the\nnon gso_skb case), so we have unified the code here with other qdiscs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f49b3aa6-9962-4e18-97a2-6e860a25daa7",
      "id": "CVE-2025-39686",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Make insn_rw_emulate_bits() do insn-\u003en samples\n\nThe `insn_rw_emulate_bits()` function is used as a default handler for\n`INSN_READ` instructions for subdevices that have a handler for\n`INSN_BITS` but not for `INSN_READ`.  Similarly, it is used as a default\nhandler for `INSN_WRITE` instructions for subdevices that have a handler\nfor `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the\n`INSN_READ` or `INSN_WRITE` instruction handling with a constructed\n`INSN_BITS` instruction.  However, `INSN_READ` and `INSN_WRITE`\ninstructions are supposed to be able read or write multiple samples,\nindicated by the `insn-\u003en` value, but `insn_rw_emulate_bits()` currently\nonly handles a single sample.  For `INSN_READ`, the comedi core will\ncopy `insn-\u003en` samples back to user-space.  (That triggered KASAN\nkernel-infoleak errors when `insn-\u003en` was greater than 1, but that is\nbeing fixed more generally elsewhere in the comedi core.)\n\nMake `insn_rw_emulate_bits()` either handle `insn-\u003en` samples, or return\nan error, to conform to the general expectation for `INSN_READ` and\n`INSN_WRITE` handlers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f1dbba3-1fa2-4b58-88c6-077820b4cf5b",
      "id": "CVE-2020-25285",
      "description": "A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36d4720e-6dec-4ae5-b0a1-12bd92a957c2",
      "id": "CVE-2021-29650",
      "description": "An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff5f3a9a-7ed6-4c14-80c9-5e5df9994a30",
      "id": "CVE-2021-3640",
      "description": "A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d81fbf27-e50b-4f4e-a257-b8c7b2ef99c5",
      "id": "CVE-2021-38208",
      "description": "net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7560f43-f3e7-4003-95a5-0271eb10ef10",
      "id": "CVE-2021-47307",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL deref in cifs_compose_mount_options()\n\nThe optional @ref parameter might contain an NULL node_name, so\nprevent dereferencing it in cifs_compose_mount_options().\n\nAddresses-Coverity: 1476408 (\"Explicit null dereferenced\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cf403a5-48e1-436e-8a11-f1f529274796",
      "id": "CVE-2021-47351",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix races between xattr_{set|get} and listxattr operations\n\nUBIFS may occur some problems with concurrent xattr_{set|get} and\nlistxattr operations, such as assertion failure, memory corruption,\nstale xattr value[1].\n\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\noperations on xattr, concurrent read operations are still effective,\njust like ext4.\n\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a9519bc-2a3f-4a36-be10-439045645a55",
      "id": "CVE-2021-47508",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free exchange changeset on failures\n\nFstests runs on my VMs have show several kmemleak reports like the following.\n\n  unreferenced object 0xffff88811ae59080 (size 64):\n    comm \"xfs_io\", pid 12124, jiffies 4294987392 (age 6.368s)\n    hex dump (first 32 bytes):\n      00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00  ................\n      90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff  ................\n    backtrace:\n      [\u003c00000000ac0176d2\u003e] ulist_add_merge+0x60/0x150 [btrfs]\n      [\u003c0000000076e9f312\u003e] set_state_bits+0x86/0xc0 [btrfs]\n      [\u003c0000000014fe73d6\u003e] set_extent_bit+0x270/0x690 [btrfs]\n      [\u003c000000004f675208\u003e] set_record_extent_bits+0x19/0x20 [btrfs]\n      [\u003c00000000b96137b1\u003e] qgroup_reserve_data+0x274/0x310 [btrfs]\n      [\u003c0000000057e9dcbb\u003e] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]\n      [\u003c0000000019c4511d\u003e] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]\n      [\u003c000000006d37e007\u003e] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]\n      [\u003c00000000fb8a74b8\u003e] iomap_iter+0x161/0x1e0\n      [\u003c0000000071dff6ff\u003e] __iomap_dio_rw+0x1df/0x700\n      [\u003c000000002567ba53\u003e] iomap_dio_rw+0x5/0x20\n      [\u003c0000000072e555f8\u003e] btrfs_file_write_iter+0x290/0x530 [btrfs]\n      [\u003c000000005eb3d845\u003e] new_sync_write+0x106/0x180\n      [\u003c000000003fb505bf\u003e] vfs_write+0x24d/0x2f0\n      [\u003c000000009bb57d37\u003e] __x64_sys_pwrite64+0x69/0xa0\n      [\u003c000000003eba3fdf\u003e] do_syscall_64+0x43/0x90\n\nIn case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()\nfail the allocated extent_changeset will not be freed.\n\nSo in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()\nfree the allocated extent_changeset to get rid of the allocated memory.\n\nThe issue currently only happens in the direct IO write path, but only\nafter 65b3c08606e5 (\"btrfs: fix ENOSPC failure when attempting direct IO\nwrite into NOCOW range\"), and also at defrag_one_locked_target(). Every\nother place is always calling extent_changeset_free() even if its call\nto btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has\nfailed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "337d616f-fcf6-4512-b395-0d984c534f92",
      "id": "CVE-2022-0812",
      "description": "An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "68f9a8fd-39e7-4c87-8fd6-30cac087508b",
      "id": "CVE-2022-48790",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix a possible use-after-free in controller reset during load\n\nUnlike .queue_rq, in .submit_async_event drivers may not check the ctrl\nreadiness for AER submission. This may lead to a use-after-free\ncondition that was observed with nvme-tcp.\n\nThe race condition may happen in the following scenario:\n1. driver executes its reset_ctrl_work\n2. -\u003e nvme_stop_ctrl - flushes ctrl async_event_work\n3. ctrl sends AEN which is received by the host, which in turn\n   schedules AEN handling\n4. teardown admin queue (which releases the queue socket)\n5. AEN processed, submits another AER, calling the driver to submit\n6. driver attempts to send the cmd\n==\u003e use-after-free\n\nIn order to fix that, add ctrl state check to validate the ctrl\nis actually able to accept the AER submission.\n\nThis addresses the above race in controller resets because the driver\nduring teardown should:\n1. change ctrl state to RESETTING\n2. flush async_event_work (as well as other async work elements)\n\nSo after 1,2, any other AER command will find the\nctrl state to be RESETTING and bail out without submitting the AER.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "632dfe9d-1c79-4acb-a4fd-ba3909d05218",
      "id": "CVE-2022-1508",
      "description": "An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c327b05-294f-45b5-b58a-81348b18a52f",
      "id": "CVE-2022-2964",
      "description": "A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9aa64175-70ab-4fc5-b42b-a142f54774c9",
      "id": "CVE-2022-3115",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bd72cc0-287f-467a-b567-99f32454178f",
      "id": "CVE-2022-3707",
      "description": "A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bfce3dde-a957-4701-a0b3-640003bca5b2",
      "id": "CVE-2022-48863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix memory leak in dsp_pipeline_build()\n\ndsp_pipeline_build() allocates dup pointer by kstrdup(cfg),\nbut then it updates dup variable by strsep(\u0026dup, \"|\").\nAs a result when it calls kfree(dup), the dup variable contains NULL.\n\nFound by Linux Driver Verification project (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00618ac6-3555-40d3-89be-6bcddf125f78",
      "id": "CVE-2022-48933",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix memory leak during stateful obj update\n\nstateful objects can be updated from the control plane.\nThe transaction logic allocates a temporary object for this purpose.\n\nThe -\u003einit function was called for this object, so plain kfree() leaks\nresources. We must call -\u003edestroy function of the object.\n\nnft_obj_destroy does this, but it also decrements the module refcount,\nbut the update path doesn't increment it.\n\nTo avoid special-casing the update object release, do module_get for\nthe update case too and release it via nft_obj_destroy().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1963e23e-ea95-4a98-9adc-7c6cbb8e50dc",
      "id": "CVE-2022-48953",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: cmos: Fix event handler registration ordering issue\n\nBecause acpi_install_fixed_event_handler() enables the event\nautomatically on success, it is incorrect to call it before the\nhandler routine passed to it is ready to handle events.\n\nUnfortunately, the rtc-cmos driver does exactly the incorrect thing\nby calling cmos_wake_setup(), which passes rtc_handler() to\nacpi_install_fixed_event_handler(), before cmos_do_probe(), because\nrtc_handler() uses dev_get_drvdata() to get to the cmos object\npointer and the driver data pointer is only populated in\ncmos_do_probe().\n\nThis leads to a NULL pointer dereference in rtc_handler() on boot\nif the RTC fixed event happens to be active at the init time.\n\nTo address this issue, change the initialization ordering of the\ndriver so that cmos_wake_setup() is always called after a successful\ncmos_do_probe() call.\n\nWhile at it, change cmos_pnp_probe() to call cmos_do_probe() after\nthe initial if () statement used for computing the IRQ argument to\nbe passed to cmos_do_probe() which is cleaner than calling it in\neach branch of that if () (local variable \"irq\" can be of type int,\nbecause it is passed to that function as an argument of type int).\n\nNote that commit 6492fed7d8c9 (\"rtc: rtc-cmos: Do not check\nACPI_FADT_LOW_POWER_S0\") caused this issue to affect a larger number\nof systems, because previously it only affected systems with\nACPI_FADT_LOW_POWER_S0 set, but it is present regardless of that\ncommit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af1df092-9b4c-4bc5-9738-a6cb8b9a66f5",
      "id": "CVE-2022-49052",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix unexpected zeroed page mapping with zram swap\n\nTwo processes under CLONE_VM cloning, user process can be corrupted by\nseeing zeroed page unexpectedly.\n\n      CPU A                        CPU B\n\n  do_swap_page                do_swap_page\n  SWP_SYNCHRONOUS_IO path     SWP_SYNCHRONOUS_IO path\n  swap_readpage valid data\n    swap_slot_free_notify\n      delete zram entry\n                              swap_readpage zeroed(invalid) data\n                              pte_lock\n                              map the *zero data* to userspace\n                              pte_unlock\n  pte_lock\n  if (!pte_same)\n    goto out_nomap;\n  pte_unlock\n  return and next refault will\n  read zeroed data\n\nThe swap_slot_free_notify is bogus for CLONE_VM case since it doesn't\nincrease the refcount of swap slot at copy_mm so it couldn't catch up\nwhether it's safe or not to discard data from backing device.  In the\ncase, only the lock it could rely on to synchronize swap slot freeing is\npage table lock.  Thus, this patch gets rid of the swap_slot_free_notify\nfunction.  With this patch, CPU A will see correct data.\n\n      CPU A                        CPU B\n\n  do_swap_page                do_swap_page\n  SWP_SYNCHRONOUS_IO path     SWP_SYNCHRONOUS_IO path\n                              swap_readpage original data\n                              pte_lock\n                              map the original data\n                              swap_free\n                                swap_range_free\n                                  bd_disk-\u003efops-\u003eswap_slot_free_notify\n  swap_readpage read zeroed data\n                              pte_unlock\n  pte_lock\n  if (!pte_same)\n    goto out_nomap;\n  pte_unlock\n  return\n  on next refault will see mapped data by CPU B\n\nThe concern of the patch would increase memory consumption since it\ncould keep wasted memory with compressed form in zram as well as\nuncompressed form in address space.  However, most of cases of zram uses\nno readahead and do_swap_page is followed by swap_free so it will free\nthe compressed form from in zram quickly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efb125f8-e8b9-444b-b18e-d3b5c48ddc28",
      "id": "CVE-2022-49066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: Ensure eth header is in skb's linear part\n\nAfter feeding a decapsulated packet to a veth device with act_mirred,\nskb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),\nwhich expects at least ETH_HLEN byte of linear data (as\n__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes\nunconditionally).\n\nUse pskb_may_pull() to ensure veth_xmit() respects this constraint.\n\nkernel BUG at include/linux/skbuff.h:2328!\nRIP: 0010:eth_type_trans+0xcf/0x140\nCall Trace:\n \u003cIRQ\u003e\n __dev_forward_skb2+0xe3/0x160\n veth_xmit+0x6e/0x250 [veth]\n dev_hard_start_xmit+0xc7/0x200\n __dev_queue_xmit+0x47f/0x520\n ? skb_ensure_writable+0x85/0xa0\n ? skb_mpls_pop+0x98/0x1c0\n tcf_mirred_act+0x442/0x47e [act_mirred]\n tcf_action_exec+0x86/0x140\n fl_classify+0x1d8/0x1e0 [cls_flower]\n ? dma_pte_clear_level+0x129/0x1a0\n ? dma_pte_clear_level+0x129/0x1a0\n ? prb_fill_curr_block+0x2f/0xc0\n ? skb_copy_bits+0x11a/0x220\n __tcf_classify+0x58/0x110\n tcf_classify_ingress+0x6b/0x140\n __netif_receive_skb_core.constprop.0+0x47d/0xfd0\n ? __iommu_dma_unmap_swiotlb+0x44/0x90\n __netif_receive_skb_one_core+0x3d/0xa0\n netif_receive_skb+0x116/0x170\n be_process_rx+0x22f/0x330 [be2net]\n be_poll+0x13c/0x370 [be2net]\n __napi_poll+0x2a/0x170\n net_rx_action+0x22f/0x2f0\n __do_softirq+0xca/0x2a8\n __irq_exit_rcu+0xc1/0xe0\n common_interrupt+0x83/0xa0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03c8e1fb-f0b3-4f97-be0f-89877f1d476f",
      "id": "CVE-2022-49102",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix possible memory leak in MMU DR fini\n\nThis patch fixes what seems to be copy paste error.\n\nWe will have a memory leak if the host-resident shadow is NULL (which\nwill likely happen as the DR and HR are not dependent).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "04beebf8-1f89-45d5-95d0-5f4c7f7c3c39",
      "id": "CVE-2022-49672",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tun: unlink NAPI from device on destruction\n\nSyzbot found a race between tun file and device destruction.\nNAPIs live in struct tun_file which can get destroyed before\nthe netdev so we have to del them explicitly. The current\ncode is missing deleting the NAPI if the queue was detached\nfirst.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d34d781-eb59-41e7-8a8a-eb33ed21378a",
      "id": "CVE-2021-3655",
      "description": "A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4ee65ae-dcb8-4181-914b-16ead1e8f63a",
      "id": "CVE-2022-50400",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: audio_helper: remove unused and wrong debugfs usage\n\nIn the greybus audio_helper code, the debugfs file for the dapm has the\npotential to be removed and memory will be leaked.  There is also the\nvery real potential for this code to remove ALL debugfs entries from the\nsystem, and it seems like this is what will really happen if this code\never runs.  This all is very wrong as the greybus audio driver did not\ncreate this debugfs file, the sound core did and controls the lifespan\nof it.\n\nSo remove all of the debugfs logic from the audio_helper code as there's\nno way it could be correct.  If this really is needed, it can come back\nwith a fixup for the incorrect usage of the debugfs_lookup() call which\nis what caused this to be noticed at all.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be251224-c237-460a-8755-94123dd7ea2c",
      "id": "CVE-2023-3338",
      "description": "A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37fb7777-9bb0-4db7-8f0e-31988bbe5040",
      "id": "CVE-2023-52501",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not attempt to read past \"commit\"\n\nWhen iterating over the ring buffer while the ring buffer is active, the\nwriter can corrupt the reader. There's barriers to help detect this and\nhandle it, but that code missed the case where the last event was at the\nvery end of the page and has only 4 bytes left.\n\nThe checks to detect the corruption by the writer to reads needs to see the\nlength of the event. If the length in the first 4 bytes is zero then the\nlength is stored in the second 4 bytes. But if the writer is in the process\nof updating that code, there's a small window where the length in the first\n4 bytes could be zero even though the length is only 4 bytes. That will\ncause rb_event_length() to read the next 4 bytes which could happen to be off the\nallocated page.\n\nTo protect against this, fail immediately if the next event pointer is\nless than 8 bytes from the end of the commit (last byte of data), as all\nevents must be a minimum of 8 bytes anyway.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a84d379-8723-4422-8fc2-867ef1f65e2b",
      "id": "CVE-2023-53038",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()\n\nIf kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on\nlpfc_read_object()'s routine to NULL check pdata.\n\nCurrently, an early return error is thrown from lpfc_read_object() to\nprotect us from NULL ptr dereference, but the errno code is -ENODEV.\n\nChange the errno code to a more appropriate -ENOMEM.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a8e5966-30bf-4537-a0c2-cc827b3c8c42",
      "id": "CVE-2023-53147",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add NULL check in xfrm_update_ae_params\n\nNormally, x-\u003ereplay_esn and x-\u003epreplay_esn should be allocated at\nxfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the\nxfrm_update_ae_params(...) is okay to update them. However, the current\nimplementation of xfrm_new_ae(...) allows a malicious user to directly\ndereference a NULL pointer and crash the kernel like below.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0\nOops: 0002 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4\nRIP: 0010:memcpy_orig+0xad/0x140\nCode: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c\nRSP: 0018:ffff888008f57658 EFLAGS: 00000202\nRAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571\nRDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818\nR13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000\nFS:  00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x1f/0x70\n ? page_fault_oops+0x1e8/0x500\n ? __pfx_is_prefetch.constprop.0+0x10/0x10\n ? __pfx_page_fault_oops+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x11/0x40\n ? fixup_exception+0x36/0x460\n ? _raw_spin_unlock_irqrestore+0x11/0x40\n ? exc_page_fault+0x5e/0xc0\n ? asm_exc_page_fault+0x26/0x30\n ? xfrm_update_ae_params+0xd1/0x260\n ? memcpy_orig+0xad/0x140\n ? __pfx__raw_spin_lock_bh+0x10/0x10\n xfrm_update_ae_params+0xe7/0x260\n xfrm_new_ae+0x298/0x4e0\n ? __pfx_xfrm_new_ae+0x10/0x10\n ? __pfx_xfrm_new_ae+0x10/0x10\n xfrm_user_rcv_msg+0x25a/0x410\n ? __pfx_xfrm_user_rcv_msg+0x10/0x10\n ? __alloc_skb+0xcf/0x210\n ? stack_trace_save+0x90/0xd0\n ? filter_irq_stacks+0x1c/0x70\n ? __stack_depot_save+0x39/0x4e0\n ? __kasan_slab_free+0x10a/0x190\n ? kmem_cache_free+0x9c/0x340\n ? netlink_recvmsg+0x23c/0x660\n ? sock_recvmsg+0xeb/0xf0\n ? __sys_recvfrom+0x13c/0x1f0\n ? __x64_sys_recvfrom+0x71/0x90\n ? do_syscall_64+0x3f/0x90\n ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n ? copyout+0x3e/0x50\n netlink_rcv_skb+0xd6/0x210\n ? __pfx_xfrm_user_rcv_msg+0x10/0x10\n ? __pfx_netlink_rcv_skb+0x10/0x10\n ? __pfx_sock_has_perm+0x10/0x10\n ? mutex_lock+0x8d/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n xfrm_netlink_rcv+0x44/0x50\n netlink_unicast+0x36f/0x4c0\n ? __pfx_netlink_unicast+0x10/0x10\n ? netlink_recvmsg+0x500/0x660\n netlink_sendmsg+0x3b7/0x700\n\nThis Null-ptr-deref bug is assigned CVE-2023-3772. And this commit\nadds additional NULL check in xfrm_update_ae_params to fix the NPD.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81edcb7b-4727-4046-b919-ae6bef3bfbf8",
      "id": "CVE-2022-48908",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()\n\nDuring driver initialization, the pointer of card info, i.e. the\nvariable 'ci' is required. However, the definition of\n'com20020pci_id_table' reveals that this field is empty for some\ndevices, which will cause null pointer dereference when initializing\nthese devices.\n\nThe following log reveals it:\n\n[    3.973806] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n[    3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci]\n[    3.975181] Call Trace:\n[    3.976208]  local_pci_probe+0x13f/0x210\n[    3.977248]  pci_device_probe+0x34c/0x6d0\n[    3.977255]  ? pci_uevent+0x470/0x470\n[    3.978265]  really_probe+0x24c/0x8d0\n[    3.978273]  __driver_probe_device+0x1b3/0x280\n[    3.979288]  driver_probe_device+0x50/0x370\n\nFix this by checking whether the 'ci' is a null pointer first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66448c64-302c-4b41-8277-137906cdb865",
      "id": "CVE-2023-53276",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Free memory for tmpfile name\n\nWhen opening a ubifs tmpfile on an encrypted directory, function\nfscrypt_setup_filename allocates memory for the name that is to be\nstored in the directory entry, but after the name has been copied to the\ndirectory entry inode, the memory is not freed.\n\nWhen running kmemleak on it we see that it is registered as a leak. The\nreport below is triggered by a simple program 'tmpfile' just opening a\ntmpfile:\n\n  unreferenced object 0xffff88810178f380 (size 32):\n    comm \"tmpfile\", pid 509, jiffies 4294934744 (age 1524.742s)\n    backtrace:\n      __kmem_cache_alloc_node\n      __kmalloc\n      fscrypt_setup_filename\n      ubifs_tmpfile\n      vfs_tmpfile\n      path_openat\n\nFree this memory after it has been copied to the inode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82fe66d5-7e17-4289-afb5-bf7705cc1766",
      "id": "CVE-2022-48704",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: add a force flush to delay work when radeon\n\nAlthough radeon card fence and wait for gpu to finish processing current batch rings,\nthere is still a corner case that radeon lockup work queue may not be fully flushed,\nand meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to\nput device in D3hot state.\nPer PCI spec rev 4.0 on 5.3.1.4.1 D3hot State.\n\u003e Configuration and Message requests are the only TLPs accepted by a Function in\n\u003e the D3hot state. All other received Requests must be handled as Unsupported Requests,\n\u003e and all received Completions may optionally be handled as Unexpected Completions.\nThis issue will happen in following logs:\nUnable to handle kernel paging request at virtual address 00008800e0008010\nCPU 0 kworker/0:3(131): Oops 0\npc = [\u003cffffffff811bea5c\u003e]  ra = [\u003cffffffff81240844\u003e]  ps = 0000 Tainted: G        W\npc is at si_gpu_check_soft_reset+0x3c/0x240\nra is at si_dma_is_lockup+0x34/0xd0\nv0 = 0000000000000000  t0 = fff08800e0008010  t1 = 0000000000010000\nt2 = 0000000000008010  t3 = fff00007e3c00000  t4 = fff00007e3c00258\nt5 = 000000000000ffff  t6 = 0000000000000001  t7 = fff00007ef078000\ns0 = fff00007e3c016e8  s1 = fff00007e3c00000  s2 = fff00007e3c00018\ns3 = fff00007e3c00000  s4 = fff00007fff59d80  s5 = 0000000000000000\ns6 = fff00007ef07bd98\na0 = fff00007e3c00000  a1 = fff00007e3c016e8  a2 = 0000000000000008\na3 = 0000000000000001  a4 = 8f5c28f5c28f5c29  a5 = ffffffff810f4338\nt8 = 0000000000000275  t9 = ffffffff809b66f8  t10 = ff6769c5d964b800\nt11= 000000000000b886  pv = ffffffff811bea20  at = 0000000000000000\ngp = ffffffff81d89690  sp = 00000000aa814126\nDisabling lock debugging due to kernel taint\nTrace:\n[\u003cffffffff81240844\u003e] si_dma_is_lockup+0x34/0xd0\n[\u003cffffffff81119610\u003e] radeon_fence_check_lockup+0xd0/0x290\n[\u003cffffffff80977010\u003e] process_one_work+0x280/0x550\n[\u003cffffffff80977350\u003e] worker_thread+0x70/0x7c0\n[\u003cffffffff80977410\u003e] worker_thread+0x130/0x7c0\n[\u003cffffffff80982040\u003e] kthread+0x200/0x210\n[\u003cffffffff809772e0\u003e] worker_thread+0x0/0x7c0\n[\u003cffffffff80981f8c\u003e] kthread+0x14c/0x210\n[\u003cffffffff80911658\u003e] ret_from_kernel_thread+0x18/0x20\n[\u003cffffffff80981e40\u003e] kthread+0x0/0x210\n Code: ad3e0008  43f0074a  ad7e0018  ad9e0020  8c3001e8  40230101\n \u003c88210000\u003e 4821ed21\nSo force lockup work queue flush to fix this problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "778d9618-c27a-433e-a293-3c47cc67cfe8",
      "id": "CVE-2023-53404",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: fotg210: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a0ca314-5acc-450a-abb1-87fad529edb3",
      "id": "CVE-2024-26615",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix illegal rmb_desc access in SMC-D connection dump\n\nA crash was found when dumping SMC-D connections. It can be reproduced\nby following steps:\n\n- run nginx/wrk test:\n  smc_run nginx\n  smc_run wrk -t 16 -c 1000 -d \u003cduration\u003e -H 'Connection: Close' \u003cURL\u003e\n\n- continuously dump SMC-D connections in parallel:\n  watch -n 1 'smcss -D'\n\n BUG: kernel NULL pointer dereference, address: 0000000000000030\n CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G\tE      6.7.0+ #55\n RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag]\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x24/0x70\n  ? page_fault_oops+0x66/0x150\n  ? exc_page_fault+0x69/0x140\n  ? asm_exc_page_fault+0x26/0x30\n  ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag]\n  ? __kmalloc_node_track_caller+0x35d/0x430\n  ? __alloc_skb+0x77/0x170\n  smc_diag_dump_proto+0xd0/0xf0 [smc_diag]\n  smc_diag_dump+0x26/0x60 [smc_diag]\n  netlink_dump+0x19f/0x320\n  __netlink_dump_start+0x1dc/0x300\n  smc_diag_handler_dump+0x6a/0x80 [smc_diag]\n  ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag]\n  sock_diag_rcv_msg+0x121/0x140\n  ? __pfx_sock_diag_rcv_msg+0x10/0x10\n  netlink_rcv_skb+0x5a/0x110\n  sock_diag_rcv+0x28/0x40\n  netlink_unicast+0x22a/0x330\n  netlink_sendmsg+0x1f8/0x420\n  __sock_sendmsg+0xb0/0xc0\n  ____sys_sendmsg+0x24e/0x300\n  ? copy_msghdr_from_user+0x62/0x80\n  ___sys_sendmsg+0x7c/0xd0\n  ? __do_fault+0x34/0x160\n  ? do_read_fault+0x5f/0x100\n  ? do_fault+0xb0/0x110\n  ? __handle_mm_fault+0x2b0/0x6c0\n  __sys_sendmsg+0x4d/0x80\n  do_syscall_64+0x69/0x180\n  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nIt is possible that the connection is in process of being established\nwhen we dump it. Assumed that the connection has been registered in a\nlink group by smc_conn_create() but the rmb_desc has not yet been\ninitialized by smc_buf_create(), thus causing the illegal access to\nconn-\u003ermb_desc. So fix it by checking before dump.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4ef15e4-982b-47c0-9ee6-5bc6fb57cf74",
      "id": "CVE-2024-26757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Don't ignore read-only array in md_check_recovery()\n\nUsually if the array is not read-write, md_check_recovery() won't\nregister new sync_thread in the first place. And if the array is\nread-write and sync_thread is registered, md_set_readonly() will\nunregister sync_thread before setting the array read-only. md/raid\nfollow this behavior hence there is no problem.\n\nAfter commit f52f5c71f3d4 (\"md: fix stopping sync thread\"), following\nhang can be triggered by test shell/integrity-caching.sh:\n\n1) array is read-only. dm-raid update super block:\nrs_update_sbs\n ro = mddev-\u003ero\n mddev-\u003ero = 0\n  -\u003e set array read-write\n md_update_sb\n\n2) register new sync thread concurrently.\n\n3) dm-raid set array back to read-only:\nrs_update_sbs\n mddev-\u003ero = ro\n\n4) stop the array:\nraid_dtr\n md_stop\n  stop_sync_thread\n    set_bit(MD_RECOVERY_INTR, \u0026mddev-\u003erecovery);\n    md_wakeup_thread_directly(mddev-\u003esync_thread);\n    wait_event(..., !test_bit(MD_RECOVERY_RUNNING, \u0026mddev-\u003erecovery))\n\n5) sync thread done:\n md_do_sync\n set_bit(MD_RECOVERY_DONE, \u0026mddev-\u003erecovery);\n md_wakeup_thread(mddev-\u003ethread);\n\n6) daemon thread can't unregister sync thread:\n md_check_recovery\n  if (!md_is_rdwr(mddev) \u0026\u0026\n      !test_bit(MD_RECOVERY_NEEDED, \u0026mddev-\u003erecovery))\n   return;\n  -\u003e -\u003e MD_RECOVERY_RUNNING can't be cleared, hence step 4 hang;\n\nThe root cause is that dm-raid manipulate 'mddev-\u003ero' by itself,\nhowever, dm-raid really should stop sync thread before setting the\narray read-only. Unfortunately, I need to read more code before I\ncan refacter the handler of 'mddev-\u003ero' in dm-raid, hence let's fix\nthe problem the easy way for now to prevent dm-raid regression.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2404dd5-8001-4c5b-b75e-6a95ba9f3d60",
      "id": "CVE-2024-36007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix warning during rehash\n\nAs previously explained, the rehash delayed work migrates filters from\none region to another. This is done by iterating over all chunks (all\nthe filters with the same priority) in the region and in each chunk\niterating over all the filters.\n\nWhen the work runs out of credits it stores the current chunk and entry\nas markers in the per-work context so that it would know where to resume\nthe migration from the next time the work is scheduled.\n\nUpon error, the chunk marker is reset to NULL, but without resetting the\nentry markers despite being relative to it. This can result in migration\nbeing resumed from an entry that does not belong to the chunk being\nmigrated. In turn, this will eventually lead to a chunk being iterated\nover as if it is an entry. Because of how the two structures happen to\nbe defined, this does not lead to KASAN splats, but to warnings such as\n[1].\n\nFix by creating a helper that resets all the markers and call it from\nall the places the currently only reset the chunk marker. For good\nmeasures also call it when starting a completely new rehash. Add a\nwarning to avoid future cases.\n\n[1]\nWARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0\nModules linked in:\nCPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G        W          6.9.0-rc3-custom-00880-g29e61d91b77b #29\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_afk_encode+0x242/0x2f0\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "448edb6c-0753-4196-a3a8-626d537af45c",
      "id": "CVE-2024-36901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent NULL dereference in ip6_output()\n\nAccording to syzbot, there is a chance that ip6_dst_idev()\nreturns NULL in ip6_output(). Most places in IPv6 stack\ndeal with a NULL idev just fine, but not here.\n\nsyzbot reported:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237\nCode: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 \u003c42\u003e 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff\nRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000\nRDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48\nRBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad\nR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0\nR13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000\nFS:  00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358\n  sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248\n  sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653\n  sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783\n  sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]\n  sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169\n  sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73\n  __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c8d321d-0ba6-4fe5-ae86-e2bb560c79a3",
      "id": "CVE-2024-36914",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip on writeback when it's not applicable\n\n[WHY]\ndynamic memory safety error detector (KASAN) catches and generates error\nmessages \"BUG: KASAN: slab-out-of-bounds\" as writeback connector does not\nsupport certain features which are not initialized.\n\n[HOW]\nSkip them when connector type is DRM_MODE_CONNECTOR_WRITEBACK.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9038f51-e2e3-4250-9087-bec9ec4243be",
      "id": "CVE-2024-38570",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix potential glock use-after-free on unmount\n\nWhen a DLM lockspace is released and there ares still locks in that\nlockspace, DLM will unlock those locks automatically.  Commit\nfb6791d100d1b started exploiting this behavior to speed up filesystem\nunmount: gfs2 would simply free glocks it didn't want to unlock and then\nrelease the lockspace.  This didn't take the bast callbacks for\nasynchronous lock contention notifications into account, which remain\nactive until until a lock is unlocked or its lockspace is released.\n\nTo prevent those callbacks from accessing deallocated objects, put the\nglocks that should not be unlocked on the sd_dead_glocks list, release\nthe lockspace, and only then free those glocks.\n\nAs an additional measure, ignore unexpected ast and bast callbacks if\nthe receiving glock is dead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "295ed1e9-94c5-402d-bdd3-f0b9d3c429bf",
      "id": "CVE-2024-38580",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nepoll: be better about file lifetimes\n\nepoll can call out to vfs_poll() with a file pointer that may race with\nthe last 'fput()'. That would make f_count go down to zero, and while\nthe ep-\u003emtx locking means that the resulting file pointer tear-down will\nbe blocked until the poll returns, it means that f_count is already\ndead, and any use of it won't actually get a reference to the file any\nmore: it's dead regardless.\n\nMake sure we have a valid ref on the file pointer before we call down to\nvfs_poll() from the epoll routines.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f705e44-db22-41bd-a1b1-b4270bf8eb37",
      "id": "CVE-2024-41064",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/eeh: avoid possible crash when edev-\u003epdev changes\n\nIf a PCI device is removed during eeh_pe_report_edev(), edev-\u003epdev\nwill change and can cause a crash, hold the PCI rescan/remove lock\nwhile taking a copy of edev-\u003epdev-\u003ebus.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "570b1c88-8784-4e53-8b1e-917518cb8625",
      "id": "CVE-2024-42093",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/dpaa2: Avoid explicit cpumask var allocation on stack\n\nFor CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask\nvariable on stack is not recommended since it can cause potential stack\noverflow.\n\nInstead, kernel code should always use *cpumask_var API(s) to allocate\ncpumask var in config-neutral way, leaving allocation strategy to\nCONFIG_CPUMASK_OFFSTACK.\n\nUse *cpumask_var API(s) to address it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0afe3d62-14d9-4c53-a6b8-dce8e8eaf113",
      "id": "CVE-2024-42225",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: replace skb_put with skb_put_zero\n\nAvoid potentially reusing uninitialized data",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df5257af-39ea-48c9-8fe4-20dbcfe50953",
      "id": "CVE-2024-42312",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: always initialize i_uid/i_gid\n\nAlways initialize i_uid/i_gid inside the sysfs core so set_ownership()\ncan safely skip setting them.\n\nCommit 5ec27ec735ba (\"fs/proc/proc_sysctl.c: fix the default values of\ni_uid/i_gid on /proc/sys inodes.\") added defaults for i_uid/i_gid when\nset_ownership() was not implemented. It also missed adjusting\nnet_ctl_set_ownership() to use the same default values in case the\ncomputation of a better value failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42a001ef-ef4e-44d0-92aa-ac2727ea03a8",
      "id": "CVE-2024-45828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Mask ring interrupts before ring stop request\n\nBus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when\nthe ring is being stopped. Depending on timing between ring stop request\ncompletion, interrupt handler removal and code execution this may lead\nto a NULL pointer dereference in hci_dma_irq_handler() if it gets to run\nafter the io_data pointer is set to NULL in hci_dma_cleanup().\n\nPrevent this my masking the ring interrupts before ring stop request.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc56da74-664b-4b26-b6f2-0ecb4e3aac07",
      "id": "CVE-2024-46719",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix null pointer dereference in trace\n\nucsi_register_altmode checks IS_ERR for the alt pointer and treats\nNULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,\nucsi_register_displayport returns NULL which causes a NULL pointer\ndereference in trace. Rather than return NULL, call\ntypec_port_register_altmode to register DisplayPort alternate mode\nas a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "814f62ef-034f-48f4-87f3-67e2a9bd8798",
      "id": "CVE-2024-47809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb-\u003elkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "329c72b8-53b5-4db5-b550-f1be0de393b9",
      "id": "CVE-2024-49867",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: wait for fixup workers before stopping cleaner kthread during umount\n\nDuring unmount, at close_ctree(), we have the following steps in this order:\n\n1) Park the cleaner kthread - this doesn't destroy the kthread, it basically\n   halts its execution (wake ups against it work but do nothing);\n\n2) We stop the cleaner kthread - this results in freeing the respective\n   struct task_struct;\n\n3) We call btrfs_stop_all_workers() which waits for any jobs running in all\n   the work queues and then free the work queues.\n\nSyzbot reported a case where a fixup worker resulted in a crash when doing\na delayed iput on its inode while attempting to wake up the cleaner at\nbtrfs_add_delayed_iput(), because the task_struct of the cleaner kthread\nwas already freed. This can happen during unmount because we don't wait\nfor any fixup workers still running before we call kthread_stop() against\nthe cleaner kthread, which stops and free all its resources.\n\nFix this by waiting for any fixup workers at close_ctree() before we call\nkthread_stop() against the cleaner and run pending delayed iputs.\n\nThe stack traces reported by syzbot were the following:\n\n  BUG: KASAN: slab-use-after-free in __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n  Read of size 8 at addr ffff8880272a8a18 by task kworker/u8:3/52\n\n  CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.12.0-rc1-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  Workqueue: btrfs-fixup btrfs_work_helper\n  Call Trace:\n   \u003cTASK\u003e\n   __dump_stack lib/dump_stack.c:94 [inline]\n   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n   print_address_description mm/kasan/report.c:377 [inline]\n   print_report+0x169/0x550 mm/kasan/report.c:488\n   kasan_report+0x143/0x180 mm/kasan/report.c:601\n   __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825\n   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n   _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162\n   class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]\n   try_to_wake_up+0xb0/0x1480 kernel/sched/core.c:4154\n   btrfs_writepage_fixup_worker+0xc16/0xdf0 fs/btrfs/inode.c:2842\n   btrfs_work_helper+0x390/0xc50 fs/btrfs/async-thread.c:314\n   process_one_work kernel/workqueue.c:3229 [inline]\n   process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310\n   worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n   kthread+0x2f0/0x390 kernel/kthread.c:389\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n   \u003c/TASK\u003e\n\n  Allocated by task 2:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   unpoison_slab_object mm/kasan/common.c:319 [inline]\n   __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345\n   kasan_slab_alloc include/linux/kasan.h:247 [inline]\n   slab_post_alloc_hook mm/slub.c:4086 [inline]\n   slab_alloc_node mm/slub.c:4135 [inline]\n   kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4187\n   alloc_task_struct_node kernel/fork.c:180 [inline]\n   dup_task_struct+0x57/0x8c0 kernel/fork.c:1107\n   copy_process+0x5d1/0x3d50 kernel/fork.c:2206\n   kernel_clone+0x223/0x880 kernel/fork.c:2787\n   kernel_thread+0x1bc/0x240 kernel/fork.c:2849\n   create_kthread kernel/kthread.c:412 [inline]\n   kthreadd+0x60d/0x810 kernel/kthread.c:765\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n  Freed by task 61:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n   poison_slab_object mm/kasan/common.c:247 [inline]\n   __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n   kasan_slab_free include/linux/kasan.h:230 [inline]\n   slab_free_h\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "378ff871-75f2-438f-9497-92f4e5cb4a61",
      "id": "CVE-2024-49892",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize get_bytes_per_element's default to 1\n\nVariables, used as denominators and maybe not assigned to other values,\nshould not be 0. bytes_per_element_y \u0026 bytes_per_element_c are\ninitialized by get_bytes_per_element() which should never return 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93a43b42-a4fb-4ab4-8aeb-839bfc599d16",
      "id": "CVE-2024-49898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null-initialized variables\n\n[WHAT \u0026 HOW]\ndrr_timing and subvp_pipe are initialized to null and they are not\nalways assigned new values. It is necessary to check for null before\ndereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26221307-4a21-4a7e-89a4-bf1e8c5a5424",
      "id": "CVE-2024-49963",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: bcm2835: Fix timeout during suspend mode\n\nDuring noirq suspend phase the Raspberry Pi power driver suffer of\nfirmware property timeouts. The reason is that the IRQ of the underlying\nBCM2835 mailbox is disabled and rpi_firmware_property_list() will always\nrun into a timeout [1].\n\nSince the VideoCore side isn't consider as a wakeup source, set the\nIRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled\nduring suspend-resume cycle.\n\n[1]\nPM: late suspend of devices complete after 1.754 msecs\nWARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128\n rpi_firmware_property_list+0x204/0x22c\nFirmware transaction 0x00028001 timeout\nModules linked in:\nCPU: 0 PID: 438 Comm: bash Tainted: G         C         6.9.3-dirty #17\nHardware name: BCM2835\nCall trace:\nunwind_backtrace from show_stack+0x18/0x1c\nshow_stack from dump_stack_lvl+0x34/0x44\ndump_stack_lvl from __warn+0x88/0xec\n__warn from warn_slowpath_fmt+0x7c/0xb0\nwarn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c\nrpi_firmware_property_list from rpi_firmware_property+0x68/0x8c\nrpi_firmware_property from rpi_firmware_set_power+0x54/0xc0\nrpi_firmware_set_power from _genpd_power_off+0xe4/0x148\n_genpd_power_off from genpd_sync_power_off+0x7c/0x11c\ngenpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0\ngenpd_finish_suspend from dpm_run_callback+0x78/0xd0\ndpm_run_callback from device_suspend_noirq+0xc0/0x238\ndevice_suspend_noirq from dpm_suspend_noirq+0xb0/0x168\ndpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac\nsuspend_devices_and_enter from pm_suspend+0x254/0x2e4\npm_suspend from state_store+0xa8/0xd4\nstate_store from kernfs_fop_write_iter+0x154/0x1a0\nkernfs_fop_write_iter from vfs_write+0x12c/0x184\nvfs_write from ksys_write+0x78/0xc0\nksys_write from ret_fast_syscall+0x0/0x54\nException stack(0xcc93dfa8 to 0xcc93dff0)\n[...]\nPM: noirq suspend of devices complete after 3095.584 msecs",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03aad246-2622-497d-98dc-23b045f021b9",
      "id": "CVE-2024-50003",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix system hang while resume with TBT monitor\n\n[Why]\nConnected with a Thunderbolt monitor and do the suspend and the system\nmay hang while resume.\n\nThe TBT monitor HPD will be triggered during the resume procedure\nand call the drm_client_modeset_probe() while\nstruct drm_connector connector-\u003edev-\u003emaster is NULL.\n\nIt will mess up the pipe topology after resume.\n\n[How]\nSkip the TBT monitor HPD during the resume procedure because we\ncurrently will probe the connectors after resume by default.\n\n(cherry picked from commit 453f86a26945207a16b8f66aaed5962dc2b95b85)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5601a2c9-4ef4-4e13-9bab-b5f7c7786921",
      "id": "CVE-2024-50044",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change\n\nrfcomm_sk_state_change attempts to use sock_lock so it must never be\ncalled with it locked but rfcomm_sock_ioctl always attempt to lock it\ncausing the following trace:\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted\n------------------------------------------------------\nsyz-executor386/5093 is trying to acquire lock:\nffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]\nffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73\n\nbut task is already holding lock:\nffff88807badfd28 (\u0026d-\u003elock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "809506cf-77bf-4af5-bc77-34585e02d581",
      "id": "CVE-2024-50287",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-tpg: prevent the risk of a division by zero\n\nAs reported by Coverity, the logic at tpg_precalculate_line()\nblindly rescales the buffer even when scaled_witdh is equal to\nzero. If this ever happens, this will cause a division by zero.\n\nInstead, add a WARN_ON_ONCE() to trigger such cases and return\nwithout doing any precalculation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55ad7150-8697-46f8-8303-4c8678a8767d",
      "id": "CVE-2024-50304",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()\n\nThe per-netns IP tunnel hash table is protected by the RTNL mutex and\nip_tunnel_find() is only called from the control path where the mutex is\ntaken.\n\nAdd a lockdep expression to hlist_for_each_entry_rcu() in\nip_tunnel_find() in order to validate that the mutex is held and to\nsilence the suspicious RCU usage warning [1].\n\n[1]\nWARNING: suspicious RCU usage\n6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted\n-----------------------------\nnet/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n1 lock held by ip/362:\n #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60\n\nstack backtrace:\nCPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xba/0x110\n lockdep_rcu_suspicious.cold+0x4f/0xd6\n ip_tunnel_find+0x435/0x4d0\n ip_tunnel_newlink+0x517/0x7a0\n ipgre_newlink+0x14c/0x170\n __rtnl_newlink+0x1173/0x19c0\n rtnl_newlink+0x6c/0xa0\n rtnetlink_rcv_msg+0x3cc/0xf60\n netlink_rcv_skb+0x171/0x450\n netlink_unicast+0x539/0x7f0\n netlink_sendmsg+0x8c1/0xd80\n ____sys_sendmsg+0x8f9/0xc20\n ___sys_sendmsg+0x197/0x1e0\n __sys_sendmsg+0x122/0x1f0\n do_syscall_64+0xbb/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7aa92cfd-5353-420d-b35f-750456888a98",
      "id": "CVE-2020-25670",
      "description": "A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fcfb68c4-1b46-48a2-a4f8-ab6c4dc87855",
      "id": "CVE-2024-53060",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: prevent NULL pointer dereference if ATIF is not supported\n\nacpi_evaluate_object() may return AE_NOT_FOUND (failure), which\nwould result in dereferencing buffer.pointer (obj) while being NULL.\n\nAlthough this case may be unrealistic for the current code, it is\nstill better to protect against possible bugs.\n\nBail out also when status is AE_NOT_FOUND.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity\nReport: CID 1600951:  Null pointer dereferences  (FORWARD_NULL)\n\n(cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c3b1ab8-7084-4f74-bed5-6e36886af2e9",
      "id": "CVE-2024-53156",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()\n\nI found the following bug in my fuzzer:\n\n  UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51\n  index 255 is out of range for type 'htc_endpoint [22]'\n  CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Workqueue: events request_firmware_work_func\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x180/0x1b0\n   __ubsan_handle_out_of_bounds+0xd4/0x130\n   htc_issue_send.constprop.0+0x20c/0x230\n   ? _raw_spin_unlock_irqrestore+0x3c/0x70\n   ath9k_wmi_cmd+0x41d/0x610\n   ? mark_held_locks+0x9f/0xe0\n   ...\n\nSince this bug has been confirmed to be caused by insufficient verification\nof conn_rsp_epid, I think it would be appropriate to add a range check for\nconn_rsp_epid to htc_connect_service() to prevent the bug from occurring.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e581973-57d5-49b5-8cdc-d6a699b5a60c",
      "id": "CVE-2024-56570",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Filter invalid inodes with missing lookup function\n\nAdd a check to the ovl_dentry_weird() function to prevent the\nprocessing of directory inodes that lack the lookup function.\nThis is important because such inodes can cause errors in overlayfs\nwhen passed to the lowerstack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c503f02d-6356-45f4-b1e1-652180b560b5",
      "id": "CVE-2024-57897",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Correct the migration DMA map direction\n\nThe SVM DMA device map direction should be set the same as\nthe DMA unmap setting, otherwise the DMA core will report\nthe following warning.\n\nBefore finialize this solution, there're some discussion on\nthe DMA mapping type(stream-based or coherent) in this KFD\nmigration case, followed by https://lore.kernel.org/all/04d4ab32\n-45a1-4b88-86ee-fb0f35a0ca40@amd.com/T/.\n\nAs there's no dma_sync_single_for_*() in the DMA buffer accessed\nthat because this migration operation should be sync properly and\nautomatically. Give that there's might not be a performance problem\nin various cache sync policy of DMA sync. Therefore, in order to\nsimplify the DMA direction setting alignment, let's set the DMA map\ndirection as BIDIRECTIONAL.\n\n[  150.834218] WARNING: CPU: 8 PID: 1812 at kernel/dma/debug.c:1028 check_unmap+0x1cc/0x930\n[  150.834225] Modules linked in: amdgpu(OE) amdxcp drm_exec(OE) gpu_sched drm_buddy(OE) drm_ttm_helper(OE) ttm(OE) drm_suballoc_helper(OE) drm_display_helper(OE) drm_kms_helper(OE) i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc sch_fq_codel intel_rapl_msr amd_atl intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd snd_pci_acp6x snd_hda_codec snd_acp_config snd_hda_core snd_hwdep snd_soc_acpi kvm_amd sunrpc snd_pcm kvm binfmt_misc snd_seq_midi crct10dif_pclmul snd_seq_midi_event ghash_clmulni_intel sha512_ssse3 snd_rawmidi nls_iso8859_1 sha256_ssse3 sha1_ssse3 snd_seq aesni_intel snd_seq_device crypto_simd snd_timer cryptd input_leds\n[  150.834310]  wmi_bmof serio_raw k10temp rapl snd sp5100_tco ipmi_devintf soundcore ccp ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport efi_pstore drm(OE) ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii\n[  150.834354] CPU: 8 PID: 1812 Comm: rocrtst64 Tainted: G           OE      6.10.0-custom #492\n[  150.834358] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021\n[  150.834360] RIP: 0010:check_unmap+0x1cc/0x930\n[  150.834363] Code: c0 4c 89 4d c8 e8 34 bf 86 00 4c 8b 4d c8 4c 8b 45 c0 48 8b 4d b8 48 89 c6 41 57 4c 89 ea 48 c7 c7 80 49 b4 84 e8 b4 81 f3 ff \u003c0f\u003e 0b 48 c7 c7 04 83 ac 84 e8 76 ba fc ff 41 8b 76 4c 49 8d 7e 50\n[  150.834365] RSP: 0018:ffffaac5023739e0 EFLAGS: 00010086\n[  150.834368] RAX: 0000000000000000 RBX: ffffffff8566a2e0 RCX: 0000000000000027\n[  150.834370] RDX: ffff8f6a8f621688 RSI: 0000000000000001 RDI: ffff8f6a8f621680\n[  150.834372] RBP: ffffaac502373a30 R08: 00000000000000c9 R09: ffffaac502373850\n[  150.834373] R10: ffffaac502373848 R11: ffffffff84f46328 R12: ffffaac502373a40\n[  150.834375] R13: ffff8f6741045330 R14: ffff8f6741a77700 R15: ffffffff84ac831b\n[  150.834377] FS:  00007faf0fc94c00(0000) GS:ffff8f6a8f600000(0000) knlGS:0000000000000000\n[  150.834379] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  150.834381] CR2: 00007faf0b600020 CR3: 000000010a52e000 CR4: 0000000000350ef0\n[  150.834383] Call Trace:\n[  150.834385]  \u003cTASK\u003e\n[  150.834387]  ? show_regs+0x6d/0x80\n[  150.834393]  ? __warn+0x8c/0x140\n[  150.834397]  ? check_unmap+0x1cc/0x930\n[  150.834400]  ? report_bug+0x193/0x1a0\n[  150.834406]  ? handle_bug+0x46/0x80\n[  150.834410]  ? exc_invalid_op+0x1d/0x80\n[  150.834413]  ? asm_exc_invalid_op+0x1f/0x30\n[  150.834420]  ? check_unmap+0x1cc/0x930\n[  150.834425]  debug_dma_unmap_page+0x86/0x90\n[  150.834431]  ? srso_return_thunk+0x5/0x5f\n[  150.834435] \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f16141f3-d976-4eab-ab75-1bc85f4a5ef0",
      "id": "CVE-2024-57904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: at91: call input_free_device() on allocated iio_dev\n\nCurrent implementation of at91_ts_register() calls input_free_deivce()\non st-\u003ets_input, however, the err label can be reached before the\nallocated iio_dev is stored to st-\u003ets_input. Thus call\ninput_free_device() on input instead of st-\u003ets_input.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f933f1db-c746-4765-a41d-679f774ea137",
      "id": "CVE-2024-58052",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table\n\nThe function atomctrl_get_smc_sclk_range_table() does not check the return\nvalue of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to\nretrieve SMU_Info table, it returns NULL which is later dereferenced.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nIn practice this should never happen as this code only gets called\non polaris chips and the vbios data table will always be present on\nthose chips.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6137fe03-3bac-4975-b00f-fe7b1dbeeb6b",
      "id": "CVE-2024-58094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add check read-only before truncation in jfs_truncate_nolock()\n\nAdded a check for \"read-only\" mode in the `jfs_truncate_nolock`\nfunction to avoid errors related to writing to a read-only\nfilesystem.\n\nCall stack:\n\nblock_write_begin() {\n  jfs_write_failed() {\n    jfs_truncate() {\n      jfs_truncate_nolock() {\n        txEnd() {\n          ...\n          log = JFS_SBI(tblk-\u003esb)-\u003elog;\n          // (log == NULL)\n\nIf the `isReadOnly(ip)` condition is triggered in\n`jfs_truncate_nolock`, the function execution will stop, and no\nfurther data modification will occur. Instead, the `xtTruncate`\nfunction will be called with the \"COMMIT_WMAP\" flag, preventing\nmodifications in \"read-only\" mode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15194165-4624-4ef6-a0b5-56da20554904",
      "id": "CVE-2025-21750",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Check the return value of of_property_read_string_index()\n\nSomewhen between 6.10 and 6.11 the driver started to crash on my\nMacBookPro14,3. The property doesn't exist and 'tmp' remains\nuninitialized, so we pass a random pointer to devm_kstrdup().\n\nThe crash I am getting looks like this:\n\nBUG: unable to handle page fault for address: 00007f033c669379\nPF: supervisor read access in kernel mode\nPF: error_code(0x0001) - permissions violation\nPGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025\nOops: Oops: 0001 [#1] SMP PTI\nCPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1\nHardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024\nRIP: 0010:strlen+0x4/0x30\nCode: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa \u003c80\u003e 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc\nRSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202\nRAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001\nRDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379\nRBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a\nR10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8\nR13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30\nFS:  00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x149/0x4c0\n ? raw_spin_rq_lock_nested+0xe/0x20\n ? sched_balance_newidle+0x22b/0x3c0\n ? update_load_avg+0x78/0x770\n ? exc_page_fault+0x6f/0x150\n ? asm_exc_page_fault+0x26/0x30\n ? __pfx_pci_conf1_write+0x10/0x10\n ? strlen+0x4/0x30\n devm_kstrdup+0x25/0x70\n brcmf_of_probe+0x273/0x350 [brcmfmac]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e8576404-bd06-4c4f-bd8a-f6bb78a44594",
      "id": "CVE-2025-38229",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cxusb: no longer judge rbuf when the write fails\n\nsyzbot reported a uninit-value in cxusb_i2c_xfer. [1]\n\nOnly when the write operation of usb_bulk_msg() in dvb_usb_generic_rw()\nsucceeds and rlen is greater than 0, the read operation of usb_bulk_msg()\nwill be executed to read rlen bytes of data from the dvb device into the\nrbuf.\n\nIn this case, although rlen is 1, the write operation failed which resulted\nin the dvb read operation not being executed, and ultimately variable i was\nnot initialized.\n\n[1]\nBUG: KMSAN: uninit-value in cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]\nBUG: KMSAN: uninit-value in cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196\n cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]\n cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196\n __i2c_transfer+0xe25/0x3150 drivers/i2c/i2c-core-base.c:-1\n i2c_transfer+0x317/0x4a0 drivers/i2c/i2c-core-base.c:2315\n i2c_transfer_buffer_flags+0x125/0x1e0 drivers/i2c/i2c-core-base.c:2343\n i2c_master_send include/linux/i2c.h:109 [inline]\n i2cdev_write+0x210/0x280 drivers/i2c/i2c-dev.c:183\n do_loop_readv_writev fs/read_write.c:848 [inline]\n vfs_writev+0x963/0x14e0 fs/read_write.c:1057\n do_writev+0x247/0x5c0 fs/read_write.c:1101\n __do_sys_writev fs/read_write.c:1169 [inline]\n __se_sys_writev fs/read_write.c:1166 [inline]\n __x64_sys_writev+0x98/0xe0 fs/read_write.c:1166\n x64_sys_call+0x2229/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:21\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8754c236-3965-40f6-a21f-c950afff493a",
      "id": "CVE-2025-38310",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: Fix validation of nexthop addresses\n\nThe kernel currently validates that the length of the provided nexthop\naddress does not exceed the specified length. This can lead to the\nkernel reading uninitialized memory if user space provided a shorter\nlength than the specified one.\n\nFix by validating that the provided length exactly matches the specified\none.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3676f6f-7dfb-4a5c-ad9b-c9ece3361d6b",
      "id": "CVE-2025-38530",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: pcl812: Fix bit shift out of bounds\n\nWhen checking for a supported IRQ number, the following test is used:\n\n\tif ((1 \u003c\u003c it-\u003eoptions[1]) \u0026 board-\u003eirq_bits) {\n\nHowever, `it-\u003eoptions[i]` is an unchecked `int` value from userspace, so\nthe shift amount could be negative or out of bounds.  Fix the test by\nrequiring `it-\u003eoptions[1]` to be within bounds before proceeding with\nthe original test.  Valid `it-\u003eoptions[1]` values that select the IRQ\nwill be in the range [1,15]. The value 0 explicitly disables the use of\ninterrupts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73a55dbd-8462-4151-aaad-f51c83577d37",
      "id": "CVE-2025-38556",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn't reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9789c881-3f85-4b80-8977-51b93467505c",
      "id": "CVE-2020-36310",
      "description": "An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a71dd931-d5c4-41db-b7b7-b32d4d6c2dd8",
      "id": "CVE-2020-36557",
      "description": "A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef723e84-a4db-431a-8bbf-a28f40d5ae32",
      "id": "CVE-2020-8648",
      "description": "There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1a30fad-f246-49d0-80e4-e25dd30e0f9e",
      "id": "CVE-2021-27365",
      "description": "An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b31cb821-3469-4b67-9bc9-222e34f7ab39",
      "id": "CVE-2022-3625",
      "description": "A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1819ad71-3ee5-4610-a6ea-7780083e0486",
      "id": "CVE-2021-38205",
      "description": "drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03359edb-6fd2-4503-a3f2-67dc6a9719b0",
      "id": "CVE-2021-4090",
      "description": "An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9eb343c-72f6-4e31-80d4-f83b429fe99d",
      "id": "CVE-2021-4159",
      "description": "A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae212518-278d-4f86-9164-df9baa1285a8",
      "id": "CVE-2021-46915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_limit: avoid possible divide error in nft_limit_init\n\ndiv_u64() divides u64 by u32.\n\nnft_limit_init() wants to divide u64 by u64, use the appropriate\nmath function (div64_u64)\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]\nRIP: 0010:div_u64 include/linux/math64.h:127 [inline]\nRIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85\nCode: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45 89 ed 31 d2 4c 89 f0 \u003c49\u003e f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00\nRSP: 0018:ffffc90009447198 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000200000000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff875152e6 RDI: 0000000000000003\nRBP: ffff888020f80908 R08: 0000200000000000 R09: 0000000000000000\nR10: ffffffff875152d8 R11: 0000000000000000 R12: ffffc90009447270\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  000000000097a300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200001c4 CR3: 0000000026a52000 CR4: 00000000001506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n nf_tables_newexpr net/netfilter/nf_tables_api.c:2675 [inline]\n nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713\n nft_set_elem_expr_alloc+0x27/0x280 net/netfilter/nf_tables_api.c:5160\n nf_tables_newset+0x1997/0x3150 net/netfilter/nf_tables_api.c:4321\n nfnetlink_rcv_batch+0x85a/0x21b0 net/netfilter/nfnetlink.c:456\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580 [inline]\n nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598\n netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338\n netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927\n sock_sendmsg_nosec net/socket.c:654 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:674\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2404\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbbfc50d-5676-4548-a477-088296a59e42",
      "id": "CVE-2021-47065",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw88: Fix array overrun in rtw_get_tx_power_params()\n\nUsing a kernel with the Undefined Behaviour Sanity Checker (UBSAN) enabled, the\nfollowing array overrun is logged:\n\n================================================================================\nUBSAN: array-index-out-of-bounds in /home/finger/wireless-drivers-next/drivers/net/wireless/realtek/rtw88/phy.c:1789:34\nindex 5 is out of range for type 'u8 [5]'\nCPU: 2 PID: 84 Comm: kworker/u16:3 Tainted: G           O      5.12.0-rc5-00086-gd88bba47038e-dirty #651\nHardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.50   09/29/2014\nWorkqueue: phy0 ieee80211_scan_work [mac80211]\nCall Trace:\n dump_stack+0x64/0x7c\n ubsan_epilogue+0x5/0x40\n __ubsan_handle_out_of_bounds.cold+0x43/0x48\n rtw_get_tx_power_params+0x83a/drivers/net/wireless/realtek/rtw88/0xad0 [rtw_core]\n ? rtw_pci_read16+0x20/0x20 [rtw_pci]\n ? check_hw_ready+0x50/0x90 [rtw_core]\n rtw_phy_get_tx_power_index+0x4d/0xd0 [rtw_core]\n rtw_phy_set_tx_power_level+0xee/0x1b0 [rtw_core]\n rtw_set_channel+0xab/0x110 [rtw_core]\n rtw_ops_config+0x87/0xc0 [rtw_core]\n ieee80211_hw_config+0x9d/0x130 [mac80211]\n ieee80211_scan_state_set_channel+0x81/0x170 [mac80211]\n ieee80211_scan_work+0x19f/0x2a0 [mac80211]\n process_one_work+0x1dd/0x3a0\n worker_thread+0x49/0x330\n ? rescuer_thread+0x3a0/0x3a0\n kthread+0x134/0x150\n ? kthread_create_worker_on_cpu+0x70/0x70\n ret_from_fork+0x22/0x30\n================================================================================\n\nThe statement where an array is being overrun is shown in the following snippet:\n\n\tif (rate \u003c= DESC_RATE11M)\n\t\ttx_power = pwr_idx_2g-\u003ecck_base[group];\n\telse\n====\u003e\t\ttx_power = pwr_idx_2g-\u003ebw40_base[group];\n\nThe associated arrays are defined in main.h as follows:\n\nstruct rtw_2g_txpwr_idx {\n\tu8 cck_base[6];\n\tu8 bw40_base[5];\n\tstruct rtw_2g_1s_pwr_idx_diff ht_1s_diff;\n\tstruct rtw_2g_ns_pwr_idx_diff ht_2s_diff;\n\tstruct rtw_2g_ns_pwr_idx_diff ht_3s_diff;\n\tstruct rtw_2g_ns_pwr_idx_diff ht_4s_diff;\n};\n\nThe problem arises because the value of group is 5 for channel 14. The trivial\nincrease in the dimension of bw40_base fails as this struct must match the layout of\nefuse. The fix is to add the rate as an argument to rtw_get_channel_group() and set\nthe group for channel 14 to 4 if rate \u003c= DESC_RATE11M.\n\nThis patch fixes commit fa6dfe6bff24 (\"rtw88: resolve order of tx power setting routines\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3ffbf26-4cdd-4f76-b502-a2991de5dfc4",
      "id": "CVE-2021-47095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ssif: initialize ssif_info-\u003eclient early\n\nDuring probe ssif_info-\u003eclient is dereferenced in error path. However,\nit is set when some of the error checking has already been done. This\ncauses following kernel crash if an error path is taken:\n\n[   30.645593][  T674] ipmi_ssif 0-000e: ipmi_ssif: Not probing, Interface already present\n[   30.657616][  T674] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088\n...\n[   30.657723][  T674] pc : __dev_printk+0x28/0xa0\n[   30.657732][  T674] lr : _dev_err+0x7c/0xa0\n...\n[   30.657772][  T674] Call trace:\n[   30.657775][  T674]  __dev_printk+0x28/0xa0\n[   30.657778][  T674]  _dev_err+0x7c/0xa0\n[   30.657781][  T674]  ssif_probe+0x548/0x900 [ipmi_ssif 62ce4b08badc1458fd896206d9ef69a3c31f3d3e]\n[   30.657791][  T674]  i2c_device_probe+0x37c/0x3c0\n...\n\nInitialize ssif_info-\u003eclient before any error path can be taken. Clear\ni2c_client data in the error path to prevent the dangling pointer from\nleaking.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1d2f19f-ccaf-4217-b842-7351872557a2",
      "id": "CVE-2021-47112",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Teardown PV features on boot CPU as well\n\nVarious PV features (Async PF, PV EOI, steal time) work through memory\nshared with hypervisor and when we restore from hibernation we must\nproperly teardown all these features to make sure hypervisor doesn't\nwrite to stale locations after we jump to the previously hibernated kernel\n(which can try to place anything there). For secondary CPUs the job is\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\nthe same for boot CPU.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c883ad26-53d5-4024-aa8b-b1d2fc568bd0",
      "id": "CVE-2021-47122",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: caif: fix memory leak in caif_device_notify\n\nIn case of caif_enroll_dev() fail, allocated\nlink_support won't be assigned to the corresponding\nstructure. So simply free allocated pointer in case\nof error",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f30d067-a7db-4a82-b93d-45a521053cf2",
      "id": "CVE-2021-47212",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Update error handler for UCTX and UMEM\n\nIn the fast unload flow, the device state is set to internal error,\nwhich indicates that the driver started the destroy process.\nIn this case, when a destroy command is being executed, it should return\nMLX5_CMD_STAT_OK.\nFix MLX5_CMD_OP_DESTROY_UCTX and MLX5_CMD_OP_DESTROY_UMEM to return OK\ninstead of EIO.\n\nThis fixes a call trace in the umem release process -\n[ 2633.536695] Call Trace:\n[ 2633.537518]  ib_uverbs_remove_one+0xc3/0x140 [ib_uverbs]\n[ 2633.538596]  remove_client_context+0x8b/0xd0 [ib_core]\n[ 2633.539641]  disable_device+0x8c/0x130 [ib_core]\n[ 2633.540615]  __ib_unregister_device+0x35/0xa0 [ib_core]\n[ 2633.541640]  ib_unregister_device+0x21/0x30 [ib_core]\n[ 2633.542663]  __mlx5_ib_remove+0x38/0x90 [mlx5_ib]\n[ 2633.543640]  auxiliary_bus_remove+0x1e/0x30 [auxiliary]\n[ 2633.544661]  device_release_driver_internal+0x103/0x1f0\n[ 2633.545679]  bus_remove_device+0xf7/0x170\n[ 2633.546640]  device_del+0x181/0x410\n[ 2633.547606]  mlx5_rescan_drivers_locked.part.10+0x63/0x160 [mlx5_core]\n[ 2633.548777]  mlx5_unregister_device+0x27/0x40 [mlx5_core]\n[ 2633.549841]  mlx5_uninit_one+0x21/0xc0 [mlx5_core]\n[ 2633.550864]  remove_one+0x69/0xe0 [mlx5_core]\n[ 2633.551819]  pci_device_remove+0x3b/0xc0\n[ 2633.552731]  device_release_driver_internal+0x103/0x1f0\n[ 2633.553746]  unbind_store+0xf6/0x130\n[ 2633.554657]  kernfs_fop_write+0x116/0x190\n[ 2633.555567]  vfs_write+0xa5/0x1a0\n[ 2633.556407]  ksys_write+0x4f/0xb0\n[ 2633.557233]  do_syscall_64+0x5b/0x1a0\n[ 2633.558071]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n[ 2633.559018] RIP: 0033:0x7f9977132648\n[ 2633.559821] Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 55 6f 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55\n[ 2633.562332] RSP: 002b:00007fffb1a83888 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 2633.563472] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f9977132648\n[ 2633.564541] RDX: 000000000000000c RSI: 000055b90546e230 RDI: 0000000000000001\n[ 2633.565596] RBP: 000055b90546e230 R08: 00007f9977406860 R09: 00007f9977a54740\n[ 2633.566653] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99774056e0\n[ 2633.567692] R13: 000000000000000c R14: 00007f9977400880 R15: 000000000000000c\n[ 2633.568725] ---[ end trace 10b4fe52945e544d ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "daa56c67-152d-40c0-8bd1-03eb537f5158",
      "id": "CVE-2021-47234",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()\n\nUse clk_disable_unprepare() in the error path of mtk_phy_init() to fix\nsome resource leaks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78937127-1be4-4f2e-a37e-4156ed4086c1",
      "id": "CVE-2021-47245",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: Fix out of bounds when parsing TCP options\n\nThe TCP option parser in synproxy (synproxy_parse_options) could read\none byte out of bounds. When the length is 1, the execution flow gets\ninto the loop, reads one byte of the opcode, and if the opcode is\nneither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds\nthe length of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").\n\nv2 changes:\n\nAdded an early return when length \u003c 0 to avoid calling\nskb_header_pointer with negative length.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8dd43250-ec1e-4996-852f-5b5bd1109c81",
      "id": "CVE-2021-47315",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: fsl_ifc: fix leak of IO mapping on probe failure\n\nOn probe error the driver should unmap the IO memory.  Smatch reports:\n\n  drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev-\u003egregs' not released on lines: 298.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cd7a9d4-1ca8-4bd0-9280-4e5e3581c867",
      "id": "CVE-2022-49586",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_fastopen.\n\nWhile reading sysctl_tcp_fastopen, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e01def13-3b37-4110-acb3-1a4953b555dd",
      "id": "CVE-2021-47328",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi: Fix conn use after free during resets\n\nIf we haven't done a unbind target call we can race where\niscsi_conn_teardown wakes up the EH thread and then frees the conn while\nthose threads are still accessing the conn ehwait.\n\nWe can only do one TMF per session so this just moves the TMF fields from\nthe conn to the session. We can then rely on the\niscsi_session_teardown-\u003eiscsi_remove_session-\u003e__iscsi_unbind_session call\nto remove the target and it's devices, and know after that point there is\nno device or scsi-ml callout trying to access the session.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35a2e5f3-bbb2-483e-8725-25cd7b0ee2ce",
      "id": "CVE-2021-47386",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val \u0026 0x08) \u0026\u0026 (!(val \u0026 0x80)) \u0026\u0026 ((val \u0026 0x7) == ((val \u003e\u003e 4) \u0026 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8d8f1fe-2b7a-4253-9820-794203e3bc4b",
      "id": "CVE-2021-47396",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211-hwsim: fix late beacon hrtimer handling\n\nThomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx\nthat our handling of the hrtimer here is wrong: If the timer fires\nlate (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot)\nthen it tries to actually rearm the timer at the next deadline,\nwhich might be in the past already:\n\n 1          2          3          N          N+1\n |          |          |   ...    |          |\n\n ^ intended to fire here (1)\n            ^ next deadline here (2)\n                                      ^ actually fired here\n\nThe next time it fires, it's later, but will still try to schedule\nfor the next deadline (now 3), etc. until it catches up with N,\nbut that might take a long time, causing stalls etc.\n\nNow, all of this is simulation, so we just have to fix it, but\nnote that the behaviour is wrong even per spec, since there's no\nvalue then in sending all those beacons unaligned - they should be\naligned to the TBTT (1, 2, 3, ... in the picture), and if we're a\nbit (or a lot) late, then just resume at that point.\n\nTherefore, change the code to use hrtimer_forward_now() which will\nensure that the next firing of the timer would be at N+1 (in the\npicture), i.e. the next interval point after the current time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bca7ef39-db8b-4958-a59b-a6b163cf2b9f",
      "id": "CVE-2021-47407",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Handle SRCU initialization failure during page track init\n\nCheck the return of init_srcu_struct(), which can fail due to OOM, when\ninitializing the page track mechanism.  Lack of checking leads to a NULL\npointer deref found by a modified syzkaller.\n\n[Move the call towards the beginning of kvm_arch_init_vm. - Paolo]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21229146-777f-46a6-8f3d-2a656076a512",
      "id": "CVE-2021-47483",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: Fix possible double-free in regcache_rbtree_exit()\n\nIn regcache_rbtree_insert_to_block(), when 'present' realloc failed,\nthe 'blk' which is supposed to assign to 'rbnode-\u003eblock' will be freed,\nso 'rbnode-\u003eblock' points a freed memory, in the error handling path of\nregcache_rbtree_init(), 'rbnode-\u003eblock' will be freed again in\nregcache_rbtree_exit(), KASAN will report double-free as follows:\n\nBUG: KASAN: double-free or invalid-free in kfree+0xce/0x390\nCall Trace:\n slab_free_freelist_hook+0x10d/0x240\n kfree+0xce/0x390\n regcache_rbtree_exit+0x15d/0x1a0\n regcache_rbtree_init+0x224/0x2c0\n regcache_init+0x88d/0x1310\n __regmap_init+0x3151/0x4a80\n __devm_regmap_init+0x7d/0x100\n madera_spi_probe+0x10f/0x333 [madera_spi]\n spi_probe+0x183/0x210\n really_probe+0x285/0xc30\n\nTo fix this, moving up the assignment of rbnode-\u003eblock to immediately after\nthe reallocation has succeeded so that the data structure stays valid even\nif the second reallocation fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74495f49-e340-43bd-9367-b4de7de1be08",
      "id": "CVE-2022-45885",
      "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "840e5dba-5797-49c4-a200-59851e8d2745",
      "id": "CVE-2022-49177",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: cavium - fix NULL but dereferenced coccicheck error\n\nFix following coccicheck warning:\n./drivers/char/hw_random/cavium-rng-vf.c:182:17-20: ERROR:\npdev is NULL but dereferenced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bb503af-362b-4de3-a3a5-4a5a3a674e5b",
      "id": "CVE-2021-47491",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: khugepaged: skip huge page collapse for special files\n\nThe read-only THP for filesystems will collapse THP for files opened\nreadonly and mapped with VM_EXEC.  The intended usecase is to avoid TLB\nmisses for large text segments.  But it doesn't restrict the file types\nso a THP could be collapsed for a non-regular file, for example, block\ndevice, if it is opened readonly and mapped with EXEC permission.  This\nmay cause bugs, like [1] and [2].\n\nThis is definitely not the intended usecase, so just collapse THP for\nregular files in order to close the attack surface.\n\n[shy828301@gmail.com: fix vm_file check [3]]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e43f69c0-70e1-46da-a624-3f0301132aa9",
      "id": "CVE-2021-47497",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: Fix shift-out-of-bound (UBSAN) with byte size cells\n\nIf a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic\n\n *p \u0026= GENMASK((cell-\u003enbits%BITS_PER_BYTE) - 1, 0);\n\nwill become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we\nsubtract one from that making a large number that is then shifted more than the\nnumber of bits that fit into an unsigned long.\n\nUBSAN reports this problem:\n\n UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8\n shift exponent 64 is too large for 64-bit type 'unsigned long'\n CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9\n Hardware name: Google Lazor (rev3+) with KB Backlight (DT)\n Workqueue: events_unbound deferred_probe_work_func\n Call trace:\n  dump_backtrace+0x0/0x170\n  show_stack+0x24/0x30\n  dump_stack_lvl+0x64/0x7c\n  dump_stack+0x18/0x38\n  ubsan_epilogue+0x10/0x54\n  __ubsan_handle_shift_out_of_bounds+0x180/0x194\n  __nvmem_cell_read+0x1ec/0x21c\n  nvmem_cell_read+0x58/0x94\n  nvmem_cell_read_variable_common+0x4c/0xb0\n  nvmem_cell_read_variable_le_u32+0x40/0x100\n  a6xx_gpu_init+0x170/0x2f4\n  adreno_bind+0x174/0x284\n  component_bind_all+0xf0/0x264\n  msm_drm_bind+0x1d8/0x7a0\n  try_to_bring_up_master+0x164/0x1ac\n  __component_add+0xbc/0x13c\n  component_add+0x20/0x2c\n  dp_display_probe+0x340/0x384\n  platform_probe+0xc0/0x100\n  really_probe+0x110/0x304\n  __driver_probe_device+0xb8/0x120\n  driver_probe_device+0x4c/0xfc\n  __device_attach_driver+0xb0/0x128\n  bus_for_each_drv+0x90/0xdc\n  __device_attach+0xc8/0x174\n  device_initial_probe+0x20/0x2c\n  bus_probe_device+0x40/0xa4\n  deferred_probe_work_func+0x7c/0xb8\n  process_one_work+0x128/0x21c\n  process_scheduled_works+0x40/0x54\n  worker_thread+0x1ec/0x2a8\n  kthread+0x138/0x158\n  ret_from_fork+0x10/0x20\n\nFix it by making sure there are any bits to mask out.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f940bd1b-41e7-4856-bd95-5e24582587f6",
      "id": "CVE-2021-47500",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: mma8452: Fix trigger reference couting\n\nThe mma8452 driver directly assigns a trigger to the struct iio_dev. The\nIIO core when done using this trigger will call `iio_trigger_put()` to drop\nthe reference count by 1.\n\nWithout the matching `iio_trigger_get()` in the driver the reference count\ncan reach 0 too early, the trigger gets freed while still in use and a\nuse-after-free occurs.\n\nFix this by getting a reference to the trigger before assigning it to the\nIIO device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52a3f2a4-d592-484f-bb3a-80a3ae3f65ab",
      "id": "CVE-2021-47579",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix warning in ovl_create_real()\n\nSyzbot triggered the following warning in ovl_workdir_create() -\u003e\novl_create_real():\n\n\tif (!err \u0026\u0026 WARN_ON(!newdentry-\u003ed_inode)) {\n\nThe reason is that the cgroup2 filesystem returns from mkdir without\ninstantiating the new dentry.\n\nWeird filesystems such as this will be rejected by overlayfs at a later\nstage during setup, but to prevent such a warning, call ovl_mkdir_real()\ndirectly from ovl_workdir_create() and reject this case early.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6df32443-c745-44a7-9a69-3147893a52be",
      "id": "CVE-2021-47587",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: Add global locking for descriptor lifecycle\n\nThe descriptor list is a shared resource across all of the transmit queues, and\nthe locking mechanism used today only protects concurrency across a given\ntransmit queue between the transmit and reclaiming. This creates an opportunity\nfor the SYSTEMPORT hardware to work on corrupted descriptors if we have\nmultiple producers at once which is the case when using multiple transmit\nqueues.\n\nThis was particularly noticeable when using multiple flows/transmit queues and\nit showed up in interesting ways in that UDP packets would get a correct UDP\nheader checksum being calculated over an incorrect packet length. Similarly TCP\npackets would get an equally correct checksum computed by the hardware over an\nincorrect packet length.\n\nThe SYSTEMPORT hardware maintains an internal descriptor list that it re-arranges\nwhen the driver produces a new descriptor anytime it writes to the\nWRITE_PORT_{HI,LO} registers, there is however some delay in the hardware to\nre-organize its descriptors and it is possible that concurrent TX queues\neventually break this internal allocation scheme to the point where the\nlength/status part of the descriptor gets used for an incorrect data buffer.\n\nThe fix is to impose a global serialization for all TX queues in the short\nsection where we are writing to the WRITE_PORT_{HI,LO} registers which solves\nthe corruption even with multiple concurrent TX queues being used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c0799dc-a4cd-4fb6-95bc-24f8900c36a7",
      "id": "CVE-2022-48673",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix possible access to freed memory in link clear\n\nAfter modifying the QP to the Error state, all RX WR would be completed\nwith WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not\nwait for it is done, but destroy the QP and free the link group directly.\nSo there is a risk that accessing the freed memory in tasklet context.\n\nHere is a crash example:\n\n BUG: unable to handle page fault for address: ffffffff8f220860\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060\n Oops: 0002 [#1] SMP PTI\n CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23\n Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018\n RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0\n Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e \u003c48\u003e 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32\n RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086\n RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000\n RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00\n RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b\n R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010\n R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040\n FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cIRQ\u003e\n  _raw_spin_lock_irqsave+0x30/0x40\n  mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]\n  smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]\n  tasklet_action_common.isra.21+0x66/0x100\n  __do_softirq+0xd5/0x29c\n  asm_call_irq_on_stack+0x12/0x20\n  \u003c/IRQ\u003e\n  do_softirq_own_stack+0x37/0x40\n  irq_exit_rcu+0x9d/0xa0\n  sysvec_call_function_single+0x34/0x80\n  asm_sysvec_call_function_single+0x12/0x20",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8cab7bad-c986-4e14-bb38-15f2858a29ac",
      "id": "CVE-2025-21721",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: handle errors that nilfs_prepare_chunk() may return\n\nPatch series \"nilfs2: fix issues with rename operations\".\n\nThis series fixes BUG_ON check failures reported by syzbot around rename\noperations, and a minor behavioral issue where the mtime of a child\ndirectory changes when it is renamed instead of moved.\n\n\nThis patch (of 2):\n\nThe directory manipulation routines nilfs_set_link() and\nnilfs_delete_entry() rewrite the directory entry in the folio/page\npreviously read by nilfs_find_entry(), so error handling is omitted on the\nassumption that nilfs_prepare_chunk(), which prepares the buffer for\nrewriting, will always succeed for these.  And if an error is returned, it\ntriggers the legacy BUG_ON() checks in each routine.\n\nThis assumption is wrong, as proven by syzbot: the buffer layer called by\nnilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may\nfail due to metadata corruption or other reasons.  This has been there all\nalong, but improved sanity checks and error handling may have made it more\nreproducible in fuzzing tests.\n\nFix this issue by adding missing error paths in nilfs_set_link(),\nnilfs_delete_entry(), and their caller nilfs_rename().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13203edd-f944-4a17-833a-c5ca2c99e8df",
      "id": "CVE-2021-47637",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix deadlock in concurrent rename whiteout and inode writeback\n\nFollowing hung tasks:\n[   77.028764] task:kworker/u8:4    state:D stack:    0 pid:  132\n[   77.028820] Call Trace:\n[   77.029027]  schedule+0x8c/0x1b0\n[   77.029067]  mutex_lock+0x50/0x60\n[   77.029074]  ubifs_write_inode+0x68/0x1f0 [ubifs]\n[   77.029117]  __writeback_single_inode+0x43c/0x570\n[   77.029128]  writeback_sb_inodes+0x259/0x740\n[   77.029148]  wb_writeback+0x107/0x4d0\n[   77.029163]  wb_workfn+0x162/0x7b0\n\n[   92.390442] task:aa              state:D stack:    0 pid: 1506\n[   92.390448] Call Trace:\n[   92.390458]  schedule+0x8c/0x1b0\n[   92.390461]  wb_wait_for_completion+0x82/0xd0\n[   92.390469]  __writeback_inodes_sb_nr+0xb2/0x110\n[   92.390472]  writeback_inodes_sb_nr+0x14/0x20\n[   92.390476]  ubifs_budget_space+0x705/0xdd0 [ubifs]\n[   92.390503]  do_rename.cold+0x7f/0x187 [ubifs]\n[   92.390549]  ubifs_rename+0x8b/0x180 [ubifs]\n[   92.390571]  vfs_rename+0xdb2/0x1170\n[   92.390580]  do_renameat2+0x554/0x770\n\n, are caused by concurrent rename whiteout and inode writeback processes:\n\trename_whiteout(Thread 1)\t        wb_workfn(Thread2)\nubifs_rename\n  do_rename\n    lock_4_inodes (Hold ui_mutex)\n    ubifs_budget_space\n      make_free_space\n        shrink_liability\n\t  __writeback_inodes_sb_nr\n\t    bdi_split_work_to_wbs (Queue new wb work)\n\t\t\t\t\t      wb_do_writeback(wb work)\n\t\t\t\t\t\t__writeback_single_inode\n\t\t\t\t\t          ubifs_write_inode\n\t\t\t\t\t            LOCK(ui_mutex)\n\t\t\t\t\t\t\t   ↑\n\t      wb_wait_for_completion (Wait wb work) \u003c-- deadlock!\n\nReproducer (Detail program in [Link]):\n  1. SYS_renameat2(\"/mp/dir/file\", \"/mp/dir/whiteout\", RENAME_WHITEOUT)\n  2. Consume out of space before kernel(mdelay) doing budget for whiteout\n\nFix it by doing whiteout space budget before locking ubifs inodes.\nBTW, it also fixes wrong goto tag 'out_release' in whiteout budget\nerror handling path(It should at least recover dir i_size and unlock\n4 ubifs inodes).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "352eec33-5c6f-42ae-8aa5-44344fbaac0d",
      "id": "CVE-2022-0330",
      "description": "A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d108b8d5-1452-4557-a992-b3e80d9d08a1",
      "id": "CVE-2022-49980",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: Fix use-after-free Read in usb_udc_uevent()\n\nThe syzbot fuzzer found a race between uevent callbacks and gadget\ndriver unregistration that can cause a use-after-free bug:\n\n---------------------------------------------------------------\nBUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130\ndrivers/usb/gadget/udc/core.c:1732\nRead of size 8 at addr ffff888078ce2050 by task udevd/2968\n\nCPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google\n06/29/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:317 [inline]\n print_report.cold+0x2ba/0x719 mm/kasan/report.c:433\n kasan_report+0xbe/0x1f0 mm/kasan/report.c:495\n usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732\n dev_uevent+0x290/0x770 drivers/base/core.c:2424\n---------------------------------------------------------------\n\nThe bug occurs because usb_udc_uevent() dereferences udc-\u003edriver but\ndoes so without acquiring the udc_lock mutex, which protects this\nfield.  If the gadget driver is unbound from the udc concurrently with\nuevent processing, the driver structure may be accessed after it has\nbeen deallocated.\n\nTo prevent the race, we make sure that the routine holds the mutex\naround the racing accesses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9f672ea-bb52-4c31-a5ba-69a67f07f359",
      "id": "CVE-2022-1195",
      "description": "A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a07f8b63-e347-4954-a8b2-3e6b949f3126",
      "id": "CVE-2022-2905",
      "description": "An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42e9289b-4690-4210-a6a0-e74f57189f18",
      "id": "CVE-2022-34494",
      "description": "rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad886b71-f223-4292-8319-c1bc22f51f75",
      "id": "CVE-2021-47578",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Don't call kcalloc() if size arg is zero\n\nIf the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR.  Because of\nthat, for a following NULL pointer check to work on the returned pointer,\nkcalloc() must not be called with the size arg equal to zero. Return early\nwithout error before the kcalloc() call if size arg is zero.\n\nBUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline]\nBUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974\nWrite of size 4 at addr 0000000000000010 by task syz-executor.1/22789\n\nCPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\n __kasan_report mm/kasan/report.c:446 [inline]\n kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189\n memcpy+0x3b/0x60 mm/kasan/shadow.c:66\n memcpy include/linux/fortify-string.h:191 [inline]\n sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974\n do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline]\n do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline]\n resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276\n schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478\n scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533\n scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]\n scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62\n blk_execute_rq+0xdb/0x360 block/blk-exec.c:102\n sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline]\n scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930\n sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db7f1607-b275-41f8-8fad-ababa440a019",
      "id": "CVE-2022-48809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix a memleak when uncloning an skb dst and its metadata\n\nWhen uncloning an skb dst and its associated metadata, a new\ndst+metadata is allocated and later replaces the old one in the skb.\nThis is helpful to have a non-shared dst+metadata attached to a specific\nskb.\n\nThe issue is the uncloned dst+metadata is initialized with a refcount of\n1, which is increased to 2 before attaching it to the skb. When\ntun_dst_unclone returns, the dst+metadata is only referenced from a\nsingle place (the skb) while its refcount is 2. Its refcount will never\ndrop to 0 (when the skb is consumed), leading to a memory leak.\n\nFix this by removing the call to dst_hold in tun_dst_unclone, as the\ndst+metadata refcount is already 1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49b81a38-a90b-473c-9105-8e727950e127",
      "id": "CVE-2022-48893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Cleanup partial engine discovery failures\n\nIf we abort driver initialisation in the middle of gt/engine discovery,\nsome engines will be fully setup and some not. Those incompletely setup\nengines only have 'engine-\u003erelease == NULL' and so will leak any of the\ncommon objects allocated.\n\nv2:\n - Drop the destroy_pinned_context() helper for now.  It's not really\n   worth it with just a single callsite at the moment.  (Janusz)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4f52e8e-2a42-4cdb-8190-89ba1a6a1a92",
      "id": "CVE-2022-48948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: Prevent buffer overflow in setup handler\n\nSetup function uvc_function_setup permits control transfer\nrequests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),\ndata stage handler for OUT transfer uses memcpy to copy req-\u003eactual\nbytes to uvc_event-\u003edata.data array of size 60. This may result\nin an overflow of 4 bytes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfa3d3f4-ec61-4cab-a07e-00d8f1f58923",
      "id": "CVE-2022-48958",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet: aeroflex: fix potential skb leak in greth_init_rings()\n\nThe greth_init_rings() function won't free the newly allocated skb when\ndma_mapping_error() returns error, so add dev_kfree_skb() to fix it.\n\nCompile tested only.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb1334b1-d32c-4300-9128-1f46ba0759a3",
      "id": "CVE-2022-49180",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLSM: general protection fault in legacy_parse_param\n\nThe usual LSM hook \"bail on fail\" scheme doesn't work for cases where\na security module may return an error code indicating that it does not\nrecognize an input.  In this particular case Smack sees a mount option\nthat it recognizes, and returns 0. A call to a BPF hook follows, which\nreturns -ENOPARAM, which confuses the caller because Smack has processed\nits data.\n\nThe SELinux hook incorrectly returns 1 on success. There was a time\nwhen this was correct, however the current expectation is that it\nreturn 0 on success. This is repaired.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41431d3c-118a-47fc-bae7-a21df65c4ee4",
      "id": "CVE-2022-49010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) Check for null before removing sysfs attrs\n\nIf coretemp_add_core() gets an error then pdata-\u003ecore_data[indx]\nis already NULL and has been kfreed. Don't pass that to\nsysfs_remove_group() as that will crash in sysfs_remove_group().\n\n[Shortened for readability]\n[91854.020159] sysfs: cannot create duplicate filename '/devices/platform/coretemp.0/hwmon/hwmon2/temp20_label'\n\u003ccpu offline\u003e\n[91855.126115] BUG: kernel NULL pointer dereference, address: 0000000000000188\n[91855.165103] #PF: supervisor read access in kernel mode\n[91855.194506] #PF: error_code(0x0000) - not-present page\n[91855.224445] PGD 0 P4D 0\n[91855.238508] Oops: 0000 [#1] PREEMPT SMP PTI\n...\n[91855.342716] RIP: 0010:sysfs_remove_group+0xc/0x80\n...\n[91855.796571] Call Trace:\n[91855.810524]  coretemp_cpu_offline+0x12b/0x1dd [coretemp]\n[91855.841738]  ? coretemp_cpu_online+0x180/0x180 [coretemp]\n[91855.871107]  cpuhp_invoke_callback+0x105/0x4b0\n[91855.893432]  cpuhp_thread_fun+0x8e/0x150\n...\n\nFix this by checking for NULL first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c7001695-41e1-400b-aefb-933613513c0a",
      "id": "CVE-2022-49046",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: dev: check return value when calling dev_set_name()\n\nIf dev_set_name() fails, the dev_name() is null, check the return\nvalue of dev_set_name() to avoid the null-ptr-deref.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dbf5a38e-60fa-42e7-8e95-f02e74ce5016",
      "id": "CVE-2023-39189",
      "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a6e6ace-3232-4de8-9608-13187d7b3623",
      "id": "CVE-2022-49091",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imx: Fix memory leak in imx_pd_connector_get_modes\n\nAvoid leaking the display mode variable if of_get_drm_display_mode\nfails.\n\nAddresses-Coverity-ID: 1443943 (\"Resource leak\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f90cbbc2-8fd3-4afd-992a-eda308b27e12",
      "id": "CVE-2022-49152",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nXArray: Fix xas_create_range() when multi-order entry present\n\nIf there is already an entry present that is of order \u003e= XA_CHUNK_SHIFT\nwhen we call xas_create_range(), xas_create_range() will misinterpret\nthat entry as a node and dereference xa_node-\u003eparent, generally leading\nto a crash that looks something like this:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001:\n0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 32 Comm: khugepaged Not tainted 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0\nRIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline]\nRIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725\n\nIt's deterministically reproducable once you know what the problem is,\nbut producing it in a live kernel requires khugepaged to hit a race.\nWhile the problem has been present since xas_create_range() was\nintroduced, I'm not aware of a way to hit it before the page cache was\nconverted to use multi-index entries.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d86dc6b2-922d-4c81-b65f-1ac0cf7f489c",
      "id": "CVE-2022-49158",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix warning message due to adisc being flushed\n\nFix warning message due to adisc being flushed.  Linux kernel triggered a\nwarning message where a different error code type is not matching up with\nthe expected type. Add additional translation of one error code type to\nanother.\n\nWARNING: CPU: 2 PID: 1131623 at drivers/scsi/qla2xxx/qla_init.c:498\nqla2x00_async_adisc_sp_done+0x294/0x2b0 [qla2xxx]\nCPU: 2 PID: 1131623 Comm: drmgr Not tainted 5.13.0-rc1-autotest #1\n..\nGPR28: c000000aaa9c8890 c0080000079ab678 c00000140a104800 c00000002bd19000\nNIP [c00800000790857c] qla2x00_async_adisc_sp_done+0x294/0x2b0 [qla2xxx]\nLR [c008000007908578] qla2x00_async_adisc_sp_done+0x290/0x2b0 [qla2xxx]\nCall Trace:\n[c00000001cdc3620] [c008000007908578] qla2x00_async_adisc_sp_done+0x290/0x2b0 [qla2xxx] (unreliable)\n[c00000001cdc3710] [c0080000078f3080] __qla2x00_abort_all_cmds+0x1b8/0x580 [qla2xxx]\n[c00000001cdc3840] [c0080000078f589c] qla2x00_abort_all_cmds+0x34/0xd0 [qla2xxx]\n[c00000001cdc3880] [c0080000079153d8] qla2x00_abort_isp_cleanup+0x3f0/0x570 [qla2xxx]\n[c00000001cdc3920] [c0080000078fb7e8] qla2x00_remove_one+0x3d0/0x480 [qla2xxx]\n[c00000001cdc39b0] [c00000000071c274] pci_device_remove+0x64/0x120\n[c00000001cdc39f0] [c0000000007fb818] device_release_driver_internal+0x168/0x2a0\n[c00000001cdc3a30] [c00000000070e304] pci_stop_bus_device+0xb4/0x100\n[c00000001cdc3a70] [c00000000070e4f0] pci_stop_and_remove_bus_device+0x20/0x40\n[c00000001cdc3aa0] [c000000000073940] pci_hp_remove_devices+0x90/0x130\n[c00000001cdc3b30] [c0080000070704d0] disable_slot+0x38/0x90 [rpaphp] [\nc00000001cdc3b60] [c00000000073eb4c] power_write_file+0xcc/0x180\n[c00000001cdc3be0] [c0000000007354bc] pci_slot_attr_store+0x3c/0x60\n[c00000001cdc3c00] [c00000000055f820] sysfs_kf_write+0x60/0x80 [c00000001cdc3c20]\n[c00000000055df10] kernfs_fop_write_iter+0x1a0/0x290\n[c00000001cdc3c70] [c000000000447c4c] new_sync_write+0x14c/0x1d0\n[c00000001cdc3d10] [c00000000044b134] vfs_write+0x224/0x330\n[c00000001cdc3d60] [c00000000044b3f4] ksys_write+0x74/0x130\n[c00000001cdc3db0] [c00000000002df70] system_call_exception+0x150/0x2d0\n[c00000001cdc3e10] [c00000000000d45c] system_call_common+0xec/0x278",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3cc9bca-2bfc-488b-b46b-8bc19bc9ef2c",
      "id": "CVE-2022-49358",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: memleak flow rule from commit path\n\nAbort path release flow rule object, however, commit path does not.\nUpdate code to destroy these objects before releasing the transaction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "596f009d-63cb-45cf-a1bc-66f55c9d5e88",
      "id": "CVE-2022-49389",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbip: fix a refcount leak in stub_probe()\n\nusb_get_dev() is called in stub_device_alloc(). When stub_probe() fails\nafter that, usb_put_dev() needs to be called to release the reference.\n\nFix this by moving usb_put_dev() to sdev_free error path handling.\n\nFind this by code review.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93a8cbf1-4c24-48e9-b930-6d36f2d1d0c8",
      "id": "CVE-2022-49495",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/hdmi: check return value after calling platform_get_resource_byname()\n\nIt will cause null-ptr-deref if platform_get_resource_byname() returns NULL,\nwe need check the return value.\n\nPatchwork: https://patchwork.freedesktop.org/patch/482992/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "499a4138-1331-492a-a7a8-afe3c06dc8ca",
      "id": "CVE-2022-49520",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall\n\nIf a compat process tries to execute an unknown system call above the\n__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the\noffending process. Information about the error is printed to dmesg in\ncompat_arm_syscall() -\u003e arm64_notify_die() -\u003e arm64_force_sig_fault() -\u003e\narm64_show_signal().\n\narm64_show_signal() interprets a non-zero value for\ncurrent-\u003ethread.fault_code as an exception syndrome and displays the\nmessage associated with the ESR_ELx.EC field (bits 31:26).\ncurrent-\u003ethread.fault_code is set in compat_arm_syscall() -\u003e\narm64_notify_die() with the bad syscall number instead of a valid ESR_ELx\nvalue. This means that the ESR_ELx.EC field has the value that the user set\nfor the syscall number and the kernel can end up printing bogus exception\nmessages*. For example, for the syscall number 0x68000000, which evaluates\nto ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error:\n\n[   18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000]\n[   18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79\n[   18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT)\n[..]\n\nwhich is misleading, as the bad compat syscall has nothing to do with\npointer authentication.\n\nStop arm64_show_signal() from printing exception syndrome information by\nhaving compat_arm_syscall() set the ESR_ELx value to 0, as it has no\nmeaning for an invalid system call number. The example above now becomes:\n\n[   19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000]\n[   19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80\n[   19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT)\n[..]\n\nwhich although shows less information because the syscall number,\nwrongfully advertised as the ESR value, is missing, it is better than\nshowing plainly wrong information. The syscall number can be easily\nobtained with strace.\n\n*A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative\ninteger in compat_arm_syscal() and the condition scno \u003c __ARM_NR_COMPAT_END\nevaluates to true; the syscall will exit to userspace in this case with the\nENOSYS error code instead of arm64_notify_die() being called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7761e38-4f95-4411-881a-6bf68fbab1ce",
      "id": "CVE-2022-49590",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigmp: Fix data-races around sysctl_igmp_llm_reports.\n\nWhile reading sysctl_igmp_llm_reports, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.\n\nThis test can be packed into a helper, so such changes will be in the\nfollow-up series after net is merged into net-next.\n\n  if (ipv4_is_local_multicast(pmc-\u003emultiaddr) \u0026\u0026\n      !READ_ONCE(net-\u003eipv4.sysctl_igmp_llm_reports))",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37254218-d7e4-4592-9bba-0fe516f4bbb1",
      "id": "CVE-2022-49604",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: Fix data-races around sysctl_ip_fwd_use_pmtu.\n\nWhile reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2229f24e-f4da-49ad-896b-e3e2d5653caa",
      "id": "CVE-2023-53412",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "377127c8-5c43-4117-b8e2-7b2d08416d8a",
      "id": "CVE-2022-49771",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: fix misbehavior if list_versions races with module loading\n\n__list_versions will first estimate the required space using the\n\"dm_target_iterate(list_version_get_needed, \u0026needed)\" call and then will\nfill the space using the \"dm_target_iterate(list_version_get_info,\n\u0026iter_info)\" call. Each of these calls locks the targets using the\n\"down_read(\u0026_lock)\" and \"up_read(\u0026_lock)\" calls, however between the first\nand second \"dm_target_iterate\" there is no lock held and the target\nmodules can be loaded at this point, so the second \"dm_target_iterate\"\ncall may need more space than what was the first \"dm_target_iterate\"\nreturned.\n\nThe code tries to handle this overflow (see the beginning of\nlist_version_get_info), however this handling is incorrect.\n\nThe code sets \"param-\u003edata_size = param-\u003edata_start + needed\" and\n\"iter_info.end = (char *)vers+len\" - \"needed\" is the size returned by the\nfirst dm_target_iterate call; \"len\" is the size of the buffer allocated by\nuserspace.\n\n\"len\" may be greater than \"needed\"; in this case, the code will write up\nto \"len\" bytes into the buffer, however param-\u003edata_size is set to\n\"needed\", so it may write data past the param-\u003edata_size value. The ioctl\ninterface copies only up to param-\u003edata_size into userspace, thus part of\nthe result will be truncated.\n\nFix this bug by setting \"iter_info.end = (char *)vers + needed;\" - this\nguarantees that the second \"dm_target_iterate\" call will write only up to\nthe \"needed\" buffer and it will exit with \"DM_BUFFER_FULL_FLAG\" if it\noverflows the \"needed\" space - in this case, userspace will allocate a\nlarger buffer and retry.\n\nNote that there is also a bug in list_version_get_needed - we need to add\n\"strlen(tt-\u003ename) + 1\" to the needed size, not \"strlen(tt-\u003ename)\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b32b36ef-f035-4b47-95c0-d4ed5aba96bd",
      "id": "CVE-2022-49870",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncapabilities: fix undefined behavior in bit shift for CAP_TO_MASK\n\nShifting signed 32-bit value by 31 bits is undefined, so changing\nsignificant bit to unsigned. The UBSAN warning calltrace like below:\n\nUBSAN: shift-out-of-bounds in security/commoncap.c:1252:2\nleft shift of 1 by 31 places cannot be represented in type 'int'\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x7d/0xa5\n dump_stack+0x15/0x1b\n ubsan_epilogue+0xe/0x4e\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c\n cap_task_prctl+0x561/0x6f0\n security_task_prctl+0x5a/0xb0\n __x64_sys_prctl+0x61/0x8f0\n do_syscall_64+0x58/0x80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09496543-14fa-408d-979f-a2350c002e2b",
      "id": "CVE-2022-49954",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag\n\nsyzbot is reporting hung task at __input_unregister_device() [1], for\niforce_close() waiting at wait_event_interruptible() with dev-\u003emutex held\nis blocking input_disconnect_device() from __input_unregister_device().\n\nIt seems that the cause is simply that commit c2b27ef672992a20 (\"Input:\niforce - wait for command completion when closing the device\") forgot to\ncall wake_up() after clear_bit().\n\nFix this problem by introducing a helper that calls clear_bit() followed\nby wake_up_all().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4792ff1-885f-473d-a86f-6749ad840fca",
      "id": "CVE-2022-50012",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64: Init jump labels before parse_early_param()\n\nOn 64-bit, calling jump_label_init() in setup_feature_keys() is too\nlate because static keys may be used in subroutines of\nparse_early_param() which is again subroutine of early_init_devtree().\n\nFor example booting with \"threadirqs\":\n\n  static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init()\n  WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120\n  ...\n  NIP static_key_enable_cpuslocked+0xfc/0x120\n  LR  static_key_enable_cpuslocked+0xf8/0x120\n  Call Trace:\n    static_key_enable_cpuslocked+0xf8/0x120 (unreliable)\n    static_key_enable+0x30/0x50\n    setup_forced_irqthreads+0x28/0x40\n    do_early_param+0xa0/0x108\n    parse_args+0x290/0x4e0\n    parse_early_options+0x48/0x5c\n    parse_early_param+0x58/0x84\n    early_init_devtree+0xd4/0x518\n    early_setup+0xb4/0x214\n\nSo call jump_label_init() just before parse_early_param() in\nearly_init_devtree().\n\n[mpe: Add call trace to change log and minor wording edits.]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8df84e1f-d8a2-4cd0-9e30-eccc3b1f5344",
      "id": "CVE-2022-50022",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers:md:fix a potential use-after-free bug\n\nIn line 2884, \"raid5_release_stripe(sh);\" drops the reference to sh and\nmay cause sh to be released. However, sh is subsequently used in lines\n2886 \"if (sh-\u003ebatch_head \u0026\u0026 sh != sh-\u003ebatch_head)\". This may result in an\nuse-after-free bug.\n\nIt can be fixed by moving \"raid5_release_stripe(sh);\" to the bottom of\nthe function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b0e7171-88ca-4b88-ab98-836a58d6c6d7",
      "id": "CVE-2022-48763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Forcibly leave nested virt when SMM state is toggled\n\nForcibly leave nested virtualization operation if userspace toggles SMM\nstate via KVM_SET_VCPU_EVENTS or KVM_SYNC_X86_EVENTS.  If userspace\nforces the vCPU out of SMM while it's post-VMXON and then injects an SMI,\nvmx_enter_smm() will overwrite vmx-\u003enested.smm.vmxon and end up with both\nvmxon=false and smm.vmxon=false, but all other nVMX state allocated.\n\nDon't attempt to gracefully handle the transition as (a) most transitions\nare nonsencial, e.g. forcing SMM while L2 is running, (b) there isn't\nsufficient information to handle all transitions, e.g. SVM wants access\nto the SMRAM save state, and (c) KVM_SET_VCPU_EVENTS must precede\nKVM_SET_NESTED_STATE during state restore as the latter disallows putting\nthe vCPU into L2 if SMM is active, and disallows tagging the vCPU as\nbeing post-VMXON in SMM if SMM is not active.\n\nAbuse of KVM_SET_VCPU_EVENTS manifests as a WARN and memory leak in nVMX\ndue to failure to free vmcs01's shadow VMCS, but the bug goes far beyond\njust a memory leak, e.g. toggling SMM on while L2 is active puts the vCPU\nin an architecturally impossible state.\n\n  WARNING: CPU: 0 PID: 3606 at free_loaded_vmcs arch/x86/kvm/vmx/vmx.c:2665 [inline]\n  WARNING: CPU: 0 PID: 3606 at free_loaded_vmcs+0x158/0x1a0 arch/x86/kvm/vmx/vmx.c:2656\n  Modules linked in:\n  CPU: 1 PID: 3606 Comm: syz-executor725 Not tainted 5.17.0-rc1-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:free_loaded_vmcs arch/x86/kvm/vmx/vmx.c:2665 [inline]\n  RIP: 0010:free_loaded_vmcs+0x158/0x1a0 arch/x86/kvm/vmx/vmx.c:2656\n  Code: \u003c0f\u003e 0b eb b3 e8 8f 4d 9f 00 e9 f7 fe ff ff 48 89 df e8 92 4d 9f 00\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_arch_vcpu_destroy+0x72/0x2f0 arch/x86/kvm/x86.c:11123\n   kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline]\n   kvm_destroy_vcpus+0x11f/0x290 arch/x86/kvm/../../../virt/kvm/kvm_main.c:460\n   kvm_free_vcpus arch/x86/kvm/x86.c:11564 [inline]\n   kvm_arch_destroy_vm+0x2e8/0x470 arch/x86/kvm/x86.c:11676\n   kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1217 [inline]\n   kvm_put_kvm+0x4fa/0xb00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1250\n   kvm_vm_release+0x3f/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1273\n   __fput+0x286/0x9f0 fs/file_table.c:311\n   task_work_run+0xdd/0x1a0 kernel/task_work.c:164\n   exit_task_work include/linux/task_work.h:32 [inline]\n   do_exit+0xb29/0x2a30 kernel/exit.c:806\n   do_group_exit+0xd2/0x2f0 kernel/exit.c:935\n   get_signal+0x4b0/0x28c0 kernel/signal.c:2862\n   arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868\n   handle_signal_work kernel/entry/common.c:148 [inline]\n   exit_to_user_mode_loop kernel/entry/common.c:172 [inline]\n   exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]\n   syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300\n   do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n   \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff10d8be-de6a-43a9-a1fe-c72e593ae6ac",
      "id": "CVE-2022-50084",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix address sanitizer warning in raid_status\n\nThere is this warning when using a kernel with the address sanitizer\nand running this testsuite:\nhttps://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid]\nRead of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319\nCPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.\u003csnip\u003e #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6a/0x9c\n print_address_description.constprop.0+0x1f/0x1e0\n print_report.cold+0x55/0x244\n kasan_report+0xc9/0x100\n raid_status+0x1747/0x2820 [dm_raid]\n dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod]\n table_load+0x35c/0x630 [dm_mod]\n ctl_ioctl+0x411/0x630 [dm_mod]\n dm_ctl_ioctl+0xa/0x10 [dm_mod]\n __x64_sys_ioctl+0x12a/0x1a0\n do_syscall_64+0x5b/0x80\n\nThe warning is caused by reading conf-\u003emax_nr_stripes in raid_status. The\ncode in raid_status reads mddev-\u003eprivate, casts it to struct r5conf and\nreads the entry max_nr_stripes.\n\nHowever, if we have different raid type than 4/5/6, mddev-\u003eprivate\ndoesn't point to struct r5conf; it may point to struct r0conf, struct\nr1conf, struct r10conf or struct mpconf. If we cast a pointer to one\nof these structs to struct r5conf, we will be reading invalid memory\nand KASAN warns about it.\n\nFix this bug by reading struct r5conf only if raid type is 4, 5 or 6.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "627d1353-4830-46ad-b3cc-43af496e3e40",
      "id": "CVE-2022-50250",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: fix use_count leakage when handling boot-on\n\nI found a use_count leakage towards supply regulator of rdev with\nboot-on option.\n\n┌───────────────────┐           ┌───────────────────┐\n│  regulator_dev A  │           │  regulator_dev B  │\n│     (boot-on)     │           │     (boot-on)     │\n│    use_count=0    │◀──supply──│    use_count=1    │\n│                   │           │                   │\n└───────────────────┘           └───────────────────┘\n\nIn case of rdev(A) configured with `regulator-boot-on', the use_count\nof supplying regulator(B) will increment inside\nregulator_enable(rdev-\u003esupply).\n\nThus, B will acts like always-on, and further balanced\nregulator_enable/disable cannot actually disable it anymore.\n\nHowever, B was also configured with `regulator-boot-on', we wish it\ncould be disabled afterwards.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ff31c65-78bd-4281-b79d-56d79306ed90",
      "id": "CVE-2022-50291",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: annotate data-races around kcm-\u003erx_psock\n\nkcm-\u003erx_psock can be read locklessly in kcm_rfree().\nAnnotate the read and writes accordingly.\n\nWe do the same for kcm-\u003erx_wait in the following patch.\n\nsyzbot reported:\nBUG: KCSAN: data-race in kcm_rfree / unreserve_rx_kcm\n\nwrite to 0xffff888123d827b8 of 8 bytes by task 2758 on cpu 1:\nunreserve_rx_kcm+0x72/0x1f0 net/kcm/kcmsock.c:313\nkcm_rcv_strparser+0x2b5/0x3a0 net/kcm/kcmsock.c:373\n__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301\nstrp_recv+0x6d/0x80 net/strparser/strparser.c:335\ntcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703\nstrp_read_sock net/strparser/strparser.c:358 [inline]\ndo_strp_work net/strparser/strparser.c:406 [inline]\nstrp_work+0xe8/0x180 net/strparser/strparser.c:415\nprocess_one_work+0x3d3/0x720 kernel/workqueue.c:2289\nworker_thread+0x618/0xa70 kernel/workqueue.c:2436\nkthread+0x1a9/0x1e0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nread to 0xffff888123d827b8 of 8 bytes by task 5859 on cpu 0:\nkcm_rfree+0x14c/0x220 net/kcm/kcmsock.c:181\nskb_release_head_state+0x8e/0x160 net/core/skbuff.c:841\nskb_release_all net/core/skbuff.c:852 [inline]\n__kfree_skb net/core/skbuff.c:868 [inline]\nkfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891\nkfree_skb include/linux/skbuff.h:1216 [inline]\nkcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161\n____sys_recvmsg+0x16c/0x2e0\n___sys_recvmsg net/socket.c:2743 [inline]\ndo_recvmmsg+0x2f1/0x710 net/socket.c:2837\n__sys_recvmmsg net/socket.c:2916 [inline]\n__do_sys_recvmmsg net/socket.c:2939 [inline]\n__se_sys_recvmmsg net/socket.c:2932 [inline]\n__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nvalue changed: 0xffff88812971ce00 -\u003e 0x0000000000000000\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 5859 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-12189-g19d17ab7c68b-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5499e494-47fa-4450-bff4-719d7633b7d1",
      "id": "CVE-2023-4207",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.\n\nWhen fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.\n\nWe recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49b3ede0-2571-4995-b2ec-c868effd5c07",
      "id": "CVE-2023-4273",
      "description": "A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17556cdb-6e32-4725-9031-00cb6cd219b0",
      "id": "CVE-2022-48842",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix race condition during interface enslave\n\nCommit 5dbbbd01cbba83 (\"ice: Avoid RTNL lock when re-creating\nauxiliary device\") changes a process of re-creation of aux device\nso ice_plug_aux_dev() is called from ice_service_task() context.\nThis unfortunately opens a race window that can result in dead-lock\nwhen interface has left LAG and immediately enters LAG again.\n\nReproducer:\n```\n#!/bin/sh\n\nip link add lag0 type bond mode 1 miimon 100\nip link set lag0\n\nfor n in {1..10}; do\n        echo Cycle: $n\n        ip link set ens7f0 master lag0\n        sleep 1\n        ip link set ens7f0 nomaster\ndone\n```\n\nThis results in:\n[20976.208697] Workqueue: ice ice_service_task [ice]\n[20976.213422] Call Trace:\n[20976.215871]  __schedule+0x2d1/0x830\n[20976.219364]  schedule+0x35/0xa0\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\n[20976.289790]  really_probe+0x1f2/0x480\n[20976.298509]  driver_probe_device+0x49/0xc0\n[20976.302609]  bus_for_each_drv+0x79/0xc0\n[20976.306448]  __device_attach+0xdc/0x160\n[20976.310286]  bus_probe_device+0x9d/0xb0\n[20976.314128]  device_add+0x43c/0x890\n[20976.321287]  __auxiliary_device_add+0x43/0x60\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\n[20976.342591]  process_one_work+0x1a7/0x360\n[20976.350536]  worker_thread+0x30/0x390\n[20976.358128]  kthread+0x10a/0x120\n[20976.365547]  ret_from_fork+0x1f/0x40\n...\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\n[20976.446469] Call Trace:\n[20976.448921]  __schedule+0x2d1/0x830\n[20976.452414]  schedule+0x35/0xa0\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\n[20976.464364]  device_del+0x36/0x3c0\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\n[20976.477288]  notifier_call_chain+0x47/0x70\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\n[20976.494475]  do_setlink+0x336/0xf50\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\n[20976.543441]  rtnl_newlink+0x43/0x60\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\n[20976.563079]  netlink_unicast+0x196/0x230\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\n[20976.570930]  sock_sendmsg+0x4c/0x50\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\n[20976.606353]  __sys_sendmsg+0x57/0xa0\n[20976.609930]  do_syscall_64+0x5b/0x1a0\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n1. Command 'ip link ... set nomaster' causes that ice_plug_aux_dev()\n   is called from ice_service_task() context, aux device is created\n   and associated device-\u003elock is taken.\n2. Command 'ip link ... set master...' calls ice's notifier under\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\n   function tries to take aux device-\u003elock but this is already taken\n   by ice_plug_aux_dev() in step 1\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\n   taken in step 2\n4. Dead-lock\n\nThe patch fixes this issue by following changes:\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\n  call in ice_service_task()\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\n  then ice_unplug_aux_dev() is called. If it is set (in other words\n  plugging of aux device was requested and ice_plug_aux_dev() is\n  potentially running) then the function only clears the\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5645d6ac-b6cd-4e2a-9472-9c244e55ef47",
      "id": "CVE-2023-4623",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.\n\nIf a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.\n\nWe recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19f2a694-8a88-4b49-b6dc-717f3abf37f5",
      "id": "CVE-2023-5178",
      "description": "A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a951e4b8-492b-4206-b917-86aaaa7f51e1",
      "id": "CVE-2023-52475",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: powermate - fix use-after-free in powermate_config_complete\n\nsyzbot has found a use-after-free bug [1] in the powermate driver. This\nhappens when the device is disconnected, which leads to a memory free from\nthe powermate_device struct.  When an asynchronous control message\ncompletes after the kfree and its callback is invoked, the lock does not\nexist anymore and hence the bug.\n\nUse usb_kill_urb() on pm-\u003econfig to cancel any in-progress requests upon\ndevice disconnection.\n\n[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "212003b2-cf31-4c95-9cb1-06a870d48a64",
      "id": "CVE-2023-52527",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()\n\nIncluding the transhdrlen in length is a problem when the packet is\npartially filled (e.g. something like send(MSG_MORE) happened previously)\nwhen appending to an IPv4 or IPv6 packet as we don't want to repeat the\ntransport header or account for it twice.  This can happen under some\ncircumstances, such as splicing into an L2TP socket.\n\nThe symptom observed is a warning in __ip6_append_data():\n\n    WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800\n\nthat occurs when MSG_SPLICE_PAGES is used to append more data to an already\npartially occupied skbuff.  The warning occurs when 'copy' is larger than\nthe amount of data in the message iterator.  This is because the requested\nlength includes the transport header length when it shouldn't.  This can be\ntriggered by, for example:\n\n        sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP);\n        bind(sfd, ...); // ::1\n        connect(sfd, ...); // ::1 port 7\n        send(sfd, buffer, 4100, MSG_MORE);\n        sendfile(sfd, dfd, NULL, 1024);\n\nFix this by only adding transhdrlen into the length if the write queue is\nempty in l2tp_ip6_sendmsg(), analogously to how UDP does things.\n\nl2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds\nthe UDP packet itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09d49bea-6aa7-4f04-bc22-b2323d0be654",
      "id": "CVE-2023-52587",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/ipoib: Fix mcast list locking\n\nReleasing the `priv-\u003elock` while iterating the `priv-\u003emulticast_list` in\n`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to\nremove the items while in the middle of iteration. If the mcast is removed\nwhile the lock was dropped, the for loop spins forever resulting in a hard\nlockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):\n\n    Task A (kworker/u72:2 below)       | Task B (kworker/u72:0 below)\n    -----------------------------------+-----------------------------------\n    ipoib_mcast_join_task(work)        | ipoib_ib_dev_flush_light(work)\n      spin_lock_irq(\u0026priv-\u003elock)       | __ipoib_ib_dev_flush(priv, ...)\n      list_for_each_entry(mcast,       | ipoib_mcast_dev_flush(dev = priv-\u003edev)\n          \u0026priv-\u003emulticast_list, list) |\n        ipoib_mcast_join(dev, mcast)   |\n          spin_unlock_irq(\u0026priv-\u003elock) |\n                                       |   spin_lock_irqsave(\u0026priv-\u003elock, flags)\n                                       |   list_for_each_entry_safe(mcast, tmcast,\n                                       |                  \u0026priv-\u003emulticast_list, list)\n                                       |     list_del(\u0026mcast-\u003elist);\n                                       |     list_add_tail(\u0026mcast-\u003elist, \u0026remove_list)\n                                       |   spin_unlock_irqrestore(\u0026priv-\u003elock, flags)\n          spin_lock_irq(\u0026priv-\u003elock)   |\n                                       |   ipoib_mcast_remove_list(\u0026remove_list)\n   (Here, `mcast` is no longer on the  |     list_for_each_entry_safe(mcast, tmcast,\n    `priv-\u003emulticast_list` and we keep |                            remove_list, list)\n    spinning on the `remove_list` of   |  \u003e\u003e\u003e  wait_for_completion(\u0026mcast-\u003edone)\n    the other thread which is blocked  |\n    and the list is still valid on     |\n    it's stack.)\n\nFix this by keeping the lock held and changing to GFP_ATOMIC to prevent\neventual sleeps.\nUnfortunately we could not reproduce the lockup and confirm this fix but\nbased on the code review I think this fix should address such lockups.\n\ncrash\u003e bc 31\nPID: 747      TASK: ff1c6a1a007e8000  CPU: 31   COMMAND: \"kworker/u72:2\"\n--\n    [exception RIP: ipoib_mcast_join_task+0x1b1]\n    RIP: ffffffffc0944ac1  RSP: ff646f199a8c7e00  RFLAGS: 00000002\n    RAX: 0000000000000000  RBX: ff1c6a1a04dc82f8  RCX: 0000000000000000\n                                  work (\u0026priv-\u003emcast_task{,.work})\n    RDX: ff1c6a192d60ac68  RSI: 0000000000000286  RDI: ff1c6a1a04dc8000\n           \u0026mcast-\u003elist\n    RBP: ff646f199a8c7e90   R8: ff1c699980019420   R9: ff1c6a1920c9a000\n    R10: ff646f199a8c7e00  R11: ff1c6a191a7d9800  R12: ff1c6a192d60ac00\n                                                         mcast\n    R13: ff1c6a1d82200000  R14: ff1c6a1a04dc8000  R15: ff1c6a1a04dc82d8\n           dev                    priv (\u0026priv-\u003elock)     \u0026priv-\u003emulticast_list (aka head)\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n--- \u003cNMI exception stack\u003e ---\n #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib]\n #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967\n\ncrash\u003e rx ff646f199a8c7e68\nff646f199a8c7e68:  ff1c6a1a04dc82f8 \u003c\u003c\u003c work = \u0026priv-\u003emcast_task.work\n\ncrash\u003e list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000\n(empty)\n\ncrash\u003e ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000\n  mcast_task.work.func = 0xffffffffc0944910 \u003cipoib_mcast_join_task\u003e,\n  mcast_mutex.owner.counter = 0xff1c69998efec000\n\ncrash\u003e b 8\nPID: 8        TASK: ff1c69998efec000  CPU: 33   COMMAND: \"kworker/u72:0\"\n--\n #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646\n #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib]\n #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib]\n #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib]\n #7 [ff\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "080aa3c2-a579-49a2-9864-4fc952e796fb",
      "id": "CVE-2023-52635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\n\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\n\nwhile true\ndo\n        echo \"simple_ondemand\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\n        echo \"performance\" \u003e /sys/class/devfreq/1d84000.ufshc/governor\ndone\n\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\n\nLet's use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\n\n[1]\n...\n..\n\u003cidle\u003e-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n\u003cidle\u003e-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n\u003cidle\u003e-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\n\n[2]\n\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\n\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37bc01e4-4f4c-45a8-b05f-c9dca7e424c4",
      "id": "CVE-2023-52641",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()\n\nIt is preferable to exit through the out: label because\ninternal debugging functions are located there.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1ac8812-4181-4c03-91b7-2441fba01325",
      "id": "CVE-2023-52703",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/usb: kalmia: Don't pass act_len in usb_bulk_msg error path\n\nsyzbot reported that act_len in kalmia_send_init_packet() is\nuninitialized when passing it to the first usb_bulk_msg error path. Jiri\nPirko noted that it's pointless to pass it in the error path, and that\nthe value that would be printed in the second error path would be the\nvalue of act_len from the first call to usb_bulk_msg.[1]\n\nWith this in mind, let's just not pass act_len to the usb_bulk_msg error\npaths.\n\n1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c470952-e99b-4c3e-9803-09da0f60c007",
      "id": "CVE-2023-52762",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: fix implicit overflow on virtio_max_dma_size\n\nThe following codes have an implicit conversion from size_t to u32:\n(u32)max_size = (size_t)virtio_max_dma_size(vdev);\n\nThis may lead overflow, Ex (size_t)4G -\u003e (u32)0. Once\nvirtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX\ninstead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d21cac8-4859-4baa-ac0a-c2356c9e7d57",
      "id": "CVE-2023-52855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: fix possible NULL pointer dereference caused by driver concurrency\n\nIn _dwc2_hcd_urb_enqueue(), \"urb-\u003ehcpriv = NULL\" is executed without\nholding the lock \"hsotg-\u003elock\". In _dwc2_hcd_urb_dequeue():\n\n    spin_lock_irqsave(\u0026hsotg-\u003elock, flags);\n    ...\n\tif (!urb-\u003ehcpriv) {\n\t\tdev_dbg(hsotg-\u003edev, \"## urb-\u003ehcpriv is NULL ##\\n\");\n\t\tgoto out;\n\t}\n    rc = dwc2_hcd_urb_dequeue(hsotg, urb-\u003ehcpriv); // Use urb-\u003ehcpriv\n    ...\nout:\n    spin_unlock_irqrestore(\u0026hsotg-\u003elock, flags);\n\nWhen _dwc2_hcd_urb_enqueue() and _dwc2_hcd_urb_dequeue() are\nconcurrently executed, the NULL check of \"urb-\u003ehcpriv\" can be executed\nbefore \"urb-\u003ehcpriv = NULL\". After urb-\u003ehcpriv is NULL, it can be used\nin the function call to dwc2_hcd_urb_dequeue(), which can cause a NULL\npointer dereference.\n\nThis possible bug is found by an experimental static analysis tool\ndeveloped by myself. This tool analyzes the locking APIs to extract\nfunction pairs that can be concurrently executed, and then analyzes the\ninstructions in the paired functions to identify possible concurrency\nbugs including data races and atomicity violations. The above possible\nbug is reported, when my tool analyzes the source code of Linux 6.5.\n\nTo fix this possible bug, \"urb-\u003ehcpriv = NULL\" should be executed with\nholding the lock \"hsotg-\u003elock\". After using this patch, my tool never\nreports the possible bug, with the kernelconfiguration allyesconfig for\nx86_64. Because I have no associated hardware, I cannot test the patch\nin runtime testing, and just verify it according to the code logic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e1b2103-551b-4ca7-988b-8a9f0e17f7a0",
      "id": "CVE-2023-52893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngsmi: fix null-deref in gsmi_get_variable\n\nWe can get EFI variables without fetching the attribute, so we must\nallow for that in gsmi.\n\ncommit 859748255b43 (\"efi: pstore: Omit efivars caching EFI varstore\naccess layer\") added a new get_variable call with attr=NULL, which\ntriggers panic in gsmi.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95131c92-2269-4f4a-9d90-c9284350d2a8",
      "id": "CVE-2023-53020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: close all race conditions in l2tp_tunnel_register()\n\nThe code in l2tp_tunnel_register() is racy in several ways:\n\n1. It modifies the tunnel socket _after_ publishing it.\n\n2. It calls setup_udp_tunnel_sock() on an existing socket without\n   locking.\n\n3. It changes sock lock class on fly, which triggers many syzbot\n   reports.\n\nThis patch amends all of them by moving socket initialization code\nbefore publishing and under sock lock. As suggested by Jakub, the\nl2tp lockdep class is not necessary as we can just switch to\nbh_lock_sock_nested().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae9ff2e1-0880-4987-80cd-e3a3e47115a5",
      "id": "CVE-2023-53196",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: qcom: Fix potential memory leak\n\nFunction dwc3_qcom_probe() allocates memory for resource structure\nwhich is pointed by parent_res pointer. This memory is not\nfreed. This leads to memory leak. Use stack memory to prevent\nmemory leak.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7727fcfc-73bb-4884-8afa-13b43ec7a0f3",
      "id": "CVE-2024-26673",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations\n\n- Disallow families other than NFPROTO_{IPV4,IPV6,INET}.\n- Disallow layer 4 protocol with no ports, since destination port is a\n  mandatory attribute for this object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b988363a-54f2-4a71-8f38-9d6932cade03",
      "id": "CVE-2024-43902",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null checker before passing variables\n\nChecks null pointer before passing variables to functions.\n\nThis fixes 3 NULL_RETURNS issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2036f710-6403-4803-be71-b6c2160d8c0b",
      "id": "CVE-2024-26749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()\n\n  ...\n  cdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, \u0026priv_req-\u003erequest);\n  list_del_init(\u0026priv_req-\u003elist);\n  ...\n\n'priv_req' actually free at cdns3_gadget_ep_free_request(). But\nlist_del_init() use priv_req-\u003elist after it.\n\n[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4\n[ 1542.642868][  T534]\n[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):\n[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4\n[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]\n[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4\n[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8\n[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368\n[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28\n\nMove list_del_init() before cdns3_gadget_ep_free_request() to resolve this\nproblem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d53ab41e-a9c0-4362-923e-4cd44cd2e5e9",
      "id": "CVE-2024-26775",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: avoid potential deadlock at set_capacity\n\nMove set_capacity() outside of the section procected by (\u0026d-\u003elock).\nTo avoid possible interrupt unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n[1] lock(\u0026bdev-\u003ebd_size_lock);\n                                local_irq_disable();\n                            [2] lock(\u0026d-\u003elock);\n                            [3] lock(\u0026bdev-\u003ebd_size_lock);\n   \u003cInterrupt\u003e\n[4]  lock(\u0026d-\u003elock);\n\n  *** DEADLOCK ***\n\nWhere [1](\u0026bdev-\u003ebd_size_lock) hold by zram_add()-\u003eset_capacity().\n[2]lock(\u0026d-\u003elock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc()\nis trying to acquire [3](\u0026bdev-\u003ebd_size_lock) at set_capacity() call.\nIn this situation an attempt to acquire [4]lock(\u0026d-\u003elock) from\naoecmd_cfg_rsp() will lead to deadlock.\n\nSo the simplest solution is breaking lock dependency\n[2](\u0026d-\u003elock) -\u003e [3](\u0026bdev-\u003ebd_size_lock) by moving set_capacity()\noutside.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76036765-09e3-4cc1-877e-f549c5795244",
      "id": "CVE-2024-26845",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Add TMF to tmr_list handling\n\nAn abort that is responded to by iSCSI itself is added to tmr_list but does\nnot go to target core. A LUN_RESET that goes through tmr_list takes a\nrefcounter on the abort and waits for completion. However, the abort will\nbe never complete because it was not started in target core.\n\n Unable to locate ITT: 0x05000000 on CID: 0\n Unable to locate RefTaskTag: 0x05000000 on CID: 0.\n wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop\n wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop\n...\n INFO: task kworker/0:2:49 blocked for more than 491 seconds.\n task:kworker/0:2     state:D stack:    0 pid:   49 ppid:     2 flags:0x00000800\n Workqueue: events target_tmr_work [target_core_mod]\nCall Trace:\n __switch_to+0x2c4/0x470\n _schedule+0x314/0x1730\n schedule+0x64/0x130\n schedule_timeout+0x168/0x430\n wait_for_completion+0x140/0x270\n target_put_cmd_and_wait+0x64/0xb0 [target_core_mod]\n core_tmr_lun_reset+0x30/0xa0 [target_core_mod]\n target_tmr_work+0xc8/0x1b0 [target_core_mod]\n process_one_work+0x2d4/0x5d0\n worker_thread+0x78/0x6c0\n\nTo fix this, only add abort to tmr_list if it will be handled by target\ncore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c92abab6-72ae-4263-bffb-a6645f3075f2",
      "id": "CVE-2024-26894",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()\n\nAfter unregistering the CPU idle device, the memory associated with\nit is not freed, leading to a memory leak:\n\nunreferenced object 0xffff896282f6c000 (size 1024):\n  comm \"swapper/0\", pid 1, jiffies 4294893170\n  hex dump (first 32 bytes):\n    00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 8836a742):\n    [\u003cffffffff993495ed\u003e] kmalloc_trace+0x29d/0x340\n    [\u003cffffffff9972f3b3\u003e] acpi_processor_power_init+0xf3/0x1c0\n    [\u003cffffffff9972d263\u003e] __acpi_processor_start+0xd3/0xf0\n    [\u003cffffffff9972d2bc\u003e] acpi_processor_start+0x2c/0x50\n    [\u003cffffffff99805872\u003e] really_probe+0xe2/0x480\n    [\u003cffffffff99805c98\u003e] __driver_probe_device+0x78/0x160\n    [\u003cffffffff99805daf\u003e] driver_probe_device+0x1f/0x90\n    [\u003cffffffff9980601e\u003e] __driver_attach+0xce/0x1c0\n    [\u003cffffffff99803170\u003e] bus_for_each_dev+0x70/0xc0\n    [\u003cffffffff99804822\u003e] bus_add_driver+0x112/0x210\n    [\u003cffffffff99807245\u003e] driver_register+0x55/0x100\n    [\u003cffffffff9aee4acb\u003e] acpi_processor_driver_init+0x3b/0xc0\n    [\u003cffffffff990012d1\u003e] do_one_initcall+0x41/0x300\n    [\u003cffffffff9ae7c4b0\u003e] kernel_init_freeable+0x320/0x470\n    [\u003cffffffff99b231f6\u003e] kernel_init+0x16/0x1b0\n    [\u003cffffffff99042e6d\u003e] ret_from_fork+0x2d/0x50\n\nFix this by freeing the CPU idle device after unregistering it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3a9e6bb5-4d2e-4806-97c2-b478ec690418",
      "id": "CVE-2024-26910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix performance regression in swap operation\n\nThe patch \"netfilter: ipset: fix race condition between swap/destroy\nand kernel side add/del/test\", commit 28628fa9 fixes a race condition.\nBut the synchronize_rcu() added to the swap function unnecessarily slows\nit down: it can safely be moved to destroy and use call_rcu() instead.\n\nEric Dumazet pointed out that simply calling the destroy functions as\nrcu callback does not work: sets with timeout use garbage collectors\nwhich need cancelling at destroy which can wait. Therefore the destroy\nfunctions are split into two: cancelling garbage collectors safely at\nexecuting the command received by netlink and moving the remaining\npart only into the rcu callback.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48762a13-fc4d-4081-8b07-cc4b7a438bee",
      "id": "CVE-2024-26915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reset IH OVERFLOW_CLEAR bit\n\nAllows us to detect subsequent IH ring buffer overflows as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46d4b6b6-9bd7-44ba-a177-19f7efa24cca",
      "id": "CVE-2024-26923",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix garbage collector racing against connect()\n\nGarbage collector does not take into account the risk of embryo getting\nenqueued during the garbage collection. If such embryo has a peer that\ncarries SCM_RIGHTS, two consecutive passes of scan_children() may see a\ndifferent set of children. Leading to an incorrectly elevated inflight\ncount, and then a dangling pointer within the gc_inflight_list.\n\nsockets are AF_UNIX/SOCK_STREAM\nS is an unconnected socket\nL is a listening in-flight socket bound to addr, not in fdtable\nV's fd will be passed via sendmsg(), gets inflight count bumped\n\nconnect(S, addr)\tsendmsg(S, [V]); close(V)\t__unix_gc()\n----------------\t-------------------------\t-----------\n\nNS = unix_create1()\nskb1 = sock_wmalloc(NS)\nL = unix_find_other(addr)\nunix_state_lock(L)\nunix_peer(S) = NS\n\t\t\t// V count=1 inflight=0\n\n \t\t\tNS = unix_peer(S)\n \t\t\tskb2 = sock_alloc()\n\t\t\tskb_queue_tail(NS, skb2[V])\n\n\t\t\t// V became in-flight\n\t\t\t// V count=2 inflight=1\n\n\t\t\tclose(V)\n\n\t\t\t// V count=1 inflight=1\n\t\t\t// GC candidate condition met\n\n\t\t\t\t\t\tfor u in gc_inflight_list:\n\t\t\t\t\t\t  if (total_refs == inflight_refs)\n\t\t\t\t\t\t    add u to gc_candidates\n\n\t\t\t\t\t\t// gc_candidates={L, V}\n\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  scan_children(u, dec_inflight)\n\n\t\t\t\t\t\t// embryo (skb1) was not\n\t\t\t\t\t\t// reachable from L yet, so V's\n\t\t\t\t\t\t// inflight remains unchanged\n__skb_queue_tail(L, skb1)\nunix_state_unlock(L)\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  if (u.inflight)\n\t\t\t\t\t\t    scan_children(u, inc_inflight_move_tail)\n\n\t\t\t\t\t\t// V count=1 inflight=2 (!)\n\nIf there is a GC-candidate listening socket, lock/unlock its state. This\nmakes GC wait until the end of any ongoing connect() to that socket. After\nflipping the lock, a possibly SCM-laden embryo is already enqueued. And if\nthere is another embryo coming, it can not possibly carry SCM_RIGHTS. At\nthis point, unix_inflight() can not happen because unix_gc_lock is already\ntaken. Inflight graph remains unaffected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e785cc8f-03fb-4b3e-98a3-8e14d615630c",
      "id": "CVE-2024-26978",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: max310x: fix NULL pointer dereference in I2C instantiation\n\nWhen trying to instantiate a max14830 device from userspace:\n\n    echo max14830 0x60 \u003e /sys/bus/i2c/devices/i2c-2/new_device\n\nwe get the following error:\n\n    Unable to handle kernel NULL pointer dereference at virtual address...\n    ...\n    Call trace:\n        max310x_i2c_probe+0x48/0x170 [max310x]\n        i2c_device_probe+0x150/0x2a0\n    ...\n\nAdd check for validity of devtype to prevent the error, and abort probe\nwith a meaningful error message.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2915f15-8ea8-47c9-a142-7ccac2b93034",
      "id": "CVE-2024-27037",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: zynq: Prevent null pointer dereference caused by kmalloc failure\n\nThe kmalloc() in zynq_clk_setup() will return null if the\nphysical memory has run out. As a result, if we use snprintf()\nto write data to the null address, the null pointer dereference\nbug will happen.\n\nThis patch uses a stack variable to replace the kmalloc().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5875ade1-8bf4-43ae-bb1b-f3f6138bfb24",
      "id": "CVE-2024-27076",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imx: csc/scaler: fix v4l2_ctrl_handler memory leak\n\nFree the memory allocated in v4l2_ctrl_handler_init on release.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc0350c9-27ba-4fb7-ac2d-3201f305f9b9",
      "id": "CVE-2024-27405",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs\n\nIt is observed sometimes when tethering is used over NCM with Windows 11\nas host, at some instances, the gadget_giveback has one byte appended at\nthe end of a proper NTB. When the NTB is parsed, unwrap call looks for\nany leftover bytes in SKB provided by u_ether and if there are any pending\nbytes, it treats them as a separate NTB and parses it. But in case the\nsecond NTB (as per unwrap call) is faulty/corrupt, all the datagrams that\nwere parsed properly in the first NTB and saved in rx_list are dropped.\n\nAdding a few custom traces showed the following:\n[002] d..1  7828.532866: dwc3_gadget_giveback: ep1out:\nreq 000000003868811a length 1025/16384 zsI ==\u003e 0\n[002] d..1  7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025\n[002] d..1  7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342\n[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67\n[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400\n[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10\n[002] d..1  7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames\n\nIn this case, the giveback is of 1025 bytes and block length is 1024.\nThe rest 1 byte (which is 0x00) won't be parsed resulting in drop of\nall datagrams in rx_list.\n\nSame is case with packets of size 2048:\n[002] d..1  7828.557948: dwc3_gadget_giveback: ep1out:\nreq 0000000011dfd96e length 2049/16384 zsI ==\u003e 0\n[002] d..1  7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342\n[002] d..1  7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800\n\nLecroy shows one byte coming in extra confirming that the byte is coming\nin from PC:\n\n Transfer 2959 - Bytes Transferred(1025)  Timestamp((18.524 843 590)\n - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)\n --- Packet 4063861\n       Data(1024 bytes)\n       Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)\n --- Packet 4063863\n       Data(1 byte)\n       Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)\n\nAccording to Windows driver, no ZLP is needed if wBlockLength is non-zero,\nbecause the non-zero wBlockLength has already told the function side the\nsize of transfer to be expected. However, there are in-market NCM devices\nthat rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.\nTo deal with such devices, it pads an extra 0 at end so the transfer is no\nlonger multiple of wMaxPacketSize.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95d5a206-5d07-46ec-8985-1c7f83b28e77",
      "id": "CVE-2024-35811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n-\u003ebrcmf_usb_probe\n  -\u003ebrcmf_usb_probe_cb\n    -\u003ebrcmf_attach\n      -\u003ebrcmf_bus_started\n        -\u003ebrcmf_cfg80211_attach\n          -\u003ewl_init_priv\n            -\u003ebrcmf_init_escan\n              -\u003eINIT_WORK(\u0026cfg-\u003eescan_timeout_work,\n\t\t  brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n  -\u003ebrcmf_usb_disconnect_cb\n    -\u003ebrcmf_detach\n      -\u003ebrcmf_cfg80211_detach\n        -\u003ekfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93a68477-05a5-4b63-b742-8eb49da7424f",
      "id": "CVE-2024-38588",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix possible use-after-free issue in ftrace_location()\n\nKASAN reports a bug:\n\n  BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\n  Read of size 8 at addr ffff888141d40010 by task insmod/424\n  CPU: 8 PID: 424 Comm: insmod Tainted: G        W          6.9.0-rc2+\n  [...]\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcf/0x610\n   kasan_report+0xb5/0xe0\n   ftrace_location+0x90/0x120\n   register_kprobe+0x14b/0xa40\n   kprobe_init+0x2d/0xff0 [kprobe_example]\n   do_one_initcall+0x8f/0x2d0\n   do_init_module+0x13a/0x3c0\n   load_module+0x3082/0x33d0\n   init_module_from_file+0xd2/0x130\n   __x64_sys_finit_module+0x306/0x440\n   do_syscall_64+0x68/0x140\n   entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause is that, in lookup_rec(), ftrace record of some address\nis being searched in ftrace pages of some module, but those ftrace pages\nat the same time is being freed in ftrace_release_mod() as the\ncorresponding module is being deleted:\n\n           CPU1                       |      CPU2\n  register_kprobes() {                | delete_module() {\n    check_kprobe_address_safe() {     |\n      arch_check_ftrace_location() {  |\n        ftrace_location() {           |\n          lookup_rec() // USE!        |   ftrace_release_mod() // Free!\n\nTo fix this issue:\n  1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\n  2. Use ftrace_location_range() instead of lookup_rec() in\n     ftrace_location();\n  3. Call synchronize_rcu() before freeing any ftrace pages both in\n     ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "207c8357-7e69-4639-b503-cf1337dea892",
      "id": "CVE-2024-39502",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: fix use after netif_napi_del()\n\nWhen queues are started, netif_napi_add() and napi_enable() are called.\nIf there are 4 queues and only 3 queues are used for the current\nconfiguration, only 3 queues' napi should be registered and enabled.\nThe ionic_qcq_enable() checks whether the .poll pointer is not NULL for\nenabling only the using queue' napi. Unused queues' napi will not be\nregistered by netif_napi_add(), so the .poll pointer indicates NULL.\nBut it couldn't distinguish whether the napi was unregistered or not\nbecause netif_napi_del() doesn't reset the .poll pointer to NULL.\nSo, ionic_qcq_enable() calls napi_enable() for the queue, which was\nunregistered by netif_napi_del().\n\nReproducer:\n   ethtool -L \u003cinterface name\u003e rx 1 tx 1 combined 0\n   ethtool -L \u003cinterface name\u003e rx 0 tx 0 combined 1\n   ethtool -L \u003cinterface name\u003e rx 0 tx 0 combined 4\n\nSplat looks like:\nkernel BUG at net/core/dev.c:6666!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16\nWorkqueue: events ionic_lif_deferred_work [ionic]\nRIP: 0010:napi_enable+0x3b/0x40\nCode: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f\nRSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029\nRDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28\nRBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000\nR13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20\nFS:  0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8f734ee200 CR3: 0000000103e50000 CR4: 00000000007506f0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? die+0x33/0x90\n ? do_trap+0xd9/0x100\n ? napi_enable+0x3b/0x40\n ? do_error_trap+0x83/0xb0\n ? napi_enable+0x3b/0x40\n ? napi_enable+0x3b/0x40\n ? exc_invalid_op+0x4e/0x70\n ? napi_enable+0x3b/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? napi_enable+0x3b/0x40\n ionic_qcq_enable+0xb7/0x180 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n ionic_start_queues+0xc4/0x290 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n ionic_link_status_check+0x11c/0x170 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n ionic_lif_deferred_work+0x129/0x280 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8]\n process_one_work+0x145/0x360\n worker_thread+0x2bb/0x3d0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xcc/0x100\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6edec0c9-02cb-4aec-a6ca-0bc598cb9efe",
      "id": "CVE-2024-39506",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nliquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet\n\nIn lio_vf_rep_copy_packet() pg_info-\u003epage is compared to a NULL value,\nbut then it is unconditionally passed to skb_add_rx_frag() which looks\nstrange and could lead to null pointer dereference.\n\nlio_vf_rep_copy_packet() call trace looks like:\n\tocteon_droq_process_packets\n\t octeon_droq_fast_process_packets\n\t  octeon_droq_dispatch_pkt\n\t   octeon_create_recv_info\n\t    ...search in the dispatch_list...\n\t     -\u003edisp_fn(rdisp-\u003erinfo, ...)\n\t      lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...)\nIn this path there is no code which sets pg_info-\u003epage to NULL.\nSo this check looks unneeded and doesn't solve potential problem.\nBut I guess the author had reason to add a check and I have no such card\nand can't do real test.\nIn addition, the code in the function liquidio_push_packet() in\nliquidio/lio_core.c does exactly the same.\n\nBased on this, I consider the most acceptable compromise solution to\nadjust this issue by moving skb_add_rx_frag() into conditional scope.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ad95eac-ac6e-435f-9cd1-ee92087babf1",
      "id": "CVE-2024-42086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: chemical: bme680: Fix overflows in compensate() functions\n\nThere are cases in the compensate functions of the driver that\nthere could be overflows of variables due to bit shifting ops.\nThese implications were initially discussed here [1] and they\nwere mentioned in log message of Commit 1b3bd8592780 (\"iio:\nchemical: Add support for Bosch BME680 sensor\").\n\n[1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe98f4c6-61a7-4fbe-a606-ab3ba0f29c2b",
      "id": "CVE-2024-44931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: prevent potential speculation leaks in gpio_device_get_desc()\n\nUserspace may trigger a speculative read of an address outside the gpio\ndescriptor array.\nUsers can do that by calling gpio_ioctl() with an offset out of range.\nOffset is copied from user and then used as an array index to get\nthe gpio descriptor without sanitization in gpio_device_get_desc().\n\nThis change ensures that the offset is sanitized by using\narray_index_nospec() to mitigate any possibility of speculative\ninformation leaks.\n\nThis bug was discovered and resolved using Coverity Static Analysis\nSecurity Testing (SAST) by Synopsys, Inc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "848736c4-504d-4bbb-ba95-84a8b785d1b0",
      "id": "CVE-2024-45006",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Fix Panther point NULL pointer deref at full-speed re-enumeration\n\nre-enumerating full-speed devices after a failed address device command\ncan trigger a NULL pointer dereference.\n\nFull-speed devices may need to reconfigure the endpoint 0 Max Packet Size\nvalue during enumeration. Usb core calls usb_ep0_reinit() in this case,\nwhich ends up calling xhci_configure_endpoint().\n\nOn Panther point xHC the xhci_configure_endpoint() function will\nadditionally check and reserve bandwidth in software. Other hosts do\nthis in hardware\n\nIf xHC address device command fails then a new xhci_virt_device structure\nis allocated as part of re-enabling the slot, but the bandwidth table\npointers are not set up properly here.\nThis triggers the NULL pointer dereference the next time usb_ep0_reinit()\nis called and xhci_configure_endpoint() tries to check and reserve\nbandwidth\n\n[46710.713538] usb 3-1: new full-speed USB device number 5 using xhci_hcd\n[46710.713699] usb 3-1: Device not responding to setup address.\n[46710.917684] usb 3-1: Device not responding to setup address.\n[46711.125536] usb 3-1: device not accepting address 5, error -71\n[46711.125594] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[46711.125600] #PF: supervisor read access in kernel mode\n[46711.125603] #PF: error_code(0x0000) - not-present page\n[46711.125606] PGD 0 P4D 0\n[46711.125610] Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n[46711.125615] CPU: 1 PID: 25760 Comm: kworker/1:2 Not tainted 6.10.3_2 #1\n[46711.125620] Hardware name: Gigabyte Technology Co., Ltd.\n[46711.125623] Workqueue: usb_hub_wq hub_event [usbcore]\n[46711.125668] RIP: 0010:xhci_reserve_bandwidth (drivers/usb/host/xhci.c\n\nFix this by making sure bandwidth table pointers are set up correctly\nafter a failed address device command, and additionally by avoiding\nchecking for bandwidth in cases like this where no actual endpoints are\nadded or removed, i.e. only context for default control endpoint 0 is\nevaluated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a61c5dda-58a3-4ffb-ad25-96ff7af495cb",
      "id": "CVE-2024-46725",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix out-of-bounds write warning\n\nCheck the ring type value to fix the out-of-bounds\nwrite warning",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3b716dd-26db-4fba-9473-59c45a11bbbe",
      "id": "CVE-2024-46787",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: fix checks for huge PMDs\n\nPatch series \"userfaultfd: fix races around pmd_trans_huge() check\", v2.\n\nThe pmd_trans_huge() code in mfill_atomic() is wrong in three different\nways depending on kernel version:\n\n1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit\n   the right two race windows) - I've tested this in a kernel build with\n   some extra mdelay() calls. See the commit message for a description\n   of the race scenario.\n   On older kernels (before 6.5), I think the same bug can even\n   theoretically lead to accessing transhuge page contents as a page table\n   if you hit the right 5 narrow race windows (I haven't tested this case).\n2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for\n   detecting PMDs that don't point to page tables.\n   On older kernels (before 6.5), you'd just have to win a single fairly\n   wide race to hit this.\n   I've tested this on 6.1 stable by racing migration (with a mdelay()\n   patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86\n   VM, that causes a kernel oops in ptlock_ptr().\n3. On newer kernels (\u003e=6.5), for shmem mappings, khugepaged is allowed\n   to yank page tables out from under us (though I haven't tested that),\n   so I think the BUG_ON() checks in mfill_atomic() are just wrong.\n\nI decided to write two separate fixes for these (one fix for bugs 1+2, one\nfix for bug 3), so that the first fix can be backported to kernels\naffected by bugs 1+2.\n\n\nThis patch (of 2):\n\nThis fixes two issues.\n\nI discovered that the following race can occur:\n\n  mfill_atomic                other thread\n  ============                ============\n                              \u003czap PMD\u003e\n  pmdp_get_lockless() [reads none pmd]\n  \u003cbail if trans_huge\u003e\n  \u003cif none:\u003e\n                              \u003cpagefault creates transhuge zeropage\u003e\n    __pte_alloc [no-op]\n                              \u003czap PMD\u003e\n  \u003cbail if pmd_trans_huge(*dst_pmd)\u003e\n  BUG_ON(pmd_none(*dst_pmd))\n\nI have experimentally verified this in a kernel with extra mdelay() calls;\nthe BUG_ON(pmd_none(*dst_pmd)) triggers.\n\nOn kernels newer than commit 0d940a9b270b (\"mm/pgtable: allow\npte_offset_map[_lock]() to fail\"), this can't lead to anything worse than\na BUG_ON(), since the page table access helpers are actually designed to\ndeal with page tables concurrently disappearing; but on older kernels\n(\u003c=6.4), I think we could probably theoretically race past the two\nBUG_ON() checks and end up treating a hugepage as a page table.\n\nThe second issue is that, as Qi Zheng pointed out, there are other types\nof huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs\n(in particular, migration PMDs).\n\nOn \u003c=6.4, this is worse than the first issue: If mfill_atomic() runs on a\nPMD that contains a migration entry (which just requires winning a single,\nfairly wide race), it will pass the PMD to pte_offset_map_lock(), which\nassumes that the PMD points to a page table.\n\nBreakage follows: First, the kernel tries to take the PTE lock (which will\ncrash or maybe worse if there is no \"struct page\" for the address bits in\nthe migration entry PMD - I think at least on X86 there usually is no\ncorresponding \"struct page\" thanks to the PTE inversion mitigation, amd64\nlooks different).\n\nIf that didn't crash, the kernel would next try to write a PTE into what\nit wrongly thinks is a page table.\n\nAs part of fixing these issues, get rid of the check for pmd_trans_huge()\nbefore __pte_alloc() - that's redundant, we're going to have to check for\nthat after the __pte_alloc() anyway.\n\nBackport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1454bf8e-af66-4e8b-88b8-fe1c2b8de52a",
      "id": "CVE-2024-46854",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dpaa: Pad packets to ETH_ZLEN\n\nWhen sending packets under 60 bytes, up to three bytes of the buffer\nfollowing the data may be leaked. Avoid this by extending all packets to\nETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be\nreproduced by running\n\n\t$ ping -s 11 destination",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "478dbace-0f0c-451a-8dbb-785c4c53c681",
      "id": "CVE-2024-47684",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: check skb is non-NULL in tcp_rto_delta_us()\n\nWe have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic\nkernel that are running ceph and recently hit a null ptr dereference in\ntcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also\nsaw it getting hit from the RACK case as well. Here are examples of the oops\nmessages we saw in each of those cases:\n\nJul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020\nJul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode\nJul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page\nJul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0\nJul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI\nJul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu\nJul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023\nJul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160\nJul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 \u003c48\u003e 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3\nJul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246\nJul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000\nJul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60\nJul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8\nJul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900\nJul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30\nJul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000\nJul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nJul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0\nJul 26 15:05:02 rx [11061395.913822] PKRU: 55555554\nJul 26 15:05:02 rx [11061395.916786] Call Trace:\nJul 26 15:05:02 rx [11061395.919488]\nJul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f\nJul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9\nJul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380\nJul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0\nJul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50\nJul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0\nJul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20\nJul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450\nJul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140\nJul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90\nJul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0\nJul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40\nJul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160\nJul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160\nJul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220\nJul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240\nJul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0\nJul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240\nJul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130\nJul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280\nJul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10\nJul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30\nJul 26 15:05:02 rx [11061396.017718] ? lapic_next_even\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "088510b6-584f-4240-b1aa-e630c3267d17",
      "id": "CVE-2024-47735",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled\n\nFix missuse of spin_lock_irq()/spin_unlock_irq() when\nspin_lock_irqsave()/spin_lock_irqrestore() was hold.\n\nThis was discovered through the lock debugging, and the corresponding\nlog is as follows:\n\nraw_local_irq_restore() called with IRQs enabled\nWARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40\n...\nCall trace:\n warn_bogus_irq_restore+0x30/0x40\n _raw_spin_unlock_irqrestore+0x84/0xc8\n add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2]\n hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2]\n hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2]\n create_qp+0x138/0x258\n ib_create_qp_kernel+0x50/0xe8\n create_mad_qp+0xa8/0x128\n ib_mad_port_open+0x218/0x448\n ib_mad_init_device+0x70/0x1f8\n add_client_context+0xfc/0x220\n enable_device_and_get+0xd0/0x140\n ib_register_device.part.0+0xf4/0x1c8\n ib_register_device+0x34/0x50\n hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2]\n hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2]\n __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2]\n hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e62cb2ea-72b2-40b4-aa7e-a24aa76e11fc",
      "id": "CVE-2024-49937",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Set correct chandef when starting CAC\n\nWhen starting CAC in a mode other than AP mode, it return a\n\"WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\"\ncaused by the chandef.chan being null at the end of CAC.\n\nSolution: Ensure the channel definition is set for the different modes\nwhen starting CAC to avoid getting a NULL 'chan' at the end of CAC.\n\n Call Trace:\n  ? show_regs.part.0+0x14/0x16\n  ? __warn+0x67/0xc0\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? report_bug+0xa7/0x130\n  ? exc_overflow+0x30/0x30\n  ? handle_bug+0x27/0x50\n  ? exc_invalid_op+0x18/0x60\n  ? handle_exception+0xf6/0xf6\n  ? exc_overflow+0x30/0x30\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? exc_overflow+0x30/0x30\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211]\n  ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211]\n  ? process_one_work+0x165/0x280\n  ? worker_thread+0x120/0x3f0\n  ? kthread+0xc2/0xf0\n  ? process_one_work+0x280/0x280\n  ? kthread_complete_and_exit+0x20/0x20\n  ? ret_from_fork+0x19/0x24\n\n[shorten subject, remove OCB, reorder cases to match previous list]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b77d7794-2d2c-4734-8be2-83411fdf32cf",
      "id": "CVE-2024-49944",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start\n\nIn sctp_listen_start() invoked by sctp_inet_listen(), it should set the\nsk_state back to CLOSED if sctp_autobind() fails due to whatever reason.\n\nOtherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)-\u003ereuse\nis already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)-\u003ebind_hash will\nbe dereferenced as sk_state is LISTENING, which causes a crash as bind_hash\nis NULL.\n\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617\n  Call Trace:\n   \u003cTASK\u003e\n   __sys_listen_socket net/socket.c:1883 [inline]\n   __sys_listen+0x1b7/0x230 net/socket.c:1894\n   __do_sys_listen net/socket.c:1902 [inline]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cf561f4-2c70-42bc-94e2-1b368a895c78",
      "id": "CVE-2024-50059",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition\n\nIn the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev\nfunction, then \u0026sndev-\u003echeck_link_status_work is bound with\ncheck_link_status_work. switchtec_ntb_link_notification may be called\nto start the work.\n\nIf we remove the module which will call switchtec_ntb_remove to make\ncleanup, it will free sndev through kfree(sndev), while the work\nmentioned above will be used. The sequence of operations that may lead\nto a UAF bug is as follows:\n\nCPU0                                 CPU1\n\n                        | check_link_status_work\nswitchtec_ntb_remove    |\nkfree(sndev);           |\n                        | if (sndev-\u003elink_force_down)\n                        | // use sndev\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in switchtec_ntb_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af1d27cc-49d1-4dc9-8121-382346bb0daf",
      "id": "CVE-2025-21753",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when attempting to join an aborted transaction\n\nWhen we are trying to join the current transaction and if it's aborted,\nwe read its 'aborted' field after unlocking fs_info-\u003etrans_lock and\nwithout holding any extra reference count on it. This means that a\nconcurrent task that is aborting the transaction may free the transaction\nbefore we read its 'aborted' field, leading to a use-after-free.\n\nFix this by reading the 'aborted' field while holding fs_info-\u003etrans_lock\nsince any freeing task must first acquire that lock and set\nfs_info-\u003erunning_transaction to NULL before freeing the transaction.\n\nThis was reported by syzbot and Dmitry with the following stack traces\nfrom KASAN:\n\n   ==================================================================\n   BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278\n   Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128\n\n   CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n   Workqueue: events_unbound btrfs_async_reclaim_data_space\n   Call Trace:\n    \u003cTASK\u003e\n    __dump_stack lib/dump_stack.c:94 [inline]\n    dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n    print_address_description mm/kasan/report.c:378 [inline]\n    print_report+0x169/0x550 mm/kasan/report.c:489\n    kasan_report+0x143/0x180 mm/kasan/report.c:602\n    join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278\n    start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697\n    flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803\n    btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321\n    process_one_work kernel/workqueue.c:3236 [inline]\n    process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317\n    worker_thread+0x870/0xd30 kernel/workqueue.c:3398\n    kthread+0x2f0/0x390 kernel/kthread.c:389\n    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n    \u003c/TASK\u003e\n\n   Allocated by task 5315:\n    kasan_save_stack mm/kasan/common.c:47 [inline]\n    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n    __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n    kasan_kmalloc include/linux/kasan.h:260 [inline]\n    __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n    kmalloc_noprof include/linux/slab.h:901 [inline]\n    join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308\n    start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697\n    btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572\n    lookup_open fs/namei.c:3649 [inline]\n    open_last_lookups fs/namei.c:3748 [inline]\n    path_openat+0x1c03/0x3590 fs/namei.c:3984\n    do_filp_open+0x27f/0x4e0 fs/namei.c:4014\n    do_sys_openat2+0x13e/0x1d0 fs/open.c:1402\n    do_sys_open fs/open.c:1417 [inline]\n    __do_sys_creat fs/open.c:1495 [inline]\n    __se_sys_creat fs/open.c:1489 [inline]\n    __x64_sys_creat+0x123/0x170 fs/open.c:1489\n    do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n   Freed by task 5336:\n    kasan_save_stack mm/kasan/common.c:47 [inline]\n    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n    kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n    poison_slab_object mm/kasan/common.c:247 [inline]\n    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n    kasan_slab_free include/linux/kasan.h:233 [inline]\n    slab_free_hook mm/slub.c:2353 [inline]\n    slab_free mm/slub.c:4613 [inline]\n    kfree+0x196/0x430 mm/slub.c:4761\n    cleanup_transaction fs/btrfs/transaction.c:2063 [inline]\n    btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598\n    insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757\n    btrfs_balance+0x992/\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd9d30d9-297a-4546-b6b1-a6aa94da742e",
      "id": "CVE-2024-50229",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential deadlock with newly created symlinks\n\nSyzbot reported that page_symlink(), called by nilfs_symlink(), triggers\nmemory reclamation involving the filesystem layer, which can result in\ncircular lock dependencies among the reader/writer semaphore\nnilfs-\u003ens_segctor_sem, s_writers percpu_rwsem (intwrite) and the\nfs_reclaim pseudo lock.\n\nThis is because after commit 21fc61c73c39 (\"don't put symlink bodies in\npagecache into highmem\"), the gfp flags of the page cache for symbolic\nlinks are overwritten to GFP_KERNEL via inode_nohighmem().\n\nThis is not a problem for symlinks read from the backing device, because\nthe __GFP_FS flag is dropped after inode_nohighmem() is called.  However,\nwhen a new symlink is created with nilfs_symlink(), the gfp flags remain\noverwritten to GFP_KERNEL.  Then, memory allocation called from\npage_symlink() etc.  triggers memory reclamation including the FS layer,\nwhich may call nilfs_evict_inode() or nilfs_dirty_inode().  And these can\ncause a deadlock if they are called while nilfs-\u003ens_segctor_sem is held:\n\nFix this issue by dropping the __GFP_FS flag from the page cache GFP flags\nof newly created symlinks in the same way that nilfs_new_inode() and\n__nilfs_read_inode() do, as a workaround until we adopt nofs allocation\nscope consistently or improve the locking constraints.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "926d0acc-b7c5-41e9-8d40-852d0b2b8bd2",
      "id": "CVE-2024-53093",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: defer partition scanning\n\nWe need to suppress the partition scan from occuring within the\ncontroller's scan_work context. If a path error occurs here, the IO will\nwait until a path becomes available or all paths are torn down, but that\naction also occurs within scan_work, so it would deadlock. Defer the\npartion scan to a different context that does not block scan_work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "619d9a5c-7db9-40df-a6e8-a37c0593ad29",
      "id": "CVE-2024-56531",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Use snd_card_free_when_closed() at disconnection\n\nThe USB disconnect callback is supposed to be short and not too-long\nwaiting.  OTOH, the current code uses snd_card_free() at\ndisconnection, but this waits for the close of all used fds, hence it\ncan take long.  It eventually blocks the upper layer USB ioctls, which\nmay trigger a soft lockup.\n\nAn easy workaround is to replace snd_card_free() with\nsnd_card_free_when_closed().  This variant returns immediately while\nthe release of resources is done asynchronously by the card device\nrelease at the last close.\n\nThis patch also splits the code to the disconnect and the free phases;\nthe former is called immediately at the USB disconnect callback while\nthe latter is called from the card destructor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d813ee2-57a0-4892-b5a3-83ff89c2deaa",
      "id": "CVE-2024-56597",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix shift-out-of-bounds in dbSplit\n\nWhen dmt_budmin is less than zero, it causes errors\nin the later stages. Added a check to return an error beforehand\nin dbAllocCtl itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a54bccc-9e88-4b7f-a3e7-2d482fbd683f",
      "id": "CVE-2024-56611",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM\n\nWe currently assume that there is at least one VMA in a MM, which isn't\ntrue.\n\nSo we might end up having find_vma() return NULL, to then de-reference\nNULL.  So properly handle find_vma() returning NULL.\n\nThis fixes the report:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nRIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]\nRIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194\nCode: ...\nRSP: 0018:ffffc9000375fd08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000\nRDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044\nRBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1\nR10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003\nR13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8\nFS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709\n __do_sys_migrate_pages mm/mempolicy.c:1727 [inline]\n __se_sys_migrate_pages mm/mempolicy.c:1723 [inline]\n __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[akpm@linux-foundation.org: add unlikely()]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38378e99-4404-4533-aa0b-379599a3d937",
      "id": "CVE-2025-21762",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: use RCU protection in arp_xmit()\n\narp_xmit() can be called without RTNL or RCU protection.\n\nUse RCU protection to avoid potential UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "578e5e51-e2af-42fb-a8ec-efed697a7237",
      "id": "CVE-2025-21877",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: gl620a: fix endpoint checking in genelink_bind()\n\nSyzbot reports [1] a warning in usb_submit_urb() triggered by\ninconsistencies between expected and actually present endpoints\nin gl620a driver. Since genelink_bind() does not properly\nverify whether specified eps are in fact provided by the device,\nin this case, an artificially manufactured one, one may get a\nmismatch.\n\nFix the issue by resorting to a usbnet utility function\nusbnet_get_endpoints(), usually reserved for this very problem.\nCheck for endpoints and return early before proceeding further if\nany are missing.\n\n[1] Syzbot report:\nusb 5-1: Manufacturer: syz\nusb 5-1: SerialNumber: syz\nusb 5-1: config 0 descriptor??\ngl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummy_hcd.0-1, ...\n------------[ cut here ]------------\nusb 5-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\nModules linked in:\nCPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nWorkqueue: mld mld_ifc_work\nRIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\n...\nCall Trace:\n \u003cTASK\u003e\n usbnet_start_xmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467\n __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n xmit_one net/core/dev.c:3590 [inline]\n dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606\n sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343\n __dev_xmit_skb net/core/dev.c:3827 [inline]\n __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4400\n dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n neigh_resolve_output net/core/neighbour.c:1514 [inline]\n neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494\n neigh_output include/net/neighbour.h:539 [inline]\n ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141\n __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]\n ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247\n dst_output include/net/dst.h:450 [inline]\n NF_HOOK include/linux/netfilter.h:314 [inline]\n NF_HOOK include/linux/netfilter.h:308 [inline]\n mld_sendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819\n mld_send_cr net/ipv6/mcast.c:2120 [inline]\n mld_ifc_work+0x740/0xca0 net/ipv6/mcast.c:2651\n process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229\n process_scheduled_works kernel/workqueue.c:3310 [inline]\n worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af42e082-adb5-482d-8535-13a7f40023ae",
      "id": "CVE-2025-21912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: rcar: Use raw_spinlock to protect register access\n\nUse raw_spinlock in order to fix spurious messages about invalid context\nwhen spinlock debugging is enabled. The lock is only used to serialize\nregister access.\n\n    [    4.239592] =============================\n    [    4.239595] [ BUG: Invalid wait context ]\n    [    4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted\n    [    4.239603] -----------------------------\n    [    4.239606] kworker/u8:5/76 is trying to lock:\n    [    4.239609] ffff0000091898a0 (\u0026p-\u003elock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164\n    [    4.239641] other info that might help us debug this:\n    [    4.239643] context-{5:5}\n    [    4.239646] 5 locks held by kworker/u8:5/76:\n    [    4.239651]  #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c\n    [    4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value.\n    [    4.254094]  #1: ffff80008299bd80 ((work_completion)(\u0026entry-\u003ework)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c\n    [    4.254109]  #2: ffff00000920c8f8\n    [    4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value.\n    [    4.264803]  (\u0026dev-\u003emutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc\n    [    4.264820]  #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690\n    [    4.264840]  #4:\n    [    4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value.\n    [    4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690\n    [    4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz\n    [    4.304082] stack backtrace:\n    [    4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35\n    [    4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)\n    [    4.304097] Workqueue: async async_run_entry_fn\n    [    4.304106] Call trace:\n    [    4.304110]  show_stack+0x14/0x20 (C)\n    [    4.304122]  dump_stack_lvl+0x6c/0x90\n    [    4.304131]  dump_stack+0x14/0x1c\n    [    4.304138]  __lock_acquire+0xdfc/0x1584\n    [    4.426274]  lock_acquire+0x1c4/0x33c\n    [    4.429942]  _raw_spin_lock_irqsave+0x5c/0x80\n    [    4.434307]  gpio_rcar_config_interrupt_input_mode+0x34/0x164\n    [    4.440061]  gpio_rcar_irq_set_type+0xd4/0xd8\n    [    4.444422]  __irq_set_trigger+0x5c/0x178\n    [    4.448435]  __setup_irq+0x2e4/0x690\n    [    4.452012]  request_threaded_irq+0xc4/0x190\n    [    4.456285]  devm_request_threaded_irq+0x7c/0xf4\n    [    4.459398] ata1: link resume succeeded after 1 retries\n    [    4.460902]  mmc_gpiod_request_cd_irq+0x68/0xe0\n    [    4.470660]  mmc_start_host+0x50/0xac\n    [    4.474327]  mmc_add_host+0x80/0xe4\n    [    4.477817]  tmio_mmc_host_probe+0x2b0/0x440\n    [    4.482094]  renesas_sdhi_probe+0x488/0x6f4\n    [    4.486281]  renesas_sdhi_internal_dmac_probe+0x60/0x78\n    [    4.491509]  platform_probe+0x64/0xd8\n    [    4.495178]  really_probe+0xb8/0x2a8\n    [    4.498756]  __driver_probe_device+0x74/0x118\n    [    4.503116]  driver_probe_device+0x3c/0x154\n    [    4.507303]  __device_attach_driver+0xd4/0x160\n    [    4.511750]  bus_for_each_drv+0x84/0xe0\n    [    4.515588]  __device_attach_async_helper+0xb0/0xdc\n    [    4.520470]  async_run_entry_fn+0x30/0xd8\n    [    4.524481]  process_one_work+0x210/0x62c\n    [    4.528494]  worker_thread+0x1ac/0x340\n    [    4.532245]  kthread+0x10c/0x110\n    [    4.535476]  ret_from_fork+0x10/0x20",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e3eed5c-0a3d-4b2f-876a-b28f0bac488b",
      "id": "CVE-2025-21917",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas_usbhs: Flush the notify_hotplug_work\n\nWhen performing continuous unbind/bind operations on the USB drivers\navailable on the Renesas RZ/G2L SoC, a kernel crash with the message\n\"Unable to handle kernel NULL pointer dereference at virtual address\"\nmay occur. This issue points to the usbhsc_notify_hotplug() function.\n\nFlush the delayed work to avoid its execution when driver resources are\nunavailable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20d150a6-c5b9-4eda-87a2-d16ba8d7aee6",
      "id": "CVE-2025-21922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: Fix KMSAN uninit-value warning with bpf\n\nSyzbot caught an \"KMSAN: uninit-value\" warning [1], which is caused by the\nppp driver not initializing a 2-byte header when using socket filter.\n\nThe following code can generate a PPP filter BPF program:\n'''\nstruct bpf_program fp;\npcap_t *handle;\nhandle = pcap_open_dead(DLT_PPP_PPPD, 65535);\npcap_compile(handle, \u0026fp, \"ip and outbound\", 0, 0);\nbpf_dump(\u0026fp, 1);\n'''\nIts output is:\n'''\n(000) ldh [2]\n(001) jeq #0x21 jt 2 jf 5\n(002) ldb [0]\n(003) jeq #0x1 jt 4 jf 5\n(004) ret #65535\n(005) ret #0\n'''\nWen can find similar code at the following link:\nhttps://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680\nThe maintainer of this code repository is also the original maintainer\nof the ppp driver.\n\nAs you can see the BPF program skips 2 bytes of data and then reads the\n'Protocol' field to determine if it's an IP packet. Then it read the first\nbyte of the first 2 bytes to determine the direction.\n\nThe issue is that only the first byte indicating direction is initialized\nin current ppp driver code while the second byte is not initialized.\n\nFor normal BPF programs generated by libpcap, uninitialized data won't be\nused, so it's not a problem. However, for carefully crafted BPF programs,\nsuch as those generated by syzkaller [2], which start reading from offset\n0, the uninitialized data will be used and caught by KMSAN.\n\n[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791\n[2] https://syzkaller.appspot.com/text?tag=ReproC\u0026x=11994913980000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "230ea377-8600-4206-a41a-75591217ff58",
      "id": "CVE-2025-21935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: add check for rio_add_net() in rio_scan_alloc_net()\n\nThe return value of rio_add_net() should be checked.  If it fails,\nput_device() should be called to free the memory and give up the reference\ninitialized in rio_add_net().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cda015a-1cb3-42af-aab1-14de31b34e7f",
      "id": "CVE-2025-21993",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()\n\nWhen performing an iSCSI boot using IPv6, iscsistart still reads the\n/sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix\nlength is 64, this causes the shift exponent to become negative,\ntriggering a UBSAN warning. As the concept of a subnet mask does not\napply to IPv6, the value is set to ~0 to suppress the warning message.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8cd0c00f-b277-4cc4-b22a-c4255ee187d4",
      "id": "CVE-2025-22028",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vimc: skip .s_stream() for stopped entities\n\nSyzbot reported [1] a warning prompted by a check in call_s_stream()\nthat checks whether .s_stream() operation is warranted for unstarted\nor stopped subdevs.\n\nAdd a simple fix in vimc_streamer_pipeline_terminate() ensuring that\nentities skip a call to .s_stream() unless they have been previously\nproperly started.\n\n[1] Syzbot report:\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 5933 at drivers/media/v4l2-core/v4l2-subdev.c:460 call_s_stream+0x2df/0x350 drivers/media/v4l2-core/v4l2-subdev.c:460\nModules linked in:\nCPU: 0 UID: 0 PID: 5933 Comm: syz-executor330 Not tainted 6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0\n...\nCall Trace:\n \u003cTASK\u003e\n vimc_streamer_pipeline_terminate+0x218/0x320 drivers/media/test-drivers/vimc/vimc-streamer.c:62\n vimc_streamer_pipeline_init drivers/media/test-drivers/vimc/vimc-streamer.c:101 [inline]\n vimc_streamer_s_stream+0x650/0x9a0 drivers/media/test-drivers/vimc/vimc-streamer.c:203\n vimc_capture_start_streaming+0xa1/0x130 drivers/media/test-drivers/vimc/vimc-capture.c:256\n vb2_start_streaming+0x15f/0x5a0 drivers/media/common/videobuf2/videobuf2-core.c:1789\n vb2_core_streamon+0x2a7/0x450 drivers/media/common/videobuf2/videobuf2-core.c:2348\n vb2_streamon drivers/media/common/videobuf2/videobuf2-v4l2.c:875 [inline]\n vb2_ioctl_streamon+0xf4/0x170 drivers/media/common/videobuf2/videobuf2-v4l2.c:1118\n __video_do_ioctl+0xaf0/0xf00 drivers/media/v4l2-core/v4l2-ioctl.c:3122\n video_usercopy+0x4d2/0x1620 drivers/media/v4l2-core/v4l2-ioctl.c:3463\n v4l2_ioctl+0x1ba/0x250 drivers/media/v4l2-core/v4l2-dev.c:366\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f2b85c01b19\n...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3b0bc85-5b08-46e4-9fd3-0d625433acf7",
      "id": "CVE-2025-22058",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix memory accounting leak.\n\nMatt Dowling reported a weird UDP memory usage issue.\n\nUnder normal operation, the UDP memory usage reported in /proc/net/sockstat\nremains close to zero.  However, it occasionally spiked to 524,288 pages\nand never dropped.  Moreover, the value doubled when the application was\nterminated.  Finally, it caused intermittent packet drops.\n\nWe can reproduce the issue with the script below [0]:\n\n  1. /proc/net/sockstat reports 0 pages\n\n    # cat /proc/net/sockstat | grep UDP:\n    UDP: inuse 1 mem 0\n\n  2. Run the script till the report reaches 524,288\n\n    # python3 test.py \u0026 sleep 5\n    # cat /proc/net/sockstat | grep UDP:\n    UDP: inuse 3 mem 524288  \u003c-- (INT_MAX + 1) \u003e\u003e PAGE_SHIFT\n\n  3. Kill the socket and confirm the number never drops\n\n    # pkill python3 \u0026\u0026 sleep 5\n    # cat /proc/net/sockstat | grep UDP:\n    UDP: inuse 1 mem 524288\n\n  4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()\n\n    # python3 test.py \u0026 sleep 1 \u0026\u0026 pkill python3\n\n  5. The number doubles\n\n    # cat /proc/net/sockstat | grep UDP:\n    UDP: inuse 1 mem 1048577\n\nThe application set INT_MAX to SO_RCVBUF, which triggered an integer\noverflow in udp_rmem_release().\n\nWhen a socket is close()d, udp_destruct_common() purges its receive\nqueue and sums up skb-\u003etruesize in the queue.  This total is calculated\nand stored in a local unsigned integer variable.\n\nThe total size is then passed to udp_rmem_release() to adjust memory\naccounting.  However, because the function takes a signed integer\nargument, the total size can wrap around, causing an overflow.\n\nThen, the released amount is calculated as follows:\n\n  1) Add size to sk-\u003esk_forward_alloc.\n  2) Round down sk-\u003esk_forward_alloc to the nearest lower multiple of\n      PAGE_SIZE and assign it to amount.\n  3) Subtract amount from sk-\u003esk_forward_alloc.\n  4) Pass amount \u003e\u003e PAGE_SHIFT to __sk_mem_reduce_allocated().\n\nWhen the issue occurred, the total in udp_destruct_common() was 2147484480\n(INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().\n\nAt 1) sk-\u003esk_forward_alloc is changed from 3264 to -2147479552, and\n2) sets -2147479552 to amount.  3) reverts the wraparound, so we don't\nsee a warning in inet_sock_destruct().  However, udp_memory_allocated\nends up doubling at 4).\n\nSince commit 3cd3399dd7a8 (\"net: implement per-cpu reserves for\nmemory_allocated\"), memory usage no longer doubles immediately after\na socket is close()d because __sk_mem_reduce_allocated() caches the\namount in udp_memory_per_cpu_fw_alloc.  However, the next time a UDP\nsocket receives a packet, the subtraction takes effect, causing UDP\nmemory usage to double.\n\nThis issue makes further memory allocation fail once the socket's\nsk-\u003esk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet\ndrops.\n\nTo prevent this issue, let's use unsigned int for the calculation and\ncall sk_forward_alloc_add() only once for the small delta.\n\nNote that first_packet_length() also potentially has the same problem.\n\n[0]:\nfrom socket import *\n\nSO_RCVBUFFORCE = 33\nINT_MAX = (2 ** 31) - 1\n\ns = socket(AF_INET, SOCK_DGRAM)\ns.bind(('', 0))\ns.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)\n\nc = socket(AF_INET, SOCK_DGRAM)\nc.connect(s.getsockname())\n\ndata = b'a' * 100\n\nwhile True:\n    c.send(data)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d101ed0d-2c9f-406b-ac95-b64c5fe8170e",
      "id": "CVE-2025-23131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: prevent NPD when writing a positive value to event_done\n\ndo_uevent returns the value written to event_done. In case it is a\npositive value, new_lockspace would undo all the work, and lockspace\nwould not be set. __dlm_new_lockspace, however, would treat that\npositive value as a success due to commit 8511a2728ab8 (\"dlm: fix use\ncount with multiple joins\").\n\nDown the line, device_create_lockspace would pass that NULL lockspace to\ndlm_find_lockspace_local, leading to a NULL pointer dereference.\n\nTreating such positive values as successes prevents the problem. Given\nthis has been broken for so long, this is unlikely to break userspace\nexpectations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cdb5534e-a38b-4c6d-ac3f-c81ff11e987f",
      "id": "CVE-2025-37758",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()\n\ndevm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does\nnot check for this case, which can result in a NULL pointer dereference.\n\nAdd NULL check after devm_ioremap() to prevent this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9e95516-a83a-4163-8a43-c69e3da847c8",
      "id": "CVE-2025-37997",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix region locking in hash types\n\nRegion locking introduced in v5.6-rc4 contained three macros to handle\nthe region locks: ahash_bucket_start(), ahash_bucket_end() which gave\nback the start and end hash bucket values belonging to a given region\nlock and ahash_region() which should give back the region lock belonging\nto a given hash bucket. The latter was incorrect which can lead to a\nrace condition between the garbage collector and adding new elements\nwhen a hash type of set is defined with timeouts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "075e3d26-a22c-4e17-bbe7-5d73ab1a3efd",
      "id": "CVE-2021-34556",
      "description": "In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e067980-c8ee-42a5-9330-f77617b0231e",
      "id": "CVE-2023-1193",
      "description": "A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "498e0e46-73cb-4e91-a2c6-5aae351a3041",
      "id": "CVE-2025-38067",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrseq: Fix segfault on registration when rseq_cs is non-zero\n\nThe rseq_cs field is documented as being set to 0 by user-space prior to\nregistration, however this is not currently enforced by the kernel. This\ncan result in a segfault on return to user-space if the value stored in\nthe rseq_cs field doesn't point to a valid struct rseq_cs.\n\nThe correct solution to this would be to fail the rseq registration when\nthe rseq_cs field is non-zero. However, some older versions of glibc\nwill reuse the rseq area of previous threads without clearing the\nrseq_cs field and will also terminate the process if the rseq\nregistration fails in a secondary thread. This wasn't caught in testing\nbecause in this case the leftover rseq_cs does point to a valid struct\nrseq_cs.\n\nWhat we can do is clear the rseq_cs field on registration when it's\nnon-zero which will prevent segfaults on registration and won't break\nthe glibc versions that reuse rseq areas on thread creation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "400f6a4a-457f-4402-9316-6d3b9b4743bb",
      "id": "CVE-2025-38174",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Do not double dequeue a configuration request\n\nSome of our devices crash in tb_cfg_request_dequeue():\n\n general protection fault, probably for non-canonical address 0xdead000000000122\n\n CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65\n RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0\n Call Trace:\n \u003cTASK\u003e\n ? tb_cfg_request_dequeue+0x2d/0xa0\n tb_cfg_request_work+0x33/0x80\n worker_thread+0x386/0x8f0\n kthread+0xed/0x110\n ret_from_fork+0x38/0x50\n ret_from_fork_asm+0x1b/0x30\n\nThe circumstances are unclear, however, the theory is that\ntb_cfg_request_work() can be scheduled twice for a request:\nfirst time via frame.callback from ring_work() and second\ntime from tb_cfg_request().  Both times kworkers will execute\ntb_cfg_request_dequeue(), which results in double list_del()\nfrom the ctl-\u003erequest_queue (the list poison deference hints\nat it: 0xdead000000000122).\n\nDo not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE\nbit set.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0570f8f-1455-4f07-a61a-a7bb87ae90f5",
      "id": "CVE-2025-38245",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().\n\nsyzbot reported a warning below during atm_dev_register(). [0]\n\nBefore creating a new device and procfs/sysfs for it, atm_dev_register()\nlooks up a duplicated device by __atm_dev_lookup().  These operations are\ndone under atm_dev_mutex.\n\nHowever, when removing a device in atm_dev_deregister(), it releases the\nmutex just after removing the device from the list that __atm_dev_lookup()\niterates over.\n\nSo, there will be a small race window where the device does not exist on\nthe device list but procfs/sysfs are still not removed, triggering the\nsplat.\n\nLet's hold the mutex until procfs/sysfs are removed in\natm_dev_deregister().\n\n[0]:\nproc_dir_entry 'atm/atmtcp:0' already registered\nWARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377\nModules linked in:\nCPU: 0 UID: 0 PID: 5919 Comm: syz-executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nRIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377\nCode: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 \u003c0f\u003e 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48\nRSP: 0018:ffffc9000466fa30 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248\nRDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001\nRBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: ffff888076ed2140\nR13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444\nFS:  00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n proc_create_data+0xbe/0x110 fs/proc/generic.c:585\n atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361\n atm_dev_register+0x46d/0x890 net/atm/resources.c:113\n atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369\n atmtcp_attach drivers/atm/atmtcp.c:403 [inline]\n atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464\n do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n sock_do_ioctl+0x115/0x280 net/socket.c:1190\n sock_ioctl+0x227/0x6b0 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl fs/ioctl.c:893 [inline]\n __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f38b3b74459\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f38b3bfe318 RCX: 00007f38b3b74459\nRDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005\nRBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f\nR10: 65732f636f72702f R11: 0000000000000246 R12: 00007f38b3bcb0ac\nR13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d00a8201-d450-46c5-a7af-719782160da6",
      "id": "CVE-2025-38346",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix UAF when lookup kallsym after ftrace disabled\n\nThe following issue happens with a buggy module:\n\nBUG: unable to handle page fault for address: ffffffffc05d0218\nPGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0\nOops: Oops: 0000 [#1] SMP KASAN PTI\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nRIP: 0010:sized_strscpy+0x81/0x2f0\nRSP: 0018:ffff88812d76fa08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000\nRDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d\nRBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68\nR10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038\nR13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff\nFS:  00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ftrace_mod_get_kallsym+0x1ac/0x590\n update_iter_mod+0x239/0x5b0\n s_next+0x5b/0xa0\n seq_read_iter+0x8c9/0x1070\n seq_read+0x249/0x3b0\n proc_reg_read+0x1b0/0x280\n vfs_read+0x17f/0x920\n ksys_read+0xf3/0x1c0\n do_syscall_64+0x5f/0x2e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe above issue may happen as follows:\n(1) Add kprobe tracepoint;\n(2) insmod test.ko;\n(3)  Module triggers ftrace disabled;\n(4) rmmod test.ko;\n(5) cat /proc/kallsyms; --\u003e Will trigger UAF as test.ko already removed;\nftrace_mod_get_kallsym()\n...\nstrscpy(module_name, mod_map-\u003emod-\u003ename, MODULE_NAME_LEN);\n...\n\nThe problem is when a module triggers an issue with ftrace and\nsets ftrace_disable. The ftrace_disable is set when an anomaly is\ndiscovered and to prevent any more damage, ftrace stops all text\nmodification. The issue that happened was that the ftrace_disable stops\nmore than just the text modification.\n\nWhen a module is loaded, its init functions can also be traced. Because\nkallsyms deletes the init functions after a module has loaded, ftrace\nsaves them when the module is loaded and function tracing is enabled. This\nallows the output of the function trace to show the init function names\ninstead of just their raw memory addresses.\n\nWhen a module is removed, ftrace_release_mod() is called, and if\nftrace_disable is set, it just returns without doing anything more. The\nproblem here is that it leaves the mod_list still around and if kallsyms\nis called, it will call into this code and access the module memory that\nhas already been freed as it will return:\n\n  strscpy(module_name, mod_map-\u003emod-\u003ename, MODULE_NAME_LEN);\n\nWhere the \"mod\" no longer exists and triggers a UAF bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "296fae56-b6da-4f43-a268-4df3a4aefb00",
      "id": "CVE-2025-38458",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix NULL pointer dereference in vcc_sendmsg()\n\natmarpd_dev_ops does not implement the send method, which may cause crash\nas bellow.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0010 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246\nRAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000\nRDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000\nRBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287\nR10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00\nR13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88\nFS:  00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:727\n ____sys_sendmsg+0x52d/0x830 net/socket.c:2566\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620\n __sys_sendmmsg+0x227/0x430 net/socket.c:2709\n __do_sys_sendmmsg net/socket.c:2736 [inline]\n __se_sys_sendmmsg net/socket.c:2733 [inline]\n __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2733\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec68adc2-83f8-4502-91dc-ec340eccca9b",
      "id": "CVE-2025-38623",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: pnv_php: Fix surprise plug detection and recovery\n\nThe existing PowerNV hotplug code did not handle surprise plug events\ncorrectly, leading to a complete failure of the hotplug system after device\nremoval and a required reboot to detect new devices.\n\nThis comes down to two issues:\n\n 1) When a device is surprise removed, often the bridge upstream\n    port will cause a PE freeze on the PHB.  If this freeze is not\n    cleared, the MSI interrupts from the bridge hotplug notification\n    logic will not be received by the kernel, stalling all plug events\n    on all slots associated with the PE.\n\n 2) When a device is removed from a slot, regardless of surprise or\n    programmatic removal, the associated PHB/PE ls left frozen.\n    If this freeze is not cleared via a fundamental reset, skiboot\n    is unable to clear the freeze and cannot retrain / rescan the\n    slot.  This also requires a reboot to clear the freeze and redetect\n    the device in the slot.\n\nIssue the appropriate unfreeze and rescan commands on hotplug events,\nand don't oops on hotplug if pci_bus_to_OF_node() returns NULL.\n\n[bhelgaas: tidy comments]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6626be3d-2c97-44aa-94c5-dd578a261c6c",
      "id": "CVE-2025-39685",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: pcl726: Prevent invalid irq number\n\nThe reproducer passed in an irq number(0x80008000) that was too large,\nwhich triggered the oob.\n\nAdded an interrupt number check to prevent users from passing in an irq\nnumber that was too large.\n\nIf `it-\u003eoptions[1]` is 31, then `1 \u003c\u003c it-\u003eoptions[1]` is still invalid\nbecause it shifts a 1-bit into the sign bit (which is UB in C).\nPossible solutions include reducing the upper bound on the\n`it-\u003eoptions[1]` value to 30 or lower, or using `1U \u003c\u003c it-\u003eoptions[1]`.\n\nThe old code would just not attempt to request the IRQ if the\n`options[1]` value were invalid.  And it would still configure the\ndevice without interrupts even if the call to `request_irq` returned an\nerror.  So it would be better to combine this test with the test below.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95b61abf-0c37-4f46-a18a-ccf6dd79fb76",
      "id": "CVE-2025-39716",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Revise __get_user() to probe user read access\n\nBecause of the way read access support is implemented, read access\ninterruptions are only triggered at privilege levels 2 and 3. The\nkernel executes at privilege level 0, so __get_user() never triggers\na read access interruption (code 26). Thus, it is currently possible\nfor user code to access a read protected address via a system call.\n\nFix this by probing read access rights at privilege level 3 (PRIV_USER)\nand setting __gu_err to -EFAULT (-14) if access isn't allowed.\n\nNote the cmpiclr instruction does a 32-bit compare because COND macro\ndoesn't work inside asm.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cb88d99-02a1-4009-b87b-a53c9f597013",
      "id": "CVE-2020-11608",
      "description": "An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0720f6d4-53f8-4b0f-b2cf-05dfc94ecc54",
      "id": "CVE-2020-27152",
      "description": "An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b257a6f-df18-4499-8bf0-92c7ab42cb76",
      "id": "CVE-2020-29660",
      "description": "A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd6f7f67-4182-4221-b69e-e06d4e4825c4",
      "id": "CVE-2020-8647",
      "description": "There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4bc3f7f4-fd0a-4f8c-84d6-8a3305c70723",
      "id": "CVE-2021-3739",
      "description": "A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cecb741b-ed95-473b-bff1-8d7940253507",
      "id": "CVE-2021-4002",
      "description": "A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cbd8c1d6-7f5a-490d-a10c-03c82dcde981",
      "id": "CVE-2021-47010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Only allow init netns to set default tcp cong to a restricted algo\n\ntcp_set_default_congestion_control() is netns-safe in that it writes\nto \u0026net-\u003eipv4.tcp_congestion_control, but it also sets\nca-\u003eflags |= TCP_CONG_NON_RESTRICTED which is not namespaced.\nThis has the unintended side-effect of changing the global\nnet.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it\nis read-only: 97684f0970f6 (\"net: Make tcp_allowed_congestion_control\nreadonly in non-init netns\")\n\nResolve this netns \"leak\" by only allowing the init netns to set the\ndefault algorithm to one that is restricted. This restriction could be\nremoved if tcp_allowed_congestion_control were namespace-ified in the\nfuture.\n\nThis bug was uncovered with\nhttps://github.com/JonathonReinhart/linux-netns-sysctl-verify",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3522f62-6525-4b93-8cdc-66b09a5ebc9e",
      "id": "CVE-2021-47071",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Fix a memory leak in error handling paths\n\nIf 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be\nupdated and 'hv_uio_cleanup()' in the error handling path will not be\nable to free the corresponding buffer.\n\nIn such a case, we need to free the buffer explicitly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35e2ab89-9906-407a-a886-1890ccb8b6c2",
      "id": "CVE-2021-47077",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Add pointer checks in qedf_update_link_speed()\n\nThe following trace was observed:\n\n [   14.042059] Call Trace:\n [   14.042061]  \u003cIRQ\u003e\n [   14.042068]  qedf_link_update+0x144/0x1f0 [qedf]\n [   14.042117]  qed_link_update+0x5c/0x80 [qed]\n [   14.042135]  qed_mcp_handle_link_change+0x2d2/0x410 [qed]\n [   14.042155]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042170]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042186]  ? qed_rd+0x13/0x40 [qed]\n [   14.042205]  qed_mcp_handle_events+0x437/0x690 [qed]\n [   14.042221]  ? qed_set_ptt+0x70/0x80 [qed]\n [   14.042239]  qed_int_sp_dpc+0x3a6/0x3e0 [qed]\n [   14.042245]  tasklet_action_common.isra.14+0x5a/0x100\n [   14.042250]  __do_softirq+0xe4/0x2f8\n [   14.042253]  irq_exit+0xf7/0x100\n [   14.042255]  do_IRQ+0x7f/0xd0\n [   14.042257]  common_interrupt+0xf/0xf\n [   14.042259]  \u003c/IRQ\u003e\n\nAPI qedf_link_update() is getting called from QED but by that time\nshost_data is not initialised. This results in a NULL pointer dereference\nwhen we try to dereference shost_data while updating supported_speeds.\n\nAdd a NULL pointer check before dereferencing shost_data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f955e81-f26b-4437-9ec5-7e6519468951",
      "id": "CVE-2021-47167",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix an Oopsable condition in __nfs_pageio_add_request()\n\nEnsure that nfs_pageio_error_cleanup() resets the mirror array contents,\nso that the structure reflects the fact that it is now empty.\nAlso change the test in nfs_pageio_do_add_request() to be more robust by\nchecking whether or not the list is empty rather than relying on the\nvalue of pg_count.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c545c90d-8bdc-4338-8017-fbc0320a2ce1",
      "id": "CVE-2022-48901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not start relocation until in progress drops are done\n\nWe hit a bug with a recovering relocation on mount for one of our file\nsystems in production.  I reproduced this locally by injecting errors\ninto snapshot delete with balance running at the same time.  This\npresented as an error while looking up an extent item\n\n  WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680\n  CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8\n  RIP: 0010:lookup_inline_extent_backref+0x647/0x680\n  RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202\n  RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000\n  RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001\n  R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000\n  R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000\n  FS:  0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0\n  Call Trace:\n   \u003cTASK\u003e\n   insert_inline_extent_backref+0x46/0xd0\n   __btrfs_inc_extent_ref.isra.0+0x5f/0x200\n   ? btrfs_merge_delayed_refs+0x164/0x190\n   __btrfs_run_delayed_refs+0x561/0xfa0\n   ? btrfs_search_slot+0x7b4/0xb30\n   ? btrfs_update_root+0x1a9/0x2c0\n   btrfs_run_delayed_refs+0x73/0x1f0\n   ? btrfs_update_root+0x1a9/0x2c0\n   btrfs_commit_transaction+0x50/0xa50\n   ? btrfs_update_reloc_root+0x122/0x220\n   prepare_to_merge+0x29f/0x320\n   relocate_block_group+0x2b8/0x550\n   btrfs_relocate_block_group+0x1a6/0x350\n   btrfs_relocate_chunk+0x27/0xe0\n   btrfs_balance+0x777/0xe60\n   balance_kthread+0x35/0x50\n   ? btrfs_balance+0xe60/0xe60\n   kthread+0x16b/0x190\n   ? set_kthread_struct+0x40/0x40\n   ret_from_fork+0x22/0x30\n   \u003c/TASK\u003e\n\nNormally snapshot deletion and relocation are excluded from running at\nthe same time by the fs_info-\u003ecleaner_mutex.  However if we had a\npending balance waiting to get the -\u003ecleaner_mutex, and a snapshot\ndeletion was running, and then the box crashed, we would come up in a\nstate where we have a half deleted snapshot.\n\nAgain, in the normal case the snapshot deletion needs to complete before\nrelocation can start, but in this case relocation could very well start\nbefore the snapshot deletion completes, as we simply add the root to the\ndead roots list and wait for the next time the cleaner runs to clean up\nthe snapshot.\n\nFix this by setting a bit on the fs_info if we have any DEAD_ROOT's that\nhad a pending drop_progress key.  If they do then we know we were in the\nmiddle of the drop operation and set a flag on the fs_info.  Then\nbalance can wait until this flag is cleared to start up again.\n\nIf there are DEAD_ROOT's that don't have a drop_progress set then we're\nsafe to start balance right away as we'll be properly protected by the\ncleaner_mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "948f664d-1fb8-4698-9b39-9082c7e5b55f",
      "id": "CVE-2021-47185",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: tty_buffer: Fix the softlockup issue in flush_to_ldisc\n\nWhen running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup,\nwhich look like this one:\n\n  Workqueue: events_unbound flush_to_ldisc\n  Call trace:\n   dump_backtrace+0x0/0x1ec\n   show_stack+0x24/0x30\n   dump_stack+0xd0/0x128\n   panic+0x15c/0x374\n   watchdog_timer_fn+0x2b8/0x304\n   __run_hrtimer+0x88/0x2c0\n   __hrtimer_run_queues+0xa4/0x120\n   hrtimer_interrupt+0xfc/0x270\n   arch_timer_handler_phys+0x40/0x50\n   handle_percpu_devid_irq+0x94/0x220\n   __handle_domain_irq+0x88/0xf0\n   gic_handle_irq+0x84/0xfc\n   el1_irq+0xc8/0x180\n   slip_unesc+0x80/0x214 [slip]\n   tty_ldisc_receive_buf+0x64/0x80\n   tty_port_default_receive_buf+0x50/0x90\n   flush_to_ldisc+0xbc/0x110\n   process_one_work+0x1d4/0x4b0\n   worker_thread+0x180/0x430\n   kthread+0x11c/0x120\n\nIn the testcase pty04, The first process call the write syscall to send\ndata to the pty master. At the same time, the workqueue will do the\nflush_to_ldisc to pop data in a loop until there is no more data left.\nWhen the sender and workqueue running in different core, the sender sends\ndata fastly in full time which will result in workqueue doing work in loop\nfor a long time and occuring softlockup in flush_to_ldisc with kernel\nconfigured without preempt. So I add need_resched check and cond_resched\nin the flush_to_ldisc loop to avoid it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46d9450c-7f8a-415a-88e3-21d40c30a07e",
      "id": "CVE-2021-47354",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Avoid data corruptions\n\nWait for all dependencies of a job  to complete before\nkilling it to avoid data corruptions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcc296ca-f842-4e88-a2f4-cb4573b9fbdd",
      "id": "CVE-2021-47435",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix mempool NULL pointer race when completing IO\n\ndm_io_dec_pending() calls end_io_acct() first and will then dec md\nin-flight pending count. But if a task is swapping DM table at same\ntime this can result in a crash due to mempool-\u003eelements being NULL:\n\ntask1                             task2\ndo_resume\n -\u003edo_suspend\n  -\u003edm_wait_for_completion\n                                  bio_endio\n\t\t\t\t   -\u003eclone_endio\n\t\t\t\t    -\u003edm_io_dec_pending\n\t\t\t\t     -\u003eend_io_acct\n\t\t\t\t      -\u003ewakeup task1\n -\u003edm_swap_table\n  -\u003e__bind\n   -\u003e__bind_mempools\n    -\u003ebioset_exit\n     -\u003emempool_exit\n                                     -\u003efree_io\n\n[ 67.330330] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\n......\n[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)\n[ 67.330510] pc : mempool_free+0x70/0xa0\n[ 67.330515] lr : mempool_free+0x4c/0xa0\n[ 67.330520] sp : ffffff8008013b20\n[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004\n[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8\n[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800\n[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800\n[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80\n[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c\n[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd\n[ 67.330563] x15: 000000000093b41e x14: 0000000000000010\n[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555\n[ 67.330574] x11: 0000000000000001 x10: 0000000000000001\n[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000\n[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a\n[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001\n[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8\n[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970\n[ 67.330609] Call trace:\n[ 67.330616] mempool_free+0x70/0xa0\n[ 67.330627] bio_put+0xf8/0x110\n[ 67.330638] dec_pending+0x13c/0x230\n[ 67.330644] clone_endio+0x90/0x180\n[ 67.330649] bio_endio+0x198/0x1b8\n[ 67.330655] dec_pending+0x190/0x230\n[ 67.330660] clone_endio+0x90/0x180\n[ 67.330665] bio_endio+0x198/0x1b8\n[ 67.330673] blk_update_request+0x214/0x428\n[ 67.330683] scsi_end_request+0x2c/0x300\n[ 67.330688] scsi_io_completion+0xa0/0x710\n[ 67.330695] scsi_finish_command+0xd8/0x110\n[ 67.330700] scsi_softirq_done+0x114/0x148\n[ 67.330708] blk_done_softirq+0x74/0xd0\n[ 67.330716] __do_softirq+0x18c/0x374\n[ 67.330724] irq_exit+0xb4/0xb8\n[ 67.330732] __handle_domain_irq+0x84/0xc0\n[ 67.330737] gic_handle_irq+0x148/0x1b0\n[ 67.330744] el1_irq+0xe8/0x190\n[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538\n[ 67.330759] cpuidle_enter_state+0x1fc/0x398\n[ 67.330764] cpuidle_enter+0x18/0x20\n[ 67.330772] do_idle+0x1b4/0x290\n[ 67.330778] cpu_startup_entry+0x20/0x28\n[ 67.330786] secondary_start_kernel+0x160/0x170\n\nFix this by:\n1) Establishing pointers to 'struct dm_io' members in\ndm_io_dec_pending() so that they may be passed into end_io_acct()\n_after_ free_io() is called.\n2) Moving end_io_acct() after free_io().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c7409207-122c-4dd5-8232-5e66748124e2",
      "id": "CVE-2021-47480",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Put LLD module refcnt after SCSI device is released\n\nSCSI host release is triggered when SCSI device is freed. We have to make\nsure that the low-level device driver module won't be unloaded before SCSI\nhost instance is released because shost-\u003ehostt is required in the release\nhandler.\n\nMake sure to put LLD module refcnt after SCSI device is released.\n\nFixes a kernel panic of 'BUG: unable to handle page fault for address'\nreported by Changhui and Yi.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98066c97-22f8-4f51-b3e1-eb92c384a81e",
      "id": "CVE-2021-47538",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()\n\nNeed to call rxrpc_put_local() for peer candidate before kfree() as it\nholds a ref to rxrpc_local.\n\n[DH: v2: Changed to abstract the peer freeing code out into a function]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f105d7a4-feef-4780-803c-fce6e692282c",
      "id": "CVE-2021-47598",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: do not call cake_destroy() from cake_init()\n\nqdiscs are not supposed to call their own destroy() method\nfrom init(), because core stack already does that.\n\nsyzbot was able to trigger use after free:\n\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\nWARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock_common kernel/locking/mutex.c:586 [inline]\nWARNING: CPU: 0 PID: 21902 at kernel/locking/mutex.c:586 __mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740\nModules linked in:\nCPU: 0 PID: 21902 Comm: syz-executor189 Not tainted 5.16.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:__mutex_lock_common kernel/locking/mutex.c:586 [inline]\nRIP: 0010:__mutex_lock+0x9ec/0x12f0 kernel/locking/mutex.c:740\nCode: 08 84 d2 0f 85 19 08 00 00 8b 05 97 38 4b 04 85 c0 0f 85 27 f7 ff ff 48 c7 c6 20 00 ac 89 48 c7 c7 a0 fe ab 89 e8 bf 76 ba ff \u003c0f\u003e 0b e9 0d f7 ff ff 48 8b 44 24 40 48 8d b8 c8 08 00 00 48 89 f8\nRSP: 0018:ffffc9000627f290 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802315d700 RSI: ffffffff815f1db8 RDI: fffff52000c4fe44\nRBP: ffff88818f28e000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815ebb5e R11: 0000000000000000 R12: 0000000000000000\nR13: dffffc0000000000 R14: ffffc9000627f458 R15: 0000000093c30000\nFS:  0000555556abc400(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fda689c3303 CR3: 000000001cfbb000 CR4: 0000000000350ef0\nCall Trace:\n \u003cTASK\u003e\n tcf_chain0_head_change_cb_del+0x2e/0x3d0 net/sched/cls_api.c:810\n tcf_block_put_ext net/sched/cls_api.c:1381 [inline]\n tcf_block_put_ext net/sched/cls_api.c:1376 [inline]\n tcf_block_put+0xbc/0x130 net/sched/cls_api.c:1394\n cake_destroy+0x3f/0x80 net/sched/sch_cake.c:2695\n qdisc_create.constprop.0+0x9da/0x10f0 net/sched/sch_api.c:1293\n tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2496\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x904/0xdf0 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f1bb06badb9\nCode: Unable to access opcode bytes at RIP 0x7f1bb06bad8f.\nRSP: 002b:00007fff3012a658 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1bb06badb9\nRDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000003\nR10: 0000000000000003 R11: 0000000000000246 R12: 00007fff3012a688\nR13: 00007fff3012a6a0 R14: 00007fff3012a6e0 R15: 00000000000013c2\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8b59e97-7f5b-43f8-a080-8e4f42bd6d90",
      "id": "CVE-2021-47609",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Fix string overflow in SCPI genpd driver\n\nWithout the bound checks for scpi_pd-\u003ename, it could result in the buffer\noverflow when copying the SCPI device name from the corresponding device\ntree node as the name string is set at maximum size of 30.\n\nLet us fix it by using devm_kasprintf so that the string buffer is\nallocated dynamically.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d292356-ac83-4248-abdb-ca0b691b7d5b",
      "id": "CVE-2023-52593",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()\n\nSince 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()'\nshould check the return value before examining skb data. So convert\nthe latter to return an appropriate error code and propagate it to\nreturn from 'wfx_start_ap()' as well. Compile tested only.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e79ec8be-1152-460c-8c4c-3fa2df3b59d6",
      "id": "CVE-2022-3424",
      "description": "A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2118064b-efd8-4fc2-8377-b4899e96b106",
      "id": "CVE-2022-38096",
      "description": "A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5291cb6b-0c61-4f87-a96f-c08d3e308cd7",
      "id": "CVE-2022-42896",
      "description": "There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim.\n\nWe recommend upgrading past commit   https://www.google.com/url  https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "264b6565-a7f7-4d00-b8e8-67811924622f",
      "id": "CVE-2022-44034",
      "description": "An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between scr24x_open() and scr24x_remove().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7df86a7-64f2-4f04-86a4-bc0094acf2ef",
      "id": "CVE-2022-48672",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: fdt: fix off-by-one error in unflatten_dt_nodes()\n\nCommit 78c44d910d3e (\"drivers/of: Fix depth when unflattening devicetree\")\nforgot to fix up the depth check in the loop body in unflatten_dt_nodes()\nwhich makes it possible to overflow the nps[] buffer...\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb3587d0-c9fb-477c-a2c1-2d6db6ab4e2d",
      "id": "CVE-2024-26846",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: do not wait in vain when unloading module\n\nThe module exit path has race between deleting all controllers and\nfreeing 'left over IDs'. To prevent double free a synchronization\nbetween nvme_delete_ctrl and ida_destroy has been added by the initial\ncommit.\n\nThere is some logic around trying to prevent from hanging forever in\nwait_for_completion, though it does not handling all cases. E.g.\nblktests is able to reproduce the situation where the module unload\nhangs forever.\n\nIf we completely rely on the cleanup code executed from the\nnvme_delete_ctrl path, all IDs will be freed eventually. This makes\ncalling ida_destroy unnecessary. We only have to ensure that all\nnvme_delete_ctrl code has been executed before we leave\nnvme_fc_exit_module. This is done by flushing the nvme_delete_wq\nworkqueue.\n\nWhile at it, remove the unused nvme_fc_wq workqueue too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "062610c6-73b7-4887-aa69-4478ff7fa6d6",
      "id": "CVE-2024-26900",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix kmemleak of rdev-\u003eserial\n\nIf kobject_add() is fail in bind_rdev_to_array(), 'rdev-\u003eserial' will be\nalloc not be freed, and kmemleak occurs.\n\nunreferenced object 0xffff88815a350000 (size 49152):\n  comm \"mdadm\", pid 789, jiffies 4294716910\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc f773277a):\n    [\u003c0000000058b0a453\u003e] kmemleak_alloc+0x61/0xe0\n    [\u003c00000000366adf14\u003e] __kmalloc_large_node+0x15e/0x270\n    [\u003c000000002e82961b\u003e] __kmalloc_node.cold+0x11/0x7f\n    [\u003c00000000f206d60a\u003e] kvmalloc_node+0x74/0x150\n    [\u003c0000000034bf3363\u003e] rdev_init_serial+0x67/0x170\n    [\u003c0000000010e08fe9\u003e] mddev_create_serial_pool+0x62/0x220\n    [\u003c00000000c3837bf0\u003e] bind_rdev_to_array+0x2af/0x630\n    [\u003c0000000073c28560\u003e] md_add_new_disk+0x400/0x9f0\n    [\u003c00000000770e30ff\u003e] md_ioctl+0x15bf/0x1c10\n    [\u003c000000006cfab718\u003e] blkdev_ioctl+0x191/0x3f0\n    [\u003c0000000085086a11\u003e] vfs_ioctl+0x22/0x60\n    [\u003c0000000018b656fe\u003e] __x64_sys_ioctl+0xba/0xe0\n    [\u003c00000000e54e675e\u003e] do_syscall_64+0x71/0x150\n    [\u003c000000008b0ad622\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e914e08-1018-4e12-80ea-59c5f8bd74ef",
      "id": "CVE-2022-48756",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dsi: invalid parameter check in msm_dsi_phy_enable\n\nThe function performs a check on the \"phy\" input parameter, however, it\nis used before the check.\n\nInitialize the \"dev\" variable after the sanity check to avoid a possible\nNULL pointer dereference.\n\nAddresses-Coverity-ID: 1493860 (\"Null pointer dereference\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2fc0b594-4136-4fbc-a944-056b3397954c",
      "id": "CVE-2022-49309",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()\n\nThere is a deadlock in rtw_surveydone_event_callback(),\nwhich is shown below:\n\n   (Thread 1)                  |      (Thread 2)\n                               | _set_timer()\nrtw_surveydone_event_callback()|  mod_timer()\n spin_lock_bh() //(1)          |  (wait a time)\n ...                           | rtw_scan_timeout_handler()\n del_timer_sync()              |  spin_lock_bh() //(2)\n (wait timer to stop)          |  ...\n\nWe hold pmlmepriv-\u003elock in position (1) of thread 1 and use\ndel_timer_sync() to wait timer to stop, but timer handler\nalso need pmlmepriv-\u003elock in position (2) of thread 2.\nAs a result, rtw_surveydone_event_callback() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_bh(), which could let timer handler to obtain\nthe needed lock. What`s more, we change spin_lock_bh() in\nrtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,\nspin_lock_bh() will also cause deadlock() in timer handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b540823b-d3f8-4ace-a986-a78df94fce32",
      "id": "CVE-2022-48766",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap dcn301_calculate_wm_and_dlg for FPU.\n\nMirrors the logic for dcn30. Cue lots of WARNs and some\nkernel panics without this fix.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b9d4273-6fd5-46c1-8062-91441d2da8a7",
      "id": "CVE-2022-48788",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a2fac85-df60-4fee-b08b-3a4fc21ae5ad",
      "id": "CVE-2022-49002",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() for the error path to avoid reference count leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17bbf5af-3c9c-4430-a686-1a70428c0fc1",
      "id": "CVE-2022-49072",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Restrict usage of GPIO chip irq members before initialization\n\nGPIO chip irq members are exposed before they could be completely\ninitialized and this leads to race conditions.\n\nOne such issue was observed for the gc-\u003eirq.domain variable which\nwas accessed through the I2C interface in gpiochip_to_irq() before\nit could be initialized by gpiochip_add_irqchip(). This resulted in\nKernel NULL pointer dereference.\n\nFollowing are the logs for reference :-\n\nkernel: Call Trace:\nkernel:  gpiod_to_irq+0x53/0x70\nkernel:  acpi_dev_gpio_irq_get_by+0x113/0x1f0\nkernel:  i2c_acpi_get_irq+0xc0/0xd0\nkernel:  i2c_device_probe+0x28a/0x2a0\nkernel:  really_probe+0xf2/0x460\nkernel: RIP: 0010:gpiochip_to_irq+0x47/0xc0\n\nTo avoid such scenarios, restrict usage of GPIO chip irq members before\nthey are completely initialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e256b6bf-f6a5-4e18-b375-5463ba79375f",
      "id": "CVE-2022-49124",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mce: Work around an erratum on fast string copy instructions\n\nA rare kernel panic scenario can happen when the following conditions\nare met due to an erratum on fast string copy instructions:\n\n1) An uncorrected error.\n2) That error must be in first cache line of a page.\n3) Kernel must execute page_copy from the page immediately before that\npage.\n\nThe fast string copy instructions (\"REP; MOVS*\") could consume an\nuncorrectable memory error in the cache line _right after_ the desired\nregion to copy and raise an MCE.\n\nBit 0 of MSR_IA32_MISC_ENABLE can be cleared to disable fast string\ncopy and will avoid such spurious machine checks. However, that is less\npreferable due to the permanent performance impact. Considering memory\npoison is rare, it's desirable to keep fast string copy enabled until an\nMCE is seen.\n\nIntel has confirmed the following:\n1. The CPU erratum of fast string copy only applies to Skylake,\nCascade Lake and Cooper Lake generations.\n\nDirectly return from the MCE handler:\n2. Will result in complete execution of the \"REP; MOVS*\" with no data\nloss or corruption.\n3. Will not result in another MCE firing on the next poisoned cache line\ndue to \"REP; MOVS*\".\n4. Will resume execution from a correct point in code.\n5. Will result in the same instruction that triggered the MCE firing a\nsecond MCE immediately for any other software recoverable data fetch\nerrors.\n6. Is not safe without disabling the fast string copy, as the next fast\nstring copy of the same buffer on the same CPU would result in a PANIC\nMCE.\n\nThis should mitigate the erratum completely with the only caveat that\nthe fast string copy is disabled on the affected hyper thread thus\nperformance degradation.\n\nThis is still better than the OS crashing on MCEs raised on an\nirrelevant process due to \"REP; MOVS*' accesses in a kernel context,\ne.g., copy_page.\n\n\nInjected errors on 1st cache line of 8 anonymous pages of process\n'proc1' and observed MCE consumption from 'proc2' with no panic\n(directly returned).\n\nWithout the fix, the host panicked within a few minutes on a\nrandom 'proc2' process due to kernel access from copy_page.\n\n  [ bp: Fix comment style + touch ups, zap an unlikely(), improve the\n    quirk function's readability. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "80f0dcec-416a-459c-a7ce-378be9bf0694",
      "id": "CVE-2022-49217",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix abort all task initialization\n\nIn pm80xx_send_abort_all(), the n_elem field of the ccb used is not\ninitialized to 0. This missing initialization sometimes lead to the task\ncompletion path seeing the ccb with a non-zero n_elem resulting in the\nexecution of invalid dma_unmap_sg() calls in pm8001_ccb_task_free(),\ncausing a crash such as:\n\n[  197.676341] RIP: 0010:iommu_dma_unmap_sg+0x6d/0x280\n[  197.700204] RSP: 0018:ffff889bbcf89c88 EFLAGS: 00010012\n[  197.705485] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83d0bda0\n[  197.712687] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff88810dffc0d0\n[  197.719887] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8881c790098b\n[  197.727089] R10: ffffed1038f20131 R11: 0000000000000001 R12: 0000000000000000\n[  197.734296] R13: ffff88810dffc0d0 R14: 0000000000000010 R15: 0000000000000000\n[  197.741493] FS:  0000000000000000(0000) GS:ffff889bbcf80000(0000) knlGS:0000000000000000\n[  197.749659] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  197.755459] CR2: 00007f16c1b42734 CR3: 0000000004814000 CR4: 0000000000350ee0\n[  197.762656] Call Trace:\n[  197.765127]  \u003cIRQ\u003e\n[  197.767162]  pm8001_ccb_task_free+0x5f1/0x820 [pm80xx]\n[  197.772364]  ? do_raw_spin_unlock+0x54/0x220\n[  197.776680]  pm8001_mpi_task_abort_resp+0x2ce/0x4f0 [pm80xx]\n[  197.782406]  process_oq+0xe85/0x7890 [pm80xx]\n[  197.786817]  ? lock_acquire+0x194/0x490\n[  197.790697]  ? handle_irq_event+0x10e/0x1b0\n[  197.794920]  ? mpi_sata_completion+0x2d70/0x2d70 [pm80xx]\n[  197.800378]  ? __wake_up_bit+0x100/0x100\n[  197.804340]  ? lock_is_held_type+0x98/0x110\n[  197.808565]  pm80xx_chip_isr+0x94/0x130 [pm80xx]\n[  197.813243]  tasklet_action_common.constprop.0+0x24b/0x2f0\n[  197.818785]  __do_softirq+0x1b5/0x82d\n[  197.822485]  ? do_raw_spin_unlock+0x54/0x220\n[  197.826799]  __irq_exit_rcu+0x17e/0x1e0\n[  197.830678]  irq_exit_rcu+0xa/0x20\n[  197.834114]  common_interrupt+0x78/0x90\n[  197.840051]  \u003c/IRQ\u003e\n[  197.844236]  \u003cTASK\u003e\n[  197.848397]  asm_common_interrupt+0x1e/0x40\n\nAvoid this issue by always initializing the ccb n_elem field to 0 in\npm8001_send_abort_all(), pm8001_send_read_log() and\npm80xx_send_abort_all().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ee519dd-01c5-4f6e-95b1-1792ef719c23",
      "id": "CVE-2022-49430",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: gpio-keys - cancel delayed work only in case of GPIO\n\ngpio_keys module can either accept gpios or interrupts. The module\ninitializes delayed work in case of gpios only and is only used if\ndebounce timer is not used, so make sure cancel_delayed_work_sync()\nis called only when its gpio-backed and debounce_use_hrtimer is false.\n\nThis fixes the issue seen below when the gpio_keys module is unloaded and\nan interrupt pin is used instead of GPIO:\n\n[  360.297569] ------------[ cut here ]------------\n[  360.302303] WARNING: CPU: 0 PID: 237 at kernel/workqueue.c:3066 __flush_work+0x414/0x470\n[  360.310531] Modules linked in: gpio_keys(-)\n[  360.314797] CPU: 0 PID: 237 Comm: rmmod Not tainted 5.18.0-rc5-arm64-renesas-00116-g73636105874d-dirty #166\n[  360.324662] Hardware name: Renesas SMARC EVK based on r9a07g054l2 (DT)\n[  360.331270] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  360.338318] pc : __flush_work+0x414/0x470\n[  360.342385] lr : __cancel_work_timer+0x140/0x1b0\n[  360.347065] sp : ffff80000a7fba00\n[  360.350423] x29: ffff80000a7fba00 x28: ffff000012b9c5c0 x27: 0000000000000000\n[  360.357664] x26: ffff80000a7fbb80 x25: ffff80000954d0a8 x24: 0000000000000001\n[  360.364904] x23: ffff800009757000 x22: 0000000000000000 x21: ffff80000919b000\n[  360.372143] x20: ffff00000f5974e0 x19: ffff00000f5974e0 x18: ffff8000097fcf48\n[  360.379382] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000053f40\n[  360.386622] x14: ffff800009850e88 x13: 0000000000000002 x12: 000000000000a60c\n[  360.393861] x11: 000000000000a610 x10: 0000000000000000 x9 : 0000000000000008\n[  360.401100] x8 : 0101010101010101 x7 : 00000000a473c394 x6 : 0080808080808080\n[  360.408339] x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80000919b458\n[  360.415578] x2 : ffff8000097577f0 x1 : 0000000000000001 x0 : 0000000000000000\n[  360.422818] Call trace:\n[  360.425299]  __flush_work+0x414/0x470\n[  360.429012]  __cancel_work_timer+0x140/0x1b0\n[  360.433340]  cancel_delayed_work_sync+0x10/0x18\n[  360.437931]  gpio_keys_quiesce_key+0x28/0x58 [gpio_keys]\n[  360.443327]  devm_action_release+0x10/0x18\n[  360.447481]  release_nodes+0x8c/0x1a0\n[  360.451194]  devres_release_all+0x90/0x100\n[  360.455346]  device_unbind_cleanup+0x14/0x60\n[  360.459677]  device_release_driver_internal+0xe8/0x168\n[  360.464883]  driver_detach+0x4c/0x90\n[  360.468509]  bus_remove_driver+0x54/0xb0\n[  360.472485]  driver_unregister+0x2c/0x58\n[  360.476462]  platform_driver_unregister+0x10/0x18\n[  360.481230]  gpio_keys_exit+0x14/0x828 [gpio_keys]\n[  360.486088]  __arm64_sys_delete_module+0x1e0/0x270\n[  360.490945]  invoke_syscall+0x40/0xf8\n[  360.494661]  el0_svc_common.constprop.3+0xf0/0x110\n[  360.499515]  do_el0_svc+0x20/0x78\n[  360.502877]  el0_svc+0x48/0xf8\n[  360.505977]  el0t_64_sync_handler+0x88/0xb0\n[  360.510216]  el0t_64_sync+0x148/0x14c\n[  360.513930] irq event stamp: 4306\n[  360.517288] hardirqs last  enabled at (4305): [\u003cffff8000080b0300\u003e] __cancel_work_timer+0x130/0x1b0\n[  360.526359] hardirqs last disabled at (4306): [\u003cffff800008d194fc\u003e] el1_dbg+0x24/0x88\n[  360.534204] softirqs last  enabled at (4278): [\u003cffff8000080104a0\u003e] _stext+0x4a0/0x5e0\n[  360.542133] softirqs last disabled at (4267): [\u003cffff8000080932ac\u003e] irq_exit_rcu+0x18c/0x1b0\n[  360.550591] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "396f79f2-f168-45c3-8eb2-81e9ff06c58e",
      "id": "CVE-2022-49502",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rga: fix possible memory leak in rga_probe\n\nrga-\u003em2m_dev needs to be freed when rga_probe fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e92e805-e187-4445-afed-a50913a299aa",
      "id": "CVE-2022-49647",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: Use separate src/dst nodes when preloading css_sets for migration\n\nEach cset (css_set) is pinned by its tasks. When we're moving tasks around\nacross csets for a migration, we need to hold the source and destination\ncsets to ensure that they don't go away while we're moving tasks about. This\nis done by linking cset-\u003emg_preload_node on either the\nmgctx-\u003epreloaded_src_csets or mgctx-\u003epreloaded_dst_csets list. Using the\nsame cset-\u003emg_preload_node for both the src and dst lists was deemed okay as\na cset can't be both the source and destination at the same time.\n\nUnfortunately, this overloading becomes problematic when multiple tasks are\ninvolved in a migration and some of them are identity noop migrations while\nothers are actually moving across cgroups. For example, this can happen with\nthe following sequence on cgroup1:\n\n #1\u003e mkdir -p /sys/fs/cgroup/misc/a/b\n #2\u003e echo $$ \u003e /sys/fs/cgroup/misc/a/cgroup.procs\n #3\u003e RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS \u0026\n #4\u003e PID=$!\n #5\u003e echo $PID \u003e /sys/fs/cgroup/misc/a/b/tasks\n #6\u003e echo $PID \u003e /sys/fs/cgroup/misc/a/cgroup.procs\n\nthe process including the group leader back into a. In this final migration,\nnon-leader threads would be doing identity migration while the group leader\nis doing an actual one.\n\nAfter #3, let's say the whole process was in cset A, and that after #4, the\nleader moves to cset B. Then, during #6, the following happens:\n\n 1. cgroup_migrate_add_src() is called on B for the leader.\n\n 2. cgroup_migrate_add_src() is called on A for the other threads.\n\n 3. cgroup_migrate_prepare_dst() is called. It scans the src list.\n\n 4. It notices that B wants to migrate to A, so it tries to A to the dst\n    list but realizes that its -\u003emg_preload_node is already busy.\n\n 5. and then it notices A wants to migrate to A as it's an identity\n    migration, it culls it by list_del_init()'ing its -\u003emg_preload_node and\n    putting references accordingly.\n\n 6. The rest of migration takes place with B on the src list but nothing on\n    the dst list.\n\nThis means that A isn't held while migration is in progress. If all tasks\nleave A before the migration finishes and the incoming task pins it, the\ncset will be destroyed leading to use-after-free.\n\nThis is caused by overloading cset-\u003emg_preload_node for both src and dst\npreload lists. We wanted to exclude the cset from the src list but ended up\ninadvertently excluding it from the dst list too.\n\nThis patch fixes the issue by separating out cset-\u003emg_preload_node into\n-\u003emg_src_preload_node and -\u003emg_dst_preload_node, so that the src and dst\npreloadings don't interfere with each other.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d924acd-35fa-4b9d-af10-0a16f656b024",
      "id": "CVE-2022-49780",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()\n\nIf device_register() fails in tcm_loop_setup_hba_bus(), the name allocated\nby dev_set_name() need be freed. As comment of device_register() says, it\nshould use put_device() to give up the reference in the error path. So fix\nthis by calling put_device(), then the name can be freed in kobject_cleanup().\nThe 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need\ngoto error label in this case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "513cb601-c74c-4821-baef-f1b5c7030af4",
      "id": "CVE-2022-49846",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix a slab-out-of-bounds write bug in udf_find_entry()\n\nSyzbot reported a slab-out-of-bounds Write bug:\n\nloop0: detected capacity change from 0 to 2048\n==================================================================\nBUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0\nfs/udf/namei.c:253\nWrite of size 105 at addr ffff8880123ff896 by task syz-executor323/3610\n\nCPU: 0 PID: 3610 Comm: syz-executor323 Not tainted\n6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS\nGoogle 10/11/2022\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:284\n print_report+0x107/0x1f0 mm/kasan/report.c:395\n kasan_report+0xcd/0x100 mm/kasan/report.c:495\n kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189\n memcpy+0x3c/0x60 mm/kasan/shadow.c:66\n udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253\n udf_lookup+0xef/0x340 fs/udf/namei.c:309\n lookup_open fs/namei.c:3391 [inline]\n open_last_lookups fs/namei.c:3481 [inline]\n path_openat+0x10e6/0x2df0 fs/namei.c:3710\n do_filp_open+0x264/0x4f0 fs/namei.c:3740\n do_sys_openat2+0x124/0x4e0 fs/open.c:1310\n do_sys_open fs/open.c:1326 [inline]\n __do_sys_creat fs/open.c:1402 [inline]\n __se_sys_creat fs/open.c:1396 [inline]\n __x64_sys_creat+0x11f/0x160 fs/open.c:1396\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7ffab0d164d9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89\nf7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\nf0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffe1a7e6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffab0d164d9\nRDX: 00007ffab0d164d9 RSI: 0000000000000000 RDI: 0000000020000180\nRBP: 00007ffab0cd5a10 R08: 0000000000000000 R09: 0000000000000000\nR10: 00005555573552c0 R11: 0000000000000246 R12: 00007ffab0cd5aa0\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n \u003c/TASK\u003e\n\nAllocated by task 3610:\n kasan_save_stack mm/kasan/common.c:45 [inline]\n kasan_set_track+0x3d/0x60 mm/kasan/common.c:52\n ____kasan_kmalloc mm/kasan/common.c:371 [inline]\n __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380\n kmalloc include/linux/slab.h:576 [inline]\n udf_find_entry+0x7b6/0x14f0 fs/udf/namei.c:243\n udf_lookup+0xef/0x340 fs/udf/namei.c:309\n lookup_open fs/namei.c:3391 [inline]\n open_last_lookups fs/namei.c:3481 [inline]\n path_openat+0x10e6/0x2df0 fs/namei.c:3710\n do_filp_open+0x264/0x4f0 fs/namei.c:3740\n do_sys_openat2+0x124/0x4e0 fs/open.c:1310\n do_sys_open fs/open.c:1326 [inline]\n __do_sys_creat fs/open.c:1402 [inline]\n __se_sys_creat fs/open.c:1396 [inline]\n __x64_sys_creat+0x11f/0x160 fs/open.c:1396\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe buggy address belongs to the object at ffff8880123ff800\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 150 bytes inside of\n 256-byte region [ffff8880123ff800, ffff8880123ff900)\n\nThe buggy address belongs to the physical page:\npage:ffffea000048ff80 refcount:1 mapcount:0 mapping:0000000000000000\nindex:0x0 pfn:0x123fe\nhead:ffffea000048ff80 order:1 compound_mapcount:0 compound_pincount:0\nflags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)\nraw: 00fff00000010200 ffffea00004b8500 dead000000000003 ffff888012041b40\nraw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\npage_owner tracks the page as allocated\npage last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(),\npid 1, tgid 1 (swapper/0), ts 1841222404, free_ts 0\n create_dummy_stack mm/page_owner.c:\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81670eea-fd95-4ac3-b9e7-c159ca63d54e",
      "id": "CVE-2022-50023",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-axi-dmac: ignore interrupt if no descriptor\n\nIf the channel has no descriptor and the interrupt is raised then the\nkernel will OOPS. Check the result of vchan_next_desc() in the handler\naxi_chan_block_xfer_complete() to avoid the error happening.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8f9417a-09d4-4cbb-b52a-5210ea6f5302",
      "id": "CVE-2024-26901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndo_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak\n\nsyzbot identified a kernel information leak vulnerability in\ndo_sys_name_to_handle() and issued the following report [1].\n\n[1]\n\"BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n _copy_to_user+0xbc/0x100 lib/usercopy.c:40\n copy_to_user include/linux/uaccess.h:191 [inline]\n do_sys_name_to_handle fs/fhandle.c:73 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\n\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n __do_kmalloc_node mm/slab_common.c:1006 [inline]\n __kmalloc+0x121/0x3c0 mm/slab_common.c:1020\n kmalloc include/linux/slab.h:604 [inline]\n do_sys_name_to_handle fs/fhandle.c:39 [inline]\n __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]\n __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94\n __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94\n ...\n\nBytes 18-19 of 20 are uninitialized\nMemory access of size 20 starts at ffff888128a46380\nData copied to user address 0000000020000240\"\n\nPer Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to\nsolve the problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "755791c9-e336-4bf8-b525-4702aa29ecfb",
      "id": "CVE-2022-50097",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: s3fb: Check the size of screen before memset_io()\n\nIn the function s3fb_set_par(), the value of 'screen_size' is\ncalculated by the user input. If the user provides the improper value,\nthe value of 'screen_size' may larger than 'info-\u003escreen_size', which\nmay cause the following bug:\n\n[   54.083733] BUG: unable to handle page fault for address: ffffc90003000000\n[   54.083742] #PF: supervisor write access in kernel mode\n[   54.083744] #PF: error_code(0x0002) - not-present page\n[   54.083760] RIP: 0010:memset_orig+0x33/0xb0\n[   54.083782] Call Trace:\n[   54.083788]  s3fb_set_par+0x1ec6/0x4040\n[   54.083806]  fb_set_var+0x604/0xeb0\n[   54.083836]  do_fb_ioctl+0x234/0x670\n\nFix the this by checking the value of 'screen_size' before memset_io().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9dd94d52-edab-467a-85c5-5f4a618d99ff",
      "id": "CVE-2022-50313",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix order \u003e= MAX_ORDER warning due to crafted negative i_size\n\nAs syzbot reported [1], the root cause is that i_size field is a\nsigned type, and negative i_size is also less than EROFS_BLKSIZ.\nAs a consequence, it's handled as fast symlink unexpectedly.\n\nLet's fall back to the generic path to deal with such unusual i_size.\n\n[1] https://lore.kernel.org/r/000000000000ac8efa05e7feaa1f@google.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c898f8c0-01e4-4fe3-91c2-1a6c6aa4cc69",
      "id": "CVE-2022-50381",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix a crash in mempool_free\n\nThere's a crash in mempool_free when running the lvm test\nshell/lvchange-rebuild-raid.sh.\n\nThe reason for the crash is this:\n* super_written calls atomic_dec_and_test(\u0026mddev-\u003epending_writes) and\n  wake_up(\u0026mddev-\u003esb_wait). Then it calls rdev_dec_pending(rdev, mddev)\n  and bio_put(bio).\n* so, the process that waited on sb_wait and that is woken up is racing\n  with bio_put(bio).\n* if the process wins the race, it calls bioset_exit before bio_put(bio)\n  is executed.\n* bio_put(bio) attempts to free a bio into a destroyed bio set - causing\n  a crash in mempool_free.\n\nWe fix this bug by moving bio_put before atomic_dec_and_test.\n\nWe also move rdev_dec_pending before atomic_dec_and_test as suggested by\nNeil Brown.\n\nThe function md_end_flush has a similar bug - we must call bio_put before\nwe decrement the number of in-progress bios.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 11557f0067 P4D 11557f0067 PUD 0\n Oops: 0002 [#1] PREEMPT SMP\n CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\n Workqueue: kdelayd flush_expired_bios [dm_delay]\n RIP: 0010:mempool_free+0x47/0x80\n Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 \u003c48\u003e 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00\n RSP: 0018:ffff88910036bda8 EFLAGS: 00010093\n RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001\n RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8\n RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900\n R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000\n R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05\n FS:  0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0\n Call Trace:\n  \u003cTASK\u003e\n  clone_endio+0xf4/0x1c0 [dm_mod]\n  clone_endio+0xf4/0x1c0 [dm_mod]\n  __submit_bio+0x76/0x120\n  submit_bio_noacct_nocheck+0xb6/0x2a0\n  flush_expired_bios+0x28/0x2f [dm_delay]\n  process_one_work+0x1b4/0x300\n  worker_thread+0x45/0x3e0\n  ? rescuer_thread+0x380/0x380\n  kthread+0xc2/0x100\n  ? kthread_complete_and_exit+0x20/0x20\n  ret_from_fork+0x1f/0x30\n  \u003c/TASK\u003e\n Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd]\n CR2: 0000000000000000\n ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b72d513f-63ac-4a13-822c-813eb1782977",
      "id": "CVE-2023-1582",
      "description": "A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f401714a-c567-440e-981b-25befebc001a",
      "id": "CVE-2023-3358",
      "description": "A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd9af91d-a011-4833-b551-87b8a4130168",
      "id": "CVE-2023-4244",
      "description": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nDue to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.\n\nWe recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ceebe6ac-915b-4988-88e9-b94bceed7d73",
      "id": "CVE-2023-52528",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg\n\nsyzbot reported the following uninit-value access issue:\n\n=====================================================\nBUG: KMSAN: uninit-value in smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline]\nBUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482\nCPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x21c/0x280 lib/dump_stack.c:118\n kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121\n __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215\n smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline]\n smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482\n usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737\n usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374\n really_probe+0xf20/0x20b0 drivers/base/dd.c:529\n driver_probe_device+0x293/0x390 drivers/base/dd.c:701\n __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807\n bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431\n __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:920\n bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491\n device_add+0x3b0e/0x40d0 drivers/base/core.c:2680\n usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032\n usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241\n usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272\n really_probe+0xf20/0x20b0 drivers/base/dd.c:529\n driver_probe_device+0x293/0x390 drivers/base/dd.c:701\n __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807\n bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431\n __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:920\n bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491\n device_add+0x3b0e/0x40d0 drivers/base/core.c:2680\n usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554\n hub_port_connect drivers/usb/core/hub.c:5208 [inline]\n hub_port_connect_change drivers/usb/core/hub.c:5348 [inline]\n port_event drivers/usb/core/hub.c:5494 [inline]\n hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576\n process_one_work+0x1688/0x2140 kernel/workqueue.c:2269\n worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415\n kthread+0x551/0x590 kernel/kthread.c:292\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293\n\nLocal variable ----buf.i87@smsc75xx_bind created at:\n __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline]\n smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline]\n smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482\n __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline]\n smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline]\n smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482\n\nThis issue is caused because usbnet_read_cmd() reads less bytes than requested\n(zero byte in the reproducer). In this case, 'buf' is not properly filled.\n\nThis patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads\nless bytes than requested.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a95b828-cd1b-4d2b-8b57-1b4a184beac9",
      "id": "CVE-2024-42252",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclosures: Change BUG_ON() to WARN_ON()\n\nIf a BUG_ON() can be hit in the wild, it shouldn't be a BUG_ON()\n\nFor reference, this has popped up once in the CI, and we'll need more\ninfo to debug it:\n\n03240 ------------[ cut here ]------------\n03240 kernel BUG at lib/closure.c:21!\n03240 kernel BUG at lib/closure.c:21!\n03240 Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n03240 Modules linked in:\n03240 CPU: 15 PID: 40534 Comm: kworker/u80:1 Not tainted 6.10.0-rc4-ktest-ga56da69799bd #25570\n03240 Hardware name: linux,dummy-virt (DT)\n03240 Workqueue: btree_update btree_interior_update_work\n03240 pstate: 00001005 (nzcv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)\n03240 pc : closure_put+0x224/0x2a0\n03240 lr : closure_put+0x24/0x2a0\n03240 sp : ffff0000d12071c0\n03240 x29: ffff0000d12071c0 x28: dfff800000000000 x27: ffff0000d1207360\n03240 x26: 0000000000000040 x25: 0000000000000040 x24: 0000000000000040\n03240 x23: ffff0000c1f20180 x22: 0000000000000000 x21: ffff0000c1f20168\n03240 x20: 0000000040000000 x19: ffff0000c1f20140 x18: 0000000000000001\n03240 x17: 0000000000003aa0 x16: 0000000000003ad0 x15: 1fffe0001c326974\n03240 x14: 0000000000000a1e x13: 0000000000000000 x12: 1fffe000183e402d\n03240 x11: ffff6000183e402d x10: dfff800000000000 x9 : ffff6000183e402e\n03240 x8 : 0000000000000001 x7 : 00009fffe7c1bfd3 x6 : ffff0000c1f2016b\n03240 x5 : ffff0000c1f20168 x4 : ffff6000183e402e x3 : ffff800081391954\n03240 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 00000000a8000000\n03240 Call trace:\n03240  closure_put+0x224/0x2a0\n03240  bch2_check_for_deadlock+0x910/0x1028\n03240  bch2_six_check_for_deadlock+0x1c/0x30\n03240  six_lock_slowpath.isra.0+0x29c/0xed0\n03240  six_lock_ip_waiter+0xa8/0xf8\n03240  __bch2_btree_node_lock_write+0x14c/0x298\n03240  bch2_trans_lock_write+0x6d4/0xb10\n03240  __bch2_trans_commit+0x135c/0x5520\n03240  btree_interior_update_work+0x1248/0x1c10\n03240  process_scheduled_works+0x53c/0xd90\n03240  worker_thread+0x370/0x8c8\n03240  kthread+0x258/0x2e8\n03240  ret_from_fork+0x10/0x20\n03240 Code: aa1303e0 d63f0020 a94363f7 17ffff8c (d4210000)\n03240 ---[ end trace 0000000000000000 ]---\n03240 Kernel panic - not syncing: Oops - BUG: Fatal exception\n03240 SMP: stopping secondary CPUs\n03241 SMP: failed to stop secondary CPUs 13,15\n03241 Kernel Offset: disabled\n03241 CPU features: 0x00,00000003,80000008,4240500b\n03241 Memory Limit: none\n03241 ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception ]---\n03246 ========= FAILED TIMEOUT copygc_torture_no_checksum in 7200s",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae39b466-f5f5-41d1-9716-23fec2852659",
      "id": "CVE-2023-52625",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Refactor DMCUB enter/exit idle interface\n\n[Why]\nWe can hang in place trying to send commands when the DMCUB isn't\npowered on.\n\n[How]\nWe need to exit out of the idle state prior to sending a command,\nbut the process that performs the exit also invokes a command itself.\n\nFixing this issue involves the following:\n\n1. Using a software state to track whether or not we need to start\n   the process to exit idle or notify idle.\n\nIt's possible for the hardware to have exited an idle state without\ndriver knowledge, but entering one is always restricted to a driver\nallow - which makes the SW state vs HW state mismatch issue purely one\nof optimization, which should seldomly be hit, if at all.\n\n2. Refactor any instances of exit/notify idle to use a single wrapper\n   that maintains this SW state.\n\nThis works simialr to dc_allow_idle_optimizations, but works at the\nDMCUB level and makes sure the state is marked prior to any notify/exit\nidle so we don't enter an infinite loop.\n\n3. Make sure we exit out of idle prior to sending any commands or\n   waiting for DMCUB idle.\n\nThis patch takes care of 1/2. A future patch will take care of wrapping\nDMCUB command submission with calls to this new interface.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3abc6ff1-423a-45ca-b013-f6bc069c2f0b",
      "id": "CVE-2023-52634",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix disable_otg_wa logic\n\n[Why]\nWhen switching to another HDMI mode, we are unnecesarilly\ndisabling/enabling FIFO causing both HPO and DIG registers to be set at\nthe same time when only HPO is supposed to be set.\n\nThis can lead to a system hang the next time we change refresh rates as\nthere are cases when we don't disable OTG/FIFO but FIFO is enabled when\nit isn't supposed to be.\n\n[How]\nRemoving the enable/disable FIFO entirely.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8d3c4f8-8e59-4360-8241-1dffb3ba92b1",
      "id": "CVE-2023-52671",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix hang/underflow when transitioning to ODM4:1\n\n[Why]\nUnder some circumstances, disabling an OPTC and attempting to reclaim\nits OPP(s) for a different OPTC could cause a hang/underflow due to OPPs\nnot being properly disconnected from the disabled OPTC.\n\n[How]\nEnsure that all OPPs are unassigned from an OPTC when it gets disabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee3cfebe-9f45-4d58-b22b-a544818284b0",
      "id": "CVE-2023-52784",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: stop the device in bond_setup_by_slave()\n\nCommit 9eed321cde22 (\"net: lapbether: only support ethernet devices\")\nhas been able to keep syzbot away from net/lapb, until today.\n\nIn the following splat [1], the issue is that a lapbether device has\nbeen created on a bonding device without members. Then adding a non\nARPHRD_ETHER member forced the bonding master to change its type.\n\nThe fix is to make sure we call dev_close() in bond_setup_by_slave()\nso that the potential linked lapbether devices (or any other devices\nhaving assumptions on the physical device) are removed.\n\nA similar bug has been addressed in commit 40baec225765\n(\"bonding: fix panic on non-ARPHRD_ETHER enslave failure\")\n\n[1]\nskbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0\nkernel BUG at net/core/skbuff.c:192 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : skb_panic net/core/skbuff.c:188 [inline]\npc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nlr : skb_panic net/core/skbuff.c:188 [inline]\nlr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nsp : ffff800096a06aa0\nx29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000\nx26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea\nx23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140\nx20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100\nx17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001\nx14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00\nx8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c\nx2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086\nCall trace:\nskb_panic net/core/skbuff.c:188 [inline]\nskb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nskb_push+0xf0/0x108 net/core/skbuff.c:2446\nip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384\ndev_hard_header include/linux/netdevice.h:3136 [inline]\nlapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257\nlapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447\nlapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149\nlapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251\n__lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326\nlapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nlapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nbond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332\nbond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539\ndev_ifsioc+0x754/0x9ac\ndev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786\nsock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217\nsock_ioctl+0x4e8/0x834 net/socket.c:1322\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96b6ff90-4f74-4ee6-a5f0-222e4bfb5bc1",
      "id": "CVE-2023-52845",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Change nla_policy for bearer-related names to NLA_NUL_STRING\n\nsyzbot reported the following uninit-value access issue [1]:\n\n=====================================================\nBUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]\nBUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756\n strlen lib/string.c:418 [inline]\n strstr+0xb8/0x2f0 lib/string.c:756\n tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595\n genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]\n genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066\n netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545\n genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075\n netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]\n netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910\n sock_sendmsg_nosec net/socket.c:730 [inline]\n sock_sendmsg net/socket.c:753 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\n __sys_sendmsg net/socket.c:2624 [inline]\n __do_sys_sendmsg net/socket.c:2633 [inline]\n __se_sys_sendmsg net/socket.c:2631 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUninit was created at:\n slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559\n __alloc_skb+0x318/0x740 net/core/skbuff.c:650\n alloc_skb include/linux/skbuff.h:1286 [inline]\n netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]\n netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885\n sock_sendmsg_nosec net/socket.c:730 [inline]\n sock_sendmsg net/socket.c:753 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595\n __sys_sendmsg net/socket.c:2624 [inline]\n __do_sys_sendmsg net/socket.c:2633 [inline]\n __se_sys_sendmsg net/socket.c:2631 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nTIPC bearer-related names including link names must be null-terminated\nstrings. If a link name which is not null-terminated is passed through\nnetlink, strstr() and similar functions can cause buffer overrun. This\ncauses the above issue.\n\nThis patch changes the nla_policy for bearer-related names from NLA_STRING\nto NLA_NUL_STRING. This resolves the issue by ensuring that only\nnull-terminated strings are accepted as bearer-related names.\n\nsyzbot reported similar uninit-value issue related to bearer names [2]. The\nroot cause of this issue is that a non-null-terminated bearer name was\npassed. This patch also resolved this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06361a69-e461-4323-a2e5-d338b936e6ea",
      "id": "CVE-2023-53079",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix steering rules cleanup\n\nvport's mc, uc and multicast rules are not deleted in teardown path when\nEEH happens. Since the vport's promisc settings(uc, mc and all) in\nfirmware are reset after EEH, mlx5 driver will try to delete the above\nrules in the initialization path. This cause kernel crash because these\nsoftware rules are no longer valid.\n\nFix by nullifying these rules right after delete to avoid accessing any dangling\npointers.\n\nCall Trace:\n__list_del_entry_valid+0xcc/0x100 (unreliable)\ntree_put_node+0xf4/0x1b0 [mlx5_core]\ntree_remove_node+0x30/0x70 [mlx5_core]\nmlx5_del_flow_rules+0x14c/0x1f0 [mlx5_core]\nesw_apply_vport_rx_mode+0x10c/0x200 [mlx5_core]\nesw_update_vport_rx_mode+0xb4/0x180 [mlx5_core]\nesw_vport_change_handle_locked+0x1ec/0x230 [mlx5_core]\nesw_enable_vport+0x130/0x260 [mlx5_core]\nmlx5_eswitch_enable_sriov+0x2a0/0x2f0 [mlx5_core]\nmlx5_device_enable_sriov+0x74/0x440 [mlx5_core]\nmlx5_load_one+0x114c/0x1550 [mlx5_core]\nmlx5_pci_resume+0x68/0xf0 [mlx5_core]\neeh_report_resume+0x1a4/0x230\neeh_pe_dev_traverse+0x98/0x170\neeh_handle_normal_event+0x3e4/0x640\neeh_handle_event+0x4c/0x370\neeh_event_handler+0x14c/0x210\nkthread+0x168/0x1b0\nret_from_kernel_thread+0x5c/0x84",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c233e04d-9dc2-420e-8185-28c6bb5813b9",
      "id": "CVE-2023-53114",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix kernel crash during reboot when adapter is in recovery mode\n\nIf the driver detects during probe that firmware is in recovery\nmode then i40e_init_recovery_mode() is called and the rest of\nprobe function is skipped including pci_set_drvdata(). Subsequent\ni40e_shutdown() called during shutdown/reboot dereferences NULL\npointer as pci_get_drvdata() returns NULL.\n\nTo fix call pci_set_drvdata() also during entering to recovery mode.\n\nReproducer:\n1) Lets have i40e NIC with firmware in recovery mode\n2) Run reboot\n\nResult:\n[  139.084698] i40e: Intel(R) Ethernet Connection XL710 Network Driver\n[  139.090959] i40e: Copyright (c) 2013 - 2019 Intel Corporation.\n[  139.108438] i40e 0000:02:00.0: Firmware recovery mode detected. Limiting functionality.\n[  139.116439] i40e 0000:02:00.0: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode.\n[  139.129499] i40e 0000:02:00.0: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a]\n[  139.215932] i40e 0000:02:00.0 enp2s0f0: renamed from eth0\n[  139.223292] i40e 0000:02:00.1: Firmware recovery mode detected. Limiting functionality.\n[  139.231292] i40e 0000:02:00.1: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode.\n[  139.244406] i40e 0000:02:00.1: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a]\n[  139.329209] i40e 0000:02:00.1 enp2s0f1: renamed from eth0\n...\n[  156.311376] BUG: kernel NULL pointer dereference, address: 00000000000006c2\n[  156.318330] #PF: supervisor write access in kernel mode\n[  156.323546] #PF: error_code(0x0002) - not-present page\n[  156.328679] PGD 0 P4D 0\n[  156.331210] Oops: 0002 [#1] PREEMPT SMP NOPTI\n[  156.335567] CPU: 26 PID: 15119 Comm: reboot Tainted: G            E      6.2.0+ #1\n[  156.343126] Hardware name: Abacus electric, s.r.o. - servis@abacus.cz Super Server/H12SSW-iN, BIOS 2.4 04/13/2022\n[  156.353369] RIP: 0010:i40e_shutdown+0x15/0x130 [i40e]\n[  156.358430] Code: c1 fc ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 48 89 fd 53 48 8b 9f 48 01 00 00 \u003cf0\u003e 80 8b c2 06 00 00 04 f0 80 8b c0 06 00 00 08 48 8d bb 08 08 00\n[  156.377168] RSP: 0018:ffffb223c8447d90 EFLAGS: 00010282\n[  156.382384] RAX: ffffffffc073ee70 RBX: 0000000000000000 RCX: 0000000000000001\n[  156.389510] RDX: 0000000080000001 RSI: 0000000000000246 RDI: ffff95db49988000\n[  156.396634] RBP: ffff95db49988000 R08: ffffffffffffffff R09: ffffffff8bd17d40\n[  156.403759] R10: 0000000000000001 R11: ffffffff8a5e3d28 R12: ffff95db49988000\n[  156.410882] R13: ffffffff89a6fe17 R14: ffff95db49988150 R15: 0000000000000000\n[  156.418007] FS:  00007fe7c0cc3980(0000) GS:ffff95ea8ee80000(0000) knlGS:0000000000000000\n[  156.426083] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  156.431819] CR2: 00000000000006c2 CR3: 00000003092fc005 CR4: 0000000000770ee0\n[  156.438944] PKRU: 55555554\n[  156.441647] Call Trace:\n[  156.444096]  \u003cTASK\u003e\n[  156.446199]  pci_device_shutdown+0x38/0x60\n[  156.450297]  device_shutdown+0x163/0x210\n[  156.454215]  kernel_restart+0x12/0x70\n[  156.457872]  __do_sys_reboot+0x1ab/0x230\n[  156.461789]  ? vfs_writev+0xa6/0x1a0\n[  156.465362]  ? __pfx_file_free_rcu+0x10/0x10\n[  156.469635]  ? __call_rcu_common.constprop.85+0x109/0x5a0\n[  156.475034]  do_syscall_64+0x3e/0x90\n[  156.478611]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n[  156.483658] RIP: 0033:0x7fe7bff37ab7",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba6f18ba-c687-4ffe-b8a3-1c3bef7a2ec5",
      "id": "CVE-2023-53292",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix NULL dereference on q-\u003eelevator in blk_mq_elv_switch_none\n\nAfter grabbing q-\u003esysfs_lock, q-\u003eelevator may become NULL because of\nelevator switch.\n\nFix the NULL dereference on q-\u003eelevator by checking it with lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3f6cc74-6d13-4f4a-a882-777719d9a0ab",
      "id": "CVE-2024-43892",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: protect concurrent access to mem_cgroup_idr\n\nCommit 73f576c04b94 (\"mm: memcontrol: fix cgroup creation failure after\nmany small jobs\") decoupled the memcg IDs from the CSS ID space to fix the\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\nspace.  The IDR depends on external synchronization mechanisms for\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\nhappen within css callback and thus are protected through cgroup_mutex\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\nwas not protected against concurrency and can be run concurrently for\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\n\nWe have been seeing list_lru based kernel crashes at a low frequency in\nour fleet for a long time.  These crashes were in different part of\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\ncode.  Upon further inspection, it looked like for a given object (dentry\nand inode), the super_block's list_lru didn't have list_lru_one for the\nmemcg of that object.  The initial suspicions were either the object is\nnot allocated through kmem_cache_alloc_lru() or somehow\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\nreturned success.  No evidence were found for these cases.\n\nLooking more deeply, we started seeing situations where valid memcg's id\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\nreasonable explanation is that these situations can happen due to race\nbetween multiple idr_remove() calls or race between\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\nmultiple memcgs to acquire the same ID and then offlining of one of them\nwould cleanup list_lrus on the system for all of them.  Later access from\nother memcgs to the list_lru cause crashes due to missing list_lru_one.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "182d0d85-7105-4dfc-94c6-e8ea0795bc2b",
      "id": "CVE-2024-43914",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: avoid BUG_ON() while continue reshape after reassembling\n\nCurrently, mdadm support --revert-reshape to abort the reshape while\nreassembling, as the test 07revert-grow. However, following BUG_ON()\ncan be triggerred by the test:\n\nkernel BUG at drivers/md/raid5.c:6278!\ninvalid opcode: 0000 [#1] PREEMPT SMP PTI\nirq event stamp: 158985\nCPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94\nRIP: 0010:reshape_request+0x3f1/0xe60\nCall Trace:\n \u003cTASK\u003e\n raid5_sync_request+0x43d/0x550\n md_do_sync+0xb7a/0x2110\n md_thread+0x294/0x2b0\n kthread+0x147/0x1c0\n ret_from_fork+0x59/0x70\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nRoot cause is that --revert-reshape update the raid_disks from 5 to 4,\nwhile reshape position is still set, and after reassembling the array,\nreshape position will be read from super block, then during reshape the\nchecking of 'writepos' that is caculated by old reshape position will\nfail.\n\nFix this panic the easy way first, by converting the BUG_ON() to\nWARN_ON(), and stop the reshape if checkings fail.\n\nNoted that mdadm must fix --revert-shape as well, and probably md/raid\nshould enhance metadata validation as well, however this means\nreassemble will fail and there must be user tools to fix the wrong\nmetadata.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d6e1200-7bd0-4a52-92fd-8d9b34249c72",
      "id": "CVE-2023-53332",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()\n\nIf ipi_send_{mask|single}() is called with an invalid interrupt number, all\nthe local variables there will be NULL. ipi_send_verify() which is invoked\nfrom these functions does verify its 'data' parameter, resulting in a\nkernel oops in irq_data_get_affinity_mask() as the passed NULL pointer gets\ndereferenced.\n\nAdd a missing NULL pointer check in ipi_send_verify()...\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ccf6048e-5589-44f2-857b-7dab450fcce3",
      "id": "CVE-2023-53441",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: cpumap: Fix memory leak in cpu_map_update_elem\n\nSyzkaller reported a memory leak as follows:\n\nBUG: memory leak\nunreferenced object 0xff110001198ef748 (size 192):\n  comm \"syz-executor.3\", pid 17672, jiffies 4298118891 (age 9.906s)\n  hex dump (first 32 bytes):\n    00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00  ....J...........\n    00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff  ........(.......\n  backtrace:\n    [\u003cffffffffadd28087\u003e] __cpu_map_entry_alloc+0xf7/0xb00\n    [\u003cffffffffadd28d8e\u003e] cpu_map_update_elem+0x2fe/0x3d0\n    [\u003cffffffffadc6d0fd\u003e] bpf_map_update_value.isra.0+0x2bd/0x520\n    [\u003cffffffffadc7349b\u003e] map_update_elem+0x4cb/0x720\n    [\u003cffffffffadc7d983\u003e] __se_sys_bpf+0x8c3/0xb90\n    [\u003cffffffffb029cc80\u003e] do_syscall_64+0x30/0x40\n    [\u003cffffffffb0400099\u003e] entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nBUG: memory leak\nunreferenced object 0xff110001198ef528 (size 192):\n  comm \"syz-executor.3\", pid 17672, jiffies 4298118891 (age 9.906s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffffadd281f0\u003e] __cpu_map_entry_alloc+0x260/0xb00\n    [\u003cffffffffadd28d8e\u003e] cpu_map_update_elem+0x2fe/0x3d0\n    [\u003cffffffffadc6d0fd\u003e] bpf_map_update_value.isra.0+0x2bd/0x520\n    [\u003cffffffffadc7349b\u003e] map_update_elem+0x4cb/0x720\n    [\u003cffffffffadc7d983\u003e] __se_sys_bpf+0x8c3/0xb90\n    [\u003cffffffffb029cc80\u003e] do_syscall_64+0x30/0x40\n    [\u003cffffffffb0400099\u003e] entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nBUG: memory leak\nunreferenced object 0xff1100010fd93d68 (size 8):\n  comm \"syz-executor.3\", pid 17672, jiffies 4298118891 (age 9.906s)\n  hex dump (first 8 bytes):\n    00 00 00 00 00 00 00 00                          ........\n  backtrace:\n    [\u003cffffffffade5db3e\u003e] kvmalloc_node+0x11e/0x170\n    [\u003cffffffffadd28280\u003e] __cpu_map_entry_alloc+0x2f0/0xb00\n    [\u003cffffffffadd28d8e\u003e] cpu_map_update_elem+0x2fe/0x3d0\n    [\u003cffffffffadc6d0fd\u003e] bpf_map_update_value.isra.0+0x2bd/0x520\n    [\u003cffffffffadc7349b\u003e] map_update_elem+0x4cb/0x720\n    [\u003cffffffffadc7d983\u003e] __se_sys_bpf+0x8c3/0xb90\n    [\u003cffffffffb029cc80\u003e] do_syscall_64+0x30/0x40\n    [\u003cffffffffb0400099\u003e] entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nIn the cpu_map_update_elem flow, when kthread_stop is called before\ncalling the threadfn of rcpu-\u003ekthread, since the KTHREAD_SHOULD_STOP bit\nof kthread has been set by kthread_stop, the threadfn of rcpu-\u003ekthread\nwill never be executed, and rcpu-\u003erefcnt will never be 0, which will\nlead to the allocated rcpu, rcpu-\u003equeue and rcpu-\u003equeue-\u003equeue cannot be\nreleased.\n\nCalling kthread_stop before executing kthread's threadfn will return\n-EINTR. We can complete the release of memory resources in this state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1d93a67-db48-4411-8abe-e10bae63487c",
      "id": "CVE-2023-6546",
      "description": "A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84968ae5-a861-44dc-bb95-3c2d7d93bce6",
      "id": "CVE-2023-6915",
      "description": "A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d723f20-d229-4ca3-98bd-277478f61cb9",
      "id": "CVE-2024-0639",
      "description": "A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df1e0542-c537-4170-8906-bc7ab5accbd4",
      "id": "CVE-2024-26685",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential bug in end_buffer_async_write\n\nAccording to a syzbot report, end_buffer_async_write(), which handles the\ncompletion of block device writes, may detect abnormal condition of the\nbuffer async_write flag and cause a BUG_ON failure when using nilfs2.\n\nNilfs2 itself does not use end_buffer_async_write().  But, the async_write\nflag is now used as a marker by commit 7f42ec394156 (\"nilfs2: fix issue\nwith race condition of competition between segments for dirty blocks\") as\na means of resolving double list insertion of dirty blocks in\nnilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the\nresulting crash.\n\nThis modification is safe as long as it is used for file data and b-tree\nnode blocks where the page caches are independent.  However, it was\nirrelevant and redundant to also introduce async_write for segment summary\nand super root blocks that share buffers with the backing device.  This\nled to the possibility that the BUG_ON check in end_buffer_async_write\nwould fail as described above, if independent writebacks of the backing\ndevice occurred in parallel.\n\nThe use of async_write for segment summary buffers has already been\nremoved in a previous change.\n\nFix this issue by removing the manipulation of the async_write flag for\nthe remaining super root block buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c4ca1e3-36d3-4ce4-ad6c-1e6a88b5839a",
      "id": "CVE-2024-26719",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: offload fence uevents work to workqueue\n\nThis should break the deadlock between the fctx lock and the irq lock.\n\nThis offloads the processing off the work from the irq into a workqueue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2291278f-d058-4257-8aa9-a68fbef4e3bf",
      "id": "CVE-2024-27051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value\n\ncpufreq_cpu_get may return NULL. To avoid NULL-dereference check it\nand return 0 in case of error.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ce5425d-1d79-4ba3-8d43-6cffa61a243d",
      "id": "CVE-2024-36006",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix incorrect list API usage\n\nBoth the function that migrates all the chunks within a region and the\nfunction that migrates all the entries within a chunk call\nlist_first_entry() on the respective lists without checking that the\nlists are not empty. This is incorrect usage of the API, which leads to\nthe following warning [1].\n\nFix by returning if the lists are empty as there is nothing to migrate\nin this case.\n\n[1]\nWARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0\u003e\nModules linked in:\nCPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e0afadb-844e-4c32-8f98-624713c9c5d3",
      "id": "CVE-2024-36917",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix overflow in blk_ioctl_discard()\n\nThere is no check for overflow of 'start + len' in blk_ioctl_discard().\nHung task occurs if submit an discard ioctl with the following param:\n  start = 0x80000000000ff000, len = 0x8000000000fff000;\nAdd the overflow validation now.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f137487f-34d7-435b-9da3-74f1945c99e7",
      "id": "CVE-2024-38597",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: sungem: remove .ndo_poll_controller to avoid deadlocks\n\nErhard reports netpoll warnings from sungem:\n\n  netpoll_send_skb_on_dev(): eth0 enabled interrupts in poll (gem_start_xmit+0x0/0x398)\n  WARNING: CPU: 1 PID: 1 at net/core/netpoll.c:370 netpoll_send_skb+0x1fc/0x20c\n\ngem_poll_controller() disables interrupts, which may sleep.\nWe can't sleep in netpoll, it has interrupts disabled completely.\nStrangely, gem_poll_controller() doesn't even poll the completions,\nand instead acts as if an interrupt has fired so it just schedules\nNAPI and exits. None of this has been necessary for years, since\nnetpoll invokes NAPI directly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1ee75de-c998-4435-b589-db2670722434",
      "id": "CVE-2024-40941",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don't read past the mfuart notifcation\n\nIn case the firmware sends a notification that claims it has more data\nthan it has, we will read past that was allocated for the notification.\nRemove the print of the buffer, we won't see it by default. If needed,\nwe can see the content with tracing.\n\nThis was reported by KFENCE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "539be7b8-7901-409d-874b-a9a483187a0d",
      "id": "CVE-2024-40978",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix crash while reading debugfs attribute\n\nThe qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly\non a __user pointer, which results into the crash.\n\nTo fix this issue, use a small local stack buffer for sprintf() and then\ncall simple_read_from_buffer(), which in turns make the copy_to_user()\ncall.\n\nBUG: unable to handle page fault for address: 00007f4801111000\nPGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0\nOops: 0002 [#1] PREEMPT SMP PTI\nHardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023\nRIP: 0010:memcpy_orig+0xcd/0x130\nRSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202\nRAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f\nRDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000\nRBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572\nR10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff\nR13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af\nFS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die_body+0x1a/0x60\n ? page_fault_oops+0x183/0x510\n ? exc_page_fault+0x69/0x150\n ? asm_exc_page_fault+0x22/0x30\n ? memcpy_orig+0xcd/0x130\n vsnprintf+0x102/0x4c0\n sprintf+0x51/0x80\n qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]\n full_proxy_read+0x50/0x80\n vfs_read+0xa5/0x2e0\n ? folio_add_new_anon_rmap+0x44/0xa0\n ? set_pte_at+0x15/0x30\n ? do_pte_missing+0x426/0x7f0\n ksys_read+0xa5/0xe0\n do_syscall_64+0x58/0x80\n ? __count_memcg_events+0x46/0x90\n ? count_memcg_event_mm+0x3d/0x60\n ? handle_mm_fault+0x196/0x2f0\n ? do_user_addr_fault+0x267/0x890\n ? exc_page_fault+0x69/0x150\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7f4800f20b4d",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "962a36dd-ebea-4277-bcc7-3b67c326b8a0",
      "id": "CVE-2024-42144",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data\n\nVerify that lvts_data is not NULL before using it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21fb9bd3-ab0e-42f8-ae59-fcd685bcc038",
      "id": "CVE-2024-45008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: MT - limit max slots\n\nsyzbot is reporting too large allocation at input_mt_init_slots(), for\nnum_slots is supplied from userspace using ioctl(UI_DEV_CREATE).\n\nSince nobody knows possible max slots, this patch chose 1024.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d67e5a60-ca46-4d04-90ab-b8431c19206a",
      "id": "CVE-2024-46745",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - reject requests with unreasonable number of slots\n\n\nWhen exercising uinput interface syzkaller may try setting up device\nwith a really large number of slots, which causes memory allocation\nfailure in input_mt_init_slots(). While this allocation failure is\nhandled properly and request is rejected, it results in syzkaller\nreports. Additionally, such request may put undue burden on the\nsystem which will try to free a lot of memory for a bogus request.\n\nFix it by limiting allowed number of slots to 100. This can easily\nbe extended if we see devices that can track more than 100 contacts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5dfa7204-fb8e-4f07-b7a8-5f5969578ff8",
      "id": "CVE-2024-46759",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (adc128d818) Fix underflows seen when writing limit attributes\n\nDIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large\nnegative number such as -9223372036854775808 is provided by the user.\nFix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e3d2856-e143-4781-ac5f-8fb89d58d441",
      "id": "CVE-2024-46783",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: fix return value of tcp_bpf_sendmsg()\n\nWhen we cork messages in psock-\u003ecork, the last message triggers the\nflushing will result in sending a sk_msg larger than the current\nmessage size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes\nnegative at least in the following case:\n\n468         case __SK_DROP:\n469         default:\n470                 sk_msg_free_partial(sk, msg, tosend);\n471                 sk_msg_apply_bytes(psock, tosend);\n472                 *copied -= (tosend + delta); // \u003c==== HERE\n473                 return -EACCES;\n\nTherefore, it could lead to the following BUG with a proper value of\n'copied' (thanks to syzbot). We should not use negative 'copied' as a\nreturn value here.\n\n  ------------[ cut here ]------------\n  kernel BUG at net/socket.c:733!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0\n  Hardware name: linux,dummy-virt (DT)\n  pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : sock_sendmsg_nosec net/socket.c:733 [inline]\n  pc : sock_sendmsg_nosec net/socket.c:728 [inline]\n  pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745\n  lr : sock_sendmsg_nosec net/socket.c:730 [inline]\n  lr : __sock_sendmsg+0x54/0x60 net/socket.c:745\n  sp : ffff800088ea3b30\n  x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000\n  x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000\n  x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90\n  x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001\n  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0\n  x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000\n  x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef\n  Call trace:\n   sock_sendmsg_nosec net/socket.c:733 [inline]\n   __sock_sendmsg+0x5c/0x60 net/socket.c:745\n   ____sys_sendmsg+0x274/0x2ac net/socket.c:2597\n   ___sys_sendmsg+0xac/0x100 net/socket.c:2651\n   __sys_sendmsg+0x84/0xe0 net/socket.c:2680\n   __do_sys_sendmsg net/socket.c:2689 [inline]\n   __se_sys_sendmsg net/socket.c:2687 [inline]\n   __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687\n   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n   invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49\n   el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132\n   do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151\n   el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712\n   el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730\n   el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598\n  Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)\n  ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfe0d66f-574a-48a7-8115-21e93ef8fe23",
      "id": "CVE-2024-46853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: nxp-fspi: fix the KASAN report out-of-bounds bug\n\nChange the memcpy length to fix the out-of-bounds issue when writing the\ndata that is not 4 byte aligned to TX FIFO.\n\nTo reproduce the issue, write 3 bytes data to NOR chip.\n\ndd if=3b of=/dev/mtd0\n[   36.926103] ==================================================================\n[   36.933409] BUG: KASAN: slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838\n[   36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455\n[   36.946721]\n[   36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070\n[   36.956185] Hardware name: Freescale i.MX8QM MEK (DT)\n[   36.961260] Call trace:\n[   36.963723]  dump_backtrace+0x90/0xe8\n[   36.967414]  show_stack+0x18/0x24\n[   36.970749]  dump_stack_lvl+0x78/0x90\n[   36.974451]  print_report+0x114/0x5cc\n[   36.978151]  kasan_report+0xa4/0xf0\n[   36.981670]  __asan_report_load_n_noabort+0x1c/0x28\n[   36.986587]  nxp_fspi_exec_op+0x26ec/0x2838\n[   36.990800]  spi_mem_exec_op+0x8ec/0xd30\n[   36.994762]  spi_mem_no_dirmap_read+0x190/0x1e0\n[   36.999323]  spi_mem_dirmap_write+0x238/0x32c\n[   37.003710]  spi_nor_write_data+0x220/0x374\n[   37.007932]  spi_nor_write+0x110/0x2e8\n[   37.011711]  mtd_write_oob_std+0x154/0x1f0\n[   37.015838]  mtd_write_oob+0x104/0x1d0\n[   37.019617]  mtd_write+0xb8/0x12c\n[   37.022953]  mtdchar_write+0x224/0x47c\n[   37.026732]  vfs_write+0x1e4/0x8c8\n[   37.030163]  ksys_write+0xec/0x1d0\n[   37.033586]  __arm64_sys_write+0x6c/0x9c\n[   37.037539]  invoke_syscall+0x6c/0x258\n[   37.041327]  el0_svc_common.constprop.0+0x160/0x22c\n[   37.046244]  do_el0_svc+0x44/0x5c\n[   37.049589]  el0_svc+0x38/0x78\n[   37.052681]  el0t_64_sync_handler+0x13c/0x158\n[   37.057077]  el0t_64_sync+0x190/0x194\n[   37.060775]\n[   37.062274] Allocated by task 455:\n[   37.065701]  kasan_save_stack+0x2c/0x54\n[   37.069570]  kasan_save_track+0x20/0x3c\n[   37.073438]  kasan_save_alloc_info+0x40/0x54\n[   37.077736]  __kasan_kmalloc+0xa0/0xb8\n[   37.081515]  __kmalloc_noprof+0x158/0x2f8\n[   37.085563]  mtd_kmalloc_up_to+0x120/0x154\n[   37.089690]  mtdchar_write+0x130/0x47c\n[   37.093469]  vfs_write+0x1e4/0x8c8\n[   37.096901]  ksys_write+0xec/0x1d0\n[   37.100332]  __arm64_sys_write+0x6c/0x9c\n[   37.104287]  invoke_syscall+0x6c/0x258\n[   37.108064]  el0_svc_common.constprop.0+0x160/0x22c\n[   37.112972]  do_el0_svc+0x44/0x5c\n[   37.116319]  el0_svc+0x38/0x78\n[   37.119401]  el0t_64_sync_handler+0x13c/0x158\n[   37.123788]  el0t_64_sync+0x190/0x194\n[   37.127474]\n[   37.128977] The buggy address belongs to the object at ffff00081037c2a0\n[   37.128977]  which belongs to the cache kmalloc-8 of size 8\n[   37.141177] The buggy address is located 0 bytes inside of\n[   37.141177]  allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3)\n[   37.153465]\n[   37.154971] The buggy address belongs to the physical page:\n[   37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c\n[   37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff)\n[   37.175149] page_type: 0xfdffffff(slab)\n[   37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000\n[   37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000\n[   37.194553] page dumped because: kasan: bad access detected\n[   37.200144]\n[   37.201647] Memory state around the buggy address:\n[   37.206460]  ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc\n[   37.213701]  ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc\n[   37.220946] \u003effff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc\n[   37.228186]                                ^\n[   37.232473]  ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   37.239718]  ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   37.246962] ==============================================================\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a96cc7fa-2d75-46a1-8391-0a3338f19cbc",
      "id": "CVE-2024-47660",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: clear PARENT_WATCHED flags lazily\n\nIn some setups directories can have many (usually negative) dentries.\nHence __fsnotify_update_child_dentry_flags() function can take a\nsignificant amount of time. Since the bulk of this function happens\nunder inode-\u003ei_lock this causes a significant contention on the lock\nwhen we remove the watch from the directory as the\n__fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask()\nraces with __fsnotify_update_child_dentry_flags() calls from\n__fsnotify_parent() happening on children. This can lead upto softlockup\nreports reported by users.\n\nFix the problem by calling fsnotify_update_children_dentry_flags() to\nset PARENT_WATCHED flags only when parent starts watching children.\n\nWhen parent stops watching children, clear false positive PARENT_WATCHED\nflags lazily in __fsnotify_parent() for each accessed child.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4bc7333-b4d8-4647-8853-9102fe362613",
      "id": "CVE-2024-47674",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid leaving partial pfn mappings around in error case\n\nAs Jann points out, PFN mappings are special, because unlike normal\nmemory mappings, there is no lifetime information associated with the\nmapping - it is just a raw mapping of PFNs with no reference counting of\na 'struct page'.\n\nThat's all very much intentional, but it does mean that it's easy to\nmess up the cleanup in case of errors.  Yes, a failed mmap() will always\neventually clean up any partial mappings, but without any explicit\nlifetime in the page table mapping itself, it's very easy to do the\nerror handling in the wrong order.\n\nIn particular, it's easy to mistakenly free the physical backing store\nbefore the page tables are actually cleaned up and (temporarily) have\nstale dangling PTE entries.\n\nTo make this situation less error-prone, just make sure that any partial\npfn mapping is torn down early, before any other error handling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19a49e34-fe41-4781-a043-4863e420680f",
      "id": "CVE-2024-47685",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()\n\nsyzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending\ngarbage on the four reserved tcp bits (th-\u003eres1)\n\nUse skb_put_zero() to clear the whole TCP header,\nas done in nf_reject_ip_tcphdr_put()\n\nBUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255\n  nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255\n  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344\n  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48\n  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288\n  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n  nf_hook include/linux/netfilter.h:269 [inline]\n  NF_HOOK include/linux/netfilter.h:312 [inline]\n  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]\n  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775\n  process_backlog+0x4ad/0xa50 net/core/dev.c:6108\n  __napi_poll+0xe7/0x980 net/core/dev.c:6772\n  napi_poll net/core/dev.c:6841 [inline]\n  net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963\n  handle_softirqs+0x1ce/0x800 kernel/softirq.c:554\n  __do_softirq+0x14/0x1a kernel/softirq.c:588\n  do_softirq+0x9a/0x100 kernel/softirq.c:455\n  __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\n  rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline]\n  __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450\n  dev_queue_xmit include/linux/netdevice.h:3105 [inline]\n  neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565\n  neigh_output include/net/neighbour.h:542 [inline]\n  ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141\n  __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]\n  ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226\n  NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n  ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247\n  dst_output include/net/dst.h:450 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366\n  inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135\n  __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466\n  tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline]\n  tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143\n  tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333\n  __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679\n  inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750\n  __sys_connect_file net/socket.c:2061 [inline]\n  __sys_connect+0x606/0x690 net/socket.c:2078\n  __do_sys_connect net/socket.c:2088 [inline]\n  __se_sys_connect net/socket.c:2085 [inline]\n  __x64_sys_connect+0x91/0xe0 net/socket.c:2085\n  x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was stored to memory at:\n  nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249\n  nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344\n  nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48\n  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n  nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288\n  nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n  nf_hook include/linux/netfilter.h:269 [inline]\n  NF_HOOK include/linux/netfilter.h:312 [inline]\n  ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "da3cfb80-e906-482e-8370-b83722892819",
      "id": "CVE-2024-47726",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to wait dio completion\n\nIt should wait all existing dio write IOs before block removal,\notherwise, previous direct write IO may overwrite data in the\nblock which may be reused by other inode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45b40cf4-2abf-41ed-a8a5-07a44cee568c",
      "id": "CVE-2024-49889",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid use-after-free in ext4_ext_show_leaf()\n\nIn ext4_find_extent(), path may be freed by error or be reallocated, so\nusing a previously saved *ppath may have been freed and thus may trigger\nuse-after-free, as follows:\n\next4_split_extent\n  path = *ppath;\n  ext4_split_extent_at(ppath)\n  path = ext4_find_extent(ppath)\n  ext4_split_extent_at(ppath)\n    // ext4_find_extent fails to free path\n    // but zeroout succeeds\n  ext4_ext_show_leaf(inode, path)\n    eh = path[depth].p_hdr\n    // path use-after-free !!!\n\nSimilar to ext4_split_extent_at(), we use *ppath directly as an input to\next4_ext_show_leaf(). Fix a spelling error by the way.\n\nSame problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only\nused in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.\n\nThis issue is triggered only when EXT_DEBUG is defined and therefore does\nnot affect functionality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f808e286-63f9-4c37-a642-cdaecfad25bd",
      "id": "CVE-2024-49994",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix integer overflow in BLKSECDISCARD\n\nI independently rediscovered\n\n\tcommit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155\n\tblock: fix overflow in blk_ioctl_discard()\n\nbut for secure erase.\n\nSame problem:\n\n\tuint64_t r[2] = {512, 18446744073709551104ULL};\n\tioctl(fd, BLKSECDISCARD, r);\n\nwill enter near infinite loop inside blkdev_issue_secure_erase():\n\n\ta.out: attempt to access beyond end of device\n\tloop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048\n\tbio_check_eod: 3286214 callbacks suppressed",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be10028f-f5cd-4e8a-9083-c264170f91e1",
      "id": "CVE-2024-50055",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: bus: Fix double free in driver API bus_register()\n\nFor bus_register(), any error which happens after kset_register() will\ncause that @priv are freed twice, fixed by setting @priv with NULL after\nthe first free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af4d563b-4ef0-4861-b193-9e8fc11a16ed",
      "id": "CVE-2024-50285",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: check outstanding simultaneous SMB operations\n\nIf Client send simultaneous SMB operations to ksmbd, It exhausts too much\nmemory through the \"ksmbd_work_cache”. It will cause OOM issue.\nksmbd has a credit mechanism but it can't handle this problem. This patch\nadd the check if it exceeds max credits to prevent this problem by assuming\nthat one smb request consumes at least one credit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2ec0a69-12a5-4003-86b1-3d45a996b801",
      "id": "CVE-2025-38208",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: add NULL check in automount_fullpath\n\npage is checked for null in __build_path_from_dentry_optional_prefix\nwhen tcon-\u003eorigin_fullpath is not set. However, the check is missing when\nit is set.\nAdd a check to prevent a potential NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b43d92bf-6818-4e03-aa23-0662aaefe3b5",
      "id": "CVE-2024-53059",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()\n\n1. The size of the response packet is not validated.\n2. The response buffer is not freed.\n\nResolve these issues by switching to iwl_mvm_send_cmd_status(),\nwhich handles both size validation and frees the buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0deddc3f-374a-4c58-8fcc-4f58254faf6f",
      "id": "CVE-2024-56533",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: Use snd_card_free_when_closed() at disconnection\n\nThe USB disconnect callback is supposed to be short and not too-long\nwaiting.  OTOH, the current code uses snd_card_free() at\ndisconnection, but this waits for the close of all used fds, hence it\ncan take long.  It eventually blocks the upper layer USB ioctls, which\nmay trigger a soft lockup.\n\nAn easy workaround is to replace snd_card_free() with\nsnd_card_free_when_closed().  This variant returns immediately while\nthe release of resources is done asynchronously by the card device\nrelease at the last close.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab65103f-7be9-4176-835d-c2e2bcee146f",
      "id": "CVE-2024-56692",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on node blkaddr in truncate_node()\n\nsyzbot reports a f2fs bug as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2534!\nRIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534\nCall Trace:\n truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909\n f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288\n f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856\n evict+0x4e8/0x9b0 fs/inode.c:723\n f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986\n f2fs_create+0x357/0x530 fs/f2fs/namei.c:394\n lookup_open fs/namei.c:3595 [inline]\n open_last_lookups fs/namei.c:3694 [inline]\n path_openat+0x1c03/0x3590 fs/namei.c:3930\n do_filp_open+0x235/0x490 fs/namei.c:3960\n do_sys_openat2+0x13e/0x1d0 fs/open.c:1415\n do_sys_open fs/open.c:1430 [inline]\n __do_sys_openat fs/open.c:1446 [inline]\n __se_sys_openat fs/open.c:1441 [inline]\n __x64_sys_openat+0x247/0x2a0 fs/open.c:1441\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534\n\nThe root cause is: on a fuzzed image, blkaddr in nat entry may be\ncorrupted, then it will cause system panic when using it in\nf2fs_invalidate_blocks(), to avoid this, let's add sanity check on\nnat blkaddr in truncate_node().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8435c1e7-375a-432e-ba21-10541ed9db2c",
      "id": "CVE-2024-56769",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg\n\nSyzbot reports [1] an uninitialized value issue found by KMSAN in\ndib3000_read_reg().\n\nLocal u8 rb[2] is used in i2c_transfer() as a read buffer; in case\nthat call fails, the buffer may end up with some undefined values.\n\nSince no elaborate error handling is expected in dib3000_write_reg(),\nsimply zero out rb buffer to mitigate the problem.\n\n[1] Syzkaller report\ndvb-usb: bulk message failed: -22 (6/0)\n=====================================================\nBUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31\n dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290\n dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]\n dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]\n dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310\n dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110\n...\nLocal variable rb created at:\n dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54\n dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84173e39-5b8a-4268-be3a-1c94aed48a3e",
      "id": "CVE-2025-21678",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: Destroy device along with udp socket's netns dismantle.\n\ngtp_newlink() links the device to a list in dev_net(dev) instead of\nsrc_net, where a udp tunnel socket is created.\n\nEven when src_net is removed, the device stays alive on dev_net(dev).\nThen, removing src_net triggers the splat below. [0]\n\nIn this example, gtp0 is created in ns2, and the udp socket is created\nin ns1.\n\n  ip netns add ns1\n  ip netns add ns2\n  ip -n ns1 link add netns ns2 name gtp0 type gtp role sgsn\n  ip netns del ns1\n\nLet's link the device to the socket's netns instead.\n\nNow, gtp_net_exit_batch_rtnl() needs another netdev iteration to remove\nall gtp devices in the netns.\n\n[0]:\nref_tracker: net notrefcnt@000000003d6e7d05 has 1/2 users at\n     sk_alloc (./include/net/net_namespace.h:345 net/core/sock.c:2236)\n     inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252)\n     __sock_create (net/socket.c:1558)\n     udp_sock_create4 (net/ipv4/udp_tunnel_core.c:18)\n     gtp_create_sock (./include/net/udp_tunnel.h:59 drivers/net/gtp.c:1423)\n     gtp_create_sockets (drivers/net/gtp.c:1447)\n     gtp_newlink (drivers/net/gtp.c:1507)\n     rtnl_newlink (net/core/rtnetlink.c:3786 net/core/rtnetlink.c:3897 net/core/rtnetlink.c:4012)\n     rtnetlink_rcv_msg (net/core/rtnetlink.c:6922)\n     netlink_rcv_skb (net/netlink/af_netlink.c:2542)\n     netlink_unicast (net/netlink/af_netlink.c:1321 net/netlink/af_netlink.c:1347)\n     netlink_sendmsg (net/netlink/af_netlink.c:1891)\n     ____sys_sendmsg (net/socket.c:711 net/socket.c:726 net/socket.c:2583)\n     ___sys_sendmsg (net/socket.c:2639)\n     __sys_sendmsg (net/socket.c:2669)\n     do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n\nWARNING: CPU: 1 PID: 60 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)\nModules linked in:\nCPU: 1 UID: 0 PID: 60 Comm: kworker/u16:2 Not tainted 6.13.0-rc5-00147-g4c1224501e9d #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nWorkqueue: netns cleanup_net\nRIP: 0010:ref_tracker_dir_exit (lib/ref_tracker.c:179)\nCode: 00 00 00 fc ff df 4d 8b 26 49 bd 00 01 00 00 00 00 ad de 4c 39 f5 0f 85 df 00 00 00 48 8b 74 24 08 48 89 df e8 a5 cc 12 02 90 \u003c0f\u003e 0b 90 48 8d 6b 44 be 04 00 00 00 48 89 ef e8 80 de 67 ff 48 89\nRSP: 0018:ff11000009a07b60 EFLAGS: 00010286\nRAX: 0000000000002bd3 RBX: ff1100000f4e1aa0 RCX: 1ffffffff0e40ac6\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8423ee3c\nRBP: ff1100000f4e1af0 R08: 0000000000000001 R09: fffffbfff0e395ae\nR10: 0000000000000001 R11: 0000000000036001 R12: ff1100000f4e1af0\nR13: dead000000000100 R14: ff1100000f4e1af0 R15: dffffc0000000000\nFS:  0000000000000000(0000) GS:ff1100006ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f9b2464bd98 CR3: 0000000005286005 CR4: 0000000000771ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __warn (kernel/panic.c:748)\n ? ref_tracker_dir_exit (lib/ref_tracker.c:179)\n ? report_bug (lib/bug.c:201 lib/bug.c:219)\n ? handle_bug (arch/x86/kernel/traps.c:285)\n ? exc_invalid_op (arch/x86/kernel/traps.c:309 (discriminator 1))\n ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621)\n ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:97 ./arch/x86/include/asm/irqflags.h:155 ./include/linux/spinlock_api_smp.h:151 kernel/locking/spinlock.c:194)\n ? ref_tracker_dir_exit (lib/ref_tracker.c:179)\n ? __pfx_ref_tracker_dir_exit (lib/ref_tracker.c:158)\n ? kfree (mm/slub.c:4613 mm/slub.c:4761)\n net_free (net/core/net_namespace.c:476 net/core/net_namespace.c:467)\n cleanup_net (net/core/net_namespace.c:664 (discriminator 3))\n process_one_work (kernel/workqueue.c:3229)\n worker_thread (kernel/workqueue.c:3304 kernel/workqueue.c:3391\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47440455-94cd-404f-869e-3757a4902f7f",
      "id": "CVE-2021-3753",
      "description": "A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29fedb5c-5b31-4dab-a6ba-3099fec1d6a6",
      "id": "CVE-2025-21904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncaif_virtio: fix wrong pointer check in cfv_probe()\n\ndel_vqs() frees virtqueues, therefore cfv-\u003evq_tx pointer should be checked\nfor NULL before calling it, not cfv-\u003evdev. Also the current implementation\nis redundant because the pointer cfv-\u003evdev is dereferenced before it is\nchecked for NULL.\n\nFix this by checking cfv-\u003evq_tx for NULL instead of cfv-\u003evdev before\ncalling del_vqs().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3ef6e73-30fe-4c47-92c8-ff385c42c1b2",
      "id": "CVE-2025-22026",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don't ignore the return code of svc_proc_register()\n\nCurrently, nfsd_proc_stat_init() ignores the return value of\nsvc_proc_register(). If the procfile creation fails, then the kernel\nwill WARN when it tries to remove the entry later.\n\nFix nfsd_proc_stat_init() to return the same type of pointer as\nsvc_proc_register(), and fix up nfsd_net_init() to check that and fail\nthe nfsd_net construction if it occurs.\n\nsvc_proc_register() can fail if the dentry can't be allocated, or if an\nidentical dentry already exists. The second case is pretty unlikely in\nthe nfsd_net construction codepath, so if this happens, return -ENOMEM.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "056f25e7-e93c-4446-8e75-944d6f977537",
      "id": "CVE-2025-37794",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Purge vif txq in ieee80211_do_stop()\n\nAfter ieee80211_do_stop() SKB from vif's txq could still be processed.\nIndeed another concurrent vif schedule_and_wake_txq call could cause\nthose packets to be dequeued (see ieee80211_handle_wake_tx_queue())\nwithout checking the sdata current state.\n\nBecause vif.drv_priv is now cleared in this function, this could lead to\ndriver crash.\n\nFor example in ath12k, ahvif is store in vif.drv_priv. Thus if\nath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif-\u003eah can be\nNULL, leading the ath12k_warn(ahvif-\u003eah,...) call in this function to\ntrigger the NULL deref below.\n\n  Unable to handle kernel paging request at virtual address dfffffc000000001\n  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n  batman_adv: bat0: Interface deactivated: brbh1337\n  Mem abort info:\n    ESR = 0x0000000096000004\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x04: level 0 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n    CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n  [dfffffc000000001] address between user and kernel address ranges\n  Internal error: Oops: 0000000096000004 [#1] SMP\n  CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114\n  Hardware name: HW (DT)\n  pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k]\n  lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k]\n  sp : ffffffc086ace450\n  x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4\n  x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e\n  x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0\n  x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958\n  x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8\n  x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03\n  x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40\n  x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0\n  x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001\n  x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008\n  Call trace:\n   ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P)\n   ieee80211_handle_wake_tx_queue+0x16c/0x260\n   ieee80211_queue_skb+0xeec/0x1d20\n   ieee80211_tx+0x200/0x2c8\n   ieee80211_xmit+0x22c/0x338\n   __ieee80211_subif_start_xmit+0x7e8/0xc60\n   ieee80211_subif_start_xmit+0xc4/0xee0\n   __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0\n   ieee80211_subif_start_xmit_8023+0x124/0x488\n   dev_hard_start_xmit+0x160/0x5a8\n   __dev_queue_xmit+0x6f8/0x3120\n   br_dev_queue_push_xmit+0x120/0x4a8\n   __br_forward+0xe4/0x2b0\n   deliver_clone+0x5c/0xd0\n   br_flood+0x398/0x580\n   br_dev_xmit+0x454/0x9f8\n   dev_hard_start_xmit+0x160/0x5a8\n   __dev_queue_xmit+0x6f8/0x3120\n   ip6_finish_output2+0xc28/0x1b60\n   __ip6_finish_output+0x38c/0x638\n   ip6_output+0x1b4/0x338\n   ip6_local_out+0x7c/0xa8\n   ip6_send_skb+0x7c/0x1b0\n   ip6_push_pending_frames+0x94/0xd0\n   rawv6_sendmsg+0x1a98/0x2898\n   inet_sendmsg+0x94/0xe0\n   __sys_sendto+0x1e4/0x308\n   __arm64_sys_sendto+0xc4/0x140\n   do_el0_svc+0x110/0x280\n   el0_svc+0x20/0x60\n   el0t_64_sync_handler+0x104/0x138\n   el0t_64_sync+0x154/0x158\n\nTo avoid that, empty vif's txq at ieee80211_do_stop() so no packet could\nbe dequeued after ieee80211_do_stop() (new packets cannot be queued\nbecause SDATA_STATE_RUNNING is cleared at this point).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08dad826-69d5-4002-a3be-7d5530d81794",
      "id": "CVE-2025-37862",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: pidff: Fix null pointer dereference in pidff_find_fields\n\nThis function triggered a null pointer dereference if used to search for\na report that isn't implemented on the device. This happened both for\noptional and required reports alike.\n\nThe same logic was applied to pidff_find_special_field and although\npidff_init_fields should return an error earlier if one of the required\nreports is missing, future modifications could change this logic and\nresurface this possible null pointer dereference again.\n\nLKML bug report:\nhttps://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b941fd8d-8ed3-4dac-987b-4de0db082dbe",
      "id": "CVE-2025-37925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: reject on-disk inodes of an unsupported type\n\nSyzbot has reported the following BUG:\n\nkernel BUG at fs/inode.c:668!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 3 UID: 0 PID: 139 Comm: jfsCommit Not tainted 6.12.0-rc4-syzkaller-00085-g4e46774408d9 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\nRIP: 0010:clear_inode+0x168/0x190\nCode: 4c 89 f7 e8 ba fe e5 ff e9 61 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 7c c1 4c 89 f7 e8 90 ff e5 ff eb b7\n 0b e8 01 5d 7f ff 90 0f 0b e8 f9 5c 7f ff 90 0f 0b e8 f1 5c 7f\nRSP: 0018:ffffc900027dfae8 EFLAGS: 00010093\nRAX: ffffffff82157a87 RBX: 0000000000000001 RCX: ffff888104d4b980\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000\nRBP: ffffc900027dfc90 R08: ffffffff82157977 R09: fffff520004fbf38\nR10: dffffc0000000000 R11: fffff520004fbf38 R12: dffffc0000000000\nR13: ffff88811315bc00 R14: ffff88811315bda8 R15: ffff88811315bb80\nFS:  0000000000000000(0000) GS:ffff888135f00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005565222e0578 CR3: 0000000026ef0000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n ? __die_body+0x5f/0xb0\n ? die+0x9e/0xc0\n ? do_trap+0x15a/0x3a0\n ? clear_inode+0x168/0x190\n ? do_error_trap+0x1dc/0x2c0\n ? clear_inode+0x168/0x190\n ? __pfx_do_error_trap+0x10/0x10\n ? report_bug+0x3cd/0x500\n ? handle_invalid_op+0x34/0x40\n ? clear_inode+0x168/0x190\n ? exc_invalid_op+0x38/0x50\n ? asm_exc_invalid_op+0x1a/0x20\n ? clear_inode+0x57/0x190\n ? clear_inode+0x167/0x190\n ? clear_inode+0x168/0x190\n ? clear_inode+0x167/0x190\n jfs_evict_inode+0xb5/0x440\n ? __pfx_jfs_evict_inode+0x10/0x10\n evict+0x4ea/0x9b0\n ? __pfx_evict+0x10/0x10\n ? iput+0x713/0xa50\n txUpdateMap+0x931/0xb10\n ? __pfx_txUpdateMap+0x10/0x10\n jfs_lazycommit+0x49a/0xb80\n ? _raw_spin_unlock_irqrestore+0x8f/0x140\n ? lockdep_hardirqs_on+0x99/0x150\n ? __pfx_jfs_lazycommit+0x10/0x10\n ? __pfx_default_wake_function+0x10/0x10\n ? __kthread_parkme+0x169/0x1d0\n ? __pfx_jfs_lazycommit+0x10/0x10\n kthread+0x2f2/0x390\n ? __pfx_jfs_lazycommit+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x4d/0x80\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nThis happens when 'clear_inode()' makes an attempt to finalize an underlying\nJFS inode of unknown type. According to JFS layout description from\nhttps://jfs.sourceforge.net/project/pub/jfslayout.pdf, inode types from 5 to\n15 are reserved for future extensions and should not be encountered on a valid\nfilesystem. So add an extra check for valid inode type in 'copy_from_dinode()'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ecd532b-e2a9-497f-be04-214200dbf1fb",
      "id": "CVE-2025-38037",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Annotate FDB data races\n\nThe 'used' and 'updated' fields in the FDB entry structure can be\naccessed concurrently by multiple threads, leading to reports such as\n[1]. Can be reproduced using [2].\n\nSuppress these reports by annotating these accesses using\nREAD_ONCE() / WRITE_ONCE().\n\n[1]\nBUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit\n\nwrite to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:\n vxlan_xmit+0xb29/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:\n vxlan_xmit+0xadf/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000000fffbac6e -\u003e 0x00000000fffbac6f\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n\n[2]\n #!/bin/bash\n\n set +H\n echo whitelist \u003e /sys/kernel/debug/kcsan\n echo !vxlan_xmit \u003e /sys/kernel/debug/kcsan\n\n ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1\n bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1\n taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026\n taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c464e48-6ad7-40b3-a47f-57cda059f419",
      "id": "CVE-2025-38166",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix ktls panic with sockmap\n\n[ 2172.936997] ------------[ cut here ]------------\n[ 2172.936999] kernel BUG at lib/iov_iter.c:629!\n......\n[ 2172.944996] PKRU: 55555554\n[ 2172.945155] Call Trace:\n[ 2172.945299]  \u003cTASK\u003e\n[ 2172.945428]  ? die+0x36/0x90\n[ 2172.945601]  ? do_trap+0xdd/0x100\n[ 2172.945795]  ? iov_iter_revert+0x178/0x180\n[ 2172.946031]  ? iov_iter_revert+0x178/0x180\n[ 2172.946267]  ? do_error_trap+0x7d/0x110\n[ 2172.946499]  ? iov_iter_revert+0x178/0x180\n[ 2172.946736]  ? exc_invalid_op+0x50/0x70\n[ 2172.946961]  ? iov_iter_revert+0x178/0x180\n[ 2172.947197]  ? asm_exc_invalid_op+0x1a/0x20\n[ 2172.947446]  ? iov_iter_revert+0x178/0x180\n[ 2172.947683]  ? iov_iter_revert+0x5c/0x180\n[ 2172.947913]  tls_sw_sendmsg_locked.isra.0+0x794/0x840\n[ 2172.948206]  tls_sw_sendmsg+0x52/0x80\n[ 2172.948420]  ? inet_sendmsg+0x1f/0x70\n[ 2172.948634]  __sys_sendto+0x1cd/0x200\n[ 2172.948848]  ? find_held_lock+0x2b/0x80\n[ 2172.949072]  ? syscall_trace_enter+0x140/0x270\n[ 2172.949330]  ? __lock_release.isra.0+0x5e/0x170\n[ 2172.949595]  ? find_held_lock+0x2b/0x80\n[ 2172.949817]  ? syscall_trace_enter+0x140/0x270\n[ 2172.950211]  ? lockdep_hardirqs_on_prepare+0xda/0x190\n[ 2172.950632]  ? ktime_get_coarse_real_ts64+0xc2/0xd0\n[ 2172.951036]  __x64_sys_sendto+0x24/0x30\n[ 2172.951382]  do_syscall_64+0x90/0x170\n......\n\nAfter calling bpf_exec_tx_verdict(), the size of msg_pl-\u003esg may increase,\ne.g., when the BPF program executes bpf_msg_push_data().\n\nIf the BPF program sets cork_bytes and sg.size is smaller than cork_bytes,\nit will return -ENOSPC and attempt to roll back to the non-zero copy\nlogic. However, during rollback, msg-\u003emsg_iter is reset, but since\nmsg_pl-\u003esg.size has been increased, subsequent executions will exceed the\nactual size of msg_iter.\n'''\niov_iter_revert(\u0026msg-\u003emsg_iter, msg_pl-\u003esg.size - orig_size);\n'''\n\nThe changes in this commit are based on the following considerations:\n\n1. When cork_bytes is set, rolling back to non-zero copy logic is\npointless and can directly go to zero-copy logic.\n\n2. We can not calculate the correct number of bytes to revert msg_iter.\n\nAssume the original data is \"abcdefgh\" (8 bytes), and after 3 pushes\nby the BPF program, it becomes 11-byte data: \"abc?de?fgh?\".\nThen, we set cork_bytes to 6, which means the first 6 bytes have been\nprocessed, and the remaining 5 bytes \"?fgh?\" will be cached until the\nlength meets the cork_bytes requirement.\n\nHowever, some data in \"?fgh?\" is not within 'sg-\u003emsg_iter'\n(but in msg_pl instead), especially the data \"?\" we pushed.\n\nSo it doesn't seem as simple as just reverting through an offset of\nmsg_iter.\n\n3. For non-TLS sockets in tcp_bpf_sendmsg, when a \"cork\" situation occurs,\nthe user-space send() doesn't return an error, and the returned length is\nthe same as the input length parameter, even if some data is cached.\n\nAdditionally, I saw that the current non-zero-copy logic for handling\ncorking is written as:\n'''\nline 1177\nelse if (ret != -EAGAIN) {\n\tif (ret == -ENOSPC)\n\t\tret = 0;\n\tgoto send_end;\n'''\n\nSo it's ok to just return 'copied' without error when a \"cork\" situation\noccurs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d9c8867-8142-405b-9856-3695252f480e",
      "id": "CVE-2025-38377",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrose: fix dangling neighbour pointers in rose_rt_device_down()\n\nThere are two bugs in rose_rt_device_down() that can cause\nuse-after-free:\n\n1. The loop bound `t-\u003ecount` is modified within the loop, which can\n   cause the loop to terminate early and miss some entries.\n\n2. When removing an entry from the neighbour array, the subsequent entries\n   are moved up to fill the gap, but the loop index `i` is still\n   incremented, causing the next entry to be skipped.\n\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\nis being removed, the second A is not checked.\n\n    i=0: (A, A, B) -\u003e (A, B) with count=2\n          ^ checked\n    i=1: (A, B)    -\u003e (A, B) with count=2\n             ^ checked (B, not A!)\n    i=2: (doesn't occur because i \u003c count is false)\n\nThis leaves the second A in the array with count=2, but the rose_neigh\nstructure has been freed. Code that accesses these entries assumes that\nthe first `count` entries are valid pointers, causing a use-after-free\nwhen it accesses the dangling pointer.\n\nFix both issues by iterating over the array in reverse order with a fixed\nloop bound. This ensures that all entries are examined and that the removal\nof an entry doesn't affect subsequent iterations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c6578230-f067-463c-941a-b3778d0d6fcc",
      "id": "CVE-2025-38468",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree\n\nhtb_lookup_leaf has a BUG_ON that can trigger with the following:\n\ntc qdisc del dev lo root\ntc qdisc add dev lo root handle 1: htb default 1\ntc class add dev lo parent 1: classid 1:1 htb rate 64bit\ntc qdisc add dev lo parent 1:1 handle 2: netem\ntc qdisc add dev lo parent 2:1 handle 3: blackhole\nping -I lo -c1 -W0.001 127.0.0.1\n\nThe root cause is the following:\n\n1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on\n   the selected leaf qdisc\n2. netem_dequeue calls enqueue on the child qdisc\n3. blackhole_enqueue drops the packet and returns a value that is not\n   just NET_XMIT_SUCCESS\n4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and\n   since qlen is now 0, it calls htb_qlen_notify -\u003e htb_deactivate -\u003e\n   htb_deactiviate_prios -\u003e htb_remove_class_from_row -\u003e htb_safe_rb_erase\n5. As this is the only class in the selected hprio rbtree,\n   __rb_change_child in __rb_erase_augmented sets the rb_root pointer to\n   NULL\n6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL,\n   which causes htb_dequeue_tree to call htb_lookup_leaf with the same\n   hprio rbtree, and fail the BUG_ON\n\nThe function graph for this scenario is shown here:\n 0)               |  htb_enqueue() {\n 0) + 13.635 us   |    netem_enqueue();\n 0)   4.719 us    |    htb_activate_prios();\n 0) # 2249.199 us |  }\n 0)               |  htb_dequeue() {\n 0)   2.355 us    |    htb_lookup_leaf();\n 0)               |    netem_dequeue() {\n 0) + 11.061 us   |      blackhole_enqueue();\n 0)               |      qdisc_tree_reduce_backlog() {\n 0)               |        qdisc_lookup_rcu() {\n 0)   1.873 us    |          qdisc_match_from_root();\n 0)   6.292 us    |        }\n 0)   1.894 us    |        htb_search();\n 0)               |        htb_qlen_notify() {\n 0)   2.655 us    |          htb_deactivate_prios();\n 0)   6.933 us    |        }\n 0) + 25.227 us   |      }\n 0)   1.983 us    |      blackhole_dequeue();\n 0) + 86.553 us   |    }\n 0) # 2932.761 us |    qdisc_warn_nonwc();\n 0)               |    htb_lookup_leaf() {\n 0)               |      BUG_ON();\n ------------------------------------------\n\nThe full original bug report can be seen here [1].\n\nWe can fix this just by returning NULL instead of the BUG_ON,\nas htb_dequeue_tree returns NULL when htb_lookup_leaf returns\nNULL.\n\n[1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ef7774d-8fc6-4ceb-acab-e93161f3a769",
      "id": "CVE-2025-38497",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Fix OOB read on empty string write\n\nWhen writing an empty string to either 'qw_sign' or 'landingPage'\nsysfs attributes, the store functions attempt to access page[l - 1]\nbefore validating that the length 'l' is greater than zero.\n\nThis patch fixes the vulnerability by adding a check at the beginning\nof os_desc_qw_sign_store() and webusb_landingPage_store() to handle\nthe zero-length input case gracefully by returning immediately.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63009fcd-b9b5-4ebf-850a-d69c6b136b1d",
      "id": "CVE-2020-14331",
      "description": "A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb07c5d2-8bbd-4b72-8cb7-2b723fcefcea",
      "id": "CVE-2020-35508",
      "description": "A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e86b336-4fab-4269-b5f1-c465de2db9e4",
      "id": "CVE-2021-29649",
      "description": "An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e49ecee5-4217-4f22-a381-9b33ce80503a",
      "id": "CVE-2023-53151",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: prevent soft lockup while flush writes\n\nCurrently, there is no limit for raid1/raid10 plugged bio. While flushing\nwrites, raid1 has cond_resched() while raid10 doesn't, and too many\nwrites can cause soft lockup.\n\nFollow up soft lockup can be triggered easily with writeback test for\nraid10 with ramdisks:\n\nwatchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293]\nCall Trace:\n \u003cTASK\u003e\n call_rcu+0x16/0x20\n put_object+0x41/0x80\n __delete_object+0x50/0x90\n delete_object_full+0x2b/0x40\n kmemleak_free+0x46/0xa0\n slab_free_freelist_hook.constprop.0+0xed/0x1a0\n kmem_cache_free+0xfd/0x300\n mempool_free_slab+0x1f/0x30\n mempool_free+0x3a/0x100\n bio_free+0x59/0x80\n bio_put+0xcf/0x2c0\n free_r10bio+0xbf/0xf0\n raid_end_bio_io+0x78/0xb0\n one_write_done+0x8a/0xa0\n raid10_end_write_request+0x1b4/0x430\n bio_endio+0x175/0x320\n brd_submit_bio+0x3b9/0x9b7 [brd]\n __submit_bio+0x69/0xe0\n submit_bio_noacct_nocheck+0x1e6/0x5a0\n submit_bio_noacct+0x38c/0x7e0\n flush_pending_writes+0xf0/0x240\n raid10d+0xac/0x1ed0\n\nFix the problem by adding cond_resched() to raid10 like what raid1 did.\n\nNote that unlimited plugged bio still need to be optimized, for example,\nin the case of lots of dirty pages writeback, this will take lots of\nmemory and io will spend a long time in plug, hence io latency is bad.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "75e7aa91-44d7-454e-a818-24bd91f392a3",
      "id": "CVE-2021-38199",
      "description": "fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "622e0eef-4512-446b-b26f-d0ef91fd81fc",
      "id": "CVE-2021-46909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: footbridge: fix PCI interrupt mapping\n\nSince commit 30fdfb929e82 (\"PCI: Add a call to pci_assign_irq() in\npci_device_probe()\"), the PCI code will call the IRQ mapping function\nwhenever a PCI driver is probed. If these are marked as __init, this\ncauses an oops if a PCI driver is loaded or bound after the kernel has\ninitialised.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83f2ae21-51a1-4637-a0b6-8229f093730e",
      "id": "CVE-2021-46935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix async_free_space accounting for empty parcels\n\nIn 4.13, commit 74310e06be4d (\"android: binder: Move buffer out of area shared with user space\")\nfixed a kernel structure visibility issue. As part of that patch,\nsizeof(void *) was used as the buffer size for 0-length data payloads so\nthe driver could detect abusive clients sending 0-length asynchronous\ntransactions to a server by enforcing limits on async_free_size.\n\nUnfortunately, on the \"free\" side, the accounting of async_free_space\ndid not add the sizeof(void *) back. The result was that up to 8-bytes of\nasync_free_space were leaked on every async transaction of 8-bytes or\nless.  These small transactions are uncommon, so this accounting issue\nhas gone undetected for several years.\n\nThe fix is to use \"buffer_size\" (the allocated buffer size) instead of\n\"size\" (the logical buffer size) when updating the async_free_space\nduring the free operation. These are the same except for this\ncorner case of asynchronous transactions with payloads \u003c 8 bytes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac985c17-817f-4126-b041-074600351703",
      "id": "CVE-2021-47002",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix null pointer dereference in svc_rqst_free()\n\nWhen alloc_pages_node() returns null in svc_rqst_alloc(), the\nnull rq_scratch_page pointer will be dereferenced when calling\nput_page() in svc_rqst_free(). Fix it by adding a null check.\n\nAddresses-Coverity: (\"Dereference after null check\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00087ec5-c329-44ca-8dc3-8be5b225e042",
      "id": "CVE-2021-47054",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: qcom: Put child node before return\n\nPut child node before return to fix potential reference count leak.\nGenerally, the reference count of child is incremented and decremented\nautomatically in the macro for_each_available_child_of_node() and should\nbe decremented manually if the loop is broken in loop body.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2ede776-4414-480b-8fde-61a63f4ba917",
      "id": "CVE-2021-47120",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: fix NULL-deref on disconnect\n\nCommit 9d7b18668956 (\"HID: magicmouse: add support for Apple Magic\nTrackpad 2\") added a sanity check for an Apple trackpad but returned\nsuccess instead of -ENODEV when the check failed. This means that the\nremove callback will dereference the never-initialised driver data\npointer when the driver is later unbound (e.g. on USB disconnect).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ee46543-6c3d-4f51-8e68-7fb14ec7a0a6",
      "id": "CVE-2021-47146",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmld: fix panic in mld_newpack()\n\nmld_newpack() doesn't allow to allocate high order page,\nonly order-0 allocation is allowed.\nIf headroom size is too large, a kernel panic could occur in skb_put().\n\nTest commands:\n    ip netns del A\n    ip netns del B\n    ip netns add A\n    ip netns add B\n    ip link add veth0 type veth peer name veth1\n    ip link set veth0 netns A\n    ip link set veth1 netns B\n\n    ip netns exec A ip link set lo up\n    ip netns exec A ip link set veth0 up\n    ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0\n    ip netns exec B ip link set lo up\n    ip netns exec B ip link set veth1 up\n    ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1\n    for i in {1..99}\n    do\n        let A=$i-1\n        ip netns exec A ip link add ip6gre$i type ip6gre \\\n\tlocal 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100\n        ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i\n        ip netns exec A ip link set ip6gre$i up\n\n        ip netns exec B ip link add ip6gre$i type ip6gre \\\n\tlocal 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100\n        ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i\n        ip netns exec B ip link set ip6gre$i up\n    done\n\nSplat looks like:\nkernel BUG at net/core/skbuff.c:110!\ninvalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI\nCPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891\nWorkqueue: ipv6_addrconf addrconf_dad_work\nRIP: 0010:skb_panic+0x15d/0x15f\nCode: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83\n41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff \u003c0f\u003e 0b 48 8b 6c 24 20 89\n34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20\nRSP: 0018:ffff88810091f820 EFLAGS: 00010282\nRAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000\nRDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb\nRBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031\nR10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028\nR13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0\nFS:  0000000000000000(0000) GS:ffff888117c00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n skb_put.cold.104+0x22/0x22\n ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600\n ? rcu_read_lock_sched_held+0x91/0xc0\n mld_newpack+0x398/0x8f0\n ? ip6_mc_hdr.isra.26.constprop.46+0x600/0x600\n ? lock_contended+0xc40/0xc40\n add_grhead.isra.33+0x280/0x380\n add_grec+0x5ca/0xff0\n ? mld_sendpack+0xf40/0xf40\n ? lock_downgrade+0x690/0x690\n mld_send_initial_cr.part.34+0xb9/0x180\n ipv6_mc_dad_complete+0x15d/0x1b0\n addrconf_dad_completed+0x8d2/0xbb0\n ? lock_downgrade+0x690/0x690\n ? addrconf_rs_timer+0x660/0x660\n ? addrconf_dad_work+0x73c/0x10e0\n addrconf_dad_work+0x73c/0x10e0\n\nAllowing high order page allocation could fix this problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e19c36aa-e967-4b83-9927-f0a33eb9e205",
      "id": "CVE-2021-47366",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server\n\nAFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and\nLinux's afs client switches between them when talking to a non-YFS server\nif the read size, the file position or the sum of the two have the upper 32\nbits set of the 64-bit value.\n\nThis is a problem, however, since the file position and length fields of\nFS.FetchData are *signed* 32-bit values.\n\nFix this by capturing the capability bits obtained from the fileserver when\nit's sent an FS.GetCapabilities RPC, rather than just discarding them, and\nthen picking out the VICED_CAPABILITY_64BITFILES flag.  This can then be\nused to decide whether to use FS.FetchData or FS.FetchData64 - and also\nFS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to\nswitch on the parameter values.\n\nThis capabilities flag could also be used to limit the maximum size of the\nfile, but all servers must be checked for that.\n\nNote that the issue does not exist with FS.StoreData - that uses *unsigned*\n32-bit values.  It's also not a problem with Auristor servers as its\nYFS.FetchData64 op uses unsigned 64-bit values.\n\nThis can be tested by cloning a git repo through an OpenAFS client to an\nOpenAFS server and then doing \"git status\" on it from a Linux afs\nclient[1].  Provided the clone has a pack file that's in the 2G-4G range,\nthe git status will show errors like:\n\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\nThis can be observed in the server's FileLog with something like the\nfollowing appearing:\n\nSun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001\nSun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866\n...\nSun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5\n\nNote the file position of 18446744071815340032.  This is the requested file\nposition sign-extended.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fcdc7bd6-c73b-403e-a7fb-b927a3133135",
      "id": "CVE-2024-46835",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix smatch static checker warning\n\nadev-\u003egfx.imu.funcs could be NULL",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2fa88958-cfb1-4141-9636-49bba0a3f0ff",
      "id": "CVE-2021-47380",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Fix potential NULL pointer dereference\n\ndevm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at\nregistration that will cause NULL pointer dereference since\ncorresponding data is not initialized yet. The patch moves\ninitialization of data before devm_add_action_or_reset().\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[jkosina@suse.cz: rebase]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cc22556-527a-4ed5-9822-863afe13d8fa",
      "id": "CVE-2021-47397",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb\n\nWe should always check if skb_header_pointer's return is NULL before\nusing it, otherwise it may cause null-ptr-deref, as syzbot reported:\n\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline]\n  RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196\n  Call Trace:\n  \u003cIRQ\u003e\n   sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109\n   ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422\n   ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463\n   NF_HOOK include/linux/netfilter.h:307 [inline]\n   NF_HOOK include/linux/netfilter.h:301 [inline]\n   ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472\n   dst_input include/net/dst.h:460 [inline]\n   ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]\n   NF_HOOK include/linux/netfilter.h:307 [inline]\n   NF_HOOK include/linux/netfilter.h:301 [inline]\n   ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8f8bda9-515e-4155-82d6-f65979ba9986",
      "id": "CVE-2021-47623",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fixmap: Fix VM debug warning on unmap\n\nUnmapping a fixmap entry is done by calling __set_fixmap()\nwith FIXMAP_PAGE_CLEAR as flags.\n\nToday, powerpc __set_fixmap() calls map_kernel_page().\n\nmap_kernel_page() is not happy when called a second time\nfor the same page.\n\n\tWARNING: CPU: 0 PID: 1 at arch/powerpc/mm/pgtable.c:194 set_pte_at+0xc/0x1e8\n\tCPU: 0 PID: 1 Comm: swapper Not tainted 5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty #682\n\tNIP:  c0017cd4 LR: c00187f0 CTR: 00000010\n\tREGS: e1011d50 TRAP: 0700   Not tainted  (5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty)\n\tMSR:  00029032 \u003cEE,ME,IR,DR,RI\u003e  CR: 42000208  XER: 00000000\n\n\tGPR00: c0165fec e1011e10 c14c0000 c0ee2550 ff800000 c0f3d000 00000000 c001686c\n\tGPR08: 00001000 b00045a9 00000001 c0f58460 c0f50000 00000000 c0007e10 00000000\n\tGPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n\tGPR24: 00000000 00000000 c0ee2550 00000000 c0f57000 00000ff8 00000000 ff800000\n\tNIP [c0017cd4] set_pte_at+0xc/0x1e8\n\tLR [c00187f0] map_kernel_page+0x9c/0x100\n\tCall Trace:\n\t[e1011e10] [c0736c68] vsnprintf+0x358/0x6c8 (unreliable)\n\t[e1011e30] [c0165fec] __set_fixmap+0x30/0x44\n\t[e1011e40] [c0c13bdc] early_iounmap+0x11c/0x170\n\t[e1011e70] [c0c06cb0] ioremap_legacy_serial_console+0x88/0xc0\n\t[e1011e90] [c0c03634] do_one_initcall+0x80/0x178\n\t[e1011ef0] [c0c0385c] kernel_init_freeable+0xb4/0x250\n\t[e1011f20] [c0007e34] kernel_init+0x24/0x140\n\t[e1011f30] [c0016268] ret_from_kernel_thread+0x5c/0x64\n\tInstruction dump:\n\t7fe3fb78 48019689 80010014 7c630034 83e1000c 5463d97e 7c0803a6 38210010\n\t4e800020 81250000 712a0001 41820008 \u003c0fe00000\u003e 9421ffe0 93e1001c 48000030\n\nImplement unmap_kernel_page() which clears an existing pte.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec85a8b8-bbeb-45dc-9406-9f06687e6d49",
      "id": "CVE-2022-1055",
      "description": "A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ce54ac5-7ff7-4cf8-9853-9d327e4c37d2",
      "id": "CVE-2022-25375",
      "description": "An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01a15f6c-4b6c-4393-9c73-431ec1544ba6",
      "id": "CVE-2023-53410",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ULPI: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c6f90331-136b-4f39-86a9-4880bae1de2c",
      "id": "CVE-2022-3594",
      "description": "A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "05749bca-2ecd-4b28-9212-e3f41cda13aa",
      "id": "CVE-2022-40476",
      "description": "A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or potentially cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6da6610-6151-4b3b-9e3e-6d82f1f75261",
      "id": "CVE-2022-45887",
      "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f71255c-ee9c-4302-94b7-4a996b14e3d5",
      "id": "CVE-2022-48754",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphylib: fix potential use-after-free\n\nCommit bafbdd527d56 (\"phylib: Add device reset GPIO support\") added call\nto phy_device_reset(phydev) after the put_device() call in phy_detach().\n\nThe comment before the put_device() call says that the phydev might go\naway with put_device().\n\nFix potential use-after-free by calling phy_device_reset() before\nput_device().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c0f060d-268f-498b-b84f-793b960aac44",
      "id": "CVE-2022-48789",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_tcp_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83edcaaf-2e55-49b9-b667-2f31ed7b9d7f",
      "id": "CVE-2022-49035",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE\n\nI expect that the hardware will have limited this to 16, but just in\ncase it hasn't, check for this corner case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3732d322-a4e2-40a2-9bd6-9218b31ab8d9",
      "id": "CVE-2022-48844",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix leaking sent_cmd skb\n\nsent_cmd memory is not freed before freeing hci_dev causing it to leak\nit contents.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7793c83c-8772-460f-bac2-bbfa828f290d",
      "id": "CVE-2022-48860",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet: Fix error handling in xemaclite_of_probe\n\nThis node pointer is returned by of_parse_phandle() with refcount\nincremented in this function. Calling of_node_put() to avoid the\nrefcount leak. As the remove function do.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e487386f-c6ed-4b02-a67a-e7818172e0d0",
      "id": "CVE-2022-48873",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Don't remove map on creater_process and device_release\n\nDo not remove the map from the list on error path in\nfastrpc_init_create_process, instead call fastrpc_map_put, to avoid\nuse-after-free. Do not remove it on fastrpc_device_release either,\ncall fastrpc_map_put instead.\n\nThe fastrpc_free_map is the only proper place to remove the map.\nThis is called only after the reference count is 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "630f9d4f-902c-4018-a229-78b734a9ef5b",
      "id": "CVE-2022-48905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: free reset-work-item when flushing\n\nFix a tiny memory leak when flushing the reset work queue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29d1447a-18cb-4af9-98dd-495f34daca0f",
      "id": "CVE-2022-48986",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix gup_pud_range() for dax\n\nFor dax pud, pud_huge() returns true on x86. So the function works as long\nas hugetlb is configured. However, dax doesn't depend on hugetlb.\nCommit 414fd080d125 (\"mm/gup: fix gup_pmd_range() for dax\") fixed\ndevmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as\nwell.\n\nThis fixes the below kernel panic:\n\ngeneral protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP\n\t\u003c snip \u003e\nCall Trace:\n\u003cTASK\u003e\nget_user_pages_fast+0x1f/0x40\niov_iter_get_pages+0xc6/0x3b0\n? mempool_alloc+0x5d/0x170\nbio_iov_iter_get_pages+0x82/0x4e0\n? bvec_alloc+0x91/0xc0\n? bio_alloc_bioset+0x19a/0x2a0\nblkdev_direct_IO+0x282/0x480\n? __io_complete_rw_common+0xc0/0xc0\n? filemap_range_has_page+0x82/0xc0\ngeneric_file_direct_write+0x9d/0x1a0\n? inode_update_time+0x24/0x30\n__generic_file_write_iter+0xbd/0x1e0\nblkdev_write_iter+0xb4/0x150\n? io_import_iovec+0x8d/0x340\nio_write+0xf9/0x300\nio_issue_sqe+0x3c3/0x1d30\n? sysvec_reschedule_ipi+0x6c/0x80\n__io_queue_sqe+0x33/0x240\n? fget+0x76/0xa0\nio_submit_sqes+0xe6a/0x18d0\n? __fget_light+0xd1/0x100\n__x64_sys_io_uring_enter+0x199/0x880\n? __context_tracking_enter+0x1f/0x70\n? irqentry_exit_to_user_mode+0x24/0x30\n? irqentry_exit+0x1d/0x30\n? __context_tracking_exit+0xe/0x70\ndo_syscall_64+0x3b/0x90\nentry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7fc97c11a7be\n\t\u003c snip \u003e\n\u003c/TASK\u003e\n---[ end trace 48b2e0e67debcaeb ]---\nRIP: 0010:internal_get_user_pages_fast+0x340/0x990\n\t\u003c snip \u003e\nKernel panic - not syncing: Fatal exception\nKernel Offset: disabled",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35237bfe-3db2-4c49-9bde-17f554280b16",
      "id": "CVE-2022-49021",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: fix null-ptr-deref while probe() failed\n\nI got a null-ptr-deref report as following when doing fault injection test:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000058\nOops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G    B            N 6.1.0-rc3+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:klist_put+0x2d/0xd0\nCall Trace:\n \u003cTASK\u003e\n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x23e/0x2d0\n bus_remove_device+0x1bd/0x240\n device_del+0x357/0x770\n phy_device_remove+0x11/0x30\n mdiobus_unregister+0xa5/0x140\n release_nodes+0x6a/0xa0\n devres_release_all+0xf8/0x150\n device_unbind_cleanup+0x19/0xd0\n\n//probe path:\nphy_device_register()\n  device_add()\n\nphy_connect\n  phy_attach_direct() //set device driver\n    probe() //it's failed, driver is not bound\n    device_bind_driver() // probe failed, it's not called\n\n//remove path:\nphy_device_remove()\n  device_del()\n    device_release_driver_internal()\n      __device_release_driver() //dev-\u003edrv is not NULL\n        klist_remove() \u003c- knode_driver is not added yet, cause null-ptr-deref\n\nIn phy_attach_direct(), after setting the 'dev-\u003edriver', probe() fails,\ndevice_bind_driver() is not called, so the knode_driver-\u003en_klist is not\nset, then it causes null-ptr-deref in __device_release_driver() while\ndeleting device. Fix this by setting dev-\u003edriver to NULL in the error\npath in phy_attach_direct().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3c35d54-5820-44d0-be53-be647756c232",
      "id": "CVE-2022-49216",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tegra: Fix reference leak in tegra_dsi_ganged_probe\n\nThe reference taken by 'of_find_device_by_node()' must be released when\nnot needed anymore. Add put_device() call to fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4e464b7-64ee-47d9-a89c-07315ceb20ed",
      "id": "CVE-2022-49248",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction\n\nAV/C deferred transaction was supported at a commit 00a7bb81c20f (\"ALSA:\nfirewire-lib: Add support for deferred transaction\") while 'deferrable'\nflag can be uninitialized for non-control/notify AV/C transactions.\nUBSAN reports it:\n\nkernel: ================================================================================\nkernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9\nkernel: load of value 158 is not a valid value for type '_Bool'\nkernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P           OE     5.15.0-18-generic #18-Ubuntu\nkernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019\nkernel: Call Trace:\nkernel:  \u003cIRQ\u003e\nkernel:  show_stack+0x52/0x58\nkernel:  dump_stack_lvl+0x4a/0x5f\nkernel:  dump_stack+0x10/0x12\nkernel:  ubsan_epilogue+0x9/0x45\nkernel:  __ubsan_handle_load_invalid_value.cold+0x44/0x49\nkernel:  fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib]\nkernel:  fcp_response+0x28/0x30 [snd_firewire_lib]\nkernel:  fw_core_handle_request+0x230/0x3d0 [firewire_core]\nkernel:  handle_ar_packet+0x1d9/0x200 [firewire_ohci]\nkernel:  ? handle_ar_packet+0x1d9/0x200 [firewire_ohci]\nkernel:  ? transmit_complete_callback+0x9f/0x120 [firewire_core]\nkernel:  ar_context_tasklet+0xa8/0x2e0 [firewire_ohci]\nkernel:  tasklet_action_common.constprop.0+0xea/0xf0\nkernel:  tasklet_action+0x22/0x30\nkernel:  __do_softirq+0xd9/0x2e3\nkernel:  ? irq_finalize_oneshot.part.0+0xf0/0xf0\nkernel:  do_softirq+0x75/0xa0\nkernel:  \u003c/IRQ\u003e\nkernel:  \u003cTASK\u003e\nkernel:  __local_bh_enable_ip+0x50/0x60\nkernel:  irq_forced_thread_fn+0x7e/0x90\nkernel:  irq_thread+0xba/0x190\nkernel:  ? irq_thread_fn+0x60/0x60\nkernel:  kthread+0x11e/0x140\nkernel:  ? irq_thread_check_affinity+0xf0/0xf0\nkernel:  ? set_kthread_struct+0x50/0x50\nkernel:  ret_from_fork+0x22/0x30\nkernel:  \u003c/TASK\u003e\nkernel: ================================================================================\n\nThis commit fixes the bug. The bug has no disadvantage for the non-\ncontrol/notify AV/C transactions since the flag has an effect for AV/C\nresponse with INTERIM (0x0f) status which is not used for the transactions\nin AV/C general specification.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b7b826a-6b26-490b-8df3-b535b664bb06",
      "id": "CVE-2022-49288",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent prealloc proc writes\n\nWe have no protection against concurrent PCM buffer preallocation\nchanges via proc files, and it may potentially lead to UAF or some\nweird problem.  This patch applies the PCM open_mutex to the proc\nwrite operation for avoiding the racy proc writes and the PCM stream\nopen (and further operations).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14baa91b-7f3a-4f76-99fd-a69a671a037d",
      "id": "CVE-2022-49296",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix possible deadlock when holding Fwb to get inline_data\n\n1, mount with wsync.\n2, create a file with O_RDWR, and the request was sent to mds.0:\n\n   ceph_atomic_open()--\u003e\n     ceph_mdsc_do_request(openc)\n     finish_open(file, dentry, ceph_open)--\u003e\n       ceph_open()--\u003e\n         ceph_init_file()--\u003e\n           ceph_init_file_info()--\u003e\n             ceph_uninline_data()--\u003e\n             {\n               ...\n               if (inline_version == 1 || /* initial version, no data */\n                   inline_version == CEPH_INLINE_NONE)\n                     goto out_unlock;\n               ...\n             }\n\nThe inline_version will be 1, which is the initial version for the\nnew create file. And here the ci-\u003ei_inline_version will keep with 1,\nit's buggy.\n\n3, buffer write to the file immediately:\n\n   ceph_write_iter()--\u003e\n     ceph_get_caps(file, need=Fw, want=Fb, ...);\n     generic_perform_write()--\u003e\n       a_ops-\u003ewrite_begin()--\u003e\n         ceph_write_begin()--\u003e\n           netfs_write_begin()--\u003e\n             netfs_begin_read()--\u003e\n               netfs_rreq_submit_slice()--\u003e\n                 netfs_read_from_server()--\u003e\n                   rreq-\u003enetfs_ops-\u003eissue_read()--\u003e\n                     ceph_netfs_issue_read()--\u003e\n                     {\n                       ...\n                       if (ci-\u003ei_inline_version != CEPH_INLINE_NONE \u0026\u0026\n                           ceph_netfs_issue_op_inline(subreq))\n                         return;\n                       ...\n                     }\n     ceph_put_cap_refs(ci, Fwb);\n\nThe ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to\nmds.1.\n\n4, then the mds.1 will request the rd lock for CInode::filelock from\nthe auth mds.0, the mds.0 will do the CInode::filelock state transation\nfrom excl --\u003e sync, but it need to revoke the Fxwb caps back from the\nclients.\n\nWhile the kernel client has aleady held the Fwb caps and waiting for\nthe getattr(Fsr).\n\nIt's deadlock!\n\nURL: https://tracker.ceph.com/issues/55377",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d2f0d63f-ea93-4aa7-94bb-32dded60b412",
      "id": "CVE-2022-49328",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: fix use-after-free by removing a non-RCU wcid pointer\n\nFixes an issue caught by KASAN about use-after-free in mt76_txq_schedule\nby protecting mtxq-\u003ewcid with rcu_lock between mt76_txq_schedule and\nsta_info_[alloc, free].\n\n[18853.876689] ==================================================================\n[18853.876751] BUG: KASAN: use-after-free in mt76_txq_schedule+0x204/0xaf8 [mt76]\n[18853.876773] Read of size 8 at addr ffffffaf989a2138 by task mt76-tx phy0/883\n[18853.876786]\n[18853.876810] CPU: 5 PID: 883 Comm: mt76-tx phy0 Not tainted 5.10.100-fix-510-56778d365941-kasan #5 0b01fbbcf41a530f52043508fec2e31a4215\n\n[18853.876840] Call trace:\n[18853.876861]  dump_backtrace+0x0/0x3ec\n[18853.876878]  show_stack+0x20/0x2c\n[18853.876899]  dump_stack+0x11c/0x1ac\n[18853.876918]  print_address_description+0x74/0x514\n[18853.876934]  kasan_report+0x134/0x174\n[18853.876948]  __asan_report_load8_noabort+0x44/0x50\n[18853.876976]  mt76_txq_schedule+0x204/0xaf8 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]\n[18853.877002]  mt76_txq_schedule_all+0x2c/0x48 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]\n[18853.877030]  mt7921_tx_worker+0xa0/0x1cc [mt7921_common f0875ebac9d7b4754e1010549e7db50fbd90a047]\n[18853.877054]  __mt76_worker_fn+0x190/0x22c [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]\n[18853.877071]  kthread+0x2f8/0x3b8\n[18853.877087]  ret_from_fork+0x10/0x30\n[18853.877098]\n[18853.877112] Allocated by task 941:\n[18853.877131]  kasan_save_stack+0x38/0x68\n[18853.877147]  __kasan_kmalloc+0xd4/0xfc\n[18853.877163]  kasan_kmalloc+0x10/0x1c\n[18853.877177]  __kmalloc+0x264/0x3c4\n[18853.877294]  sta_info_alloc+0x460/0xf88 [mac80211]\n[18853.877410]  ieee80211_prep_connection+0x204/0x1ee0 [mac80211]\n[18853.877523]  ieee80211_mgd_auth+0x6c4/0xa4c [mac80211]\n[18853.877635]  ieee80211_auth+0x20/0x2c [mac80211]\n[18853.877733]  rdev_auth+0x7c/0x438 [cfg80211]\n[18853.877826]  cfg80211_mlme_auth+0x26c/0x390 [cfg80211]\n[18853.877919]  nl80211_authenticate+0x6d4/0x904 [cfg80211]\n[18853.877938]  genl_rcv_msg+0x748/0x93c\n[18853.877954]  netlink_rcv_skb+0x160/0x2a8\n[18853.877969]  genl_rcv+0x3c/0x54\n[18853.877985]  netlink_unicast_kernel+0x104/0x1ec\n[18853.877999]  netlink_unicast+0x178/0x268\n[18853.878015]  netlink_sendmsg+0x3cc/0x5f0\n[18853.878030]  sock_sendmsg+0xb4/0xd8\n[18853.878043]  ____sys_sendmsg+0x2f8/0x53c\n[18853.878058]  ___sys_sendmsg+0xe8/0x150\n[18853.878071]  __sys_sendmsg+0xc4/0x1f4\n[18853.878087]  __arm64_compat_sys_sendmsg+0x88/0x9c\n[18853.878101]  el0_svc_common+0x1b4/0x390\n[18853.878115]  do_el0_svc_compat+0x8c/0xdc\n[18853.878131]  el0_svc_compat+0x10/0x1c\n[18853.878146]  el0_sync_compat_handler+0xa8/0xcc\n[18853.878161]  el0_sync_compat+0x188/0x1c0\n[18853.878171]\n[18853.878183] Freed by task 10927:\n[18853.878200]  kasan_save_stack+0x38/0x68\n[18853.878215]  kasan_set_track+0x28/0x3c\n[18853.878228]  kasan_set_free_info+0x24/0x48\n[18853.878244]  __kasan_slab_free+0x11c/0x154\n[18853.878259]  kasan_slab_free+0x14/0x24\n[18853.878273]  slab_free_freelist_hook+0xac/0x1b0\n[18853.878287]  kfree+0x104/0x390\n[18853.878402]  sta_info_free+0x198/0x210 [mac80211]\n[18853.878515]  __sta_info_destroy_part2+0x230/0x2d4 [mac80211]\n[18853.878628]  __sta_info_flush+0x300/0x37c [mac80211]\n[18853.878740]  ieee80211_set_disassoc+0x2cc/0xa7c [mac80211]\n[18853.878851]  ieee80211_mgd_deauth+0x4a4/0x10a0 [mac80211]\n[18853.878962]  ieee80211_deauth+0x20/0x2c [mac80211]\n[18853.879057]  rdev_deauth+0x7c/0x438 [cfg80211]\n[18853.879150]  cfg80211_mlme_deauth+0x274/0x414 [cfg80211]\n[18853.879243]  cfg80211_mlme_down+0xe4/0x118 [cfg80211]\n[18853.879335]  cfg80211_disconnect+0x218/0x2d8 [cfg80211]\n[18853.879427]  __cfg80211_leave+0x17c/0x240 [cfg80211]\n[18853.879519]  cfg80211_leave+0x3c/0x58 [cfg80211]\n[18853.879611]  wiphy_suspend+0xdc/0x200 [cfg80211]\n[18853.879628]  dpm_run_callback+0x58/0x408\n[18853.879642]  __device_suspend+0x4cc/0x864\n[18853.879658]  async_suspend+0x34/0xf4\n[18\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ebe6d194-7730-4a1d-9db9-810e6e57b357",
      "id": "CVE-2022-49545",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Cancel pending work at closing a MIDI substream\n\nAt closing a USB MIDI output substream, there might be still a pending\nwork, which would eventually access the rawmidi runtime object that is\nbeing released.  For fixing the race, make sure to cancel the pending\nwork at closing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1eff4fd9-5914-4608-bada-0b58f3fbd408",
      "id": "CVE-2022-50165",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`\n\nCommit 7a4836560a61 changes simple_write_to_buffer() with memdup_user()\nbut it forgets to change the value to be returned that came from\nsimple_write_to_buffer() call. It results in the following warning:\n\n  warning: variable 'rc' is uninitialized when used here [-Wuninitialized]\n           return rc;\n                  ^~\n\nRemove rc variable and just return the passed in length if the\nmemdup_user() succeeds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3b769e7a-1bf7-44f7-a54f-ba7de683c4d1",
      "id": "CVE-2022-49793",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()\n\ndev_set_name() allocates memory for name, it need be freed\nwhen device_add() fails, call put_device() to give up the\nreference that hold in device_initialize(), so that it can\nbe freed in kobject_cleanup() when the refcount hit to 0.\n\nFault injection test can trigger this:\n\nunreferenced object 0xffff8e8340a7b4c0 (size 32):\n  comm \"modprobe\", pid 243, jiffies 4294678145 (age 48.845s)\n  hex dump (first 32 bytes):\n    69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65  iio_sysfs_trigge\n    72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff  r..@............\n  backtrace:\n    [\u003c0000000074999de8\u003e] __kmem_cache_alloc_node+0x1e9/0x360\n    [\u003c00000000497fd30b\u003e] __kmalloc_node_track_caller+0x44/0x1a0\n    [\u003c000000003636c520\u003e] kstrdup+0x2d/0x60\n    [\u003c0000000032f84da2\u003e] kobject_set_name_vargs+0x1e/0x90\n    [\u003c0000000092efe493\u003e] dev_set_name+0x4e/0x70",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3096cc2f-2d11-4124-b499-012a1edffd53",
      "id": "CVE-2022-49812",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: switchdev: Fix memory leaks when changing VLAN protocol\n\nThe bridge driver can offload VLANs to the underlying hardware either\nvia switchdev or the 8021q driver. When the former is used, the VLAN is\nmarked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV'\nprivate flag.\n\nTo avoid the memory leaks mentioned in the cited commit, the bridge\ndriver will try to delete a VLAN via the 8021q driver if the VLAN is not\nmarked with the previously mentioned flag.\n\nWhen the VLAN protocol of the bridge changes, switchdev drivers are\nnotified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but\nthe 8021q driver is also called to add the existing VLANs with the new\nprotocol and delete them with the old protocol.\n\nIn case the VLANs were offloaded via switchdev, the above behavior is\nboth redundant and buggy. Redundant because the VLANs are already\nprogrammed in hardware and drivers that support VLAN protocol change\n(currently only mlx5) change the protocol upon the switchdev attribute\nnotification. Buggy because the 8021q driver is called despite these\nVLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to\nmemory leaks [1] when the VLANs are deleted.\n\nFix by not calling the 8021q driver for VLANs that were already\nprogrammed via switchdev.\n\n[1]\nunreferenced object 0xffff8881f6771200 (size 256):\n  comm \"ip\", pid 446855, jiffies 4298238841 (age 55.240s)\n  hex dump (first 32 bytes):\n    00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c00000000012819ac\u003e] vlan_vid_add+0x437/0x750\n    [\u003c00000000f2281fad\u003e] __br_vlan_set_proto+0x289/0x920\n    [\u003c000000000632b56f\u003e] br_changelink+0x3d6/0x13f0\n    [\u003c0000000089d25f04\u003e] __rtnl_newlink+0x8ae/0x14c0\n    [\u003c00000000f6276baf\u003e] rtnl_newlink+0x5f/0x90\n    [\u003c00000000746dc902\u003e] rtnetlink_rcv_msg+0x336/0xa00\n    [\u003c000000001c2241c0\u003e] netlink_rcv_skb+0x11d/0x340\n    [\u003c0000000010588814\u003e] netlink_unicast+0x438/0x710\n    [\u003c00000000e1a4cd5c\u003e] netlink_sendmsg+0x788/0xc40\n    [\u003c00000000e8992d4e\u003e] sock_sendmsg+0xb0/0xe0\n    [\u003c00000000621b8f91\u003e] ____sys_sendmsg+0x4ff/0x6d0\n    [\u003c000000000ea26996\u003e] ___sys_sendmsg+0x12e/0x1b0\n    [\u003c00000000684f7e25\u003e] __sys_sendmsg+0xab/0x130\n    [\u003c000000004538b104\u003e] do_syscall_64+0x3d/0x90\n    [\u003c0000000091ed9678\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c53622c8-f12f-4a54-99e6-93778dae7a85",
      "id": "CVE-2022-49839",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_sas: Fix error handling in sas_phy_add()\n\nIf transport_add_device() fails in sas_phy_add(), the kernel will crash\ntrying to delete the device in transport_remove_device() called from\nsas_remove_host().\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000108\nCPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc1+ #173\npstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : device_del+0x54/0x3d0\nlr : device_del+0x37c/0x3d0\nCall trace:\n device_del+0x54/0x3d0\n attribute_container_class_device_del+0x28/0x38\n transport_remove_classdev+0x6c/0x80\n attribute_container_device_trigger+0x108/0x110\n transport_remove_device+0x28/0x38\n sas_phy_delete+0x30/0x60 [scsi_transport_sas]\n do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas]\n device_for_each_child+0x68/0xb0\n sas_remove_children+0x40/0x50 [scsi_transport_sas]\n sas_remove_host+0x20/0x38 [scsi_transport_sas]\n hisi_sas_remove+0x40/0x68 [hisi_sas_main]\n hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw]\n platform_remove+0x2c/0x60\n\nFix this by checking and handling return value of transport_add_device()\nin sas_phy_add().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d307f3b5-1f88-475d-92b3-33b7c211341e",
      "id": "CVE-2022-49874",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: fix possible memory leak in mousevsc_probe()\n\nIf hid_add_device() returns error, it should call hid_destroy_device()\nto free hid_dev which is allocated in hid_allocate_device().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0b1098c-3edb-4f17-bcd9-9a4577c9ccb5",
      "id": "CVE-2022-49892",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix use-after-free for dynamic ftrace_ops\n\nKASAN reported a use-after-free with ftrace ops [1]. It was found from\nvmcore that perf had registered two ops with the same content\nsuccessively, both dynamic. After unregistering the second ops, a\nuse-after-free occurred.\n\nIn ftrace_shutdown(), when the second ops is unregistered, the\nFTRACE_UPDATE_CALLS command is not set because there is another enabled\nops with the same content.  Also, both ops are dynamic and the ftrace\ncallback function is ftrace_ops_list_func, so the\nFTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value\nof 'command' will be 0 and ftrace_shutdown() will skip the rcu\nsynchronization.\n\nHowever, ftrace may be activated. When the ops is released, another CPU\nmay be accessing the ops.  Add the missing synchronization to fix this\nproblem.\n\n[1]\nBUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\nBUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\nRead of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468\n\nCPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132\n show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1b4/0x248 lib/dump_stack.c:118\n print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387\n __kasan_report mm/kasan/report.c:547 [inline]\n kasan_report+0x118/0x210 mm/kasan/report.c:564\n check_memory_region_inline mm/kasan/generic.c:187 [inline]\n __asan_load8+0x98/0xc0 mm/kasan/generic.c:253\n __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\n ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\n ftrace_graph_call+0x0/0x4\n __might_sleep+0x8/0x100 include/linux/perf_event.h:1170\n __might_fault mm/memory.c:5183 [inline]\n __might_fault+0x58/0x70 mm/memory.c:5171\n do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]\n strncpy_from_user+0x1f4/0x4b0 lib/strncpy_from_user.c:139\n getname_flags+0xb0/0x31c fs/namei.c:149\n getname+0x2c/0x40 fs/namei.c:209\n [...]\n\nAllocated by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc mm/kasan/common.c:479 [inline]\n __kasan_kmalloc.constprop.0+0x110/0x13c mm/kasan/common.c:449\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493\n kmem_cache_alloc_trace+0x440/0x924 mm/slub.c:2950\n kmalloc include/linux/slab.h:563 [inline]\n kzalloc include/linux/slab.h:675 [inline]\n perf_event_alloc.part.0+0xb4/0x1350 kernel/events/core.c:11230\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n __arm64_sys_perf_event_open+0x6c/0x80 kernel/events/core.c:11723\n [...]\n\nFreed by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track+0x24/0x34 mm/kasan/common.c:56\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:358\n __kasan_slab_free.part.0+0x11c/0x1b0 mm/kasan/common.c:437\n __kasan_slab_free mm/kasan/common.c:445 [inline]\n kasan_slab_free+0x2c/0x40 mm/kasan/common.c:446\n slab_free_hook mm/slub.c:1569 [inline]\n slab_free_freelist_hook mm/slub.c:1608 [inline]\n slab_free mm/slub.c:3179 [inline]\n kfree+0x12c/0xc10 mm/slub.c:4176\n perf_event_alloc.part.0+0xa0c/0x1350 kernel/events/core.c:11434\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n [...]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a46947d2-c0e9-420a-87c2-d8e6e9ad42c3",
      "id": "CVE-2022-49969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: clear optc underflow before turn off odm clock\n\n[Why]\nAfter ODM clock off, optc underflow bit will be kept there always and clear not work.\nWe need to clear that before clock off.\n\n[How]\nClear that if have when clock off.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3921f01b-477a-4322-a897-3cda17d72770",
      "id": "CVE-2022-50106",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address\n\nof_get_next_parent() returns a node pointer with refcount incremented,\nwe should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() in the error path to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a6eb5dc-5474-4cd0-b7f5-d6f75b51f2d1",
      "id": "CVE-2022-50358",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbrcmfmac: return error when getting invalid max_flowrings from dongle\n\nWhen firmware hit trap at initialization, host will read abnormal\nmax_flowrings number from dongle, and it will cause kernel panic when\ndoing iowrite to initialize dongle ring.\nTo detect this error at early stage, we directly return error when getting\ninvalid max_flowrings(\u003e256).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71747046-fea6-4f5d-9511-9eb8621280f9",
      "id": "CVE-2022-50417",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix GEM handle creation ref-counting\n\npanfrost_gem_create_with_handle() previously returned a BO but with the\nonly reference being from the handle, which user space could in theory\nguess and release, causing a use-after-free. Additionally if the call to\npanfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then\na(nother) reference on the BO was dropped.\n\nThe _create_with_handle() is a problematic pattern, so ditch it and\ninstead create the handle in panfrost_ioctl_create_bo(). If the call to\npanfrost_gem_mapping_get() fails then this means that user space has\nindeed gone behind our back and freed the handle. In which case just\nreturn an error code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3f6e069-e2d1-45ed-9004-55c520479c55",
      "id": "CVE-2023-0160",
      "description": "A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d1f2e44-1061-42a1-ad8b-85b419a9e56f",
      "id": "CVE-2023-1249",
      "description": "A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 (\"coredump: Use the vma snapshot in fill_files_note\") not applied yet, then kernel could be affected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58bbc8ce-fce5-46ef-a898-d30658742fd4",
      "id": "CVE-2023-23454",
      "description": "cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "267a122e-ba81-4b39-bf28-2d8770793503",
      "id": "CVE-2023-3141",
      "description": "A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa1fdc7c-4e94-4896-adc8-024db4fa0fd8",
      "id": "CVE-2023-39197",
      "description": "An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "699c5622-2be8-4927-b30b-33116436601d",
      "id": "CVE-2023-42754",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3683e6f-4490-4947-9814-a7a6522dcd4f",
      "id": "CVE-2023-51043",
      "description": "In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e54c591-19f2-4df2-9244-811fd5ea6b21",
      "id": "CVE-2023-51780",
      "description": "An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "22de732c-fdd1-497b-b1ef-c68c244668ee",
      "id": "CVE-2023-53005",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntrace_events_hist: add check for return value of 'create_hist_field'\n\nFunction 'create_hist_field' is called recursively at\ntrace_events_hist.c:1954 and can return NULL-value that's why we have\nto check it to avoid null pointer dereference.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7d53ea8-7869-44d8-867d-e8607c90018a",
      "id": "CVE-2023-52638",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: prevent deadlock by changing j1939_socks_lock to rwlock\n\nThe following 3 locks would race against each other, causing the\ndeadlock situation in the Syzbot bug report:\n\n- j1939_socks_lock\n- active_session_list_lock\n- sk_session_queue_lock\n\nA reasonable fix is to change j1939_socks_lock to an rwlock, since in\nthe rare situations where a write lock is required for the linked list\nthat j1939_socks_lock is protecting, the code does not attempt to\nacquire any more locks. This would break the circular lock dependency,\nwhere, for example, the current thread already locks j1939_socks_lock\nand attempts to acquire sk_session_queue_lock, and at the same time,\nanother thread attempts to acquire j1939_socks_lock while holding\nsk_session_queue_lock.\n\nNOTE: This patch along does not fix the unregister_netdevice bug\nreported by Syzbot; instead, it solves a deadlock situation to prepare\nfor one or more further patches to actually fix the Syzbot bug, which\nappears to be a reference counting problem within the j1939 codebase.\n\n[mkl: remove unrelated newline change]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b2e7241-ed60-4367-b716-8ab3605d67fd",
      "id": "CVE-2023-52670",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: virtio: Free driver_override when rpmsg_remove()\n\nFree driver_override when rpmsg_remove(), otherwise\nthe following memory leak will occur:\n\nunreferenced object 0xffff0000d55d7080 (size 128):\n  comm \"kworker/u8:2\", pid 56, jiffies 4294893188 (age 214.272s)\n  hex dump (first 32 bytes):\n    72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00  rpmsg_ns........\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c000000009c94c9c1\u003e] __kmem_cache_alloc_node+0x1f8/0x320\n    [\u003c000000002300d89b\u003e] __kmalloc_node_track_caller+0x44/0x70\n    [\u003c00000000228a60c3\u003e] kstrndup+0x4c/0x90\n    [\u003c0000000077158695\u003e] driver_set_override+0xd0/0x164\n    [\u003c000000003e9c4ea5\u003e] rpmsg_register_device_override+0x98/0x170\n    [\u003c000000001c0c89a8\u003e] rpmsg_ns_register_device+0x24/0x30\n    [\u003c000000008bbf8fa2\u003e] rpmsg_probe+0x2e0/0x3ec\n    [\u003c00000000e65a68df\u003e] virtio_dev_probe+0x1c0/0x280\n    [\u003c00000000443331cc\u003e] really_probe+0xbc/0x2dc\n    [\u003c00000000391064b1\u003e] __driver_probe_device+0x78/0xe0\n    [\u003c00000000a41c9a5b\u003e] driver_probe_device+0xd8/0x160\n    [\u003c000000009c3bd5df\u003e] __device_attach_driver+0xb8/0x140\n    [\u003c0000000043cd7614\u003e] bus_for_each_drv+0x7c/0xd4\n    [\u003c000000003b929a36\u003e] __device_attach+0x9c/0x19c\n    [\u003c00000000a94e0ba8\u003e] device_initial_probe+0x14/0x20\n    [\u003c000000003c999637\u003e] bus_probe_device+0xa0/0xac",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f6de8930-7c48-4ba7-aac0-eabcc315ba28",
      "id": "CVE-2023-52743",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Do not use WQ_MEM_RECLAIM flag for workqueue\n\nWhen both ice and the irdma driver are loaded, a warning in\ncheck_flush_dependency is being triggered. This is due to ice driver\nworkqueue being allocated with the WQ_MEM_RECLAIM flag and the irdma one\nis not.\n\nAccording to kernel documentation, this flag should be set if the\nworkqueue will be involved in the kernel's memory reclamation flow.\nSince it is not, there is no need for the ice driver's WQ to have this\nflag set so remove it.\n\nExample trace:\n\n[  +0.000004] workqueue: WQ_MEM_RECLAIM ice:ice_service_task [ice] is flushing !WQ_MEM_RECLAIM infiniband:0x0\n[  +0.000139] WARNING: CPU: 0 PID: 728 at kernel/workqueue.c:2632 check_flush_dependency+0x178/0x1a0\n[  +0.000011] Modules linked in: bonding tls xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_cha\nin_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rfkill vfat fat intel_rapl_msr intel\n_rapl_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct1\n0dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_\ncore_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_cm iw_cm iTCO_wdt iTCO_vendor_support ipmi_ssif irdma mei_me ib_uverbs\nib_core intel_uncore joydev pcspkr i2c_i801 acpi_ipmi mei lpc_ich i2c_smbus intel_pch_thermal ioatdma ipmi_si acpi_power_meter\nacpi_pad xfs libcrc32c sd_mod t10_pi crc64_rocksoft crc64 sg ahci ixgbe libahci ice i40e igb crc32c_intel mdio i2c_algo_bit liba\nta dca wmi dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse\n[  +0.000161]  [last unloaded: bonding]\n[  +0.000006] CPU: 0 PID: 728 Comm: kworker/0:2 Tainted: G S                 6.2.0-rc2_next-queue-13jan-00458-gc20aabd57164 #1\n[  +0.000006] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020\n[  +0.000003] Workqueue: ice ice_service_task [ice]\n[  +0.000127] RIP: 0010:check_flush_dependency+0x178/0x1a0\n[  +0.000005] Code: 89 8e 02 01 e8 49 3d 40 00 49 8b 55 18 48 8d 8d d0 00 00 00 48 8d b3 d0 00 00 00 4d 89 e0 48 c7 c7 e0 3b 08\n9f e8 bb d3 07 01 \u003c0f\u003e 0b e9 be fe ff ff 80 3d 24 89 8e 02 00 0f 85 6b ff ff ff e9 06\n[  +0.000004] RSP: 0018:ffff88810a39f990 EFLAGS: 00010282\n[  +0.000005] RAX: 0000000000000000 RBX: ffff888141bc2400 RCX: 0000000000000000\n[  +0.000004] RDX: 0000000000000001 RSI: dffffc0000000000 RDI: ffffffffa1213a80\n[  +0.000003] RBP: ffff888194bf3400 R08: ffffed117b306112 R09: ffffed117b306112\n[  +0.000003] R10: ffff888bd983088b R11: ffffed117b306111 R12: 0000000000000000\n[  +0.000003] R13: ffff888111f84d00 R14: ffff88810a3943ac R15: ffff888194bf3400\n[  +0.000004] FS:  0000000000000000(0000) GS:ffff888bd9800000(0000) knlGS:0000000000000000\n[  +0.000003] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  +0.000003] CR2: 000056035b208b60 CR3: 000000017795e005 CR4: 00000000007706f0\n[  +0.000003] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  +0.000003] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  +0.000002] PKRU: 55555554\n[  +0.000003] Call Trace:\n[  +0.000002]  \u003cTASK\u003e\n[  +0.000003]  __flush_workqueue+0x203/0x840\n[  +0.000006]  ? mutex_unlock+0x84/0xd0\n[  +0.000008]  ? __pfx_mutex_unlock+0x10/0x10\n[  +0.000004]  ? __pfx___flush_workqueue+0x10/0x10\n[  +0.000006]  ? mutex_lock+0xa3/0xf0\n[  +0.000005]  ib_cache_cleanup_one+0x39/0x190 [ib_core]\n[  +0.000174]  __ib_unregister_device+0x84/0xf0 [ib_core]\n[  +0.000094]  ib_unregister_device+0x25/0x30 [ib_core]\n[  +0.000093]  irdma_ib_unregister_device+0x97/0xc0 [irdma]\n[  +0.000064]  ? __pfx_irdma_ib_unregister_device+0x10/0x10 [irdma]\n[  +0.000059]  ? up_write+0x5c/0x90\n[  +0.000005]  irdma_remove+0x36/0x90 [irdma]\n[  +0.000062]  auxiliary_bus_remove+0x32/0x50\n[  +0.000007]  device_r\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96e57b0b-f53a-4303-ac01-aa585bbfb1b4",
      "id": "CVE-2023-52901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Check endpoint is valid before dereferencing it\n\nWhen the host controller is not responding, all URBs queued to all\nendpoints need to be killed. This can cause a kernel panic if we\ndereference an invalid endpoint.\n\nFix this by using xhci_get_virt_ep() helper to find the endpoint and\nchecking if the endpoint is valid before dereferencing it.\n\n[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead\n[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8\n\n[233311.853964] pc : xhci_hc_died+0x10c/0x270\n[233311.853971] lr : xhci_hc_died+0x1ac/0x270\n\n[233311.854077] Call trace:\n[233311.854085]  xhci_hc_died+0x10c/0x270\n[233311.854093]  xhci_stop_endpoint_command_watchdog+0x100/0x1a4\n[233311.854105]  call_timer_fn+0x50/0x2d4\n[233311.854112]  expire_timers+0xac/0x2e4\n[233311.854118]  run_timer_softirq+0x300/0xabc\n[233311.854127]  __do_softirq+0x148/0x528\n[233311.854135]  irq_exit+0x194/0x1a8\n[233311.854143]  __handle_domain_irq+0x164/0x1d0\n[233311.854149]  gic_handle_irq.22273+0x10c/0x188\n[233311.854156]  el1_irq+0xfc/0x1a8\n[233311.854175]  lpm_cpuidle_enter+0x25c/0x418 [msm_pm]\n[233311.854185]  cpuidle_enter_state+0x1f0/0x764\n[233311.854194]  do_idle+0x594/0x6ac\n[233311.854201]  cpu_startup_entry+0x7c/0x80\n[233311.854209]  secondary_start_kernel+0x170/0x198",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e49524a-7095-45b7-a41e-8fd169475f78",
      "id": "CVE-2023-52974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress\n\nIf during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,\nuserspace could be accessing the host's ipaddress attr. If we then free the\nsession via iscsi_session_teardown() while userspace is still accessing the\nsession we will hit a use after free bug.\n\nSet the tcp_sw_host-\u003esession after we have completed session creation and\ncan no longer fail.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c081255-013e-4b7f-940e-91c9b3543d68",
      "id": "CVE-2023-53015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: betop: check shape of output reports\n\nbetopff_init() only checks the total sum of the report counts for each\nreport field to be at least 4, but hid_betopff_play() expects 4 report\nfields.\nA device advertising an output report with one field and 4 report counts\nwould pass the check but crash the kernel with a NULL pointer dereference\nin hid_betopff_play().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79d264ef-5093-4456-b8db-4dd2af553c8f",
      "id": "CVE-2023-53296",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check send stream number after wait_for_sndbuf\n\nThis patch fixes a corner case where the asoc out stream count may change\nafter wait_for_sndbuf.\n\nWhen the main thread in the client starts a connection, if its out stream\ncount is set to N while the in stream count in the server is set to N - 2,\nanother thread in the client keeps sending the msgs with stream number\nN - 1, and waits for sndbuf before processing INIT_ACK.\n\nHowever, after processing INIT_ACK, the out stream count in the client is\nshrunk to N - 2, the same to the in stream count in the server. The crash\noccurs when the thread waiting for sndbuf is awake and sends the msg in a\nnon-existing stream(N - 1), the call trace is as below:\n\n  KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n  Call Trace:\n   \u003cTASK\u003e\n   sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline]\n   sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline]\n   sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]\n   sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170\n   sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163\n   sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868\n   sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026\n   inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825\n   sock_sendmsg_nosec net/socket.c:722 [inline]\n   sock_sendmsg+0xde/0x190 net/socket.c:745\n\nThe fix is to add an unlikely check for the send stream number after the\nthread wakes up from the wait_for_sndbuf.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30937612-50ce-49b3-936c-ae878551f206",
      "id": "CVE-2023-53347",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Handle pairing of E-switch via uplink un/load APIs\n\nIn case user switch a device from switchdev mode to legacy mode, mlx5\nfirst unpair the E-switch and afterwards unload the uplink vport.\nFrom the other hand, in case user remove or reload a device, mlx5\nfirst unload the uplink vport and afterwards unpair the E-switch.\n\nThe latter is causing a bug[1], hence, handle pairing of E-switch as\npart of uplink un/load APIs.\n\n[1]\nIn case VF_LAG is used, every tc fdb flow is duplicated to the peer\nesw. However, the original esw keeps a pointer to this duplicated\nflow, not the peer esw.\ne.g.: if user create tc fdb flow over esw0, the flow is duplicated\nover esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated\nflow.\nDuring module unload while a peer tc fdb flow is still offloaded, in\ncase the first device to be removed is the peer device (esw1 in the\nexample above), the peer net-dev is destroyed, and so the mlx5e_priv\nis memset to 0.\nAfterwards, the peer device is trying to unpair himself from the\noriginal device (esw0 in the example above). Unpair API invoke the\noriginal device to clear peer flow from its eswitch (esw0), but the\npeer flow, which is stored over the original eswitch (esw0), is\ntrying to use the peer mlx5e_priv, which is memset to 0 and result in\nbellow kernel-oops.\n\n[  157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60\n[  157.964662 ] #PF: supervisor read access in kernel mode\n[  157.965123 ] #PF: error_code(0x0000) - not-present page\n[  157.965582 ] PGD 0 P4D 0\n[  157.965866 ] Oops: 0000 [#1] SMP\n[  157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core]\n[  157.976164 ] Call Trace:\n[  157.976437 ]  \u003cTASK\u003e\n[  157.976690 ]  __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core]\n[  157.977230 ]  mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core]\n[  157.977767 ]  mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core]\n[  157.984653 ]  mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core]\n[  157.985212 ]  mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core]\n[  157.985714 ]  esw_offloads_disable+0x5a/0x110 [mlx5_core]\n[  157.986209 ]  mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core]\n[  157.986757 ]  mlx5_eswitch_disable+0x51/0x80 [mlx5_core]\n[  157.987248 ]  mlx5_unload+0x2a/0xb0 [mlx5_core]\n[  157.987678 ]  mlx5_uninit_one+0x5f/0xd0 [mlx5_core]\n[  157.988127 ]  remove_one+0x64/0xe0 [mlx5_core]\n[  157.988549 ]  pci_device_remove+0x31/0xa0\n[  157.988933 ]  device_release_driver_internal+0x18f/0x1f0\n[  157.989402 ]  driver_detach+0x3f/0x80\n[  157.989754 ]  bus_remove_driver+0x70/0xf0\n[  157.990129 ]  pci_unregister_driver+0x34/0x90\n[  157.990537 ]  mlx5_cleanup+0xc/0x1c [mlx5_core]\n[  157.990972 ]  __x64_sys_delete_module+0x15a/0x250\n[  157.991398 ]  ? exit_to_user_mode_prepare+0xea/0x110\n[  157.991840 ]  do_syscall_64+0x3d/0x90\n[  157.992198 ]  entry_SYSCALL_64_after_hwframe+0x46/0xb0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8452e09a-b5b4-4b5d-9dec-be2317cf795b",
      "id": "CVE-2024-26651",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsr9800: Add check for usbnet_get_endpoints\n\nAdd check for usbnet_get_endpoints() and return the error if it fails\nin order to transfer the error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49f361c4-07cb-45f9-9030-52f7f3797bd6",
      "id": "CVE-2024-26772",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()\n\nPlaces the logic for checking if the group's block bitmap is corrupt under\nthe protection of the group lock to avoid allocating blocks from the group\nwith a corrupted block bitmap.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9629e162-ecb8-4a10-a3a2-06242137dec0",
      "id": "CVE-2024-26787",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmci: stm32: fix DMA API overlapping mappings warning\n\nTurning on CONFIG_DMA_API_DEBUG_SG results in the following warning:\n\nDMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST,\noverlapping mappings aren't supported\nWARNING: CPU: 1 PID: 51 at kernel/dma/debug.c:568\nadd_dma_entry+0x234/0x2f4\nModules linked in:\nCPU: 1 PID: 51 Comm: kworker/1:2 Not tainted 6.1.28 #1\nHardware name: STMicroelectronics STM32MP257F-EV1 Evaluation Board (DT)\nWorkqueue: events_freezable mmc_rescan\nCall trace:\nadd_dma_entry+0x234/0x2f4\ndebug_dma_map_sg+0x198/0x350\n__dma_map_sg_attrs+0xa0/0x110\ndma_map_sg_attrs+0x10/0x2c\nsdmmc_idma_prep_data+0x80/0xc0\nmmci_prep_data+0x38/0x84\nmmci_start_data+0x108/0x2dc\nmmci_request+0xe4/0x190\n__mmc_start_request+0x68/0x140\nmmc_start_request+0x94/0xc0\nmmc_wait_for_req+0x70/0x100\nmmc_send_tuning+0x108/0x1ac\nsdmmc_execute_tuning+0x14c/0x210\nmmc_execute_tuning+0x48/0xec\nmmc_sd_init_uhs_card.part.0+0x208/0x464\nmmc_sd_init_card+0x318/0x89c\nmmc_attach_sd+0xe4/0x180\nmmc_rescan+0x244/0x320\n\nDMA API debug brings to light leaking dma-mappings as dma_map_sg and\ndma_unmap_sg are not correctly balanced.\n\nIf an error occurs in mmci_cmd_irq function, only mmci_dma_error\nfunction is called and as this API is not managed on stm32 variant,\ndma_unmap_sg is never called in this error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63d5b2b2-0105-4758-a9ef-7b3c371b1be8",
      "id": "CVE-2024-26869",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t  - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n   due to lock failure or dirty|writeback\n   status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t  - load old data from meta_inode page\n\t\t\t\t\t  - f2fs_submit_page_write\n\t\t\t\t\t  : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6415b489-ce5d-45cf-afe3-69bd3d6e7764",
      "id": "CVE-2024-35864",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_valid_lease_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c7eb1e62-00b2-4fb6-af1c-1fadd58bd767",
      "id": "CVE-2024-35875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/coco: Require seeding RNG with RDRAND on CoCo systems\n\nThere are few uses of CoCo that don't rely on working cryptography and\nhence a working RNG. Unfortunately, the CoCo threat model means that the\nVM host cannot be trusted and may actively work against guests to\nextract secrets or manipulate computation. Since a malicious host can\nmodify or observe nearly all inputs to guests, the only remaining source\nof entropy for CoCo guests is RDRAND.\n\nIf RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole\nis meant to gracefully continue on gathering entropy from other sources,\nbut since there aren't other sources on CoCo, this is catastrophic.\nThis is mostly a concern at boot time when initially seeding the RNG, as\nafter that the consequences of a broken RDRAND are much more\ntheoretical.\n\nSo, try at boot to seed the RNG using 256 bits of RDRAND output. If this\nfails, panic(). This will also trigger if the system is booted without\nRDRAND, as RDRAND is essential for a safe CoCo boot.\n\nAdd this deliberately to be \"just a CoCo x86 driver feature\" and not\npart of the RNG itself. Many device drivers and platforms have some\ndesire to contribute something to the RNG, and add_device_randomness()\nis specifically meant for this purpose.\n\nAny driver can call it with seed data of any quality, or even garbage\nquality, and it can only possibly make the quality of the RNG better or\nhave no effect, but can never make it worse.\n\nRather than trying to build something into the core of the RNG, consider\nthe particular CoCo issue just a CoCo issue, and therefore separate it\nall out into driver (well, arch/platform) code.\n\n  [ bp: Massage commit message. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "50adc77a-85f8-4d10-93e2-daf73fb68070",
      "id": "CVE-2024-35922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbmon: prevent division by zero in fb_videomode_from_videomode()\n\nThe expression htotal * vtotal can have a zero value on\noverflow. It is necessary to prevent division by zero like in\nfb_var_to_videomode().\n\nFound by Linux Verification Center (linuxtesting.org) with Svace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa49a78c-6860-4b0a-909d-aee5258f2c76",
      "id": "CVE-2024-35999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: missing lock when picking channel\n\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\n\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f326e80f-0272-4d6d-8ddc-214fb67bf8a1",
      "id": "CVE-2024-36270",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: tproxy: bail out if IP has been disabled on the device\n\nsyzbot reports:\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n[..]\nRIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62\nCall Trace:\n nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline]\n nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168\n\n__in_dev_get_rcu() can return NULL, so check for this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4f86346e-611b-4d38-b5b8-a4ae39928389",
      "id": "CVE-2024-36288",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix loop termination condition in gss_free_in_token_pages()\n\nThe in_token-\u003epages[] array is not NULL terminated. This results in\nthe following KASAN splat:\n\n  KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "340acbe0-990d-4d19-bdce-69b5b438ac44",
      "id": "CVE-2024-46834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: fail closed if we can't get max channel used in indirection tables\n\nCommit 0d1b7d6c9274 (\"bnxt: fix crashes when reducing ring count with\nactive RSS contexts\") proves that allowing indirection table to contain\nchannels with out of bounds IDs may lead to crashes. Currently the\nmax channel check in the core gets skipped if driver can't fetch\nthe indirection table or when we can't allocate memory.\n\nBoth of those conditions should be extremely rare but if they do\nhappen we should try to be safe and fail the channel change.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73387150-408d-4426-a5d4-ee5bbedd1e8f",
      "id": "CVE-2024-36908",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iocost: do not WARN if iocg was already offlined\n\nIn iocg_pay_debt(), warn is triggered if 'active_list' is empty, which\nis intended to confirm iocg is active when it has debt. However, warn\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\nis run at that time:\n\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\n  Call trace:\n  iocg_pay_debt+0x14c/0x190\n  iocg_kick_waitq+0x438/0x4c0\n  iocg_waitq_timer_fn+0xd8/0x130\n  __run_hrtimer+0x144/0x45c\n  __hrtimer_run_queues+0x16c/0x244\n  hrtimer_interrupt+0x2cc/0x7b0\n\nThe warn in this situation is meaningless. Since this iocg is being\nremoved, the state of the 'active_list' is irrelevant, and 'waitq_timer'\nis canceled after removing 'active_list' in ioc_pd_free(), which ensures\niocg is freed after iocg_waitq_timer_fn() returns.\n\nTherefore, add the check if iocg was already offlined to avoid warn\nwhen removing a blkcg or disk.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f11ff52-4452-4077-ab9d-11384c36bf90",
      "id": "CVE-2024-38559",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Ensure the copied buf is NUL terminated\n\nCurrently, we allocate a count-sized kernel buffer and copy count from\nuserspace to that buffer. Later, we use kstrtouint on this buffer but we\ndon't ensure that the string is terminated inside the buffer, this can\nlead to OOB read when using kstrtouint. Fix this issue by using\nmemdup_user_nul instead of memdup_user.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77cdb1f3-322a-4b55-8e06-312d35f4f391",
      "id": "CVE-2024-38600",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: Fix deadlocks with kctl removals at disconnection\n\nIn snd_card_disconnect(), we set card-\u003eshutdown flag at the beginning,\ncall callbacks and do sync for card-\u003epower_ref_sleep waiters at the\nend.  The callback may delete a kctl element, and this can lead to a\ndeadlock when the device was in the suspended state.  Namely:\n\n* A process waits for the power up at snd_power_ref_and_wait() in\n  snd_ctl_info() or read/write() inside card-\u003econtrols_rwsem.\n\n* The system gets disconnected meanwhile, and the driver tries to\n  delete a kctl via snd_ctl_remove*(); it tries to take\n  card-\u003econtrols_rwsem again, but this is already locked by the\n  above.  Since the sleeper isn't woken up, this deadlocks.\n\nAn easy fix is to wake up sleepers before processing the driver\ndisconnect callbacks but right after setting the card-\u003eshutdown flag.\nThen all sleepers will abort immediately, and the code flows again.\n\nSo, basically this patch moves the wait_event() call at the right\ntiming.  While we're at it, just to be sure, call wait_event_all()\ninstead of wait_event(), although we don't use exclusive events on\nthis queue for now.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81e3390b-1f99-4637-9926-1525c88832eb",
      "id": "CVE-2024-39301",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix uninit-value in p9_client_rpc()\n\nSyzbot with the help of KMSAN reported the following error:\n\nBUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline]\nBUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\n trace_9p_client_res include/trace/events/9p.h:146 [inline]\n p9_client_rpc+0x1314/0x1340 net/9p/client.c:754\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\n path_mount+0x742/0x1f20 fs/namespace.c:3679\n do_mount fs/namespace.c:3692 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was created at:\n __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n alloc_slab_page mm/slub.c:2175 [inline]\n allocate_slab mm/slub.c:2338 [inline]\n new_slab+0x2de/0x1400 mm/slub.c:2391\n ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525\n __slab_alloc mm/slub.c:3610 [inline]\n __slab_alloc_node mm/slub.c:3663 [inline]\n slab_alloc_node mm/slub.c:3835 [inline]\n kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852\n p9_tag_alloc net/9p/client.c:278 [inline]\n p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641\n p9_client_rpc+0x27e/0x1340 net/9p/client.c:688\n p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031\n v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410\n v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122\n legacy_get_tree+0x114/0x290 fs/fs_context.c:662\n vfs_get_tree+0xa7/0x570 fs/super.c:1797\n do_new_mount+0x71f/0x15e0 fs/namespace.c:3352\n path_mount+0x742/0x1f20 fs/namespace.c:3679\n do_mount fs/namespace.c:3692 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x725/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nIf p9_check_errors() fails early in p9_client_rpc(), req-\u003erc.tag\nwill not be properly initialized. However, trace_9p_client_res()\nends up trying to print it out anyway before p9_client_rpc()\nfinishes.\n\nFix this issue by assigning default values to p9_fcall fields\nsuch as 'tag' and (just in case KMSAN unearths something new) 'id'\nduring the tag allocation stage.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07b84401-3751-4c07-945f-04c23e73a5c9",
      "id": "CVE-2024-39495",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: Fix use-after-free bug in gb_interface_release due to race condition.\n\nIn gb_interface_create, \u0026intf-\u003emode_switch_completion is bound with\ngb_interface_mode_switch_work. Then it will be started by\ngb_interface_request_mode_switch. Here is the relevant code.\nif (!queue_work(system_long_wq, \u0026intf-\u003emode_switch_work)) {\n\t...\n}\n\nIf we call gb_interface_release to make cleanup, there may be an\nunfinished work. This function will call kfree to free the object\n\"intf\". However, if gb_interface_mode_switch_work is scheduled to\nrun after kfree, it may cause use-after-free error as\ngb_interface_mode_switch_work will use the object \"intf\".\nThe possible execution flow that may lead to the issue is as follows:\n\nCPU0                            CPU1\n\n                            |   gb_interface_create\n                            |   gb_interface_request_mode_switch\ngb_interface_release        |\nkfree(intf) (free)          |\n                            |   gb_interface_mode_switch_work\n                            |   mutex_lock(\u0026intf-\u003emutex) (use)\n\nFix it by canceling the work before kfree.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4710aeb4-897a-4fe2-a1ee-70162e8fd4b7",
      "id": "CVE-2024-40912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()\n\nThe ieee80211_sta_ps_deliver_wakeup() function takes sta-\u003eps_lock to\nsynchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from\nsoftirq context. However using only spin_lock() to get sta-\u003eps_lock in\nieee80211_sta_ps_deliver_wakeup() does not prevent softirq to execute\non this same CPU, to run ieee80211_tx_h_unicast_ps_buf() and try to\ntake this same lock ending in deadlock. Below is an example of rcu stall\nthat arises in such situation.\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu:    2-....: (42413413 ticks this GP) idle=b154/1/0x4000000000000000 softirq=1763/1765 fqs=21206996\n rcu:    (t=42586894 jiffies g=2057 q=362405 ncpus=4)\n CPU: 2 PID: 719 Comm: wpa_supplicant Tainted: G        W          6.4.0-02158-g1b062f552873 #742\n Hardware name: RPT (r1) (DT)\n pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : queued_spin_lock_slowpath+0x58/0x2d0\n lr : invoke_tx_handlers_early+0x5b4/0x5c0\n sp : ffff00001ef64660\n x29: ffff00001ef64660 x28: ffff000009bc1070 x27: ffff000009bc0ad8\n x26: ffff000009bc0900 x25: ffff00001ef647a8 x24: 0000000000000000\n x23: ffff000009bc0900 x22: ffff000009bc0900 x21: ffff00000ac0e000\n x20: ffff00000a279e00 x19: ffff00001ef646e8 x18: 0000000000000000\n x17: ffff800016468000 x16: ffff00001ef608c0 x15: 0010533c93f64f80\n x14: 0010395c9faa3946 x13: 0000000000000000 x12: 00000000fa83b2da\n x11: 000000012edeceea x10: ffff0000010fbe00 x9 : 0000000000895440\n x8 : 000000000010533c x7 : ffff00000ad8b740 x6 : ffff00000c350880\n x5 : 0000000000000007 x4 : 0000000000000001 x3 : 0000000000000000\n x2 : 0000000000000000 x1 : 0000000000000001 x0 : ffff00000ac0e0e8\n Call trace:\n  queued_spin_lock_slowpath+0x58/0x2d0\n  ieee80211_tx+0x80/0x12c\n  ieee80211_tx_pending+0x110/0x278\n  tasklet_action_common.constprop.0+0x10c/0x144\n  tasklet_action+0x20/0x28\n  _stext+0x11c/0x284\n  ____do_softirq+0xc/0x14\n  call_on_irq_stack+0x24/0x34\n  do_softirq_own_stack+0x18/0x20\n  do_softirq+0x74/0x7c\n  __local_bh_enable_ip+0xa0/0xa4\n  _ieee80211_wake_txqs+0x3b0/0x4b8\n  __ieee80211_wake_queue+0x12c/0x168\n  ieee80211_add_pending_skbs+0xec/0x138\n  ieee80211_sta_ps_deliver_wakeup+0x2a4/0x480\n  ieee80211_mps_sta_status_update.part.0+0xd8/0x11c\n  ieee80211_mps_sta_status_update+0x18/0x24\n  sta_apply_parameters+0x3bc/0x4c0\n  ieee80211_change_station+0x1b8/0x2dc\n  nl80211_set_station+0x444/0x49c\n  genl_family_rcv_msg_doit.isra.0+0xa4/0xfc\n  genl_rcv_msg+0x1b0/0x244\n  netlink_rcv_skb+0x38/0x10c\n  genl_rcv+0x34/0x48\n  netlink_unicast+0x254/0x2bc\n  netlink_sendmsg+0x190/0x3b4\n  ____sys_sendmsg+0x1e8/0x218\n  ___sys_sendmsg+0x68/0x8c\n  __sys_sendmsg+0x44/0x84\n  __arm64_sys_sendmsg+0x20/0x28\n  do_el0_svc+0x6c/0xe8\n  el0_svc+0x14/0x48\n  el0t_64_sync_handler+0xb0/0xb4\n  el0t_64_sync+0x14c/0x150\n\nUsing spin_lock_bh()/spin_unlock_bh() instead prevents softirq to raise\non the same CPU that is holding the lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "505b0172-e0f5-482d-be7c-d807177d19f5",
      "id": "CVE-2024-42304",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: make sure the first directory block is not a hole\n\nThe syzbot constructs a directory that has no dirblock but is non-inline,\ni.e. the first directory block is a hole. And no errors are reported when\ncreating files in this directory in the following flow.\n\n    ext4_mknod\n     ...\n      ext4_add_entry\n        // Read block 0\n        ext4_read_dirblock(dir, block, DIRENT)\n          bh = ext4_bread(NULL, inode, block, 0)\n          if (!bh \u0026\u0026 (type == INDEX || type == DIRENT_HTREE))\n          // The first directory block is a hole\n          // But type == DIRENT, so no error is reported.\n\nAfter that, we get a directory block without '.' and '..' but with a valid\ndentry. This may cause some code that relies on dot or dotdot (such as\nmake_indexed_dir()) to crash.\n\nTherefore when ext4_read_dirblock() finds that the first directory block\nis a hole report that the filesystem is corrupted and return an error to\navoid loading corrupted data from disk causing something bad.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f60e8aaa-865d-4245-8270-daf0207457bb",
      "id": "CVE-2024-43831",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Handle invalid decoder vsi\n\nHandle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi\nis valid for future use.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bec9cae2-dc36-4306-b55d-fba60b9925a1",
      "id": "CVE-2024-46677",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix a potential NULL pointer dereference\n\nWhen sockfd_lookup() fails, gtp_encap_enable_socket() returns a\nNULL pointer, but its callers only check for error pointers thus miss\nthe NULL pointer case.\n\nFix it by returning an error pointer with the error code carried from\nsockfd_lookup().\n\n(I found this bug during code inspection.)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b99be662-c9d4-4d6b-bd11-0f3d35d74dcf",
      "id": "CVE-2024-46707",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3\n\nOn a system with a GICv3, if a guest hasn't been configured with\nGICv3 and that the host is not capable of GICv2 emulation,\na write to any of the ICC_*SGI*_EL1 registers is trapped to EL2.\n\nWe therefore try to emulate the SGI access, only to hit a NULL\npointer as no private interrupt is allocated (no GIC, remember?).\n\nThe obvious fix is to give the guest what it deserves, in the\nshape of a UNDEF exception.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d607ab32-53e6-4757-b8a9-dfa23f4e5dc9",
      "id": "CVE-2024-46723",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix ucode out-of-bounds read warning\n\nClear warning that read ucode[] may out-of-bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "465a1e93-ded0-451e-bfee-30a16a69ea22",
      "id": "CVE-2024-46742",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()\n\nnull-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)\nand parse_lease_state() return NULL.\n\nFix this by check if 'lease_ctx_info' is NULL.\n\nAdditionally, remove the redundant parentheses in\nparse_durable_handle_context().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48ddc908-cd8f-4639-a428-6f98b24c9b29",
      "id": "CVE-2024-46782",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nila: call nf_unregister_net_hooks() sooner\n\nsyzbot found an use-after-free Read in ila_nf_input [1]\n\nIssue here is that ila_xlat_exit_net() frees the rhashtable,\nthen call nf_unregister_net_hooks().\n\nIt should be done in the reverse way, with a synchronize_rcu().\n\nThis is a good match for a pre_exit() method.\n\n[1]\n BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]\n BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]\n BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672\nRead of size 4 at addr ffff888064620008 by task ksoftirqd/0/16\n\nCPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:93 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  rht_key_hashfn include/linux/rhashtable.h:159 [inline]\n  __rhashtable_lookup include/linux/rhashtable.h:604 [inline]\n  rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n  rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672\n  ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]\n  ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]\n  ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626\n  nf_hook include/linux/netfilter.h:269 [inline]\n  NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312\n  __netif_receive_skb_one_core net/core/dev.c:5661 [inline]\n  __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775\n  process_backlog+0x662/0x15b0 net/core/dev.c:6108\n  __napi_poll+0xcb/0x490 net/core/dev.c:6772\n  napi_poll net/core/dev.c:6841 [inline]\n  net_rx_action+0x89b/0x1240 net/core/dev.c:6963\n  handle_softirqs+0x2c4/0x970 kernel/softirq.c:554\n  run_ksoftirqd+0xca/0x130 kernel/softirq.c:928\n  smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164\n  kthread+0x2f0/0x390 kernel/kthread.c:389\n  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620\nflags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)\npage_type: 0xbfffffff(buddy)\nraw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000\nraw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000\npage dumped because: kasan: bad access detected\npage_owner tracks the page as freed\npage last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187\n  set_page_owner include/linux/page_owner.h:32 [inline]\n  post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493\n  prep_new_page mm/page_alloc.c:1501 [inline]\n  get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439\n  __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695\n  __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]\n  alloc_pages_node_noprof include/linux/gfp.h:296 [inline]\n  ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103\n  __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130\n  __do_kmalloc_node mm/slub.c:4146 [inline]\n  __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164\n  __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650\n  bucket_table_alloc lib/rhashtable.c:186 [inline]\n  rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071\n  ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613\n  ops_ini\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d17723a0-6642-47e3-b3cf-7783a9d18001",
      "id": "CVE-2024-46808",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range\n\n[Why \u0026 How]\nASSERT if return NULL from kcalloc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7f8ac74-f639-421a-92aa-23f65134b40c",
      "id": "CVE-2024-46817",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6\n\n[Why]\nCoverity reports OVERRUN warning. Should abort amdgpu_dm\ninitialize.\n\n[How]\nReturn failure to amdgpu_dm_init.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f350a5b9-e0b2-45bc-9943-fa00f0f88e0f",
      "id": "CVE-2024-47666",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Set phy-\u003eenable_completion only when we wait for it\n\npm8001_phy_control() populates the enable_completion pointer with a stack\naddress, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and\nreturns. The problem arises when a phy control response comes late.  After\n300 ms the pm8001_phy_control() function returns and the passed\nenable_completion stack address is no longer valid. Late phy control\nresponse invokes complete() on a dangling enable_completion pointer which\nleads to a kernel crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39d95872-acdd-4426-901c-ac18e6f4f383",
      "id": "CVE-2024-49882",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix double brelse() the buffer of the extents path\n\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\nreleased, otherwise it may be released twice. An example of what triggers\nthis is as follows:\n\n  split2    map    split1\n|--------|-------|--------|\n\next4_ext_map_blocks\n ext4_ext_handle_unwritten_extents\n  ext4_split_convert_extents\n   // path-\u003ep_depth == 0\n   ext4_split_extent\n     // 1. do split1\n     ext4_split_extent_at\n       |ext4_ext_insert_extent\n       |  ext4_ext_create_new_leaf\n       |    ext4_ext_grow_indepth\n       |      le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\n       |    ext4_find_extent\n       |      // return -ENOMEM\n       |// get error and try zeroout\n       |path = ext4_find_extent\n       |  path-\u003ep_depth = 1\n       |ext4_ext_try_to_merge\n       |  ext4_ext_try_to_merge_up\n       |    path-\u003ep_depth = 0\n       |    brelse(path[1].p_bh)  ---\u003e not set to NULL here\n       |// zeroout success\n     // 2. update path\n     ext4_find_extent\n     // 3. do split2\n     ext4_split_extent_at\n       ext4_ext_insert_extent\n         ext4_ext_create_new_leaf\n           ext4_ext_grow_indepth\n             le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\n           ext4_find_extent\n             path[0].p_bh = NULL;\n             path-\u003ep_depth = 1\n             read_extent_tree_block  ---\u003e return err\n             // path[1].p_bh is still the old value\n             ext4_free_ext_path\n               ext4_ext_drop_refs\n                 // path-\u003ep_depth == 1\n                 brelse(path[1].p_bh)  ---\u003e brelse a buffer twice\n\nFinally got the following WARRNING when removing the buffer from lru:\n\n============================================\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\nRIP: 0010:__brelse+0x58/0x90\nCall Trace:\n \u003cTASK\u003e\n __find_get_block+0x6e7/0x810\n bdev_getblk+0x2b/0x480\n __ext4_get_inode_loc+0x48a/0x1240\n ext4_get_inode_loc+0xb2/0x150\n ext4_reserve_inode_write+0xb7/0x230\n __ext4_mark_inode_dirty+0x144/0x6a0\n ext4_ext_insert_extent+0x9c8/0x3230\n ext4_ext_map_blocks+0xf45/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n============================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74407ff9-5235-46d3-a5b1-0e1566104123",
      "id": "CVE-2024-49903",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uaf in dbFreeBits\n\n[syzbot reported]\n==================================================================\nBUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline]\nBUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\nRead of size 8 at addr ffff8880229254b0 by task syz-executor357/5216\n\nCPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n __mutex_lock_common kernel/locking/mutex.c:587 [inline]\n __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\n dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390\n dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline]\n dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409\n dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650\n jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100\n jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n\nFreed by task 5218:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2252 [inline]\n slab_free mm/slub.c:4473 [inline]\n kfree+0x149/0x360 mm/slub.c:4594\n dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278\n jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247\n jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454\n reconfigure_super+0x445/0x880 fs/super.c:1083\n vfs_cmd_reconfigure fs/fsopen.c:263 [inline]\n vfs_fsconfig_locked fs/fsopen.c:292 [inline]\n __do_sys_fsconfig fs/fsopen.c:473 [inline]\n __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[Analysis]\nThere are two paths (dbUnmount and jfs_ioc_trim) that generate race\ncondition when accessing bmap, which leads to the occurrence of uaf.\n\nUse the lock s_umount to synchronize them, in order to avoid uaf caused\nby race condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc1e9153-cf14-445c-89d2-063254f0a31a",
      "id": "CVE-2024-49907",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using dc-\u003eclk_mgr\n\n[WHY \u0026 HOW]\ndc-\u003eclk_mgr is null checked previously in the same function, indicating\nit might be null.\n\nPassing \"dc\" to \"dc-\u003ehwss.apply_idle_power_optimizations\", which\ndereferences null \"dc-\u003eclk_mgr\". (The function pointer resolves to\n\"dcn35_apply_idle_power_optimizations\".)\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f774b671-ad2e-4818-b946-31b8424996cc",
      "id": "CVE-2024-49910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn401_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null, but then it was being\ndereferenced without any null check. This could lead to a null pointer\ndereference if set_output_gamma is null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e4f1ac4-0620-43af-aa02-6c7dcac0f941",
      "id": "CVE-2024-49948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add more sanity checks to qdisc_pkt_len_init()\n\nOne path takes care of SKB_GSO_DODGY, assuming\nskb-\u003elen is bigger than hdr_len.\n\nvirtio_net_hdr_to_skb() does not fully dissect TCP headers,\nit only make sure it is at least 20 bytes.\n\nIt is possible for an user to provide a malicious 'GSO' packet,\ntotal length of 80 bytes.\n\n- 20 bytes of IPv4 header\n- 60 bytes TCP header\n- a small gso_size like 8\n\nvirtio_net_hdr_to_skb() would declare this packet as a normal\nGSO packet, because it would see 40 bytes of payload,\nbigger than gso_size.\n\nWe need to make detect this case to not underflow\nqdisc_skb_cb(skb)-\u003epkt_len.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bd692d3-84f6-4fec-be01-c66a33516893",
      "id": "CVE-2024-49955",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: battery: Fix possible crash when unregistering a battery hook\n\nWhen a battery hook returns an error when adding a new battery, then\nthe battery hook is automatically unregistered.\nHowever the battery hook provider cannot know that, so it will later\ncall battery_hook_unregister() on the already unregistered battery\nhook, resulting in a crash.\n\nFix this by using the list head to mark already unregistered battery\nhooks as already being unregistered so that they can be ignored by\nbattery_hook_unregister().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f726ee5e-671d-440a-806b-2877d2ab690f",
      "id": "CVE-2023-53343",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp6: Fix null-ptr-deref of ip6_null_entry-\u003ert6i_idev in icmp6_dev().\n\nWith some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that\nhas the link-local address as src and dst IP and will be forwarded to\nan external IP in the IPv6 Ext Hdr.\n\nFor example, the script below generates a packet whose src IP is the\nlink-local address and dst is updated to 11::.\n\n  # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 \u003e $f; done\n  # python3\n  \u003e\u003e\u003e from socket import *\n  \u003e\u003e\u003e from scapy.all import *\n  \u003e\u003e\u003e\n  \u003e\u003e\u003e SRC_ADDR = DST_ADDR = \"fe80::5054:ff:fe12:3456\"\n  \u003e\u003e\u003e\n  \u003e\u003e\u003e pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)\n  \u003e\u003e\u003e pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=[\"11::\", \"22::\"], segleft=1)\n  \u003e\u003e\u003e\n  \u003e\u003e\u003e sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)\n  \u003e\u003e\u003e sk.sendto(bytes(pkt), (DST_ADDR, 0))\n\nFor such a packet, we call ip6_route_input() to look up a route for the\nnext destination in these three functions depending on the header type.\n\n  * ipv6_rthdr_rcv()\n  * ipv6_rpl_srh_rcv()\n  * ipv6_srh_rcv()\n\nIf no route is found, ip6_null_entry is set to skb, and the following\ndst_input(skb) calls ip6_pkt_drop().\n\nFinally, in icmp6_dev(), we dereference skb_rt6_info(skb)-\u003ert6i_idev-\u003edev\nas the input device is the loopback interface.  Then, we have to check if\nskb_rt6_info(skb)-\u003ert6i_idev is NULL or not to avoid NULL pointer deref\nfor ip6_null_entry.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)\nCode: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 \u003c48\u003e 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01\nRSP: 0018:ffffc90000003c70 EFLAGS: 00000286\nRAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0\nRDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18\nRBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001\nR10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10\nR13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0\nFS:  00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ip6_pkt_drop (net/ipv6/route.c:4513)\n ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))\n ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)\n __netif_receive_skb_one_core (net/core/dev.c:5455)\n process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)\n __napi_poll (net/core/dev.c:6460)\n net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)\n __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)\n do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip (kernel/softirq.c:381)\n __dev_queue_xmit (net/core/dev.c:4231)\n ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)\n rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)\n sock_sendmsg (net/socket.c:725 net/socket.c:748)\n __sys_sendto (net/socket.c:2134)\n __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\nRIP: 0033:0x7f9dc751baea\nCode: d8 64 89 02 48 c7 c0 ff f\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33c20171-5529-4aef-b68c-1fd4ba58a8e1",
      "id": "CVE-2024-50058",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: protect uart_port_dtr_rts() in uart_shutdown() too\n\nCommit af224ca2df29 (serial: core: Prevent unsafe uart port access, part\n3) added few uport == NULL checks. It added one to uart_shutdown(), so\nthe commit assumes, uport can be NULL in there. But right after that\nprotection, there is an unprotected \"uart_port_dtr_rts(uport, false);\"\ncall. That is invoked only if HUPCL is set, so I assume that is the\nreason why we do not see lots of these reports.\n\nOr it cannot be NULL at this point at all for some reason :P.\n\nUntil the above is investigated, stay on the safe side and move this\ndereference to the if too.\n\nI got this inconsistency from Coverity under CID 1585130. Thanks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "760052ea-65a0-40b4-9bb2-cc10db887d79",
      "id": "CVE-2024-50196",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: ocelot: fix system hang on level based interrupts\n\nThe current implementation only calls chained_irq_enter() and\nchained_irq_exit() if it detects pending interrupts.\n\n```\nfor (i = 0; i \u003c info-\u003estride; i++) {\n\turegmap_read(info-\u003emap, id_reg + 4 * i, \u0026reg);\n\tif (!reg)\n\t\tcontinue;\n\n\tchained_irq_enter(parent_chip, desc);\n```\n\nHowever, in case of GPIO pin configured in level mode and the parent\ncontroller configured in edge mode, GPIO interrupt might be lowered by the\nhardware. In the result, if the interrupt is short enough, the parent\ninterrupt is still pending while the GPIO interrupt is cleared;\nchained_irq_enter() never gets called and the system hangs trying to\nservice the parent interrupt.\n\nMoving chained_irq_enter() and chained_irq_exit() outside the for loop\nensures that they are called even when GPIO interrupt is lowered by the\nhardware.\n\nThe similar code with chained_irq_enter() / chained_irq_exit() functions\nwrapping interrupt checking loop may be found in many other drivers:\n```\ngrep -r -A 10 chained_irq_enter drivers/pinctrl\n```",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "402a552b-1b96-4e6e-a718-ed2eeb90a448",
      "id": "CVE-2024-50234",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: Clear stale interrupts before resuming device\n\niwl4965 fails upon resume from hibernation on my laptop. The reason\nseems to be a stale interrupt which isn't being cleared out before\ninterrupts are enabled. We end up with a race beween the resume\ntrying to bring things back up, and the restart work (queued form\nthe interrupt handler) trying to bring things down. Eventually\nthe whole thing blows up.\n\nFix the problem by clearing out any stale interrupts before\ninterrupts get enabled during resume.\n\nHere's a debug log of the indicent:\n[   12.042589] ieee80211 phy0: il_isr ISR inta 0x00000080, enabled 0xaa00008b, fh 0x00000000\n[   12.042625] ieee80211 phy0: il4965_irq_tasklet inta 0x00000080, enabled 0x00000000, fh 0x00000000\n[   12.042651] iwl4965 0000:10:00.0: RF_KILL bit toggled to enable radio.\n[   12.042653] iwl4965 0000:10:00.0: On demand firmware reload\n[   12.042690] ieee80211 phy0: il4965_irq_tasklet End inta 0x00000000, enabled 0xaa00008b, fh 0x00000000, flags 0x00000282\n[   12.052207] ieee80211 phy0: il4965_mac_start enter\n[   12.052212] ieee80211 phy0: il_prep_station Add STA to driver ID 31: ff:ff:ff:ff:ff:ff\n[   12.052244] ieee80211 phy0: il4965_set_hw_ready hardware  ready\n[   12.052324] ieee80211 phy0: il_apm_init Init card's basic functions\n[   12.052348] ieee80211 phy0: il_apm_init L1 Enabled; Disabling L0S\n[   12.055727] ieee80211 phy0: il4965_load_bsm Begin load bsm\n[   12.056140] ieee80211 phy0: il4965_verify_bsm Begin verify bsm\n[   12.058642] ieee80211 phy0: il4965_verify_bsm BSM bootstrap uCode image OK\n[   12.058721] ieee80211 phy0: il4965_load_bsm BSM write complete, poll 1 iterations\n[   12.058734] ieee80211 phy0: __il4965_up iwl4965 is coming up\n[   12.058737] ieee80211 phy0: il4965_mac_start Start UP work done.\n[   12.058757] ieee80211 phy0: __il4965_down iwl4965 is going down\n[   12.058761] ieee80211 phy0: il_scan_cancel_timeout Scan cancel timeout\n[   12.058762] ieee80211 phy0: il_do_scan_abort Not performing scan to abort\n[   12.058765] ieee80211 phy0: il_clear_ucode_stations Clearing ucode stations in driver\n[   12.058767] ieee80211 phy0: il_clear_ucode_stations No active stations found to be cleared\n[   12.058819] ieee80211 phy0: _il_apm_stop Stop card, put in low power state\n[   12.058827] ieee80211 phy0: _il_apm_stop_master stop master\n[   12.058864] ieee80211 phy0: il4965_clear_free_frames 0 frames on pre-allocated heap on clear.\n[   12.058869] ieee80211 phy0: Hardware restart was requested\n[   16.132299] iwl4965 0000:10:00.0: START_ALIVE timeout after 4000ms.\n[   16.132303] ------------[ cut here ]------------\n[   16.132304] Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n[   16.132338] WARNING: CPU: 0 PID: 181 at net/mac80211/util.c:1826 ieee80211_reconfig+0x8f/0x14b0 [mac80211]\n[   16.132390] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev\n[   16.132456] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Not tainted 6.11.0-cl+ #143\n[   16.132460] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010\n[   16.132463] Workqueue: async async_run_entry_fn\n[   16.132469] RIP: 0010:ieee80211_reconfig+0x8f/0x14b0 [mac80211]\n[   16.132501] Code: da 02 00 0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61fadd05-dfff-4f28-9f91-cdcff12b0bed",
      "id": "CVE-2024-53101",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Fix uninitialized value issue in from_kuid and from_kgid\n\nocfs2_setattr() uses attr-\u003eia_mode, attr-\u003eia_uid and attr-\u003eia_gid in\na trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.\n\nInitialize all fields of newattrs to avoid uninitialized variables, by\nchecking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd3d1531-ed45-4647-a390-fa4f80820648",
      "id": "CVE-2024-53217",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent NULL dereference in nfsd4_process_cb_update()\n\n@ses is initialized to NULL. If __nfsd4_find_backchannel() finds no\navailable backchannel session, setup_callback_client() will try to\ndereference @ses and segfault.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ac2b0e6-2be5-40f3-88d8-13f95a975b7e",
      "id": "CVE-2020-36694",
      "description": "An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace. NOTE: cc00bca was reverted in 5.12.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa533a5f-5add-4e15-917b-8649d7754848",
      "id": "CVE-2024-56631",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Fix slab-use-after-free read in sg_release()\n\nFix a use-after-free bug in sg_release(), detected by syzbot with KASAN:\n\nBUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30\nkernel/locking/lockdep.c:5838\n__mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912\nsg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407\n\nIn sg_release(), the function kref_put(\u0026sfp-\u003ef_ref, sg_remove_sfp) is\ncalled before releasing the open_rel_lock mutex. The kref_put() call may\ndecrement the reference count of sfp to zero, triggering its cleanup\nthrough sg_remove_sfp(). This cleanup includes scheduling deferred work\nvia sg_remove_sfp_usercontext(), which ultimately frees sfp.\n\nAfter kref_put(), sg_release() continues to unlock open_rel_lock and may\nreference sfp or sdp. If sfp has already been freed, this results in a\nslab-use-after-free error.\n\nMove the kref_put(\u0026sfp-\u003ef_ref, sg_remove_sfp) call after unlocking the\nopen_rel_lock mutex. This ensures:\n\n - No references to sfp or sdp occur after the reference count is\n   decremented.\n\n - Cleanup functions such as sg_remove_sfp() and\n   sg_remove_sfp_usercontext() can safely execute without impacting the\n   mutex handling in sg_release().\n\nThe fix has been tested and validated by syzbot. This patch closes the\nbug reported at the following syzkaller link and ensures proper\nsequencing of resource cleanup and mutex operations, eliminating the\nrisk of use-after-free errors in sg_release().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2bc51002-44fb-4b5b-9176-a64779a98abb",
      "id": "CVE-2024-56681",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: bcm - add error check in the ahash_hmac_init function\n\nThe ahash_init functions may return fails. The ahash_hmac_init should\nnot return ok when ahash_init returns error. For an example, ahash_init\nwill return -ENOMEM when allocation memory is error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72cc3b88-7935-4f14-8b46-1c1c6bd072eb",
      "id": "CVE-2024-57884",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()\n\nThe task sometimes continues looping in throttle_direct_reclaim() because\nallow_direct_reclaim(pgdat) keeps returning false.  \n\n #0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac\n #1 [ffff80002cb6f900] __schedule at ffff800008abbd1c\n #2 [ffff80002cb6f990] schedule at ffff800008abc50c\n #3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550\n #4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68\n #5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660\n #6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98\n #7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8\n #8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974\n #9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4\n\nAt this point, the pgdat contains the following two zones:\n\n        NODE: 4  ZONE: 0  ADDR: ffff00817fffe540  NAME: \"DMA32\"\n          SIZE: 20480  MIN/LOW/HIGH: 11/28/45\n          VM_STAT:\n                NR_FREE_PAGES: 359\n        NR_ZONE_INACTIVE_ANON: 18813\n          NR_ZONE_ACTIVE_ANON: 0\n        NR_ZONE_INACTIVE_FILE: 50\n          NR_ZONE_ACTIVE_FILE: 0\n          NR_ZONE_UNEVICTABLE: 0\n        NR_ZONE_WRITE_PENDING: 0\n                     NR_MLOCK: 0\n                    NR_BOUNCE: 0\n                   NR_ZSPAGES: 0\n            NR_FREE_CMA_PAGES: 0\n\n        NODE: 4  ZONE: 1  ADDR: ffff00817fffec00  NAME: \"Normal\"\n          SIZE: 8454144  PRESENT: 98304  MIN/LOW/HIGH: 68/166/264\n          VM_STAT:\n                NR_FREE_PAGES: 146\n        NR_ZONE_INACTIVE_ANON: 94668\n          NR_ZONE_ACTIVE_ANON: 3\n        NR_ZONE_INACTIVE_FILE: 735\n          NR_ZONE_ACTIVE_FILE: 78\n          NR_ZONE_UNEVICTABLE: 0\n        NR_ZONE_WRITE_PENDING: 0\n                     NR_MLOCK: 0\n                    NR_BOUNCE: 0\n                   NR_ZSPAGES: 0\n            NR_FREE_CMA_PAGES: 0\n\nIn allow_direct_reclaim(), while processing ZONE_DMA32, the sum of\ninactive/active file-backed pages calculated in zone_reclaimable_pages()\nbased on the result of zone_page_state_snapshot() is zero.  \n\nAdditionally, since this system lacks swap, the calculation of inactive/\nactive anonymous pages is skipped.\n\n        crash\u003e p nr_swap_pages\n        nr_swap_pages = $1937 = {\n          counter = 0\n        }\n\nAs a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on to\nthe processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 having\nfree pages significantly exceeding the high watermark.\n\nThe problem is that the pgdat-\u003ekswapd_failures hasn't been incremented.\n\n        crash\u003e px ((struct pglist_data *) 0xffff00817fffe540)-\u003ekswapd_failures\n        $1935 = 0x0\n\nThis is because the node deemed balanced.  The node balancing logic in\nbalance_pgdat() evaluates all zones collectively.  If one or more zones\n(e.g., ZONE_DMA32) have enough free pages to meet their watermarks, the\nentire node is deemed balanced.  This causes balance_pgdat() to exit early\nbefore incrementing the kswapd_failures, as it considers the overall\nmemory state acceptable, even though some zones (like ZONE_NORMAL) remain\nunder significant pressure.\n\n\nThe patch ensures that zone_reclaimable_pages() includes free pages\n(NR_FREE_PAGES) in its calculation when no other reclaimable pages are\navailable (e.g., file-backed or anonymous pages).  This change prevents\nzones like ZONE_DMA32, which have sufficient free pages, from being\nmistakenly deemed unreclaimable.  By doing so, the patch ensures proper\nnode balancing, avoids masking pressure on other zones like ZONE_NORMAL,\nand prevents infinite loops in throttle_direct_reclaim() caused by\nallow_direct_reclaim(pgdat) repeatedly returning false.\n\n\nThe kernel hangs due to a task stuck in throttle_direct_reclaim(), caused\nby a node being incorrectly deemed balanced despite pressure in certain\nzones, such as ZONE_NORMAL.  This issue arises from\nzone_reclaimable_pages\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc66f879-d88b-4401-b989-ab06ada225a3",
      "id": "CVE-2024-57887",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: adv7511: Fix use-after-free in adv7533_attach_dsi()\n\nThe host_node pointer was assigned and freed in adv7533_parse_dt(), and\nlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issue\nby dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()\nin error path of probe() and also in the remove().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f87ded5a-acf4-445b-893f-251fcc2738b5",
      "id": "CVE-2024-57929",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm array: fix releasing a faulty array block twice in dm_array_cursor_end\n\nWhen dm_bm_read_lock() fails due to locking or checksum errors, it\nreleases the faulty block implicitly while leaving an invalid output\npointer behind. The caller of dm_bm_read_lock() should not operate on\nthis invalid dm_block pointer, or it will lead to undefined result.\nFor example, the dm_array_cursor incorrectly caches the invalid pointer\non reading a faulty array block, causing a double release in\ndm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().\n\nReproduce steps:\n\n1. initialize a cache device\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc $262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1\ndmsetup create cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. wipe the second array block offline\n\ndmsteup remove cache cmeta cdata corig\nmapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \\\n2\u003e/dev/null | hexdump -e '1/8 \"%u\\n\"')\nablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \\\n2\u003e/dev/null | hexdump -e '1/8 \"%u\\n\"')\ndd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock\n\n3. try reopen the cache device\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc $262144\"\ndmsetup create cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\nKernel logs:\n\n(snip)\ndevice-mapper: array: array_block_check failed: blocknr 0 != wanted 10\ndevice-mapper: block manager: array validator check failed for block 10\ndevice-mapper: array: get_ablock failed\ndevice-mapper: cache metadata: dm_array_cursor_next for mapping failed\n------------[ cut here ]------------\nkernel BUG at drivers/md/dm-bufio.c:638!\n\nFix by setting the cached block pointer to NULL on errors.\n\nIn addition to the reproducer described above, this fix can be\nverified using the \"array_cursor/damaged\" test in dm-unit:\n  dm-unit run /pdata/array_cursor/damaged --kernel-dir \u003cKERNEL_DIR\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78e1a405-d1d8-4627-ac21-d5e119d44af1",
      "id": "CVE-2024-57977",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: fix soft lockup in the OOM process\n\nA soft lockup issue was found in the product with about 56,000 tasks were\nin the OOM cgroup, it was traversing them when the soft lockup was\ntriggered.\n\nwatchdog: BUG: soft lockup - CPU#2 stuck for 23s! [VM Thread:1503066]\nCPU: 2 PID: 1503066 Comm: VM Thread Kdump: loaded Tainted: G\nHardware name: Huawei Cloud OpenStack Nova, BIOS\nRIP: 0010:console_unlock+0x343/0x540\nRSP: 0000:ffffb751447db9a0 EFLAGS: 00000247 ORIG_RAX: ffffffffffffff13\nRAX: 0000000000000001 RBX: 0000000000000000 RCX: 00000000ffffffff\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000247\nRBP: ffffffffafc71f90 R08: 0000000000000000 R09: 0000000000000040\nR10: 0000000000000080 R11: 0000000000000000 R12: ffffffffafc74bd0\nR13: ffffffffaf60a220 R14: 0000000000000247 R15: 0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f2fe6ad91f0 CR3: 00000004b2076003 CR4: 0000000000360ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n vprintk_emit+0x193/0x280\n printk+0x52/0x6e\n dump_task+0x114/0x130\n mem_cgroup_scan_tasks+0x76/0x100\n dump_header+0x1fe/0x210\n oom_kill_process+0xd1/0x100\n out_of_memory+0x125/0x570\n mem_cgroup_out_of_memory+0xb5/0xd0\n try_charge+0x720/0x770\n mem_cgroup_try_charge+0x86/0x180\n mem_cgroup_try_charge_delay+0x1c/0x40\n do_anonymous_page+0xb5/0x390\n handle_mm_fault+0xc4/0x1f0\n\nThis is because thousands of processes are in the OOM cgroup, it takes a\nlong time to traverse all of them.  As a result, this lead to soft lockup\nin the OOM process.\n\nTo fix this issue, call 'cond_resched' in the 'mem_cgroup_scan_tasks'\nfunction per 1000 iterations.  For global OOM, call\n'touch_softlockup_watchdog' per 1000 iterations to avoid this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6d60869-44d0-4c04-bc34-5f09a2851fe9",
      "id": "CVE-2025-21699",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\n\nTruncate an inode's address space when flipping the GFS2_DIF_JDATA flag:\ndepending on that flag, the pages in the address space will either use\nbuffer heads or iomap_folio_state structs, and we cannot mix the two.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8856f9f4-7312-4734-957c-f50fcdfde770",
      "id": "CVE-2025-21719",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmr: do not call mr_mfc_uses_dev() for unres entries\n\nsyzbot found that calling mr_mfc_uses_dev() for unres entries\nwould crash [1], because c-\u003emfc_un.res.minvif / c-\u003emfc_un.res.maxvif\nalias to \"struct sk_buff_head unresolved\", which contain two pointers.\n\nThis code never worked, lets remove it.\n\n[1]\nUnable to handle kernel paging request at virtual address ffff5fff2d536613\nKASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f]\nModules linked in:\nCPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline]\n pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334\n lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline]\n lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334\nCall trace:\n  mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P)\n  mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P)\n  mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382\n  ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648\n  rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327\n  rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791\n  netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317\n  netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973\n  sock_recvmsg_nosec net/socket.c:1033 [inline]\n  sock_recvmsg net/socket.c:1055 [inline]\n  sock_read_iter+0x2d8/0x40c net/socket.c:1125\n  new_sync_read fs/read_write.c:484 [inline]\n  vfs_read+0x740/0x970 fs/read_write.c:565\n  ksys_read+0x15c/0x26c fs/read_write.c:708",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "523772a5-941b-4db3-86d3-30ec51ce3cb8",
      "id": "CVE-2025-21738",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\nwrite outside the allocated buffer, overwriting random memory.\n\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\nto be a bug either in libata-sff or QEMU, where either this status is not\nset, or the status is cleared before read by ata_sff_hsm_move().\nAnyway, that is most likely a separate bug.\n\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\n\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\ncannot write outside the allocated buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5dcfdb3b-f71f-4df9-9e14-a1e5ffc0252e",
      "id": "CVE-2025-21761",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: use RCU protection in ovs_vport_cmd_fill_info()\n\novs_vport_cmd_fill_info() can be called without RTNL or RCU.\n\nUse RCU protection and dev_net_rcu() to avoid potential UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6845e0fc-b98d-4ab7-ac5e-d2443e026e42",
      "id": "CVE-2025-22063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets\n\nWhen calling netlbl_conn_setattr(), addr-\u003esa_family is used\nto determine the function behavior. If sk is an IPv4 socket,\nbut the connect function is called with an IPv6 address,\nthe function calipso_sock_setattr() is triggered.\nInside this function, the following code is executed:\n\nsk_fullsock(__sk) ? inet_sk(__sk)-\u003epinet6 : NULL;\n\nSince sk is an IPv4 socket, pinet6 is NULL, leading to a\nnull pointer dereference.\n\nThis patch fixes the issue by checking if inet6_sk(sk)\nreturns a NULL pointer before accessing pinet6.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac1b631a-c993-4630-bdf7-87550244d704",
      "id": "CVE-2025-37739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()\n\nsyzbot reports an UBSAN issue as below:\n\n------------[ cut here ]------------\nUBSAN: array-index-out-of-bounds in fs/f2fs/node.h:381:10\nindex 18446744073709550692 is out of range for type '__le32[5]' (aka 'unsigned int[5]')\nCPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n ubsan_epilogue lib/ubsan.c:231 [inline]\n __ubsan_handle_out_of_bounds+0x121/0x150 lib/ubsan.c:429\n get_nid fs/f2fs/node.h:381 [inline]\n f2fs_truncate_inode_blocks+0xa5e/0xf60 fs/f2fs/node.c:1181\n f2fs_do_truncate_blocks+0x782/0x1030 fs/f2fs/file.c:808\n f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:836\n f2fs_truncate+0x417/0x720 fs/f2fs/file.c:886\n f2fs_file_write_iter+0x1bdb/0x2550 fs/f2fs/file.c:5093\n aio_write+0x56b/0x7c0 fs/aio.c:1633\n io_submit_one+0x8a7/0x18a0 fs/aio.c:2052\n __do_sys_io_submit fs/aio.c:2111 [inline]\n __se_sys_io_submit+0x171/0x2e0 fs/aio.c:2081\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f238798cde9\n\nindex 18446744073709550692 (decimal, unsigned long long)\n= 0xfffffffffffffc64 (hexadecimal, unsigned long long)\n= -924 (decimal, long long)\n\nIn f2fs_truncate_inode_blocks(), UBSAN detects that get_nid() tries to\naccess .i_nid[-924], it means both offset[0] and level should zero.\n\nThe possible case should be in f2fs_do_truncate_blocks(), we try to\ntruncate inode size to zero, however, dn.ofs_in_node is zero and\ndn.node_page is not an inode page, so it fails to truncate inode page,\nand then pass zeroed free_from to f2fs_truncate_inode_blocks(), result\nin this issue.\n\n\tif (dn.ofs_in_node || IS_INODE(dn.node_page)) {\n\t\tf2fs_truncate_data_blocks_range(\u0026dn, count);\n\t\tfree_from += count;\n\t}\n\nI guess the reason why dn.node_page is not an inode page could be: there\nare multiple nat entries share the same node block address, once the node\nblock address was reused, f2fs_get_node_page() may load a non-inode block.\n\nLet's add a sanity check for such condition to avoid out-of-bounds access\nissue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28fcd1d0-bfda-4c70-a7bb-0ddfc5204761",
      "id": "CVE-2025-38023",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: handle failure of nfs_get_lock_context in unlock path\n\nWhen memory is insufficient, the allocation of nfs_lock_context in\nnfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat\nan nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM)\nas valid and proceed to execute rpc_run_task(), this will trigger a NULL\npointer dereference in nfs4_locku_prepare. For example:\n\nBUG: kernel NULL pointer dereference, address: 000000000000000c\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP PTI\nCPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40\nWorkqueue: rpciod rpc_async_schedule\nRIP: 0010:nfs4_locku_prepare+0x35/0xc2\nCode: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3\nRSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246\nRAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40\nRBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38\nR10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030\nR13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30\nFS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n __rpc_execute+0xbc/0x480\n rpc_async_schedule+0x2f/0x40\n process_one_work+0x232/0x5d0\n worker_thread+0x1da/0x3d0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x10d/0x240\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\nModules linked in:\nCR2: 000000000000000c\n---[ end trace 0000000000000000 ]---\n\nFree the allocated nfs4_unlockdata when nfs_get_lock_context() fails and\nreturn NULL to terminate subsequent rpc_run_task, preventing NULL pointer\ndereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b79c2de-c602-480c-bda7-1b06527310ed",
      "id": "CVE-2025-38071",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Check return value from memblock_phys_alloc_range()\n\nAt least with CONFIG_PHYSICAL_START=0x100000, if there is \u003c 4 MiB of\ncontiguous free memory available at this point, the kernel will crash\nand burn because memblock_phys_alloc_range() returns 0 on failure,\nwhich leads memblock_phys_free() to throw the first 4 MiB of physical\nmemory to the wolves.\n\nAt a minimum it should fail gracefully with a meaningful diagnostic,\nbut in fact everything seems to work fine without the weird reserve\nallocation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fcaddb0d-bb48-4e74-88b9-e6d965e9fac7",
      "id": "CVE-2025-38086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ch9200: fix uninitialised access during mii_nway_restart\n\nIn mii_nway_restart() the code attempts to call\nmii-\u003emdio_read which is ch9200_mdio_read(). ch9200_mdio_read()\nutilises a local buffer called \"buff\", which is initialised\nwith control_read(). However \"buff\" is conditionally\ninitialised inside control_read():\n\n        if (err == size) {\n                memcpy(data, buf, size);\n        }\n\nIf the condition of \"err == size\" is not met, then\n\"buff\" remains uninitialised. Once this happens the\nuninitialised \"buff\" is accessed and returned during\nch9200_mdio_read():\n\n        return (buff[0] | buff[1] \u003c\u003c 8);\n\nThe problem stems from the fact that ch9200_mdio_read()\nignores the return value of control_read(), leading to\nuinit-access of \"buff\".\n\nTo fix this we should check the return value of\ncontrol_read() and return early on error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c66e9dc-7a01-434f-9eeb-2d8de754e449",
      "id": "CVE-2025-38336",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330\n\nThe controller has a hardware bug that can hard hang the system when\ndoing ATAPI DMAs without any trace of what happened. Depending on the\ndevice attached, it can also prevent the system from booting.\n\nIn this case, the system hangs when reading the ATIP from optical media\nwith cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an\nOptiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4,\nrunning at UDMA/33.\n\nThe issue can be reproduced by running the same command with a cygwin\nbuild of cdrecord on WinXP, although it requires more attempts to cause\nit. The hang in that case is also resolved by forcing PIO. It doesn't\nappear that VIA has produced any drivers for that OS, thus no known\nworkaround exists.\n\nHDDs attached to the controller do not suffer from any DMA issues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30c051ff-fb31-4672-a3f2-9ea830f2d8d2",
      "id": "CVE-2025-38428",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - check record size in ims_pcu_flash_firmware()\n\nThe \"len\" variable comes from the firmware and we generally do\ntrust firmware, but it's always better to double check.  If the \"len\"\nis too large it could result in memory corruption when we do\n\"memcpy(fragment-\u003edata, rec-\u003edata, len);\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cdc8ccab-5071-4469-8c20-800dd78feb00",
      "id": "CVE-2025-38448",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Fix race condition in TTY wakeup\n\nA race condition occurs when gs_start_io() calls either gs_start_rx() or\ngs_start_tx(), as those functions briefly drop the port_lock for\nusb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear\nport.tty and port_usb, respectively.\n\nUse the null-safe TTY Port helper function to wake up TTY.\n\nExample\n  CPU1:\t\t\t      CPU2:\n  gserial_connect() // lock\n  \t\t\t      gs_close() // await lock\n  gs_start_rx()     // unlock\n  usb_ep_queue()\n  \t\t\t      gs_close() // lock, reset port.tty and unlock\n  gs_start_rx()     // lock\n  tty_wakeup()      // NPE",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83788559-6a6e-4b30-9f6b-70fb7db3ad69",
      "id": "CVE-2025-38473",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()\n\nsyzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0]\n\nl2cap_sock_resume_cb() has a similar problem that was fixed by commit\n1bff51ea59a9 (\"Bluetooth: fix use-after-free error in lock_sock_nested()\").\n\nSince both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed\nunder l2cap_sock_resume_cb(), we can avoid the issue simply by checking\nif chan-\u003edata is NULL.\n\nLet's not access to the killed socket in l2cap_sock_resume_cb().\n\n[0]:\nBUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]\nBUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]\nBUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711\nWrite of size 8 at addr 0000000000000570 by task kworker/u9:0/52\n\nCPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nWorkqueue: hci0 hci_rx_work\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C)\n __dump_stack+0x30/0x40 lib/dump_stack.c:94\n dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120\n print_report+0x58/0x84 mm/kasan/report.c:524\n kasan_report+0xb0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:-1 [inline]\n kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189\n __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37\n instrument_atomic_write include/linux/instrumented.h:82 [inline]\n clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]\n l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711\n l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357\n hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline]\n hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514\n hci_event_func net/bluetooth/hci_event.c:7511 [inline]\n hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565\n hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070\n process_one_work+0x7e8/0x155c kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3321 [inline]\n worker_thread+0x958/0xed8 kernel/workqueue.c:3402\n kthread+0x5fc/0x75c kernel/kthread.c:464\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d7688c5-1604-4daa-9977-868d54acb36a",
      "id": "CVE-2025-38477",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix race condition on qfq_aggregate\n\nA race condition can occur when 'agg' is modified in qfq_change_agg\n(called during qfq_enqueue) while other threads access it\nconcurrently. For example, qfq_dump_class may trigger a NULL\ndereference, and qfq_delete_class may cause a use-after-free.\n\nThis patch addresses the issue by:\n\n1. Moved qfq_destroy_class into the critical section.\n\n2. Added sch_tree_lock protection to qfq_dump_class and\nqfq_dump_class_stats.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d3fbf2d-a989-4ffd-b1eb-083e4403c21b",
      "id": "CVE-2025-39745",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcutorture: Fix rcutorture_one_extend_check() splat in RT kernels\n\nFor built with CONFIG_PREEMPT_RT=y kernels, running rcutorture\ntests resulted in the following splat:\n\n[   68.797425] rcutorture_one_extend_check during change: Current 0x1  To add 0x1  To remove 0x0  preempt_count() 0x0\n[   68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture]\n[   68.797601] Call Trace:\n[   68.797602]  \u003cTASK\u003e\n[   68.797619]  ? lockdep_softirqs_off+0xa5/0x160\n[   68.797631]  rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797646]  ? local_clock+0x19/0x40\n[   68.797659]  rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797678]  ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797804]  ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797815] rcu-torture: rcu_torture_reader task started\n[   68.797824] rcu-torture: Creating rcu_torture_reader task\n[   68.797824]  rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797836]  ? kvm_sched_clock_read+0x15/0x30\n\nDisable BH does not change the SOFTIRQ corresponding bits in\npreempt_count() for RT kernels, this commit therefore use\nsoftirq_count() to check the if BH is disabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8b0eb12-1d53-42de-9b4e-0c2b2bfd29fd",
      "id": "CVE-2025-39747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Add error handling for krealloc in metadata setup\n\nFunction msm_ioctl_gem_info_set_metadata() now checks for krealloc\nfailure and returns -ENOMEM, avoiding potential NULL pointer dereference.\nExplicitly avoids __GFP_NOFAIL due to deadlock risks and allocation constraints.\n\nPatchwork: https://patchwork.freedesktop.org/patch/661235/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8dea5fda-7daa-477d-8eb2-8aa90a4be98d",
      "id": "CVE-2025-39797",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Duplicate SPI Handling\n\nThe issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI\nNetlink message, which triggers the kernel function xfrm_alloc_spi().\nThis function is expected to ensure uniqueness of the Security Parameter\nIndex (SPI) for inbound Security Associations (SAs). However, it can\nreturn success even when the requested SPI is already in use, leading\nto duplicate SPIs assigned to multiple inbound SAs, differentiated\nonly by their destination addresses.\n\nThis behavior causes inconsistencies during SPI lookups for inbound packets.\nSince the lookup may return an arbitrary SA among those with the same SPI,\npacket processing can fail, resulting in packet drops.\n\nAccording to RFC 4301 section 4.4.2 , for inbound processing a unicast SA\nis uniquely identified by the SPI and optionally protocol.\n\nReproducing the Issue Reliably:\nTo consistently reproduce the problem, restrict the available SPI range in\ncharon.conf : spi_min = 0x10000000 spi_max = 0x10000002\nThis limits the system to only 2 usable SPI values.\nNext, create more than 2 Child SA. each using unique pair of src/dst address.\nAs soon as the 3rd Child SA is initiated, it will be assigned a duplicate\nSPI, since the SPI pool is already exhausted.\nWith a narrow SPI range, the issue is consistently reproducible.\nWith a broader/default range, it becomes rare and unpredictable.\n\nCurrent implementation:\nxfrm_spi_hash() lookup function computes hash using daddr, proto, and family.\nSo if two SAs have the same SPI but different destination addresses, then\nthey will:\na. Hash into different buckets\nb. Be stored in different linked lists (byspi + h)\nc. Not be seen in the same hlist_for_each_entry_rcu() iteration.\nAs a result, the lookup will result in NULL and kernel allows that Duplicate SPI\n\nProposed Change:\nxfrm_state_lookup_spi_proto() does a truly global search - across all states,\nregardless of hash bucket and matches SPI and proto.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "212b2128-83d1-41c1-a984-b9e8ba0d8f42",
      "id": "CVE-2019-20794",
      "description": "An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20074cbd-76c2-4dd9-9fc7-5afc13ab0da5",
      "id": "CVE-2020-27673",
      "description": "An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8ba429a-78a3-4214-8d2d-707281c8665a",
      "id": "CVE-2020-36386",
      "description": "An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a305a96a-a00a-4e1c-9098-c611a72965da",
      "id": "CVE-2021-34981",
      "description": "Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the CMTP module. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11977.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef52e22e-e61c-4359-b177-3a63e188024e",
      "id": "CVE-2021-3609",
      "description": ".A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dfd0f7dc-4a82-436a-9c82-664a57640c54",
      "id": "CVE-2021-3744",
      "description": "A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16e7c88f-94e7-4da2-b2f5-17337265c061",
      "id": "CVE-2021-47116",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix memory leak in ext4_mb_init_backend on error path.\n\nFix a memory leak discovered by syzbot when a file system is corrupted\nwith an illegally large s_log_groups_per_flex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0616596f-6ca9-4afe-a662-26d8847c1bcc",
      "id": "CVE-2021-47177",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix sysfs leak in alloc_iommu()\n\niommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent\nerrors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c39ad9e3-3a32-4635-8dc1-d291c349a765",
      "id": "CVE-2021-47187",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency\n\nThe entry/exit latency and minimum residency in state for the idle\nstates of MSM8998 were ..bad: first of all, for all of them the\ntimings were written for CPU sleep but the min-residency-us param\nwas miscalculated (supposedly, while porting this from downstream);\nThen, the power collapse states are setting PC on both the CPU\ncluster *and* the L2 cache, which have different timings: in the\nspecific case of L2 the times are higher so these ones should be\ntaken into account instead of the CPU ones.\n\nThis parameter misconfiguration was not giving particular issues\nbecause on MSM8998 there was no CPU scaling at all, so cluster/L2\npower collapse was rarely (if ever) hit.\nWhen CPU scaling is enabled, though, the wrong timings will produce\nSoC unstability shown to the user as random, apparently error-less,\nsudden reboots and/or lockups.\n\nThis set of parameters are stabilizing the SoC when CPU scaling is\nON and when power collapse is frequently hit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0cd865af-46e2-4d1f-b2ba-59355713e5a5",
      "id": "CVE-2022-1652",
      "description": "Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a018d600-df59-41b6-b9b3-ddbbb8fae4ed",
      "id": "CVE-2021-47240",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix OOB Read in qrtr_endpoint_post\n\nSyzbot reported slab-out-of-bounds Read in\nqrtr_endpoint_post. The problem was in wrong\n_size_ type:\n\n\tif (len != ALIGN(size, 4) + hdrlen)\n\t\tgoto err;\n\nIf size from qrtr_hdr is 4294967293 (0xfffffffd), the result of\nALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293\nin header this check won't fail and\n\n\tskb_put_data(skb, data + hdrlen, size);\n\nwill read out of bound from data, which is hdrlen allocated block.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "789d8c29-fb31-4802-bf23-7cef47f75a3e",
      "id": "CVE-2021-47306",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: fix UAF in fza_probe\n\nfp is netdev private data and it cannot be\nused after free_netdev() call. Using fp after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() after error message.\n\nTURBOchannel adapter\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d679a25-a5dc-4ed8-859a-4899f1af4e65",
      "id": "CVE-2022-48722",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: ca8210: Stop leaking skb's\n\nUpon error the ieee802154_xmit_complete() helper is not called. Only\nieee802154_wake_queue() is called manually. We then leak the skb\nstructure.\n\nFree the skb structure upon error before returning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8dfdc534-4eba-4eeb-85a6-6220032a7e3f",
      "id": "CVE-2021-47340",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix GPF in diFree\n\nAvoid passing inode with\nJFS_SBI(inode-\u003ei_sb)-\u003eipimap == NULL to\ndiFree()[1]. GFP will appear:\n\n\tstruct inode *ipimap = JFS_SBI(ip-\u003ei_sb)-\u003eipimap;\n\tstruct inomap *imap = JFS_IP(ipimap)-\u003ei_imap;\n\nJFS_IP() will return invalid pointer when ipimap == NULL\n\nCall Trace:\n diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1]\n jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154\n evict+0x2ed/0x750 fs/inode.c:578\n iput_final fs/inode.c:1654 [inline]\n iput.part.0+0x3fe/0x820 fs/inode.c:1680\n iput+0x58/0x70 fs/inode.c:1670",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3c56550-c56c-4750-bbc4-5506b3fd2493",
      "id": "CVE-2021-47343",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd-\u003edetails_root or pmd-\u003eroot will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n  Hardware name: QEMU Standard PC\n  RIP: 0010:metadata_ll_load_ie+0x14/0x30\n  Call Trace:\n   sm_metadata_count_is_more_than_one+0xb9/0xe0\n   dm_tm_shadow_block+0x52/0x1c0\n   shadow_step+0x59/0xf0\n   remove_raw+0xb2/0x170\n   dm_btree_remove+0xf4/0x1c0\n   dm_pool_delete_thin_device+0xc3/0x140\n   pool_message+0x218/0x2b0\n   target_message+0x251/0x290\n   ctl_ioctl+0x1c4/0x4d0\n   dm_ctl_ioctl+0xe/0x20\n   __x64_sys_ioctl+0x7b/0xb0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5509a91d-c44a-4dd2-98f5-8b5c2168ac95",
      "id": "CVE-2021-47410",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix svm_migrate_fini warning\n\nDevice manager releases device-specific resources when a driver\ndisconnects from a device, devm_memunmap_pages and\ndevm_release_mem_region calls in svm_migrate_fini are redundant.\n\nIt causes below warning trace after patch \"drm/amdgpu: Split\namdgpu_device_fini into early and late\", so remove function\nsvm_migrate_fini.\n\nBUG: https://gitlab.freedesktop.org/drm/amd/-/issues/1718\n\nWARNING: CPU: 1 PID: 3646 at drivers/base/devres.c:795\ndevm_release_action+0x51/0x60\nCall Trace:\n    ? memunmap_pages+0x360/0x360\n    svm_migrate_fini+0x2d/0x60 [amdgpu]\n    kgd2kfd_device_exit+0x23/0xa0 [amdgpu]\n    amdgpu_amdkfd_device_fini_sw+0x1d/0x30 [amdgpu]\n    amdgpu_device_fini_sw+0x45/0x290 [amdgpu]\n    amdgpu_driver_release_kms+0x12/0x30 [amdgpu]\n    drm_dev_release+0x20/0x40 [drm]\n    release_nodes+0x196/0x1e0\n    device_release_driver_internal+0x104/0x1d0\n    driver_detach+0x47/0x90\n    bus_remove_driver+0x7a/0xd0\n    pci_unregister_driver+0x3d/0x90\n    amdgpu_exit+0x11/0x20 [amdgpu]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f81a39d2-a54d-43ec-a81f-f8e584e581ee",
      "id": "CVE-2021-47638",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: rename_whiteout: Fix double free for whiteout_ui-\u003edata\n\n'whiteout_ui-\u003edata' will be freed twice if space budget fail for\nrename whiteout operation as following process:\n\nrename_whiteout\n  dev = kmalloc\n  whiteout_ui-\u003edata = dev\n  kfree(whiteout_ui-\u003edata)  // Free first time\n  iput(whiteout)\n    ubifs_free_inode\n      kfree(ui-\u003edata)\t    // Double free!\n\nKASAN reports:\n==================================================================\nBUG: KASAN: double-free or invalid-free in ubifs_free_inode+0x4f/0x70\nCall Trace:\n  kfree+0x117/0x490\n  ubifs_free_inode+0x4f/0x70 [ubifs]\n  i_callback+0x30/0x60\n  rcu_do_batch+0x366/0xac0\n  __do_softirq+0x133/0x57f\n\nAllocated by task 1506:\n  kmem_cache_alloc_trace+0x3c2/0x7a0\n  do_rename+0x9b7/0x1150 [ubifs]\n  ubifs_rename+0x106/0x1f0 [ubifs]\n  do_syscall_64+0x35/0x80\n\nFreed by task 1506:\n  kfree+0x117/0x490\n  do_rename.cold+0x53/0x8a [ubifs]\n  ubifs_rename+0x106/0x1f0 [ubifs]\n  do_syscall_64+0x35/0x80\n\nThe buggy address belongs to the object at ffff88810238bed8 which\nbelongs to the cache kmalloc-8 of size 8\n==================================================================\n\nLet ubifs_free_inode() free 'whiteout_ui-\u003edata'. BTW, delete unused\nassignment 'whiteout_ui-\u003edata_len = 0', process 'ubifs_evict_inode()\n-\u003e ubifs_jnl_delete_inode() -\u003e ubifs_jnl_write_inode()' doesn't need it\n(because 'inc_nlink(whiteout)' won't be excuted by 'goto out_release',\n and the nlink of whiteout inode is 0).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01355378-400b-4459-a764-074ccc493b33",
      "id": "CVE-2022-2977",
      "description": "A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8a36e05-d1ab-49b1-8be1-73fa9bf0c0d9",
      "id": "CVE-2022-3112",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dfc4b886-85a8-471a-8a87-1cae15255576",
      "id": "CVE-2022-48706",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: ifcvf: Do proper cleanup if IFCVF init fails\n\nifcvf_mgmt_dev leaks memory if it is not freed before\nreturning. Call is made to correct return statement\nso memory does not leak. ifcvf_init_hw does not take\ncare of this so it is needed to do it here.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b184134b-0d4b-445a-8b77-6f0e1417f0d0",
      "id": "CVE-2022-48724",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()\n\nAfter commit e3beca48a45b (\"irqdomain/treewide: Keep firmware node\nunconditionally allocated\"). For tear down scenario, fn is only freed\nafter fail to allocate ir_domain, though it also should be freed in case\ndmar_enable_qi returns error.\n\nBesides free fn, irq_domain and ir_msi_domain need to be removed as well\nif intel_setup_irq_remapping fails to enable queued invalidation.\n\nImprove the rewinding path by add out_free_ir_domain and out_free_fwnode\nlables per Baolu's suggestion.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f779f77c-63a5-4f30-9a69-2b45eacac373",
      "id": "CVE-2022-48869",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadgetfs: Fix race between mounting and unmounting\n\nThe syzbot fuzzer and Gerald Lee have identified a use-after-free bug\nin the gadgetfs driver, involving processes concurrently mounting and\nunmounting the gadgetfs filesystem.  In particular, gadgetfs_fill_super()\ncan race with gadgetfs_kill_sb(), causing the latter to deallocate\nthe_device while the former is using it.  The output from KASAN says,\nin part:\n\nBUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]\nBUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]\nBUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline]\nBUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline]\nBUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline]\nBUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]\nBUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086\nWrite of size 4 at addr ffff8880276d7840 by task syz-executor126/18689\n\nCPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nCall Trace:\n \u003cTASK\u003e\n...\n atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]\n __refcount_sub_and_test include/linux/refcount.h:272 [inline]\n __refcount_dec_and_test include/linux/refcount.h:315 [inline]\n refcount_dec_and_test include/linux/refcount.h:333 [inline]\n put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]\n gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086\n deactivate_locked_super+0xa7/0xf0 fs/super.c:332\n vfs_get_super fs/super.c:1190 [inline]\n get_tree_single+0xd0/0x160 fs/super.c:1207\n vfs_get_tree+0x88/0x270 fs/super.c:1531\n vfs_fsconfig_locked fs/fsopen.c:232 [inline]\n\nThe simplest solution is to ensure that gadgetfs_fill_super() and\ngadgetfs_kill_sb() are serialized by making them both acquire a new\nmutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1dfcdd9-f5ea-4ad4-9b05-edb538ce734d",
      "id": "CVE-2022-48879",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: fix NULL-deref in init error path\n\nIn cases where runtime services are not supported or have been disabled,\nthe runtime services workqueue will never have been allocated.\n\nDo not try to destroy the workqueue unconditionally in the unlikely\nevent that EFI initialisation fails to avoid dereferencing a NULL\npointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f42c271-d55d-4e7d-842f-cfe3772512a9",
      "id": "CVE-2022-48930",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ib_srp: Fix a deadlock\n\nRemove the flush_workqueue(system_long_wq) call since flushing\nsystem_long_wq is deadlock-prone and since that call is redundant with a\npreceding cancel_work_sync()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f713c1ad-2879-46c1-8d29-54ab1719378e",
      "id": "CVE-2022-49007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n\nSyzbot reported a null-ptr-deref bug:\n\n NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP\n frequency \u003c 30 seconds\n general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 PID: 3603 Comm: segctord Not tainted\n 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google\n 10/11/2022\n RIP: 0010:nilfs_palloc_commit_free_entry+0xe5/0x6b0\n fs/nilfs2/alloc.c:608\n Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00\n 00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02\n 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7\n RSP: 0018:ffffc90003dff830 EFLAGS: 00010212\n RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d\n RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010\n RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f\n R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158\n R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004\n FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000)\n knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0\n Call Trace:\n  \u003cTASK\u003e\n  nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]\n  nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193\n  nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236\n  nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940\n  nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]\n  nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]\n  nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088\n  nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337\n  nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568\n  nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018\n  nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067\n  nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]\n  nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]\n  nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045\n  nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]\n  nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570\n  kthread+0x2e4/0x3a0 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n  \u003c/TASK\u003e\n ...\n\nIf DAT metadata file is corrupted on disk, there is a case where\nreq-\u003epr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during\na b-tree operation that cascadingly updates ancestor nodes of the b-tree,\nbecause nilfs_dat_commit_alloc() for a lower level block can initialize\nthe blocknr on the same DAT entry between nilfs_dat_prepare_end() and\nnilfs_dat_commit_end().\n\nIf this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free()\nwithout valid buffer heads in req-\u003epr_desc_bh and req-\u003epr_bitmap_bh, and\ncauses the NULL pointer dereference above in\nnilfs_palloc_commit_free_entry() function, which leads to a crash.\n\nFix this by adding a NULL check on req-\u003epr_desc_bh and req-\u003epr_bitmap_bh\nbefore nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().\n\nThis also calls nilfs_error() in that case to notify that there is a fatal\nflaw in the filesystem metadata and prevent further operations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d006ad7e-961d-47af-94f0-c29af0519192",
      "id": "CVE-2022-49297",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix io hung while disconnecting device\n\nIn our tests, \"qemu-nbd\" triggers a io hung:\n\nINFO: task qemu-nbd:11445 blocked for more than 368 seconds.\n      Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:qemu-nbd        state:D stack:    0 pid:11445 ppid:     1 flags:0x00000000\nCall Trace:\n \u003cTASK\u003e\n __schedule+0x480/0x1050\n ? _raw_spin_lock_irqsave+0x3e/0xb0\n schedule+0x9c/0x1b0\n blk_mq_freeze_queue_wait+0x9d/0xf0\n ? ipi_rseq+0x70/0x70\n blk_mq_freeze_queue+0x2b/0x40\n nbd_add_socket+0x6b/0x270 [nbd]\n nbd_ioctl+0x383/0x510 [nbd]\n blkdev_ioctl+0x18e/0x3e0\n __x64_sys_ioctl+0xac/0x120\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7fd8ff706577\nRSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577\nRDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f\nRBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0\nR10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d\nR13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0\n\n\"qemu-ndb -d\" will call ioctl 'NBD_DISCONNECT' first, however, following\nmessage was found:\n\nblock nbd0: Send disconnect failed -32\n\nWhich indicate that something is wrong with the server. Then,\n\"qemu-nbd -d\" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear\nrequests after commit 2516ab1543fd(\"nbd: only clear the queue on device\nteardown\"). And in the meantime, request can't complete through timeout\nbecause nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which\nmeans such request will never be completed in this situation.\n\nNow that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't\ncomplete multiple times, switch back to call nbd_clear_sock() in\nnbd_clear_sock_ioctl(), so that inflight requests can be cleared.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38c6ed6f-96d8-44d5-bd58-8f8f59692639",
      "id": "CVE-2022-49571",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_max_reordering.\n\nWhile reading sysctl_tcp_max_reordering, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7bf41f1e-7d48-440b-a4ae-7161eba38256",
      "id": "CVE-2022-49577",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix a data-race around sysctl_udp_l3mdev_accept.\n\nWhile reading sysctl_udp_l3mdev_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3bb0d2fe-888d-4740-b2c0-69600c6328f1",
      "id": "CVE-2022-49607",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix data race between perf_event_set_output() and perf_mmap_close()\n\nYang Jihing reported a race between perf_event_set_output() and\nperf_mmap_close():\n\n\tCPU1\t\t\t\t\tCPU2\n\n\tperf_mmap_close(e2)\n\t  if (atomic_dec_and_test(\u0026e2-\u003erb-\u003emmap_count)) // 1 - \u003e 0\n\t    detach_rest = true\n\n\t\t\t\t\t\tioctl(e1, IOC_SET_OUTPUT, e2)\n\t\t\t\t\t\t  perf_event_set_output(e1, e2)\n\n\t  ...\n\t  list_for_each_entry_rcu(e, \u0026e2-\u003erb-\u003eevent_list, rb_entry)\n\t    ring_buffer_attach(e, NULL);\n\t    // e1 isn't yet added and\n\t    // therefore not detached\n\n\t\t\t\t\t\t    ring_buffer_attach(e1, e2-\u003erb)\n\t\t\t\t\t\t      list_add_rcu(\u0026e1-\u003erb_entry,\n\t\t\t\t\t\t\t\t   \u0026e2-\u003erb-\u003eevent_list)\n\nAfter this; e1 is attached to an unmapped rb and a subsequent\nperf_mmap() will loop forever more:\n\n\tagain:\n\t\tmutex_lock(\u0026e-\u003emmap_mutex);\n\t\tif (event-\u003erb) {\n\t\t\t...\n\t\t\tif (!atomic_inc_not_zero(\u0026e-\u003erb-\u003emmap_count)) {\n\t\t\t\t...\n\t\t\t\tmutex_unlock(\u0026e-\u003emmap_mutex);\n\t\t\t\tgoto again;\n\t\t\t}\n\t\t}\n\nThe loop in perf_mmap_close() holds e2-\u003emmap_mutex, while the attach\nin perf_event_set_output() holds e1-\u003emmap_mutex. As such there is no\nserialization to avoid this race.\n\nChange perf_event_set_output() to take both e1-\u003emmap_mutex and\ne2-\u003emmap_mutex to alleviate that problem. Additionally, have the loop\nin perf_mmap() detach the rb directly, this avoids having to wait for\nthe concurrent perf_mmap_close() to get around to doing it to make\nprogress.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "acfe666f-3043-43f7-9f89-4d003a188222",
      "id": "CVE-2022-49619",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sfp: fix memory leak in sfp_probe()\n\nsfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When\ndevm_add_action() fails, sfp is not freed, which leads to a memory leak.\n\nWe should use devm_add_action_or_reset() instead of devm_add_action().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b955ee1-26cf-4a90-aa64-026c486ca62b",
      "id": "CVE-2022-49626",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix use after free when disabling sriov\n\nUse after free is detected by kfence when disabling sriov. What was read\nafter being freed was vf-\u003epci_dev: it was freed from pci_disable_sriov\nand later read in efx_ef10_sriov_free_vf_vports, called from\nefx_ef10_sriov_free_vf_vswitching.\n\nSet the pointer to NULL at release time to not trying to read it later.\n\nReproducer and dmesg log (note that kfence doesn't detect it every time):\n$ echo 1 \u003e /sys/class/net/enp65s0f0np0/device/sriov_numvfs\n$ echo 0 \u003e /sys/class/net/enp65s0f0np0/device/sriov_numvfs\n\n BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc]\n\n Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224):\n  efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc]\n  efx_ef10_pci_sriov_disable+0x38/0x70 [sfc]\n  efx_pci_sriov_configure+0x24/0x40 [sfc]\n  sriov_numvfs_store+0xfe/0x140\n  kernfs_fop_write_iter+0x11c/0x1b0\n  new_sync_write+0x11f/0x1b0\n  vfs_write+0x1eb/0x280\n  ksys_write+0x5f/0xe0\n  do_syscall_64+0x5c/0x80\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k\n\n allocated by task 6771 on cpu 10 at 3137.860196s:\n  pci_alloc_dev+0x21/0x60\n  pci_iov_add_virtfn+0x2a2/0x320\n  sriov_enable+0x212/0x3e0\n  efx_ef10_sriov_configure+0x67/0x80 [sfc]\n  efx_pci_sriov_configure+0x24/0x40 [sfc]\n  sriov_numvfs_store+0xba/0x140\n  kernfs_fop_write_iter+0x11c/0x1b0\n  new_sync_write+0x11f/0x1b0\n  vfs_write+0x1eb/0x280\n  ksys_write+0x5f/0xe0\n  do_syscall_64+0x5c/0x80\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n freed by task 6771 on cpu 12 at 3170.991309s:\n  device_release+0x34/0x90\n  kobject_cleanup+0x3a/0x130\n  pci_iov_remove_virtfn+0xd9/0x120\n  sriov_disable+0x30/0xe0\n  efx_ef10_pci_sriov_disable+0x57/0x70 [sfc]\n  efx_pci_sriov_configure+0x24/0x40 [sfc]\n  sriov_numvfs_store+0xfe/0x140\n  kernfs_fop_write_iter+0x11c/0x1b0\n  new_sync_write+0x11f/0x1b0\n  vfs_write+0x1eb/0x280\n  ksys_write+0x5f/0xe0\n  do_syscall_64+0x5c/0x80\n  entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1beaefd-1234-426a-a3f0-6b8c368945a8",
      "id": "CVE-2022-49642",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: dwc-qos: Disable split header for Tegra194\n\nThere is a long-standing issue with the Synopsys DWC Ethernet driver\nfor Tegra194 where random system crashes have been observed [0]. The\nproblem occurs when the split header feature is enabled in the stmmac\ndriver. In the bad case, a larger than expected buffer length is\nreceived and causes the calculation of the total buffer length to\noverflow. This results in a very large buffer length that causes the\nkernel to crash. Why this larger buffer length is received is not clear,\nhowever, the feedback from the NVIDIA design team is that the split\nheader feature is not supported for Tegra194. Therefore, disable split\nheader support for Tegra194 to prevent these random crashes from\noccurring.\n\n[0] https://lore.kernel.org/linux-tegra/b0b17697-f23e-8fa5-3757-604a86f3a095@nvidia.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee674832-aeb1-4afb-af19-c114f77079fd",
      "id": "CVE-2022-49656",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: meson: Fix refcount leak in meson_smp_prepare_cpus\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1928910f-b9c3-4f11-8e13-084244f8400d",
      "id": "CVE-2022-49667",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free after 802.3ad slave unbind\n\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\"),\nresolve case, when there is several aggregation groups in the same bond.\nbond_3ad_unbind_slave will invalidate (clear) aggregator when\n__agg_active_ports return zero. So, ad_clear_agg can be executed even, when\nnum_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,\npreviously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave\nwill not update slave ports list, because lag_ports==NULL. So, here we\ngot slave ports, pointing to freed aggregator memory.\n\nFix with checking actual number of ports in group (as was before\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\") ),\nbefore ad_clear_agg().\n\nThe KASAN logs are as follows:\n\n[  767.617392] ==================================================================\n[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470\n[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767\n[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15\n[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler\n[  767.666468] Call trace:\n[  767.668930]  dump_backtrace+0x0/0x2d0\n[  767.672625]  show_stack+0x24/0x30\n[  767.675965]  dump_stack_lvl+0x68/0x84\n[  767.679659]  print_address_description.constprop.0+0x74/0x2b8\n[  767.685451]  kasan_report+0x1f0/0x260\n[  767.689148]  __asan_load2+0x94/0xd0\n[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba614c8d-a53e-4788-937f-05b92510a6f0",
      "id": "CVE-2022-49673",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix KASAN warning in raid5_add_disks\n\nThere's a KASAN warning in raid5_add_disk when running the LVM testsuite.\nThe warning happens in the test\nlvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning\nby verifying that rdev-\u003esaved_raid_disk is within limits.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48b7ea2a-f1cf-4fe2-aa7a-956087a38712",
      "id": "CVE-2022-49831",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: initialize device's zone info for seeding\n\nWhen performing seeding on a zoned filesystem it is necessary to\ninitialize each zoned device's btrfs_zoned_device_info structure,\notherwise mounting the filesystem will cause a NULL pointer dereference.\n\nThis was uncovered by fstests' testcase btrfs/163.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e95f11ff-cd20-43f6-a707-30f504368f91",
      "id": "CVE-2022-49869",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix possible crash in bnxt_hwrm_set_coal()\n\nDuring the error recovery sequence, the rtnl_lock is not held for the\nentire duration and some datastructures may be freed during the sequence.\nCheck for the BNXT_STATE_OPEN flag instead of netif_running() to ensure\nthat the device is fully operational before proceeding to reconfigure\nthe coalescing settings.\n\nThis will fix a possible crash like this:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000000\nPGD 0 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 10 PID: 181276 Comm: ethtool Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-348.el8.x86_64 #1\nHardware name: Dell Inc. PowerEdge R740/0F9N89, BIOS 2.3.10 08/15/2019\nRIP: 0010:bnxt_hwrm_set_coal+0x1fb/0x2a0 [bnxt_en]\nCode: c2 66 83 4e 22 08 66 89 46 1c e8 10 cb 00 00 41 83 c6 01 44 39 b3 68 01 00 00 0f 8e a3 00 00 00 48 8b 93 c8 00 00 00 49 63 c6 \u003c48\u003e 8b 2c c2 48 8b 85 b8 02 00 00 48 85 c0 74 2e 48 8b 74 24 08 f6\nRSP: 0018:ffffb11c8dcaba50 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8d168a8b0ac0 RCX: 00000000000000c5\nRDX: 0000000000000000 RSI: ffff8d162f72c000 RDI: ffff8d168a8b0b28\nRBP: 0000000000000000 R08: b6e1f68a12e9a7eb R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000037 R12: ffff8d168a8b109c\nR13: ffff8d168a8b10aa R14: 0000000000000000 R15: ffffffffc01ac4e0\nFS:  00007f3852e4c740(0000) GS:ffff8d24c0080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000041b3ee003 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ethnl_set_coalesce+0x3ce/0x4c0\n genl_family_rcv_msg_doit.isra.15+0x10f/0x150\n genl_family_rcv_msg+0xb3/0x160\n ? coalesce_fill_reply+0x480/0x480\n genl_rcv_msg+0x47/0x90\n ? genl_family_rcv_msg+0x160/0x160\n netlink_rcv_skb+0x4c/0x120\n genl_rcv+0x24/0x40\n netlink_unicast+0x196/0x230\n netlink_sendmsg+0x204/0x3d0\n sock_sendmsg+0x4c/0x50\n __sys_sendto+0xee/0x160\n ? syscall_trace_enter+0x1d3/0x2c0\n ? __audit_syscall_exit+0x249/0x2a0\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x5b/0x1a0\n entry_SYSCALL_64_after_hwframe+0x65/0xca\nRIP: 0033:0x7f38524163bb",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5af838f-97df-4dad-8c8a-fe5f4af88c66",
      "id": "CVE-2022-49887",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: meson: vdec: fix possible refcount leak in vdec_probe()\n\nv4l2_device_unregister need to be called to put the refcount got by\nv4l2_device_register when vdec_probe fails or vdec_remove is called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "80dff83b-f7da-4db4-8b68-54be0bb3a262",
      "id": "CVE-2022-49903",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix WARNING in ip6_route_net_exit_late()\n\nDuring the initialization of ip6_route_net_init_late(), if file\nipv6_route or rt6_stats fails to be created, the initialization is\nsuccessful by default. Therefore, the ipv6_route or rt6_stats file\ndoesn't be found during the remove in ip6_route_net_exit_late(). It\nwill cause WRNING.\n\nThe following is the stack information:\nname 'rt6_stats'\nWARNING: CPU: 0 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460\nModules linked in:\nWorkqueue: netns cleanup_net\nRIP: 0010:remove_proc_entry+0x389/0x460\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\nops_exit_list+0xb0/0x170\ncleanup_net+0x4ea/0xb00\nprocess_one_work+0x9bf/0x1710\nworker_thread+0x665/0x1080\nkthread+0x2e4/0x3a0\nret_from_fork+0x1f/0x30\n\u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de9c52d3-0df3-42bb-bf72-86699be79615",
      "id": "CVE-2022-49921",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: Fix use after free in red_enqueue()\n\nWe can't use \"skb\" again after passing it to qdisc_enqueue().  This is\nbasically identical to commit 2f09707d0c97 (\"sch_sfb: Also store skb\nlen before calling child enqueue\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6dd36fb-993e-487a-b8bf-10f8996bfe16",
      "id": "CVE-2022-49935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/dma-resv: check if the new fence is really later\n\nPreviously when we added a fence to a dma_resv object we always\nassumed the the newer than all the existing fences.\n\nWith Jason's work to add an UAPI to explicit export/import that's not\nnecessary the case any more. So without this check we would allow\nuserspace to force the kernel into an use after free error.\n\nSince the change is very small and defensive it's probably a good\nidea to backport this to stable kernels as well just in case others\nare using the dma_resv object in the same way.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76a163ac-0e75-403d-a53a-255d2ea042af",
      "id": "CVE-2022-49977",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead\n\nftrace_startup does not remove ops from ftrace_ops_list when\nftrace_startup_enable fails:\n\nregister_ftrace_function\n  ftrace_startup\n    __register_ftrace_function\n      ...\n      add_ftrace_ops(\u0026ftrace_ops_list, ops)\n      ...\n    ...\n    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1\n    ...\n  return 0 // ops is in the ftrace_ops_list.\n\nWhen ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:\nunregister_ftrace_function\n  ftrace_shutdown\n    if (unlikely(ftrace_disabled))\n            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,\n                             // as a result, ops is still in the ftrace_ops_list\n    __unregister_ftrace_function\n    ...\n\nIf ops is dynamically allocated, it will be free later, in this case,\nis_ftrace_trampoline accesses NULL pointer:\n\nis_ftrace_trampoline\n  ftrace_ops_trampoline\n    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!\n\nSyzkaller reports as follows:\n[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b\n[ 1203.508039] #PF: supervisor read access in kernel mode\n[ 1203.508798] #PF: error_code(0x0000) - not-present page\n[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0\n[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI\n[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8\n[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0\n[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 \u003c48\u003e 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00\n[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246\n[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866\n[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b\n[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07\n[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399\n[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008\n[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000\n[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0\n[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nTherefore, when ftrace_startup_enable fails, we need to rollback registration\nprocess and remove ops from ftrace_ops_list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e37f45f-cb06-4dd2-b541-b0d4b66f42d6",
      "id": "CVE-2022-50127",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix error unwind in rxe_create_qp()\n\nIn the function rxe_create_qp(), rxe_qp_from_init() is called to\ninitialize qp, internally things like the spin locks are not setup until\nrxe_qp_init_req().\n\nIf an error occures before this point then the unwind will call\nrxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task()\nwhich will oops when trying to access the uninitialized spinlock.\n\nMove the spinlock initializations earlier before any failures.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5c8bbff-23b2-456e-b64f-cd320ddc2552",
      "id": "CVE-2022-50194",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register\n\nEvery iteration of for_each_available_child_of_node() decrements\nthe reference count of the previous node.\nWhen breaking early from a for_each_available_child_of_node() loop,\nwe need to explicitly call of_node_put() on the child node.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2538da5c-cf94-49ae-a499-d7ea777dd366",
      "id": "CVE-2022-50213",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: do not allow SET_ID to refer to another table\n\nWhen doing lookups for sets on the same batch by using its ID, a set from a\ndifferent table can be used.\n\nThen, when the table is removed, a reference to the set may be kept after\nthe set is freed, leading to a potential use-after-free.\n\nWhen looking for sets by ID, use the table that was used for the lookup by\nname, and only return sets belonging to that same table.\n\nThis fixes CVE-2022-2586, also reported as ZDI-CAN-17470.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3ee3047-b022-4dc9-b818-5734ede13035",
      "id": "CVE-2024-42155",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Wipe copies of protected- and secure-keys\n\nAlthough the clear-key of neither protected- nor secure-keys is\naccessible, this key material should only be visible to the calling\nprocess. So wipe all copies of protected- or secure-keys from stack,\neven in case of an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c099cc24-58c2-465e-8031-9c66d28e3ddc",
      "id": "CVE-2022-50311",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: Fix refcount leak in cxl_calc_capp_routing\n\nof_get_next_parent() returns a node pointer with refcount incremented,\nwe should use of_node_put() on it when not need anymore.\nThis function only calls of_node_put() in normal path,\nmissing it in the error path.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "977331cc-9752-43f4-8c61-7f1bd1eba32a",
      "id": "CVE-2022-50411",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix error code path in acpi_ds_call_control_method()\n\nA use-after-free in acpi_ps_parse_aml() after a failing invocaion of\nacpi_ds_call_control_method() is reported by KASAN [1] and code\ninspection reveals that next_walk_state pushed to the thread by\nacpi_ds_create_walk_state() is freed on errors, but it is not popped\nfrom the thread beforehand.  Thus acpi_ds_get_current_walk_state()\ncalled by acpi_ps_parse_aml() subsequently returns it as the new\nwalk state which is incorrect.\n\nTo address this, make acpi_ds_call_control_method() call\nacpi_ds_pop_walk_state() to pop next_walk_state from the thread before\nreturning an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be59e3e1-0f16-420c-b457-7017d71623ab",
      "id": "CVE-2023-1382",
      "description": "A data race flaw was found in the Linux kernel, between where con is allocated and con-\u003esock is set. This issue leads to a NULL pointer dereference when accessing con-\u003esock-\u003esk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97e04678-b1af-44cd-8891-7b54bd94034d",
      "id": "CVE-2023-1670",
      "description": "A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "638d10db-e59a-4582-af83-e8a45303b4e1",
      "id": "CVE-2023-32233",
      "description": "In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "012537f1-0ebd-4164-bd7c-b3e66395bb57",
      "id": "CVE-2023-39198",
      "description": "A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72169b9d-2497-4cab-a7fb-724bd10729cb",
      "id": "CVE-2023-52569",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: remove BUG() after failure to insert delayed dir index item\n\nInstead of calling BUG() when we fail to insert a delayed dir index item\ninto the delayed node's tree, we can just release all the resources we\nhave allocated/acquired before and return the error to the caller. This is\nfine because all existing call chains undo anything they have done before\ncalling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending\nsnapshots in the transaction commit path).\n\nSo remove the BUG() call and do proper error handling.\n\nThis relates to a syzbot report linked below, but does not fix it because\nit only prevents hitting a BUG(), it does not fix the issue where somehow\nwe attempt to use twice the same index number for different index items.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c0d5a22f-4266-4926-bf31-cd85ecc5da13",
      "id": "CVE-2023-52836",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/ww_mutex/test: Fix potential workqueue corruption\n\nIn some cases running with the test-ww_mutex code, I was seeing\nodd behavior where sometimes it seemed flush_workqueue was\nreturning before all the work threads were finished.\n\nOften this would cause strange crashes as the mutexes would be\nfreed while they were being used.\n\nLooking at the code, there is a lifetime problem as the\ncontrolling thread that spawns the work allocates the\n\"struct stress\" structures that are passed to the workqueue\nthreads. Then when the workqueue threads are finished,\nthey free the stress struct that was passed to them.\n\nUnfortunately the workqueue work_struct node is in the stress\nstruct. Which means the work_struct is freed before the work\nthread returns and while flush_workqueue is waiting.\n\nIt seems like a better idea to have the controlling thread\nboth allocate and free the stress structures, so that we can\nbe sure we don't corrupt the workqueue by freeing the structure\nprematurely.\n\nSo this patch reworks the test to do so, and with this change\nI no longer see the early flush_workqueue returns.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e66a3a71-b9b3-4a7f-a830-a1df23c35ec6",
      "id": "CVE-2023-52843",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: verify mac len before reading mac header\n\nLLC reads the mac header with eth_hdr without verifying that the skb\nhas an Ethernet header.\n\nSyzbot was able to enter llc_rcv on a tun device. Tun can insert\npackets without mac len and with user configurable skb-\u003eprotocol\n(passing a tun_pi header when not configuring IFF_NO_PI).\n\n    BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218\n    __netif_receive_skb_one_core net/core/dev.c:5523 [inline]\n    __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637\n    netif_receive_skb_internal net/core/dev.c:5723 [inline]\n    netif_receive_skb+0x58/0x660 net/core/dev.c:5782\n    tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n    tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002\n\nAdd a mac_len test before all three eth_hdr(skb) calls under net/llc.\n\nThere are further uses in include/net/llc_pdu.h. All these are\nprotected by a test skb-\u003eprotocol == ETH_P_802_2. Which does not\nprotect against this tun scenario.\n\nBut the mac_len test added in this patch in llc_fixup_skb will\nindirectly protect those too. That is called from llc_rcv before any\nother LLC code.\n\nIt is tempting to just add a blanket mac_len check in llc_rcv, but\nnot sure whether that could break valid LLC paths that do not assume\nan Ethernet header. 802.2 LLC may be used on top of non-802.3\nprotocols in principle. The below referenced commit shows that used\nto, on top of Token Ring.\n\nAt least one of the three eth_hdr uses goes back to before the start\nof git history. But the one that syzbot exercises is introduced in\nthis commit. That commit is old enough (2008), that effectively all\nstable kernels should receive this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5dd9b416-dd98-49fd-b93f-3cbbe1d93295",
      "id": "CVE-2023-52988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()\n\nsnd_hda_get_connections() can return a negative error code.\nIt may lead to accessing 'conn' array at a negative index.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a330e827-e234-4b3d-899b-5762a54e1b0c",
      "id": "CVE-2023-53109",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tunnels: annotate lockless accesses to dev-\u003eneeded_headroom\n\nIP tunnels can apparently update dev-\u003eneeded_headroom\nin their xmit path.\n\nThis patch takes care of three tunnels xmit, and also the\ncore LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA()\nhelpers.\n\nMore changes might be needed for completeness.\n\nBUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit\n\nread to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1:\nip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430\ndst_output include/net/dst.h:444 [inline]\nip_local_out+0x64/0x80 net/ipv4/ip_output.c:126\niptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82\nip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430\ndst_output include/net/dst.h:444 [inline]\nip_local_out+0x64/0x80 net/ipv4/ip_output.c:126\niptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82\nip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430\ndst_output include/net/dst.h:444 [inline]\nip_local_out+0x64/0x80 net/ipv4/ip_output.c:126\niptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82\nip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/i\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3bce181-92eb-41c6-900b-7ea6a17f08f2",
      "id": "CVE-2023-53365",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: Fix skb_under_panic in ip6mr_cache_report()\n\nskbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4\n head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:192!\n invalid opcode: 0000 [#1] PREEMPT SMP KASAN\n CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Workqueue: ipv6_addrconf addrconf_dad_work\n RIP: 0010:skb_panic+0x152/0x1d0\n Call Trace:\n  \u003cTASK\u003e\n  skb_push+0xc4/0xe0\n  ip6mr_cache_report+0xd69/0x19b0\n  reg_vif_xmit+0x406/0x690\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  vlan_dev_hard_start_xmit+0x3ab/0x5c0\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  neigh_connected_output+0x3ed/0x570\n  ip6_finish_output2+0x5b5/0x1950\n  ip6_finish_output+0x693/0x11c0\n  ip6_output+0x24b/0x880\n  NF_HOOK.constprop.0+0xfd/0x530\n  ndisc_send_skb+0x9db/0x1400\n  ndisc_send_rs+0x12a/0x6c0\n  addrconf_dad_completed+0x3c9/0xea0\n  addrconf_dad_work+0x849/0x1420\n  process_one_work+0xa22/0x16e0\n  worker_thread+0x679/0x10c0\n  ret_from_fork+0x28/0x60\n  ret_from_fork_asm+0x11/0x20\n\nWhen setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit().\nreg_vif_xmit()\n    ip6mr_cache_report()\n        skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4\nAnd skb_push declared as:\n\tvoid *skb_push(struct sk_buff *skb, unsigned int len);\n\t\tskb-\u003edata -= len;\n\t\t//0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850\nskb-\u003edata is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "881bba2b-598e-4948-94f5-cd07e6a2c2c7",
      "id": "CVE-2023-53339",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix BUG_ON condition in btrfs_cancel_balance\n\nPausing and canceling balance can race to interrupt balance lead to BUG_ON\npanic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance\ndoes not take this race scenario into account.\n\nHowever, the race condition has no other side effects. We can fix that.\n\nReproducing it with panic trace like this:\n\n  kernel BUG at fs/btrfs/volumes.c:4618!\n  RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0\n  Call Trace:\n   \u003cTASK\u003e\n   ? do_nanosleep+0x60/0x120\n   ? hrtimer_nanosleep+0xb7/0x1a0\n   ? sched_core_clone_cookie+0x70/0x70\n   btrfs_ioctl_balance_ctl+0x55/0x70\n   btrfs_ioctl+0xa46/0xd20\n   __x64_sys_ioctl+0x7d/0xa0\n   do_syscall_64+0x38/0x80\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n  Race scenario as follows:\n  \u003e mutex_unlock(\u0026fs_info-\u003ebalance_mutex);\n  \u003e --------------------\n  \u003e .......issue pause and cancel req in another thread\n  \u003e --------------------\n  \u003e ret = __btrfs_balance(fs_info);\n  \u003e\n  \u003e mutex_lock(\u0026fs_info-\u003ebalance_mutex);\n  \u003e if (ret == -ECANCELED \u0026\u0026 atomic_read(\u0026fs_info-\u003ebalance_pause_req)) {\n  \u003e         btrfs_info(fs_info, \"balance: paused\");\n  \u003e         btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);\n  \u003e }",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff8ab5a4-681f-4b85-8bca-f6bd2d290edd",
      "id": "CVE-2023-53368",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix race issue between cpu buffer write and swap\n\nWarning happened in rb_end_commit() at code:\n\tif (RB_WARN_ON(cpu_buffer, !local_read(\u0026cpu_buffer-\u003ecommitting)))\n\n  WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142\n\trb_commit+0x402/0x4a0\n  Call Trace:\n   ring_buffer_unlock_commit+0x42/0x250\n   trace_buffer_unlock_commit_regs+0x3b/0x250\n   trace_event_buffer_commit+0xe5/0x440\n   trace_event_buffer_reserve+0x11c/0x150\n   trace_event_raw_event_sched_switch+0x23c/0x2c0\n   __traceiter_sched_switch+0x59/0x80\n   __schedule+0x72b/0x1580\n   schedule+0x92/0x120\n   worker_thread+0xa0/0x6f0\n\nIt is because the race between writing event into cpu buffer and swapping\ncpu buffer through file per_cpu/cpu0/snapshot:\n\n  Write on CPU 0             Swap buffer by per_cpu/cpu0/snapshot on CPU 1\n  --------                   --------\n                             tracing_snapshot_write()\n                               [...]\n\n  ring_buffer_lock_reserve()\n    cpu_buffer = buffer-\u003ebuffers[cpu]; // 1. Suppose find 'cpu_buffer_a';\n    [...]\n    rb_reserve_next_event()\n      [...]\n\n                               ring_buffer_swap_cpu()\n                                 if (local_read(\u0026cpu_buffer_a-\u003ecommitting))\n                                     goto out_dec;\n                                 if (local_read(\u0026cpu_buffer_b-\u003ecommitting))\n                                     goto out_dec;\n                                 buffer_a-\u003ebuffers[cpu] = cpu_buffer_b;\n                                 buffer_b-\u003ebuffers[cpu] = cpu_buffer_a;\n                                 // 2. cpu_buffer has swapped here.\n\n      rb_start_commit(cpu_buffer);\n      if (unlikely(READ_ONCE(cpu_buffer-\u003ebuffer)\n          != buffer)) { // 3. This check passed due to 'cpu_buffer-\u003ebuffer'\n        [...]           //    has not changed here.\n        return NULL;\n      }\n                                 cpu_buffer_b-\u003ebuffer = buffer_a;\n                                 cpu_buffer_a-\u003ebuffer = buffer_b;\n                                 [...]\n\n      // 4. Reserve event from 'cpu_buffer_a'.\n\n  ring_buffer_unlock_commit()\n    [...]\n    cpu_buffer = buffer-\u003ebuffers[cpu]; // 5. Now find 'cpu_buffer_b' !!!\n    rb_commit(cpu_buffer)\n      rb_end_commit()  // 6. WARN for the wrong 'committing' state !!!\n\nBased on above analysis, we can easily reproduce by following testcase:\n  ``` bash\n  #!/bin/bash\n\n  dmesg -n 7\n  sysctl -w kernel.panic_on_warn=1\n  TR=/sys/kernel/tracing\n  echo 7 \u003e ${TR}/buffer_size_kb\n  echo \"sched:sched_switch\" \u003e ${TR}/set_event\n  while [ true ]; do\n          echo 1 \u003e ${TR}/per_cpu/cpu0/snapshot\n  done \u0026\n  while [ true ]; do\n          echo 1 \u003e ${TR}/per_cpu/cpu0/snapshot\n  done \u0026\n  while [ true ]; do\n          echo 1 \u003e ${TR}/per_cpu/cpu0/snapshot\n  done \u0026\n  ```\n\nTo fix it, IIUC, we can use smp_call_function_single() to do the swap on\nthe target cpu where the buffer is located, so that above race would be\navoided.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f041c9d5-fd38-4fef-aec8-9d7d394ecbe2",
      "id": "CVE-2023-53388",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Clean dangling pointer on bind error path\n\nmtk_drm_bind() can fail, in which case drm_dev_put() is called,\ndestroying the drm_device object. However a pointer to it was still\nbeing held in the private object, and that pointer would be passed along\nto DRM in mtk_drm_sys_prepare() if a suspend were triggered at that\npoint, resulting in a panic. Clean the pointer when destroying the\nobject in the error path to prevent this from happening.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c867208a-f917-4385-90b0-c7ab1b123005",
      "id": "CVE-2024-0641",
      "description": "A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b824c5ef-3456-4ef0-8626-c24d595ac2e4",
      "id": "CVE-2024-26595",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path\n\nWhen calling mlxsw_sp_acl_tcam_region_destroy() from an error path after\nfailing to attach the region to an ACL group, we hit a NULL pointer\ndereference upon 'region-\u003egroup-\u003etcam' [1].\n\nFix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0\n[...]\nCall Trace:\n mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "916d4ebf-e40f-4a7d-8319-9dd5305f722b",
      "id": "CVE-2024-26790",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read\n\nThere is chip (ls1028a) errata:\n\nThe SoC may hang on 16 byte unaligned read transactions by QDMA.\n\nUnaligned read transactions initiated by QDMA may stall in the NOC\n(Network On-Chip), causing a deadlock condition. Stalled transactions will\ntrigger completion timeouts in PCIe controller.\n\nWorkaround:\nEnable prefetch by setting the source descriptor prefetchable bit\n( SD[PF] = 1 ).\n\nImplement this workaround.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f779b1d0-5bd8-4f73-9e3f-1cb88dd64865",
      "id": "CVE-2024-50095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Improve handling of timed out WRs of mad agent\n\nCurrent timeout handler of mad agent acquires/releases mad_agent_priv\nlock for every timed out WRs. This causes heavy locking contention\nwhen higher no. of WRs are to be handled inside timeout handler.\n\nThis leads to softlockup with below trace in some use cases where\nrdma-cm path is used to establish connection between peer nodes\n\nTrace:\n-----\n BUG: soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767]\n CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump: loaded Tainted: G OE\n     -------  ---  5.14.0-427.13.1.el9_4.x86_64 #1\n Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019\n Workqueue: ib_mad1 timeout_sends [ib_core]\n RIP: 0010:__do_softirq+0x78/0x2ac\n RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246\n RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 000000000000001f\n RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b\n RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000\n R10: 0000000000000040 R11: ffffb253449e4ff8 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040\n FS:  0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  \u003cIRQ\u003e\n  ? show_trace_log_lvl+0x1c4/0x2df\n  ? show_trace_log_lvl+0x1c4/0x2df\n  ? __irq_exit_rcu+0xa1/0xc0\n  ? watchdog_timer_fn+0x1b2/0x210\n  ? __pfx_watchdog_timer_fn+0x10/0x10\n  ? __hrtimer_run_queues+0x127/0x2c0\n  ? hrtimer_interrupt+0xfc/0x210\n  ? __sysvec_apic_timer_interrupt+0x5c/0x110\n  ? sysvec_apic_timer_interrupt+0x37/0x90\n  ? asm_sysvec_apic_timer_interrupt+0x16/0x20\n  ? __do_softirq+0x78/0x2ac\n  ? __do_softirq+0x60/0x2ac\n  __irq_exit_rcu+0xa1/0xc0\n  sysvec_call_function_single+0x72/0x90\n  \u003c/IRQ\u003e\n  \u003cTASK\u003e\n  asm_sysvec_call_function_single+0x16/0x20\n RIP: 0010:_raw_spin_unlock_irq+0x14/0x30\n RSP: 0018:ffffb253604cbd88 EFLAGS: 00000247\n RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800\n RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c\n RBP: ffff8cad5d39f600 R08: 0000000000000001 R09: 0000000000000000\n R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538\n R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c\n  cm_process_send_error+0x122/0x1d0 [ib_cm]\n  timeout_sends+0x1dd/0x270 [ib_core]\n  process_one_work+0x1e2/0x3b0\n  ? __pfx_worker_thread+0x10/0x10\n  worker_thread+0x50/0x3a0\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0xdd/0x100\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x29/0x50\n  \u003c/TASK\u003e\n\nSimplified timeout handler by creating local list of timed out WRs\nand invoke send handler post creating the list. The new method acquires/\nreleases lock once to fetch the list and hence helps to reduce locking\ncontetiong when processing higher no. of WRs",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b31dd1d-4edc-49ec-8af3-8d42f0116ca6",
      "id": "CVE-2024-27072",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: usbtv: Remove useless locks in usbtv_video_free()\n\nRemove locks calls in usbtv_video_free() because\nare useless and may led to a deadlock as reported here:\nhttps://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000\nAlso remove usbtv_stop() call since it will be called when\nunregistering the device.\n\nBefore 'c838530d230b' this issue would only be noticed if you\ndisconnect while streaming and now it is noticeable even when\ndisconnecting while not streaming.\n\n\n[hverkuil: fix minor spelling mistake in log message]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af3b5f3b-e939-4773-8bce-d410be45ea00",
      "id": "CVE-2024-27388",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix some memleaks in gssx_dec_option_array\n\nThe creds and oa-\u003edata need to be freed in the error-handling paths after\ntheir allocation. So this patch add these deallocations in the\ncorresponding paths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37837b71-5266-4210-bd42-65339acc58f9",
      "id": "CVE-2024-35887",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: fix use-after-free bugs caused by ax25_ds_del_timer\n\nWhen the ax25 device is detaching, the ax25_dev_device_down()\ncalls ax25_ds_del_timer() to cleanup the slave_timer. When\nthe timer handler is running, the ax25_ds_del_timer() that\ncalls del_timer() in it will return directly. As a result,\nthe use-after-free bugs could happen, one of the scenarios\nis shown below:\n\n      (Thread 1)          |      (Thread 2)\n                          | ax25_ds_timeout()\nax25_dev_device_down()    |\n  ax25_ds_del_timer()     |\n    del_timer()           |\n  ax25_dev_put() //FREE   |\n                          |  ax25_dev-\u003e //USE\n\nIn order to mitigate bugs, when the device is detaching, use\ntimer_shutdown_sync() to stop the timer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c06405dc-db0d-40c6-a267-059ba628f8ee",
      "id": "CVE-2024-35915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\n\nsyzbot reported the following uninit-value access issue [1][2]:\n\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\n\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "447c63b6-b8b3-4461-b090-68c5bea5c3a8",
      "id": "CVE-2024-35932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: don't check if plane-\u003estate-\u003efb == state-\u003efb\n\nCurrently, when using non-blocking commits, we can see the following\nkernel warning:\n\n[  110.908514] ------------[ cut here ]------------\n[  110.908529] refcount_t: underflow; use-after-free.\n[  110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0\n[  110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6\n[  110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G         C         6.1.66-v8+ #32\n[  110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)\n[  110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  110.909132] pc : refcount_dec_not_one+0xb8/0xc0\n[  110.909152] lr : refcount_dec_not_one+0xb4/0xc0\n[  110.909170] sp : ffffffc00913b9c0\n[  110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60\n[  110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480\n[  110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78\n[  110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000\n[  110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004\n[  110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003\n[  110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00\n[  110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572\n[  110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000\n[  110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001\n[  110.909434] Call trace:\n[  110.909441]  refcount_dec_not_one+0xb8/0xc0\n[  110.909461]  vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4]\n[  110.909903]  vc4_cleanup_fb+0x44/0x50 [vc4]\n[  110.910315]  drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper]\n[  110.910669]  vc4_atomic_commit_tail+0x390/0x9dc [vc4]\n[  110.911079]  commit_tail+0xb0/0x164 [drm_kms_helper]\n[  110.911397]  drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper]\n[  110.911716]  drm_atomic_commit+0xb0/0xdc [drm]\n[  110.912569]  drm_mode_atomic_ioctl+0x348/0x4b8 [drm]\n[  110.913330]  drm_ioctl_kernel+0xec/0x15c [drm]\n[  110.914091]  drm_ioctl+0x24c/0x3b0 [drm]\n[  110.914850]  __arm64_sys_ioctl+0x9c/0xd4\n[  110.914873]  invoke_syscall+0x4c/0x114\n[  110.914897]  el0_svc_common+0xd0/0x118\n[  110.914917]  do_el0_svc+0x38/0xd0\n[  110.914936]  el0_svc+0x30/0x8c\n[  110.914958]  el0t_64_sync_handler+0x84/0xf0\n[  110.914979]  el0t_64_sync+0x18c/0x190\n[  110.914996] ---[ end trace 0000000000000000 ]---\n\nThis happens because, although `prepare_fb` and `cleanup_fb` are\nperfectly balanced, we cannot guarantee consistency in the check\nplane-\u003estate-\u003efb == state-\u003efb. This means that sometimes we can increase\nthe refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The\nopposite can also be true.\n\nIn fact, the struct drm_plane .state shouldn't be accessed directly\nbut instead, the `drm_atomic_get_new_plane_state()` helper function should\nbe used. So, we could stick to this check, but using\n`drm_atomic_get_new_plane_state()`. But actually, this check is not re\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a1a635c-8a97-43ca-92e0-73229ce4470c",
      "id": "CVE-2024-41012",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Remove locks reliably when fcntl/close race is detected\n\nWhen fcntl_setlk() races with close(), it removes the created lock with\ndo_lock_file_wait().\nHowever, LSMs can allow the first do_lock_file_wait() that created the lock\nwhile denying the second do_lock_file_wait() that tries to remove the lock.\nSeparately, posix_lock_file() could also fail to\nremove a lock due to GFP_KERNEL allocation failure (when splitting a range\nin the middle).\n\nAfter the bug has been triggered, use-after-free reads will occur in\nlock_get_status() when userspace reads /proc/locks. This can likely be used\nto read arbitrary kernel memory, but can't corrupt kernel memory.\n\nFix it by calling locks_remove_posix() instead, which is designed to\nreliably get rid of POSIX locks associated with the given file and\nfiles_struct and is also used by filp_flush().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "900acc7d-166e-4804-8fd6-ec6d408e37a6",
      "id": "CVE-2024-42124",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedf: Make qedf_execute_tmf() non-preemptible\n\nStop calling smp_processor_id() from preemptible code in\nqedf_execute_tmf90.  This results in BUG_ON() when running an RT kernel.\n\n[ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646\n[ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09ab7b81-3eb7-4f6d-b9c2-9fae0c4702d2",
      "id": "CVE-2024-44969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Prevent release of buffer in I/O\n\nWhen a task waiting for completion of a Store Data operation is\ninterrupted, an attempt is made to halt this operation. If this attempt\nfails due to a hardware or firmware problem, there is a chance that the\nSCLP facility might store data into buffers referenced by the original\noperation at a later time.\n\nHandle this situation by not releasing the referenced data buffers if\nthe halt attempt fails. For current use cases, this might result in a\nleak of few pages of memory in case of a rare hardware/firmware\nmalfunction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b85678dd-d5e7-42b0-85cd-6b8e552d9ca0",
      "id": "CVE-2024-46681",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npktgen: use cpus_read_lock() in pg_net_init()\n\nI have seen the WARN_ON(smp_processor_id() != cpu) firing\nin pktgen_thread_worker() during tests.\n\nWe must use cpus_read_lock()/cpus_read_unlock()\naround the for_each_online_cpu(cpu) loop.\n\nWhile we are at it use WARN_ON_ONCE() to avoid a possible syslog flood.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a519a89-dfb9-4f6e-a182-7625f3ae13c5",
      "id": "CVE-2024-46744",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: sanity check symbolic link size\n\nSyzkiller reports a \"KMSAN: uninit-value in pick_link\" bug.\n\nThis is caused by an uninitialised page, which is ultimately caused\nby a corrupted symbolic link size read from disk.\n\nThe reason why the corrupted symlink size causes an uninitialised\npage is due to the following sequence of events:\n\n1. squashfs_read_inode() is called to read the symbolic\n   link from disk.  This assigns the corrupted value\n   3875536935 to inode-\u003ei_size.\n\n2. Later squashfs_symlink_read_folio() is called, which assigns\n   this corrupted value to the length variable, which being a\n   signed int, overflows producing a negative number.\n\n3. The following loop that fills in the page contents checks that\n   the copied bytes is less than length, which being negative means\n   the loop is skipped, producing an uninitialised page.\n\nThis patch adds a sanity check which checks that the symbolic\nlink size is not larger than expected.\n\n--\n\nV2: fix spelling mistake.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec75db45-60e8-44f8-9236-5c2efc3e413e",
      "id": "CVE-2024-46772",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check denominator crb_pipes before used\n\n[WHAT \u0026 HOW]\nA denominator cannot be 0, and is checked before used.\n\nThis fixes 2 DIVIDE_BY_ZERO issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23d85ee2-78a4-429e-9061-480de2081a4d",
      "id": "CVE-2024-46794",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/tdx: Fix data leak in mmio_read()\n\nThe mmio_read() function makes a TDVMCALL to retrieve MMIO data for an\naddress from the VMM.\n\nSean noticed that mmio_read() unintentionally exposes the value of an\ninitialized variable (val) on the stack to the VMM.\n\nThis variable is only needed as an output value. It did not need to be\npassed to the VMM in the first place.\n\nDo not send the original value of *val to the VMM.\n\n[ dhansen: clarify what 'val' is used for. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f53a1f49-1789-4c9b-a1aa-5e05ddec2a33",
      "id": "CVE-2024-46815",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]\n\n[WHY \u0026 HOW]\nnum_valid_sets needs to be checked to avoid a negative index when\naccessing reader_wm_sets[num_valid_sets - 1].\n\nThis fixes an OVERRUN issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28295515-0f3f-44ab-8700-11c446a30212",
      "id": "CVE-2024-47665",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup\n\nDefinitely condition dma_get_cache_alignment * defined value \u003e 256\nduring driver initialization is not reason to BUG_ON(). Turn that to\ngraceful error out with -EINVAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4fee52bc-1266-43ed-b827-40503830ed7f",
      "id": "CVE-2024-49860",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: sysfs: validate return type of _STR method\n\nOnly buffer objects are valid return values of _STR.\n\nIf something else is returned description_show() will access invalid\nmemory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ddbdc100-65f3-4449-9c8e-37f6da2edef4",
      "id": "CVE-2024-49918",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn32_acquire_idle_pipe_for_head_pipe_in_layer` function. The issue\ncould occur when `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2690 dcn32_acquire_idle_pipe_for_head_pipe_in_layer() error: we previously assumed 'head_pipe' could be null (see line 2681)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bafd9b85-cd1d-431e-b00c-a437ad6cb9d4",
      "id": "CVE-2024-53133",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Handle dml allocation failure to avoid crash\n\n[Why]\nIn the case where a dml allocation fails for any reason, the\ncurrent state's dml contexts would no longer be valid. Then\nsubsequent calls dc_state_copy_internal would shallow copy\ninvalid memory and if the new state was released, a double\nfree would occur.\n\n[How]\nReset dml pointers in new_state to NULL and avoid invalid\npointer\n\n(cherry picked from commit bcafdc61529a48f6f06355d78eb41b3aeda5296c)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33ef957e-d925-4d3f-81e8-223ed76296f4",
      "id": "CVE-2024-49929",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: avoid NULL pointer dereference\n\niwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta\npointer is not NULL.\nIt retrieves this pointer using iwl_mvm_sta_from_mac80211, which is\ndereferencing the ieee80211_sta pointer.\nIf sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL\npointer.\nFix this by checking the sta pointer before retrieving the mvmsta\nfrom it. If sta is not NULL, then mvmsta isn't either.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1640e262-0681-40c6-ad16-378bbe1a12b0",
      "id": "CVE-2024-49992",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: Avoid use-after-free issues with crtc and plane\n\nltdc_load() calls functions drm_crtc_init_with_planes(),\ndrm_universal_plane_init() and drm_encoder_init(). These functions\nshould not be called with parameters allocated with devm_kzalloc()\nto avoid use-after-free issues [1].\n\nUse allocations managed by the DRM framework.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n[1]\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9fb4476-c21e-47ad-b25c-2f0bc7bf13ee",
      "id": "CVE-2024-50014",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix access to uninitialised lock in fc replay path\n\nThe following kernel trace can be triggered with fstest generic/629 when\nexecuted against a filesystem with fast-commit feature enabled:\n\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nCPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0x90\n register_lock_class+0x759/0x7d0\n __lock_acquire+0x85/0x2630\n ? __find_get_block+0xb4/0x380\n lock_acquire+0xd1/0x2d0\n ? __ext4_journal_get_write_access+0xd5/0x160\n _raw_spin_lock+0x33/0x40\n ? __ext4_journal_get_write_access+0xd5/0x160\n __ext4_journal_get_write_access+0xd5/0x160\n ext4_reserve_inode_write+0x61/0xb0\n __ext4_mark_inode_dirty+0x79/0x270\n ? ext4_ext_replay_set_iblocks+0x2f8/0x450\n ext4_ext_replay_set_iblocks+0x330/0x450\n ext4_fc_replay+0x14c8/0x1540\n ? jread+0x88/0x2e0\n ? rcu_is_watching+0x11/0x40\n do_one_pass+0x447/0xd00\n jbd2_journal_recover+0x139/0x1b0\n jbd2_journal_load+0x96/0x390\n ext4_load_and_init_journal+0x253/0xd40\n ext4_fill_super+0x2cc6/0x3180\n...\n\nIn the replay path there's an attempt to lock sbi-\u003es_bdev_wb_lock in\nfunction ext4_check_bdev_write_error().  Unfortunately, at this point this\nspinlock has not been initialized yet.  Moving it's initialization to an\nearlier point in __ext4_fill_super() fixes this splat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a85b60f-130b-4577-830d-6e26bdef560e",
      "id": "CVE-2024-50051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: Add cancel_work_sync before module remove\n\nIf we remove the module which will call mpc52xx_spi_remove\nit will free 'ms' through spi_unregister_controller.\nwhile the work ms-\u003ework will be used. The sequence of operations\nthat may lead to a UAF bug.\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in mpc52xx_spi_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a194bfd0-7b12-4726-bf26-363e987ea817",
      "id": "CVE-2024-50178",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: loongson3: Use raw_smp_processor_id() in do_service_request()\n\nUse raw_smp_processor_id() instead of plain smp_processor_id() in\ndo_service_request(), otherwise we may get some errors with the driver\nenabled:\n\n BUG: using smp_processor_id() in preemptible [00000000] code: (udev-worker)/208\n caller is loongson3_cpufreq_probe+0x5c/0x250 [loongson3_cpufreq]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "654fab76-33da-4fab-99b8-b1c071fbf130",
      "id": "CVE-2024-50180",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sisfb: Fix strbuf array overflow\n\nThe values of the variables xres and yres are placed in strbuf.\nThese variables are obtained from strbuf1.\nThe strbuf1 array contains digit characters\nand a space if the array contains non-digit characters.\nThen, when executing sprintf(strbuf, \"%ux%ux8\", xres, yres);\nmore than 16 bytes will be written to strbuf.\nIt is suggested to increase the size of the strbuf array to 24.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "243325c6-a594-4cb2-89b4-81ede21408ff",
      "id": "CVE-2024-53098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/ufence: Prefetch ufence addr to catch bogus address\n\naccess_ok() only checks for addr overflow so also try to read the addr\nto catch invalid addr sent from userspace.\n\n(cherry picked from commit 9408c4508483ffc60811e910a93d6425b8e63928)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e01d743-c0d4-41b8-b690-60d9cd745da6",
      "id": "CVE-2024-56599",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: avoid NULL pointer error during sdio remove\n\nWhen running 'rmmod ath10k', ath10k_sdio_remove() will free sdio\nworkqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON\nis set to yes, kernel panic will happen:\nCall trace:\n destroy_workqueue+0x1c/0x258\n ath10k_sdio_remove+0x84/0x94\n sdio_bus_remove+0x50/0x16c\n device_release_driver_internal+0x188/0x25c\n device_driver_detach+0x20/0x2c\n\nThis is because during 'rmmod ath10k', ath10k_sdio_remove() will call\nath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()\nwill finally be called in ath10k_core_destroy(). This function will free\nstruct cfg80211_registered_device *rdev and all its members, including\nwiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio\nworkqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.\n\nAfter device release, destroy_workqueue() will use NULL pointer then the\nkernel panic happen.\n\nCall trace:\nath10k_sdio_remove\n  -\u003eath10k_core_unregister\n    ……\n    -\u003eath10k_core_stop\n      -\u003eath10k_hif_stop\n        -\u003eath10k_sdio_irq_disable\n    -\u003eath10k_hif_power_down\n      -\u003edel_timer_sync(\u0026ar_sdio-\u003esleep_timer)\n  -\u003eath10k_core_destroy\n    -\u003eath10k_mac_destroy\n      -\u003eieee80211_free_hw\n        -\u003ewiphy_free\n    ……\n          -\u003ewiphy_dev_release\n  -\u003edestroy_workqueue\n\nNeed to call destroy_workqueue() before ath10k_core_destroy(), free\nthe work queue buffer first and then free pointer of work queue by\nath10k_core_destroy(). This order matches the error path order in\nath10k_sdio_probe().\n\nNo work will be queued on sdio workqueue between it is destroyed and\nath10k_core_destroy() is called. Based on the call_stack above, the\nreason is:\nOnly ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and\nath10k_sdio_irq_disable() will queue work on sdio workqueue.\nSleep timer will be deleted before ath10k_core_destroy() in\nath10k_hif_power_down().\nath10k_sdio_irq_disable() only be called in ath10k_hif_stop().\nath10k_core_unregister() will call ath10k_hif_power_down() to stop hif\nbus, so ath10k_sdio_hif_tx_sg() won't be called anymore.\n\nTested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2260f51b-0b0d-4710-8d49-4ee3f51e40a6",
      "id": "CVE-2024-56603",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_can: do not leave a dangling sk pointer in can_create()\n\nOn error can_create() frees the allocated sk object, but sock_init_data()\nhas already attached it to the provided sock object. This will leave a\ndangling sk pointer in the sock object and may cause use-after-free later.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bba0347d-a6ee-4cef-b880-7a34952af4a7",
      "id": "CVE-2024-56712",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: fix memory leak on last export_udmabuf() error path\n\nIn export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a\ndma_buf owning the udmabuf has already been created; but the error handling\nin udmabuf_create() will tear down the udmabuf without doing anything about\nthe containing dma_buf.\n\nThis leaves a dma_buf in memory that contains a dangling pointer; though\nthat doesn't seem to lead to anything bad except a memory leak.\n\nFix it by moving the dma_buf_fd() call out of export_udmabuf() so that we\ncan give it different error handling.\n\nNote that the shape of this code changed a lot in commit 5e72b2b41a21\n(\"udmabuf: convert udmabuf driver to use folios\"); but the memory leak\nseems to have existed since the introduction of udmabuf.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4fb35178-f4f0-40fc-bd1d-e4732f23e6c1",
      "id": "CVE-2024-56723",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices\n\nWhile design wise the idea of converting the driver to use\nthe hierarchy of the IRQ chips is correct, the implementation\nhas (inherited) flaws. This was unveiled when platform_get_irq()\nhad started WARN() on IRQ 0 that is supposed to be a Linux\nIRQ number (also known as vIRQ).\n\nRework the driver to respect IRQ domain when creating each MFD\ndevice separately, as the domain is not the same for all of them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c7cb9a1-4d3e-4bac-b1d1-663e820fa43a",
      "id": "CVE-2024-57798",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()\n\nWhile receiving an MST up request message from one thread in\ndrm_dp_mst_handle_up_req(), the MST topology could be removed from\nanother thread via drm_dp_mst_topology_mgr_set_mst(false), freeing\nmst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL.\nThis could lead to a NULL deref/use-after-free of mst_primary in\ndrm_dp_mst_handle_up_req().\n\nAvoid the above by holding a reference for mst_primary in\ndrm_dp_mst_handle_up_req() while it's used.\n\nv2: Fix kfreeing the request if getting an mst_primary reference fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d7d73ca-b659-45cb-a048-578079d6b83e",
      "id": "CVE-2022-49632",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.\n\nWhile reading sysctl_icmp_errors_use_inbound_ifaddr, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8718a09-ebc8-4c6f-8457-082d0a977e05",
      "id": "CVE-2024-57973",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrdma/cxgb4: Prevent potential integer overflow on 32bit\n\nThe \"gl-\u003etot_len\" variable is controlled by the user.  It comes from\nprocess_responses().  On 32bit systems, the \"gl-\u003etot_len + sizeof(struct\ncpl_pass_accept_req) + sizeof(struct rss_header)\" addition could have an\ninteger wrapping bug.  Use size_add() to prevent this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7499a3c6-9d22-4f77-8f1b-e2879e6b8d77",
      "id": "CVE-2024-57984",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition\n\nIn dw_i3c_common_probe, \u0026master-\u003ehj_work is bound with\ndw_i3c_hj_work. And dw_i3c_master_irq_handler can call\ndw_i3c_master_irq_handle_ibis function to start the work.\n\nIf we remove the module which will call dw_i3c_common_remove to\nmake cleanup, it will free master-\u003ebase through i3c_master_unregister\nwhile the work mentioned above will be used. The sequence of operations\nthat may lead to a UAF bug is as follows:\n\nCPU0                                      CPU1\n\n                                     | dw_i3c_hj_work\ndw_i3c_common_remove                 |\ni3c_master_unregister(\u0026master-\u003ebase) |\ndevice_unregister(\u0026master-\u003edev)      |\ndevice_release                       |\n//free master-\u003ebase                  |\n                                     | i3c_master_do_daa(\u0026master-\u003ebase)\n                                     | //use master-\u003ebase\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in dw_i3c_common_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4e935c59-2c07-4961-93c2-2313050ce0d9",
      "id": "CVE-2023-4385",
      "description": "A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3963a1fd-b165-43c1-9718-e717c66af8ec",
      "id": "CVE-2024-58010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix integer overflow bug on 32 bit systems\n\nMost of these sizes and counts are capped at 256MB so the math doesn't\nresult in an integer overflow.  The \"relocs\" count needs to be checked\nas well.  Otherwise on 32bit systems the calculation of \"full_data\"\ncould be wrong.\n\n\tfull_data = data_len + relocs * sizeof(unsigned long);",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "875c874b-884d-4ff0-a260-55c429887342",
      "id": "CVE-2024-58016",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsafesetid: check size of policy writes\n\nsyzbot attempts to write a buffer with a large size to a sysfs entry\nwith writes handled by handle_policy_update(), triggering a warning\nin kmalloc.\n\nCheck the size specified for write buffers before allocating.\n\n[PM: subject tweak]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2547c566-e30a-4686-b98f-ed273c12e6d6",
      "id": "CVE-2025-21749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: lock the socket in rose_bind()\n\nsyzbot reported a soft lockup in rose_loopback_timer(),\nwith a repro calling bind() from multiple threads.\n\nrose_bind() must lock the socket to avoid this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ef7bb23-1beb-47e4-bc0e-35779b3a2ad0",
      "id": "CVE-2025-21781",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix panic during interface removal\n\nReference counting is used to ensure that\nbatadv_hardif_neigh_node and batadv_hard_iface\nare not freed before/during\nbatadv_v_elp_throughput_metric_update work is\nfinished.\n\nBut there isn't a guarantee that the hard if will\nremain associated with a soft interface up until\nthe work is finished.\n\nThis fixes a crash triggered by reboot that looks\nlike this:\n\nCall trace:\n batadv_v_mesh_free+0xd0/0x4dc [batman_adv]\n batadv_v_elp_throughput_metric_update+0x1c/0xa4\n process_one_work+0x178/0x398\n worker_thread+0x2e8/0x4d0\n kthread+0xd8/0xdc\n ret_from_fork+0x10/0x20\n\n(the batadv_v_mesh_free call is misleading,\nand does not actually happen)\n\nI was able to make the issue happen more reliably\nby changing hardif_neigh-\u003ebat_v.metric_work work\nto be delayed work. This allowed me to track down\nand confirm the fix.\n\n[sven@narfation.org: prevent entering batadv_v_elp_get_throughput without\n soft_iface]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28d81117-2d8c-42e8-a0f3-f668831c737b",
      "id": "CVE-2025-21811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: protect access to buffers with no active references\n\nnilfs_lookup_dirty_data_buffers(), which iterates through the buffers\nattached to dirty data folios/pages, accesses the attached buffers without\nlocking the folios/pages.\n\nFor data cache, nilfs_clear_folio_dirty() may be called asynchronously\nwhen the file system degenerates to read only, so\nnilfs_lookup_dirty_data_buffers() still has the potential to cause use\nafter free issues when buffers lose the protection of their dirty state\nmidway due to this asynchronous clearing and are unintentionally freed by\ntry_to_free_buffers().\n\nEliminate this race issue by adjusting the lock section in this function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71370f4a-e0f6-4732-bf91-7d25d1a33ed0",
      "id": "CVE-2025-22053",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ibmveth: make veth_pool_store stop hanging\n\nv2:\n- Created a single error handling unlock and exit in veth_pool_store\n- Greatly expanded commit message with previous explanatory-only text\n\nSummary: Use rtnl_mutex to synchronize veth_pool_store with itself,\nibmveth_close and ibmveth_open, preventing multiple calls in a row to\nnapi_disable.\n\nBackground: Two (or more) threads could call veth_pool_store through\nwriting to /sys/devices/vio/30000002/pool*/*. You can do this easily\nwith a little shell script. This causes a hang.\n\nI configured LOCKDEP, compiled ibmveth.c with DEBUG, and built a new\nkernel. I ran this test again and saw:\n\n    Setting pool0/active to 0\n    Setting pool1/active to 1\n    [   73.911067][ T4365] ibmveth 30000002 eth0: close starting\n    Setting pool1/active to 1\n    Setting pool1/active to 0\n    [   73.911367][ T4366] ibmveth 30000002 eth0: close starting\n    [   73.916056][ T4365] ibmveth 30000002 eth0: close complete\n    [   73.916064][ T4365] ibmveth 30000002 eth0: open starting\n    [  110.808564][  T712] systemd-journald[712]: Sent WATCHDOG=1 notification.\n    [  230.808495][  T712] systemd-journald[712]: Sent WATCHDOG=1 notification.\n    [  243.683786][  T123] INFO: task stress.sh:4365 blocked for more than 122 seconds.\n    [  243.683827][  T123]       Not tainted 6.14.0-01103-g2df0c02dab82-dirty #8\n    [  243.683833][  T123] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n    [  243.683838][  T123] task:stress.sh       state:D stack:28096 pid:4365  tgid:4365  ppid:4364   task_flags:0x400040 flags:0x00042000\n    [  243.683852][  T123] Call Trace:\n    [  243.683857][  T123] [c00000000c38f690] [0000000000000001] 0x1 (unreliable)\n    [  243.683868][  T123] [c00000000c38f840] [c00000000001f908] __switch_to+0x318/0x4e0\n    [  243.683878][  T123] [c00000000c38f8a0] [c000000001549a70] __schedule+0x500/0x12a0\n    [  243.683888][  T123] [c00000000c38f9a0] [c00000000154a878] schedule+0x68/0x210\n    [  243.683896][  T123] [c00000000c38f9d0] [c00000000154ac80] schedule_preempt_disabled+0x30/0x50\n    [  243.683904][  T123] [c00000000c38fa00] [c00000000154dbb0] __mutex_lock+0x730/0x10f0\n    [  243.683913][  T123] [c00000000c38fb10] [c000000001154d40] napi_enable+0x30/0x60\n    [  243.683921][  T123] [c00000000c38fb40] [c000000000f4ae94] ibmveth_open+0x68/0x5dc\n    [  243.683928][  T123] [c00000000c38fbe0] [c000000000f4aa20] veth_pool_store+0x220/0x270\n    [  243.683936][  T123] [c00000000c38fc70] [c000000000826278] sysfs_kf_write+0x68/0xb0\n    [  243.683944][  T123] [c00000000c38fcb0] [c0000000008240b8] kernfs_fop_write_iter+0x198/0x2d0\n    [  243.683951][  T123] [c00000000c38fd00] [c00000000071b9ac] vfs_write+0x34c/0x650\n    [  243.683958][  T123] [c00000000c38fdc0] [c00000000071bea8] ksys_write+0x88/0x150\n    [  243.683966][  T123] [c00000000c38fe10] [c0000000000317f4] system_call_exception+0x124/0x340\n    [  243.683973][  T123] [c00000000c38fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n    ...\n    [  243.684087][  T123] Showing all locks held in the system:\n    [  243.684095][  T123] 1 lock held by khungtaskd/123:\n    [  243.684099][  T123]  #0: c00000000278e370 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x50/0x248\n    [  243.684114][  T123] 4 locks held by stress.sh/4365:\n    [  243.684119][  T123]  #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150\n    [  243.684132][  T123]  #1: c000000041aea888 (\u0026of-\u003emutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x154/0x2d0\n    [  243.684143][  T123]  #2: c0000000366fb9a8 (kn-\u003eactive#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x160/0x2d0\n    [  243.684155][  T123]  #3: c000000035ff4cb8 (\u0026dev-\u003elock){+.+.}-{3:3}, at: napi_enable+0x30/0x60\n    [  243.684166][  T123] 5 locks held by stress.sh/4366:\n    [  243.684170][  T123]  #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150\n    [  243.\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0216731-296c-44e1-931c-3eecd750b8c0",
      "id": "CVE-2024-26898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: fix the potential use-after-free problem in aoecmd_cfg_pkts\n\nThis patch is against CVE-2023-6270. The description of cve is:\n\n  A flaw was found in the ATA over Ethernet (AoE) driver in the Linux\n  kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on\n  `struct net_device`, and a use-after-free can be triggered by racing\n  between the free on the struct and the access through the `skbtxq`\n  global queue. This could lead to a denial of service condition or\n  potential code execution.\n\nIn aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial\ncode is finished. But the net_device ifp will still be used in\nlater tx()-\u003edev_queue_xmit() in kthread. Which means that the\ndev_put(ifp) should NOT be called in the success path of skb\ninitial code in aoecmd_cfg_pkts(). Otherwise tx() may run into\nuse-after-free because the net_device is freed.\n\nThis patch removed the dev_put(ifp) in the success path in\naoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "974593fb-1f2e-4783-9208-257e6beab02c",
      "id": "CVE-2024-26902",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: RISCV: Fix panic on pmu overflow handler\n\n(1 \u003c\u003c idx) of int is not desired when setting bits in unsigned long\noverflowed_ctrs, use BIT() instead. This panic happens when running\n'perf record -e branches' on sophgo sg2042.\n\n[  273.311852] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098\n[  273.320851] Oops [#1]\n[  273.323179] Modules linked in:\n[  273.326303] CPU: 0 PID: 1475 Comm: perf Not tainted 6.6.0-rc3+ #9\n[  273.332521] Hardware name: Sophgo Mango (DT)\n[  273.336878] epc : riscv_pmu_ctr_get_width_mask+0x8/0x62\n[  273.342291]  ra : pmu_sbi_ovf_handler+0x2e0/0x34e\n[  273.347091] epc : ffffffff80aecd98 ra : ffffffff80aee056 sp : fffffff6e36928b0\n[  273.354454]  gp : ffffffff821f82d0 tp : ffffffd90c353200 t0 : 0000002ade4f9978\n[  273.361815]  t1 : 0000000000504d55 t2 : ffffffff8016cd8c s0 : fffffff6e3692a70\n[  273.369180]  s1 : 0000000000000020 a0 : 0000000000000000 a1 : 00001a8e81800000\n[  273.376540]  a2 : 0000003c00070198 a3 : 0000003c00db75a4 a4 : 0000000000000015\n[  273.383901]  a5 : ffffffd7ff8804b0 a6 : 0000000000000015 a7 : 000000000000002a\n[  273.391327]  s2 : 000000000000ffff s3 : 0000000000000000 s4 : ffffffd7ff8803b0\n[  273.398773]  s5 : 0000000000504d55 s6 : ffffffd905069800 s7 : ffffffff821fe210\n[  273.406139]  s8 : 000000007fffffff s9 : ffffffd7ff8803b0 s10: ffffffd903f29098\n[  273.413660]  s11: 0000000080000000 t3 : 0000000000000003 t4 : ffffffff8017a0ca\n[  273.421022]  t5 : ffffffff8023cfc2 t6 : ffffffd9040780e8\n[  273.426437] status: 0000000200000100 badaddr: 0000000000000098 cause: 000000000000000d\n[  273.434512] [\u003cffffffff80aecd98\u003e] riscv_pmu_ctr_get_width_mask+0x8/0x62\n[  273.441169] [\u003cffffffff80076bd8\u003e] handle_percpu_devid_irq+0x98/0x1ee\n[  273.447562] [\u003cffffffff80071158\u003e] generic_handle_domain_irq+0x28/0x36\n[  273.454151] [\u003cffffffff8047a99a\u003e] riscv_intc_irq+0x36/0x4e\n[  273.459659] [\u003cffffffff80c944de\u003e] handle_riscv_irq+0x4a/0x74\n[  273.465442] [\u003cffffffff80c94c48\u003e] do_irq+0x62/0x92\n[  273.470360] Code: 0420 60a2 6402 5529 0141 8082 0013 0000 0013 0000 (6d5c) b783\n[  273.477921] ---[ end trace 0000000000000000 ]---\n[  273.482630] Kernel panic - not syncing: Fatal exception in interrupt",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "789ccce1-bdd7-4259-804c-352b8cb7b94f",
      "id": "CVE-2025-23156",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: refactor hfi packet parsing logic\n\nwords_count denotes the number of words in total payload, while data\npoints to payload of various property within it. When words_count\nreaches last word, data can access memory beyond the total payload. This\ncan lead to OOB access. With this patch, the utility api for handling\nindividual properties now returns the size of data consumed. Accordingly\nremaining bytes are calculated before parsing the payload, thereby\neliminates the OOB access possibilities.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b386ad24-47e2-485b-86a0-e8a1908f17d2",
      "id": "CVE-2025-37780",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: Prevent the use of too small fid\n\nsyzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1]\n\nThe handle_bytes value passed in by the reproducing program is equal to 12.\nIn handle_to_path(), only 12 bytes of memory are allocated for the structure\nfile_handle-\u003ef_handle member, which causes an out-of-bounds access when\naccessing the member parent_block of the structure isofs_fid in isofs,\nbecause accessing parent_block requires at least 16 bytes of f_handle.\nHere, fh_len is used to indirectly confirm that the value of handle_bytes\nis greater than 3 before accessing parent_block.\n\n[1]\nBUG: KASAN: slab-out-of-bounds in isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183\nRead of size 4 at addr ffff0000cc030d94 by task syz-executor215/6466\nCPU: 1 UID: 0 PID: 6466 Comm: syz-executor215 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0x198/0x550 mm/kasan/report.c:521\n kasan_report+0xd8/0x138 mm/kasan/report.c:634\n __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380\n isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183\n exportfs_decode_fh_raw+0x2dc/0x608 fs/exportfs/expfs.c:523\n do_handle_to_path+0xa0/0x198 fs/fhandle.c:257\n handle_to_path fs/fhandle.c:385 [inline]\n do_handle_open+0x8cc/0xb8c fs/fhandle.c:403\n __do_sys_open_by_handle_at fs/fhandle.c:443 [inline]\n __se_sys_open_by_handle_at fs/fhandle.c:434 [inline]\n __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n\nAllocated by task 6466:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4294 [inline]\n __kmalloc_noprof+0x32c/0x54c mm/slub.c:4306\n kmalloc_noprof include/linux/slab.h:905 [inline]\n handle_to_path fs/fhandle.c:357 [inline]\n do_handle_open+0x5a4/0xb8c fs/fhandle.c:403\n __do_sys_open_by_handle_at fs/fhandle.c:443 [inline]\n __se_sys_open_by_handle_at fs/fhandle.c:434 [inline]\n __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a07c02e7-b956-433d-9e9d-f9135e5f9409",
      "id": "CVE-2025-37881",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()\n\nThe variable d-\u003ename, returned by devm_kasprintf(), could be NULL.\nA pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\"ice: Fix some null pointer dereference issues in ice_ptp.c\").\n\nThis issue is found by our static analysis tool",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f850bcc9-815c-4d7a-8fb7-f397604b82ee",
      "id": "CVE-2025-37994",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix NULL pointer access\n\nThis patch ensures that the UCSI driver waits for all pending tasks in the\nucsi_displayport_work workqueue to finish executing before proceeding with\nthe partner removal.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd036b81-f68c-4d7c-a893-f24ebb0a1982",
      "id": "CVE-2022-49302",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: host: isp116x: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42200cde-2214-40f9-a7f0-2ad9bb5efb39",
      "id": "CVE-2025-38105",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Kill timer properly at removal\n\nThe USB-audio MIDI code initializes the timer, but in a rare case, the\ndriver might be freed without the disconnect call.  This leaves the\ntimer in an active state while the assigned object is released via\nsnd_usbmidi_free(), which ends up with a kernel warning when the debug\nconfiguration is enabled, as spotted by fuzzer.\n\nFor avoiding the problem, put timer_shutdown_sync() at\nsnd_usbmidi_free(), so that the timer can be killed properly.\nWhile we're at it, replace the existing timer_delete_sync() at the\ndisconnect callback with timer_shutdown_sync(), too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c13e5f7-cbc6-443f-b8c6-0cd7a4f84b9f",
      "id": "CVE-2025-38415",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check return result of sb_min_blocksize\n\nSyzkaller reports an \"UBSAN: shift-out-of-bounds in squashfs_bio_read\" bug.\n\nSyzkaller forks multiple processes which after mounting the Squashfs\nfilesystem, issues an ioctl(\"/dev/loop0\", LOOP_SET_BLOCK_SIZE, 0x8000). \nNow if this ioctl occurs at the same time another process is in the\nprocess of mounting a Squashfs filesystem on /dev/loop0, the failure\noccurs.  When this happens the following code in squashfs_fill_super()\nfails.\n\n----\nmsblk-\u003edevblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);\nmsblk-\u003edevblksize_log2 = ffz(~msblk-\u003edevblksize);\n----\n\nsb_min_blocksize() returns 0, which means msblk-\u003edevblksize is set to 0.\n\nAs a result, ffz(~msblk-\u003edevblksize) returns 64, and msblk-\u003edevblksize_log2\nis set to 64.\n\nThis subsequently causes the\n\nUBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36\nshift exponent 64 is too large for 64-bit type 'u64' (aka\n'unsigned long long')\n\nThis commit adds a check for a 0 return by sb_min_blocksize().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c41b5a63-70a2-4344-99ef-78c0fd9792ca",
      "id": "CVE-2025-38709",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Avoid updating block size under exclusive owner\n\nSyzbot came up with a reproducer where a loop device block size is\nchanged underneath a mounted filesystem. This causes a mismatch between\nthe block device block size and the block size stored in the superblock\ncausing confusion in various places such as fs/buffer.c. The particular\nissue triggered by syzbot was a warning in __getblk_slow() due to\nrequested buffer size not matching block device block size.\n\nFix the problem by getting exclusive hold of the loop device to change\nits block size. This fails if somebody (such as filesystem) has already\nan exclusive ownership of the block device and thus prevents modifying\nthe loop device under some exclusive owner which doesn't expect it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33ba76c0-367f-4ce8-ae5c-a7fd3074ba20",
      "id": "CVE-2025-39707",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities\n\nHUBBUB structure is not initialized on DCE hardware, so check if it is NULL\nto avoid null dereference while accessing amdgpu_dm_capabilities file in\ndebugfs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5de38279-7468-487e-b7ea-a1164ba281e9",
      "id": "CVE-2020-25656",
      "description": "A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c6c7ed44-6a70-4cf7-929b-405fd5eb2ef9",
      "id": "CVE-2020-29370",
      "description": "An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71b9ed91-0e55-4440-8cff-e214ebf0ebf5",
      "id": "CVE-2022-49341",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Clear prog-\u003ejited_len along prog-\u003ejited\n\nsyzbot reported an illegal copy_to_user() attempt\nfrom bpf_prog_get_info_by_fd() [1]\n\nThere was no repro yet on this bug, but I think\nthat commit 0aef499f3172 (\"mm/usercopy: Detect vmalloc overruns\")\nis exposing a prior bug in bpf arm64.\n\nbpf_prog_get_info_by_fd() looks at prog-\u003ejited_len\nto determine if the JIT image can be copied out to user space.\n\nMy theory is that syzbot managed to get a prog where prog-\u003ejited_len\nhas been set to 43, while prog-\u003ebpf_func has ben cleared.\n\nIt is not clear why copy_to_user(uinsns, NULL, ulen) is triggering\nthis particular warning.\n\nI thought find_vma_area(NULL) would not find a vm_struct.\nAs we do not hold vmap_area_lock spinlock, it might be possible\nthat the found vm_struct was garbage.\n\n[1]\nusercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)!\nkernel BUG at mm/usercopy.c:101!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0\nHardware name: linux,dummy-virt (DT)\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : usercopy_abort+0x90/0x94 mm/usercopy.c:101\nlr : usercopy_abort+0x90/0x94 mm/usercopy.c:89\nsp : ffff80000b773a20\nx29: ffff80000b773a30 x28: faff80000b745000 x27: ffff80000b773b48\nx26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000\nx23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001\nx20: 000000000000002b x19: ffff80000b75db3c x18: 00000000fffffffd\nx17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420\nx14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031\nx11: 3237313434333533 x10: 3336323937207465 x9 : 657275736f707865\nx8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830\nx5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : f7ff000028fc0000 x0 : 0000000000000064\nCall trace:\n usercopy_abort+0x90/0x94 mm/usercopy.c:89\n check_heap_object mm/usercopy.c:186 [inline]\n __check_object_size mm/usercopy.c:252 [inline]\n __check_object_size+0x198/0x36c mm/usercopy.c:214\n check_object_size include/linux/thread_info.h:199 [inline]\n check_copy_size include/linux/thread_info.h:235 [inline]\n copy_to_user include/linux/uaccess.h:159 [inline]\n bpf_prog_get_info_by_fd.isra.0+0xf14/0xfdc kernel/bpf/syscall.c:3993\n bpf_obj_get_info_by_fd+0x12c/0x510 kernel/bpf/syscall.c:4253\n __sys_bpf+0x900/0x2150 kernel/bpf/syscall.c:4956\n __do_sys_bpf kernel/bpf/syscall.c:5021 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5019 [inline]\n __arm64_sys_bpf+0x28/0x40 kernel/bpf/syscall.c:5019\n __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\n invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52\n el0_svc_common.constprop.0+0x44/0xec arch/arm64/kernel/syscall.c:142\n do_el0_svc+0xa0/0xc0 arch/arm64/kernel/syscall.c:206\n el0_svc+0x44/0xb0 arch/arm64/kernel/entry-common.c:624\n el0t_64_sync_handler+0x1ac/0x1b0 arch/arm64/kernel/entry-common.c:642\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:581\nCode: aa0003e3 d00038c0 91248000 97fff65f (d4210000)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9fad397-bfa1-44ae-8980-968674fcdc66",
      "id": "CVE-2021-3653",
      "description": "A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the \"int_ctl\" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76a01464-e1f7-4890-a745-6c72246781dc",
      "id": "CVE-2021-47158",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: add error handling in sja1105_setup()\n\nIf any of sja1105_static_config_load(), sja1105_clocking_setup() or\nsja1105_devlink_setup() fails, we can't just return in the middle of\nsja1105_setup() or memory will leak. Add a cleanup path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83a288ef-980a-4c30-a2de-6c70de208fa0",
      "id": "CVE-2022-47518",
      "description": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82590c6e-c295-4e2b-afe2-affc94173170",
      "id": "CVE-2022-48636",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup\n\nFix Oops in dasd_alias_get_start_dev() function caused by the pavgroup\npointer being NULL.\n\nThe pavgroup pointer is checked on the entrance of the function but\nwithout the lcu-\u003elock being held. Therefore there is a race window\nbetween dasd_alias_get_start_dev() and _lcu_update() which sets\npavgroup to NULL with the lcu-\u003elock held.\n\nFix by checking the pavgroup pointer with lcu-\u003elock held.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "533be0da-ceb9-4e17-8471-aabffaa1d8a9",
      "id": "CVE-2022-49845",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: j1939_send_one(): fix missing CAN header initialization\n\nThe read access to struct canxl_frame::len inside of a j1939 created\nskbuff revealed a missing initialization of reserved and later filled\nelements in struct can_frame.\n\nThis patch initializes the 8 byte CAN header with zero.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26b1bfef-cafd-423f-aa7d-c2d92678ca61",
      "id": "CVE-2022-48911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n  The sock_hold() side seems suspect, because there is no guarantee\n  that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror.  The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cc4b749-45ea-41c3-b1a7-59911a4688ce",
      "id": "CVE-2022-48920",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: get rid of warning on transaction commit when using flushoncommit\n\nWhen using the flushoncommit mount option, during almost every transaction\ncommit we trigger a warning from __writeback_inodes_sb_nr():\n\n  $ cat fs/fs-writeback.c:\n  (...)\n  static void __writeback_inodes_sb_nr(struct super_block *sb, ...\n  {\n        (...)\n        WARN_ON(!rwsem_is_locked(\u0026sb-\u003es_umount));\n        (...)\n  }\n  (...)\n\nThe trace produced in dmesg looks like the following:\n\n  [947.473890] WARNING: CPU: 5 PID: 930 at fs/fs-writeback.c:2610 __writeback_inodes_sb_nr+0x7e/0xb3\n  [947.481623] Modules linked in: nfsd nls_cp437 cifs asn1_decoder cifs_arc4 fscache cifs_md4 ipmi_ssif\n  [947.489571] CPU: 5 PID: 930 Comm: btrfs-transacti Not tainted 95.16.3-srb-asrock-00001-g36437ad63879 #186\n  [947.497969] RIP: 0010:__writeback_inodes_sb_nr+0x7e/0xb3\n  [947.502097] Code: 24 10 4c 89 44 24 18 c6 (...)\n  [947.519760] RSP: 0018:ffffc90000777e10 EFLAGS: 00010246\n  [947.523818] RAX: 0000000000000000 RBX: 0000000000963300 RCX: 0000000000000000\n  [947.529765] RDX: 0000000000000000 RSI: 000000000000fa51 RDI: ffffc90000777e50\n  [947.535740] RBP: ffff888101628a90 R08: ffff888100955800 R09: ffff888100956000\n  [947.541701] R10: 0000000000000002 R11: 0000000000000001 R12: ffff888100963488\n  [947.547645] R13: ffff888100963000 R14: ffff888112fb7200 R15: ffff888100963460\n  [947.553621] FS:  0000000000000000(0000) GS:ffff88841fd40000(0000) knlGS:0000000000000000\n  [947.560537] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [947.565122] CR2: 0000000008be50c4 CR3: 000000000220c000 CR4: 00000000001006e0\n  [947.571072] Call Trace:\n  [947.572354]  \u003cTASK\u003e\n  [947.573266]  btrfs_commit_transaction+0x1f1/0x998\n  [947.576785]  ? start_transaction+0x3ab/0x44e\n  [947.579867]  ? schedule_timeout+0x8a/0xdd\n  [947.582716]  transaction_kthread+0xe9/0x156\n  [947.585721]  ? btrfs_cleanup_transaction.isra.0+0x407/0x407\n  [947.590104]  kthread+0x131/0x139\n  [947.592168]  ? set_kthread_struct+0x32/0x32\n  [947.595174]  ret_from_fork+0x22/0x30\n  [947.597561]  \u003c/TASK\u003e\n  [947.598553] ---[ end trace 644721052755541c ]---\n\nThis is because we started using writeback_inodes_sb() to flush delalloc\nwhen committing a transaction (when using -o flushoncommit), in order to\navoid deadlocks with filesystem freeze operations. This change was made\nby commit ce8ea7cc6eb313 (\"btrfs: don't call btrfs_start_delalloc_roots\nin flushoncommit\"). After that change we started producing that warning,\nand every now and then a user reports this since the warning happens too\noften, it spams dmesg/syslog, and a user is unsure if this reflects any\nproblem that might compromise the filesystem's reliability.\n\nWe can not just lock the sb-\u003es_umount semaphore before calling\nwriteback_inodes_sb(), because that would at least deadlock with\nfilesystem freezing, since at fs/super.c:freeze_super() sync_filesystem()\nis called while we are holding that semaphore in write mode, and that can\ntrigger a transaction commit, resulting in a deadlock. It would also\ntrigger the same type of deadlock in the unmount path. Possibly, it could\nalso introduce some other locking dependencies that lockdep would report.\n\nTo fix this call try_to_writeback_inodes_sb() instead of\nwriteback_inodes_sb(), because that will try to read lock sb-\u003es_umount\nand then will only call writeback_inodes_sb() if it was able to lock it.\nThis is fine because the cases where it can't read lock sb-\u003es_umount\nare during a filesystem unmount or during a filesystem freeze - in those\ncases sb-\u003es_umount is write locked and sync_filesystem() is called, which\ncalls writeback_inodes_sb(). In other words, in all cases where we can't\ntake a read lock on sb-\u003es_umount, writeback is already being triggered\nelsewhere.\n\nAn alternative would be to call btrfs_start_delalloc_roots() with a\nnumber of pages different from LONG_MAX, for example matching the number\nof delalloc bytes we currently have, in \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cf2e159-1061-4cfe-84ba-d732d17479ae",
      "id": "CVE-2022-49086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix leak of nested actions\n\nWhile parsing user-provided actions, openvswitch module may dynamically\nallocate memory and store pointers in the internal copy of the actions.\nSo this memory has to be freed while destroying the actions.\n\nCurrently there are only two such actions: ct() and set().  However,\nthere are many actions that can hold nested lists of actions and\novs_nla_free_flow_actions() just jumps over them leaking the memory.\n\nFor example, removal of the flow with the following actions will lead\nto a leak of the memory allocated by nf_ct_tmpl_alloc():\n\n  actions:clone(ct(commit),0)\n\nNon-freed set() action may also leak the 'dst' structure for the\ntunnel info including device references.\n\nUnder certain conditions with a high rate of flow rotation that may\ncause significant memory leak problem (2MB per second in reporter's\ncase).  The problem is also hard to mitigate, because the user doesn't\nhave direct control over the datapath flows generated by OVS.\n\nFix that by iterating over all the nested actions and freeing\neverything that needs to be freed recursively.\n\nNew build time assertion should protect us from this problem if new\nactions will be added in the future.\n\nUnfortunately, openvswitch module doesn't use NLA_F_NESTED, so all\nattributes has to be explicitly checked.  sample() and clone() actions\nare mixing extra attributes into the user-provided action list.  That\nprevents some code generalization too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71b5e06f-e017-4d3b-8e35-e1e6e2ff6b1d",
      "id": "CVE-2023-53096",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: fix mem leak when freeing nodes\n\nThe node link array is allocated when adding links to a node but is not\ndeallocated when nodes are destroyed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ca281e35-225b-4d78-b50f-3d84e7783c54",
      "id": "CVE-2022-49421",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup\n\nof_parse_phandle() returns a node pointer with refcount incremented, we should\nuse of_node_put() on it when not need anymore.  Add missing of_node_put() to\navoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7dc2da3f-723d-4c19-88aa-5a5ef01670b3",
      "id": "CVE-2022-49814",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: close race conditions on sk_receive_queue\n\nsk-\u003esk_receive_queue is protected by skb queue lock, but for KCM\nsockets its RX path takes mux-\u003erx_lock to protect more than just\nskb queue. However, kcm_recvmsg() still only grabs the skb queue\nlock, so race conditions still exist.\n\nWe can teach kcm_recvmsg() to grab mux-\u003erx_lock too but this would\nintroduce a potential performance regression as struct kcm_mux can\nbe shared by multiple KCM sockets.\n\nSo we have to enforce skb queue lock in requeue_rx_msgs() and handle\nskb peek case carefully in kcm_wait_data(). Fortunately,\nskb_recv_datagram() already handles it nicely and is widely used by\nother sockets, we can just switch to skb_recv_datagram() after\ngetting rid of the unnecessary sock lock in kcm_recvmsg() and\nkcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets,\nso it is safe to get rid of this check too.\n\nI ran the original syzbot reproducer for 30 min without seeing any\nissue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e679819-d9fb-4314-be04-8743bb6d0e49",
      "id": "CVE-2022-49824",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-transport: fix error handling in ata_tlink_add()\n\nIn ata_tlink_add(), the return value of transport_add_device() is\nnot checked. As a result, it causes null-ptr-deref while removing\nthe module, because transport_remove_device() is called to remove\nthe device that was not added.\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000000000000d0\nCPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc3+ #12\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : device_del+0x48/0x39c\nlr : device_del+0x44/0x39c\nCall trace:\n device_del+0x48/0x39c\n attribute_container_class_device_del+0x28/0x40\n transport_remove_classdev+0x60/0x7c\n attribute_container_device_trigger+0x118/0x120\n transport_remove_device+0x20/0x30\n ata_tlink_delete+0x88/0xb0 [libata]\n ata_tport_delete+0x2c/0x60 [libata]\n ata_port_detach+0x148/0x1b0 [libata]\n ata_pci_remove_one+0x50/0x80 [libata]\n ahci_remove_one+0x4c/0x8c [ahci]\n\nFix this by checking and handling return value of transport_add_device()\nin ata_tlink_add().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0fdb59da-0d68-4bdd-89f5-2b2e5ceff92c",
      "id": "CVE-2022-50029",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: ipq8074: dont disable gcc_sleep_clk_src\n\nOnce the usb sleep clocks are disabled, clock framework is trying to\ndisable the sleep clock source also.\n\nHowever, it seems that it cannot be disabled and trying to do so produces:\n[  245.436390] ------------[ cut here ]------------\n[  245.441233] gcc_sleep_clk_src status stuck at 'on'\n[  245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140\n[  245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio\n[  245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215\n[  245.463889] Hardware name: Xiaomi AX9000 (DT)\n[  245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  245.474307] pc : clk_branch_wait+0x130/0x140\n[  245.481073] lr : clk_branch_wait+0x130/0x140\n[  245.485588] sp : ffffffc009f2bad0\n[  245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000\n[  245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20\n[  245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0\n[  245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7\n[  245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777\n[  245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129\n[  245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001\n[  245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001\n[  245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027\n[  245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026\n[  245.557122] Call trace:\n[  245.564229]  clk_branch_wait+0x130/0x140\n[  245.566490]  clk_branch2_disable+0x2c/0x40\n[  245.570656]  clk_core_disable+0x60/0xb0\n[  245.574561]  clk_core_disable+0x68/0xb0\n[  245.578293]  clk_disable+0x30/0x50\n[  245.582113]  dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom]\n[  245.585588]  platform_remove+0x28/0x60\n[  245.590361]  device_remove+0x4c/0x80\n[  245.594179]  device_release_driver_internal+0x1dc/0x230\n[  245.597914]  device_driver_detach+0x18/0x30\n[  245.602861]  unbind_store+0xec/0x110\n[  245.607027]  drv_attr_store+0x24/0x40\n[  245.610847]  sysfs_kf_write+0x44/0x60\n[  245.614405]  kernfs_fop_write_iter+0x128/0x1c0\n[  245.618052]  new_sync_write+0xc0/0x130\n[  245.622391]  vfs_write+0x1d4/0x2a0\n[  245.626123]  ksys_write+0x58/0xe0\n[  245.629508]  __arm64_sys_write+0x1c/0x30\n[  245.632895]  invoke_syscall.constprop.0+0x5c/0x110\n[  245.636890]  do_el0_svc+0xa0/0x150\n[  245.641488]  el0_svc+0x18/0x60\n[  245.644872]  el0t_64_sync_handler+0xa4/0x130\n[  245.647914]  el0t_64_sync+0x174/0x178\n[  245.652340] ---[ end trace 0000000000000000 ]---\n\nSo, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try\nto disable the sleep clock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eaa9e1e8-3ee0-4c61-88bb-db960f0fe712",
      "id": "CVE-2022-50065",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: fix memory leak inside XPD_TX with mergeable\n\nWhen we call xdp_convert_buff_to_frame() to get xdpf, if it returns\nNULL, we should check if xdp_page was allocated by xdp_linearize_page().\nIf it is newly allocated, it should be freed here alone. Just like any\nother \"goto err_xdp\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12eb2e5a-c5b3-44e0-ad59-bc81e7858582",
      "id": "CVE-2022-49998",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix locking in rxrpc's sendmsg\n\nFix three bugs in the rxrpc's sendmsg implementation:\n\n (1) rxrpc_new_client_call() should release the socket lock when returning\n     an error from rxrpc_get_call_slot().\n\n (2) rxrpc_wait_for_tx_window_intr() will return without the call mutex\n     held in the event that we're interrupted by a signal whilst waiting\n     for tx space on the socket or relocking the call mutex afterwards.\n\n     Fix this by: (a) moving the unlock/lock of the call mutex up to\n     rxrpc_send_data() such that the lock is not held around all of\n     rxrpc_wait_for_tx_window*() and (b) indicating to higher callers\n     whether we're return with the lock dropped.  Note that this means\n     recvmsg() will not block on this call whilst we're waiting.\n\n (3) After dropping and regaining the call mutex, rxrpc_send_data() needs\n     to go and recheck the state of the tx_pending buffer and the\n     tx_total_len check in case we raced with another sendmsg() on the same\n     call.\n\nThinking on this some more, it might make sense to have different locks for\nsendmsg() and recvmsg().  There's probably no need to make recvmsg() wait\nfor sendmsg().  It does mean that recvmsg() can return MSG_EOR indicating\nthat a call is dead before a sendmsg() to that call returns - but that can\ncurrently happen anyway.\n\nWithout fix (2), something like the following can be induced:\n\n\tWARNING: bad unlock balance detected!\n\t5.16.0-rc6-syzkaller #0 Not tainted\n\t-------------------------------------\n\tsyz-executor011/3597 is trying to release lock (\u0026call-\u003euser_mutex) at:\n\t[\u003cffffffff885163a3\u003e] rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748\n\tbut there are no more locks to release!\n\n\tother info that might help us debug this:\n\tno locks held by syz-executor011/3597.\n\t...\n\tCall Trace:\n\t \u003cTASK\u003e\n\t __dump_stack lib/dump_stack.c:88 [inline]\n\t dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n\t print_unlock_imbalance_bug include/trace/events/lock.h:58 [inline]\n\t __lock_release kernel/locking/lockdep.c:5306 [inline]\n\t lock_release.cold+0x49/0x4e kernel/locking/lockdep.c:5657\n\t __mutex_unlock_slowpath+0x99/0x5e0 kernel/locking/mutex.c:900\n\t rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748\n\t rxrpc_sendmsg+0x420/0x630 net/rxrpc/af_rxrpc.c:561\n\t sock_sendmsg_nosec net/socket.c:704 [inline]\n\t sock_sendmsg+0xcf/0x120 net/socket.c:724\n\t ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n\t ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n\t __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n\t do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n\t do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n\t entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n[Thanks to Hawkins Jiawei and Khalid Masum for their attempts to fix this]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c208f0e-70c3-4d64-9ab0-cd717b385a08",
      "id": "CVE-2022-50203",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: OMAP2+: display: Fix refcount leak bug\n\nIn omapdss_init_fbdev(), of_find_node_by_name() will return a node\npointer with refcount incremented. We should use of_node_put() when\nit is not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4a1541a8-b9cd-4bdc-99e0-e3db931f6f18",
      "id": "CVE-2022-50204",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: OMAP2+: pdata-quirks: Fix refcount leak bug\n\nIn pdata_quirks_init_clocks(), the loop contains\nof_find_node_by_name() but without corresponding of_node_put().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33575257-fff6-4ded-ae3d-d97d656919f3",
      "id": "CVE-2022-50348",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Fix a memory leak in an error handling path\n\nIf this memdup_user() call fails, the memory allocated in a previous call\na few lines above should be freed. Otherwise it leaks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92aa96ac-ddda-4075-9165-e8c056f9a069",
      "id": "CVE-2023-2008",
      "description": "A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6dcd4b4-bfe7-4223-994f-55943c66f58b",
      "id": "CVE-2023-53239",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/mdp5: Add check for kzalloc\n\nAs kzalloc may fail and return NULL pointer,\nit should be better to check the return value\nin order to avoid the NULL pointer dereference.\n\nPatchwork: https://patchwork.freedesktop.org/patch/514154/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f9af948-9b9e-40f5-aebc-d7d1203b2f51",
      "id": "CVE-2023-52464",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/thunderx: Fix possible out-of-bounds string access\n\nEnabling -Wstringop-overflow globally exposes a warning for a common bug\nin the usage of strncat():\n\n  drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':\n  drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]\n   1136 |                 strncat(msg, other, OCX_MESSAGE_SIZE);\n        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n   ...\n   1145 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);\n   ...\n   1150 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);\n\n   ...\n\nApparently the author of this driver expected strncat() to behave the\nway that strlcat() does, which uses the size of the destination buffer\nas its third argument rather than the length of the source buffer. The\nresult is that there is no check on the size of the allocated buffer.\n\nChange it to strlcat().\n\n  [ bp: Trim compiler output, fixup commit message. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "716f02c9-676e-4a37-8028-2cfde1d69a7b",
      "id": "CVE-2023-52469",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/amd/pm: fix a use-after-free in kv_parse_power_table\n\nWhen ps allocated by kzalloc equals to NULL, kv_parse_power_table\nfrees adev-\u003epm.dpm.ps that allocated before. However, after the control\nflow goes through the following call chains:\n\nkv_parse_power_table\n  |-\u003e kv_dpm_init\n        |-\u003e kv_dpm_sw_init\n\t      |-\u003e kv_dpm_fini\n\nThe adev-\u003epm.dpm.ps is used in the for loop of kv_dpm_fini after its\nfirst free in kv_parse_power_table and causes a use-after-free bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07d9c8f1-9237-4047-a580-3609f101fe2c",
      "id": "CVE-2023-52799",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in dbFindLeaf\n\nCurrently while searching for dmtree_t for sufficient free blocks there\nis an array out of bounds while getting element in tp-\u003edm_stree. To add\nthe required check for out of bound we first need to determine the type\nof dmtree. Thus added an extra parameter to dbFindLeaf so that the type\nof tree can be determined and the required check can be applied.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b431a8b-deeb-4003-85fe-9b60dc77e483",
      "id": "CVE-2023-52878",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds\n\nIf the \"struct can_priv::echoo_skb\" is accessed out of bounds, this\nwould cause a kernel crash. Instead, issue a meaningful warning\nmessage and return with an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5f2b316-3628-4eb5-abaa-66e304046495",
      "id": "CVE-2023-52921",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix possible UAF in amdgpu_cs_pass1()\n\nSince the gang_size check is outside of chunk parsing\nloop, we need to reset i before we free the chunk data.\n\nSuggested by Ye Zhang (@VAR10CK) of Baidu Security.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe3d71bf-dd6d-4976-92e2-9ca4ecc7b7db",
      "id": "CVE-2023-53000",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: prevent potential spectre v1 gadgets\n\nMost netlink attributes are parsed and validated from\n__nla_validate_parse() or validate_nla()\n\n    u16 type = nla_type(nla);\n\n    if (type == 0 || type \u003e maxtype) {\n        /* error or continue */\n    }\n\n@type is then used as an array index and can be used\nas a Spectre v1 gadget.\n\narray_index_nospec() can be used to prevent leaking\ncontent of kernel memory to malicious users.\n\nThis should take care of vast majority of netlink uses,\nbut an audit is needed to take care of others where\nvalidation is not yet centralized in core netlink functions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38eea54c-6621-4235-926d-c67b3163e3a2",
      "id": "CVE-2023-53416",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: isp1362: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b17bbbb-032c-4fda-823a-c15fe7198f8c",
      "id": "CVE-2024-26606",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: signal epoll threads of self-work\n\nIn (e)poll mode, threads often depend on I/O events to determine when\ndata is ready for consumption. Within binder, a thread may initiate a\ncommand via BINDER_WRITE_READ without a read buffer and then make use\nof epoll_wait() or similar to consume any responses afterwards.\n\nIt is then crucial that epoll threads are signaled via wakeup when they\nqueue their own work. Otherwise, they risk waiting indefinitely for an\nevent leaving their work unhandled. What is worse, subsequent commands\nwon't trigger a wakeup either as the thread has pending work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99a11cb6-2bdd-476b-be83-1132566700b7",
      "id": "CVE-2024-26684",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac: fix handling of DPP safety error for DMA channels\n\nCommit 56e58d6c8a56 (\"net: stmmac: Implement Safety Features in\nXGMAC core\") checks and reports safety errors, but leaves the\nData Path Parity Errors for each channel in DMA unhandled at all, lead to\na storm of interrupt.\nFix it by checking and clearing the DMA_DPP_Interrupt_Status register.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "05d0eda2-6747-4efd-84bc-5e424ae39942",
      "id": "CVE-2024-26878",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix potential NULL pointer dereference\n\nBelow race may cause NULL pointer dereference\n\nP1\t\t\t\t\tP2\ndquot_free_inode\t\t\tquota_off\n\t\t\t\t\t  drop_dquot_ref\n\t\t\t\t\t   remove_dquot_ref\n\t\t\t\t\t   dquots = i_dquot(inode)\n  dquots = i_dquot(inode)\n  srcu_read_lock\n  dquots[cnt]) != NULL (1)\n\t\t\t\t\t     dquots[type] = NULL (2)\n  spin_lock(\u0026dquots[cnt]-\u003edq_dqb_lock) (3)\n   ....\n\nIf dquot_free_inode(or other routines) checks inode's quota pointers (1)\nbefore quota_off sets it to NULL(2) and use it (3) after that, NULL pointer\ndereference will be triggered.\n\nSo let's fix it by using a temporary pointer to avoid this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f6048dd-debc-4b9d-aa88-96a7beac35cb",
      "id": "CVE-2024-38549",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Add 0 size check to mtk_drm_gem_obj\n\nAdd a check to mtk_drm_gem_init if we attempt to allocate a GEM object\nof 0 bytes. Currently, no such check exists and the kernel will panic if\na userspace application attempts to allocate a 0x0 GBM buffer.\n\nTested by attempting to allocate a 0x0 GBM buffer on an MT8188 and\nverifying that we now return EINVAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87e9f954-aa70-4ff0-a800-8528efd27418",
      "id": "CVE-2024-40902",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: xattr: fix buffer overflow for invalid xattr\n\nWhen an xattr size is not what is expected, it is printed out to the\nkernel log in hex format as a form of debugging.  But when that xattr\nsize is bigger than the expected size, printing it out can cause an\naccess off the end of the buffer.\n\nFix this all up by properly restricting the size of the debug hex dump\nin the kernel log.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfcb52ad-0a79-4902-9dc3-7f943298f6d5",
      "id": "CVE-2024-41093",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: avoid using null object of framebuffer\n\nInstead of using state-\u003efb-\u003eobj[0] directly, get object from framebuffer\nby calling drm_gem_fb_get_obj() and return error code when object is\nnull to avoid using null object of framebuffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f074b64-8419-4894-9e37-1153261e02d4",
      "id": "CVE-2024-42309",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes\n\nIn psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "379980bd-8b2b-401e-bce4-409fc6291a4c",
      "id": "CVE-2024-43913",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: apple: fix device reference counting\n\nDrivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl.\nSplit the allocation side out to make the error handling boundary easier\nto navigate. The apple driver had been doing this wrong, leaking the\ncontroller device memory on a tagset failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93ccb2dc-0f1c-494e-9893-1d0c8b5d0583",
      "id": "CVE-2024-46702",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Mark XDomain as unplugged when router is removed\n\nI noticed that when we do discrete host router NVM upgrade and it gets\nhot-removed from the PCIe side as a result of NVM firmware authentication,\nif there is another host connected with enabled paths we hang in tearing\nthem down. This is due to fact that the Thunderbolt networking driver\nalso tries to cleanup the paths and ends up blocking in\ntb_disconnect_xdomain_paths() waiting for the domain lock.\n\nHowever, at this point we already cleaned the paths in tb_stop() so\nthere is really no need for tb_disconnect_xdomain_paths() to do that\nanymore. Furthermore it already checks if the XDomain is unplugged and\nbails out early so take advantage of that and mark the XDomain as\nunplugged when we remove the parent router.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6571bacf-baf7-471b-9940-4e80c5ec514e",
      "id": "CVE-2024-46804",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add array index check for hdcp ddc access\n\n[Why]\nCoverity reports OVERRUN warning. Do not check if array\nindex valid.\n\n[How]\nCheck msg_id valid and valid array index.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eead1793-4a31-4196-9d8d-acf5b26be5f9",
      "id": "CVE-2024-40997",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate: fix memory leak on CPU EPP exit\n\nThe cpudata memory from kzalloc() in amd_pstate_epp_cpu_init() is\nnot freed in the analogous exit function, so fix that.\n\n[ rjw: Subject and changelog edits ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3555cea-4d35-4b67-b8f3-830c409edf95",
      "id": "CVE-2024-50086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix user-after-free from session log off\n\nThere is racy issue between smb2 session log off and smb2 session setup.\nIt will cause user-after-free from session log off.\nThis add session_lock when setting SMB2_SESSION_EXPIRED and referece\ncount to session struct not to free session while it is being used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ecf12587-5249-4b49-835c-558402b9cf96",
      "id": "CVE-2024-50091",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm vdo: don't refer to dedupe_context after releasing it\n\nClear the dedupe_context pointer in a data_vio whenever ownership of\nthe context is lost, so that vdo can't examine it accidentally.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c0c58fc-e791-4294-bac9-9bb825ef80f3",
      "id": "CVE-2024-50135",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix race condition between reset and nvme_dev_disable()\n\nnvme_dev_disable() modifies the dev-\u003eonline_queues field, therefore\nnvme_pci_update_nr_queues() should avoid racing against it, otherwise\nwe could end up passing invalid values to blk_mq_update_nr_hw_queues().\n\n WARNING: CPU: 39 PID: 61303 at drivers/pci/msi/api.c:347\n          pci_irq_get_affinity+0x187/0x210\n Workqueue: nvme-reset-wq nvme_reset_work [nvme]\n RIP: 0010:pci_irq_get_affinity+0x187/0x210\n Call Trace:\n  \u003cTASK\u003e\n  ? blk_mq_pci_map_queues+0x87/0x3c0\n  ? pci_irq_get_affinity+0x187/0x210\n  blk_mq_pci_map_queues+0x87/0x3c0\n  nvme_pci_map_queues+0x189/0x460 [nvme]\n  blk_mq_update_nr_hw_queues+0x2a/0x40\n  nvme_reset_work+0x1be/0x2a0 [nvme]\n\nFix the bug by locking the shutdown_lock mutex before using\ndev-\u003eonline_queues. Give up if nvme_dev_disable() is running or if\nit has been executed already.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87ae84c1-e243-458b-a9de-89aba8aaed5e",
      "id": "CVE-2024-50267",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_edgeport: fix use after free in debug printk\n\nThe \"dev_dbg(\u0026urb-\u003edev-\u003edev, ...\" which happens after usb_free_urb(urb)\nis a use after free of the \"urb\" pointer.  Store the \"dev\" pointer at the\nstart of the function to avoid this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76c0e3f7-26ff-4c9c-8897-faf50eacac9f",
      "id": "CVE-2024-56576",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: tc358743: Fix crash in the probe error path when using polling\n\nIf an error occurs in the probe() function, we should remove the polling\ntimer that was alarmed earlier, otherwise the timer is called with\narguments that are already freed, which results in a crash.\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268\nModules linked in:\nCPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226\nHardware name: Diasom DS-RK3568-SOM-EVB (DT)\npstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __run_timers+0x244/0x268\nlr : __run_timers+0x1d4/0x268\nsp : ffffff80eff2baf0\nx29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00\nx26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00\nx23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000\nx20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff\nx17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e\nx14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000\nx11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009\nx8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480\nx5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240\nx2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0\nCall trace:\n __run_timers+0x244/0x268\n timer_expire_remote+0x50/0x68\n tmigr_handle_remote+0x388/0x39c\n run_timer_softirq+0x38/0x44\n handle_softirqs+0x138/0x298\n __do_softirq+0x14/0x20\n ____do_softirq+0x10/0x1c\n call_on_irq_stack+0x24/0x4c\n do_softirq_own_stack+0x1c/0x2c\n irq_exit_rcu+0x9c/0xcc\n el1_interrupt+0x48/0xc0\n el1h_64_irq_handler+0x18/0x24\n el1h_64_irq+0x7c/0x80\n default_idle_call+0x34/0x68\n do_idle+0x23c/0x294\n cpu_startup_entry+0x38/0x3c\n secondary_start_kernel+0x128/0x160\n __secondary_switched+0xb8/0xbc\n---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7eb5f61-055f-48b1-bd88-e81f952185b5",
      "id": "CVE-2024-56640",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix LGR and link use-after-free issue\n\nWe encountered a LGR/link use-after-free issue, which manifested as\nthe LGR/link refcnt reaching 0 early and entering the clear process,\nmaking resource access unsafe.\n\n refcount_t: addition on 0; use-after-free.\n WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140\n Workqueue: events smc_lgr_terminate_work [smc]\n Call trace:\n  refcount_warn_saturate+0x9c/0x140\n  __smc_lgr_terminate.part.45+0x2a8/0x370 [smc]\n  smc_lgr_terminate_work+0x28/0x30 [smc]\n  process_one_work+0x1b8/0x420\n  worker_thread+0x158/0x510\n  kthread+0x114/0x118\n\nor\n\n refcount_t: underflow; use-after-free.\n WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140\n Workqueue: smc_hs_wq smc_listen_work [smc]\n Call trace:\n  refcount_warn_saturate+0xf0/0x140\n  smcr_link_put+0x1cc/0x1d8 [smc]\n  smc_conn_free+0x110/0x1b0 [smc]\n  smc_conn_abort+0x50/0x60 [smc]\n  smc_listen_find_device+0x75c/0x790 [smc]\n  smc_listen_work+0x368/0x8a0 [smc]\n  process_one_work+0x1b8/0x420\n  worker_thread+0x158/0x510\n  kthread+0x114/0x118\n\nIt is caused by repeated release of LGR/link refcnt. One suspect is that\nsmc_conn_free() is called repeatedly because some smc_conn_free() from\nserver listening path are not protected by sock lock.\n\ne.g.\n\nCalls under socklock        | smc_listen_work\n-------------------------------------------------------\nlock_sock(sk)               | smc_conn_abort\nsmc_conn_free               | \\- smc_conn_free\n\\- smcr_link_put            |    \\- smcr_link_put (duplicated)\nrelease_sock(sk)\n\nSo here add sock lock protection in smc_listen_work() path, making it\nexclusive with other connection operations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d4e2950-bc8a-4210-b2a2-344200d33ce9",
      "id": "CVE-2024-56662",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl\n\nFix an issue detected by syzbot with KASAN:\n\nBUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/\ncore.c:416 [inline]\nBUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0\ndrivers/acpi/nfit/core.c:459\n\nThe issue occurs in cmd_to_func when the call_pkg-\u003end_reserved2\narray is accessed without verifying that call_pkg points to a buffer\nthat is appropriately sized as a struct nd_cmd_pkg. This can lead\nto out-of-bounds access and undefined behavior if the buffer does not\nhave sufficient space.\n\nTo address this, a check was added in acpi_nfit_ctl() to ensure that\nbuf is not NULL and that buf_len is less than sizeof(*call_pkg)\nbefore accessing it. This ensures safe access to the members of\ncall_pkg, including the nd_reserved2 array.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a37d11fb-ca26-49c0-b4aa-66f16a249249",
      "id": "CVE-2024-57809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: imx6: Fix suspend/resume support on i.MX6QDL\n\nThe suspend/resume functionality is currently broken on the i.MX6QDL\nplatform, as documented in the NXP errata (ERR005723):\n\n  https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf\n\nThis patch addresses the issue by sharing most of the suspend/resume\nsequences used by other i.MX devices, while avoiding modifications to\ncritical registers that disrupt the PCIe functionality. It targets the\nsame problem as the following downstream commit:\n\n  https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995\n\nUnlike the downstream commit, this patch also resets the connected PCIe\ndevice if possible. Without this reset, certain drivers, such as ath10k\nor iwlwifi, will crash on resume. The device reset is also done by the\ndriver on other i.MX platforms, making this patch consistent with\nexisting practices.\n\nUpon resuming, the kernel will hang and display an error. Here's an\nexample of the error encountered with the ath10k driver:\n\n  ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible\n  Unhandled fault: imprecise external abort (0x1406) at 0x0106f944\n\nWithout this patch, suspend/resume will fail on i.MX6QDL devices if a\nPCIe device is connected.\n\n[kwilczynski: commit log, added tag for stable releases]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13a03491-a2ad-47f3-8cdd-d6cb40504021",
      "id": "CVE-2024-57883",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: hugetlb: independent PMD page table shared count\n\nThe folio refcount may be increased unexpectly through try_get_folio() by\ncaller such as split_huge_pages.  In huge_pmd_unshare(), we use refcount\nto check whether a pmd page table is shared.  The check is incorrect if\nthe refcount is increased by the above caller, and this can cause the page\ntable leaked:\n\n BUG: Bad page state in process sh  pfn:109324\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324\n flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff)\n page_type: f2(table)\n raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000\n raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000\n page dumped because: nonzero mapcount\n ...\n CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G    B              6.13.0-rc2master+ #7\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n Call trace:\n  show_stack+0x20/0x38 (C)\n  dump_stack_lvl+0x80/0xf8\n  dump_stack+0x18/0x28\n  bad_page+0x8c/0x130\n  free_page_is_bad_report+0xa4/0xb0\n  free_unref_page+0x3cc/0x620\n  __folio_put+0xf4/0x158\n  split_huge_pages_all+0x1e0/0x3e8\n  split_huge_pages_write+0x25c/0x2d8\n  full_proxy_write+0x64/0xd8\n  vfs_write+0xcc/0x280\n  ksys_write+0x70/0x110\n  __arm64_sys_write+0x24/0x38\n  invoke_syscall+0x50/0x120\n  el0_svc_common.constprop.0+0xc8/0xf0\n  do_el0_svc+0x24/0x38\n  el0_svc+0x34/0x128\n  el0t_64_sync_handler+0xc8/0xd0\n  el0t_64_sync+0x190/0x198\n\nThe issue may be triggered by damon, offline_page, page_idle, etc, which\nwill increase the refcount of page table.\n\n1. The page table itself will be discarded after reporting the\n   \"nonzero mapcount\".\n\n2. The HugeTLB page mapped by the page table miss freeing since we\n   treat the page table as shared and a shared page table will not be\n   unmapped.\n\nFix it by introducing independent PMD page table shared count.  As\ndescribed by comment, pt_index/pt_mm/pt_frag_refcount are used for s390\ngmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv\npmds, so we can reuse the field as pt_share_count.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6f02144-3512-4f93-b7ff-b9923675ba32",
      "id": "CVE-2025-21704",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdc-acm: Check control transfer buffer size before access\n\nIf the first fragment is shorter than struct usb_cdc_notification, we can't\ncalculate an expected_size. Log an error and discard the notification\ninstead of reading lengths from memory outside the received data, which can\nlead to memory corruption when the expected_size decreases between\nfragments, causing `expected_size - acm-\u003enb_index` to wrap.\n\nThis issue has been present since the beginning of git history; however,\nit only leads to memory corruption since commit ea2583529cd1\n(\"cdc-acm: reassemble fragmented notifications\").\n\nA mitigating factor is that acm_ctrl_irq() can only execute after userspace\nhas opened /dev/ttyACM*; but if ModemManager is running, ModemManager will\ndo that automatically depending on the USB device's vendor/product IDs and\nits other interfaces.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7dce640c-b260-4d93-ba04-77d477d20ee0",
      "id": "CVE-2025-21787",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: better TEAM_OPTION_TYPE_STRING validation\n\nsyzbot reported following splat [1]\n\nMake sure user-provided data contains one nul byte.\n\n[1]\n BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline]\n BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714\n  string_nocheck lib/vsprintf.c:633 [inline]\n  string+0x3ec/0x5f0 lib/vsprintf.c:714\n  vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843\n  __request_module+0x252/0x9f0 kernel/module/kmod.c:149\n  team_mode_get drivers/net/team/team_core.c:480 [inline]\n  team_change_mode drivers/net/team/team_core.c:607 [inline]\n  team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401\n  team_option_set drivers/net/team/team_core.c:375 [inline]\n  team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2662\n  genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n  genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n  genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210\n  netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543\n  genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219\n  netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n  netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348\n  netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892\n  sock_sendmsg_nosec net/socket.c:718 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:733\n  ____sys_sendmsg+0x877/0xb60 net/socket.c:2573\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627\n  __sys_sendmsg net/socket.c:2659 [inline]\n  __do_sys_sendmsg net/socket.c:2664 [inline]\n  __se_sys_sendmsg net/socket.c:2662 [inline]\n  __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662\n  x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74d05496-e5cb-46c8-9638-718c0d1fc17f",
      "id": "CVE-2025-21910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: regulatory: improve invalid hints checking\n\nSyzbot keeps reporting an issue [1] that occurs when erroneous symbols\nsent from userspace get through into user_alpha2[] via\nregulatory_hint_user() call. Such invalid regulatory hints should be\nrejected.\n\nWhile a sanity check from commit 47caf685a685 (\"cfg80211: regulatory:\nreject invalid hints\") looks to be enough to deter these very cases,\nthere is a way to get around it due to 2 reasons.\n\n1) The way isalpha() works, symbols other than latin lower and\nupper letters may be used to determine a country/domain.\nFor instance, greek letters will also be considered upper/lower\nletters and for such characters isalpha() will return true as well.\nHowever, ISO-3166-1 alpha2 codes should only hold latin\ncharacters.\n\n2) While processing a user regulatory request, between\nreg_process_hint_user() and regulatory_hint_user() there happens to\nbe a call to queue_regulatory_request() which modifies letters in\nrequest-\u003ealpha2[] with toupper(). This works fine for latin symbols,\nless so for weird letter characters from the second part of _ctype[].\n\nSyzbot triggers a warning in is_user_regdom_saved() by first sending\nover an unexpected non-latin letter that gets malformed by toupper()\ninto a character that ends up failing isalpha() check.\n\nPrevent this by enhancing is_an_alpha2() to ensure that incoming\nsymbols are latin letters and nothing else.\n\n[1] Syzbot report:\n------------[ cut here ]------------\nUnexpected user alpha2: A�\nWARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline]\nWARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline]\nWARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516\nModules linked in:\nCPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: events_power_efficient crda_timeout_work\nRIP: 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline]\nRIP: 0010:restore_alpha2 net/wireless/reg.c:3424 [inline]\nRIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516\n...\nCall Trace:\n \u003cTASK\u003e\n crda_timeout_work+0x27/0x50 net/wireless/reg.c:542\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f2/0x390 kernel/kthread.c:389\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd439d97-7255-4991-8b43-f873f280b7b5",
      "id": "CVE-2024-56747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()\n\nHook \"qedi_ops-\u003ecommon-\u003esb_init = qed_sb_init\" does not release the DMA\nmemory sb_virt when it fails. Add dma_free_coherent() to free it. This\nis the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89f4f57b-b0da-429d-9825-9afd9663e500",
      "id": "CVE-2025-21726",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: avoid UAF for reorder_work\n\nAlthough the previous patch can avoid ps and ps UAF for _do_serial, it\ncan not avoid potential UAF issue for reorder_work. This issue can\nhappen just as below:\n\ncrypto_request\t\t\tcrypto_request\t\tcrypto_del_alg\npadata_do_serial\n  ...\n  padata_reorder\n    // processes all remaining\n    // requests then breaks\n    while (1) {\n      if (!padata)\n        break;\n      ...\n    }\n\n\t\t\t\tpadata_do_serial\n\t\t\t\t  // new request added\n\t\t\t\t  list_add\n    // sees the new request\n    queue_work(reorder_work)\n\t\t\t\t  padata_reorder\n\t\t\t\t    queue_work_on(squeue-\u003ework)\n...\n\n\t\t\t\t\u003ckworker context\u003e\n\t\t\t\tpadata_serial_worker\n\t\t\t\t// completes new request,\n\t\t\t\t// no more outstanding\n\t\t\t\t// requests\n\n\t\t\t\t\t\t\tcrypto_del_alg\n\t\t\t\t\t\t\t  // free pd\n\n\u003ckworker context\u003e\ninvoke_padata_reorder\n  // UAF of pd\n\nTo avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work'\ninto the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9fc519ed-c1e0-4b0b-9372-6d82cd68bf1c",
      "id": "CVE-2025-37879",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/net: fix improper handling of bogus negative read/write replies\n\nIn p9_client_write() and p9_client_read_once(), if the server\nincorrectly replies with success but a negative write/read count then we\nwould consider written (negative) \u003c= rsize (positive) because both\nvariables were signed.\n\nMake variables unsigned to avoid this problem.\n\nThe reproducer linked below now fails with the following error instead\nof a null pointer deref:\n9pnet: bogus RWRITE count (4294967295 \u003e 3)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9df49b4a-c1cc-4f9c-b5e4-c2e748a63c11",
      "id": "CVE-2025-37915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: drr: Fix double list add in class with netem as child qdisc\n\nAs described in Gerrard's report [1], there are use cases where a netem\nchild qdisc will make the parent qdisc's enqueue callback reentrant.\nIn the case of drr, there won't be a UAF, but the code will add the same\nclassifier to the list twice, which will cause memory corruption.\n\nIn addition to checking for qlen being zero, this patch checks whether the\nclass was already added to the active_list (cl_is_active) before adding\nto the list to cover for the reentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2b87033-04da-4ce2-a64f-32517e940cca",
      "id": "CVE-2025-37982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wl1251: fix memory leak in wl1251_tx_work\n\nThe skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails\nwith a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ee4b0d8-dc4c-48ec-bbcd-ced1aeef930b",
      "id": "CVE-2025-38604",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: Kill URBs before clearing tx status queue\n\nIn rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing\nb_tx_status.queue. This change prevents callbacks from using already freed\nskb due to anchor was not killed before freeing such skb.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000080\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015\n RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211]\n Call Trace:\n  \u003cIRQ\u003e\n  rtl8187_tx_cb+0x116/0x150 [rtl8187]\n  __usb_hcd_giveback_urb+0x9d/0x120\n  usb_giveback_urb_bh+0xbb/0x140\n  process_one_work+0x19b/0x3c0\n  bh_worker+0x1a7/0x210\n  tasklet_action+0x10/0x30\n  handle_softirqs+0xf0/0x340\n  __irq_exit_rcu+0xcd/0xf0\n  common_interrupt+0x85/0xa0\n  \u003c/IRQ\u003e\n\nTested on RTL8187BvE device.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab48e588-9e56-49a3-9381-db32c5879d44",
      "id": "CVE-2022-49885",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()\n\nChange num_ghes from int to unsigned int, preventing an overflow\nand causing subsequent vmalloc() to fail.\n\nThe overflow happens in ghes_estatus_pool_init() when calculating\nlen during execution of the statement below as both multiplication\noperands here are signed int:\n\nlen += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE);\n\nThe following call trace is observed because of this bug:\n\n[    9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1\n[    9.317131] Call Trace:\n[    9.317134]  \u003cTASK\u003e\n[    9.317137]  dump_stack_lvl+0x49/0x5f\n[    9.317145]  dump_stack+0x10/0x12\n[    9.317146]  warn_alloc.cold+0x7b/0xdf\n[    9.317150]  ? __device_attach+0x16a/0x1b0\n[    9.317155]  __vmalloc_node_range+0x702/0x740\n[    9.317160]  ? device_add+0x17f/0x920\n[    9.317164]  ? dev_set_name+0x53/0x70\n[    9.317166]  ? platform_device_add+0xf9/0x240\n[    9.317168]  __vmalloc_node+0x49/0x50\n[    9.317170]  ? ghes_estatus_pool_init+0x43/0xa0\n[    9.317176]  vmalloc+0x21/0x30\n[    9.317177]  ghes_estatus_pool_init+0x43/0xa0\n[    9.317179]  acpi_hest_init+0x129/0x19c\n[    9.317185]  acpi_init+0x434/0x4a4\n[    9.317188]  ? acpi_sleep_proc_init+0x2a/0x2a\n[    9.317190]  do_one_initcall+0x48/0x200\n[    9.317195]  kernel_init_freeable+0x221/0x284\n[    9.317200]  ? rest_init+0xe0/0xe0\n[    9.317204]  kernel_init+0x1a/0x130\n[    9.317205]  ret_from_fork+0x22/0x30\n[    9.317208]  \u003c/TASK\u003e\n\n[ rjw: Subject and changelog edits ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f6dfc952-e6e5-4c41-8ee4-1826c4cf4bdb",
      "id": "CVE-2025-38617",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix a race in packet_set_ring() and packet_notifier()\n\nWhen packet_set_ring() releases po-\u003ebind_lock, another thread can\nrun packet_notifier() and process an NETDEV_UP event.\n\nThis race and the fix are both similar to that of commit 15fe076edea7\n(\"net/packet: fix a race in packet_bind() and packet_notifier()\").\n\nThere too the packet_notifier NETDEV_UP event managed to run while a\npo-\u003ebind_lock critical section had to be temporarily released. And\nthe fix was similarly to temporarily set po-\u003enum to zero to keep\nthe socket unhooked until the lock is retaken.\n\nThe po-\u003ebind_lock in packet_set_ring and packet_notifier precede the\nintroduction of git history.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7792d7e-c476-4588-830c-6a84ad3d16d5",
      "id": "CVE-2025-38622",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: drop UFO packets in udp_rcv_segment()\n\nWhen sending a packet with virtio_net_hdr to tun device, if the gso_type\nin virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr\nsize, below crash may happen.\n\n  ------------[ cut here ]------------\n  kernel BUG at net/core/skbuff.c:4572!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  RIP: 0010:skb_pull_rcsum+0x8e/0xa0\n  Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc \u003c0f\u003e 0b 0f 0b 66 66 2e 0f 1f 84 00 000\n  RSP: 0018:ffffc900001fba38 EFLAGS: 00000297\n  RAX: 0000000000000004 RBX: ffff8880040c1000 RCX: ffffc900001fb948\n  RDX: ffff888003e6d700 RSI: 0000000000000008 RDI: ffff88800411a062\n  RBP: ffff8880040c1000 R08: 0000000000000000 R09: 0000000000000001\n  R10: ffff888003606c00 R11: 0000000000000001 R12: 0000000000000000\n  R13: ffff888004060900 R14: ffff888004050000 R15: ffff888004060900\n  FS:  000000002406d3c0(0000) GS:ffff888084a19000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000020000040 CR3: 0000000004007000 CR4: 00000000000006f0\n  Call Trace:\n   \u003cTASK\u003e\n   udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445\n   udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475\n   udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626\n   __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690\n   ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205\n   ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233\n   ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579\n   ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636\n   ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670\n   __netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067\n   netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210\n   napi_complete_done+0x78/0x180 net/core/dev.c:6580\n   tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909\n   tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984\n   vfs_write+0x300/0x420 fs/read_write.c:593\n   ksys_write+0x60/0xd0 fs/read_write.c:686\n   do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63\n   \u003c/TASK\u003e\n\nTo trigger gso segment in udp_queue_rcv_skb(), we should also set option\nUDP_ENCAP_ESPINUDP to enable udp_sk(sk)-\u003eencap_rcv. When the encap_rcv\nhook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try\nto pull udphdr, but the skb size has been segmented to gso size, which\nleads to this crash.\n\nPrevious commit cf329aa42b66 (\"udp: cope with UDP GRO packet misdirection\")\nintroduces segmentation in UDP receive path only for GRO, which was never\nintended to be used for UFO, so drop UFO packets in udp_rcv_segment().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc3b7a39-7239-4d7c-9ba7-56885e6865d8",
      "id": "CVE-2025-38710",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Validate i_depth for exhash directories\n\nA fuzzer test introduced corruption that ends up with a depth of 0 in\ndir_e_read(), causing an undefined shift by 32 at:\n\n  index = hash \u003e\u003e (32 - dip-\u003ei_depth);\n\nAs calculated in an open-coded way in dir_make_exhash(), the minimum\ndepth for an exhash directory is ilog2(sdp-\u003esd_hash_ptrs) and 0 is\ninvalid as sdp-\u003esd_hash_ptrs is fixed as sdp-\u003ebsize / 16 at mount time.\n\nSo we can avoid the undefined behaviour by checking for depth values\nlower than the minimum in gfs2_dinode_in(). Values greater than the\nmaximum are already being checked for there.\n\nAlso switch the calculation in dir_make_exhash() to use ilog2() to\nclarify how the depth is calculated.\n\nTested with the syzkaller repro.c and xfstests '-g quick'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97918bc3-2abd-4da0-861d-d724ddb152d1",
      "id": "CVE-2020-12656",
      "description": "gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ce8167b-ccc5-45f0-bb9a-8616dbbcf44a",
      "id": "CVE-2020-28097",
      "description": "The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2404a9f5-4001-40c0-a9b9-6245e2d5a9fa",
      "id": "CVE-2021-45469",
      "description": "In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "338f7ddd-e8af-4869-a22e-e44ca41ede0c",
      "id": "CVE-2021-46955",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\n\nrunning openvswitch on kernels built with KASAN, it's possible to see the\nfollowing splat while testing fragmentation of IPv4 packets:\n\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\n\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n Call Trace:\n  dump_stack+0x92/0xc1\n  print_address_description.constprop.7+0x1a/0x150\n  kasan_report.cold.13+0x7f/0x111\n  ip_do_fragment+0x1b03/0x1f60\n  ovs_fragment+0x5bf/0x840 [openvswitch]\n  do_execute_actions+0x1bd5/0x2400 [openvswitch]\n  ovs_execute_actions+0xc8/0x3d0 [openvswitch]\n  ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\n  genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\n  genl_rcv_msg+0x287/0x490\n  netlink_rcv_skb+0x120/0x380\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x439/0x630\n  netlink_sendmsg+0x719/0xbf0\n  sock_sendmsg+0xe2/0x110\n  ____sys_sendmsg+0x5ba/0x890\n  ___sys_sendmsg+0xe9/0x160\n  __sys_sendmsg+0xd3/0x170\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f957079db07\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\n\n The buggy address belongs to the page:\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\n flags: 0x17ffffc0000000()\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\n  ovs_fragment+0x0/0x840 [openvswitch]\n\n this frame has 2 objects:\n  [32, 144) 'ovs_dst'\n  [192, 424) 'ovs_rt'\n\n Memory state around the buggy address:\n  ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\n \u003effff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\n                                         ^\n  ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\n\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\nin the following call graph:\n\n  ip_do_fragment()\n    ip_skb_dst_mtu()\n      ip_dst_mtu_maybe_forward()\n        ip_mtu_locked()\n\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\nturns the access to struct members like rt_mtu_locked into an OOB read in\nthe stack. Fix this changing the temporary variable used for IPv4 packets\nin ovs_fragment(), similarly to what is done for IPv6 few lines below.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16e651b0-247a-4150-a877-ecf9e9468296",
      "id": "CVE-2021-46984",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkyber: fix out of bounds access when preempted\n\n__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and\npasses the hctx to -\u003ebio_merge(). kyber_bio_merge() then gets the ctx\nfor the current CPU again and uses that to get the corresponding Kyber\ncontext in the passed hctx. However, the thread may be preempted between\nthe two calls to blk_mq_get_ctx(), and the ctx returned the second time\nmay no longer correspond to the passed hctx. This \"works\" accidentally\nmost of the time, but it can cause us to read garbage if the second ctx\ncame from an hctx with more ctx's than the first one (i.e., if\nctx-\u003eindex_hw[hctx-\u003etype] \u003e hctx-\u003enr_ctx).\n\nThis manifested as this UBSAN array index out of bounds error reported\nby Jakub:\n\nUBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9\nindex 13106 is out of range for type 'long unsigned int [128]'\nCall Trace:\n dump_stack+0xa4/0xe5\n ubsan_epilogue+0x5/0x40\n __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34\n queued_spin_lock_slowpath+0x476/0x480\n do_raw_spin_lock+0x1c2/0x1d0\n kyber_bio_merge+0x112/0x180\n blk_mq_submit_bio+0x1f5/0x1100\n submit_bio_noacct+0x7b0/0x870\n submit_bio+0xc2/0x3a0\n btrfs_map_bio+0x4f0/0x9d0\n btrfs_submit_data_bio+0x24e/0x310\n submit_one_bio+0x7f/0xb0\n submit_extent_page+0xc4/0x440\n __extent_writepage_io+0x2b8/0x5e0\n __extent_writepage+0x28d/0x6e0\n extent_write_cache_pages+0x4d7/0x7a0\n extent_writepages+0xa2/0x110\n do_writepages+0x8f/0x180\n __writeback_single_inode+0x99/0x7f0\n writeback_sb_inodes+0x34e/0x790\n __writeback_inodes_wb+0x9e/0x120\n wb_writeback+0x4d2/0x660\n wb_workfn+0x64d/0xa10\n process_one_work+0x53a/0xa80\n worker_thread+0x69/0x5b0\n kthread+0x20b/0x240\n ret_from_fork+0x1f/0x30\n\nOnly Kyber uses the hctx, so fix it by passing the request_queue to\n-\u003ebio_merge() instead. BFQ and mq-deadline just use that, and Kyber can\nmap the queues itself to avoid the mismatch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dee24cd8-3a09-4cf3-96ce-d0faf2d3f2da",
      "id": "CVE-2021-47153",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: Don't generate an interrupt on bus reset\n\nNow that the i2c-i801 driver supports interrupts, setting the KILL bit\nin a attempt to recover from a timed out transaction triggers an\ninterrupt. Unfortunately, the interrupt handler (i801_isr) is not\nprepared for this situation and will try to process the interrupt as\nif it was signaling the end of a successful transaction. In the case\nof a block transaction, this can result in an out-of-range memory\naccess.\n\nThis condition was reproduced several times by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e\nhttps://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e\nhttps://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e\nhttps://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb\nhttps://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a\nhttps://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79\n\nSo disable interrupts while trying to reset the bus. Interrupts will\nbe enabled again for the following transaction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b93e0df-5425-4063-b10a-f455ae7c9506",
      "id": "CVE-2021-47216",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: advansys: Fix kernel pointer leak\n\nPointers should be printed with %p or %px rather than cast to 'unsigned\nlong' and printed with %lx.\n\nChange %lx to %p to print the hashed pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d9fa216-e74b-4aca-968a-f4cffeb6852d",
      "id": "CVE-2021-47295",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix memory leak in tcindex_partial_destroy_work\n\nSyzbot reported memory leak in tcindex_set_parms(). The problem was in\nnon-freed perfect hash in tcindex_partial_destroy_work().\n\nIn tcindex_set_parms() new tcindex_data is allocated and some fields from\nold one are copied to new one, but not the perfect hash. Since\ntcindex_partial_destroy_work() is the destroy function for old\ntcindex_data, we need to free perfect hash to avoid memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d328390-364f-4fd0-96bf-ebe9f2e1e294",
      "id": "CVE-2021-47408",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: serialize hash resizes and cleanups\n\nSyzbot was able to trigger the following warning [1]\n\nNo repro found by syzbot yet but I was able to trigger similar issue\nby having 2 scripts running in parallel, changing conntrack hash sizes,\nand:\n\nfor j in `seq 1 1000` ; do unshare -n /bin/true \u003e/dev/null ; done\n\nIt would take more than 5 minutes for net_namespace structures\nto be cleaned up.\n\nThis is because nf_ct_iterate_cleanup() has to restart everytime\na resize happened.\n\nBy adding a mutex, we can serialize hash resizes and cleanups\nand also make get_next_corpse() faster by skipping over empty\nbuckets.\n\nEven without resizes in the picture, this patch considerably\nspeeds up network namespace dismantles.\n\n[1]\nINFO: task syz-executor.0:8312 can't die for more than 144 seconds.\ntask:syz-executor.0  state:R  running task     stack:25672 pid: 8312 ppid:  6573 flags:0x00004006\nCall Trace:\n context_switch kernel/sched/core.c:4955 [inline]\n __schedule+0x940/0x26f0 kernel/sched/core.c:6236\n preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408\n preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35\n __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390\n local_bh_enable include/linux/bottom_half.h:32 [inline]\n get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline]\n nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275\n nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469\n ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171\n setup_net+0x639/0xa30 net/core/net_namespace.c:349\n copy_net_ns+0x319/0x760 net/core/net_namespace.c:470\n create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226\n ksys_unshare+0x445/0x920 kernel/fork.c:3128\n __do_sys_unshare kernel/fork.c:3202 [inline]\n __se_sys_unshare kernel/fork.c:3200 [inline]\n __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f63da68e739\nRSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000\nRBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80\nR13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000\n\nShowing all locks held in the system:\n1 lock held by khungtaskd/27:\n #0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446\n2 locks held by kworker/u4:2/153:\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268\n #1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272\n1 lock held by systemd-udevd/2970:\n1 lock held by in:imklog/6258:\n #0: ffff88807f970ff0 (\u0026f-\u003ef_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990\n3 locks held by kworker/1:6/8158:\n1 lock held by syz-executor.0/8312:\n2 locks held by kworker/u4:13/9320:\n1 lock held by\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b04f6786-2c02-4a27-9351-4c9f25b9e767",
      "id": "CVE-2021-47518",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done\n\nThe done() netlink callback nfc_genl_dump_ses_done() should check if\nreceived argument is non-NULL, because its allocation could fail earlier\nin dumpit() (nfc_genl_dump_ses()).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4842a1c4-5b89-4f76-99b7-9681a5689a31",
      "id": "CVE-2022-27666",
      "description": "A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe2d1749-545a-4b23-9aef-2007e78126ed",
      "id": "CVE-2022-41849",
      "description": "drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3ad3954-8952-44b2-bba1-953e1d9cd079",
      "id": "CVE-2022-48686",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix UAF when detecting digest errors\n\nWe should also bail from the io_work loop when we set rd_enabled to true,\nso we don't attempt to read data from the socket when the TCP stream is\nalready out-of-sync or corrupted.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df320231-2816-4e93-aa6e-df3524574730",
      "id": "CVE-2022-48717",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: max9759: fix underflow in speaker_gain_control_put()\n\nCheck for negative values of \"priv-\u003egain\" to prevent an out of bounds\naccess.  The concern is that these might come from the user via:\n  -\u003e snd_ctl_elem_write_user()\n    -\u003e snd_ctl_elem_write()\n      -\u003e kctl-\u003eput()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0fcbbe3-8958-49f8-b8a6-b3b9b8631147",
      "id": "CVE-2022-49375",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: mt6397: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "452214f1-caed-4131-9931-360c665023d7",
      "id": "CVE-2022-48751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Transitional solution for clcsock race issue\n\nWe encountered a crash in smc_setsockopt() and it is caused by\naccessing smc-\u003eclcsock after clcsock was released.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E     5.16.0-rc4+ #53\n RIP: 0010:smc_setsockopt+0x59/0x280 [smc]\n Call Trace:\n  \u003cTASK\u003e\n  __sys_setsockopt+0xfc/0x190\n  __x64_sys_setsockopt+0x20/0x30\n  do_syscall_64+0x34/0x90\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f16ba83918e\n  \u003c/TASK\u003e\n\nThis patch tries to fix it by holding clcsock_release_lock and\nchecking whether clcsock has already been released before access.\n\nIn case that a crash of the same reason happens in smc_getsockopt()\nor smc_switch_to_fallback(), this patch also checkes smc-\u003eclcsock\nin them too. And the caller of smc_switch_to_fallback() will identify\nwhether fallback succeeds according to the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "131a3fb1-9d66-497d-a3d6-c60f35738397",
      "id": "CVE-2022-48931",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix a race in configfs_{,un}register_subsystem()\n\nWhen configfs_register_subsystem() or configfs_unregister_subsystem()\nis executing link_group() or unlink_group(),\nit is possible that two processes add or delete list concurrently.\nSome unfortunate interleavings of them can cause kernel panic.\n\nOne of cases is:\nA --\u003e B --\u003e C --\u003e D\nA \u003c-- B \u003c-- C \u003c-- D\n\n     delete list_head *B        |      delete list_head *C\n--------------------------------|-----------------------------------\nconfigfs_unregister_subsystem   |   configfs_unregister_subsystem\n  unlink_group                  |     unlink_group\n    unlink_obj                  |       unlink_obj\n      list_del_init             |         list_del_init\n        __list_del_entry        |           __list_del_entry\n          __list_del            |             __list_del\n            // next == C        |\n            next-\u003eprev = prev   |\n                                |               next-\u003eprev = prev\n            prev-\u003enext = next   |\n                                |                 // prev == B\n                                |                 prev-\u003enext = next\n\nFix this by adding mutex when calling link_group() or unlink_group(),\nbut parent configfs_subsystem is NULL when config_item is root.\nSo I create a mutex configfs_subsystem_mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8b0ad86-ea33-4f0f-b0cc-c8d7a2d9d3b8",
      "id": "CVE-2022-48970",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Get user_ns from in_skb in unix_diag_get_exact().\n\nWei Chen reported a NULL deref in sk_user_ns() [0][1], and Paolo diagnosed\nthe root cause: in unix_diag_get_exact(), the newly allocated skb does not\nhave sk. [2]\n\nWe must get the user_ns from the NETLINK_CB(in_skb).sk and pass it to\nsk_diag_fill().\n\n[0]:\nBUG: kernel NULL pointer dereference, address: 0000000000000270\n#PF: supervisor read access in kernel mode\n#PF: error_code(0x0000) - not-present page\nPGD 12bbce067 P4D 12bbce067 PUD 12bc40067 PMD 0\nOops: 0000 [#1] PREEMPT SMP\nCPU: 0 PID: 27942 Comm: syz-executor.0 Not tainted 6.1.0-rc5-next-20221118 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014\nRIP: 0010:sk_user_ns include/net/sock.h:920 [inline]\nRIP: 0010:sk_diag_dump_uid net/unix/diag.c:119 [inline]\nRIP: 0010:sk_diag_fill+0x77d/0x890 net/unix/diag.c:170\nCode: 89 ef e8 66 d4 2d fd c7 44 24 40 00 00 00 00 49 8d 7c 24 18 e8\n54 d7 2d fd 49 8b 5c 24 18 48 8d bb 70 02 00 00 e8 43 d7 2d fd \u003c48\u003e 8b\n9b 70 02 00 00 48 8d 7b 10 e8 33 d7 2d fd 48 8b 5b 10 48 8d\nRSP: 0018:ffffc90000d67968 EFLAGS: 00010246\nRAX: ffff88812badaa48 RBX: 0000000000000000 RCX: ffffffff840d481d\nRDX: 0000000000000465 RSI: 0000000000000000 RDI: 0000000000000270\nRBP: ffffc90000d679a8 R08: 0000000000000277 R09: 0000000000000000\nR10: 0001ffffffffffff R11: 0001c90000d679a8 R12: ffff88812ac03800\nR13: ffff88812c87c400 R14: ffff88812ae42210 R15: ffff888103026940\nFS:  00007f08b4e6f700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000270 CR3: 000000012c58b000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n unix_diag_get_exact net/unix/diag.c:285 [inline]\n unix_diag_handler_dump+0x3f9/0x500 net/unix/diag.c:317\n __sock_diag_cmd net/core/sock_diag.c:235 [inline]\n sock_diag_rcv_msg+0x237/0x250 net/core/sock_diag.c:266\n netlink_rcv_skb+0x13e/0x250 net/netlink/af_netlink.c:2564\n sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:277\n netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline]\n netlink_unicast+0x5e9/0x6b0 net/netlink/af_netlink.c:1356\n netlink_sendmsg+0x739/0x860 net/netlink/af_netlink.c:1932\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n ____sys_sendmsg+0x38f/0x500 net/socket.c:2476\n ___sys_sendmsg net/socket.c:2530 [inline]\n __sys_sendmsg+0x197/0x230 net/socket.c:2559\n __do_sys_sendmsg net/socket.c:2568 [inline]\n __se_sys_sendmsg net/socket.c:2566 [inline]\n __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x4697f9\nCode: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48\n89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d\n01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f08b4e6ec48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000077bf80 RCX: 00000000004697f9\nRDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003\nRBP: 00000000004d29e9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf80\nR13: 0000000000000000 R14: 000000000077bf80 R15: 00007ffdb36bc6c0\n \u003c/TASK\u003e\nModules linked in:\nCR2: 0000000000000270\n\n[1]: https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/\n[2]: https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc69dd97-be22-4d99-8bf3-f18bd3f61009",
      "id": "CVE-2022-49134",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum: Guard against invalid local ports\n\nWhen processing events generated by the device's firmware, the driver\nprotects itself from events reported for non-existent local ports, but\nnot for the CPU port (local port 0), which exists, but does not have all\nthe fields as any local port.\n\nThis can result in a NULL pointer dereference when trying access\n'struct mlxsw_sp_port' fields which are not initialized for CPU port.\n\nCommit 63b08b1f6834 (\"mlxsw: spectrum: Protect driver from buggy firmware\")\nalready handled such issue by bailing early when processing a PUDE event\nreported for the CPU port.\n\nGeneralize the approach by moving the check to a common function and\nmaking use of it in all relevant places.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "115e4e77-364b-48db-af14-c1efac768c94",
      "id": "CVE-2022-49188",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region\n\nThe device_node pointer is returned by of_parse_phandle() or\nof_get_child_by_name() with refcount incremented.\nWe should use of_node_put() on it when done.\n\nThis function only call of_node_put(node) when of_address_to_resource\nsucceeds, missing error cases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94118d18-f208-4370-a124-690aa2033307",
      "id": "CVE-2022-49201",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: fix race between xmit and reset\n\nThere is a race between reset and the transmit paths that can lead to\nibmvnic_xmit() accessing an scrq after it has been freed in the reset\npath. It can result in a crash like:\n\n\tKernel attempted to read user page (0) - exploit attempt? (uid: 0)\n\tBUG: Kernel NULL pointer dereference on read at 0x00000000\n\tFaulting instruction address: 0xc0080000016189f8\n\tOops: Kernel access of bad area, sig: 11 [#1]\n\t...\n\tNIP [c0080000016189f8] ibmvnic_xmit+0x60/0xb60 [ibmvnic]\n\tLR [c000000000c0046c] dev_hard_start_xmit+0x11c/0x280\n\tCall Trace:\n\t[c008000001618f08] ibmvnic_xmit+0x570/0xb60 [ibmvnic] (unreliable)\n\t[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280\n\t[c000000000c9cfcc] sch_direct_xmit+0xec/0x330\n\t[c000000000bfe640] __dev_xmit_skb+0x3a0/0x9d0\n\t[c000000000c00ad4] __dev_queue_xmit+0x394/0x730\n\t[c008000002db813c] __bond_start_xmit+0x254/0x450 [bonding]\n\t[c008000002db8378] bond_start_xmit+0x40/0xc0 [bonding]\n\t[c000000000c0046c] dev_hard_start_xmit+0x11c/0x280\n\t[c000000000c00ca4] __dev_queue_xmit+0x564/0x730\n\t[c000000000cf97e0] neigh_hh_output+0xd0/0x180\n\t[c000000000cfa69c] ip_finish_output2+0x31c/0x5c0\n\t[c000000000cfd244] __ip_queue_xmit+0x194/0x4f0\n\t[c000000000d2a3c4] __tcp_transmit_skb+0x434/0x9b0\n\t[c000000000d2d1e0] __tcp_retransmit_skb+0x1d0/0x6a0\n\t[c000000000d2d984] tcp_retransmit_skb+0x34/0x130\n\t[c000000000d310e8] tcp_retransmit_timer+0x388/0x6d0\n\t[c000000000d315ec] tcp_write_timer_handler+0x1bc/0x330\n\t[c000000000d317bc] tcp_write_timer+0x5c/0x200\n\t[c000000000243270] call_timer_fn+0x50/0x1c0\n\t[c000000000243704] __run_timers.part.0+0x324/0x460\n\t[c000000000243894] run_timer_softirq+0x54/0xa0\n\t[c000000000ea713c] __do_softirq+0x15c/0x3e0\n\t[c000000000166258] __irq_exit_rcu+0x158/0x190\n\t[c000000000166420] irq_exit+0x20/0x40\n\t[c00000000002853c] timer_interrupt+0x14c/0x2b0\n\t[c000000000009a00] decrementer_common_virt+0x210/0x220\n\t--- interrupt: 900 at plpar_hcall_norets_notrace+0x18/0x2c\n\nThe immediate cause of the crash is the access of tx_scrq in the following\nsnippet during a reset, where the tx_scrq can be either NULL or an address\nthat will soon be invalid:\n\n\tibmvnic_xmit()\n\t{\n\t\t...\n\t\ttx_scrq = adapter-\u003etx_scrq[queue_num];\n\t\ttxq = netdev_get_tx_queue(netdev, queue_num);\n\t\tind_bufp = \u0026tx_scrq-\u003eind_buf;\n\n\t\tif (test_bit(0, \u0026adapter-\u003eresetting)) {\n\t\t...\n\t}\n\nBut beyond that, the call to ibmvnic_xmit() itself is not safe during a\nreset and the reset path attempts to avoid this by stopping the queue in\nibmvnic_cleanup(). However just after the queue was stopped, an in-flight\nibmvnic_complete_tx() could have restarted the queue even as the reset is\nprogressing.\n\nSince the queue was restarted we could get a call to ibmvnic_xmit() which\ncan then access the bad tx_scrq (or other fields).\n\nWe cannot however simply have ibmvnic_complete_tx() check the -\u003eresetting\nbit and skip starting the queue. This can race at the \"back-end\" of a good\nreset which just restarted the queue but has not cleared the -\u003eresetting\nbit yet. If we skip restarting the queue due to -\u003eresetting being true,\nthe queue would remain stopped indefinitely potentially leading to transmit\ntimeouts.\n\nIOW -\u003eresetting is too broad for this purpose. Instead use a new flag\nthat indicates whether or not the queues are active. Only the open/\nreset paths control when the queues are active. ibmvnic_complete_tx()\nand others wake up the queue only if the queue is marked active.\n\nSo we will have:\n\tA. reset/open thread in ibmvnic_cleanup() and __ibmvnic_open()\n\n\t\t-\u003eresetting = true\n\t\t-\u003etx_queues_active = false\n\t\tdisable tx queues\n\t\t...\n\t\t-\u003etx_queues_active = true\n\t\tstart tx queues\n\n\tB. Tx interrupt in ibmvnic_complete_tx():\n\n\t\tif (-\u003etx_queues_active)\n\t\t\tnetif_wake_subqueue();\n\nTo ensure that -\u003etx_queues_active and state of the queues are consistent,\nwe need a lock which:\n\n\t- must also be taken in the interrupt path (ibmvnic_complete_tx())\n\t- shared across the multiple\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eefecb55-9ed2-4da8-9a39-b60da416f214",
      "id": "CVE-2022-49242",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mxs: Fix error handling in mxs_sgtl5000_probe\n\nThis function only calls of_node_put() in the regular path.\nAnd it will cause refcount leak in error paths.\nFor example, when codec_np is NULL, saif_np[0] and saif_np[1]\nare not NULL, it will cause leaks.\n\nof_node_put() will check if the node pointer is NULL, so we can\ncall it directly to release the refcount of regular pointers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd433d10-934a-405c-a292-f77106fa839a",
      "id": "CVE-2022-50126",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix assertion 'jh-\u003eb_frozen_data == NULL' failure when journal aborted\n\nFollowing process will fail assertion 'jh-\u003eb_frozen_data == NULL' in\njbd2_journal_dirty_metadata():\n\n                   jbd2_journal_commit_transaction\nunlink(dir/a)\n jh-\u003eb_transaction = trans1\n jh-\u003eb_jlist = BJ_Metadata\n                    journal-\u003ej_running_transaction = NULL\n                    trans1-\u003et_state = T_COMMIT\nunlink(dir/b)\n handle-\u003eh_trans = trans2\n do_get_write_access\n  jh-\u003eb_modified = 0\n  jh-\u003eb_frozen_data = frozen_buffer\n  jh-\u003eb_next_transaction = trans2\n jbd2_journal_dirty_metadata\n  is_handle_aborted\n   is_journal_aborted // return false\n\n           --\u003e jbd2 abort \u003c--\n\n                     while (commit_transaction-\u003et_buffers)\n                      if (is_journal_aborted)\n                       jbd2_journal_refile_buffer\n                        __jbd2_journal_refile_buffer\n                         WRITE_ONCE(jh-\u003eb_transaction,\n\t\t\t\t\t\tjh-\u003eb_next_transaction)\n                         WRITE_ONCE(jh-\u003eb_next_transaction, NULL)\n                         __jbd2_journal_file_buffer(jh, BJ_Reserved)\n        J_ASSERT_JH(jh, jh-\u003eb_frozen_data == NULL) // assertion failure !\n\nThe reproducer (See detail in [Link]) reports:\n ------------[ cut here ]------------\n kernel BUG at fs/jbd2/transaction.c:1629!\n invalid opcode: 0000 [#1] PREEMPT SMP\n CPU: 2 PID: 584 Comm: unlink Tainted: G        W\n 5.19.0-rc6-00115-g4a57a8400075-dirty #697\n RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470\n RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202\n Call Trace:\n  \u003cTASK\u003e\n  __ext4_handle_dirty_metadata+0xa0/0x290\n  ext4_handle_dirty_dirblock+0x10c/0x1d0\n  ext4_delete_entry+0x104/0x200\n  __ext4_unlink+0x22b/0x360\n  ext4_unlink+0x275/0x390\n  vfs_unlink+0x20b/0x4c0\n  do_unlinkat+0x42f/0x4c0\n  __x64_sys_unlink+0x37/0x50\n  do_syscall_64+0x35/0x80\n\nAfter journal aborting, __jbd2_journal_refile_buffer() is executed with\nholding @jh-\u003eb_state_lock, we can fix it by moving 'is_handle_aborted()'\ninto the area protected by @jh-\u003eb_state_lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a4c5d6c-4b9a-4b5c-a8d0-8c1e2424143e",
      "id": "CVE-2022-49385",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver: base: fix UAF when driver_attach failed\n\nWhen driver_attach(drv); failed, the driver_private will be freed.\nBut it has been added to the bus, which caused a UAF.\n\nTo fix it, we need to delete it from the bus when failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19d26c63-5065-471b-b45d-1a069c862ba3",
      "id": "CVE-2022-49413",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: Update cgroup information before merging bio\n\nWhen the process is migrated to a different cgroup (or in case of\nwriteback just starts submitting bios associated with a different\ncgroup) bfq_merge_bio() can operate with stale cgroup information in\nbic. Thus the bio can be merged to a request from a different cgroup or\nit can result in merging of bfqqs for different cgroups or bfqqs of\nalready dead cgroups and causing possible use-after-free issues. Fix the\nproblem by updating cgroup information in bfq_merge_bio().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24cfa228-d7d0-4b5c-8183-6cb6cbb1a4ba",
      "id": "CVE-2022-49531",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: implement -\u003efree_disk\n\nEnsure that the lo_device which is stored in the gendisk private\ndata is valid until the gendisk is freed.  Currently the loop driver\nuses a lot of effort to make sure a device is not freed when it is\nstill in use, but to to fix a potential deadlock this will be relaxed\na bit soon.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b7f1c29-2e87-4dc3-963f-c84bcb17ccf4",
      "id": "CVE-2022-49651",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Tighten cleanup_srcu_struct() GP checks\n\nCurrently, cleanup_srcu_struct() checks for a grace period in progress,\nbut it does not check for a grace period that has not yet started but\nwhich might start at any time.  Such a situation could result in a\nuse-after-free bug, so this commit adds a check for a grace period that\nis needed but not yet started to cleanup_srcu_struct().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98478616-7dd7-4fb6-9476-630005a16e13",
      "id": "CVE-2022-49697",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix request_sock leak in sk lookup helpers\n\nA customer reported a request_socket leak in a Calico cloud environment. We\nfound that a BPF program was doing a socket lookup with takes a refcnt on\nthe socket and that it was finding the request_socket but returning the parent\nLISTEN socket via sk_to_full_sk() without decrementing the child request socket\n1st, resulting in request_sock slab object leak. This patch retains the\nexisting behaviour of returning full socks to the caller but it also decrements\nthe child request_socket if one is present before doing so to prevent the leak.\n\nThanks to Curtis Taylor for all the help in diagnosing and testing this. And\nthanks to Antoine Tenart for the reproducer and patch input.\n\nv2 of this patch contains, refactor as per Daniel Borkmann's suggestions to\nvalidate RCU flags on the listen socket so that it balances with bpf_sk_release()\nand update comments as per Martin KaFai Lau's suggestion. One small change to\nDaniels suggestion, put \"sk = sk2\" under \"if (sk2 != sk)\" to avoid an extra\ninstruction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8aa9b92b-f120-4c87-836b-5c53b5ab6c41",
      "id": "CVE-2022-49763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix use-after-free in ntfs_attr_find()\n\nPatch series \"ntfs: fix bugs about Attribute\", v2.\n\nThis patchset fixes three bugs relative to Attribute in record:\n\nPatch 1 adds a sanity check to ensure that, attrs_offset field in first\nmft record loading from disk is within bounds.\n\nPatch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid\ndereferencing ATTR_RECORD before checking this ATTR_RECORD is within\nbounds.\n\nPatch 3 adds an overflow checking to avoid possible forever loop in\nntfs_attr_find().\n\nWithout patch 1 and patch 2, the kernel triggersa KASAN use-after-free\ndetection as reported by Syzkaller.\n\nAlthough one of patch 1 or patch 2 can fix this, we still need both of\nthem.  Because patch 1 fixes the root cause, and patch 2 not only fixes\nthe direct cause, but also fixes the potential out-of-bounds bug.\n\n\nThis patch (of 3):\n\nSyzkaller reported use-after-free read as follows:\n==================================================================\nBUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597\nRead of size 2 at addr ffff88807e352009 by task syz-executor153/3607\n\n[...]\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:317 [inline]\n print_report.cold+0x2ba/0x719 mm/kasan/report.c:433\n kasan_report+0xb1/0x1e0 mm/kasan/report.c:495\n ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597\n ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193\n ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845\n ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854\n mount_bdev+0x34d/0x410 fs/super.c:1400\n legacy_get_tree+0x105/0x220 fs/fs_context.c:610\n vfs_get_tree+0x89/0x2f0 fs/super.c:1530\n do_new_mount fs/namespace.c:3040 [inline]\n path_mount+0x1326/0x1e20 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n \u003c/TASK\u003e\n\nThe buggy address belongs to the physical page:\npage:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350\nhead:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)\nraw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140\nraw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\nMemory state around the buggy address:\n ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                      ^\n ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nKernel will loads $MFT/$DATA's first mft record in\nntfs_read_inode_mount().\n\nYet the problem is that after loading, kernel doesn't check whether\nattrs_offset field is a valid value.\n\nTo be more specific, if attrs_offset field is larger than bytes_allocated\nfield, then it may trigger the out-of-bounds read bug(reported as\nuse-after-free bug) in ntfs_attr_find(), when kernel tries to access the\ncorresponding mft record's attribute.\n\nThis patch solves it by adding the sanity check between attrs_offset field\nand bytes_allocated field, after loading the first mft record.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e79fca89-89ec-4165-b90d-d97c0ea783e5",
      "id": "CVE-2022-50008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: don't call disarm_kprobe() for disabled kprobes\n\nThe assumption in __disable_kprobe() is wrong, and it could try to disarm\nan already disarmed kprobe and fire the WARN_ONCE() below. [0]  We can\neasily reproduce this issue.\n\n1. Write 0 to /sys/kernel/debug/kprobes/enabled.\n\n  # echo 0 \u003e /sys/kernel/debug/kprobes/enabled\n\n2. Run execsnoop.  At this time, one kprobe is disabled.\n\n  # /usr/share/bcc/tools/execsnoop \u0026\n  [1] 2460\n  PCOMM            PID    PPID   RET ARGS\n\n  # cat /sys/kernel/debug/kprobes/list\n  ffffffff91345650  r  __x64_sys_execve+0x0    [FTRACE]\n  ffffffff91345650  k  __x64_sys_execve+0x0    [DISABLED][FTRACE]\n\n3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes\n   kprobes_all_disarmed to false but does not arm the disabled kprobe.\n\n  # echo 1 \u003e /sys/kernel/debug/kprobes/enabled\n\n  # cat /sys/kernel/debug/kprobes/list\n  ffffffff91345650  r  __x64_sys_execve+0x0    [FTRACE]\n  ffffffff91345650  k  __x64_sys_execve+0x0    [DISABLED][FTRACE]\n\n4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the\n   disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace().\n\n  # fg\n  /usr/share/bcc/tools/execsnoop\n  ^C\n\nActually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses\nsome cleanups and leaves the aggregated kprobe in the hash table.  Then,\n__unregister_trace_kprobe() initialises tk-\u003erp.kp.list and creates an\ninfinite loop like this.\n\n  aggregated kprobe.list -\u003e kprobe.list -.\n                                     ^    |\n                                     '.__.'\n\nIn this situation, these commands fall into the infinite loop and result\nin RCU stall or soft lockup.\n\n  cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the\n                                       infinite loop with RCU.\n\n  /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex,\n                                   and __get_valid_kprobe() is stuck in\n\t\t\t\t   the loop.\n\nTo avoid the issue, make sure we don't call disarm_kprobe() for disabled\nkprobes.\n\n[0]\nFailed to disarm kprobe-ftrace at __x64_sys_execve+0x0/0x40 (error -2)\nWARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129)\nModules linked in: ena\nCPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28\nHardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017\nRIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129)\nCode: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff \u003c0f\u003e 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94\nRSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001\nRDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff\nRBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff\nR10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40\nR13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000\nFS:  00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\n __disable_kprobe (kernel/kprobes.c:1716)\n disable_kprobe (kernel/kprobes.c:2392)\n __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340)\n disable_trace_kprobe (kernel/trace/trace_kprobe.c:429)\n perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168)\n perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295)\n _free_event (kernel/events/core.c:4971)\n perf_event_release_kernel (kernel/events/core.c:5176)\n perf_release (kernel/events/core.c:5186)\n __fput (fs/file_table.c:321)\n task_work_run (./include/linux/\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "835b2f2d-9d3a-45c1-85e1-ac28c22940cf",
      "id": "CVE-2022-50120",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not needed anymore.\nThis function has two paths missing of_node_put().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f703e434-d8fe-4d33-beba-482b8d207553",
      "id": "CVE-2022-50156",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: cp2112: prevent a buffer overflow in cp2112_xfer()\n\nSmatch warnings:\ndrivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()\n'data-\u003eblock[1]' too small (33 vs 255)\ndrivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too\nsmall (64 vs 255)\n\nThe 'read_length' variable is provided by 'data-\u003eblock[0]' which comes\nfrom user and it(read_length) can take a value between 0-255. Add an\nupper bound to 'read_length' variable to prevent a buffer overflow in\nmemcpy().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2366003-1699-4088-99e3-514c1b4487dd",
      "id": "CVE-2022-50273",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on destination blkaddr during recovery\n\nAs Wenqing Liu reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=216456\n\nloop5: detected capacity change from 0 to 131072\nF2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1\nF2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0\nF2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1\nF2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0\nF2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1\nF2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0\nF2FS-fs (loop5): Bitmap was wrongly set, blk:5634\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 1013 at fs/f2fs/segment.c:2198\nRIP: 0010:update_sit_entry+0xa55/0x10b0 [f2fs]\nCall Trace:\n \u003cTASK\u003e\n f2fs_do_replace_block+0xa98/0x1890 [f2fs]\n f2fs_replace_block+0xeb/0x180 [f2fs]\n recover_data+0x1a69/0x6ae0 [f2fs]\n f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs]\n f2fs_fill_super+0x4665/0x61e0 [f2fs]\n mount_bdev+0x2cf/0x3b0\n legacy_get_tree+0xed/0x1d0\n vfs_get_tree+0x81/0x2b0\n path_mount+0x47e/0x19d0\n do_mount+0xce/0xf0\n __x64_sys_mount+0x12c/0x1a0\n do_syscall_64+0x38/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIf we enable CONFIG_F2FS_CHECK_FS config, it will trigger a kernel panic\ninstead of warning.\n\nThe root cause is: in fuzzed image, SIT table is inconsistent with inode\nmapping table, result in triggering such warning during SIT table update.\n\nThis patch introduces a new flag DATA_GENERIC_ENHANCE_UPDATE, w/ this\nflag, data block recovery flow can check destination blkaddr's validation\nin SIT table, and skip f2fs_replace_block() to avoid inconsistent status.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c766a2c3-9d9f-449f-bff4-5c8169d86562",
      "id": "CVE-2022-50314",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n\nsyzbot reported hung task [1].  The following program is a simplified\nversion of the reproducer:\n\nint main(void)\n{\n\tint sv[2], fd;\n\n\tif (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) \u003c 0)\n\t\treturn 1;\n\tif ((fd = open(\"/dev/nbd0\", 0)) \u003c 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) \u003c 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SOCK, sv[0]) \u003c 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_DO_IT) \u003c 0)\n\t\treturn 1;\n\treturn 0;\n}\n\nWhen signal interrupt nbd_start_device_ioctl() waiting the condition\natomic_read(\u0026config-\u003erecv_threads) == 0, the task can hung because it\nwaits the completion of the inflight IOs.\n\nThis patch fixes the issue by clearing queue, not just shutdown, when\nsignal interrupt nbd_start_device_ioctl().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c9a787c-91f8-4107-af86-a5db0f7c8356",
      "id": "CVE-2023-1281",
      "description": "Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root.\nThis issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "644312ac-33c4-45ad-8fbd-c908353b0e9a",
      "id": "CVE-2023-1855",
      "description": "A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d57338a-5ff3-4ed7-9a58-6f6b44a27f72",
      "id": "CVE-2023-35823",
      "description": "An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "62112f12-4e57-4fa1-93c4-e21f9589ecf0",
      "id": "CVE-2023-40791",
      "description": "extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0963ec41-26cc-4505-af58-e2e2e2a28a8b",
      "id": "CVE-2023-45862",
      "description": "An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ee40a4f-23d0-4660-9a61-9e562eaadae0",
      "id": "CVE-2023-52445",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix use after free on context disconnection\n\nUpon module load, a kthread is created targeting the\npvr2_context_thread_func function, which may call pvr2_context_destroy\nand thus call kfree() on the context object. However, that might happen\nbefore the usb hub_event handler is able to notify the driver. This\npatch adds a sanity check before the invalid read reported by syzbot,\nwithin the context disconnection call stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3561ad86-17b8-4efd-bf4c-87344bae5a06",
      "id": "CVE-2023-52826",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel/panel-tpo-tpg110: fix a possible null pointer dereference\n\nIn tpg110_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a NULL pointer dereference on\nfailure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b2534be-d4ec-41bf-912e-60bf1eb83df4",
      "id": "CVE-2023-52835",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Bail out early if the request AUX area is out of bound\n\nWhen perf-record with a large AUX area, e.g 4GB, it fails with:\n\n    #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1\n    failed to mmap with 12 (Cannot allocate memory)\n\nand it reveals a WARNING with __alloc_pages():\n\n\t------------[ cut here ]------------\n\tWARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248\n\tCall trace:\n\t __alloc_pages+0x1ec/0x248\n\t __kmalloc_large_node+0xc0/0x1f8\n\t __kmalloc_node+0x134/0x1e8\n\t rb_alloc_aux+0xe0/0x298\n\t perf_mmap+0x440/0x660\n\t mmap_region+0x308/0x8a8\n\t do_mmap+0x3c0/0x528\n\t vm_mmap_pgoff+0xf4/0x1b8\n\t ksys_mmap_pgoff+0x18c/0x218\n\t __arm64_sys_mmap+0x38/0x58\n\t invoke_syscall+0x50/0x128\n\t el0_svc_common.constprop.0+0x58/0x188\n\t do_el0_svc+0x34/0x50\n\t el0_svc+0x34/0x108\n\t el0t_64_sync_handler+0xb8/0xc0\n\t el0t_64_sync+0x1a4/0x1a8\n\n'rb-\u003eaux_pages' allocated by kcalloc() is a pointer array which is used to\nmaintains AUX trace pages. The allocated page for this array is physically\ncontiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the\nsize of pointer array crosses the limitation set by MAX_ORDER, it reveals a\nWARNING.\n\nSo bail out early with -ENOMEM if the request AUX area is out of bound,\ne.g.:\n\n    #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1\n    failed to mmap with 12 (Cannot allocate memory)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "459003db-afa4-43aa-80f1-c8b1c282ba51",
      "id": "CVE-2023-52858",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data\n\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "70197f1f-da17-44a1-92d0-8043dc4ea224",
      "id": "CVE-2023-53090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix an illegal memory access\n\nIn the kfd_wait_on_events() function, the kfd_event_waiter structure is\nallocated by alloc_event_waiters(), but the event field of the waiter\nstructure is not initialized; When copy_from_user() fails in the\nkfd_wait_on_events() function, it will enter exception handling to\nrelease the previously allocated memory of the waiter structure;\nDue to the event field of the waiters structure being accessed\nin the free_waiters() function, this results in illegal memory access\nand system crash, here is the crash log:\n\nlocalhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0\nlocalhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082\nlocalhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000\nlocalhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0\nlocalhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64\nlocalhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002\nlocalhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698\nlocalhost kernel: FS:  0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000\nlocalhost kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nlocalhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0\nlocalhost kernel: Call Trace:\nlocalhost kernel: _raw_spin_lock_irqsave+0x30/0x40\nlocalhost kernel: remove_wait_queue+0x12/0x50\nlocalhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu]\nlocalhost kernel: ? ftrace_graph_caller+0xa0/0xa0\nlocalhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu]\nlocalhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu]\nlocalhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu]\nlocalhost kernel: ? ftrace_graph_caller+0xa0/0xa0\nlocalhost kernel: __x64_sys_ioctl+0x8e/0xd0\nlocalhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0\nlocalhost kernel: do_syscall_64+0x33/0x80\nlocalhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9\nlocalhost kernel: RIP: 0033:0x152a4dff68d7\n\nAllocate the structure with kcalloc, and remove redundant 0-initialization\nand a redundant loop condition check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79318bbb-738b-454c-b46e-edc99ba1352a",
      "id": "CVE-2023-53167",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix null pointer dereference in tracing_err_log_open()\n\nFix an issue in function 'tracing_err_log_open'.\nThe function doesn't call 'seq_open' if the file is opened only with\nwrite permissions, which results in 'file-\u003eprivate_data' being left as null.\nIf we then use 'lseek' on that opened file, 'seq_lseek' dereferences\n'file-\u003eprivate_data' in 'mutex_lock(\u0026m-\u003elock)', resulting in a kernel panic.\nWriting to this node requires root privileges, therefore this bug\nhas very little security impact.\n\nTracefs node: /sys/kernel/tracing/error_log\n\nExample Kernel panic:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000038\nCall trace:\n mutex_lock+0x30/0x110\n seq_lseek+0x34/0xb8\n __arm64_sys_lseek+0x6c/0xb8\n invoke_syscall+0x58/0x13c\n el0_svc_common+0xc4/0x10c\n do_el0_svc+0x24/0x98\n el0_svc+0x24/0x88\n el0t_64_sync_handler+0x84/0xe4\n el0t_64_sync+0x1b4/0x1b8\nCode: d503201f aa0803e0 aa1f03e1 aa0103e9 (c8e97d02)\n---[ end trace 561d1b49c12cf8a5 ]---\nKernel panic - not syncing: Oops: Fatal exception",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87e6830f-c78b-4a65-bd60-09b6362411b4",
      "id": "CVE-2023-53197",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: uhci: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49bb22ef-c715-473e-b257-32c51a5ac303",
      "id": "CVE-2023-53348",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock when aborting transaction during relocation with scrub\n\nBefore relocating a block group we pause scrub, then do the relocation and\nthen unpause scrub. The relocation process requires starting and committing\na transaction, and if we have a failure in the critical section of the\ntransaction commit path (transaction state \u003e= TRANS_STATE_COMMIT_START),\nwe will deadlock if there is a paused scrub.\n\nThat results in stack traces like the following:\n\n  [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6\n  [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction.\n  [42.936] ------------[ cut here ]------------\n  [42.936] BTRFS: Transaction aborted (error -28)\n  [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\n  [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...)\n  [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G        W          6.3.0-rc2-btrfs-next-127+ #1\n  [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\n  [42.936] Code: ff ff 45 8b (...)\n  [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282\n  [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000\n  [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff\n  [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8\n  [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00\n  [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0\n  [42.936] FS:  00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000\n  [42.936] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0\n  [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [42.936] Call Trace:\n  [42.936]  \u003cTASK\u003e\n  [42.936]  ? start_transaction+0xcb/0x610 [btrfs]\n  [42.936]  prepare_to_relocate+0x111/0x1a0 [btrfs]\n  [42.936]  relocate_block_group+0x57/0x5d0 [btrfs]\n  [42.936]  ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs]\n  [42.936]  btrfs_relocate_block_group+0x248/0x3c0 [btrfs]\n  [42.936]  ? __pfx_autoremove_wake_function+0x10/0x10\n  [42.936]  btrfs_relocate_chunk+0x3b/0x150 [btrfs]\n  [42.936]  btrfs_balance+0x8ff/0x11d0 [btrfs]\n  [42.936]  ? __kmem_cache_alloc_node+0x14a/0x410\n  [42.936]  btrfs_ioctl+0x2334/0x32c0 [btrfs]\n  [42.937]  ? mod_objcg_state+0xd2/0x360\n  [42.937]  ? refill_obj_stock+0xb0/0x160\n  [42.937]  ? seq_release+0x25/0x30\n  [42.937]  ? __rseq_handle_notify_resume+0x3b5/0x4b0\n  [42.937]  ? percpu_counter_add_batch+0x2e/0xa0\n  [42.937]  ? __x64_sys_ioctl+0x88/0xc0\n  [42.937]  __x64_sys_ioctl+0x88/0xc0\n  [42.937]  do_syscall_64+0x38/0x90\n  [42.937]  entry_SYSCALL_64_after_hwframe+0x72/0xdc\n  [42.937] RIP: 0033:0x7f381a6ffe9b\n  [42.937] Code: 00 48 89 44 24 (...)\n  [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b\n  [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003\n  [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000\n  [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423\n  [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148\n  [42.937]  \u003c/TASK\u003e\n  [42.937] ---[ end trace 0000000000000000 ]---\n  [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left\n  [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds.\n  [59.196]       Tainted: G        W          6.3.0-rc2-btrfs-next-127+ #1\n  [59.196] \"echo 0 \u003e /proc/sys/kernel/hung_\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8087294f-ddfc-4c73-a57a-22a519ab0f5d",
      "id": "CVE-2023-53354",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nskbuff: skb_segment, Call zero copy functions before using skbuff frags\n\nCommit bf5c25d60861 (\"skbuff: in skb_segment, call zerocopy functions\nonce per nskb\") added the call to zero copy functions in skb_segment().\nThe change introduced a bug in skb_segment() because skb_orphan_frags()\nmay possibly change the number of fragments or allocate new fragments\naltogether leaving nrfrags and frag to point to the old values. This can\ncause a panic with stacktrace like the one below.\n\n[  193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc\n[  193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G           O      5.15.123+ #26\n[  193.903919] RIP: 0010:skb_segment+0xb0e/0x12f0\n[  194.021892] Call Trace:\n[  194.027422]  \u003cTASK\u003e\n[  194.072861]  tcp_gso_segment+0x107/0x540\n[  194.082031]  inet_gso_segment+0x15c/0x3d0\n[  194.090783]  skb_mac_gso_segment+0x9f/0x110\n[  194.095016]  __skb_gso_segment+0xc1/0x190\n[  194.103131]  netem_enqueue+0x290/0xb10 [sch_netem]\n[  194.107071]  dev_qdisc_enqueue+0x16/0x70\n[  194.110884]  __dev_queue_xmit+0x63b/0xb30\n[  194.121670]  bond_start_xmit+0x159/0x380 [bonding]\n[  194.128506]  dev_hard_start_xmit+0xc3/0x1e0\n[  194.131787]  __dev_queue_xmit+0x8a0/0xb30\n[  194.138225]  macvlan_start_xmit+0x4f/0x100 [macvlan]\n[  194.141477]  dev_hard_start_xmit+0xc3/0x1e0\n[  194.144622]  sch_direct_xmit+0xe3/0x280\n[  194.147748]  __dev_queue_xmit+0x54a/0xb30\n[  194.154131]  tap_get_user+0x2a8/0x9c0 [tap]\n[  194.157358]  tap_sendmsg+0x52/0x8e0 [tap]\n[  194.167049]  handle_tx_zerocopy+0x14e/0x4c0 [vhost_net]\n[  194.173631]  handle_tx+0xcd/0xe0 [vhost_net]\n[  194.176959]  vhost_worker+0x76/0xb0 [vhost]\n[  194.183667]  kthread+0x118/0x140\n[  194.190358]  ret_from_fork+0x1f/0x30\n[  194.193670]  \u003c/TASK\u003e\n\nIn this case calling skb_orphan_frags() updated nr_frags leaving nrfrags\nlocal variable in skb_segment() stale. This resulted in the code hitting\ni \u003e= nrfrags prematurely and trying to move to next frag_skb using\nlist_skb pointer, which was NULL, and caused kernel panic. Move the call\nto zero copy functions before using frags and nr_frags.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4899f2f1-60f8-4483-a03d-45822cf9318f",
      "id": "CVE-2023-53367",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/habanalabs: fix mem leak in capture user mappings\n\nThis commit fixes a memory leak caused when clearing the user_mappings\ninfo when a new context is opened immediately after user_mapping is\ncaptured and a hard reset is performed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5449e2db-740e-484a-b45e-9495297806ed",
      "id": "CVE-2023-53407",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d216abe-a39e-4e00-8cd7-d9016575a9ff",
      "id": "CVE-2024-26770",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: nvidia-shield: Add missing null pointer checks to LED initialization\n\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.\n\n[jkosina@suse.com: tweak changelog a bit]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89ed30fe-b79f-4c97-9db1-25d113fa2c1a",
      "id": "CVE-2023-53429",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't check PageError in __extent_writepage\n\n__extent_writepage currenly sets PageError whenever any error happens,\nand the also checks for PageError to decide if to call error handling.\nThis leads to very unclear responsibility for cleaning up on errors.\nIn the VM and generic writeback helpers the basic idea is that once\nI/O is fired off all error handling responsibility is delegated to the\nend I/O handler.  But if that end I/O handler sets the PageError bit,\nand the submitter checks it, the bit could in some cases leak into the\nsubmission context for fast enough I/O.\n\nFix this by simply not checking PageError and just using the local\nret variable to check for submission errors.  This also fundamentally\nsolves the long problem documented in a comment in __extent_writepage\nby never leaking the error bit into the submission context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e053cf69-f1ac-4f8e-b4f6-faf472f287cb",
      "id": "CVE-2023-6356",
      "description": "A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d9d6f08-d090-425f-87c4-ea4b4f999707",
      "id": "CVE-2024-26600",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP\n\nIf the external phy working together with phy-omap-usb2 does not implement\nsend_srp(), we may still attempt to call it. This can happen on an idle\nEthernet gadget triggering a wakeup for example:\n\nconfigfs-gadget.g1 gadget.0: ECM Suspend\nconfigfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup\n...\nUnable to handle kernel NULL pointer dereference at virtual address\n00000000 when execute\n...\nPC is at 0x0\nLR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc]\n...\nmusb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core]\nusb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether]\neth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c\ndev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4\nsch_direct_xmit from __dev_queue_xmit+0x334/0xd88\n__dev_queue_xmit from arp_solicit+0xf0/0x268\narp_solicit from neigh_probe+0x54/0x7c\nneigh_probe from __neigh_event_send+0x22c/0x47c\n__neigh_event_send from neigh_resolve_output+0x14c/0x1c0\nneigh_resolve_output from ip_finish_output2+0x1c8/0x628\nip_finish_output2 from ip_send_skb+0x40/0xd8\nip_send_skb from udp_send_skb+0x124/0x340\nudp_send_skb from udp_sendmsg+0x780/0x984\nudp_sendmsg from __sys_sendto+0xd8/0x158\n__sys_sendto from ret_fast_syscall+0x0/0x58\n\nLet's fix the issue by checking for send_srp() and set_vbus() before\ncalling them. For USB peripheral only cases these both could be NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "132ddc74-16d5-400d-a1f9-8be2e3fc9615",
      "id": "CVE-2024-26633",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\n\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\n\nReading frag_off can only be done if we pulled enough bytes\nto skb-\u003ehead. Currently we might access garbage.\n\n[1]\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendmsg net/socket.c:2676 [inline]\n__se_sys_sendmsg net/socket.c:2674 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\nslab_alloc_node mm/slub.c:3478 [inline]\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\npskb_may_pull include/linux/skbuff.h:2681 [inline]\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendms\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c972ff7-970f-4b82-b551-b4e18093bb41",
      "id": "CVE-2024-26635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: Drop support for ETH_P_TR_802_2.\n\nsyzbot reported an uninit-value bug below. [0]\n\nllc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2\n(0x0011), and syzbot abused the latter to trigger the bug.\n\n  write$tun(r0, \u0026(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', \"90e5dd\"}}}}, 0x16)\n\nllc_conn_handler() initialises local variables {saddr,daddr}.mac\nbased on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes\nthem to __llc_lookup().\n\nHowever, the initialisation is done only when skb-\u003eprotocol is\nhtons(ETH_P_802_2), otherwise, __llc_lookup_established() and\n__llc_lookup_listener() will read garbage.\n\nThe missing initialisation existed prior to commit 211ed865108e\n(\"net: delete all instances of special processing for token ring\").\n\nIt removed the part to kick out the token ring stuff but forgot to\nclose the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv().\n\nLet's remove llc_tr_packet_type and complete the deprecation.\n\n[0]:\nBUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90\n __llc_lookup_established+0xe9d/0xf90\n __llc_lookup net/llc/llc_conn.c:611 [inline]\n llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n __netif_receive_skb_one_core net/core/dev.c:5527 [inline]\n __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641\n netif_receive_skb_internal net/core/dev.c:5727 [inline]\n netif_receive_skb+0x58/0x660 net/core/dev.c:5786\n tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n call_write_iter include/linux/fs.h:2020 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x8ef/0x1490 fs/read_write.c:584\n ksys_write+0x20f/0x4c0 fs/read_write.c:637\n __do_sys_write fs/read_write.c:649 [inline]\n __se_sys_write fs/read_write.c:646 [inline]\n __x64_sys_write+0x93/0xd0 fs/read_write.c:646\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nLocal variable daddr created at:\n llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783\n llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206\n\nCPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2070e48-f3af-4e5e-9ece-381c6c56bdc0",
      "id": "CVE-2024-26702",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC\n\nRecently, we encounter kernel crash in function rm3100_common_probe\ncaused by out of bound access of array rm3100_samp_rates (because of\nunderlying hardware failures). Add boundary check to prevent out of\nbound access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "295e02f2-9dbf-47c9-ac45-f5911bff444c",
      "id": "CVE-2024-26829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ir_toy: fix a memleak in irtoy_tx\n\nWhen irtoy_command fails, buf should be freed since it is allocated by\nirtoy_tx, or there is a memleak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e9131c7-e05f-4ab4-9d88-c7a10de4502f",
      "id": "CVE-2024-26882",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()\n\nApply the same fix than ones found in :\n\n8d975c15c0cd (\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\")\n1ca1ba465e55 (\"geneve: make sure to pull inner header in geneve_rx()\")\n\nWe have to save skb-\u003enetwork_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\n\npskb_inet_may_pull() makes sure the needed headers are in skb-\u003ehead.\n\nsyzbot reported:\nBUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n  ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409\n  __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389\n  ipgre_rcv net/ipv4/ip_gre.c:411 [inline]\n  gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447\n  gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n  dst_input include/net/dst.h:461 [inline]\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\n  netif_receive_skb_internal net/core/dev.c:5734 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5793\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556\n  tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\n  call_write_iter include/linux/fs.h:2087 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb6b/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n  __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\n  alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133\n  alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204\n  skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909\n  tun_build_skb drivers/net/tun.c:1686 [inline]\n  tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055\n  call_write_iter include/linux/fs.h:2087 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb6b/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be4fd798-f9ec-4700-b259-03575e52a54a",
      "id": "CVE-2024-26955",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: prevent kernel bug at submit_bh_wbc()\n\nFix a bug where nilfs_get_block() returns a successful status when\nsearching and inserting the specified block both fail inconsistently.  If\nthis inconsistent behavior is not due to a previously fixed bug, then an\nunexpected race is occurring, so return a temporary error -EAGAIN instead.\n\nThis prevents callers such as __block_write_begin_int() from requesting a\nread into a buffer that is not mapped, which would cause the BUG_ON check\nfor the BH_Mapped flag in submit_bh_wbc() to fail.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e15b6488-cad6-4d07-9cba-b669761a6ad2",
      "id": "CVE-2024-35837",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: clear BM pool before initialization\n\nRegister value persist after booting the kernel using\nkexec which results in kernel panic. Thus clear the\nBM pool registers before initialisation to fix the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4991eaaf-627a-43d7-979f-53ae46a3e0f7",
      "id": "CVE-2024-35888",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerspan: make sure erspan_base_hdr is present in skb-\u003ehead\n\nsyzbot reported a problem in ip6erspan_rcv() [1]\n\nIssue is that ip6erspan_rcv() (and erspan_rcv()) no longer make\nsure erspan_base_hdr is present in skb linear part (skb-\u003ehead)\nbefore getting @ver field from it.\n\nAdd the missing pskb_may_pull() calls.\n\nv2: Reload iph pointer in erspan_rcv() after pskb_may_pull()\n    because skb-\u003ehead might have changed.\n\n[1]\n\n BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline]\n BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n  pskb_may_pull include/linux/skbuff.h:2756 [inline]\n  ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n  gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:460 [inline]\n  ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5538 [inline]\n  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652\n  netif_receive_skb_internal net/core/dev.c:5738 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5798\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549\n  tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  tun_alloc_skb drivers/net/tun.c:1525 [inline]\n  tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nCPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2193faa-ea6d-4099-b656-173cf6327edf",
      "id": "CVE-2024-36893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Check for port partner validity before consuming it\n\ntypec_register_partner() does not guarantee partner registration\nto always succeed. In the event of failure, port-\u003epartner is set\nto the error value or NULL. Given that port-\u003epartner validity is\nnot checked, this results in the following crash:\n\nUnable to handle kernel NULL pointer dereference at virtual address xx\n pc : run_state_machine+0x1bc8/0x1c08\n lr : run_state_machine+0x1b90/0x1c08\n..\n Call trace:\n   run_state_machine+0x1bc8/0x1c08\n   tcpm_state_machine_work+0x94/0xe4\n   kthread_worker_fn+0x118/0x328\n   kthread+0x1d0/0x23c\n   ret_from_fork+0x10/0x20\n\nTo prevent the crash, check for port-\u003epartner validity before\nderefencing it in all the call sites.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6aa08101-62c0-41de-bca6-3c4a94b53406",
      "id": "CVE-2024-37021",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: manager: add owner module and take its refcount\n\nThe current implementation of the fpga manager assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module's refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the manager if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_manager\nstruct and use it to take the module's refcount. Modify the functions for\nregistering the manager to take an additional owner module parameter and\nrename them to avoid conflicts. Use the old function names for helper\nmacros that automatically set the module that registers the manager as the\nowner. This ensures compatibility with existing low-level control modules\nand reduces the chances of registering a manager without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga manager.\n\nOther changes: opportunistically move put_device() from __fpga_mgr_get() to\nfpga_mgr_get() and of_fpga_mgr_get() to improve code clarity since the\nmanager device is taken in these functions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0964966b-857e-4f13-9328-2da31256d010",
      "id": "CVE-2024-38583",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free of timer for log writer thread\n\nPatch series \"nilfs2: fix log writer related issues\".\n\nThis bug fix series covers three nilfs2 log writer-related issues,\nincluding a timer use-after-free issue and potential deadlock issue on\nunmount, and a potential freeze issue in event synchronization found\nduring their analysis.  Details are described in each commit log.\n\n\nThis patch (of 3):\n\nA use-after-free issue has been reported regarding the timer sc_timer on\nthe nilfs_sc_info structure.\n\nThe problem is that even though it is used to wake up a sleeping log\nwriter thread, sc_timer is not shut down until the nilfs_sc_info structure\nis about to be freed, and is used regardless of the thread's lifetime.\n\nFix this issue by limiting the use of sc_timer only while the log writer\nthread is alive.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f079da6-0bca-404c-81fa-167fbacff075",
      "id": "CVE-2024-38633",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: max3100: Update uart_driver_registered on driver removal\n\nThe removal of the last MAX3100 device triggers the removal of\nthe driver. However, code doesn't update the respective global\nvariable and after insmod — rmmod — insmod cycle the kernel\noopses:\n\n  max3100 spi-PRP0001:01: max3100_probe: adding port 0\n  BUG: kernel NULL pointer dereference, address: 0000000000000408\n  ...\n  RIP: 0010:serial_core_register_port+0xa0/0x840\n  ...\n   max3100_probe+0x1b6/0x280 [max3100]\n   spi_probe+0x8d/0xb0\n\nUpdate the actual state so next time UART driver will be registered\nagain.\n\nHugo also noticed, that the error path in the probe also affected\nby having the variable set, and not cleared. Instead of clearing it\nmove the assignment after the successfull uart_register_driver() call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4dfc189b-ed76-4da8-9618-00a9c71ef980",
      "id": "CVE-2024-40927",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Handle TD clearing for multiple streams case\n\nWhen multiple streams are in use, multiple TDs might be in flight when\nan endpoint is stopped. We need to issue a Set TR Dequeue Pointer for\neach, to ensure everything is reset properly and the caches cleared.\nChange the logic so that any N\u003e1 TDs found active for different streams\nare deferred until after the first one is processed, calling\nxhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to\nqueue another command until we are done with all of them. Also change\nthe error/\"should never happen\" paths to ensure we at least clear any\naffected TDs, even if we can't issue a command to clear the hardware\ncache, and complain loudly with an xhci_warn() if this ever happens.\n\nThis problem case dates back to commit e9df17eb1408 (\"USB: xhci: Correct\nassumptions about number of rings per endpoint.\") early on in the XHCI\ndriver's life, when stream support was first added.\nIt was then identified but not fixed nor made into a warning in commit\n674f8438c121 (\"xhci: split handling halted endpoints into two steps\"),\nwhich added a FIXME comment for the problem case (without materially\nchanging the behavior as far as I can tell, though the new logic made\nthe problem more obvious).\n\nThen later, in commit 94f339147fc3 (\"xhci: Fix failure to give back some\ncached cancelled URBs.\"), it was acknowledged again.\n\n[Mathias: commit 94f339147fc3 (\"xhci: Fix failure to give back some cached\ncancelled URBs.\") was a targeted regression fix to the previously mentioned\npatch. Users reported issues with usb stuck after unmounting/disconnecting\nUAS devices. This rolled back the TD clearing of multiple streams to its\noriginal state.]\n\nApparently the commit author was aware of the problem (yet still chose\nto submit it): It was still mentioned as a FIXME, an xhci_dbg() was\nadded to log the problem condition, and the remaining issue was mentioned\nin the commit description. The choice of making the log type xhci_dbg()\nfor what is, at this point, a completely unhandled and known broken\ncondition is puzzling and unfortunate, as it guarantees that no actual\nusers would see the log in production, thereby making it nigh\nundebuggable (indeed, even if you turn on DEBUG, the message doesn't\nreally hint at there being a problem at all).\n\nIt took me *months* of random xHC crashes to finally find a reliable\nrepro and be able to do a deep dive debug session, which could all have\nbeen avoided had this unhandled, broken condition been actually reported\nwith a warning, as it should have been as a bug intentionally left in\nunfixed (never mind that it shouldn't have been left in at all).\n\n\u003e Another fix to solve clearing the caches of all stream rings with\n\u003e cancelled TDs is needed, but not as urgent.\n\n3 years after that statement and 14 years after the original bug was\nintroduced, I think it's finally time to fix it. And maybe next time\nlet's not leave bugs unfixed (that are actually worse than the original\nbug), and let's actually get people to review kernel commits please.\n\nFixes xHC crashes and IOMMU faults with UAS devices when handling\nerrors/faults. Easiest repro is to use `hdparm` to mark an early sector\n(e.g. 1024) on a disk as bad, then `cat /dev/sdX \u003e /dev/null` in a loop.\nAt least in the case of JMicron controllers, the read errors end up\nhaving to cancel two TDs (for two queued requests to different streams)\nand the one that didn't get cleared properly ends up faulting the xHC\nentirely when it tries to access DMA pages that have since been unmapped,\nreferred to by the stale TDs. This normally happens quickly (after two\nor three loops). After this fix, I left the `cat` in a loop running\novernight and experienced no xHC failures, with all read errors\nrecovered properly. Repro'd and tested on an Apple M1 Mac Mini\n(dwc3 host).\n\nOn systems without an IOMMU, this bug would instead silently corrupt\nfreed memory, making this a\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b4e2d5e-aafe-4d74-adb7-c7291c36fe42",
      "id": "CVE-2024-40970",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nAvoid hw_desc array overrun in dw-axi-dmac\n\nI have a use case where nr_buffers = 3 and in which each descriptor is composed by 3\nsegments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put()\nhandles the hw_desc considering the descs_allocated, this scenario would result in a\nkernel panic (hw_desc array will be overrun).\n\nTo fix this, the proposal is to add a new member to the axi_dma_desc structure,\nwhere we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in\naxi_desc_put() to handle the hw_desc array correctly.\n\nAdditionally I propose to remove the axi_chan_start_first_queued() call after completing\nthe transfer, since it was identified that unbalance can occur (started descriptors can\nbe interrupted and transfer ignored due to DMA channel not being enabled).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c8617c5-065c-4c1f-9d70-cb8cd0261ae2",
      "id": "CVE-2024-56369",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/modes: Avoid divide by zero harder in drm_mode_vrefresh()\n\ndrm_mode_vrefresh() is trying to avoid divide by zero\nby checking whether htotal or vtotal are zero. But we may\nstill end up with a div-by-zero of vtotal*htotal*...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21b875a5-1db5-4bd0-b9b3-bedf251c0aba",
      "id": "CVE-2024-42156",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Wipe copies of clear-key structures on failure\n\nWipe all sensitive data from stack for all IOCTLs, which convert a\nclear-key into a protected- or secure-key.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3e09504-2d95-49e4-a101-ed15b530c1d4",
      "id": "CVE-2024-42244",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mos7840: fix crash on resume\n\nSince commit c49cfa917025 (\"USB: serial: use generic method if no\nalternative is provided in usb serial layer\"), USB serial core calls the\ngeneric resume implementation when the driver has not provided one.\n\nThis can trigger a crash on resume with mos7840 since support for\nmultiple read URBs was added back in 2011. Specifically, both port read\nURBs are now submitted on resume for open ports, but the context pointer\nof the second URB is left set to the core rather than mos7840 port\nstructure.\n\nFix this by implementing dedicated suspend and resume functions for\nmos7840.\n\nTested with Delock 87414 USB 2.0 to 4x serial adapter.\n\n[ johan: analyse crash and rewrite commit message; set busy flag on\n         resume; drop bulk-in check; drop unnecessary usb_kill_urb() ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "011b7540-5b79-47d7-ac8b-7bfd464a86a1",
      "id": "CVE-2024-43905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix the null pointer dereference for vega10_hwmgr\n\nCheck return value and conduct null pointer handling to avoid null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9af7a28a-74af-4aa6-bd0a-1c6bec2d8d26",
      "id": "CVE-2024-44939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix null ptr deref in dtInsertEntry\n\n[syzbot reported]\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nRIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713\n...\n[Analyze]\nIn dtInsertEntry(), when the pointer h has the same value as p, after writing\nname in UniStrncpy_to_le(), p-\u003eheader.flag will be cleared. This will cause the\npreviously true judgment \"p-\u003eheader.flag \u0026 BT-LEAF\" to change to no after writing\nthe name operation, this leads to entering an incorrect branch and accessing the\nuninitialized object ih when judging this condition for the second time.\n\n[Fix]\nAfter got the page, check freelist first, if freelist == 0 then exit dtInsert()\nand return -EINVAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "537cc466-acad-4133-9214-aea47afd6d80",
      "id": "CVE-2024-45025",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE\n\ncopy_fd_bitmaps(new, old, count) is expected to copy the first\ncount/BITS_PER_LONG bits from old-\u003efull_fds_bits[] and fill\nthe rest with zeroes.  What it does is copying enough words\n(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.\nThat works fine, *if* all bits past the cutoff point are\nclear.  Otherwise we are risking garbage from the last word\nwe'd copied.\n\nFor most of the callers that is true - expand_fdtable() has\ncount equal to old-\u003emax_fds, so there's no open descriptors\npast count, let alone fully occupied words in -\u003eopen_fds[],\nwhich is what bits in -\u003efull_fds_bits[] correspond to.\n\nThe other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),\nwhich is the smallest multiple of BITS_PER_LONG that covers all\nopened descriptors below max_fds.  In the common case (copying on\nfork()) max_fds is ~0U, so all opened descriptors will be below\nit and we are fine, by the same reasons why the call in expand_fdtable()\nis safe.\n\nUnfortunately, there is a case where max_fds is less than that\nand where we might, indeed, end up with junk in -\u003efull_fds_bits[] -\nclose_range(from, to, CLOSE_RANGE_UNSHARE) with\n\t* descriptor table being currently shared\n\t* 'to' being above the current capacity of descriptor table\n\t* 'from' being just under some chunk of opened descriptors.\nIn that case we end up with observably wrong behaviour - e.g. spawn\na child with CLONE_FILES, get all descriptors in range 0..127 open,\nthen close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) ending\nup with descriptor #128, despite #64 being observably not open.\n\nThe minimally invasive fix would be to deal with that in dup_fd().\nIf this proves to add measurable overhead, we can go that way, but\nlet's try to fix copy_fd_bitmaps() first.\n\n* new helper: bitmap_copy_and_expand(to, from, bits_to_copy, size).\n* make copy_fd_bitmaps() take the bitmap size in words, rather than\nbits; it's 'count' argument is always a multiple of BITS_PER_LONG,\nso we are not losing any information, and that way we can use the\nsame helper for all three bitmaps - compiler will see that count\nis a multiple of BITS_PER_LONG for the large ones, so it'll generate\nplain memcpy()+memset().\n\nReproducer added to tools/testing/selftests/core/close_range_test.c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c09ca3ca-e7f1-48ef-b5e7-3916d7b6f9db",
      "id": "CVE-2024-46676",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: Add poll mod list filling check\n\nIn case of im_protocols value is 1 and tm_protocols value is 0 this\ncombination successfully passes the check\n'if (!im_protocols \u0026\u0026 !tm_protocols)' in the nfc_start_poll().\nBut then after pn533_poll_create_mod_list() call in pn533_start_poll()\npoll mod list will remain empty and dev-\u003epoll_mod_count will remain 0\nwhich lead to division by zero.\n\nNormally no im protocol has value 1 in the mask, so this combination is\nnot expected by driver. But these protocol values actually come from\nuserspace via Netlink interface (NFC_CMD_START_POLL operation). So a\nbroken or malicious program may pass a message containing a \"bad\"\ncombination of protocol parameter values so that dev-\u003epoll_mod_count\nis not incremented inside pn533_poll_create_mod_list(), thus leading\nto division by zero.\nCall trace looks like:\nnfc_genl_start_poll()\n  nfc_start_poll()\n    -\u003estart_poll()\n    pn533_start_poll()\n\nAdd poll mod list filling check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd966087-027a-4d15-82b7-ed4dbe1cd8fa",
      "id": "CVE-2024-46738",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: Fix use-after-free when removing resource in vmci_resource_remove()\n\nWhen removing a resource from vmci_resource_table in\nvmci_resource_remove(), the search is performed using the resource\nhandle by comparing context and resource fields.\n\nIt is possible though to create two resources with different types\nbut same handle (same context and resource fields).\n\nWhen trying to remove one of the resources, vmci_resource_remove()\nmay not remove the intended one, but the object will still be freed\nas in the case of the datagram type in vmci_datagram_destroy_handle().\nvmci_resource_table will still hold a pointer to this freed resource\nleading to a use-after-free vulnerability.\n\nBUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]\nBUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147\nRead of size 4 at addr ffff88801c16d800 by task syz-executor197/1592\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106\n print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239\n __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425\n kasan_report+0x38/0x51 mm/kasan/report.c:442\n vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]\n vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147\n vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182\n ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444\n kref_put include/linux/kref.h:65 [inline]\n vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline]\n vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195\n vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143\n __fput+0x261/0xa34 fs/file_table.c:282\n task_work_run+0xf0/0x194 kernel/task_work.c:164\n tracehook_notify_resume include/linux/tracehook.h:189 [inline]\n exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187\n exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220\n __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline]\n syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313\n do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x6e/0x0\n\nThis change ensures the type is also checked when removing\nthe resource from vmci_resource_table in vmci_resource_remove().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc6151f4-1818-4c4f-9543-f80a69963a7c",
      "id": "CVE-2024-46857",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix bridge mode operations when there are no VFs\n\nCurrently, trying to set the bridge mode attribute when numvfs=0 leads to a\ncrash:\n\nbridge link set dev eth2 hwmode vepa\n\n[  168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030\n[...]\n[  168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core]\n[...]\n[  168.976037] Call Trace:\n[  168.976188]  \u003cTASK\u003e\n[  168.978620]  _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core]\n[  168.979074]  mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core]\n[  168.979471]  rtnl_bridge_setlink+0xe9/0x1f0\n[  168.979714]  rtnetlink_rcv_msg+0x159/0x400\n[  168.980451]  netlink_rcv_skb+0x54/0x100\n[  168.980675]  netlink_unicast+0x241/0x360\n[  168.980918]  netlink_sendmsg+0x1f6/0x430\n[  168.981162]  ____sys_sendmsg+0x3bb/0x3f0\n[  168.982155]  ___sys_sendmsg+0x88/0xd0\n[  168.985036]  __sys_sendmsg+0x59/0xa0\n[  168.985477]  do_syscall_64+0x79/0x150\n[  168.987273]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  168.987773] RIP: 0033:0x7f8f7950f917\n\n(esw-\u003efdb_table.legacy.vepa_fdb is null)\n\nThe bridge mode is only relevant when there are multiple functions per\nport. Therefore, prevent setting and getting this setting when there are no\nVFs.\n\nNote that after this change, there are no settings to change on the PF\ninterface using `bridge link` when there are no VFs, so the interface no\nlonger appears in the `bridge link` output.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "706abc5e-2f97-4832-8972-730ff33b1a1a",
      "id": "CVE-2024-47663",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: iio: frequency: ad9834: Validate frequency parameter value\n\nIn ad9834_write_frequency() clk_get_rate() can return 0. In such case\nad9834_calc_freqreg() call will lead to division by zero. Checking\n'if (fout \u003e (clk_freq / 2))' doesn't protect in case of 'fout' is 0.\nad9834_write_frequency() is called from ad9834_write(), where fout is\ntaken from text buffer, which can contain any value.\n\nModify parameters checking.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3feb191-f93b-458d-b482-c948faa58eb0",
      "id": "CVE-2024-49877",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate\n\nWhen doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger\nNULL pointer dereference in the following ocfs2_set_buffer_uptodate() if\nbh is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6214224f-23e1-4c7f-b581-e0a19e8c00e5",
      "id": "CVE-2020-14314",
      "description": "A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd71112f-1c40-4696-8148-8a3753d322f9",
      "id": "CVE-2024-49924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: pxafb: Fix possible use after free in pxafb_task()\n\nIn the pxafb_probe function, it calls the pxafb_init_fbinfo function,\nafter which \u0026fbi-\u003etask is associated with pxafb_task. Moreover,\nwithin this pxafb_init_fbinfo function, the pxafb_blank function\nwithin the \u0026pxafb_ops struct is capable of scheduling work.\n\nIf we remove the module which will call pxafb_remove to make cleanup,\nit will call unregister_framebuffer function which can call\ndo_unregister_framebuffer to free fbi-\u003efb through\nput_fb_info(fb_info), while the work mentioned above will be used.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                                CPU1\n\n                                   | pxafb_task\npxafb_remove                       |\nunregister_framebuffer(info)       |\ndo_unregister_framebuffer(fb_info) |\nput_fb_info(fb_info)               |\n// free fbi-\u003efb                    | set_ctrlr_state(fbi, state)\n                                   | __pxafb_lcd_power(fbi, 0)\n                                   | fbi-\u003elcd_power(on, \u0026fbi-\u003efb.var)\n                                   | //use fbi-\u003efb\n\nFix it by ensuring that the work is canceled before proceeding\nwith the cleanup in pxafb_remove.\n\nNote that only root user can remove the driver at runtime.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83368bf2-bacf-49ef-a4da-6114b4fdd045",
      "id": "CVE-2024-49962",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()\n\nACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0\n\nACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause\nNULL pointer dereference later.\n\n[ rjw: Subject and changelog edits ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "75817f69-601b-48b7-978a-0ab2ae54d36c",
      "id": "CVE-2024-50236",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: Fix memory leak in management tx\n\nIn the current logic, memory is allocated for storing the MSDU context\nduring management packet TX but this memory is not being freed during\nmanagement TX completion. Similar leaks are seen in the management TX\ncleanup logic.\n\nKmemleak reports this problem as below,\n\nunreferenced object 0xffffff80b64ed250 (size 16):\n  comm \"kworker/u16:7\", pid 148, jiffies 4294687130 (age 714.199s)\n  hex dump (first 16 bytes):\n    00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00  .+.......t......\n  backtrace:\n    [\u003cffffffe6e7b245dc\u003e] __kmem_cache_alloc_node+0x1e4/0x2d8\n    [\u003cffffffe6e7adde88\u003e] kmalloc_trace+0x48/0x110\n    [\u003cffffffe6bbd765fc\u003e] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core]\n    [\u003cffffffe6bbd3eed4\u003e] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core]\n    [\u003cffffffe6e78d5974\u003e] process_scheduled_works+0x1ac/0x400\n    [\u003cffffffe6e78d60b8\u003e] worker_thread+0x208/0x328\n    [\u003cffffffe6e78dc890\u003e] kthread+0x100/0x1c0\n    [\u003cffffffe6e78166c0\u003e] ret_from_fork+0x10/0x20\n\nFree the memory during completion and cleanup to fix the leak.\n\nProtect the mgmt_pending_tx idr_remove() operation in\nath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar-\u003edata_lock similar to\nother instances.\n\nTested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b1d66c3-8236-4777-b6bc-86a949a7fc4f",
      "id": "CVE-2024-50273",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reinitialize delayed ref list after deleting it from the list\n\nAt insert_delayed_ref() if we need to update the action of an existing\nref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's\nref_add_list using list_del(), which leaves the ref's add_list member\nnot reinitialized, as list_del() sets the next and prev members of the\nlist to LIST_POISON1 and LIST_POISON2, respectively.\n\nIf later we end up calling drop_delayed_ref() against the ref, which can\nhappen during merging or when destroying delayed refs due to a transaction\nabort, we can trigger a crash since at drop_delayed_ref() we call\nlist_empty() against the ref's add_list, which returns false since\nthe list was not reinitialized after the list_del() and as a consequence\nwe call list_del() again at drop_delayed_ref(). This results in an\ninvalid list access since the next and prev members are set to poison\npointers, resulting in a splat if CONFIG_LIST_HARDENED and\nCONFIG_DEBUG_LIST are set or invalid poison pointer dereferences\notherwise.\n\nSo fix this by deleting from the list with list_del_init() instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17843980-f888-46fd-8512-6276449e319d",
      "id": "CVE-2024-53219",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: use pages instead of pointer for kernel direct IO\n\nWhen trying to insert a 10MB kernel module kept in a virtio-fs with cache\ndisabled, the following warning was reported:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ......\n  Modules linked in:\n  CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:__alloc_pages+0x2bf/0x380\n  ......\n  Call Trace:\n   \u003cTASK\u003e\n   ? __warn+0x8e/0x150\n   ? __alloc_pages+0x2bf/0x380\n   __kmalloc_large_node+0x86/0x160\n   __kmalloc+0x33c/0x480\n   virtio_fs_enqueue_req+0x240/0x6d0\n   virtio_fs_wake_pending_and_unlock+0x7f/0x190\n   queue_request_and_unlock+0x55/0x60\n   fuse_simple_request+0x152/0x2b0\n   fuse_direct_io+0x5d2/0x8c0\n   fuse_file_read_iter+0x121/0x160\n   __kernel_read+0x151/0x2d0\n   kernel_read+0x45/0x50\n   kernel_read_file+0x1a9/0x2a0\n   init_module_from_file+0x6a/0xe0\n   idempotent_init_module+0x175/0x230\n   __x64_sys_finit_module+0x5d/0xb0\n   x64_sys_call+0x1c3/0x9e0\n   do_syscall_64+0x3d/0xc0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   ......\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n\nThe warning is triggered as follows:\n\n1) syscall finit_module() handles the module insertion and it invokes\nkernel_read_file() to read the content of the module first.\n\n2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and\npasses it to kernel_read(). kernel_read() constructs a kvec iter by\nusing iov_iter_kvec() and passes it to fuse_file_read_iter().\n\n3) virtio-fs disables the cache, so fuse_file_read_iter() invokes\nfuse_direct_io(). As for now, the maximal read size for kvec iter is\nonly limited by fc-\u003emax_read. For virtio-fs, max_read is UINT_MAX, so\nfuse_direct_io() doesn't split the 10MB buffer. It saves the address and\nthe size of the 10MB-sized buffer in out_args[0] of a fuse request and\npasses the fuse request to virtio_fs_wake_pending_and_unlock().\n\n4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to\nqueue the request. Because virtiofs need DMA-able address, so\nvirtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for\nall fuse args, copies these args into the bounce buffer and passed the\nphysical address of the bounce buffer to virtiofsd. The total length of\nthese fuse args for the passed fuse request is about 10MB, so\ncopy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and\nit triggers the warning in __alloc_pages():\n\n\tif (WARN_ON_ONCE_GFP(order \u003e MAX_PAGE_ORDER, gfp))\n\t\treturn NULL;\n\n5) virtio_fs_enqueue_req() will retry the memory allocation in a\nkworker, but it won't help, because kmalloc() will always return NULL\ndue to the abnormal size and finit_module() will hang forever.\n\nA feasible solution is to limit the value of max_read for virtio-fs, so\nthe length passed to kmalloc() will be limited. However it will affect\nthe maximal read size for normal read. And for virtio-fs write initiated\nfrom kernel, it has the similar problem but now there is no way to limit\nfc-\u003emax_write in kernel.\n\nSo instead of limiting both the values of max_read and max_write in\nkernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as\ntrue in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use\npages instead of pointer to pass the KVEC_IO data.\n\nAfter switching to pages for KVEC_IO data, these pages will be used for\nDMA through virtio-fs. If these pages are backed by vmalloc(),\n{flush|invalidate}_kernel_vmap_range() are necessary to flush or\ninvalidate the cache before the DMA operation. So add two new fields in\nfuse_args_pages to record the base address of vmalloc area and the\ncondition indicating whether invalidation is needed. Perform the flush\nin fuse_get_user_pages() for write operations and the invalidation in\nfuse_release_user_pages() for read operations.\n\nIt may seem necessary to introduce another fie\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2768f85-0f49-4262-ad3d-48e9db829403",
      "id": "CVE-2024-55916",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: util: Avoid accessing a ringbuffer not initialized yet\n\nIf the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is\nfully initialized, we can hit the panic below:\n\nhv_utils: Registering HyperV Utility Driver\nhv_vmbus: registering driver hv_utils\n...\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1\nRIP: 0010:hv_pkt_iter_first+0x12/0xd0\nCall Trace:\n...\n vmbus_recvpacket\n hv_kvp_onchannelcallback\n vmbus_on_event\n tasklet_action_common\n tasklet_action\n handle_softirqs\n irq_exit_rcu\n sysvec_hyperv_stimer0\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_hyperv_stimer0\n...\n kvp_register_done\n hvt_op_read\n vfs_read\n ksys_read\n __x64_sys_read\n\nThis can happen because the KVP/VSS channel callback can be invoked\neven before the channel is fully opened:\n1) as soon as hv_kvp_init() -\u003e hvutil_transport_init() creates\n/dev/vmbus/hv_kvp, the kvp daemon can open the device file immediately and\nregister itself to the driver by writing a message KVP_OP_REGISTER1 to the\nfile (which is handled by kvp_on_msg() -\u003ekvp_handle_handshake()) and\nreading the file for the driver's response, which is handled by\nhvt_op_read(), which calls hvt-\u003eon_read(), i.e. kvp_register_done().\n\n2) the problem with kvp_register_done() is that it can cause the\nchannel callback to be called even before the channel is fully opened,\nand when the channel callback is starting to run, util_probe()-\u003e\nvmbus_open() may have not initialized the ringbuffer yet, so the\ncallback can hit the panic of NULL pointer dereference.\n\nTo reproduce the panic consistently, we can add a \"ssleep(10)\" for KVP in\n__vmbus_open(), just before the first hv_ringbuffer_init(), and then we\nunload and reload the driver hv_utils, and run the daemon manually within\nthe 10 seconds.\n\nFix the panic by reordering the steps in util_probe() so the char dev\nentry used by the KVP or VSS daemon is not created until after\nvmbus_open() has completed. This reordering prevents the race condition\nfrom happening.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10905090-4698-4252-9e9b-f97c587cc121",
      "id": "CVE-2024-56586",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.\n\ncreating a large files during checkpoint disable until it runs out of\nspace and then delete it, then remount to enable checkpoint again, and\nthen unmount the filesystem triggers the f2fs_bug_on as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/inode.c:896!\nCPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360\nOops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:f2fs_evict_inode+0x58c/0x610\nCall Trace:\n __die_body+0x15/0x60\n die+0x33/0x50\n do_trap+0x10a/0x120\n f2fs_evict_inode+0x58c/0x610\n do_error_trap+0x60/0x80\n f2fs_evict_inode+0x58c/0x610\n exc_invalid_op+0x53/0x60\n f2fs_evict_inode+0x58c/0x610\n asm_exc_invalid_op+0x16/0x20\n f2fs_evict_inode+0x58c/0x610\n evict+0x101/0x260\n dispose_list+0x30/0x50\n evict_inodes+0x140/0x190\n generic_shutdown_super+0x2f/0x150\n kill_block_super+0x11/0x40\n kill_f2fs_super+0x7d/0x140\n deactivate_locked_super+0x2a/0x70\n cleanup_mnt+0xb3/0x140\n task_work_run+0x61/0x90\n\nThe root cause is: creating large files during disable checkpoint\nperiod results in not enough free segments, so when writing back root\ninode will failed in f2fs_enable_checkpoint. When umount the file\nsystem after enabling checkpoint, the root inode is dirty in\nf2fs_evict_inode function, which triggers BUG_ON. The steps to\nreproduce are as follows:\n\ndd if=/dev/zero of=f2fs.img bs=1M count=55\nmount f2fs.img f2fs_dir -o checkpoint=disable:10%\ndd if=/dev/zero of=big bs=1M count=50\nsync\nrm big\nmount -o remount,checkpoint=enable f2fs_dir\numount f2fs_dir\n\nLet's redirty inode when there is not free segments during checkpoint\nis disable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88b8e668-ab66-4224-8f83-bda1436bc672",
      "id": "CVE-2025-21927",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n\nnvme_tcp_recv_pdu() doesn't check the validity of the header length.\nWhen header digests are enabled, a target might send a packet with an\ninvalid header length (e.g. 255), causing nvme_tcp_verify_hdgst()\nto access memory outside the allocated area and cause memory corruptions\nby overwriting it with the calculated digest.\n\nFix this by rejecting packets with an unexpected header length.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f54e6537-e0bb-4b42-aed6-284e9c1e4300",
      "id": "CVE-2025-37749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ppp: Add bound checking for skb data on ppp_sync_txmung\n\nEnsure we have enough data in linear buffer from skb before accessing\ninitial bytes. This prevents potential out-of-bounds accesses\nwhen processing short packets.\n\nWhen ppp_sync_txmung receives an incoming package with an empty\npayload:\n(remote) gef➤  p *(struct pppoe_hdr *) (skb-\u003ehead + skb-\u003enetwork_header)\n$18 = {\n\ttype = 0x1,\n\tver = 0x1,\n\tcode = 0x0,\n\tsid = 0x2,\n        length = 0x0,\n\ttag = 0xffff8880371cdb96\n}\n\nfrom the skb struct (trimmed)\n      tail = 0x16,\n      end = 0x140,\n      head = 0xffff88803346f400 \"4\",\n      data = 0xffff88803346f416 \":\\377\",\n      truesize = 0x380,\n      len = 0x0,\n      data_len = 0x0,\n      mac_len = 0xe,\n      hdr_len = 0x0,\n\nit is not safe to access data[2].\n\n[pabeni@redhat.com: fixed subj typo]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1da69b3-ddad-4cf4-8545-5d10ebc7cc3f",
      "id": "CVE-2025-37829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy-\u003ecpus mask. scpi_cpufreq_get_rate() does not check for\nthis case, which results in a NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c94f5119-5521-4cf8-9060-ae050f802a24",
      "id": "CVE-2025-37883",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Add check for get_zeroed_page()\n\nAdd check for the return value of get_zeroed_page() in\nsclp_console_init() to prevent null pointer dereference.\nFurthermore, to solve the memory leak caused by the loop\nallocation, add a free helper to do the free job.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2085170e-4e83-4024-9203-80848d439c01",
      "id": "CVE-2025-37885",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Reset IRTE to host control if *new* route isn't postable\n\nRestore an IRTE back to host control (remapped or posted MSI mode) if the\n*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of\nthe GSI routing type.  Updating the IRTE if and only if the new GSI is an\nMSI results in KVM leaving an IRTE posting to a vCPU.\n\nThe dangling IRTE can result in interrupts being incorrectly delivered to\nthe guest, and in the worst case scenario can result in use-after-free,\ne.g. if the VM is torn down, but the underlying host IRQ isn't freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "25190516-4f7b-4caa-ac6c-5774b77e4bcc",
      "id": "CVE-2025-37989",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: leds: fix memory leak\n\nA network restart test on a router led to an out-of-memory condition,\nwhich was traced to a memory leak in the PHY LED trigger code.\n\nThe root cause is misuse of the devm API. The registration function\n(phy_led_triggers_register) is called from phy_attach_direct, not\nphy_probe, and the unregister function (phy_led_triggers_unregister)\nis called from phy_detach, not phy_remove. This means the register and\nunregister functions can be called multiple times for the same PHY\ndevice, but devm-allocated memory is not freed until the driver is\nunbound.\n\nThis also prevents kmemleak from detecting the leak, as the devm API\ninternally stores the allocated pointer.\n\nFix this by replacing devm_kzalloc/devm_kcalloc with standard\nkzalloc/kcalloc, and add the corresponding kfree calls in the unregister\npath.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e9bcb80-9c1b-42c9-9cd6-e435234cc38c",
      "id": "CVE-2025-38065",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: Do not truncate file size\n\n'len' is used to store the result of i_size_read(), so making 'len'\na size_t results in truncation to 4GiB on 32-bit systems.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2e8fd84-61f1-4df9-9615-eb096f830fd6",
      "id": "CVE-2025-38173",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: marvell/cesa - Handle zero-length skcipher requests\n\nDo not access random memory for zero-length skcipher requests.\nJust return 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fba5e3b0-3a07-4c8d-a91b-bec4cc1cd7e8",
      "id": "CVE-2025-38184",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer\n\nThe reproduction steps:\n1. create a tun interface\n2. enable l2 bearer\n3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun\n\ntipc: Started in network mode\ntipc: Node identity 8af312d38a21, cluster identity 4711\ntipc: Enabled bearer \u003ceth:syz_tun\u003e, priority 1\nOops: general protection fault\nKASAN: null-ptr-deref in range\nCPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT\nHardware name: QEMU Ubuntu 24.04 PC\nRIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0\n\nthe ub was in fact a struct dev.\n\nwhen bid != 0 \u0026\u0026 skip_cnt != 0, bearer_list[bid] may be NULL or\nother media when other thread changes it.\n\nfix this by checking media_id.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d304aa22-2954-497b-bc1d-326c930d0cdb",
      "id": "CVE-2025-38262",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: uartlite: register uart driver in init\n\nWhen two instances of uart devices are probing, a concurrency race can\noccur. If one thread calls uart_register_driver function, which first\nallocates and assigns memory to 'uart_state' member of uart_driver\nstructure, the other instance can bypass uart driver registration and\ncall ulite_assign. This calls uart_add_one_port, which expects the uart\ndriver to be fully initialized. This leads to a kernel panic due to a\nnull pointer dereference:\n\n[    8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8\n[    8.156982] #PF: supervisor write access in kernel mode\n[    8.156984] #PF: error_code(0x0002) - not-present page\n[    8.156986] PGD 0 P4D 0\n...\n[    8.180668] RIP: 0010:mutex_lock+0x19/0x30\n[    8.188624] Call Trace:\n[    8.188629]  ? __die_body.cold+0x1a/0x1f\n[    8.195260]  ? page_fault_oops+0x15c/0x290\n[    8.209183]  ? __irq_resolve_mapping+0x47/0x80\n[    8.209187]  ? exc_page_fault+0x64/0x140\n[    8.209190]  ? asm_exc_page_fault+0x22/0x30\n[    8.209196]  ? mutex_lock+0x19/0x30\n[    8.223116]  uart_add_one_port+0x60/0x440\n[    8.223122]  ? proc_tty_register_driver+0x43/0x50\n[    8.223126]  ? tty_register_driver+0x1ca/0x1e0\n[    8.246250]  ulite_probe+0x357/0x4b0 [uartlite]\n\nTo prevent it, move uart driver registration in to init function. This\nwill ensure that uart_driver is always registered when probe function\nis called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5c6aed3-e13f-473b-94a1-278c229e0890",
      "id": "CVE-2025-38363",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tegra: Fix a possible null pointer dereference\n\nIn tegra_crtc_reset(), new memory is allocated with kzalloc(), but\nno check is performed. Before calling __drm_atomic_helper_crtc_reset,\nstate should be checked to prevent possible null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b51742d5-d598-4152-b9fc-566ea167435d",
      "id": "CVE-2025-38481",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large\n\nThe handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to\nhold the array of `struct comedi_insn`, getting the length from the\n`n_insns` member of the `struct comedi_insnlist` supplied by the user.\nThe allocation will fail with a WARNING and a stack dump if it is too\nlarge.\n\nAvoid that by failing with an `-EINVAL` error if the supplied `n_insns`\nvalue is unreasonable.\n\nDefine the limit on the `n_insns` value in the `MAX_INSNS` macro.  Set\nthis to the same value as `MAX_SAMPLES` (65536), which is the maximum\nallowed sum of the values of the member `n` in the array of `struct\ncomedi_insn`, and sensible comedi instructions will have an `n` of at\nleast 1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4f26eab1-7a38-4d5b-972d-a8acf543685b",
      "id": "CVE-2025-39753",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops\n\nClears up the warning added in 7ee3647243e5 (\"migrate: Remove call to\n-\u003ewritepage\") that occurs in various xfstests, causing \"something found\nin dmesg\" failures.\n\n[  341.136573] gfs2_meta_aops does not implement migrate_folio\n[  341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea56cfa7-97dc-4c90-beff-7634c5db36d7",
      "id": "CVE-2020-26147",
      "description": "An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ed5a5da-6b8e-42f1-a396-c868ef790711",
      "id": "CVE-2021-0920",
      "description": "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "80230901-5e08-4f44-af44-2f302c0ca7b3",
      "id": "CVE-2021-35039",
      "description": "kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via init_module, does not occur for a module.sig_enforce=1 command-line argument.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4e4490e0-ff11-4aea-b6ff-8d61279017fb",
      "id": "CVE-2021-4135",
      "description": "A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c2dc4e9-7495-417d-91e4-e945066e9f9a",
      "id": "CVE-2021-4439",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: cpai: check ctr-\u003ecnr to avoid array index out of bound\n\nThe cmtp_add_connection() would add a cmtp session to a controller\nand run a kernel thread to process cmtp.\n\n\t__module_get(THIS_MODULE);\n\tsession-\u003etask = kthread_run(cmtp_session, session, \"kcmtpd_ctr_%d\",\n\t\t\t\t\t\t\t\tsession-\u003enum);\n\nDuring this process, the kernel thread would call detach_capi_ctr()\nto detach a register controller. if the controller\nwas not attached yet, detach_capi_ctr() would\ntrigger an array-index-out-bounds bug.\n\n[   46.866069][ T6479] UBSAN: array-index-out-of-bounds in\ndrivers/isdn/capi/kcapi.c:483:21\n[   46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]'\n[   46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted\n5.15.0-rc2+ #8\n[   46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX,\n1996), BIOS 1.14.0-2 04/01/2014\n[   46.870107][ T6479] Call Trace:\n[   46.870473][ T6479]  dump_stack_lvl+0x57/0x7d\n[   46.870974][ T6479]  ubsan_epilogue+0x5/0x40\n[   46.871458][ T6479]  __ubsan_handle_out_of_bounds.cold+0x43/0x48\n[   46.872135][ T6479]  detach_capi_ctr+0x64/0xc0\n[   46.872639][ T6479]  cmtp_session+0x5c8/0x5d0\n[   46.873131][ T6479]  ? __init_waitqueue_head+0x60/0x60\n[   46.873712][ T6479]  ? cmtp_add_msgpart+0x120/0x120\n[   46.874256][ T6479]  kthread+0x147/0x170\n[   46.874709][ T6479]  ? set_kthread_struct+0x40/0x40\n[   46.875248][ T6479]  ret_from_fork+0x1f/0x30\n[   46.875773][ T6479]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa1a9fbc-3294-4dcd-bc45-02fba0e2d8c3",
      "id": "CVE-2021-47347",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwl1251: Fix possible buffer overflow in wl1251_cmd_scan\n\nFunction wl1251_cmd_scan calls memcpy without checking the length.\nHarden by checking the length is within the maximum allowed size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71446532-0e0f-42f6-b139-08e9a4bcad55",
      "id": "CVE-2021-4441",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()\n\nIn zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(),\nwhich could lead to a NULL pointer dereference on failure of\nkzalloc().\n\nFix this bug by adding a check of tmpbuf.\n\nThis bug was found by a static analyzer. The analysis employs\ndifferential checking to identify inconsistent security operations\n(e.g., checks or kfrees) between two code paths and confirms that the\ninconsistent operations are not recovered in the current function or\nthe callers, so they constitute bugs.\n\nNote that, as a bug found by static analysis, it can be a false\npositive or hard to trigger. Multiple researchers have cross-reviewed\nthe bug.\n\nBuilds with CONFIG_SPI_ZYNQ_QSPI=m show no new warnings,\nand our static analyzer no longer warns about this code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d0cdb4f-37f5-431a-a577-51e5c7d56967",
      "id": "CVE-2021-46962",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: uniphier-sd: Fix a resource leak in the remove function\n\nA 'tmio_mmc_host_free()' call is missing in the remove function, in order\nto balance a 'tmio_mmc_host_alloc()' call in the probe.\nThis is done in the error handling path of the probe, but not in the remove\nfunction.\n\nAdd the missing call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e1ff21e-c9ba-4d59-8187-c916a7471b7a",
      "id": "CVE-2021-47070",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Fix another memory leak in error handling paths\n\nMemory allocated by 'vmbus_alloc_ring()' at the beginning of the probe\nfunction is never freed in the error handling path.\n\nAdd the missing 'vmbus_free_ring()' call.\n\nNote that it is already freed in the .remove function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c7b6b7e-07e1-412a-9f2a-76ec1d5e9938",
      "id": "CVE-2021-47103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: fully convert sk-\u003esk_rx_dst to RCU rules\n\nsyzbot reported various issues around early demux,\none being included in this changelog [1]\n\nsk-\u003esk_rx_dst is using RCU protection without clearly\ndocumenting it.\n\nAnd following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv()\nare not following standard RCU rules.\n\n[a]    dst_release(dst);\n[b]    sk-\u003esk_rx_dst = NULL;\n\nThey look wrong because a delete operation of RCU protected\npointer is supposed to clear the pointer before\nthe call_rcu()/synchronize_rcu() guarding actual memory freeing.\n\nIn some cases indeed, dst could be freed before [b] is done.\n\nWe could cheat by clearing sk_rx_dst before calling\ndst_release(), but this seems the right time to stick\nto standard RCU annotations and debugging facilities.\n\n[1]\nBUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline]\nBUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792\nRead of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204\n\nCPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:450\n dst_check include/net/dst.h:470 [inline]\n tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792\n ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340\n ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583\n ip_sublist_rcv net/ipv4/ip_input.c:609 [inline]\n ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644\n __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline]\n __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556\n __netif_receive_skb_list net/core/dev.c:5608 [inline]\n netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699\n gro_normal_list net/core/dev.c:5853 [inline]\n gro_normal_list net/core/dev.c:5849 [inline]\n napi_complete_done+0x1f1/0x880 net/core/dev.c:6590\n virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]\n virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557\n __napi_poll+0xaf/0x440 net/core/dev.c:7023\n napi_poll net/core/dev.c:7090 [inline]\n net_rx_action+0x801/0xb40 net/core/dev.c:7177\n __do_softirq+0x29b/0x9c2 kernel/softirq.c:558\n invoke_softirq kernel/softirq.c:432 [inline]\n __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637\n irq_exit_rcu+0x5/0x20 kernel/softirq.c:649\n common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240\n asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629\nRIP: 0033:0x7f5e972bfd57\nCode: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e \u003c48\u003e 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73\nRSP: 002b:00007fff8a413210 EFLAGS: 00000283\nRAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45\nRDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45\nRBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9\nR10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0\nR13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019\n \u003c/TASK\u003e\n\nAllocated by task 13:\n kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38\n kasan_set_track mm/kasan/common.c:46 [inline]\n set_alloc_info mm/kasan/common.c:434 [inline]\n __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467\n kasan_slab_alloc include/linux/kasan.h:259 [inline]\n slab_post_alloc_hook mm/slab.h:519 [inline]\n slab_alloc_node mm/slub.c:3234 [inline]\n slab_alloc mm/slub.c:3242 [inline]\n kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247\n dst_alloc+0x146/0x1f0 net/core/dst.c:92\n rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613\n ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:234\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6cce388-d69b-467c-9e8e-ec5c47e72152",
      "id": "CVE-2021-47117",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed\n\nWe got follow bug_on when run fsstress with injecting IO fault:\n[130747.323114] kernel BUG at fs/ext4/extents_status.c:762!\n[130747.323117] Internal error: Oops - BUG: 0 [#1] SMP\n......\n[130747.334329] Call trace:\n[130747.334553]  ext4_es_cache_extent+0x150/0x168 [ext4]\n[130747.334975]  ext4_cache_extents+0x64/0xe8 [ext4]\n[130747.335368]  ext4_find_extent+0x300/0x330 [ext4]\n[130747.335759]  ext4_ext_map_blocks+0x74/0x1178 [ext4]\n[130747.336179]  ext4_map_blocks+0x2f4/0x5f0 [ext4]\n[130747.336567]  ext4_mpage_readpages+0x4a8/0x7a8 [ext4]\n[130747.336995]  ext4_readpage+0x54/0x100 [ext4]\n[130747.337359]  generic_file_buffered_read+0x410/0xae8\n[130747.337767]  generic_file_read_iter+0x114/0x190\n[130747.338152]  ext4_file_read_iter+0x5c/0x140 [ext4]\n[130747.338556]  __vfs_read+0x11c/0x188\n[130747.338851]  vfs_read+0x94/0x150\n[130747.339110]  ksys_read+0x74/0xf0\n\nThis patch's modification is according to Jan Kara's suggestion in:\nhttps://patchwork.ozlabs.org/project/linux-ext4/patch/20210428085158.3728201-1-yebin10@huawei.com/\n\"I see. Now I understand your patch. Honestly, seeing how fragile is trying\nto fix extent tree after split has failed in the middle, I would probably\ngo even further and make sure we fix the tree properly in case of ENOSPC\nand EDQUOT (those are easily user triggerable).  Anything else indicates a\nHW problem or fs corruption so I'd rather leave the extent tree as is and\ndon't try to fix it (which also means we will not create overlapping\nextents).\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcfe3d92-b48c-4c61-a8f4-f4d35d4796c8",
      "id": "CVE-2021-47342",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix possible UAF when remounting r/o a mmp-protected file system\n\nAfter commit 618f003199c6 (\"ext4: fix memory leak in\next4_fill_super\"), after the file system is remounted read-only, there\nis a race where the kmmpd thread can exit, causing sbi-\u003es_mmp_tsk to\npoint at freed memory, which the call to ext4_stop_mmpd() can trip\nover.\n\nFix this by only allowing kmmpd() to exit when it is stopped via\next4_stop_mmpd().\n\nBug-Report-Link: \u003c20210629143603.2166962-1-yebin10@huawei.com\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5304c722-3411-478c-a478-36b7826e3a53",
      "id": "CVE-2021-47433",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we'd end up with a\ncorrupt file system with a missing extent in the middle of a file.  This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code.  However the\nprealloc code uses this path too.  Instead we need to abort if there is\nan error, and the only error we _don't_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbc0bf26-0af4-453c-a160-7007a20783fe",
      "id": "CVE-2021-47546",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix memory leak in fib6_rule_suppress\n\nThe kernel leaks memory when a `fib` rule is present in IPv6 nftables\nfirewall rules and a suppress_prefix rule is present in the IPv6 routing\nrules (used by certain tools such as wg-quick). In such scenarios, every\nincoming packet will leak an allocation in `ip6_dst_cache` slab cache.\n\nAfter some hours of `bpftrace`-ing and source code reading, I tracked\ndown the issue to ca7a03c41753 (\"ipv6: do not free rt if\nFIB_LOOKUP_NOREF is set on suppress rule\").\n\nThe problem with that change is that the generic `args-\u003eflags` always have\n`FIB_LOOKUP_NOREF` set[1][2] but the IPv6-specific flag\n`RT6_LOOKUP_F_DST_NOREF` might not be, leading to `fib6_rule_suppress` not\ndecreasing the refcount when needed.\n\nHow to reproduce:\n - Add the following nftables rule to a prerouting chain:\n     meta nfproto ipv6 fib saddr . mark . iif oif missing drop\n   This can be done with:\n     sudo nft create table inet test\n     sudo nft create chain inet test test_chain '{ type filter hook prerouting priority filter + 10; policy accept; }'\n     sudo nft add rule inet test test_chain meta nfproto ipv6 fib saddr . mark . iif oif missing drop\n - Run:\n     sudo ip -6 rule add table main suppress_prefixlength 0\n - Watch `sudo slabtop -o | grep ip6_dst_cache` to see memory usage increase\n   with every incoming ipv6 packet.\n\nThis patch exposes the protocol-specific flags to the protocol\nspecific `suppress` function, and check the protocol-specific `flags`\nargument for RT6_LOOKUP_F_DST_NOREF instead of the generic\nFIB_LOOKUP_NOREF when decreasing the refcount, like this.\n\n[1]: https://github.com/torvalds/linux/blob/ca7a03c4175366a92cee0ccc4fec0038c3266e26/net/ipv6/fib6_rules.c#L71\n[2]: https://github.com/torvalds/linux/blob/ca7a03c4175366a92cee0ccc4fec0038c3266e26/net/ipv6/fib6_rules.c#L99",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dc5e0b7-f093-4c5f-91d4-010dd26b4a80",
      "id": "CVE-2021-47641",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: cirrusfb: check pixclock to avoid divide by zero\n\nDo a sanity check on pixclock value to avoid divide by zero.\n\nIf the pixclock value is zero, the cirrusfb driver will round up\npixclock to get the derived frequency as close to maxclock as\npossible.\n\nSyzkaller reported a divide error in cirrusfb_check_pixclock.\n\ndivide error: 0000 [#1] SMP KASAN PTI\nCPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2\nRIP: 0010:cirrusfb_check_var+0x6f1/0x1260\n\nCall Trace:\n fb_set_var+0x398/0xf90\n do_fb_ioctl+0x4b8/0x6f0\n fb_ioctl+0xeb/0x130\n __x64_sys_ioctl+0x19d/0x220\n do_syscall_64+0x3a/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dbce5660-735e-470d-b3f0-feb3bdfa159c",
      "id": "CVE-2022-0617",
      "description": "A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a829bd1f-0e59-4491-97a4-58446a5a0c8a",
      "id": "CVE-2022-2588",
      "description": "It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f385e7a-375c-4192-ba67-791b7203a55d",
      "id": "CVE-2023-53008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential memory leaks in session setup\n\nMake sure to free cifs_ses::auth_key.response before allocating it as\nwe might end up leaking memory in reconnect or mounting.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19343510-9967-43e4-8b67-20e9e0963a3a",
      "id": "CVE-2022-49253",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: usb: go7007: s2250-board: fix leak in probe()\n\nCall i2c_unregister_device(audio) on this error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6a706d7-776b-41d6-b32a-c9ca08cee411",
      "id": "CVE-2022-3028",
      "description": "A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4f15edd-476e-44d4-aa84-0124f37ea8ae",
      "id": "CVE-2022-33740",
      "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba537af0-aaaa-487d-b5a5-c746e6030802",
      "id": "CVE-2022-48693",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs\n\nIn brcmstb_pm_probe(), there are two kinds of leak bugs:\n\n(1) we need to add of_node_put() when for_each__matching_node() breaks\n(2) we need to add iounmap() for each iomap in fail path",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0ae04a4-7c3e-436e-8b96-ec57a6171551",
      "id": "CVE-2022-49097",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Avoid writeback threads getting stuck in mempool_alloc()\n\nIn a low memory situation, allow the NFS writeback code to fail without\ngetting stuck in infinite loops in mempool_alloc().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc3c7bcb-df28-48c2-a0df-e184633b378f",
      "id": "CVE-2022-48757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix information leakage in /proc/net/ptype\n\nIn one net namespace, after creating a packet socket without binding\nit to a device, users in other net namespaces can observe the new\n`packet_type` added by this packet socket by reading `/proc/net/ptype`\nfile. This is minor information leakage as packet socket is\nnamespace aware.\n\nAdd a net pointer in `packet_type` to keep the net namespace of\nof corresponding packet socket. In `ptype_seq_show`, this net pointer\nmust be checked when it is not NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a2319e8-4e88-4829-a1f3-875774aac4a2",
      "id": "CVE-2022-49125",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sprd: fix potential NULL dereference\n\n'drm' could be null in sprd_drm_shutdown, and drm_warn maybe dereference\nit, remove this warning log.\n\n\nv1 -\u003e v2:\n- Split checking platform_get_resource() return value to a separate patch\n- Use dev_warn() instead of removing the warning log",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98084120-ec8c-405e-8212-b86103c7e5bb",
      "id": "CVE-2022-49204",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix more uncharged while msg has more_data\n\nIn tcp_bpf_send_verdict(), if msg has more data after\ntcp_bpf_sendmsg_redir():\n\ntcp_bpf_send_verdict()\n tosend = msg-\u003esg.size  //msg-\u003esg.size = 22220\n case __SK_REDIRECT:\n  sk_msg_return()  //uncharged msg-\u003esg.size(22220) sk-\u003esk_forward_alloc\n  tcp_bpf_sendmsg_redir() //after tcp_bpf_sendmsg_redir, msg-\u003esg.size=11000\n goto more_data;\n tosend = msg-\u003esg.size  //msg-\u003esg.size = 11000\n case __SK_REDIRECT:\n  sk_msg_return()  //uncharged msg-\u003esg.size(11000) to sk-\u003esk_forward_alloc\n\nThe msg-\u003esg.size(11000) has been uncharged twice, to fix we can charge the\nremaining msg-\u003esg.size before goto more data.\n\nThis issue can cause the following info:\nWARNING: CPU: 0 PID: 9860 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0\nCall Trace:\n \u003cTASK\u003e\n inet_csk_destroy_sock+0x55/0x110\n __tcp_close+0x279/0x470\n tcp_close+0x1f/0x60\n inet_release+0x3f/0x80\n __sock_release+0x3d/0xb0\n sock_close+0x11/0x20\n __fput+0x92/0x250\n task_work_run+0x6a/0xa0\n do_exit+0x33b/0xb60\n do_group_exit+0x2f/0xa0\n get_signal+0xb6/0x950\n arch_do_signal_or_restart+0xac/0x2a0\n ? vfs_write+0x237/0x290\n exit_to_user_mode_prepare+0xa9/0x200\n syscall_exit_to_user_mode+0x12/0x30\n do_syscall_64+0x46/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n \u003c/TASK\u003e\n\nWARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x24/0x1f0\n sk_psock_destroy+0x19b/0x1c0\n process_one_work+0x1b3/0x3c0\n worker_thread+0x30/0x350\n ? process_one_work+0x3c0/0x3c0\n kthread+0xe6/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cb92fc1-25b9-4bc4-922e-c48e921da972",
      "id": "CVE-2022-49293",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: initialize registers in nft_do_chain()\n\nInitialize registers to avoid stack leak into userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a9ce6aa-6865-428f-87ce-cffb43f3b074",
      "id": "CVE-2022-49294",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check if modulo is 0 before dividing.\n\n[How \u0026 Why]\nIf a value of 0 is read, then this will cause a divide-by-0 panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84cad18d-b35d-4d37-bce6-399fd6ade5ba",
      "id": "CVE-2022-49439",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fsl_rio: Fix refcount leak in fsl_rio_setup\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88866a62-e4d8-42b4-855d-59bfcc884f80",
      "id": "CVE-2022-49459",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe\n\nplatform_get_resource() may return NULL, add proper check to\navoid potential NULL dereferencing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b83dea4-03a4-4c11-a791-fe71621ece86",
      "id": "CVE-2022-49522",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: jz4740: Apply DMA engine limits to maximum segment size\n\nDo what is done in other DMA-enabled MMC host drivers (cf. host/mmci.c) and\nlimit the maximum segment size based on the DMA engine's capabilities. This\nis needed to avoid warnings like the following with CONFIG_DMA_API_DEBUG=y.\n\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 21 at kernel/dma/debug.c:1162 debug_dma_map_sg+0x2f4/0x39c\nDMA-API: jz4780-dma 13420000.dma-controller: mapping sg segment longer than device claims to support [len=98304] [max=65536]\nCPU: 0 PID: 21 Comm: kworker/0:1H Not tainted 5.18.0-rc1 #19\nWorkqueue: kblockd blk_mq_run_work_fn\nStack : 81575aec 00000004 80620000 80620000 80620000 805e7358 00000009 801537ac\n        814c832c 806276e3 806e34b4 80620000 81575aec 00000001 81575ab8 09291444\n        00000000 00000000 805e7358 81575958 ffffffea 8157596c 00000000 636f6c62\n        6220646b 80387a70 0000000f 6d5f6b6c 80620000 00000000 81575ba4 00000009\n        805e170c 80896640 00000001 00010000 00000000 00000000 00006098 806e0000\n        ...\nCall Trace:\n[\u003c80107670\u003e] show_stack+0x84/0x120\n[\u003c80528cd8\u003e] __warn+0xb8/0xec\n[\u003c80528d78\u003e] warn_slowpath_fmt+0x6c/0xb8\n[\u003c8016f1d4\u003e] debug_dma_map_sg+0x2f4/0x39c\n[\u003c80169d4c\u003e] __dma_map_sg_attrs+0xf0/0x118\n[\u003c8016a27c\u003e] dma_map_sg_attrs+0x14/0x28\n[\u003c804f66b4\u003e] jz4740_mmc_prepare_dma_data+0x74/0xa4\n[\u003c804f6714\u003e] jz4740_mmc_pre_request+0x30/0x54\n[\u003c804f4ff4\u003e] mmc_blk_mq_issue_rq+0x6e0/0x7bc\n[\u003c804f5590\u003e] mmc_mq_queue_rq+0x220/0x2d4\n[\u003c8038b2c0\u003e] blk_mq_dispatch_rq_list+0x480/0x664\n[\u003c80391040\u003e] blk_mq_do_dispatch_sched+0x2dc/0x370\n[\u003c80391468\u003e] __blk_mq_sched_dispatch_requests+0xec/0x164\n[\u003c80391540\u003e] blk_mq_sched_dispatch_requests+0x44/0x94\n[\u003c80387900\u003e] __blk_mq_run_hw_queue+0xb0/0xcc\n[\u003c80134c14\u003e] process_one_work+0x1b8/0x264\n[\u003c80134ff8\u003e] worker_thread+0x2ec/0x3b8\n[\u003c8013b13c\u003e] kthread+0x104/0x10c\n[\u003c80101dcc\u003e] ret_from_kernel_thread+0x14/0x1c\n\n---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e8701989-974b-4dfd-a44c-b8972a230a18",
      "id": "CVE-2022-49609",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe\n\nof_find_matching_node_and_match() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe1cd14a-dc0e-46e1-a645-0ce6c00cf7ac",
      "id": "CVE-2022-49638",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: Fix data-races around sysctl.\n\nWhile reading icmp sysctl variables, they can be changed concurrently.\nSo, we need to add READ_ONCE() to avoid data-races.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95e13aa6-2253-435d-a7dc-2e846ee5596f",
      "id": "CVE-2022-49677",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: cns3xxx: Fix refcount leak in cns3xxx_init\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c94fffc-d852-42f1-b2f1-6d18b664457b",
      "id": "CVE-2022-49768",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: trans_fd/p9_conn_cancel: drop client lock earlier\n\nsyzbot reported a double-lock here and we no longer need this\nlock after requests have been moved off to local list:\njust drop the lock earlier.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47fa727b-8db4-45ab-aed3-e406331b59b1",
      "id": "CVE-2022-50017",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start\n\nWe should call of_node_put() for the reference 'uctl_node' returned by\nof_get_parent() which will increase the refcount. Otherwise, there will\nbe a refcount leak bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cab0e66d-020a-4f2d-86ed-9a1e2b30349d",
      "id": "CVE-2022-50144",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: revisit driver bind/unbind and callbacks\n\nIn the SoundWire probe, we store a pointer from the driver ops into\nthe 'slave' structure. This can lead to kernel oopses when unbinding\ncodec drivers, e.g. with the following sequence to remove machine\ndriver and codec driver.\n\n/sbin/modprobe -r snd_soc_sof_sdw\n/sbin/modprobe -r snd_soc_rt711\n\nThe full details can be found in the BugLink below, for reference the\ntwo following examples show different cases of driver ops/callbacks\nbeing invoked after the driver .remove().\n\nkernel: BUG: kernel NULL pointer dereference, address: 0000000000000150\nkernel: Workqueue: events cdns_update_slave_status_work [soundwire_cadence]\nkernel: RIP: 0010:mutex_lock+0x19/0x30\nkernel: Call Trace:\nkernel:  ? sdw_handle_slave_status+0x426/0xe00 [soundwire_bus 94ff184bf398570c3f8ff7efe9e32529f532e4ae]\nkernel:  ? newidle_balance+0x26a/0x400\nkernel:  ? cdns_update_slave_status_work+0x1e9/0x200 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82]\n\nkernel: BUG: unable to handle page fault for address: ffffffffc07654c8\nkernel: Workqueue: pm pm_runtime_work\nkernel: RIP: 0010:sdw_bus_prep_clk_stop+0x6f/0x160 [soundwire_bus]\nkernel: Call Trace:\nkernel:  \u003cTASK\u003e\nkernel:  sdw_cdns_clock_stop+0xb5/0x1b0 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82]\nkernel:  intel_suspend_runtime+0x5f/0x120 [soundwire_intel aca858f7c87048d3152a4a41bb68abb9b663a1dd]\nkernel:  ? dpm_sysfs_remove+0x60/0x60\n\nThis was not detected earlier in Intel tests since the tests first\nremove the parent PCI device and shut down the bus. The sequence\nabove is a corner case which keeps the bus operational but without a\ndriver bound.\n\nWhile trying to solve this kernel oopses, it became clear that the\nexisting SoundWire bus does not deal well with the unbind case.\n\nCommit 528be501b7d4a (\"soundwire: sdw_slave: add probe_complete structure and new fields\")\nadded a 'probed' status variable and a 'probe_complete'\nstruct completion. This status is however not reset on remove and\nlikewise the 'probe complete' is not re-initialized, so the\nbind/unbind/bind test cases would fail. The timeout used before the\n'update_status' callback was also a bad idea in hindsight, there\nshould really be no timing assumption as to if and when a driver is\nbound to a device.\n\nAn initial draft was based on device_lock() and device_unlock() was\ntested. This proved too complicated, with deadlocks created during the\nsuspend-resume sequences, which also use the same device_lock/unlock()\nas the bind/unbind sequences. On a CometLake device, a bad DSDT/BIOS\ncaused spurious resumes and the use of device_lock() caused hangs\nduring suspend. After multiple weeks or testing and painful\nreverse-engineering of deadlocks on different devices, we looked for\nalternatives that did not interfere with the device core.\n\nA bus notifier was used successfully to keep track of DRIVER_BOUND and\nDRIVER_UNBIND events. This solved the bind-unbind-bind case in tests,\nbut it can still be defeated with a theoretical corner case where the\nmemory is freed by a .remove while the callback is in use. The\nnotifier only helps make sure the driver callbacks are valid, but not\nthat the memory allocated in probe remains valid while the callbacks\nare invoked.\n\nThis patch suggests the introduction of a new 'sdw_dev_lock' mutex\nprotecting probe/remove and all driver callbacks. Since this mutex is\n'local' to SoundWire only, it does not interfere with existing locks\nand does not create deadlocks. In addition, this patch removes the\n'probe_complete' completion, instead we directly invoke the\n'update_status' from the probe routine. That removes any sort of\ntiming dependency and a much better support for the device/driver\nmodel, the driver could be bound before the bus started, or eons after\nthe bus started and the hardware would be properly initialized in all\ncases.\n\nBugLink: https://github.com/thesofproject/linux/is\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f97c8849-729e-45d8-a97d-5f6cead867ab",
      "id": "CVE-2022-50369",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vkms: Fix null-ptr-deref in vkms_release()\n\nA null-ptr-deref is triggered when it tries to destroy the workqueue in\nvkms-\u003eoutput.composer_workq in vkms_release().\n\n KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\n CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24\n RIP: 0010:destroy_workqueue+0x2f/0x710\n ...\n Call Trace:\n  \u003cTASK\u003e\n  ? vkms_config_debugfs_init+0x50/0x50 [vkms]\n  __devm_drm_dev_alloc+0x15a/0x1c0 [drm]\n  vkms_init+0x245/0x1000 [vkms]\n  do_one_initcall+0xd0/0x4f0\n  do_init_module+0x1a4/0x680\n  load_module+0x6249/0x7110\n  __do_sys_finit_module+0x140/0x200\n  do_syscall_64+0x35/0x80\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe reason is that an OOM happened which triggers the destroy of the\nworkqueue, however, the workqueue is alloced in the later process,\nthus a null-ptr-deref happened. A simple call graph is shown as below:\n\n vkms_init()\n  vkms_create()\n    devm_drm_dev_alloc()\n      __devm_drm_dev_alloc()\n        devm_drm_dev_init()\n          devm_add_action_or_reset()\n            devm_add_action() # an error happened\n            devm_drm_dev_init_release()\n              drm_dev_put()\n                kref_put()\n                  drm_dev_release()\n                    vkms_release()\n                      destroy_workqueue() # null-ptr-deref happened\n    vkms_modeset_init()\n      vkms_output_init()\n        vkms_crtc_init() # where the workqueue get allocated\n\nFix this by checking if composer_workq is NULL before passing it to\nthe destroy_workqueue() in vkms_release().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "455c3655-94a3-4fb4-96bf-6b663d66b06a",
      "id": "CVE-2023-1077",
      "description": "In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c514086-b07e-4b4e-b4c2-5d709b117746",
      "id": "CVE-2023-1206",
      "description": "A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8457260-f6c9-42dc-876a-f2684e8f99be",
      "id": "CVE-2023-1611",
      "description": "A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb683c77-9485-43a6-af2b-a19397381072",
      "id": "CVE-2023-3567",
      "description": "A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed01e252-3c6c-46a0-af78-656ee94a2b7a",
      "id": "CVE-2023-3609",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.\n\nIf tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.\n\nWe recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c6be366-1bf5-4d11-b24c-dca1eb565efe",
      "id": "CVE-2023-52486",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Don't unref the same fb many times by mistake due to deadlock handling\n\nIf we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl()\nwe proceed to unref the fb and then retry the whole thing from the top.\nBut we forget to reset the fb pointer back to NULL, and so if we then\nget another error during the retry, before the fb lookup, we proceed\nthe unref the same fb again without having gotten another reference.\nThe end result is that the fb will (eventually) end up being freed\nwhile it's still in use.\n\nReset fb to NULL once we've unreffed it to avoid doing it again\nuntil we've done another fb lookup.\n\nThis turned out to be pretty easy to hit on a DG2 when doing async\nflips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I\nsaw that drm_closefb() simply got stuck in a busy loop while walking\nthe framebuffer list. Fortunately I was able to convince it to oops\ninstead, and from there it was easier to track down the culprit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f77844e-3763-4276-a877-7add7432c5d6",
      "id": "CVE-2023-52590",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: Avoid touching renamed directory if parent does not change\n\nThe VFS will not be locking moved directory if its parent does not\nchange. Change ocfs2 rename code to avoid touching renamed directory if\nits parent does not change as without locking that can corrupt the\nfilesystem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd1218f7-7bb2-40b6-9ec4-2028463557d6",
      "id": "CVE-2023-52617",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: switchtec: Fix stdev_release() crash after surprise hot remove\n\nA PCI device hot removal may occur while stdev-\u003ecdev is held open. The call\nto stdev_release() then happens during close or exit, at a point way past\nswitchtec_pci_remove(). Otherwise the last ref would vanish with the\ntrailing put_device(), just before return.\n\nAt that later point in time, the devm cleanup has already removed the\nstdev-\u003emmio_mrpc mapping. Also, the stdev-\u003epdev reference was not a counted\none. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause\na fatal page fault, and the subsequent dma_free_coherent(), if reached,\nwould pass a stale \u0026stdev-\u003epdev-\u003edev pointer.\n\nFix by moving MRPC DMA shutdown into switchtec_pci_remove(), after\nstdev_kill(). Counting the stdev-\u003epdev ref is now optional, but may prevent\nfuture accidents.\n\nReproducible via the script at\nhttps://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff07c7f7-7d36-4733-98b3-a6798ec2ea62",
      "id": "CVE-2023-52705",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix underflow in second superblock position calculations\n\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\nsuperblock, underflows when the argument device size is less than 4096\nbytes.  Therefore, when using this macro, it is necessary to check in\nadvance that the device size is not less than a lower limit, or at least\nthat underflow does not occur.\n\nThe current nilfs2 implementation lacks this check, causing out-of-bound\nblock access when mounting devices smaller than 4096 bytes:\n\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\n phys_seg 1 prio class 2\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\n\nIn addition, when trying to resize the filesystem to a size below 4096\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\nnumber of segments in superblocks.  This causes excessive loop iterations\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\nsemaphore ns_segctor_sem to block for a long time and hang the writer\nthread:\n\n INFO: task segctord:5067 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:segctord        state:D stack:23456 pid:5067  ppid:2\n flags:0x00004000\n Call Trace:\n  \u003cTASK\u003e\n  context_switch kernel/sched/core.c:5293 [inline]\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\n  kthread+0x270/0x300 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n  \u003c/TASK\u003e\n ...\n Call Trace:\n  \u003cTASK\u003e\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\n  ...\n\nThis fixes these issues by inserting appropriate minimum device size\nchecks or anti-underflow checks, depending on where the macro is used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37d79ff1-e438-47ac-85f1-ce26c6b0bca5",
      "id": "CVE-2023-52764",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: gspca: cpia1: shift-out-of-bounds in set_flicker\n\nSyzkaller reported the following issue:\nUBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27\nshift exponent 245 is too large for 32-bit type 'int'\n\nWhen the value of the variable \"sd-\u003eparams.exposure.gain\" exceeds the\nnumber of bits in an integer, a shift-out-of-bounds error is reported. It\nis triggered because the variable \"currentexp\" cannot be left-shifted by\nmore than the number of bits in an integer. In order to avoid invalid\nrange during left-shift, the conditional expression is added.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36925dc0-2349-4b79-8cf7-27f977e0d022",
      "id": "CVE-2023-52791",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: Run atomic i2c xfer when !preemptible\n\nSince bae1d3a05a8b, i2c transfers are non-atomic if preemption is\ndisabled. However, non-atomic i2c transfers require preemption (e.g. in\nwait_for_completion() while waiting for the DMA).\n\npanic() calls preempt_disable_notrace() before calling\nemergency_restart(). Therefore, if an i2c device is used for the\nrestart, the xfer should be atomic. This avoids warnings like:\n\n[   12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0\n[   12.676926] Voluntary context switch within RCU read-side critical section!\n...\n[   12.742376]  schedule_timeout from wait_for_completion_timeout+0x90/0x114\n[   12.749179]  wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70\n...\n[   12.994527]  atomic_notifier_call_chain from machine_restart+0x34/0x58\n[   13.001050]  machine_restart from panic+0x2a8/0x32c\n\nUse !preemptible() instead, which is basically the same check as\npre-v5.2.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "67ffc8e3-116f-4d2a-a0b5-bd267cf9aed1",
      "id": "CVE-2023-52814",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix potential null pointer derefernce\n\nThe amdgpu_ras_get_context may return NULL if device\nnot support ras feature, so add check before using.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa6ac3c7-c30c-42aa-ad3b-8bb0656ea4a8",
      "id": "CVE-2023-53068",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: lan78xx: Limit packet length to skb-\u003elen\n\nPacket length retrieved from descriptor may be larger than\nthe actual socket buffer length. In such case the cloned\nskb passed up the network stack will leak kernel memory contents.\n\nAdditionally prevent integer underflow when size is less than\nETH_FCS_LEN.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "947c1333-1e38-40ca-99a4-1e3eed970681",
      "id": "CVE-2023-53140",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Remove the /proc/scsi/${proc_name} directory earlier\n\nRemove the /proc/scsi/${proc_name} directory earlier to fix a race\ncondition between unloading and reloading kernel modules. This fixes a bug\nintroduced in 2009 by commit 77c019768f06 (\"[SCSI] fix /proc memory leak in\nthe SCSI core\").\n\nFix the following kernel warning:\n\nproc_dir_entry 'scsi/scsi_debug' already registered\nWARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0\nCall Trace:\n proc_mkdir+0xb5/0xe0\n scsi_proc_hostdir_add+0xb5/0x170\n scsi_host_alloc+0x683/0x6c0\n sdebug_driver_probe+0x6b/0x2d0 [scsi_debug]\n really_probe+0x159/0x540\n __driver_probe_device+0xdc/0x230\n driver_probe_device+0x4f/0x120\n __device_attach_driver+0xef/0x180\n bus_for_each_drv+0xe5/0x130\n __device_attach+0x127/0x290\n device_initial_probe+0x17/0x20\n bus_probe_device+0x110/0x130\n device_add+0x673/0xc80\n device_register+0x1e/0x30\n sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug]\n scsi_debug_init+0x64f/0x1000 [scsi_debug]\n do_one_initcall+0xd7/0x470\n do_init_module+0xe7/0x330\n load_module+0x122a/0x12c0\n __do_sys_finit_module+0x124/0x1a0\n __x64_sys_finit_module+0x46/0x50\n do_syscall_64+0x38/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6a5a01e8-0a03-402c-a573-fc60894f75a4",
      "id": "CVE-2023-53191",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains\n\nof_irq_find_parent() returns a node pointer with refcount incremented,\nWe should use of_node_put() on it when not needed anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "670fc375-63aa-40d0-830e-de0fb33cf392",
      "id": "CVE-2024-35833",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA\n\nThis dma_alloc_coherent() is undone neither in the remove function, nor in\nthe error handling path of fsl_qdma_probe().\n\nSwitch to the managed version to fix both issues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fd5878f-b451-4795-893a-5dffa5d19351",
      "id": "CVE-2024-26643",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout\n\nWhile the rhashtable set gc runs asynchronously, a race allows it to\ncollect elements from anonymous sets with timeouts while it is being\nreleased from the commit path.\n\nMingi Cho originally reported this issue in a different path in 6.1.x\nwith a pipapo set with low timeouts which is not possible upstream since\n7395dfacfff6 (\"netfilter: nf_tables: use timestamp to check for set\nelement timeout\").\n\nFix this by setting on the dead flag for anonymous sets to skip async gc\nin this case.\n\nAccording to 08e4c8c5919f (\"netfilter: nf_tables: mark newset as dead on\ntransaction abort\"), Florian plans to accelerate abort path by releasing\nobjects via workqueue, therefore, this sets on the dead flag for abort\npath too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e741f38-9f11-4033-a9ad-d0dee4b14abb",
      "id": "CVE-2024-26699",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43defbe9-d9b3-4f62-9c62-b02dc0af6c87",
      "id": "CVE-2024-42147",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/debugfs - Fix debugfs uninit process issue\n\nDuring the zip probe process, the debugfs failure does not stop\nthe probe. When debugfs initialization fails, jumping to the\nerror branch will also release regs, in addition to its own\nrollback operation.\n\nAs a result, it may be released repeatedly during the regs\nuninit process. Therefore, the null check needs to be added to\nthe regs uninit process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a299a485-8922-4bb3-9ef3-2118417efbfd",
      "id": "CVE-2024-26773",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n  ext4_lock_group(sb, group)\n  ext4_mb_good_group\n   // check if the group bbitmap is corrupted\n  ext4_mb_complex_scan_group\n   // Scan group gets ac_b_ex but doesn't use it\n  ext4_unlock_group(sb, group)\n                           ext4_mark_group_bitmap_corrupted(group)\n                           // The block bitmap was corrupted during\n                           // the group unlock gap.\n  ext4_mb_try_best_found\n    ext4_lock_group(ac-\u003eac_sb, group)\n    ext4_mb_use_best_found\n      mb_mark_used\n      // Allocating blocks in block bitmap corrupted group",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8f13d5b-b17f-4a48-a729-6d8038940ca0",
      "id": "CVE-2024-26840",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix memory leak in cachefiles_add_cache()\n\nThe following memory leak was reported after unbinding /dev/cachefiles:\n\n==================================================================\nunreferenced object 0xffff9b674176e3c0 (size 192):\n  comm \"cachefilesd2\", pid 680, jiffies 4294881224\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc ea38a44b):\n    [\u003cffffffff8eb8a1a5\u003e] kmem_cache_alloc+0x2d5/0x370\n    [\u003cffffffff8e917f86\u003e] prepare_creds+0x26/0x2e0\n    [\u003cffffffffc002eeef\u003e] cachefiles_determine_cache_security+0x1f/0x120\n    [\u003cffffffffc00243ec\u003e] cachefiles_add_cache+0x13c/0x3a0\n    [\u003cffffffffc0025216\u003e] cachefiles_daemon_write+0x146/0x1c0\n    [\u003cffffffff8ebc4a3b\u003e] vfs_write+0xcb/0x520\n    [\u003cffffffff8ebc5069\u003e] ksys_write+0x69/0xf0\n    [\u003cffffffff8f6d4662\u003e] do_syscall_64+0x72/0x140\n    [\u003cffffffff8f8000aa\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n==================================================================\n\nPut the reference count of cache_cred in cachefiles_daemon_unbind() to\nfix the problem. And also put cache_cred in cachefiles_add_cache() error\nbranch to avoid memory leaks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4142883f-3eb3-48fb-a974-5ae547174994",
      "id": "CVE-2024-41060",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: check bo_va-\u003ebo is non-NULL before using it\n\nThe call to radeon_vm_clear_freed might clear bo_va-\u003ebo, so\nwe have to check it before dereferencing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f122d4e-7b3c-4fa8-bab7-b911d9778a39",
      "id": "CVE-2024-26885",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix DEVMAP_HASH overflow check on 32-bit arches\n\nThe devmap code allocates a number hash buckets equal to the next power\nof two of the max_entries value provided when creating the map. When\nrounding up to the next power of two, the 32-bit variable storing the\nnumber of buckets can overflow, and the code checks for overflow by\nchecking if the truncated 32-bit value is equal to 0. However, on 32-bit\narches the rounding up itself can overflow mid-way through, because it\nends up doing a left-shift of 32 bits on an unsigned long value. If the\nsize of an unsigned long is four bytes, this is undefined behaviour, so\nthere is no guarantee that we'll end up with a nice and tidy 0-value at\nthe end.\n\nSyzbot managed to turn this into a crash on arm32 by creating a\nDEVMAP_HASH with max_entries \u003e 0x80000000 and then trying to update it.\nFix this by moving the overflow check to before the rounding up\noperation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b5b231b-5026-4f6f-9937-ccb6b0cbfe59",
      "id": "CVE-2024-26891",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Don't issue ATS Invalidation request when device is disconnected\n\nFor those endpoint devices connect to system via hotplug capable ports,\nusers could request a hot reset to the device by flapping device's link\nthrough setting the slot's link control register, as pciehp_ist() DLLSC\ninterrupt sequence response, pciehp will unload the device driver and\nthen power it off. thus cause an IOMMU device-TLB invalidation (Intel\nVT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence\ntarget device to be sent and deadly loop to retry that request after ITE\nfault triggered in interrupt context.\n\nThat would cause following continuous hard lockup warning and system hang\n\n[ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down\n[ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present\n[ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144\n[ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S\n         OE    kernel version xxxx\n[ 4223.822623] Hardware name: vendorname xxxx 666-106,\nBIOS 01.01.02.03.01 05/15/2023\n[ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490\n[ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b\n 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 \u003c40\u003e f6 c6 1\n0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39\n[ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093\n[ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005\n[ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340\n[ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000\n[ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200\n[ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004\n[ 4223.822626] FS:  0000000000000000(0000) GS:ffffa237ae400000(0000)\nknlGS:0000000000000000\n[ 4223.822627] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0\n[ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 4223.822628] PKRU: 55555554\n[ 4223.822628] Call Trace:\n[ 4223.822628]  qi_flush_dev_iotlb+0xb1/0xd0\n[ 4223.822628]  __dmar_remove_one_dev_info+0x224/0x250\n[ 4223.822629]  dmar_remove_one_dev_info+0x3e/0x50\n[ 4223.822629]  intel_iommu_release_device+0x1f/0x30\n[ 4223.822629]  iommu_release_device+0x33/0x60\n[ 4223.822629]  iommu_bus_notifier+0x7f/0x90\n[ 4223.822630]  blocking_notifier_call_chain+0x60/0x90\n[ 4223.822630]  device_del+0x2e5/0x420\n[ 4223.822630]  pci_remove_bus_device+0x70/0x110\n[ 4223.822630]  pciehp_unconfigure_device+0x7c/0x130\n[ 4223.822631]  pciehp_disable_slot+0x6b/0x100\n[ 4223.822631]  pciehp_handle_presence_or_link_change+0xd8/0x320\n[ 4223.822631]  pciehp_ist+0x176/0x180\n[ 4223.822631]  ? irq_finalize_oneshot.part.50+0x110/0x110\n[ 4223.822632]  irq_thread_fn+0x19/0x50\n[ 4223.822632]  irq_thread+0x104/0x190\n[ 4223.822632]  ? irq_forced_thread_fn+0x90/0x90\n[ 4223.822632]  ? irq_thread_check_affinity+0xe0/0xe0\n[ 4223.822633]  kthread+0x114/0x130\n[ 4223.822633]  ? __kthread_cancel_work+0x40/0x40\n[ 4223.822633]  ret_from_fork+0x1f/0x30\n[ 4223.822633] Kernel panic - not syncing: Hard LOCKUP\n[ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S\n         OE     kernel version xxxx\n[ 4223.822634] Hardware name: vendorname xxxx 666-106,\nBIOS 01.01.02.03.01 05/15/2023\n[ 4223.822634] Call Trace:\n[ 4223.822634]  \u003cNMI\u003e\n[ 4223.822635]  dump_stack+0x6d/0x88\n[ 4223.822635]  panic+0x101/0x2d0\n[ 4223.822635]  ? ret_from_fork+0x11/0x30\n[ 4223.822635]  nmi_panic.cold.14+0xc/0xc\n[ 4223.822636]  watchdog_overflow_callback.cold.8+0x6d/0x81\n[ 4223.822636]  __perf_event_overflow+0x4f/0xf0\n[ 4223.822636]  handle_pmi_common\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ca09bce3-ca33-4e6a-8821-34f3b8da5d01",
      "id": "CVE-2024-26984",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: fix instmem race condition around ptr stores\n\nRunning a lot of VK CTS in parallel against nouveau, once every\nfew hours you might see something like this crash.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nPGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27\nHardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021\nRIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]\nCode: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee \u003c48\u003e 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1\nRSP: 0000:ffffac20c5857838 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001\nRDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180\nRBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10\nR10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c\nR13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c\nFS:  00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\n...\n\n ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]\n ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau]\n nvkm_vmm_iter+0x351/0xa20 [nouveau]\n ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau]\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n ? __lock_acquire+0x3ed/0x2170\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau]\n ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau]\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]\n\nAdding any sort of useful debug usually makes it go away, so I hand\nwrote the function in a line, and debugged the asm.\n\nEvery so often pt-\u003ememory-\u003eptrs is NULL. This ptrs ptr is set in\nthe nv50_instobj_acquire called from nvkm_kmap.\n\nIf Thread A and Thread B both get to nv50_instobj_acquire around\nthe same time, and Thread A hits the refcount_set line, and in\nlockstep thread B succeeds at refcount_inc_not_zero, there is a\nchance the ptrs value won't have been stored since refcount_set\nis unordered. Force a memory barrier here, I picked smp_mb, since\nwe want it on all CPUs and it's write followed by a read.\n\nv2: use paired smp_rmb/smp_wmb.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db051e71-263c-4727-90f7-f1cdc6876627",
      "id": "CVE-2024-27008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: nv04: Fix out of bounds access\n\nWhen Output Resource (dcb-\u003eor) value is assigned in\nfabricate_dcb_output(), there may be out of bounds access to\ndac_users array in case dcb-\u003eor is zero because ffs(dcb-\u003eor) is\nused as index there.\nThe 'or' argument of fabricate_dcb_output() must be interpreted as a\nnumber of bit to set, not value.\n\nUtilize macros from 'enum nouveau_or' in calls instead of hardcoding.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61cdc612-72c2-420f-9b1b-afad41d548cc",
      "id": "CVE-2024-27010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix mirred deadlock on device recursion\n\nWhen the mirred action is used on a classful egress qdisc and a packet is\nmirrored or redirected to self we hit a qdisc lock deadlock.\nSee trace below.\n\n[..... other info removed for brevity....]\n[   82.890906]\n[   82.890906] ============================================\n[   82.890906] WARNING: possible recursive locking detected\n[   82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G        W\n[   82.890906] --------------------------------------------\n[   82.890906] ping/418 is trying to acquire lock:\n[   82.890906] ffff888006994110 (\u0026sch-\u003eq.lock){+.-.}-{3:3}, at:\n__dev_queue_xmit+0x1778/0x3550\n[   82.890906]\n[   82.890906] but task is already holding lock:\n[   82.890906] ffff888006994110 (\u0026sch-\u003eq.lock){+.-.}-{3:3}, at:\n__dev_queue_xmit+0x1778/0x3550\n[   82.890906]\n[   82.890906] other info that might help us debug this:\n[   82.890906]  Possible unsafe locking scenario:\n[   82.890906]\n[   82.890906]        CPU0\n[   82.890906]        ----\n[   82.890906]   lock(\u0026sch-\u003eq.lock);\n[   82.890906]   lock(\u0026sch-\u003eq.lock);\n[   82.890906]\n[   82.890906]  *** DEADLOCK ***\n[   82.890906]\n[..... other info removed for brevity....]\n\nExample setup (eth0-\u003eeth0) to recreate\ntc qdisc add dev eth0 root handle 1: htb default 30\ntc filter add dev eth0 handle 1: protocol ip prio 2 matchall \\\n     action mirred egress redirect dev eth0\n\nAnother example(eth0-\u003eeth1-\u003eeth0) to recreate\ntc qdisc add dev eth0 root handle 1: htb default 30\ntc filter add dev eth0 handle 1: protocol ip prio 2 matchall \\\n     action mirred egress redirect dev eth1\n\ntc qdisc add dev eth1 root handle 1: htb default 30\ntc filter add dev eth1 handle 1: protocol ip prio 2 matchall \\\n     action mirred egress redirect dev eth0\n\nWe fix this by adding an owner field (CPU id) to struct Qdisc set after\nroot qdisc is entered. When the softirq enters it a second time, if the\nqdisc owner is the same CPU, the packet is dropped to break the loop.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1bdca363-9655-4cd0-86c9-f408b1decdb3",
      "id": "CVE-2024-38611",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: et8ek8: Don't strip remove function when driver is builtin\n\nUsing __exit for the remove function results in the remove callback\nbeing discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets\nunbound (e.g. using sysfs or hotplug), the driver is just removed\nwithout the cleanup being performed. This results in resource leaks. Fix\nit by compiling in the remove callback unconditionally.\n\nThis also fixes a W=1 modpost warning:\n\n\tWARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -\u003e et8ek8_remove (section: .exit.text)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a8ffc62-9749-447a-9145-0ef8e989beb3",
      "id": "CVE-2024-42158",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Use kfree_sensitive() to fix Coccinelle warnings\n\nReplace memzero_explicit() and kfree() with kfree_sensitive() to fix\nwarnings reported by Coccinelle:\n\nWARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1506)\nWARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1643)\nWARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1770)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f5151398-66a2-4422-810c-233c5892027e",
      "id": "CVE-2024-38659",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: Validate length of nl attributes in enic_set_vf_port\n\nenic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE\nis of length PORT_PROFILE_MAX and that the nl attributes\nIFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX.\nThese attributes are validated (in the function do_setlink in rtnetlink.c)\nusing the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE\nas NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and\nIFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation\nusing the policy is for the max size of the attributes and not on exact\nsize so the length of these attributes might be less than the sizes that\nenic_set_vf_port expects. This might cause an out of bands\nread access in the memcpys of the data of these\nattributes in enic_set_vf_port.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0c64d86-ba8c-4b57-b3e8-559260663511",
      "id": "CVE-2024-39490",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix missing sk_buff release in seg6_input_core\n\nThe seg6_input() function is responsible for adding the SRH into a\npacket, delegating the operation to the seg6_input_core(). This function\nuses the skb_cow_head() to ensure that there is sufficient headroom in\nthe sk_buff for accommodating the link-layer header.\nIn the event that the skb_cow_header() function fails, the\nseg6_input_core() catches the error but it does not release the sk_buff,\nwhich will result in a memory leak.\n\nThis issue was introduced in commit af3b5158b89d (\"ipv6: sr: fix BUG due\nto headroom too small after SRH push\") and persists even after commit\n7a3f5b0de364 (\"netfilter: add netfilter hooks to SRv6 data plane\"),\nwhere the entire seg6_input() code was refactored to deal with netfilter\nhooks.\n\nThe proposed patch addresses the identified memory leak by requiring the\nseg6_input_core() function to release the sk_buff in the event that\nskb_cow_head() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be61457a-8944-4829-a47c-6bc242d53ad3",
      "id": "CVE-2024-40904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages\n\nThe syzbot fuzzer found that the interrupt-URB completion callback in\nthe cdc-wdm driver was taking too long, and the driver's immediate\nresubmission of interrupt URBs with -EPROTO status combined with the\ndummy-hcd emulation to cause a CPU lockup:\n\ncdc_wdm 1-1:1.0: nonzero urb status received: -71\ncdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes\nwatchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625]\nCPU#0 Utilization every 4s during lockup:\n\t#1:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#2:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#3:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#4:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#5:  98% system,\t  1% softirq,\t  3% hardirq,\t  0% idle\nModules linked in:\nirq event stamp: 73096\nhardirqs last  enabled at (73095): [\u003cffff80008037bc00\u003e] console_emit_next_record kernel/printk/printk.c:2935 [inline]\nhardirqs last  enabled at (73095): [\u003cffff80008037bc00\u003e] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994\nhardirqs last disabled at (73096): [\u003cffff80008af10b00\u003e] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]\nhardirqs last disabled at (73096): [\u003cffff80008af10b00\u003e] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551\nsoftirqs last  enabled at (73048): [\u003cffff8000801ea530\u003e] softirq_handle_end kernel/softirq.c:400 [inline]\nsoftirqs last  enabled at (73048): [\u003cffff8000801ea530\u003e] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582\nsoftirqs last disabled at (73043): [\u003cffff800080020de8\u003e] __do_softirq+0x14/0x20 kernel/softirq.c:588\nCPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G        W          6.10.0-rc2-syzkaller-g8867bbd4a056 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\n\nTesting showed that the problem did not occur if the two error\nmessages -- the first two lines above -- were removed; apparently adding\nmaterial to the kernel log takes a surprisingly large amount of time.\n\nIn any case, the best approach for preventing these lockups and to\navoid spamming the log with thousands of error messages per second is\nto ratelimit the two dev_err() calls.  Therefore we replace them with\ndev_err_ratelimited().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fecddc4b-de15-467b-bc7b-84555cc1e683",
      "id": "CVE-2024-40971",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this gap, these files\nwill not use inlinecrypt. Worse case, it may lead to data\ncorruption if wrappedkey_v0 is enable.\n\nThread A:                               Thread B:\n\n-f2fs_remount\t\t\t\t-f2fs_file_open or f2fs_new_inode\n  -default_options\n\t\u003c- clear SB_INLINECRYPT flag\n\n                                          -fscrypt_select_encryption_impl\n\n  -parse_options\n\t\u003c- set SB_INLINECRYPT again",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5b578d3-1e6b-43d1-801f-80d0a9b6a781",
      "id": "CVE-2024-40972",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: do not create EA inode under buffer lock\n\next4_xattr_set_entry() creates new EA inodes while holding buffer lock\non the external xattr block. This is problematic as it nests all the\nallocation locking (which acquires locks on other buffers) under the\nbuffer lock. This can even deadlock when the filesystem is corrupted and\ne.g. quota file is setup to contain xattr block as data block. Move the\nallocation of EA inode out of ext4_xattr_set_entry() into the callers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11e6dd63-6965-4507-b0fa-768aa31f1255",
      "id": "CVE-2024-41065",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Whitelist dtl slub object for copying to userspace\n\nReading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-*\nresults in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as\nshown below.\n\n    kernel BUG at mm/usercopy.c:102!\n    Oops: Exception in kernel mode, sig: 5 [#1]\n    LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\n    Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc\n    scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse\n    CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85\n    Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries\n    NIP:  c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8\n    REGS: c000000120c078c0 TRAP: 0700   Not tainted  (6.10.0-rc3)\n    MSR:  8000000000029033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 2828220f  XER: 0000000e\n    CFAR: c0000000001fdc80 IRQMASK: 0\n    [ ... GPRs omitted ... ]\n    NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0\n    LR [c0000000005d23d0] usercopy_abort+0x74/0xb0\n    Call Trace:\n     usercopy_abort+0x74/0xb0 (unreliable)\n     __check_heap_object+0xf8/0x120\n     check_heap_object+0x218/0x240\n     __check_object_size+0x84/0x1a4\n     dtl_file_read+0x17c/0x2c4\n     full_proxy_read+0x8c/0x110\n     vfs_read+0xdc/0x3a0\n     ksys_read+0x84/0x144\n     system_call_exception+0x124/0x330\n     system_call_vectored_common+0x15c/0x2ec\n    --- interrupt: 3000 at 0x7fff81f3ab34\n\nCommit 6d07d1cd300f (\"usercopy: Restrict non-usercopy caches to size 0\")\nrequires that only whitelisted areas in slab/slub objects can be copied to\nuserspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY.\nDtl contains hypervisor dispatch events which are expected to be read by\nprivileged users. Hence mark this safe for user access.\nSpecify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the\nentire object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46be5484-f4f7-4d0b-92ed-7ae80a22edd4",
      "id": "CVE-2024-43884",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Add error handling to pair_device()\n\nhci_conn_params_add() never checks for a NULL value and could lead to a NULL\npointer dereference causing a crash.\n\nFixed by adding error handling in the function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ffca3fb-c63e-4a31-9f3d-de69ac21ab23",
      "id": "CVE-2024-44935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: Fix null-ptr-deref in reuseport_add_sock().\n\nsyzbot reported a null-ptr-deref while accessing sk2-\u003esk_reuseport_cb in\nreuseport_add_sock(). [0]\n\nThe repro first creates a listener with SO_REUSEPORT.  Then, it creates\nanother listener on the same port and concurrently closes the first\nlistener.\n\nThe second listen() calls reuseport_add_sock() with the first listener as\nsk2, where sk2-\u003esk_reuseport_cb is not expected to be cleared concurrently,\nbut the close() does clear it by reuseport_detach_sock().\n\nThe problem is SCTP does not properly synchronise reuseport_alloc(),\nreuseport_add_sock(), and reuseport_detach_sock().\n\nThe caller of reuseport_alloc() and reuseport_{add,detach}_sock() must\nprovide synchronisation for sockets that are classified into the same\nreuseport group.\n\nOtherwise, such sockets form multiple identical reuseport groups, and\nall groups except one would be silently dead.\n\n  1. Two sockets call listen() concurrently\n  2. No socket in the same group found in sctp_ep_hashtable[]\n  3. Two sockets call reuseport_alloc() and form two reuseport groups\n  4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives\n      incoming packets\n\nAlso, the reported null-ptr-deref could occur.\n\nTCP/UDP guarantees that would not happen by holding the hash bucket lock.\n\nLet's apply the locking strategy to __sctp_hash_endpoint() and\n__sctp_unhash_endpoint().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 UID: 0 PID: 10230 Comm: syz-executor119 Not tainted 6.10.0-syzkaller-12585-g301927d2d2eb #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024\nRIP: 0010:reuseport_add_sock+0x27e/0x5e0 net/core/sock_reuseport.c:350\nCode: 00 0f b7 5d 00 bf 01 00 00 00 89 de e8 1b a4 ff f7 83 fb 01 0f 85 a3 01 00 00 e8 6d a0 ff f7 49 8d 7e 12 48 89 f8 48 c1 e8 03 \u003c42\u003e 0f b6 04 28 84 c0 0f 85 4b 02 00 00 41 0f b7 5e 12 49 8d 7e 14\nRSP: 0018:ffffc9000b947c98 EFLAGS: 00010202\nRAX: 0000000000000002 RBX: ffff8880252ddf98 RCX: ffff888079478000\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012\nRBP: 0000000000000001 R08: ffffffff8993e18d R09: 1ffffffff1fef385\nR10: dffffc0000000000 R11: fffffbfff1fef386 R12: ffff8880252ddac0\nR13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007f24e45b96c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffcced5f7b8 CR3: 00000000241be000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __sctp_hash_endpoint net/sctp/input.c:762 [inline]\n sctp_hash_endpoint+0x52a/0x600 net/sctp/input.c:790\n sctp_listen_start net/sctp/socket.c:8570 [inline]\n sctp_inet_listen+0x767/0xa20 net/sctp/socket.c:8625\n __sys_listen_socket net/socket.c:1883 [inline]\n __sys_listen+0x1b7/0x230 net/socket.c:1894\n __do_sys_listen net/socket.c:1902 [inline]\n __se_sys_listen net/socket.c:1900 [inline]\n __x64_sys_listen+0x5a/0x70 net/socket.c:1900\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f24e46039b9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f24e45b9228 EFLAGS: 00000246 ORIG_RAX: 0000000000000032\nRAX: ffffffffffffffda RBX: 00007f24e468e428 RCX: 00007f24e46039b9\nRDX: 00007f24e46039b9 RSI: 0000000000000003 RDI: 0000000000000004\nRBP: 00007f24e468e420 R08: 00007f24e45b96c0 R09: 00007f24e45b96c0\nR10: 00007f24e45b96c0 R11: 0000000000000246 R12: 00007f24e468e42c\nR13:\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c5b45c6-28d0-4bc8-95f0-0abc2fb0e585",
      "id": "CVE-2024-44995",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix a deadlock problem when config TC during resetting\n\nWhen config TC during the reset process, may cause a deadlock, the flow is\nas below:\n                             pf reset start\n                                 │\n                                 ▼\n                              ......\nsetup tc                         │\n    │                            ▼\n    ▼                      DOWN: napi_disable()\nnapi_disable()(skip)             │\n    │                            │\n    ▼                            ▼\n  ......                      ......\n    │                            │\n    ▼                            │\nnapi_enable()                    │\n                                 ▼\n                           UINIT: netif_napi_del()\n                                 │\n                                 ▼\n                              ......\n                                 │\n                                 ▼\n                           INIT: netif_napi_add()\n                                 │\n                                 ▼\n                              ......                 global reset start\n                                 │                      │\n                                 ▼                      ▼\n                           UP: napi_enable()(skip)    ......\n                                 │                      │\n                                 ▼                      ▼\n                              ......                 napi_disable()\n\nIn reset process, the driver will DOWN the port and then UINIT, in this\ncase, the setup tc process will UP the port before UINIT, so cause the\nproblem. Adds a DOWN process in UINIT to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d766fdc-8dbf-4abf-a56b-197af34eb772",
      "id": "CVE-2024-46679",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: check device is present when getting link settings\n\nA sysfs reader can race with a device reset or removal, attempting to\nread device state when the device is not actually present. eg:\n\n     [exception RIP: qed_get_current_link+17]\n  #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede]\n  #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3\n #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4\n #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300\n #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c\n #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b\n #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3\n #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1\n #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f\n #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb\n\n crash\u003e struct net_device.state ffff9a9d21336000\n    state = 5,\n\nstate 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100).\nThe device is not present, note lack of __LINK_STATE_PRESENT (0b10).\n\nThis is the same sort of panic as observed in commit 4224cfd7fb65\n(\"net-sysfs: add check for netdevice being present to speed_show\").\n\nThere are many other callers of __ethtool_get_link_ksettings() which\ndon't have a device presence check.\n\nMove this check into ethtool to protect all callers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb30f13f-ca92-4618-ba57-255bf052249e",
      "id": "CVE-2024-46761",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npci/hotplug/pnv_php: Fix hotplug driver crash on Powernv\n\nThe hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel\ncrash when we try to hot-unplug/disable the PCIe switch/bridge from\nthe PHB.\n\nThe crash occurs because although the MSI data structure has been\nreleased during disable/hot-unplug path and it has been assigned\nwith NULL, still during unregistration the code was again trying to\nexplicitly disable the MSI which causes the NULL pointer dereference and\nkernel crash.\n\nThe patch fixes the check during unregistration path to prevent invoking\npci_disable_msi/msix() since its data structure is already freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e03ba0cb-9642-42a6-8c2e-511717ec0c4f",
      "id": "CVE-2024-46805",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix the waring dereferencing hive\n\nCheck the amdgpu_hive_info *hive that maybe is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e5046eb-dafe-451d-b10d-5b3592ab3e65",
      "id": "CVE-2024-46828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: sch_cake: fix bulk flow accounting logic for host fairness\n\nIn sch_cake, we keep track of the count of active bulk flows per host,\nwhen running in dst/src host fairness mode, which is used as the\nround-robin weight when iterating through flows. The count of active\nbulk flows is updated whenever a flow changes state.\n\nThis has a peculiar interaction with the hash collision handling: when a\nhash collision occurs (after the set-associative hashing), the state of\nthe hash bucket is simply updated to match the new packet that collided,\nand if host fairness is enabled, that also means assigning new per-host\nstate to the flow. For this reason, the bulk flow counters of the\nhost(s) assigned to the flow are decremented, before new state is\nassigned (and the counters, which may not belong to the same host\nanymore, are incremented again).\n\nBack when this code was introduced, the host fairness mode was always\nenabled, so the decrement was unconditional. When the configuration\nflags were introduced the *increment* was made conditional, but\nthe *decrement* was not. Which of course can lead to a spurious\ndecrement (and associated wrap-around to U16_MAX).\n\nAFAICT, when host fairness is disabled, the decrement and wrap-around\nhappens as soon as a hash collision occurs (which is not that common in\nitself, due to the set-associative hashing). However, in most cases this\nis harmless, as the value is only used when host fairness mode is\nenabled. So in order to trigger an array overflow, sch_cake has to first\nbe configured with host fairness disabled, and while running in this\nmode, a hash collision has to occur to cause the overflow. Then, the\nqdisc has to be reconfigured to enable host fairness, which leads to the\narray out-of-bounds because the wrapped-around value is retained and\nused as an array index. It seems that syzbot managed to trigger this,\nwhich is quite impressive in its own right.\n\nThis patch fixes the issue by introducing the same conditional check on\ndecrement as is used on increment.\n\nThe original bug predates the upstreaming of cake, but the commit listed\nin the Fixes tag touched that code, meaning that this patch won't apply\nbefore that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0c56078-f3bc-4038-96ea-259b61f7503f",
      "id": "CVE-2024-46829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Drop rt_mutex::wait_lock before scheduling\n\nrt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held.  In the\ngood case it returns with the lock held and in the deadlock case it emits a\nwarning and goes into an endless scheduling loop with the lock held, which\ntriggers the 'scheduling in atomic' warning.\n\nUnlock rt_mutex::wait_lock in the dead lock case before issuing the warning\nand dropping into the schedule for ever loop.\n\n[ tglx: Moved unlock before the WARN(), removed the pointless comment,\n  \tmassaged changelog, added Fixes tag ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f34b0c7-b602-4b13-96da-ab5dab8b50ce",
      "id": "CVE-2024-49878",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nresource: fix region_intersects() vs add_memory_driver_managed()\n\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\nCXL memory may look like something as follows.\n\n490000000-50fffffff : CXL Window 0\n  490000000-50fffffff : region0\n    490000000-50fffffff : dax0.0\n      490000000-50fffffff : System RAM (kmem)\n\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\nonlining CXL memory, which makes \"System RAM (kmem)\" a descendant of \"CXL\nWindow X\".  This confuses region_intersects(), which expects all \"System\nRAM\" resources to be at the top level of iomem_resource.  This can lead to\nbugs.\n\nFor example, when the following command line is executed to write some\nmemory in CXL memory range via /dev/mem,\n\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\n dd: error writing '/dev/mem': Bad address\n 1+0 records in\n 0+0 records out\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\n\nthe command fails as expected.  However, the error code is wrong.  It\nshould be \"Operation not permitted\" instead of \"Bad address\".  More\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\nincorrectly.  Although the accessing is prevented later because ioremap()\nisn't allowed to map system RAM, it is a potential security issue.  During\ncommand executing, the following warning is reported in the kernel log for\ncalling ioremap() on system RAM.\n\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\n Call Trace:\n  memremap+0xcb/0x184\n  xlate_dev_mem_ptr+0x25/0x2f\n  write_mem+0x94/0xfb\n  vfs_write+0x128/0x26d\n  ksys_write+0xac/0xfe\n  do_syscall_64+0x9a/0xfd\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe details of command execution process are as follows.  In the above\nresource tree, \"System RAM\" is a descendant of \"CXL Window 0\" instead of a\ntop level resource.  So, region_intersects() will report no System RAM\nresources in the CXL memory region incorrectly, because it only checks the\ntop level resources.  Consequently, devmem_is_allowed() will return 1\n(allow access via /dev/mem) for CXL memory region incorrectly. \nFortunately, ioremap() doesn't allow to map System RAM and reject the\naccess.\n\nSo, region_intersects() needs to be fixed to work correctly with the\nresource tree with \"System RAM\" not at top level as above.  To fix it, if\nwe found a unmatched resource in the top level, we will continue to search\nmatched resources in its descendant resources.  So, we will not miss any\nmatched resources in resource tree anymore.\n\nIn the new implementation, an example resource tree\n\n|------------- \"CXL Window 0\" ------------|\n|-- \"System RAM\" --|\n\nwill behave similar as the following fake resource tree for\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\n\n|-- \"System RAM\" --||-- \"CXL Window 0a\" --|\n\nWhere \"CXL Window 0a\" is part of the original \"CXL Window 0\" that\nisn't covered by \"System RAM\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd3de479-1e73-4d47-9ef2-e123484db73f",
      "id": "CVE-2024-49893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream_status before it is used\n\n[WHAT \u0026 HOW]\ndc_state_get_stream_status can return null, and therefore null must be\nchecked before stream_status is used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aaae5e27-435c-4443-aa07-f79af0260026",
      "id": "CVE-2024-49972",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Deallocate DML memory if allocation fails\n\n[Why]\nWhen DC state create DML memory allocation fails, memory is not\ndeallocated subsequently, resulting in uninitialized structure\nthat is not NULL.\n\n[How]\nDeallocate memory if DML memory allocation fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5384fe2f-7ee2-475d-91f1-d3563305b860",
      "id": "CVE-2024-49974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Limit the number of concurrent async COPY operations\n\nNothing appears to limit the number of concurrent async COPY\noperations that clients can start. In addition, AFAICT each async\nCOPY can copy an unlimited number of 4MB chunks, so can run for a\nlong time. Thus IMO async COPY can become a DoS vector.\n\nAdd a restriction mechanism that bounds the number of concurrent\nbackground COPY operations. Start simple and try to be fair -- this\npatch implements a per-namespace limit.\n\nAn async COPY request that occurs while this limit is exceeded gets\nNFS4ERR_DELAY. The requesting client can choose to send the request\nagain after a delay or fall back to a traditional read/write style\ncopy.\n\nIf there is need to make the mechanism more sophisticated, we can\nvisit that in future patches.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "032eae0d-deb6-4a9e-8705-def0c91fff82",
      "id": "CVE-2024-56782",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()\n\nacpi_dev_hid_match() does not check for adev == NULL, dereferencing\nit unconditional.\n\nAdd a check for adev being NULL before calling acpi_dev_hid_match().\n\nAt the moment acpi_quirk_skip_serdev_enumeration() is never called with\na controller_parent without an ACPI companion, but better safe than sorry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab8bb085-9071-4bbd-b076-2afb5c8ced95",
      "id": "CVE-2024-50007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: asihpi: Fix potential OOB array access\n\nASIHPI driver stores some values in the static array upon a response\nfrom the driver, and its index depends on the firmware.  We shouldn't\ntrust it blindly.\n\nThis patch adds a sanity check of the array index to fit in the array\nsize.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9de0caf2-d8b7-4ac4-b2cf-ff4e30281936",
      "id": "CVE-2024-50277",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a crash if blk_alloc_disk fails\n\nIf blk_alloc_disk fails, the variable md-\u003edisk is set to an error value.\ncleanup_mapped_device will see that md-\u003edisk is non-NULL and it will\nattempt to access it, causing a crash on this statement\n\"md-\u003edisk-\u003eprivate_data = NULL;\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36b1a564-3651-4ba4-a3aa-d2beb87b4e17",
      "id": "CVE-2024-53094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES\n\nWhile running ISER over SIW, the initiator machine encounters a warning\nfrom skb_splice_from_iter() indicating that a slab page is being used in\nsend_page. To address this, it is better to add a sendpage_ok() check\nwithin the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag\nshould be disabled before entering the network stack.\n\nA similar issue has been discussed for NVMe in this thread:\nhttps://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/\n\n  WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320\n  Call Trace:\n   tcp_sendmsg_locked+0x368/0xe40\n   siw_tx_hdt+0x695/0xa40 [siw]\n   siw_qp_sq_process+0x102/0xb00 [siw]\n   siw_sq_resume+0x39/0x110 [siw]\n   siw_run_sq+0x74/0x160 [siw]\n   kthread+0xd2/0x100\n   ret_from_fork+0x34/0x40\n   ret_from_fork_asm+0x1a/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af424472-21a3-4ca1-b791-4e3295304a94",
      "id": "CVE-2024-53124",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix data-races around sk-\u003esk_forward_alloc\n\nSyzkaller reported this warning:\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0\n Modules linked in:\n CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:inet_sock_destruct+0x1c5/0x1e0\n Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 \u003c0f\u003e 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00\n RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206\n RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007\n RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00\n RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007\n R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00\n R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78\n FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cTASK\u003e\n  ? __warn+0x88/0x130\n  ? inet_sock_destruct+0x1c5/0x1e0\n  ? report_bug+0x18e/0x1a0\n  ? handle_bug+0x53/0x90\n  ? exc_invalid_op+0x18/0x70\n  ? asm_exc_invalid_op+0x1a/0x20\n  ? inet_sock_destruct+0x1c5/0x1e0\n  __sk_destruct+0x2a/0x200\n  rcu_do_batch+0x1aa/0x530\n  ? rcu_do_batch+0x13b/0x530\n  rcu_core+0x159/0x2f0\n  handle_softirqs+0xd3/0x2b0\n  ? __pfx_smpboot_thread_fn+0x10/0x10\n  run_ksoftirqd+0x25/0x30\n  smpboot_thread_fn+0xdd/0x1d0\n  kthread+0xd3/0x100\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x34/0x50\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nIts possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add()\nconcurrently when sk-\u003esk_state == TCP_LISTEN with sk-\u003esk_lock unlocked,\nwhich triggers a data-race around sk-\u003esk_forward_alloc:\ntcp_v6_rcv\n    tcp_v6_do_rcv\n        skb_clone_and_charge_r\n            sk_rmem_schedule\n                __sk_mem_schedule\n                    sk_forward_alloc_add()\n            skb_set_owner_r\n                sk_mem_charge\n                    sk_forward_alloc_add()\n        __kfree_skb\n            skb_release_all\n                skb_release_head_state\n                    sock_rfree\n                        sk_mem_uncharge\n                            sk_forward_alloc_add()\n                            sk_mem_reclaim\n                                // set local var reclaimable\n                                __sk_mem_reclaim\n                                    sk_forward_alloc_add()\n\nIn this syzkaller testcase, two threads call\ntcp_v6_do_rcv() with skb-\u003etruesize=768, the sk_forward_alloc changes like\nthis:\n (cpu 1)             | (cpu 2)             | sk_forward_alloc\n ...                 | ...                 | 0\n __sk_mem_schedule() |                     | +4096 = 4096\n                     | __sk_mem_schedule() | +4096 = 8192\n sk_mem_charge()     |                     | -768  = 7424\n                     | sk_mem_charge()     | -768  = 6656\n ...                 |    ...              |\n sk_mem_uncharge()   |                     | +768  = 7424\n reclaimable=7424    |                     |\n                     | sk_mem_uncharge()   | +768  = 8192\n                     | reclaimable=8192    |\n __sk_mem_reclaim()  |                     | -4096 = 4096\n                     | __sk_mem_reclaim()  | -8192 = -4096 != 0\n\nThe skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when\nsk-\u003esk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock().\nFix the same issue in dccp_v6_do_rcv().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95cab1bf-82e3-4f95-88b6-a7be3adb1579",
      "id": "CVE-2024-56539",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()\n\nReplace one-element array with a flexible-array member in `struct\nmwifiex_ie_types_wildcard_ssid_params` to fix the following warning\non a MT8173 Chromebook (mt8173-elm-hana):\n\n[  356.775250] ------------[ cut here ]------------\n[  356.784543] memcpy: detected field-spanning write (size 6) of single field \"wildcard_ssid_tlv-\u003essid\" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1)\n[  356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]\n\nThe \"(size 6)\" above is exactly the length of the SSID of the network\nthis device was connected to. The source of the warning looks like:\n\n    ssid_len = user_scan_in-\u003essid_list[i].ssid_len;\n    [...]\n    memcpy(wildcard_ssid_tlv-\u003essid,\n           user_scan_in-\u003essid_list[i].ssid, ssid_len);\n\nThere is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this\nstruct, but it already didn't account for the size of the one-element\narray, so it doesn't need to be changed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6877ae0a-2793-4c9c-b563-69a726d0133f",
      "id": "CVE-2024-56595",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add a check to prevent array-index-out-of-bounds in dbAdjTree\n\nWhen the value of lp is 0 at the beginning of the for loop, it will\nbecome negative in the next assignment and we should bail out.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2f2dd3e-981a-4f7e-9418-150777366e16",
      "id": "CVE-2024-56779",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur\n\nThe action force umount(umount -f) will attempt to kill all rpc_task even\numount operation may ultimately fail if some files remain open.\nConsequently, if an action attempts to open a file, it can potentially\nsend two rpc_task to nfs server.\n\n                   NFS CLIENT\nthread1                             thread2\nopen(\"file\")\n...\nnfs4_do_open\n _nfs4_do_open\n  _nfs4_open_and_get_state\n   _nfs4_proc_open\n    nfs4_run_open_task\n     /* rpc_task1 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\n                                    umount -f\n                                    nfs_umount_begin\n                                     rpc_killall_tasks\n                                      rpc_signal_task\n     rpc_task1 been wakeup\n     and return -512\n _nfs4_do_open // while loop\n    ...\n    nfs4_run_open_task\n     /* rpc_task2 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\nWhile processing an open request, nfsd will first attempt to find or\nallocate an nfs4_openowner. If it finds an nfs4_openowner that is not\nmarked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since\ntwo rpc_task can attempt to open the same file simultaneously from the\nclient to server, and because two instances of nfsd can run\nconcurrently, this situation can lead to lots of memory leak.\nAdditionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be\ntriggered.\n\n                    NFS SERVER\nnfsd1                  nfsd2       echo 0 \u003e /proc/fs/nfsd/threads\n\nnfsd4_open\n nfsd4_process_open1\n  find_or_alloc_open_stateowner\n   // alloc oo1, stateid1\n                       nfsd4_open\n                        nfsd4_process_open1\n                        find_or_alloc_open_stateowner\n                        // find oo1, without NFS4_OO_CONFIRMED\n                         release_openowner\n                          unhash_openowner_locked\n                          list_del_init(\u0026oo-\u003eoo_perclient)\n                          // cannot find this oo\n                          // from client, LEAK!!!\n                         alloc_stateowner // alloc oo2\n\n nfsd4_process_open2\n  init_open_stateid\n  // associate oo1\n  // with stateid1, stateid1 LEAK!!!\n  nfs4_get_vfs_file\n  // alloc nfsd_file1 and nfsd_file_mark1\n  // all LEAK!!!\n\n                         nfsd4_process_open2\n                         ...\n\n                                    write_threads\n                                     ...\n                                     nfsd_destroy_serv\n                                      nfsd_shutdown_net\n                                       nfs4_state_shutdown_net\n                                        nfs4_state_destroy_net\n                                         destroy_client\n                                          __destroy_client\n                                          // won't find oo1!!!\n                                     nfsd_shutdown_generic\n                                      nfsd_file_cache_shutdown\n                                       kmem_cache_destroy\n                                       for nfsd_file_slab\n                                       and nfsd_file_mark_slab\n                                       // bark since nfsd_file1\n                                       // and nfsd_file_mark1\n                                       // still alive\n\n=======================================================================\nBUG nfsd_file (Not tainted): Objects remaining in nfsd_file on\n__kmem_cache_shutdown()\n-----------------------------------------------------------------------\n\nSlab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28\nflags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)\nCPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dum\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1270d0a-59b5-4175-bb88-6c5ff3e21387",
      "id": "CVE-2024-57875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: RCU protect disk-\u003econv_zones_bitmap\n\nEnsure that a disk revalidation changing the conventional zones bitmap\nof a disk does not cause invalid memory references when using the\ndisk_zone_is_conv() helper by RCU protecting the disk-\u003econv_zones_bitmap\npointer.\n\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\nthe function disk_set_conv_zones_bitmap() is added to update a disk\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\nzone_wplugs_lock spinlock held.\n\ndisk_free_zone_resources() is modified to call\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\nfree the old one.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "658b9a60-e045-46ad-b659-8ab8fbbb92b8",
      "id": "CVE-2024-49861",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix helper writes to read-only maps\n\nLonial found an issue that despite user- and BPF-side frozen BPF map\n(like in case of .rodata), it was still possible to write into it from\na BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT}\nas arguments.\n\nIn check_func_arg() when the argument is as mentioned, the meta-\u003eraw_mode\nis never set. Later, check_helper_mem_access(), under the case of\nPTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the\nsubsequent call to check_map_access_type() and given the BPF map is\nread-only it succeeds.\n\nThe helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT\nwhen results are written into them as opposed to read out of them. The\nlatter indicates that it's okay to pass a pointer to uninitialized memory\nas the memory is written to anyway.\n\nHowever, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM\njust with additional alignment requirement. So it is better to just get\nrid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the\nfixed size memory types. For this, add MEM_ALIGNED to additionally ensure\nalignment given these helpers write directly into the args via *\u003cptr\u003e = val.\nThe .arg*_size has been initialized reflecting the actual sizeof(*\u003cptr\u003e).\n\nMEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated\nargument types, since in !MEM_FIXED_SIZE cases the verifier does not know\nthe buffer size a priori and therefore cannot blindly write *\u003cptr\u003e = val.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24f9cac0-8eea-4c08-a13f-f233a1f672a4",
      "id": "CVE-2024-57924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: relax assertions on failure to encode file handles\n\nEncoding file handles is usually performed by a filesystem \u003eencode_fh()\nmethod that may fail for various reasons.\n\nThe legacy users of exportfs_encode_fh(), namely, nfsd and\nname_to_handle_at(2) syscall are ready to cope with the possibility\nof failure to encode a file handle.\n\nThere are a few other users of exportfs_encode_{fh,fid}() that\ncurrently have a WARN_ON() assertion when -\u003eencode_fh() fails.\nRelax those assertions because they are wrong.\n\nThe second linked bug report states commit 16aac5ad1fa9 (\"ovl: support\nencoding non-decodable file handles\") in v6.6 as the regressing commit,\nbut this is not accurate.\n\nThe aforementioned commit only increases the chances of the assertion\nand allows triggering the assertion with the reproducer using overlayfs,\ninotify and drop_caches.\n\nTriggering this assertion was always possible with other filesystems and\nother reasons of -\u003eencode_fh() failures and more particularly, it was\nalso possible with the exact same reproducer using overlayfs that is\nmounted with options index=on,nfs_export=on also on kernels \u003c v6.6.\nTherefore, I am not listing the aforementioned commit as a Fixes commit.\n\nBackport hint: this patch will have a trivial conflict applying to\nv6.6.y, and other trivial conflicts applying to stable kernels \u003c v6.6.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d15100f-9f1c-4093-97e3-4db539add6fb",
      "id": "CVE-2025-21763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: use RCU protection in __neigh_notify()\n\n__neigh_notify() can be called without RTNL or RCU protection.\n\nUse RCU protection to avoid potential UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b95e0b8b-b72c-433d-a46a-ad3a16ba9e17",
      "id": "CVE-2025-21858",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: Fix use-after-free in geneve_find_dev().\n\nsyzkaller reported a use-after-free in geneve_find_dev() [0]\nwithout repro.\n\ngeneve_configure() links struct geneve_dev.next to\nnet_generic(net, geneve_net_id)-\u003egeneve_list.\n\nThe net here could differ from dev_net(dev) if IFLA_NET_NS_PID,\nIFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set.\n\nWhen dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally\ncalls unregister_netdevice_queue() for each dev in the netns,\nand later the dev is freed.\n\nHowever, its geneve_dev.next is still linked to the backend UDP\nsocket netns.\n\nThen, use-after-free will occur when another geneve dev is created\nin the netns.\n\nLet's call geneve_dellink() instead in geneve_destroy_tunnels().\n\n[0]:\nBUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline]\nBUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343\nRead of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441\n\nCPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d\nHardware name: linux,dummy-virt (DT)\nCall trace:\n show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x16c/0x6f0 mm/kasan/report.c:489\n kasan_report+0xc0/0x120 mm/kasan/report.c:602\n __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379\n geneve_find_dev drivers/net/geneve.c:1295 [inline]\n geneve_configure+0x234/0x858 drivers/net/geneve.c:1343\n geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634\n rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021\n rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911\n netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543\n rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892\n sock_sendmsg_nosec net/socket.c:713 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568\n ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622\n __sys_sendmsg net/socket.c:2654 [inline]\n __do_sys_sendmsg net/socket.c:2659 [inline]\n __se_sys_sendmsg net/socket.c:2657 [inline]\n __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151\n el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600\n\nAllocated by task 13247:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x30/0x68 mm/kasan/common.c:68\n kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4298 [inline]\n __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304\n __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645\n alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470\n rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604\n rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021\n rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911\n netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543\n rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938\n netlink_unicast_kernel net/netlink/af_n\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "204ccc6e-dfc4-4276-bec9-b79519b8daf2",
      "id": "CVE-2025-22079",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate l_tree_depth to avoid out-of-bounds access\n\nThe l_tree_depth field is 16-bit (__le16), but the actual maximum depth is\nlimited to OCFS2_MAX_PATH_DEPTH.\n\nAdd a check to prevent out-of-bounds access if l_tree_depth has an invalid\nvalue, which may occur when reading from a corrupted mounted disk [1].",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a5714d4-242c-49d8-97d2-721b39805576",
      "id": "CVE-2025-22109",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Remove broken autobind\n\nBinding AX25 socket by using the autobind feature leads to memory leaks\nin ax25_connect() and also refcount leaks in ax25_release(). Memory\nleak was detected with kmemleak:\n\n================================================================\nunreferenced object 0xffff8880253cd680 (size 96):\nbacktrace:\n__kmalloc_node_track_caller_noprof (./include/linux/kmemleak.h:43)\nkmemdup_noprof (mm/util.c:136)\nax25_rt_autobind (net/ax25/ax25_route.c:428)\nax25_connect (net/ax25/af_ax25.c:1282)\n__sys_connect_file (net/socket.c:2045)\n__sys_connect (net/socket.c:2064)\n__x64_sys_connect (net/socket.c:2067)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n================================================================\n\nWhen socket is bound, refcounts must be incremented the way it is done\nin ax25_bind() and ax25_setsockopt() (SO_BINDTODEVICE). In case of\nautobind, the refcounts are not incremented.\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nax25_connect(): syz-executor318 uses autobind, please contact jreuter@yaina.de\n------------[ cut here ]------------\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 0 PID: 5317 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31\nModules linked in:\nCPU: 0 UID: 0 PID: 5317 Comm: syz-executor318 Not tainted 6.14.0-rc4-syzkaller-00278-gece144f151ac #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31\n...\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x6af/0x7e0 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4302 [inline]\n netdev_put include/linux/netdevice.h:4319 [inline]\n ax25_release+0x368/0x960 net/ax25/af_ax25.c:1080\n __sock_release net/socket.c:647 [inline]\n sock_close+0xbc/0x240 net/socket.c:1398\n __fput+0x3e9/0x9f0 fs/file_table.c:464\n __do_sys_close fs/open.c:1580 [inline]\n __se_sys_close fs/open.c:1565 [inline]\n __x64_sys_close+0x7f/0x110 fs/open.c:1565\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n \u003c/TASK\u003e\n================================================================\n\nConsidering the issues above and the comments left in the code that say:\n\"check if we can remove this feature. It is broken.\"; \"autobinding in this\nmay or may not work\"; - it is better to completely remove this feature than\nto fix it because it is broken and leads to various kinds of memory bugs.\n\nNow calling connect() without first binding socket will result in an\nerror (-EINVAL). Userspace software that relies on the autobind feature\nmight get broken. However, this feature does not seem widely used with\nthis specific driver as it was not reliable at any point of time, and it\nis already broken anyway. E.g. ax25-tools and ax25-apps packages for\npopular distributions do not use the autobind feature for AF_AX25.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6e4986e-4f1a-4b69-aae7-8b0672e63ac3",
      "id": "CVE-2025-23142",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: detect and prevent references to a freed transport in sendmsg\n\nsctp_sendmsg() re-uses associations and transports when possible by\ndoing a lookup based on the socket endpoint and the message destination\naddress, and then sctp_sendmsg_to_asoc() sets the selected transport in\nall the message chunks to be sent.\n\nThere's a possible race condition if another thread triggers the removal\nof that selected transport, for instance, by explicitly unbinding an\naddress with setsockopt(SCTP_SOCKOPT_BINDX_REM), after the chunks have\nbeen set up and before the message is sent. This can happen if the send\nbuffer is full, during the period when the sender thread temporarily\nreleases the socket lock in sctp_wait_for_sndbuf().\n\nThis causes the access to the transport data in\nsctp_outq_select_transport(), when the association outqueue is flushed,\nto result in a use-after-free read.\n\nThis change avoids this scenario by having sctp_transport_free() signal\nthe freeing of the transport, tagging it as \"dead\". In order to do this,\nthe patch restores the \"dead\" bit in struct sctp_transport, which was\nremoved in\ncommit 47faa1e4c50e (\"sctp: remove the dead field of sctp_transport\").\n\nThen, in the scenario where the sender thread has released the socket\nlock in sctp_wait_for_sndbuf(), the bit is checked again after\nre-acquiring the socket lock to detect the deletion. This is done while\nholding a reference to the transport to prevent it from being freed in\nthe process.\n\nIf the transport was deleted while the socket lock was relinquished,\nsctp_sendmsg_to_asoc() will return -EAGAIN to let userspace retry the\nsend.\n\nThe bug was found by a private syzbot instance (see the error report [1]\nand the C reproducer that triggers it [2]).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a78622e-ebb6-4cc8-bfff-f6646fe06c01",
      "id": "CVE-2025-37781",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cros-ec-tunnel: defer probe if parent EC is not present\n\nWhen i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent\ndevice will not be found, leading to NULL pointer dereference.\n\nThat can also be reproduced by unbinding the controller driver and then\nloading i2c-cros-ec-tunnel module (or binding the device).\n\n[  271.991245] BUG: kernel NULL pointer dereference, address: 0000000000000058\n[  271.998215] #PF: supervisor read access in kernel mode\n[  272.003351] #PF: error_code(0x0000) - not-present page\n[  272.008485] PGD 0 P4D 0\n[  272.011022] Oops: Oops: 0000 [#1] SMP NOPTI\n[  272.015207] CPU: 0 UID: 0 PID: 3859 Comm: insmod Tainted: G S                  6.15.0-rc1-00004-g44722359ed83 #30 PREEMPT(full)  3c7fb39a552e7d949de2ad921a7d6588d3a4fdc5\n[  272.030312] Tainted: [S]=CPU_OUT_OF_SPEC\n[  272.034233] Hardware name: HP Berknip/Berknip, BIOS Google_Berknip.13434.356.0 05/17/2021\n[  272.042400] RIP: 0010:ec_i2c_probe+0x2b/0x1c0 [i2c_cros_ec_tunnel]\n[  272.048577] Code: 1f 44 00 00 41 57 41 56 41 55 41 54 53 48 83 ec 10 65 48 8b 05 06 a0 6c e7 48 89 44 24 08 4c 8d 7f 10 48 8b 47 50 4c 8b 60 78 \u003c49\u003e 83 7c 24 58 00 0f 84 2f 01 00 00 48 89 fb be 30 06 00 00 4c 9\n[  272.067317] RSP: 0018:ffffa32082a03940 EFLAGS: 00010282\n[  272.072541] RAX: ffff969580b6a810 RBX: ffff969580b68c10 RCX: 0000000000000000\n[  272.079672] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff969580b68c00\n[  272.086804] RBP: 00000000fffffdfb R08: 0000000000000000 R09: 0000000000000000\n[  272.093936] R10: 0000000000000000 R11: ffffffffc0600000 R12: 0000000000000000\n[  272.101067] R13: ffffffffa666fbb8 R14: ffffffffc05b5528 R15: ffff969580b68c10\n[  272.108198] FS:  00007b930906fc40(0000) GS:ffff969603149000(0000) knlGS:0000000000000000\n[  272.116282] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  272.122024] CR2: 0000000000000058 CR3: 000000012631c000 CR4: 00000000003506f0\n[  272.129155] Call Trace:\n[  272.131606]  \u003cTASK\u003e\n[  272.133709]  ? acpi_dev_pm_attach+0xdd/0x110\n[  272.137985]  platform_probe+0x69/0xa0\n[  272.141652]  really_probe+0x152/0x310\n[  272.145318]  __driver_probe_device+0x77/0x110\n[  272.149678]  driver_probe_device+0x1e/0x190\n[  272.153864]  __driver_attach+0x10b/0x1e0\n[  272.157790]  ? driver_attach+0x20/0x20\n[  272.161542]  bus_for_each_dev+0x107/0x150\n[  272.165553]  bus_add_driver+0x15d/0x270\n[  272.169392]  driver_register+0x65/0x110\n[  272.173232]  ? cleanup_module+0xa80/0xa80 [i2c_cros_ec_tunnel 3a00532f3f4af4a9eade753f86b0f8dd4e4e5698]\n[  272.182617]  do_one_initcall+0x110/0x350\n[  272.186543]  ? security_kernfs_init_security+0x49/0xd0\n[  272.191682]  ? __kernfs_new_node+0x1b9/0x240\n[  272.195954]  ? security_kernfs_init_security+0x49/0xd0\n[  272.201093]  ? __kernfs_new_node+0x1b9/0x240\n[  272.205365]  ? kernfs_link_sibling+0x105/0x130\n[  272.209810]  ? kernfs_next_descendant_post+0x1c/0xa0\n[  272.214773]  ? kernfs_activate+0x57/0x70\n[  272.218699]  ? kernfs_add_one+0x118/0x160\n[  272.222710]  ? __kernfs_create_file+0x71/0xa0\n[  272.227069]  ? sysfs_add_bin_file_mode_ns+0xd6/0x110\n[  272.232033]  ? internal_create_group+0x453/0x4a0\n[  272.236651]  ? __vunmap_range_noflush+0x214/0x2d0\n[  272.241355]  ? __free_frozen_pages+0x1dc/0x420\n[  272.245799]  ? free_vmap_area_noflush+0x10a/0x1c0\n[  272.250505]  ? load_module+0x1509/0x16f0\n[  272.254431]  do_init_module+0x60/0x230\n[  272.258181]  __se_sys_finit_module+0x27a/0x370\n[  272.262627]  do_syscall_64+0x6a/0xf0\n[  272.266206]  ? do_syscall_64+0x76/0xf0\n[  272.269956]  ? irqentry_exit_to_user_mode+0x79/0x90\n[  272.274836]  entry_SYSCALL_64_after_hwframe+0x55/0x5d\n[  272.279887] RIP: 0033:0x7b9309168d39\n[  272.283466] Code: 5b 41 5c 5d c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d af 40 0c 00 f7 d8 64 89 01 8\n[  272.302210] RSP: 002b:00007fff50f1a288 EFLAGS: 00000246 ORIG_RAX: 000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d744d82-0cbf-435c-8353-9e33d8563e55",
      "id": "CVE-2025-37836",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix reference leak in pci_register_host_bridge()\n\nIf device_register() fails, call put_device() to give up the reference to\navoid a memory leak, per the comment at device_register().\n\nFound by code review.\n\n[bhelgaas: squash Dan Carpenter's double free fix from\nhttps://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1e5bb3d-0bab-430c-b157-bbc08fb707a9",
      "id": "CVE-2025-37858",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: Prevent integer overflow in AG size calculation\n\nThe JFS filesystem calculates allocation group (AG) size using 1 \u003c\u003c\nl2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with \u003e2TB\naggregates on 32-bit systems), this 32-bit shift operation causes undefined\nbehavior and improper AG sizing.\n\nOn 32-bit architectures:\n- Left-shifting 1 by 32+ bits results in 0 due to integer overflow\n- This creates invalid AG sizes (0 or garbage values) in\nsbi-\u003ebmap-\u003edb_agsize\n- Subsequent block allocations would reference invalid AG structures\n- Could lead to:\n  - Filesystem corruption during extend operations\n  - Kernel crashes due to invalid memory accesses\n  - Security vulnerabilities via malformed on-disk structures\n\nFix by casting to s64 before shifting:\nbmp-\u003edb_agsize = (s64)1 \u003c\u003c l2agsize;\n\nThis ensures 64-bit arithmetic even on 32-bit architectures. The cast\nmatches the data type of db_agsize (s64) and follows similar patterns in\nJFS block calculation code.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57ca7262-f99a-489d-ab18-f3a73cac2251",
      "id": "CVE-2025-37859",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: avoid infinite loop to schedule delayed worker\n\nWe noticed the kworker in page_pool_release_retry() was waken\nup repeatedly and infinitely in production because of the\nbuggy driver causing the inflight less than 0 and warning\nus in page_pool_inflight()[1].\n\nSince the inflight value goes negative, it means we should\nnot expect the whole page_pool to get back to work normally.\n\nThis patch mitigates the adverse effect by not rescheduling\nthe kworker when detecting the inflight negative in\npage_pool_release_retry().\n\n[1]\n[Mon Feb 10 20:36:11 2025] ------------[ cut here ]------------\n[Mon Feb 10 20:36:11 2025] Negative(-51446) inflight packet-pages\n...\n[Mon Feb 10 20:36:11 2025] Call Trace:\n[Mon Feb 10 20:36:11 2025]  page_pool_release_retry+0x23/0x70\n[Mon Feb 10 20:36:11 2025]  process_one_work+0x1b1/0x370\n[Mon Feb 10 20:36:11 2025]  worker_thread+0x37/0x3a0\n[Mon Feb 10 20:36:11 2025]  kthread+0x11a/0x140\n[Mon Feb 10 20:36:11 2025]  ? process_one_work+0x370/0x370\n[Mon Feb 10 20:36:11 2025]  ? __kthread_cancel_work+0x40/0x40\n[Mon Feb 10 20:36:11 2025]  ret_from_fork+0x35/0x40\n[Mon Feb 10 20:36:11 2025] ---[ end trace ebffe800f33e7e34 ]---\nNote: before this patch, the above calltrace would flood the\ndmesg due to repeated reschedule of release_dw kworker.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2f5a359-7e7a-43fe-a5c5-940713fc8fcc",
      "id": "CVE-2025-37880",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: work around sched_yield not yielding in time-travel mode\n\nsched_yield by a userspace may not actually cause scheduling in\ntime-travel mode as no time has passed. In the case seen it appears to\nbe a badly implemented userspace spinlock in ASAN. Unfortunately, with\ntime-travel it causes an extreme slowdown or even deadlock depending on\nthe kernel configuration (CONFIG_UML_MAX_USERSPACE_ITERATIONS).\n\nWork around it by accounting time to the process whenever it executes a\nsched_yield syscall.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "046fd044-0ddd-4d2f-ae69-35db41d3a7c0",
      "id": "CVE-2020-26558",
      "description": "Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c4ed480f-9a74-40ea-9038-5e4832046ad6",
      "id": "CVE-2025-38337",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()\n\nSince handle-\u003eh_transaction may be a NULL pointer, so we should change it\nto call is_handle_aborted(handle) first before dereferencing it.\n\nAnd the following data-race was reported in my fuzzer:\n\n==================================================================\nBUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata\n\nwrite to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1:\n jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556\n __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358\n ext4_do_update_inode fs/ext4/inode.c:5220 [inline]\n ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869\n __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074\n ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103\n....\n\nread to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0:\n jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512\n __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358\n ext4_do_update_inode fs/ext4/inode.c:5220 [inline]\n ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869\n __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074\n ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103\n....\n\nvalue changed: 0x00000000 -\u003e 0x00000001\n==================================================================\n\nThis issue is caused by missing data-race annotation for jh-\u003eb_modified.\nTherefore, the missing annotation needs to be added.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73f2e315-c486-42b5-8315-26af5a2cbaaf",
      "id": "CVE-2025-38445",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: Fix stack memory use after return in raid1_reshape\n\nIn the raid1_reshape function, newpool is\nallocated on the stack and assigned to conf-\u003er1bio_pool.\nThis results in conf-\u003er1bio_pool.wait.head pointing\nto a stack address.\nAccessing this address later can lead to a kernel panic.\n\nExample access path:\n\nraid1_reshape()\n{\n\t// newpool is on the stack\n\tmempool_t newpool, oldpool;\n\t// initialize newpool.wait.head to stack address\n\tmempool_init(\u0026newpool, ...);\n\tconf-\u003er1bio_pool = newpool;\n}\n\nraid1_read_request() or raid1_write_request()\n{\n\talloc_r1bio()\n\t{\n\t\tmempool_alloc()\n\t\t{\n\t\t\t// if pool-\u003ealloc fails\n\t\t\tremove_element()\n\t\t\t{\n\t\t\t\t--pool-\u003ecurr_nr;\n\t\t\t}\n\t\t}\n\t}\n}\n\nmempool_free()\n{\n\tif (pool-\u003ecurr_nr \u003c pool-\u003emin_nr) {\n\t\t// pool-\u003ewait.head is a stack address\n\t\t// wake_up() will try to access this invalid address\n\t\t// which leads to a kernel panic\n\t\treturn;\n\t\twake_up(\u0026pool-\u003ewait);\n\t}\n}\n\nFix:\nreinit conf-\u003er1bio_pool.wait after assigning newpool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f35b81f7-b659-48fd-9211-3abe5ed530d5",
      "id": "CVE-2025-38487",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: aspeed: lpc-snoop: Don't disable channels that aren't enabled\n\nMitigate e.g. the following:\n\n    # echo 1e789080.lpc-snoop \u003e /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind\n    ...\n    [  120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write\n    [  120.373866] [00000004] *pgd=00000000\n    [  120.377910] Internal error: Oops: 805 [#1] SMP ARM\n    [  120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE\n    ...\n    [  120.679543] Call trace:\n    [  120.679559]  misc_deregister from aspeed_lpc_snoop_remove+0x84/0xac\n    [  120.692462]  aspeed_lpc_snoop_remove from platform_remove+0x28/0x38\n    [  120.700996]  platform_remove from device_release_driver_internal+0x188/0x200\n    ...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6813ead4-1cee-4d14-b16b-9eed2f73e3c7",
      "id": "CVE-2025-38717",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: kcm: Fix race condition in kcm_unattach()\n\nsyzbot found a race condition when kcm_unattach(psock)\nand kcm_release(kcm) are executed at the same time.\n\nkcm_unattach() is missing a check of the flag\nkcm-\u003etx_stopped before calling queue_work().\n\nIf the kcm has a reserved psock, kcm_unattach() might get executed\nbetween cancel_work_sync() and unreserve_psock() in kcm_release(),\nrequeuing kcm-\u003etx_work right before kcm gets freed in kcm_done().\n\nRemove kcm-\u003etx_stopped and replace it by the less\nerror-prone disable_work_sync().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f503284e-11ce-4037-91ed-1529fbe675f0",
      "id": "CVE-2025-38734",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on smcsk after smc_listen_out()\n\nBPF CI testing report a UAF issue:\n\n  [   16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003  0\n  [   16.447134] #PF: supervisor read access in kernel mod  e\n  [   16.447516] #PF: error_code(0x0000) - not-present pag  e\n  [   16.447878] PGD 0 P4D   0\n  [   16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT  I\n  [   16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G           OE      6.13.0-rc3-g89e8a75fda73-dirty #4  2\n  [   16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL  E\n  [   16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201  4\n  [   16.450201] Workqueue: smc_hs_wq smc_listen_wor  k\n  [   16.450531] RIP: 0010:smc_listen_work+0xc02/0x159  0\n  [   16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024  6\n  [   16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030  0\n  [   16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000  0\n  [   16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000  5\n  [   16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640  0\n  [   16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092  0\n  [   16.454996] FS:  0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000  0\n  [   16.455557] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003  3\n  [   16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef  0\n  [   16.456459] PKRU: 5555555  4\n  [   16.456654] Call Trace  :\n  [   16.456832]  \u003cTASK  \u003e\n  [   16.456989]  ? __die+0x23/0x7  0\n  [   16.457215]  ? page_fault_oops+0x180/0x4c  0\n  [   16.457508]  ? __lock_acquire+0x3e6/0x249  0\n  [   16.457801]  ? exc_page_fault+0x68/0x20  0\n  [   16.458080]  ? asm_exc_page_fault+0x26/0x3  0\n  [   16.458389]  ? smc_listen_work+0xc02/0x159  0\n  [   16.458689]  ? smc_listen_work+0xc02/0x159  0\n  [   16.458987]  ? lock_is_held_type+0x8f/0x10  0\n  [   16.459284]  process_one_work+0x1ea/0x6d  0\n  [   16.459570]  worker_thread+0x1c3/0x38  0\n  [   16.459839]  ? __pfx_worker_thread+0x10/0x1  0\n  [   16.460144]  kthread+0xe0/0x11  0\n  [   16.460372]  ? __pfx_kthread+0x10/0x1  0\n  [   16.460640]  ret_from_fork+0x31/0x5  0\n  [   16.460896]  ? __pfx_kthread+0x10/0x1  0\n  [   16.461166]  ret_from_fork_asm+0x1a/0x3  0\n  [   16.461453]  \u003c/TASK  \u003e\n  [   16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE)  ]\n  [   16.462134] CR2: 000000000000003  0\n  [   16.462380] ---[ end trace 0000000000000000 ]---\n  [   16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590\n\nThe direct cause of this issue is that after smc_listen_out_connected(),\nnewclcsock-\u003esk may be NULL since it will releases the smcsk. Therefore,\nif the application closes the socket immediately after accept,\nnewclcsock-\u003esk can be NULL. A possible execution order could be as\nfollows:\n\nsmc_listen_work                                 | userspace\n-----------------------------------------------------------------\nlock_sock(sk)                                   |\nsmc_listen_out_connected()                      |\n| \\- smc_listen_out                             |\n|    | \\- release_sock                          |\n     | |- sk-\u003esk_data_ready()                   |\n                                                | fd = accept();\n                                                | close(fd);\n                                                |  \\- socket-\u003esk = NULL;\n/* newclcsock-\u003esk is NULL now */\nSMC_STAT_SERV_SUCC_INC(sock_net(newclcsock-\u003esk))\n\nSince smc_listen_out_connected() will not fail, simply swapping the order\nof the code can easily fix this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c6ec476c-615d-4c4f-a33c-de488792d643",
      "id": "CVE-2020-12351",
      "description": "Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb30ea90-6a98-4257-b054-b0f76abb62cc",
      "id": "CVE-2021-26931",
      "description": "An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84b54fd0-850d-4c78-a234-90967f17a3d0",
      "id": "CVE-2021-35477",
      "description": "In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f03b7148-cd03-48bb-a8bd-53a2f13f6382",
      "id": "CVE-2021-3600",
      "description": "It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod operations. A local attacker could use this to possibly execute arbitrary code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f22139e-ab42-4488-8ee9-13fba22f290f",
      "id": "CVE-2021-46932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: appletouch - initialize work before device registration\n\nSyzbot has reported warning in __flush_work(). This warning is caused by\nwork-\u003efunc == NULL, which means missing work initialization.\n\nThis may happen, since input_dev-\u003eclose() calls\ncancel_work_sync(\u0026dev-\u003ework), but dev-\u003ework initalization happens _after_\ninput_register_device() call.\n\nSo this patch moves dev-\u003ework initialization before registering input\ndevice",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c203d39a-998b-42e3-8735-4f232ff6fea1",
      "id": "CVE-2021-46961",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3: Do not enable irqs when handling spurious interrups\n\nWe triggered the following error while running our 4.19 kernel\nwith the pseudo-NMI patches backported to it:\n\n[   14.816231] ------------[ cut here ]------------\n[   14.816231] kernel BUG at irq.c:99!\n[   14.816232] Internal error: Oops - BUG: 0 [#1] SMP\n[   14.816232] Process swapper/0 (pid: 0, stack limit = 0x(____ptrval____))\n[   14.816233] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O      4.19.95.aarch64 #14\n[   14.816233] Hardware name: evb (DT)\n[   14.816234] pstate: 80400085 (Nzcv daIf +PAN -UAO)\n[   14.816234] pc : asm_nmi_enter+0x94/0x98\n[   14.816235] lr : asm_nmi_enter+0x18/0x98\n[   14.816235] sp : ffff000008003c50\n[   14.816235] pmr_save: 00000070\n[   14.816237] x29: ffff000008003c50 x28: ffff0000095f56c0\n[   14.816238] x27: 0000000000000000 x26: ffff000008004000\n[   14.816239] x25: 00000000015e0000 x24: ffff8008fb916000\n[   14.816240] x23: 0000000020400005 x22: ffff0000080817cc\n[   14.816241] x21: ffff000008003da0 x20: 0000000000000060\n[   14.816242] x19: 00000000000003ff x18: ffffffffffffffff\n[   14.816243] x17: 0000000000000008 x16: 003d090000000000\n[   14.816244] x15: ffff0000095ea6c8 x14: ffff8008fff5ab40\n[   14.816244] x13: ffff8008fff58b9d x12: 0000000000000000\n[   14.816245] x11: ffff000008c8a200 x10: 000000008e31fca5\n[   14.816246] x9 : ffff000008c8a208 x8 : 000000000000000f\n[   14.816247] x7 : 0000000000000004 x6 : ffff8008fff58b9e\n[   14.816248] x5 : 0000000000000000 x4 : 0000000080000000\n[   14.816249] x3 : 0000000000000000 x2 : 0000000080000000\n[   14.816250] x1 : 0000000000120000 x0 : ffff0000095f56c0\n[   14.816251] Call trace:\n[   14.816251]  asm_nmi_enter+0x94/0x98\n[   14.816251]  el1_irq+0x8c/0x180                    (IRQ C)\n[   14.816252]  gic_handle_irq+0xbc/0x2e4\n[   14.816252]  el1_irq+0xcc/0x180                    (IRQ B)\n[   14.816253]  arch_timer_handler_virt+0x38/0x58\n[   14.816253]  handle_percpu_devid_irq+0x90/0x240\n[   14.816253]  generic_handle_irq+0x34/0x50\n[   14.816254]  __handle_domain_irq+0x68/0xc0\n[   14.816254]  gic_handle_irq+0xf8/0x2e4\n[   14.816255]  el1_irq+0xcc/0x180                    (IRQ A)\n[   14.816255]  arch_cpu_idle+0x34/0x1c8\n[   14.816255]  default_idle_call+0x24/0x44\n[   14.816256]  do_idle+0x1d0/0x2c8\n[   14.816256]  cpu_startup_entry+0x28/0x30\n[   14.816256]  rest_init+0xb8/0xc8\n[   14.816257]  start_kernel+0x4c8/0x4f4\n[   14.816257] Code: 940587f1 d5384100 b9401001 36a7fd01 (d4210000)\n[   14.816258] Modules linked in: start_dp(O) smeth(O)\n[   15.103092] ---[ end trace 701753956cb14aa8 ]---\n[   15.103093] Kernel panic - not syncing: Fatal exception in interrupt\n[   15.103099] SMP: stopping secondary CPUs\n[   15.103100] Kernel Offset: disabled\n[   15.103100] CPU features: 0x36,a2400218\n[   15.103100] Memory Limit: none\n\nwhich is cause by a 'BUG_ON(in_nmi())' in nmi_enter().\n\nFrom the call trace, we can find three interrupts (noted A, B, C above):\ninterrupt (A) is preempted by (B), which is further interrupted by (C).\n\nSubsequent investigations show that (B) results in nmi_enter() being\ncalled, but that it actually is a spurious interrupt. Furthermore,\ninterrupts are reenabled in the context of (B), and (C) fires with\nNMI priority. We end-up with a nested NMI situation, something\nwe definitely do not want to (and cannot) handle.\n\nThe bug here is that spurious interrupts should never result in any\nstate change, and we should just return to the interrupted context.\nMoving the handling of spurious interrupts as early as possible in\nthe GICv3 handler fixes this issue.\n\n[maz: rewrote commit message, corrected Fixes: tag]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "174035cf-f51c-4b89-b37d-94dad880e208",
      "id": "CVE-2021-47041",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix incorrect locking in state_change sk callback\n\nWe are not changing anything in the TCP connection state so\nwe should not take a write_lock but rather a read lock.\n\nThis caused a deadlock when running nvmet-tcp and nvme-tcp\non the same system, where state_change callbacks on the\nhost and on the controller side have causal relationship\nand made lockdep report on this with blktests:\n\n================================\nWARNING: inconsistent lock state\n5.12.0-rc3 #1 Tainted: G          I\n--------------------------------\ninconsistent {IN-SOFTIRQ-W} -\u003e {SOFTIRQ-ON-R} usage.\nnvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes:\nffff888363151000 (clock-AF_INET){++-?}-{2:2}, at: nvme_tcp_state_change+0x21/0x150 [nvme_tcp]\n{IN-SOFTIRQ-W} state was registered at:\n  __lock_acquire+0x79b/0x18d0\n  lock_acquire+0x1ca/0x480\n  _raw_write_lock_bh+0x39/0x80\n  nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp]\n  tcp_fin+0x2a8/0x780\n  tcp_data_queue+0xf94/0x1f20\n  tcp_rcv_established+0x6ba/0x1f00\n  tcp_v4_do_rcv+0x502/0x760\n  tcp_v4_rcv+0x257e/0x3430\n  ip_protocol_deliver_rcu+0x69/0x6a0\n  ip_local_deliver_finish+0x1e2/0x2f0\n  ip_local_deliver+0x1a2/0x420\n  ip_rcv+0x4fb/0x6b0\n  __netif_receive_skb_one_core+0x162/0x1b0\n  process_backlog+0x1ff/0x770\n  __napi_poll.constprop.0+0xa9/0x5c0\n  net_rx_action+0x7b3/0xb30\n  __do_softirq+0x1f0/0x940\n  do_softirq+0xa1/0xd0\n  __local_bh_enable_ip+0xd8/0x100\n  ip_finish_output2+0x6b7/0x18a0\n  __ip_queue_xmit+0x706/0x1aa0\n  __tcp_transmit_skb+0x2068/0x2e20\n  tcp_write_xmit+0xc9e/0x2bb0\n  __tcp_push_pending_frames+0x92/0x310\n  inet_shutdown+0x158/0x300\n  __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]\n  nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]\n  nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]\n  nvme_do_delete_ctrl+0x100/0x10c [nvme_core]\n  nvme_sysfs_delete.cold+0x8/0xd [nvme_core]\n  kernfs_fop_write_iter+0x2c7/0x460\n  new_sync_write+0x36c/0x610\n  vfs_write+0x5c0/0x870\n  ksys_write+0xf9/0x1d0\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\nirq event stamp: 10687\nhardirqs last  enabled at (10687): [\u003cffffffff9ec376bd\u003e] _raw_spin_unlock_irqrestore+0x2d/0x40\nhardirqs last disabled at (10686): [\u003cffffffff9ec374d8\u003e] _raw_spin_lock_irqsave+0x68/0x90\nsoftirqs last  enabled at (10684): [\u003cffffffff9f000608\u003e] __do_softirq+0x608/0x940\nsoftirqs last disabled at (10649): [\u003cffffffff9cdedd31\u003e] do_softirq+0xa1/0xd0\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(clock-AF_INET);\n  \u003cInterrupt\u003e\n    lock(clock-AF_INET);\n\n *** DEADLOCK ***\n\n5 locks held by nvme/1324:\n #0: ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0\n #1: ffff8886e435c090 (\u0026of-\u003emutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460\n #2: ffff888104d90c38 (kn-\u003eactive#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330\n #3: ffff8884634538d0 (\u0026queue-\u003equeue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp]\n #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300\n\nstack backtrace:\nCPU: 26 PID: 1324 Comm: nvme Tainted: G          I       5.12.0-rc3 #1\nHardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020\nCall Trace:\n dump_stack+0x93/0xc2\n mark_lock_irq.cold+0x2c/0xb3\n ? verify_lock_unused+0x390/0x390\n ? stack_trace_consume_entry+0x160/0x160\n ? lock_downgrade+0x100/0x100\n ? save_trace+0x88/0x5e0\n ? _raw_spin_unlock_irqrestore+0x2d/0x40\n mark_lock+0x530/0x1470\n ? mark_lock_irq+0x1d10/0x1d10\n ? enqueue_timer+0x660/0x660\n mark_usage+0x215/0x2a0\n __lock_acquire+0x79b/0x18d0\n ? tcp_schedule_loss_probe.part.0+0x38c/0x520\n lock_acquire+0x1ca/0x480\n ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]\n ? rcu_read_unlock+0x40/0x40\n ? tcp_mtu_probe+0x1ae0/0x1ae0\n ? kmalloc_reserve+0xa0/0xa0\n ? sysfs_file_ops+0x170/0x170\n _raw_read_lock+0x3d/0xa0\n ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]\n nvme_tcp_state_change+0x21/0x150 [nvme_tcp]\n ? sysfs_file_ops\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b579e23b-9e56-438c-b369-4b72f8465f0a",
      "id": "CVE-2021-47076",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Return CQE error if invalid lkey was supplied\n\nRXE is missing update of WQE status in LOCAL_WRITE failures.  This caused\nthe following kernel panic if someone sent an atomic operation with an\nexplicitly wrong lkey.\n\n[leonro@vm ~]$ mkt test\ntest_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ...\n WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe]\n Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core\n CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe]\n Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff \u003c0f\u003e 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff\n RSP: 0018:ffff8880158af090 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652\n RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210\n RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b\n R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8\n R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c\n FS:  00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  rxe_do_task+0x130/0x230 [rdma_rxe]\n  rxe_rcv+0xb11/0x1df0 [rdma_rxe]\n  rxe_loopback+0x157/0x1e0 [rdma_rxe]\n  rxe_responder+0x5532/0x7620 [rdma_rxe]\n  rxe_do_task+0x130/0x230 [rdma_rxe]\n  rxe_rcv+0x9c8/0x1df0 [rdma_rxe]\n  rxe_loopback+0x157/0x1e0 [rdma_rxe]\n  rxe_requester+0x1efd/0x58c0 [rdma_rxe]\n  rxe_do_task+0x130/0x230 [rdma_rxe]\n  rxe_post_send+0x998/0x1860 [rdma_rxe]\n  ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs]\n  ib_uverbs_write+0x847/0xc80 [ib_uverbs]\n  vfs_write+0x1c5/0x840\n  ksys_write+0x176/0x1d0\n  do_syscall_64+0x3f/0x80\n  entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49ab89a1-abb7-4b28-871c-de8be8b47434",
      "id": "CVE-2021-47181",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: tusb6010: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76229669-5054-4255-b13a-a20cfe1c4089",
      "id": "CVE-2021-47210",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: Remove WARN_ON in tps6598x_block_read\n\nCalling tps6598x_block_read with a higher than allowed len can be\nhandled by just returning an error. There's no need to crash systems\nwith panic-on-warn enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38826bc7-9ba2-4e1c-bc74-e26c8f4fe0d4",
      "id": "CVE-2021-47277",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: avoid speculation-based attacks from out-of-range memslot accesses\n\nKVM's mechanism for accessing guest memory translates a guest physical\naddress (gpa) to a host virtual address using the right-shifted gpa\n(also known as gfn) and a struct kvm_memory_slot.  The translation is\nperformed in __gfn_to_hva_memslot using the following formula:\n\n      hva = slot-\u003euserspace_addr + (gfn - slot-\u003ebase_gfn) * PAGE_SIZE\n\nIt is expected that gfn falls within the boundaries of the guest's\nphysical memory.  However, a guest can access invalid physical addresses\nin such a way that the gfn is invalid.\n\n__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first\nretrieves a memslot through __gfn_to_memslot.  While __gfn_to_memslot\ndoes check that the gfn falls within the boundaries of the guest's\nphysical memory or not, a CPU can speculate the result of the check and\ncontinue execution speculatively using an illegal gfn. The speculation\ncan result in calculating an out-of-bounds hva.  If the resulting host\nvirtual address is used to load another guest physical address, this\nis effectively a Spectre gadget consisting of two consecutive reads,\nthe second of which is data dependent on the first.\n\nRight now it's not clear if there are any cases in which this is\nexploitable.  One interesting case was reported by the original author\nof this patch, and involves visiting guest page tables on x86.  Right\nnow these are not vulnerable because the hva read goes through get_user(),\nwhich contains an LFENCE speculation barrier.  However, there are\npatches in progress for x86 uaccess.h to mask kernel addresses instead of\nusing LFENCE; once these land, a guest could use speculation to read\nfrom the VMM's ring 3 address space.  Other architectures such as ARM\nalready use the address masking method, and would be susceptible to\nthis same kind of data-dependent access gadgets.  Therefore, this patch\nproactively protects from these attacks by masking out-of-bounds gfns\nin __gfn_to_hva_memslot, which blocks speculation of invalid hvas.\n\nSean Christopherson noted that this patch does not cover\nkvm_read_guest_offset_cached.  This however is limited to a few bytes\npast the end of the cache, and therefore it is unlikely to be useful in\nthe context of building a chain of data dependent accesses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81f140d6-ebb5-45ed-be38-86a4caca307d",
      "id": "CVE-2021-47358",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: uart: fix tty use after free\n\nUser space can hold a tty open indefinitely and tty drivers must not\nrelease the underlying structures until the last user is gone.\n\nSwitch to using the tty-port reference counter to manage the life time\nof the greybus tty state to avoid use after free after a disconnect.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b12f00d-effa-4ce2-9c50-1dc3615f74f3",
      "id": "CVE-2021-47400",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: do not allow call hns3_nic_net_open repeatedly\n\nhns3_nic_net_open() is not allowed to called repeatly, but there\nis no checking for this. When doing device reset and setup tc\nconcurrently, there is a small oppotunity to call hns3_nic_net_open\nrepeatedly, and cause kernel bug by calling napi_enable twice.\n\nThe calltrace information is like below:\n[ 3078.222780] ------------[ cut here ]------------\n[ 3078.230255] kernel BUG at net/core/dev.c:6991!\n[ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP\n[ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O)\n[ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G           O      5.14.0-rc4+ #1\n[ 3078.269102] Hardware name:  , BIOS KpxxxFPGA 1P B600 V181 08/12/2021\n[ 3078.276801] Workqueue: hclge hclge_service_task [hclge]\n[ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)\n[ 3078.296168] pc : napi_enable+0x80/0x84\ntc qdisc sho[w  3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]\n\n[ 3078.314771] sp : ffff8000108abb20\n[ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300\n[ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000\n[ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880\n[ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000\n[ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930\n[ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4\n[ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8\n[ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344\n[ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938\n[ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0\n[ 3078.414657] Call trace:\n[ 3078.418517]  napi_enable+0x80/0x84\n[ 3078.424626]  hns3_reset_notify_up_enet+0x78/0xd0 [hns3]\n[ 3078.433469]  hns3_reset_notify+0x64/0x80 [hns3]\n[ 3078.441430]  hclge_notify_client+0x68/0xb0 [hclge]\n[ 3078.450511]  hclge_reset_rebuild+0x524/0x884 [hclge]\n[ 3078.458879]  hclge_reset_service_task+0x3c4/0x680 [hclge]\n[ 3078.467470]  hclge_service_task+0xb0/0xb54 [hclge]\n[ 3078.475675]  process_one_work+0x1dc/0x48c\n[ 3078.481888]  worker_thread+0x15c/0x464\n[ 3078.487104]  kthread+0x160/0x170\n[ 3078.492479]  ret_from_fork+0x10/0x18\n[ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000)\n[ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---\n\nOnce hns3_nic_net_open() is excute success, the flag\nHNS3_NIC_STATE_DOWN will be cleared. So add checking for this\nflag, directly return when HNS3_NIC_STATE_DOWN is no set.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "31e780f5-17ff-483f-8119-9229ba5a1c75",
      "id": "CVE-2021-47401",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipack: ipoctal: fix stack information leak\n\nThe tty driver name is used also after registering the driver and must\nspecifically not be allocated on the stack to avoid leaking information\nto user space (or triggering an oops).\n\nDrivers should not try to encode topology information in the tty device\nname but this one snuck in through staging without anyone noticing and\nanother driver has since copied this malpractice.\n\nFixing the ABI is a separate issue, but this at least plugs the security\nhole.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a77d74b-9806-4924-af43-dfbdf610cf7b",
      "id": "CVE-2024-49904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add list empty check to avoid null pointer issue\n\nAdd list empty check to avoid null pointer issues in some corner cases.\n- list_for_each_entry_safe()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f9eb5c05-28dd-409c-b3cd-e67fd1467cb0",
      "id": "CVE-2021-47425",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: acpi: fix resource leak in reconfiguration device addition\n\nacpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a\nreference on the adapter which is never released which will result in a\nreference count leak and render the adapter unremovable.  Make sure to\nput the adapter after creating the client in the same manner that we do\nfor OF.\n\n[wsa: fixed title]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4dc5f46a-d95c-4082-9496-c8321406f555",
      "id": "CVE-2021-47506",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix use-after-free due to delegation race\n\nA delegation break could arrive as soon as we've called vfs_setlease.  A\ndelegation break runs a callback which immediately (in\nnfsd4_cb_recall_prepare) adds the delegation to del_recall_lru.  If we\nthen exit nfs4_set_delegation without hashing the delegation, it will be\nfreed as soon as the callback is done with it, without ever being\nremoved from del_recall_lru.\n\nSymptoms show up later as use-after-free or list corruption warnings,\nusually in the laundromat thread.\n\nI suspect aba2072f4523 \"nfsd: grant read delegations to clients holding\nwrites\" made this bug easier to hit, but I looked as far back as v3.0\nand it looks to me it already had the same problem.  So I'm not sure\nwhere the bug was introduced; it may have been there from the beginning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9dbf1fc-927b-4ac3-97c0-6134b1e19ce6",
      "id": "CVE-2021-47560",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum: Protect driver from buggy firmware\n\nWhen processing port up/down events generated by the device's firmware,\nthe driver protects itself from events reported for non-existent local\nports, but not the CPU port (local port 0), which exists, but lacks a\nnetdev.\n\nThis can result in a NULL pointer dereference when calling\nnetif_carrier_{on,off}().\n\nFix this by bailing early when processing an event reported for the CPU\nport. Problem was only observed when running on top of a buggy emulator.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d44b1c4-76eb-4f56-bcc2-e31f1a772e71",
      "id": "CVE-2022-27223",
      "description": "In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "62a2f8d0-e008-40f4-8122-418b7e67b543",
      "id": "CVE-2022-33981",
      "description": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "803ad1b8-76c7-4da9-a7a9-d6bd4ed248f8",
      "id": "CVE-2024-49939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to add interface to list twice when SER\n\nIf SER L2 occurs during the WoWLAN resume flow, the add interface flow\nis triggered by ieee80211_reconfig(). However, due to\nrtw89_wow_resume() return failure, it will cause the add interface flow\nto be executed again, resulting in a double add list and causing a kernel\npanic. Therefore, we have added a check to prevent double adding of the\nlist.\n\nlist_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628.\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:37!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G        W  O       6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7\nHardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021\nWorkqueue: events_freezable ieee80211_restart_work [mac80211]\nRIP: 0010:__list_add_valid_or_report+0x5e/0xb0\nCode: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 \u003c0f\u003e 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12\nRSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246\nRAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900\nRDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001\nRBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0\nR10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060\nR13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010\nFS:  0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0\nCall Trace:\n \u003cTASK\u003e\n ? __die_body+0x1f/0x70\n ? die+0x3d/0x60\n ? do_trap+0xa4/0x110\n ? __list_add_valid_or_report+0x5e/0xb0\n ? do_error_trap+0x6d/0x90\n ? __list_add_valid_or_report+0x5e/0xb0\n ? handle_invalid_op+0x30/0x40\n ? __list_add_valid_or_report+0x5e/0xb0\n ? exc_invalid_op+0x3c/0x50\n ? asm_exc_invalid_op+0x16/0x20\n ? __list_add_valid_or_report+0x5e/0xb0\n rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f]\n drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ? finish_wait+0x3e/0x90\n ? synchronize_rcu_expedited+0x174/0x260\n ? sync_rcu_exp_done_unlocked+0x50/0x50\n ? wake_bit_function+0x40/0x40\n ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n process_scheduled_works+0x1e5/0x480\n worker_thread+0xea/0x1e0\n kthread+0xdb/0x110\n ? move_linked_works+0x90/0x90\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork+0x3b/0x50\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork_asm+0x11/0x20\n \u003c/TASK\u003e\nModules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev\ngsmi: Log Shutdown Reason 0x03\n---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d438f255-f32e-45ad-a00c-ec511490499a",
      "id": "CVE-2022-3586",
      "description": "A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dfee3e4d-9b8c-4b15-9d23-2c1616742d3a",
      "id": "CVE-2022-36123",
      "description": "The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8db8c2d9-96c5-4930-b2c1-e6592be7a46a",
      "id": "CVE-2022-48639",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix possible refcount leak in tc_new_tfilter()\n\ntfilter_put need to be called to put the refount got by tp-\u003eops-\u003eget to\navoid possible refcount leak when chain-\u003etmplt_ops != NULL and\nchain-\u003etmplt_ops != tp-\u003eops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94467a98-014b-4230-8071-1536eeb3f426",
      "id": "CVE-2022-48923",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: prevent copying too big compressed lzo segment\n\nCompressed length can be corrupted to be a lot larger than memory\nwe have allocated for buffer.\nThis will cause memcpy in copy_compressed_segment to write outside\nof allocated memory.\n\nThis mostly results in stuck read syscall but sometimes when using\nbtrfs send can get #GP\n\n  kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI\n  kernel: CPU: 17 PID: 264 Comm: kworker/u256:7 Tainted: P           OE     5.17.0-rc2-1 #12\n  kernel: Workqueue: btrfs-endio btrfs_work_helper [btrfs]\n  kernel: RIP: 0010:lzo_decompress_bio (./include/linux/fortify-string.h:225 fs/btrfs/lzo.c:322 fs/btrfs/lzo.c:394) btrfs\n  Code starting with the faulting instruction\n  ===========================================\n     0:*  48 8b 06                mov    (%rsi),%rax              \u003c-- trapping instruction\n     3:   48 8d 79 08             lea    0x8(%rcx),%rdi\n     7:   48 83 e7 f8             and    $0xfffffffffffffff8,%rdi\n     b:   48 89 01                mov    %rax,(%rcx)\n     e:   44 89 f0                mov    %r14d,%eax\n    11:   48 8b 54 06 f8          mov    -0x8(%rsi,%rax,1),%rdx\n  kernel: RSP: 0018:ffffb110812efd50 EFLAGS: 00010212\n  kernel: RAX: 0000000000001000 RBX: 000000009ca264c8 RCX: ffff98996e6d8ff8\n  kernel: RDX: 0000000000000064 RSI: 000841551d5c1000 RDI: ffffffff9500435d\n  kernel: RBP: ffff989a3be856c0 R08: 0000000000000000 R09: 0000000000000000\n  kernel: R10: 0000000000000000 R11: 0000000000001000 R12: ffff98996e6d8000\n  kernel: R13: 0000000000000008 R14: 0000000000001000 R15: 000841551d5c1000\n  kernel: FS:  0000000000000000(0000) GS:ffff98a09d640000(0000) knlGS:0000000000000000\n  kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  kernel: CR2: 00001e9f984d9ea8 CR3: 000000014971a000 CR4: 00000000003506e0\n  kernel: Call Trace:\n  kernel:  \u003cTASK\u003e\n  kernel: end_compressed_bio_read (fs/btrfs/compression.c:104 fs/btrfs/compression.c:1363 fs/btrfs/compression.c:323) btrfs\n  kernel: end_workqueue_fn (fs/btrfs/disk-io.c:1923) btrfs\n  kernel: btrfs_work_helper (fs/btrfs/async-thread.c:326) btrfs\n  kernel: process_one_work (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:212 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2312)\n  kernel: worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2455)\n  kernel: ? process_one_work (kernel/workqueue.c:2397)\n  kernel: kthread (kernel/kthread.c:377)\n  kernel: ? kthread_complete_and_exit (kernel/kthread.c:332)\n  kernel: ret_from_fork (arch/x86/entry/entry_64.S:301)\n  kernel:  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94f34a30-46d6-4356-a343-3cc8542569f6",
      "id": "CVE-2022-48971",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix not cleanup led when bt_init fails\n\nbt_init() calls bt_leds_init() to register led, but if it fails later,\nbt_leds_cleanup() is not called to unregister it.\n\nThis can cause panic if the argument \"bluetooth-power\" in text is freed\nand then another led_trigger_register() tries to access it:\n\nBUG: unable to handle page fault for address: ffffffffc06d3bc0\nRIP: 0010:strcmp+0xc/0x30\n  Call Trace:\n    \u003cTASK\u003e\n    led_trigger_register+0x10d/0x4f0\n    led_trigger_register_simple+0x7d/0x100\n    bt_init+0x39/0xf7 [bluetooth]\n    do_one_initcall+0xd0/0x4e0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4fba06fd-05d4-4a1d-a5c7-ada4beae29e0",
      "id": "CVE-2022-49026",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ne100: Fix possible use after free in e100_xmit_prepare\n\nIn e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so\ne100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will\nresend the skb. But the skb is already freed, which will cause UAF bug\nwhen the upper layer resends the skb.\n\nRemove the harmful free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ab17a1b-bcde-4514-b77a-a6f9c13ded8a",
      "id": "CVE-2022-49034",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected,\ncpu_max_bits_warn() generates a runtime warning similar as below when\nshowing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[    3.052463] ------------[ cut here ]------------\n[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[    3.070072] Modules linked in: efivarfs autofs4\n[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[    3.195868]         ...\n[    3.199917] Call Trace:\n[    3.203941] [\u003c90000000002086d8\u003e] show_stack+0x38/0x14c\n[    3.210666] [\u003c9000000000cf846c\u003e] dump_stack_lvl+0x60/0x88\n[    3.217625] [\u003c900000000023d268\u003e] __warn+0xd0/0x100\n[    3.223958] [\u003c9000000000cf3c90\u003e] warn_slowpath_fmt+0x7c/0xcc\n[    3.231150] [\u003c9000000000210220\u003e] show_cpuinfo+0x5e8/0x5f0\n[    3.238080] [\u003c90000000004f578c\u003e] seq_read_iter+0x354/0x4b4\n[    3.245098] [\u003c90000000004c2e90\u003e] new_sync_read+0x17c/0x1c4\n[    3.252114] [\u003c90000000004c5174\u003e] vfs_read+0x138/0x1d0\n[    3.258694] [\u003c90000000004c55f8\u003e] ksys_read+0x70/0x100\n[    3.265265] [\u003c9000000000cfde9c\u003e] do_syscall+0x7c/0x94\n[    3.271820] [\u003c9000000000202fe4\u003e] handle_syscall+0xc4/0x160\n[    3.281824] ---[ end trace 8b484262b4b8c24c ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42315a0c-48a8-4405-a9ce-b4346289bab1",
      "id": "CVE-2022-49085",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: Fix five use after free bugs in get_initial_state\n\nIn get_initial_state, it calls notify_initial_state_done(skb,..) if\ncb-\u003eargs[5]==1. If genlmsg_put() failed in notify_initial_state_done(),\nthe skb will be freed by nlmsg_free(skb).\nThen get_initial_state will goto out and the freed skb will be used by\nreturn value skb-\u003elen, which is a uaf bug.\n\nWhat's worse, the same problem goes even further: skb can also be\nfreed in the notify_*_state_change -\u003e notify_*_state calls below.\nThus 4 additional uaf bugs happened.\n\nMy patch lets the problem callee functions: notify_initial_state_done\nand notify_*_state_change return an error code if errors happen.\nSo that the error codes could be propagated and the uaf bugs can be avoid.\n\nv2 reports a compilation warning. This v3 fixed this warning and built\nsuccessfully in my local environment with no additional warnings.\nv2: https://lore.kernel.org/patchwork/patch/1435218/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea8b083f-9565-41d1-a753-0122a79785b0",
      "id": "CVE-2024-50117",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: Guard against bad data for ATIF ACPI method\n\nIf a BIOS provides bad data in response to an ATIF method call\nthis causes a NULL pointer dereference in the caller.\n\n```\n? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1))\n? __die (arch/x86/kernel/dumpstack.c:423 arch/x86/kernel/dumpstack.c:434)\n? page_fault_oops (arch/x86/mm/fault.c:544 (discriminator 2) arch/x86/mm/fault.c:705 (discriminator 2))\n? do_user_addr_fault (arch/x86/mm/fault.c:440 (discriminator 1) arch/x86/mm/fault.c:1232 (discriminator 1))\n? acpi_ut_update_object_reference (drivers/acpi/acpica/utdelete.c:642)\n? exc_page_fault (arch/x86/mm/fault.c:1542)\n? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)\n? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:387 (discriminator 2)) amdgpu\n? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:386 (discriminator 1)) amdgpu\n```\n\nIt has been encountered on at least one system, so guard for it.\n\n(cherry picked from commit c9b7c809b89f24e9372a4e7f02d64c950b07fdee)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94490a9b-c817-40fa-9270-dfdb7f434493",
      "id": "CVE-2022-49190",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/resource: fix kfree() of bootmem memory again\n\nSince commit ebff7d8f270d (\"mem hotunplug: fix kfree() of bootmem\nmemory\"), we could get a resource allocated during boot via\nalloc_resource().  And it's required to release the resource using\nfree_resource().  Howerver, many people use kfree directly which will\nresult in kernel BUG.  In order to fix this without fixing every call\nsite, just leak a couple of bytes in such corner case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c43d667b-6670-4389-84bd-412b575e678f",
      "id": "CVE-2022-49246",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: atmel: Fix error handling in snd_proto_probe\n\nThe device_node pointer is returned by of_parse_phandle()  with refcount\nincremented. We should use of_node_put() on it when done.\n\nThis function only calls of_node_put() in the regular path.\nAnd it will cause refcount leak in error paths.\nFix this by calling of_node_put() in error handling too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f75a166-7605-4908-bced-0f6d7e083d1a",
      "id": "CVE-2022-49488",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected\n\nThere is a possibility for mdp5_get_global_state to return\n-EDEADLK when acquiring the modeset lock, but currently global_state in\nmdp5_mixer_release doesn't check for if an error is returned.\n\nTo avoid a NULL dereference error, let's have mdp5_mixer_release\ncheck if an error is returned and propagate that error.\n\nPatchwork: https://patchwork.freedesktop.org/patch/485181/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "118ba33e-7cc9-4fd8-9d9c-3c4fba9ef5c6",
      "id": "CVE-2022-49489",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume\n\nBUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3\n\nCall trace:\n  dpu_vbif_init_memtypes+0x40/0xb8\n  dpu_runtime_resume+0xcc/0x1c0\n  pm_generic_runtime_resume+0x30/0x44\n  __genpd_runtime_resume+0x68/0x7c\n  genpd_runtime_resume+0x134/0x258\n  __rpm_callback+0x98/0x138\n  rpm_callback+0x30/0x88\n  rpm_resume+0x36c/0x49c\n  __pm_runtime_resume+0x80/0xb0\n  dpu_core_irq_uninstall+0x30/0xb0\n  dpu_irq_uninstall+0x18/0x24\n  msm_drm_uninit+0xd8/0x16c\n\nPatchwork: https://patchwork.freedesktop.org/patch/483255/\n[DB: fixed Fixes tag]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12a55ee6-e229-4f27-897c-d770e6e6881b",
      "id": "CVE-2022-48979",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why\u0026How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6be418a6-383c-476a-9052-359cf41bf660",
      "id": "CVE-2022-49572",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_slow_start_after_idle.\n\nWhile reading sysctl_tcp_slow_start_after_idle, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4b33858-7137-47df-9a81-cee8b86296e0",
      "id": "CVE-2022-49574",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_recovery.\n\nWhile reading sysctl_tcp_recovery, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1a1e5ab-e43e-41fb-949e-e9dc0520339f",
      "id": "CVE-2022-49584",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: Add locking to prevent panic when setting sriov_numvfs to zero\n\nIt is possible to disable VFs while the PF driver is processing requests\nfrom the VF driver.  This can result in a panic.\n\nBUG: unable to handle kernel paging request at 000000000000106c\nPGD 0 P4D 0\nOops: 0000 [#1] SMP NOPTI\nCPU: 8 PID: 0 Comm: swapper/8 Kdump: loaded Tainted: G I      --------- -\nHardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020\nRIP: 0010:ixgbe_msg_task+0x4c8/0x1690 [ixgbe]\nCode: 00 00 48 8d 04 40 48 c1 e0 05 89 7c 24 24 89 fd 48 89 44 24 10 83 ff\n01 0f 84 b8 04 00 00 4c 8b 64 24 10 4d 03 a5 48 22 00 00 \u003c41\u003e 80 7c 24 4c\n00 0f 84 8a 03 00 00 0f b7 c7 83 f8 08 0f 84 8f 0a\nRSP: 0018:ffffb337869f8df8 EFLAGS: 00010002\nRAX: 0000000000001020 RBX: 0000000000000000 RCX: 000000000000002b\nRDX: 0000000000000002 RSI: 0000000000000008 RDI: 0000000000000006\nRBP: 0000000000000006 R08: 0000000000000002 R09: 0000000000029780\nR10: 00006957d8f42832 R11: 0000000000000000 R12: 0000000000001020\nR13: ffff8a00e8978ac0 R14: 000000000000002b R15: ffff8a00e8979c80\nFS:  0000000000000000(0000) GS:ffff8a07dfd00000(0000) knlGS:00000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000000106c CR3: 0000000063e10004 CR4: 00000000007726e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? ttwu_do_wakeup+0x19/0x140\n ? try_to_wake_up+0x1cd/0x550\n ? ixgbevf_update_xcast_mode+0x71/0xc0 [ixgbevf]\n ixgbe_msix_other+0x17e/0x310 [ixgbe]\n __handle_irq_event_percpu+0x40/0x180\n handle_irq_event_percpu+0x30/0x80\n handle_irq_event+0x36/0x53\n handle_edge_irq+0x82/0x190\n handle_irq+0x1c/0x30\n do_IRQ+0x49/0xd0\n common_interrupt+0xf/0xf\n\nThis can be eventually be reproduced with the following script:\n\nwhile :\ndo\n    echo 63 \u003e /sys/class/net/\u003cdevname\u003e/device/sriov_numvfs\n    sleep 1\n    echo 0 \u003e /sys/class/net/\u003cdevname\u003e/device/sriov_numvfs\n    sleep 1\ndone\n\nAdd lock when disabling SR-IOV to prevent process VF mailbox communication.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "310d753b-b040-4105-950a-386d9b6436b9",
      "id": "CVE-2022-49597",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_base_mss.\n\nWhile reading sysctl_tcp_base_mss, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a33b3777-2962-437a-8177-85f783cf32f9",
      "id": "CVE-2022-49620",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tipc: fix possible refcount leak in tipc_sk_create()\n\nFree sk in case tipc_sk_insert() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d78c72d7-cc45-47a5-8595-0a3ae12fa7e4",
      "id": "CVE-2022-49630",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_ecn_fallback.\n\nWhile reading sysctl_tcp_ecn_fallback, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0887103-17d4-4983-a1a6-61d76ceba6f1",
      "id": "CVE-2022-49927",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs4: Fix kmemleak when allocate slot failed\n\nIf one of the slot allocate failed, should cleanup all the other\nallocated slots, otherwise, the allocated slots will leak:\n\n  unreferenced object 0xffff8881115aa100 (size 64):\n    comm \"\"mount.nfs\"\", pid 679, jiffies 4294744957 (age 115.037s)\n    hex dump (first 32 bytes):\n      00 cc 19 73 81 88 ff ff 00 a0 5a 11 81 88 ff ff  ...s......Z.....\n      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    backtrace:\n      [\u003c000000007a4c434a\u003e] nfs4_find_or_create_slot+0x8e/0x130\n      [\u003c000000005472a39c\u003e] nfs4_realloc_slot_table+0x23f/0x270\n      [\u003c00000000cd8ca0eb\u003e] nfs40_init_client+0x4a/0x90\n      [\u003c00000000128486db\u003e] nfs4_init_client+0xce/0x270\n      [\u003c000000008d2cacad\u003e] nfs4_set_client+0x1a2/0x2b0\n      [\u003c000000000e593b52\u003e] nfs4_create_server+0x300/0x5f0\n      [\u003c00000000e4425dd2\u003e] nfs4_try_get_tree+0x65/0x110\n      [\u003c00000000d3a6176f\u003e] vfs_get_tree+0x41/0xf0\n      [\u003c0000000016b5ad4c\u003e] path_mount+0x9b3/0xdd0\n      [\u003c00000000494cae71\u003e] __x64_sys_mount+0x190/0x1d0\n      [\u003c000000005d56bdec\u003e] do_syscall_64+0x35/0x80\n      [\u003c00000000687c9ae4\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24d6ad27-ec30-49a2-83bf-83420aa2d34b",
      "id": "CVE-2022-49984",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report\n\nIt is possible for a malicious device to forgo submitting a Feature\nReport.  The HID Steam driver presently makes no prevision for this\nand de-references the 'struct hid_report' pointer obtained from the\nHID devices without first checking its validity.  Let's change that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8932957c-7348-4298-b818-e937857b27a3",
      "id": "CVE-2022-50394",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: ismt: Fix an out-of-bounds bug in ismt_access()\n\nWhen the driver does not check the data from the user, the variable\n'data-\u003eblock[0]' may be very large to cause an out-of-bounds bug.\n\nThe following log can reveal it:\n\n[   33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20\n[   33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA:  WRITE\n[   33.996475] ==================================================================\n[   33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b\n[   33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485\n[   33.999450] Call Trace:\n[   34.001849]  memcpy+0x20/0x60\n[   34.002077]  ismt_access.cold+0x374/0x214b\n[   34.003382]  __i2c_smbus_xfer+0x44f/0xfb0\n[   34.004007]  i2c_smbus_xfer+0x10a/0x390\n[   34.004291]  i2cdev_ioctl_smbus+0x2c8/0x710\n[   34.005196]  i2cdev_ioctl+0x5ec/0x74c\n\nFix this bug by checking the size of 'data-\u003eblock[0]' first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b4f7ec9-66d7-4fe5-92fe-f807fdf08220",
      "id": "CVE-2022-49986",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq\n\nstorvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it\ndoesn't need to make forward progress under memory pressure.  Marking this\nworkqueue as WQ_MEM_RECLAIM may cause deadlock while flushing a\nnon-WQ_MEM_RECLAIM workqueue.  In the current state it causes the following\nwarning:\n\n[   14.506347] ------------[ cut here ]------------\n[   14.506354] workqueue: WQ_MEM_RECLAIM storvsc_error_wq_0:storvsc_remove_lun is flushing !WQ_MEM_RECLAIM events_freezable_power_:disk_events_workfn\n[   14.506360] WARNING: CPU: 0 PID: 8 at \u003c-snip-\u003ekernel/workqueue.c:2623 check_flush_dependency+0xb5/0x130\n[   14.506390] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu\n[   14.506391] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022\n[   14.506393] Workqueue: storvsc_error_wq_0 storvsc_remove_lun\n[   14.506395] RIP: 0010:check_flush_dependency+0xb5/0x130\n\t\t\u003c-snip-\u003e\n[   14.506408] Call Trace:\n[   14.506412]  __flush_work+0xf1/0x1c0\n[   14.506414]  __cancel_work_timer+0x12f/0x1b0\n[   14.506417]  ? kernfs_put+0xf0/0x190\n[   14.506418]  cancel_delayed_work_sync+0x13/0x20\n[   14.506420]  disk_block_events+0x78/0x80\n[   14.506421]  del_gendisk+0x3d/0x2f0\n[   14.506423]  sr_remove+0x28/0x70\n[   14.506427]  device_release_driver_internal+0xef/0x1c0\n[   14.506428]  device_release_driver+0x12/0x20\n[   14.506429]  bus_remove_device+0xe1/0x150\n[   14.506431]  device_del+0x167/0x380\n[   14.506432]  __scsi_remove_device+0x11d/0x150\n[   14.506433]  scsi_remove_device+0x26/0x40\n[   14.506434]  storvsc_remove_lun+0x40/0x60\n[   14.506436]  process_one_work+0x209/0x400\n[   14.506437]  worker_thread+0x34/0x400\n[   14.506439]  kthread+0x121/0x140\n[   14.506440]  ? process_one_work+0x400/0x400\n[   14.506441]  ? kthread_park+0x90/0x90\n[   14.506443]  ret_from_fork+0x35/0x40\n[   14.506445] ---[ end trace 2d9633159fdc6ee7 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df1c138e-98ca-47e4-9795-6d7ee7fe2444",
      "id": "CVE-2022-50060",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Fix mcam entry resource leak\n\nThe teardown sequence in FLR handler returns if no NIX LF\nis attached to PF/VF because it indicates that graceful\nshutdown of resources already happened. But there is a\nchance of all allocated MCAM entries not being freed by\nPF/VF. Hence free mcam entries even in case of detached LF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8404fc6-75a5-4e05-b848-45ae2d64c1bd",
      "id": "CVE-2022-50103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched, cpuset: Fix dl_cpu_busy() panic due to empty cs-\u003ecpus_allowed\n\nWith cgroup v2, the cpuset's cpus_allowed mask can be empty indicating\nthat the cpuset will just use the effective CPUs of its parent. So\ncpuset_can_attach() can call task_can_attach() with an empty mask.\nThis can lead to cpumask_any_and() returns nr_cpu_ids causing the call\nto dl_bw_of() to crash due to percpu value access of an out of bound\nCPU value. For example:\n\n\t[80468.182258] BUG: unable to handle page fault for address: ffffffff8b6648b0\n\t  :\n\t[80468.191019] RIP: 0010:dl_cpu_busy+0x30/0x2b0\n\t  :\n\t[80468.207946] Call Trace:\n\t[80468.208947]  cpuset_can_attach+0xa0/0x140\n\t[80468.209953]  cgroup_migrate_execute+0x8c/0x490\n\t[80468.210931]  cgroup_update_dfl_csses+0x254/0x270\n\t[80468.211898]  cgroup_subtree_control_write+0x322/0x400\n\t[80468.212854]  kernfs_fop_write_iter+0x11c/0x1b0\n\t[80468.213777]  new_sync_write+0x11f/0x1b0\n\t[80468.214689]  vfs_write+0x1eb/0x280\n\t[80468.215592]  ksys_write+0x5f/0xe0\n\t[80468.216463]  do_syscall_64+0x5c/0x80\n\t[80468.224287]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFix that by using effective_cpus instead. For cgroup v1, effective_cpus\nis the same as cpus_allowed. For v2, effective_cpus is the real cpumask\nto be used by tasks within the cpuset anyway.\n\nAlso update task_can_attach()'s 2nd argument name to cs_effective_cpus to\nreflect the change. In addition, a check is added to task_can_attach()\nto guard against the possibility that cpumask_any_and() may return a\nvalue \u003e= nr_cpu_ids.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1461da3e-167b-4367-88ed-6f28703c5c03",
      "id": "CVE-2022-50306",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn't less than data length\nwhich will read.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "713b65f9-9bb1-4263-af87-c0d71f7da0a7",
      "id": "CVE-2022-50379",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race between quota enable and quota rescan ioctl\n\nWhen enabling quotas, at btrfs_quota_enable(), after committing the\ntransaction, we change fs_info-\u003equota_root to point to the quota root we\ncreated and set BTRFS_FS_QUOTA_ENABLED at fs_info-\u003eflags. Then we try\nto start the qgroup rescan worker, first by initializing it with a call\nto qgroup_rescan_init() - however if that fails we end up freeing the\nquota root but we leave fs_info-\u003equota_root still pointing to it, this\ncan later result in a use-after-free somewhere else.\n\nWe have previously set the flags BTRFS_FS_QUOTA_ENABLED and\nBTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at\nbtrfs_quota_enable(), which is possible if someone already called the\nquota rescan ioctl, and therefore started the rescan worker.\n\nSo fix this by ignoring an -EINPROGRESS and asserting we can't get any\nother error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e86c451-ece1-4f52-800b-035f5de8ec06",
      "id": "CVE-2023-1079",
      "description": "A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf730a0c-eb88-4edf-99ce-db12a834192e",
      "id": "CVE-2024-53130",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint\n\nWhen using the \"block:block_dirty_buffer\" tracepoint, mark_buffer_dirty()\nmay cause a NULL pointer dereference, or a general protection fault when\nKASAN is enabled.\n\nThis happens because, since the tracepoint was added in\nmark_buffer_dirty(), it references the dev_t member bh-\u003eb_bdev-\u003ebd_dev\nregardless of whether the buffer head has a pointer to a block_device\nstructure.\n\nIn the current implementation, nilfs_grab_buffer(), which grabs a buffer\nto read (or create) a block of metadata, including b-tree node blocks,\ndoes not set the block device, but instead does so only if the buffer is\nnot in the \"uptodate\" state for each of its caller block reading\nfunctions.  However, if the uptodate flag is set on a folio/page, and the\nbuffer heads are detached from it by try_to_free_buffers(), and new buffer\nheads are then attached by create_empty_buffers(), the uptodate flag may\nbe restored to each buffer without the block device being set to\nbh-\u003eb_bdev, and mark_buffer_dirty() may be called later in that state,\nresulting in the bug mentioned above.\n\nFix this issue by making nilfs_grab_buffer() always set the block device\nof the super block structure to the buffer head, regardless of the state\nof the buffer's uptodate flag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eaab56ed-dde1-4a8b-a056-5d0a794dca85",
      "id": "CVE-2024-53140",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: terminate outstanding dump on socket close\n\nNetlink supports iterative dumping of data. It provides the families\nthe following ops:\n - start - (optional) kicks off the dumping process\n - dump  - actual dump helper, keeps getting called until it returns 0\n - done  - (optional) pairs with .start, can be used for cleanup\nThe whole process is asynchronous and the repeated calls to .dump\ndon't actually happen in a tight loop, but rather are triggered\nin response to recvmsg() on the socket.\n\nThis gives the user full control over the dump, but also means that\nthe user can close the socket without getting to the end of the dump.\nTo make sure .start is always paired with .done we check if there\nis an ongoing dump before freeing the socket, and if so call .done.\n\nThe complication is that sockets can get freed from BH and .done\nis allowed to sleep. So we use a workqueue to defer the call, when\nneeded.\n\nUnfortunately this does not work correctly. What we defer is not\nthe cleanup but rather releasing a reference on the socket.\nWe have no guarantee that we own the last reference, if someone\nelse holds the socket they may release it in BH and we're back\nto square one.\n\nThe whole dance, however, appears to be unnecessary. Only the user\ncan interact with dumps, so we can clean up when socket is closed.\nAnd close always happens in process context. Some async code may\nstill access the socket after close, queue notification skbs to it etc.\nbut no dumps can start, end or otherwise make progress.\n\nDelete the workqueue and flush the dump state directly from the release\nhandler. Note that further cleanup is possible in -next, for instance\nwe now always call .done before releasing the main module reference,\nso dump doesn't have to take a reference of its own.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7082c6ca-d96d-4e18-8204-d6ba9b7f1bbf",
      "id": "CVE-2024-53142",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninitramfs: avoid filename buffer overrun\n\nThe initramfs filename field is defined in\nDocumentation/driver-api/early-userspace/buffer-format.rst as:\n\n 37 cpio_file := ALGN(4) + cpio_header + filename + \"\\0\" + ALGN(4) + data\n...\n 55 ============= ================== =========================\n 56 Field name    Field size         Meaning\n 57 ============= ================== =========================\n...\n 70 c_namesize    8 bytes            Length of filename, including final \\0\n\nWhen extracting an initramfs cpio archive, the kernel's do_name() path\nhandler assumes a zero-terminated path at @collected, passing it\ndirectly to filp_open() / init_mkdir() / init_mknod().\n\nIf a specially crafted cpio entry carries a non-zero-terminated filename\nand is followed by uninitialized memory, then a file may be created with\ntrailing characters that represent the uninitialized memory. The ability\nto create an initramfs entry would imply already having full control of\nthe system, so the buffer overrun shouldn't be considered a security\nvulnerability.\n\nAppend the output of the following bash script to an existing initramfs\nand observe any created /initramfs_test_fname_overrunAA* path. E.g.\n  ./reproducer.sh | gzip \u003e\u003e /myinitramfs\n\nIt's easiest to observe non-zero uninitialized memory when the output is\ngzipped, as it'll overflow the heap allocated @out_buf in __gunzip(),\nrather than the initrd_start+initrd_size block.\n\n---- reproducer.sh ----\nnilchar=\"A\"\t# change to \"\\0\" to properly zero terminate / pad\nmagic=\"070701\"\nino=1\nmode=$(( 0100777 ))\nuid=0\ngid=0\nnlink=1\nmtime=1\nfilesize=0\ndevmajor=0\ndevminor=1\nrdevmajor=0\nrdevminor=0\ncsum=0\nfname=\"initramfs_test_fname_overrun\"\nnamelen=$(( ${#fname} + 1 ))\t# plus one to account for terminator\n\nprintf \"%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s\" \\\n\t$magic $ino $mode $uid $gid $nlink $mtime $filesize \\\n\t$devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname\n\ntermpadlen=$(( 1 + ((4 - ((110 + $namelen) \u0026 3)) % 4) ))\nprintf \"%.s${nilchar}\" $(seq 1 $termpadlen)\n---- reproducer.sh ----\n\nSymlink filename fields handled in do_symlink() won't overrun past the\ndata segment, due to the explicit zero-termination of the symlink\ntarget.\n\nFix filename buffer overrun by aborting the initramfs FSM if any cpio\nentry doesn't carry a zero-terminator at the expected (name_len - 1)\noffset.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51ceb353-160c-4485-a988-c5494b41402d",
      "id": "CVE-2024-56589",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Add cond_resched() for no forced preemption model\n\nFor no forced preemption model kernel, in the scenario where the\nexpander is connected to 12 high performance SAS SSDs, the following\ncall trace may occur:\n\n[  214.409199][  C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211]\n[  214.568533][  C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)\n[  214.575224][  C240] pc : fput_many+0x8c/0xdc\n[  214.579480][  C240] lr : fput+0x1c/0xf0\n[  214.583302][  C240] sp : ffff80002de2b900\n[  214.587298][  C240] x29: ffff80002de2b900 x28: ffff1082aa412000\n[  214.593291][  C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000\n[  214.599284][  C240] x25: ffff1062bbac5c40 x24: 0000000000001000\n[  214.605277][  C240] x23: 000000000000000a x22: 0000000000000001\n[  214.611270][  C240] x21: 0000000000001000 x20: 0000000000000000\n[  214.617262][  C240] x19: ffff3062a41ae580 x18: 0000000000010000\n[  214.623255][  C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0\n[  214.629248][  C240] x15: ffffffffffffffff x14: 0000000003ffffff\n[  214.635241][  C240] x13: 000000000000ffff x12: 000000000000029c\n[  214.641234][  C240] x11: 0000000000000006 x10: ffff80003a9f7fd0\n[  214.647226][  C240] x9 : ffffdb3a6f0482fc x8 : 0000000000000001\n[  214.653219][  C240] x7 : 0000000000000002 x6 : 0000000000000080\n[  214.659212][  C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554\n[  214.665205][  C240] x3 : 0000000000000002 x2 : 0000000000000020\n[  214.671198][  C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8\n[  214.677191][  C240] Call trace:\n[  214.680320][  C240]  fput_many+0x8c/0xdc\n[  214.684230][  C240]  fput+0x1c/0xf0\n[  214.687707][  C240]  aio_complete_rw+0xd8/0x1fc\n[  214.692225][  C240]  blkdev_bio_end_io+0x98/0x140\n[  214.696917][  C240]  bio_endio+0x160/0x1bc\n[  214.701001][  C240]  blk_update_request+0x1c8/0x3bc\n[  214.705867][  C240]  scsi_end_request+0x3c/0x1f0\n[  214.710471][  C240]  scsi_io_completion+0x7c/0x1a0\n[  214.715249][  C240]  scsi_finish_command+0x104/0x140\n[  214.720200][  C240]  scsi_softirq_done+0x90/0x180\n[  214.724892][  C240]  blk_mq_complete_request+0x5c/0x70\n[  214.730016][  C240]  scsi_mq_done+0x48/0xac\n[  214.734194][  C240]  sas_scsi_task_done+0xbc/0x16c [libsas]\n[  214.739758][  C240]  slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw]\n[  214.746185][  C240]  cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw]\n[  214.752179][  C240]  irq_thread_fn+0x34/0xa4\n[  214.756435][  C240]  irq_thread+0xc4/0x130\n[  214.760520][  C240]  kthread+0x108/0x13c\n[  214.764430][  C240]  ret_from_fork+0x10/0x18\n\nThis is because in the hisi_sas driver, both the hardware interrupt\nhandler and the interrupt thread are executed on the same CPU. In the\nperformance test scenario, function irq_wait_for_interrupt() will always\nreturn 0 if lots of interrupts occurs and the CPU will be continuously\nconsumed. As a result, the CPU cannot run the watchdog thread. When the\nwatchdog time exceeds the specified time, call trace occurs.\n\nTo fix it, add cond_resched() to execute the watchdog thread.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b826c7f9-99cd-48ef-8856-4ae572a3d792",
      "id": "CVE-2024-56670",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer\n\nConsidering that in some extreme cases,\nwhen u_serial driver is accessed by multiple threads,\nThread A is executing the open operation and calling the gs_open,\nThread B is executing the disconnect operation and calling the\ngserial_disconnect function,The port-\u003eport_usb pointer will be set to NULL.\n\nE.g.\n    Thread A                                 Thread B\n    gs_open()                                gadget_unbind_driver()\n    gs_start_io()                            composite_disconnect()\n    gs_start_rx()                            gserial_disconnect()\n    ...                                      ...\n    spin_unlock(\u0026port-\u003eport_lock)\n    status = usb_ep_queue()                  spin_lock(\u0026port-\u003eport_lock)\n    spin_lock(\u0026port-\u003eport_lock)              port-\u003eport_usb = NULL\n    gs_free_requests(port-\u003eport_usb-\u003ein)     spin_unlock(\u0026port-\u003eport_lock)\n    Crash\n\nThis causes thread A to access a null pointer (port-\u003eport_usb is null)\nwhen calling the gs_free_requests function, causing a crash.\n\nIf port_usb is NULL, the release request will be skipped as it\nwill be done by gserial_disconnect.\n\nSo add a null pointer check to gs_start_io before attempting\nto access the value of the pointer port-\u003eport_usb.\n\nCall trace:\n gs_start_io+0x164/0x25c\n gs_open+0x108/0x13c\n tty_open+0x314/0x638\n chrdev_open+0x1b8/0x258\n do_dentry_open+0x2c4/0x700\n vfs_open+0x2c/0x3c\n path_openat+0xa64/0xc60\n do_filp_open+0xb8/0x164\n do_sys_openat2+0x84/0xf0\n __arm64_sys_openat+0x70/0x9c\n invoke_syscall+0x58/0x114\n el0_svc_common+0x80/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x38/0x68",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0ef4443-2fdf-45ba-8b2d-68be7dd31cf1",
      "id": "CVE-2023-52522",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix possible store tearing in neigh_periodic_work()\n\nWhile looking at a related syzbot report involving neigh_periodic_work(),\nI found that I forgot to add an annotation when deleting an\nRCU protected item from a list.\n\nReaders use rcu_deference(*np), we need to use either\nrcu_assign_pointer() or WRITE_ONCE() on writer side\nto prevent store tearing.\n\nI use rcu_assign_pointer() to have lockdep support,\nthis was the choice made in neigh_flush_dev().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3344ccd-e8f2-40cb-b128-71a89aec9346",
      "id": "CVE-2023-52573",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: Fix possible NULL-pointer dereference\n\nIn rds_rdma_cm_event_handler_cmn() check, if conn pointer exists\nbefore dereferencing it as rdma_set_service_type() argument\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3b42f0d-33dd-4ada-9899-3f3dddf22de8",
      "id": "CVE-2023-52732",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: blocklist the kclient when receiving corrupted snap trace\n\nWhen received corrupted snap trace we don't know what exactly has\nhappened in MDS side. And we shouldn't continue IOs and metadatas\naccess to MDS, which may corrupt or get incorrect contents.\n\nThis patch will just block all the further IO/MDS requests\nimmediately and then evict the kclient itself.\n\nThe reason why we still need to evict the kclient just after\nblocking all the further IOs is that the MDS could revoke the caps\nfaster.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6129bb8e-7cf4-41be-a062-461f8ac6193e",
      "id": "CVE-2023-52815",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vkms: fix a possible null pointer dereference\n\nIn amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()\nis assigned to mode, which will lead to a NULL pointer dereference\non failure of drm_cvt_mode(). Add a check to avoid null pointer\ndereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9315eeac-8621-46ce-b235-b1c4295d5490",
      "id": "CVE-2023-52922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: Fix UAF in bcm_proc_show()\n\nBUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80\nRead of size 8 at addr ffff888155846230 by task cat/7862\n\nCPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xd5/0x150\n print_report+0xc1/0x5e0\n kasan_report+0xba/0xf0\n bcm_proc_show+0x969/0xa80\n seq_read_iter+0x4f6/0x1260\n seq_read+0x165/0x210\n proc_reg_read+0x227/0x300\n vfs_read+0x1d5/0x8d0\n ksys_read+0x11e/0x240\n do_syscall_64+0x35/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAllocated by task 7846:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n __kasan_kmalloc+0x9e/0xa0\n bcm_sendmsg+0x264b/0x44e0\n sock_sendmsg+0xda/0x180\n ____sys_sendmsg+0x735/0x920\n ___sys_sendmsg+0x11d/0x1b0\n __sys_sendmsg+0xfa/0x1d0\n do_syscall_64+0x35/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nFreed by task 7846:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x27/0x40\n ____kasan_slab_free+0x161/0x1c0\n slab_free_freelist_hook+0x119/0x220\n __kmem_cache_free+0xb4/0x2e0\n rcu_core+0x809/0x1bd0\n\nbcm_op is freed before procfs entry be removed in bcm_release(),\nthis lead to bcm_proc_show() may read the freed bcm_op.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8e2e136-9771-4534-82e2-be67988d205a",
      "id": "CVE-2023-52936",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ee96ad7-3f78-4f3f-91ec-46a67cbd6290",
      "id": "CVE-2023-53040",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nca8210: fix mac_len negative array access\n\nThis patch fixes a buffer overflow access of skb-\u003edata if\nieee802154_hdr_peek_addrs() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d529cc2-661c-4a7a-af5d-95a03dc6c25b",
      "id": "CVE-2023-53066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info\n\nWe have to make sure that the info returned by the helper is valid\nbefore using it.\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE\nstatic analysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "419dfc46-9ae8-43fd-b8e5-2bfcf77741b7",
      "id": "CVE-2023-53150",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Pointer may be dereferenced\n\nKlocwork tool reported pointer 'rport' returned from call to function\nfc_bsg_to_rport() may be NULL and will be dereferenced.\n\nAdd a fix to validate rport before dereferencing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce371301-360a-4a21-80b8-c1e27bbca61f",
      "id": "CVE-2023-53185",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: don't allow to overwrite ENDPOINT0 attributes\n\nA bad USB device is able to construct a service connection response\nmessage with target endpoint being ENDPOINT0 which is reserved for\nHTC_CTRL_RSVD_SVC and should not be modified to be used for any other\nservices.\n\nReject such service connection responses.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26fdadb5-f4bf-4fc6-9f88-2b84f5b6a02a",
      "id": "CVE-2023-53213",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()\n\nFix a slab-out-of-bounds read that occurs in kmemdup() called from\nbrcmf_get_assoc_ies().\nThe bug could occur when assoc_info-\u003ereq_len, data from a URB provided\nby a USB device, is bigger than the size of buffer which is defined as\nWL_EXTRA_BUF_MAX.\n\nAdd the size check for req_len/resp_len of assoc_info.\n\nFound by a modified version of syzkaller.\n\n[   46.592467][    T7] ==================================================================\n[   46.594687][    T7] BUG: KASAN: slab-out-of-bounds in kmemdup+0x3e/0x50\n[   46.596572][    T7] Read of size 3014656 at addr ffff888019442000 by task kworker/0:1/7\n[   46.598575][    T7]\n[   46.599157][    T7] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G           O      5.14.0+ #145\n[   46.601333][    T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n[   46.604360][    T7] Workqueue: events brcmf_fweh_event_worker\n[   46.605943][    T7] Call Trace:\n[   46.606584][    T7]  dump_stack_lvl+0x8e/0xd1\n[   46.607446][    T7]  print_address_description.constprop.0.cold+0x93/0x334\n[   46.608610][    T7]  ? kmemdup+0x3e/0x50\n[   46.609341][    T7]  kasan_report.cold+0x79/0xd5\n[   46.610151][    T7]  ? kmemdup+0x3e/0x50\n[   46.610796][    T7]  kasan_check_range+0x14e/0x1b0\n[   46.611691][    T7]  memcpy+0x20/0x60\n[   46.612323][    T7]  kmemdup+0x3e/0x50\n[   46.612987][    T7]  brcmf_get_assoc_ies+0x967/0xf60\n[   46.613904][    T7]  ? brcmf_notify_vif_event+0x3d0/0x3d0\n[   46.614831][    T7]  ? lock_chain_count+0x20/0x20\n[   46.615683][    T7]  ? mark_lock.part.0+0xfc/0x2770\n[   46.616552][    T7]  ? lock_chain_count+0x20/0x20\n[   46.617409][    T7]  ? mark_lock.part.0+0xfc/0x2770\n[   46.618244][    T7]  ? lock_chain_count+0x20/0x20\n[   46.619024][    T7]  brcmf_bss_connect_done.constprop.0+0x241/0x2e0\n[   46.620019][    T7]  ? brcmf_parse_configure_security.isra.0+0x2a0/0x2a0\n[   46.620818][    T7]  ? __lock_acquire+0x181f/0x5790\n[   46.621462][    T7]  brcmf_notify_connect_status+0x448/0x1950\n[   46.622134][    T7]  ? rcu_read_lock_bh_held+0xb0/0xb0\n[   46.622736][    T7]  ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0\n[   46.623390][    T7]  ? find_held_lock+0x2d/0x110\n[   46.623962][    T7]  ? brcmf_fweh_event_worker+0x19f/0xc60\n[   46.624603][    T7]  ? mark_held_locks+0x9f/0xe0\n[   46.625145][    T7]  ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0\n[   46.625871][    T7]  ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0\n[   46.626545][    T7]  brcmf_fweh_call_event_handler.isra.0+0x90/0x100\n[   46.627338][    T7]  brcmf_fweh_event_worker+0x557/0xc60\n[   46.627962][    T7]  ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100\n[   46.628736][    T7]  ? rcu_read_lock_sched_held+0xa1/0xd0\n[   46.629396][    T7]  ? rcu_read_lock_bh_held+0xb0/0xb0\n[   46.629970][    T7]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0\n[   46.630649][    T7]  process_one_work+0x92b/0x1460\n[   46.631205][    T7]  ? pwq_dec_nr_in_flight+0x330/0x330\n[   46.631821][    T7]  ? rwlock_bug.part.0+0x90/0x90\n[   46.632347][    T7]  worker_thread+0x95/0xe00\n[   46.632832][    T7]  ? __kthread_parkme+0x115/0x1e0\n[   46.633393][    T7]  ? process_one_work+0x1460/0x1460\n[   46.633957][    T7]  kthread+0x3a1/0x480\n[   46.634369][    T7]  ? set_kthread_struct+0x120/0x120\n[   46.634933][    T7]  ret_from_fork+0x1f/0x30\n[   46.635431][    T7]\n[   46.635687][    T7] Allocated by task 7:\n[   46.636151][    T7]  kasan_save_stack+0x1b/0x40\n[   46.636628][    T7]  __kasan_kmalloc+0x7c/0x90\n[   46.637108][    T7]  kmem_cache_alloc_trace+0x19e/0x330\n[   46.637696][    T7]  brcmf_cfg80211_attach+0x4a0/0x4040\n[   46.638275][    T7]  brcmf_attach+0x389/0xd40\n[   46.638739][    T7]  brcmf_usb_probe+0x12de/0x1690\n[   46.639279][    T7]  usb_probe_interface+0x2aa/0x760\n[   46.639820][    T7]  really_probe+0x205/0xb70\n[   46.640342][    T7]  __driver_probe_device+0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01f5f1b2-52e7-45bc-9e33-4dc925a24d41",
      "id": "CVE-2023-53248",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: install stub fence into potential unused fence pointers\n\nWhen using cpu to update page tables, vm update fences are unused.\nInstall stub fence into these fence pointers instead of NULL\nto avoid NULL dereference when calling dma_fence_wait() on them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d013470-7e0a-4f72-852c-6c76a6442704",
      "id": "CVE-2023-53289",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: bdisp: Add missing check for create_workqueue\n\nAdd the check for the return value of the create_workqueue\nin order to avoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "710f3c0d-88d8-4a11-8a98-0f41a03b4d57",
      "id": "CVE-2023-53307",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails\n\nIf getting an ID or setting up a work queue in rbd_dev_create() fails,\nuse-after-free on rbd_dev-\u003erbd_client, rbd_dev-\u003espec and rbd_dev-\u003eopts\nis triggered in do_rbd_add().  The root cause is that the ownership of\nthese structures is transfered to rbd_dev prematurely and they all end\nup getting freed when rbd_dev_create() calls rbd_dev_free() prior to\nreturning to do_rbd_add().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE, an\nincomplete patch submitted by Natalia Petrova \u003cn.petrova@fintech.ru\u003e.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2774ac8f-409c-4bef-bdce-d7a769f01725",
      "id": "CVE-2023-53313",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix wrong setting of max_corr_read_errors\n\nThere is no input check when echo md/max_read_errors and overflow might\noccur. Add check of input number.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56b4dc2a-2f3e-4709-93ab-395f8ad0b26b",
      "id": "CVE-2023-53335",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()\n\nIf get_ep_from_tid() fails to lookup non-NULL value for ep, ep is\ndereferenced later regardless of whether it is empty.\nThis patch adds a simple sanity check to fix the issue.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5061400-4e7f-45b3-96d8-dd819e498ff6",
      "id": "CVE-2024-26691",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix circular locking dependency\n\nThe rule inside kvm enforces that the vcpu-\u003emutex is taken *inside*\nkvm-\u003elock. The rule is violated by the pkvm_create_hyp_vm() which acquires\nthe kvm-\u003elock while already holding the vcpu-\u003emutex lock from\nkvm_vcpu_ioctl(). Avoid the circular locking dependency altogether by\nprotecting the hyp vm handle with the config_lock, much like we already\ndo for other forms of VM-scoped data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "819d762a-10b5-46b0-b20b-2c14da09b2af",
      "id": "CVE-2024-26880",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: call the resume method on internal suspend\n\nThere is this reported crash when experimenting with the lvm2 testsuite.\nThe list corruption is caused by the fact that the postsuspend and resume\nmethods were not paired correctly; there were two consecutive calls to the\norigin_postsuspend function. The second call attempts to remove the\n\"hash_list\" entry from a list, while it was already removed by the first\ncall.\n\nFix __dm_internal_resume so that it calls the preresume and resume\nmethods of the table's targets.\n\nIf a preresume method of some target fails, we are in a tricky situation.\nWe can't return an error because dm_internal_resume isn't supposed to\nreturn errors. We can't return success, because then the \"resume\" and\n\"postsuspend\" methods would not be paired correctly. So, we set the\nDMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace\ntools, but it won't cause a kernel crash.\n\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:56!\ninvalid opcode: 0000 [#1] PREEMPT SMP\nCPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0\n\u003csnip\u003e\nRSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282\nRAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff\nRBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058\nR10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001\nR13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0\nFS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000\nCS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\nCR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0\nCall Trace:\n \u003cTASK\u003e\n ? die+0x2d/0x80\n ? do_trap+0xeb/0xf0\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? do_error_trap+0x60/0x80\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? exc_invalid_op+0x49/0x60\n ? __list_del_entry_valid_or_report+0x77/0xc0\n ? asm_exc_invalid_op+0x16/0x20\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ? __list_del_entry_valid_or_report+0x77/0xc0\n origin_postsuspend+0x1a/0x50 [dm_snapshot]\n dm_table_postsuspend_targets+0x34/0x50 [dm_mod]\n dm_suspend+0xd8/0xf0 [dm_mod]\n dev_suspend+0x1f2/0x2f0 [dm_mod]\n ? table_deps+0x1b0/0x1b0 [dm_mod]\n ctl_ioctl+0x300/0x5f0 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]\n __x64_compat_sys_ioctl+0x104/0x170\n do_syscall_64+0x184/0x1b0\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\nRIP: 0033:0xf7e6aead\n\u003csnip\u003e\n---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8aa7c50d-fe1c-4dae-ad4a-b859a3803632",
      "id": "CVE-2024-27030",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Use separate handlers for interrupts\n\nFor PF to AF interrupt vector and VF to AF vector same\ninterrupt handler is registered which is causing race condition.\nWhen two interrupts are raised to two CPUs at same time\nthen two cores serve same event corrupting the data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e969c40-4c2f-4af7-a938-cec98f9055fa",
      "id": "CVE-2024-35877",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: fix VM_PAT handling in COW mappings\n\nPAT handling won't do the right thing in COW mappings: the first PTE (or,\nin fact, all PTEs) can be replaced during write faults to point at anon\nfolios.  Reliably recovering the correct PFN and cachemode using\nfollow_phys() from PTEs will not work in COW mappings.\n\nUsing follow_phys(), we might just get the address+protection of the anon\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\ntrack_pfn_copy(), not properly calling free_pfn_range().\n\nIn free_pfn_range(), we either wouldn't call memtype_free() or would call\nit with the wrong range, possibly leaking memory.\n\nTo fix that, let's update follow_phys() to refuse returning anon folios,\nand fallback to using the stored PFN inside vma-\u003evm_pgoff for COW mappings\nif we run into that.\n\nWe will now properly handle untrack_pfn() with COW mappings, where we\ndon't need the cachemode.  We'll have to fail fork()-\u003etrack_pfn_copy() if\nthe first page was replaced by an anon folio, though: we'd have to store\nthe cachemode in the VMA to make this work, likely growing the VMA size.\n\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\ncase: it would have failed in the past with swap/nonswap entries already,\nand it would have done the wrong thing with anon folios.\n\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\n\n\u003c--- C reproducer ---\u003e\n #include \u003cstdio.h\u003e\n #include \u003csys/mman.h\u003e\n #include \u003cunistd.h\u003e\n #include \u003cliburing.h\u003e\n\n int main(void)\n {\n         struct io_uring_params p = {};\n         int ring_fd;\n         size_t size;\n         char *map;\n\n         ring_fd = io_uring_setup(1, \u0026p);\n         if (ring_fd \u003c 0) {\n                 perror(\"io_uring_setup\");\n                 return 1;\n         }\n         size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\n\n         /* Map the submission queue ring MAP_PRIVATE */\n         map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\n                    ring_fd, IORING_OFF_SQ_RING);\n         if (map == MAP_FAILED) {\n                 perror(\"mmap\");\n                 return 1;\n         }\n\n         /* We have at least one page. Let's COW it. */\n         *map = 0;\n         pause();\n         return 0;\n }\n\u003c--- C reproducer ---\u003e\n\nOn a system with 16 GiB RAM and swap configured:\n # ./iouring \u0026\n # memhog 16G\n # killall iouring\n[  301.552930] ------------[ cut here ]------------\n[  301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\n[  301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\n[  301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\n[  301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\n[  301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\n[  301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\n[  301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\n[  301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\n[  301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\n[  301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\n[  301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\n[  301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\n[  301.564186] FS:  0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\n[  301.564773] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\n[  301.565725] PKRU: 55555554\n[  301.565944] Call Trace:\n[  301.566148]  \u003cTASK\u003e\n[  301.566325]  ? untrack_pfn+0xf4/0x100\n[  301.566618]  ? __warn+0x81/0x130\n[  301.566876]  ? untrack_pfn+0xf4/0x100\n[  3\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "550c5043-c77e-4b06-94bd-cbbe0953bff3",
      "id": "CVE-2021-33033",
      "description": "The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c23a8280-5b0f-443a-be51-984d830f113e",
      "id": "CVE-2024-35950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Fully protect modes[] with dev-\u003emode_config.mutex\n\nThe modes[] array contains pointers to modes on the connectors'\nmode lists, which are protected by dev-\u003emode_config.mutex.\nThus we need to extend modes[] the same protection or by the\ntime we use it the elements may already be pointing to\nfreed/reused memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02ee934a-1716-4bff-a15f-1756747890c0",
      "id": "CVE-2024-38538",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: xmit: make sure we have at least eth header len bytes\n\nsyzbot triggered an uninit value[1] error in bridge device's xmit path\nby sending a short (less than ETH_HLEN bytes) skb. To fix it check if\nwe can actually pull that amount instead of assuming.\n\nTested with dropwatch:\n drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)\n origin: software\n timestamp: Mon May 13 11:31:53 2024 778214037 nsec\n protocol: 0x88a8\n length: 2\n original length: 2\n drop reason: PKT_TOO_SMALL\n\n[1]\nBUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65\n br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65\n __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n xmit_one net/core/dev.c:3531 [inline]\n dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341\n dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n __bpf_tx_skb net/core/filter.c:2136 [inline]\n __bpf_redirect_common net/core/filter.c:2180 [inline]\n __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187\n ____bpf_clone_redirect net/core/filter.c:2460 [inline]\n bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432\n ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997\n __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238\n bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]\n __bpf_prog_run include/linux/filter.h:657 [inline]\n bpf_prog_run include/linux/filter.h:664 [inline]\n bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425\n bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058\n bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678\n __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]\n __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765\n x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d58ea784-8a35-4329-85b0-663fb5c3e2c3",
      "id": "CVE-2024-42092",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: davinci: Validate the obtained number of IRQs\n\nValue of pdata-\u003egpio_unbanked is taken from Device Tree. In case of broken\nDT due to any error this value can be any. Without this value validation\nthere can be out of chips-\u003eirqs array boundaries access in\ndavinci_gpio_probe().\n\nValidate the obtained nirq value so that it won't exceed the maximum\nnumber of IRQs per bank.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1dfaa8b7-dde7-474f-acde-a29049ea38c9",
      "id": "CVE-2024-43819",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: s390: Reject memory region operations for ucontrol VMs\n\nThis change rejects the KVM_SET_USER_MEMORY_REGION and\nKVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM.\nThis is necessary since ucontrol VMs have kvm-\u003earch.gmap set to 0 and\nwould thus result in a null pointer dereference further in.\nMemory management needs to be performed in userspace and using the\nioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.\n\nAlso improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION\nand KVM_SET_USER_MEMORY_REGION2.\n\n[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "017b67d3-d156-4a9c-b34b-89f91d8d0ee8",
      "id": "CVE-2024-43860",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_rproc: Skip over memory region when node value is NULL\n\nIn imx_rproc_addr_init() \"nph = of_count_phandle_with_args()\" just counts\nnumber of phandles. But phandles may be empty. So of_parse_phandle() in\nthe parsing loop (0 \u003c a \u003c nph) may return NULL which is later dereferenced.\nAdjust this issue by adding NULL-return check.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[Fixed title to fit within the prescribed 70-75 charcters]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ecb5232-5b19-404f-b894-3cdc70ce100d",
      "id": "CVE-2024-44946",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: Serialise kcm_sendmsg() for the same socket.\n\nsyzkaller reported UAF in kcm_release(). [0]\n\nThe scenario is\n\n  1. Thread A builds a skb with MSG_MORE and sets kcm-\u003eseq_skb.\n\n  2. Thread A resumes building skb from kcm-\u003eseq_skb but is blocked\n     by sk_stream_wait_memory()\n\n  3. Thread B calls sendmsg() concurrently, finishes building kcm-\u003eseq_skb\n     and puts the skb to the write queue\n\n  4. Thread A faces an error and finally frees skb that is already in the\n     write queue\n\n  5. kcm_release() does double-free the skb in the write queue\n\nWhen a thread is building a MSG_MORE skb, another thread must not touch it.\n\nLet's add a per-sk mutex and serialise kcm_sendmsg().\n\n[0]:\nBUG: KASAN: slab-use-after-free in __skb_unlink include/linux/skbuff.h:2366 [inline]\nBUG: KASAN: slab-use-after-free in __skb_dequeue include/linux/skbuff.h:2385 [inline]\nBUG: KASAN: slab-use-after-free in __skb_queue_purge_reason include/linux/skbuff.h:3175 [inline]\nBUG: KASAN: slab-use-after-free in __skb_queue_purge include/linux/skbuff.h:3181 [inline]\nBUG: KASAN: slab-use-after-free in kcm_release+0x170/0x4c8 net/kcm/kcmsock.c:1691\nRead of size 8 at addr ffff0000ced0fc80 by task syz-executor329/6167\n\nCPU: 1 PID: 6167 Comm: syz-executor329 Tainted: G    B              6.8.0-rc5-syzkaller-g9abbc24128bc #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall trace:\n dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x178/0x518 mm/kasan/report.c:488\n kasan_report+0xd8/0x138 mm/kasan/report.c:601\n __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381\n __skb_unlink include/linux/skbuff.h:2366 [inline]\n __skb_dequeue include/linux/skbuff.h:2385 [inline]\n __skb_queue_purge_reason include/linux/skbuff.h:3175 [inline]\n __skb_queue_purge include/linux/skbuff.h:3181 [inline]\n kcm_release+0x170/0x4c8 net/kcm/kcmsock.c:1691\n __sock_release net/socket.c:659 [inline]\n sock_close+0xa4/0x1e8 net/socket.c:1421\n __fput+0x30c/0x738 fs/file_table.c:376\n ____fput+0x20/0x30 fs/file_table.c:404\n task_work_run+0x230/0x2e0 kernel/task_work.c:180\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x618/0x1f64 kernel/exit.c:871\n do_group_exit+0x194/0x22c kernel/exit.c:1020\n get_signal+0x1500/0x15ec kernel/signal.c:2893\n do_signal+0x23c/0x3b44 arch/arm64/kernel/signal.c:1249\n do_notify_resume+0x74/0x1f4 arch/arm64/kernel/entry-common.c:148\n exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline]\n exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline]\n el0_svc+0xac/0x168 arch/arm64/kernel/entry-common.c:713\n el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\n\nAllocated by task 6166:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_alloc_info+0x70/0x84 mm/kasan/generic.c:626\n unpoison_slab_object mm/kasan/common.c:314 [inline]\n __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:340\n kasan_slab_alloc include/linux/kasan.h:201 [inline]\n slab_post_alloc_hook mm/slub.c:3813 [inline]\n slab_alloc_node mm/slub.c:3860 [inline]\n kmem_cache_alloc_node+0x204/0x4c0 mm/slub.c:3903\n __alloc_skb+0x19c/0x3d8 net/core/skbuff.c:641\n alloc_skb include/linux/skbuff.h:1296 [inline]\n kcm_sendmsg+0x1d3c/0x2124 net/kcm/kcmsock.c:783\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n sock_sendmsg+0x220/0x2c0 net/socket.c:768\n splice_to_socket+0x7cc/0xd58 fs/splice.c:889\n do_splice_from fs/splice.c:941 [inline]\n direct_splice_actor+0xec/0x1d8 fs/splice.c:1164\n splice_direct_to_actor+0x438/0xa0c fs/splice.c:1108\n do_splice_direct_actor \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1eae209b-5f2c-4185-b12a-f33bc584506d",
      "id": "CVE-2024-46715",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver: iio: add missing checks on iio_info's callback access\n\nSome callbacks from iio_info structure are accessed without any check, so\nif a driver doesn't implement them trying to access the corresponding\nsysfs entries produce a kernel oops such as:\n\n[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute\n[...]\n[ 2203.783416] Call trace:\n[ 2203.783429]  iio_read_channel_info_avail from dev_attr_show+0x18/0x48\n[ 2203.789807]  dev_attr_show from sysfs_kf_seq_show+0x90/0x120\n[ 2203.794181]  sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4\n[ 2203.798555]  seq_read_iter from vfs_read+0x238/0x2a0\n[ 2203.802236]  vfs_read from ksys_read+0xa4/0xd4\n[ 2203.805385]  ksys_read from ret_fast_syscall+0x0/0x54\n[ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0)\n[ 2203.812880] dfa0:                   00000003 b6f10f80 00000003 b6eab000 00020000 00000000\n[ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000\n[ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0\n[ 2203.830363] Code: bad PC value\n[ 2203.832695] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfb3920f-9ed5-49f2-8069-ea7c5a3e7b71",
      "id": "CVE-2024-46721",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix possible NULL pointer dereference\n\nprofile-\u003eparent-\u003edents[AAFS_PROF_DIR] could be NULL only if its parent is made\nfrom __create_missing_ancestors(..) and 'ent-\u003eold' is NULL in\naa_replace_profiles(..).\nIn that case, it must return an error code and the code, -ENOENT represents\nits state that the path of its parent is not existed yet.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000030\nPGD 0 P4D 0\nPREEMPT SMP PTI\nCPU: 4 PID: 3362 Comm: apparmor_parser Not tainted 6.8.0-24-generic #24\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:aafs_create.constprop.0+0x7f/0x130\nCode: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc \u003c4d\u003e 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae\nRSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n ? show_regs+0x6d/0x80\n ? __die+0x24/0x80\n ? page_fault_oops+0x99/0x1b0\n ? kernelmode_fixup_or_oops+0xb2/0x140\n ? __bad_area_nosemaphore+0x1a5/0x2c0\n ? find_vma+0x34/0x60\n ? bad_area_nosemaphore+0x16/0x30\n ? do_user_addr_fault+0x2a2/0x6b0\n ? exc_page_fault+0x83/0x1b0\n ? asm_exc_page_fault+0x27/0x30\n ? aafs_create.constprop.0+0x7f/0x130\n ? aafs_create.constprop.0+0x51/0x130\n __aafs_profile_mkdir+0x3d6/0x480\n aa_replace_profiles+0x83f/0x1270\n policy_update+0xe3/0x180\n profile_load+0xbc/0x150\n ? rw_verify_area+0x47/0x140\n vfs_write+0x100/0x480\n ? __x64_sys_openat+0x55/0xa0\n ? syscall_exit_to_user_mode+0x86/0x260\n ksys_write+0x73/0x100\n __x64_sys_write+0x19/0x30\n x64_sys_call+0x7e/0x25c0\n do_syscall_64+0x7f/0x180\n entry_SYSCALL_64_after_hwframe+0x78/0x80\nRIP: 0033:0x7be9f211c574\nCode: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89\nRSP: 002b:00007ffd26f2b8c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00005d504415e200 RCX: 00007be9f211c574\nRDX: 0000000000001fc1 RSI: 00005d504418bc80 RDI: 0000000000000004\nRBP: 0000000000001fc1 R08: 0000000000001fc1 R09: 0000000080000000\nR10: 0000000000000000 R11: 0000000000000202 R12: 00005d504418bc80\nR13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30\n \u003c/TASK\u003e\nModules linked in: snd_seq_dummy snd_hrtimer qrtr snd_hda_codec_generic snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device i2c_i801 snd_timer i2c_smbus qxl snd soundcore drm_ttm_helper lpc_ich ttm joydev input_leds serio_raw mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas\nCR2: 0000000000000030\n---[ end trace 0000000000000000 ]---\nRIP: 0010:aafs_create.constprop.0+0x7f/0x130\nCode: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc \u003c4d\u003e 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae\nRSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2dcf05c-72f2-467c-af58-702aa903d18f",
      "id": "CVE-2024-46826",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nELF: fix kernel.randomize_va_space double read\n\nELF loader uses \"randomize_va_space\" twice. It is sysctl and can change\nat any moment, so 2 loads could see 2 different values in theory with\nunpredictable consequences.\n\nIssue exactly one load for consistent value across one exec.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c0ed85e-7900-4214-9812-525f29a4bfe3",
      "id": "CVE-2024-46843",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Remove SCSI host only if added\n\nIf host tries to remove ufshcd driver from a UFS device it would cause a\nkernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before\nadding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host\nhas been defered after MCQ configuration introduced by commit 0cab4023ec7b\n(\"scsi: ufs: core: Defer adding host to SCSI if MCQ is supported\").\n\nTo guarantee that SCSI host is removed only if it has been added, set the\nscsi_host_added flag to true after adding a SCSI host and check whether it\nis set or not before removing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e69e95cb-6fc2-4afa-90f3-23f7b21d3c4f",
      "id": "CVE-2024-46871",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX\n\n[Why \u0026 How]\nIt actually exposes '6' types in enum dmub_notification_type. Not 5. Using smaller\nnumber to create array dmub_callback \u0026 dmub_thread_offload has potential to access\nitem out of array bound. Fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d2036510-44ae-4686-bf40-795f459e1800",
      "id": "CVE-2024-52332",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix potential invalid memory access in igb_init_module()\n\nThe pci_register_driver() can fail and when this happened, the dca_notifier\nneeds to be unregistered, otherwise the dca_notifier can be called when\nigb fails to install, resulting to invalid memory access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d07e0c3-86ba-4eff-afc6-fcc0a7aa0f98",
      "id": "CVE-2024-47745",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat \u003e test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret \u003c= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "188527f6-f744-4539-8a0d-b5f22ed66cdb",
      "id": "CVE-2024-49911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn20_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null at line 1030, but then it\nwas being dereferenced without any null check at line 1048. This could\npotentially lead to a null pointer dereference error if set_output_gamma\nis null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma at line 1048.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92ab12d1-db21-4d5b-8005-f1e808b32737",
      "id": "CVE-2024-49913",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream\n\nThis commit addresses a null pointer dereference issue in the\n`commit_planes_for_stream` function at line 4140. The issue could occur\nwhen `top_pipe_to_program` is null.\n\nThe fix adds a check to ensure `top_pipe_to_program` is not null before\naccessing its stream_res. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47e93897-5387-4417-a795-bd25832ce91e",
      "id": "CVE-2024-49932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n\nOn relocation we're doing readahead on the relocation inode, but if the\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\npreallocated extents not being mapped in the RST) from the lookup.\n\nBut readahead doesn't handle the error and submits invalid reads to the\ndevice, causing an assertion in the scatter-gather list code:\n\n  BTRFS info (device nvme1n1): balance: start -d -m -s\n  BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\n  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/scatterlist.h:115!\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die_body.cold+0x14/0x25\n   ? die+0x2e/0x50\n   ? do_trap+0xca/0x110\n   ? do_error_trap+0x65/0x80\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? exc_invalid_op+0x50/0x70\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? __blk_rq_map_sg+0x339/0x4a0\n   nvme_prep_rq.part.0+0x9d/0x770\n   nvme_queue_rq+0x7d/0x1e0\n   __blk_mq_issue_directly+0x2a/0x90\n   ? blk_mq_get_budget_and_tag+0x61/0x90\n   blk_mq_try_issue_list_directly+0x56/0xf0\n   blk_mq_flush_plug_list.part.0+0x52b/0x5d0\n   __blk_flush_plug+0xc6/0x110\n   blk_finish_plug+0x28/0x40\n   read_pages+0x160/0x1c0\n   page_cache_ra_unbounded+0x109/0x180\n   relocate_file_extent_cluster+0x611/0x6a0\n   ? btrfs_search_slot+0xba4/0xd20\n   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\n   relocate_data_extent.constprop.0+0x134/0x160\n   relocate_block_group+0x3f2/0x500\n   btrfs_relocate_block_group+0x250/0x430\n   btrfs_relocate_chunk+0x3f/0x130\n   btrfs_balance+0x71b/0xef0\n   ? kmalloc_trace_noprof+0x13b/0x280\n   btrfs_ioctl+0x2c2e/0x3030\n   ? kvfree_call_rcu+0x1e6/0x340\n   ? list_lru_add_obj+0x66/0x80\n   ? mntput_no_expire+0x3a/0x220\n   __x64_sys_ioctl+0x96/0xc0\n   do_syscall_64+0x54/0x110\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7fcc04514f9b\n  Code: Unable to access opcode bytes at 0x7fcc04514f71.\n  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\n  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\n  R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\n  R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\n   \u003c/TASK\u003e\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Kernel p\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ab0a55c-8fa9-4f50-9039-a42818d4f192",
      "id": "CVE-2024-49970",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Implement bounds check for stream encoder creation in DCN401\n\n'stream_enc_regs' array is an array of dcn10_stream_enc_registers\nstructures. The array is initialized with four elements, corresponding\nto the four calls to stream_enc_regs() in the array initializer. This\nmeans that valid indices for this array are 0, 1, 2, and 3.\n\nThe error message 'stream_enc_regs' 4 \u003c= 5 below, is indicating that\nthere is an attempt to access this array with an index of 5, which is\nout of bounds. This could lead to undefined behavior\n\nHere, eng_id is used as an index to access the stream_enc_regs array. If\neng_id is 5, this would result in an out-of-bounds access on the\nstream_enc_regs array.\n\nThus fixing Buffer overflow error in dcn401_stream_encoder_create\n\nFound by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 \u003c= 5",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ee73924-455f-40fc-81d2-fe7b1f3af988",
      "id": "CVE-2024-49996",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix buffer overflow when parsing NFS reparse points\n\nReparseDataLength is sum of the InodeType size and DataBuffer size.\nSo to get DataBuffer size it is needed to subtract InodeType's size from\nReparseDataLength.\n\nFunction cifs_strndup_from_utf16() is currentlly accessing buf-\u003eDataBuffer\nat position after the end of the buffer because it does not subtract\nInodeType size from the length. Fix this problem and correctly subtract\nvariable len.\n\nMember InodeType is present only when reparse buffer is large enough. Check\nfor ReparseDataLength before accessing InodeType to prevent another invalid\nmemory access.\n\nMajor and minor rdev values are present also only when reparse buffer is\nlarge enough. Check for reparse buffer size before calling reparse_mkdev().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f616bce-0f1a-4eb2-bc1b-63fcd9400110",
      "id": "CVE-2024-53066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Fix KMSAN warning in decode_getfattr_attrs()\n\nFix the following KMSAN warning:\n\nCPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G    B\nTainted: [B]=BAD_PAGE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n=====================================================\n=====================================================\nBUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90\n decode_getfattr_attrs+0x2d6d/0x2f90\n decode_getfattr_generic+0x806/0xb00\n nfs4_xdr_dec_getattr+0x1de/0x240\n rpcauth_unwrap_resp_decode+0xab/0x100\n rpcauth_unwrap_resp+0x95/0xc0\n call_decode+0x4ff/0xb50\n __rpc_execute+0x57b/0x19d0\n rpc_execute+0x368/0x5e0\n rpc_run_task+0xcfe/0xee0\n nfs4_proc_getattr+0x5b5/0x990\n __nfs_revalidate_inode+0x477/0xd00\n nfs_access_get_cached+0x1021/0x1cc0\n nfs_do_access+0x9f/0xae0\n nfs_permission+0x1e4/0x8c0\n inode_permission+0x356/0x6c0\n link_path_walk+0x958/0x1330\n path_lookupat+0xce/0x6b0\n filename_lookup+0x23e/0x770\n vfs_statx+0xe7/0x970\n vfs_fstatat+0x1f2/0x2c0\n __se_sys_newfstatat+0x67/0x880\n __x64_sys_newfstatat+0xbd/0x120\n x64_sys_call+0x1826/0x3cf0\n do_syscall_64+0xd0/0x1b0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe KMSAN warning is triggered in decode_getfattr_attrs(), when calling\ndecode_attr_mdsthreshold(). It appears that fattr-\u003emdsthreshold is not\ninitialized.\n\nFix the issue by initializing fattr-\u003emdsthreshold to NULL in\nnfs_fattr_init().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b4f5a54-3ec9-4c4d-9f6e-7908682b76e4",
      "id": "CVE-2024-53128",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/task_stack: fix object_is_on_stack() for KASAN tagged pointers\n\nWhen CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the\nobject_is_on_stack() function may produce incorrect results due to the\npresence of tags in the obj pointer, while the stack pointer does not have\ntags.  This discrepancy can lead to incorrect stack object detection and\nsubsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled.\n\nExample of the warning:\n\nODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364\nModules linked in:\nCPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4\nHardware name: linux,dummy-virt (DT)\npstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __debug_object_init+0x330/0x364\nlr : __debug_object_init+0x330/0x364\nsp : ffff800082ea7b40\nx29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534\nx26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0\nx23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418\nx20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000\nx17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e\nx14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e\nx11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800\nx8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4\nx2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050\nCall trace:\n __debug_object_init+0x330/0x364\n debug_object_init_on_stack+0x30/0x3c\n schedule_hrtimeout_range_clock+0xac/0x26c\n schedule_hrtimeout+0x1c/0x30\n wait_task_inactive+0x1d4/0x25c\n kthread_bind_mask+0x28/0x98\n init_rescuer+0x1e8/0x280\n workqueue_init+0x1a0/0x3cc\n kernel_init_freeable+0x118/0x200\n kernel_init+0x28/0x1f0\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\nODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.\n------------[ cut here ]------------",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "434a68f8-a10f-4325-bf5f-eb4f797556fa",
      "id": "CVE-2024-56569",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix regression with module command in stack_trace_filter\n\nWhen executing the following command:\n\n    # echo \"write*:mod:ext3\" \u003e /sys/kernel/tracing/stack_trace_filter\n\nThe current mod command causes a null pointer dereference. While commit\n0f17976568b3f (\"ftrace: Fix regression with module command in stack_trace_filter\")\nhas addressed part of the issue, it left a corner case unhandled, which still\nresults in a kernel crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "868fd0fe-e15f-4c2e-aeaa-b043841e588b",
      "id": "CVE-2024-57872",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()\n\nThis will ensure that the scsi host is cleaned up properly using\nscsi_host_dev_release(). Otherwise, it may lead to memory leaks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "520cda8a-189b-4f5c-b3a8-c8a91bb714d8",
      "id": "CVE-2025-21768",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels\n\nSome lwtunnels have a dst cache for post-transformation dst.\nIf the packet destination did not change we may end up recording\na reference to the lwtunnel in its own cache, and the lwtunnel\nstate will never be freed.\n\nDiscovered by the ioam6.sh test, kmemleak was recently fixed\nto catch per-cpu memory leaks. I'm not sure if rpl and seg6\ncan actually hit this, but in principle I don't see why not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "999ed78a-15f7-44db-9fbf-b708e32ccfc5",
      "id": "CVE-2025-38203",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix null-ptr-deref in jfs_ioc_trim\n\n[ Syzkaller Report ]\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000087: 0000 [#1\nKASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f]\nCPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted\n6.13.0-rc6-gfbfd64d25c7a-dirty #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nSched_ext: serialise (enabled+all), task: runnable_at=-30ms\nRIP: 0010:jfs_ioc_trim+0x34b/0x8f0\nCode: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93\n90 82 fe ff 4c 89 ff 31 f6\nRSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206\nRAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a\nRDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001\nRBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000\nR10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438\nFS:  00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\n? __die_body+0x61/0xb0\n? die_addr+0xb1/0xe0\n? exc_general_protection+0x333/0x510\n? asm_exc_general_protection+0x26/0x30\n? jfs_ioc_trim+0x34b/0x8f0\njfs_ioctl+0x3c8/0x4f0\n? __pfx_jfs_ioctl+0x10/0x10\n? __pfx_jfs_ioctl+0x10/0x10\n__se_sys_ioctl+0x269/0x350\n? __pfx___se_sys_ioctl+0x10/0x10\n? do_syscall_64+0xfb/0x210\ndo_syscall_64+0xee/0x210\n? syscall_exit_to_user_mode+0x1e0/0x330\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe51f4903ad\nCode: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48\n89 f7 48 89 d6 48 89 ca 4d\nRSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad\nRDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640\nR13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000\n\u003c/TASK\u003e\nModules linked in:\n---[ end trace 0000000000000000 ]---\nRIP: 0010:jfs_ioc_trim+0x34b/0x8f0\nCode: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93\n90 82 fe ff 4c 89 ff 31 f6\nRSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206\nRAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a\nRDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001\nRBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000\nR10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438\nFS:  00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nKernel panic - not syncing: Fatal exception\n\n[ Analysis ]\n\nWe believe that we have found a concurrency bug in the `fs/jfs` module\nthat results in a null pointer dereference. There is a closely related\nissue which has been fixed:\n\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234\n\n... but, unfortunately, the accepted patch appears to still be\nsusceptible to a null pointer dereference under some interleavings.\n\nTo trigger the bug, we think that `JFS_SBI(ipbmap-\u003ei_sb)-\u003ebmap` is set\nto NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This\nbug manifests quite rarely under normal circumstances, but is\ntriggereable from a syz-program.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "412b73d3-d27a-423b-a56a-ee5a75c2c03a",
      "id": "CVE-2025-22037",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in alloc_preauth_hash()\n\nThe Client send malformed smb2 negotiate request. ksmbd return error\nresponse. Subsequently, the client can send smb2 session setup even\nthought conn-\u003epreauth_info is not allocated.\nThis patch add KSMBD_SESS_NEED_SETUP status of connection to ignore\nsession setup request if smb2 negotiate phase is not complete.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "354c718c-0d6f-467a-801f-b95fb2abceb4",
      "id": "CVE-2025-22090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we'll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \"simply\"\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we'll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let's fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won't try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\"x86/mm/pat: clear VM_PAT if copy_p4d_range failed\")\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "312e8c17-c4b5-4ded-be10-a18c55061d47",
      "id": "CVE-2025-37819",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()\n\nWith ACPI in place, gicv2m_get_fwnode() is registered with the pci\nsubsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime\nduring a PCI host bridge probe. But, the call back is wrongly marked as\n__init, causing it to be freed, while being registered with the PCI\nsubsystem and could trigger:\n\n Unable to handle kernel paging request at virtual address ffff8000816c0400\n  gicv2m_get_fwnode+0x0/0x58 (P)\n  pci_set_bus_msi_domain+0x74/0x88\n  pci_register_host_bridge+0x194/0x548\n\nThis is easily reproducible on a Juno board with ACPI boot.\n\nRetain the function for later use.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "131ccea6-4903-4506-a346-86957bef2918",
      "id": "CVE-2025-37882",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix isochronous Ring Underrun/Overrun event handling\n\nThe TRB pointer of these events points at enqueue at the time of error\noccurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we\nare handling the event, a new TD may be queued at this ring position.\n\nI can trigger this race by rising interrupt moderation to increase IRQ\nhandling delay. Similar delay may occur naturally due to system load.\n\nIf this ever happens after a Missed Service Error, missed TDs will be\nskipped and the new TD processed as if it matched the event. It could\nbe given back prematurely, risking data loss or buffer UAF by the xHC.\n\nDon't complete TDs on xrun events and don't warn if queued TDs don't\nmatch the event's TRB pointer, which can be NULL or a link/no-op TRB.\nDon't warn if there are no queued TDs at all.\n\nNow that it's safe, also handle xrun events if the skip flag is clear.\nThis ensures completion of any TD stuck in 'error mid TD' state right\nbefore the xrun event, which could happen if a driver submits a finite\nnumber of URBs to a buggy HC and then an error occurs on the last TD.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8eaa77cf-bde9-49c7-8ce5-df663898ae44",
      "id": "CVE-2025-38080",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Increase block_sequence array size\n\n[Why]\nIt's possible to generate more than 50 steps in hwss_build_fast_sequence,\nfor example with a 6-pipe asic where all pipes are in one MPC chain. This\noverflows the block_sequence buffer and corrupts block_sequence_steps,\ncausing a crash.\n\n[How]\nExpand block_sequence to 100 items. A naive upper bound on the possible\nnumber of steps for a 6-pipe asic, ignoring the potential for steps to be\nmutually exclusive, is 91 with current code, therefore 100 is sufficient.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c0fee2d-98a9-4d77-9684-209fe5313e76",
      "id": "CVE-2025-38136",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas_usbhs: Reorder clock handling and power management in probe\n\nReorder the initialization sequence in `usbhs_probe()` to enable runtime\nPM before accessing registers, preventing potential crashes due to\nuninitialized clocks.\n\nCurrently, in the probe path, registers are accessed before enabling the\nclocks, leading to a synchronous external abort on the RZ/V2H SoC.\nThe problematic call flow is as follows:\n\n    usbhs_probe()\n        usbhs_sys_clock_ctrl()\n            usbhs_bset()\n                usbhs_write()\n                    iowrite16()  \u003c-- Register access before enabling clocks\n\nSince `iowrite16()` is performed without ensuring the required clocks are\nenabled, this can lead to access errors. To fix this, enable PM runtime\nearly in the probe function and ensure clocks are acquired before register\naccess, preventing crashes like the following on RZ/V2H:\n\n[13.272640] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP\n[13.280814] Modules linked in: cec renesas_usbhs(+) drm_kms_helper fuse drm backlight ipv6\n[13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not tainted 6.14.0-rc7+ #98\n[13.296640] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT)\n[13.303834] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[13.310770] pc : usbhs_bset+0x14/0x4c [renesas_usbhs]\n[13.315831] lr : usbhs_probe+0x2e4/0x5ac [renesas_usbhs]\n[13.321138] sp : ffff8000827e3850\n[13.324438] x29: ffff8000827e3860 x28: 0000000000000000 x27: ffff8000827e3ca0\n[13.331554] x26: ffff8000827e3ba0 x25: ffff800081729668 x24: 0000000000000025\n[13.338670] x23: ffff0000c0f08000 x22: 0000000000000000 x21: ffff0000c0f08010\n[13.345783] x20: 0000000000000000 x19: ffff0000c3b52080 x18: 00000000ffffffff\n[13.352895] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000827e36ce\n[13.360009] x14: 00000000000003d7 x13: 00000000000003d7 x12: 0000000000000000\n[13.367122] x11: 0000000000000000 x10: 0000000000000aa0 x9 : ffff8000827e3750\n[13.374235] x8 : ffff0000c1850b00 x7 : 0000000003826060 x6 : 000000000000001c\n[13.381347] x5 : 000000030d5fcc00 x4 : ffff8000825c0000 x3 : 0000000000000000\n[13.388459] x2 : 0000000000000400 x1 : 0000000000000000 x0 : ffff0000c3b52080\n[13.395574] Call trace:\n[13.398013]  usbhs_bset+0x14/0x4c [renesas_usbhs] (P)\n[13.403076]  platform_probe+0x68/0xdc\n[13.406738]  really_probe+0xbc/0x2c0\n[13.410306]  __driver_probe_device+0x78/0x120\n[13.414653]  driver_probe_device+0x3c/0x154\n[13.418825]  __driver_attach+0x90/0x1a0\n[13.422647]  bus_for_each_dev+0x7c/0xe0\n[13.426470]  driver_attach+0x24/0x30\n[13.430032]  bus_add_driver+0xe4/0x208\n[13.433766]  driver_register+0x68/0x130\n[13.437587]  __platform_driver_register+0x24/0x30\n[13.442273]  renesas_usbhs_driver_init+0x20/0x1000 [renesas_usbhs]\n[13.448450]  do_one_initcall+0x60/0x1d4\n[13.452276]  do_init_module+0x54/0x1f8\n[13.456014]  load_module+0x1754/0x1c98\n[13.459750]  init_module_from_file+0x88/0xcc\n[13.464004]  __arm64_sys_finit_module+0x1c4/0x328\n[13.468689]  invoke_syscall+0x48/0x104\n[13.472426]  el0_svc_common.constprop.0+0xc0/0xe0\n[13.477113]  do_el0_svc+0x1c/0x28\n[13.480415]  el0_svc+0x30/0xcc\n[13.483460]  el0t_64_sync_handler+0x10c/0x138\n[13.487800]  el0t_64_sync+0x198/0x19c\n[13.491453] Code: 2a0103e1 12003c42 12003c63 8b010084 (79400084)\n[13.497522] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bd45edc-e525-427b-be0e-6d7edae66415",
      "id": "CVE-2025-38257",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Prevent overflow in size calculation for memdup_user()\n\nNumber of apqn target list entries contained in 'nr_apqns' variable is\ndetermined by userspace via an ioctl call so the result of the product in\ncalculation of size passed to memdup_user() may overflow.\n\nIn this case the actual size of the allocated area and the value\ndescribing it won't be in sync leading to various types of unpredictable\nbehaviour later.\n\nUse a proper memdup_array_user() helper which returns an error if an\noverflow is detected. Note that it is different from when nr_apqns is\ninitially zero - that case is considered valid and should be handled in\nsubsequent pkey_handler implementations.\n\nFound by Linux Verification Center (linuxtesting.org).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f309935-7cd9-40e9-bcd7-424c262a8b1e",
      "id": "CVE-2025-38618",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Do not allow binding to VMADDR_PORT_ANY\n\nIt is possible for a vsock to autobind to VMADDR_PORT_ANY. This can\ncause a use-after-free when a connection is made to the bound socket.\nThe socket returned by accept() also has port VMADDR_PORT_ANY but is not\non the list of unbound sockets. Binding it will result in an extra\nrefcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep\nthe binding until socket destruction).\n\nModify the check in __vsock_bind_connectible() to also prevent binding\nto VMADDR_PORT_ANY.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "059f0ed0-a9b7-41fd-a4fc-50842c486c83",
      "id": "CVE-2025-38704",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix possible invalid rdp's-\u003enocb_cb_kthread pointer access\n\nIn the preparation stage of CPU online, if the corresponding\nthe rdp's-\u003enocb_cb_kthread does not exist, will be created,\nthere is a situation where the rdp's rcuop kthreads creation fails,\nand then de-offload this CPU's rdp, does not assign this CPU's\nrdp-\u003enocb_cb_kthread pointer, but this rdp's-\u003enocb_gp_rdp and\nrdp's-\u003erdp_gp-\u003enocb_gp_kthread is still valid.\n\nThis will cause the subsequent re-offload operation of this offline\nCPU, which will pass the conditional check and the kthread_unpark()\nwill access invalid rdp's-\u003enocb_cb_kthread pointer.\n\nThis commit therefore use rdp's-\u003enocb_gp_kthread instead of\nrdp_gp's-\u003enocb_gp_kthread for safety check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f88b0263-b83e-4476-a353-c8a5762fa9dc",
      "id": "CVE-2025-39905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phylink: add lock for serializing concurrent pl-\u003ephydev writes with resolver\n\nCurrently phylink_resolve() protects itself against concurrent\nphylink_bringup_phy() or phylink_disconnect_phy() calls which modify\npl-\u003ephydev by relying on pl-\u003estate_mutex.\n\nThe problem is that in phylink_resolve(), pl-\u003estate_mutex is in a lock\ninversion state with pl-\u003ephydev-\u003elock. So pl-\u003ephydev-\u003elock needs to be\nacquired prior to pl-\u003estate_mutex. But that requires dereferencing\npl-\u003ephydev in the first place, and without pl-\u003estate_mutex, that is\nracy.\n\nHence the reason for the extra lock. Currently it is redundant, but it\nwill serve a functional purpose once mutex_lock(\u0026phy-\u003elock) will be\nmoved outside of the mutex_lock(\u0026pl-\u003estate_mutex) section.\n\nAnother alternative considered would have been to let phylink_resolve()\nacquire the rtnl_mutex, which is also held when phylink_bringup_phy()\nand phylink_disconnect_phy() are called. But since phylink_disconnect_phy()\nruns under rtnl_lock(), it would deadlock with phylink_resolve() when\ncalling flush_work(\u0026pl-\u003eresolve). Additionally, it would have been\nundesirable because it would have unnecessarily blocked many other call\npaths as well in the entire kernel, so the smaller-scoped lock was\npreferred.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b541592d-8bc8-45c1-b5f8-081076d08a15",
      "id": "CVE-2020-11494",
      "description": "An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL, aka CID-b9258a2cece4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a36841a3-20f7-4ee3-9787-9d17b55a0f24",
      "id": "CVE-2020-27171",
      "description": "An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f531ac92-019c-4f9b-a842-7122626d5901",
      "id": "CVE-2021-3483",
      "description": "A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1d2b2355-f069-4aa5-bc40-080a3469f88a",
      "id": "CVE-2021-3501",
      "description": "A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "383c6c50-75f2-4002-a6fa-cd04b793a245",
      "id": "CVE-2021-37576",
      "description": "arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "869527c5-c5bd-4168-b2de-fb2484d318c4",
      "id": "CVE-2021-46921",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/qrwlock: Fix ordering in queued_write_lock_slowpath()\n\nWhile this code is executed with the wait_lock held, a reader can\nacquire the lock without holding wait_lock.  The writer side loops\nchecking the value with the atomic_cond_read_acquire(), but only truly\nacquires the lock when the compare-and-exchange is completed\nsuccessfully which isn’t ordered. This exposes the window between the\nacquire and the cmpxchg to an A-B-A problem which allows reads\nfollowing the lock acquisition to observe values speculatively before\nthe write lock is truly acquired.\n\nWe've seen a problem in epoll where the reader does a xchg while\nholding the read lock, but the writer can see a value change out from\nunder it.\n\n  Writer                                | Reader\n  --------------------------------------------------------------------------------\n  ep_scan_ready_list()                  |\n  |- write_lock_irq()                   |\n      |- queued_write_lock_slowpath()   |\n\t|- atomic_cond_read_acquire()   |\n\t\t\t\t        | read_lock_irqsave(\u0026ep-\u003elock, flags);\n     --\u003e (observes value before unlock) |  chain_epi_lockless()\n     |                                  |    epi-\u003enext = xchg(\u0026ep-\u003eovflist, epi);\n     |                                  | read_unlock_irqrestore(\u0026ep-\u003elock, flags);\n     |                                  |\n     |     atomic_cmpxchg_relaxed()     |\n     |-- READ_ONCE(ep-\u003eovflist);        |\n\nA core can order the read of the ovflist ahead of the\natomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire\nsemantics addresses this issue at which point the atomic_cond_read can\nbe switched to use relaxed semantics.\n\n[peterz: use try_cmpxchg()]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a28a8672-ef7d-4c5a-982b-63663e6927a2",
      "id": "CVE-2021-46999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: do asoc update earlier in sctp_sf_do_dupcook_a\n\nThere's a panic that occurs in a few of envs, the call trace is as below:\n\n  [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI\n  [] RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0x1fa [sctp]\n  []  sctp_assoc_control_transport+0x1b9/0x210 [sctp]\n  []  sctp_do_8_2_transport_strike.isra.16+0x15c/0x220 [sctp]\n  []  sctp_cmd_interpreter.isra.21+0x1231/0x1a10 [sctp]\n  []  sctp_do_sm+0xc3/0x2a0 [sctp]\n  []  sctp_generate_timeout_event+0x81/0xf0 [sctp]\n\nThis is caused by a transport use-after-free issue. When processing a\nduplicate COOKIE-ECHO chunk in sctp_sf_do_dupcook_a(), both COOKIE-ACK\nand SHUTDOWN chunks are allocated with the transort from the new asoc.\nHowever, later in the sideeffect machine, the old asoc is used to send\nthem out and old asoc's shutdown_last_sent_to is set to the transport\nthat SHUTDOWN chunk attached to in sctp_cmd_setup_t2(), which actually\nbelongs to the new asoc. After the new_asoc is freed and the old asoc\nT2 timeout, the old asoc's shutdown_last_sent_to that is already freed\nwould be accessed in sctp_sf_t2_timer_expire().\n\nThanks Alexander and Jere for helping dig into this issue.\n\nTo fix it, this patch is to do the asoc update first, then allocate\nthe COOKIE-ACK and SHUTDOWN chunks with the 'updated' old asoc. This\nwould make more sense, as a chunk from an asoc shouldn't be sent out\nwith another asoc. We had fixed quite a few issues caused by this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42765ec1-d0eb-4b63-99bb-1d6d84a10f66",
      "id": "CVE-2021-47013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send\n\nIn emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).\nIf some error happens in emac_tx_fill_tpd(), the skb will be freed via\ndev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().\nBut the freed skb is still used via skb-\u003elen by netdev_sent_queue(,skb-\u003elen).\n\nAs i observed that emac_tx_fill_tpd() haven't modified the value of skb-\u003elen,\nthus my patch assigns skb-\u003elen to 'len' before the possible free and\nuse 'len' instead of skb-\u003elen later.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84899e1a-5289-4cba-94d8-2ae3f91bca0a",
      "id": "CVE-2021-47024",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: free queued packets when closing socket\n\nAs reported by syzbot [1], there is a memory leak while closing the\nsocket. We partially solved this issue with commit ac03046ece2b\n(\"vsock/virtio: free packets during the socket release\"), but we\nforgot to drain the RX queue when the socket is definitely closed by\nthe scheduled work.\n\nTo avoid future issues, let's use the new virtio_transport_remove_sock()\nto drain the RX queue before removing the socket from the af_vsock lists\ncalling vsock_remove_sock().\n\n[1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "608cff84-b0b3-4bcd-a29c-93668810577b",
      "id": "CVE-2021-47082",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: avoid double free in tun_free_netdev\n\nAvoid double free in tun_free_netdev() by moving the\ndev-\u003etstats and tun-\u003esecurity allocs to a new ndo_init routine\n(tun_net_init()) that will be called by register_netdevice().\nndo_init is paired with the desctructor (tun_free_netdev()),\nso if there's an error in register_netdevice() the destructor\nwill handle the frees.\n\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\n\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\nHardware name: Red Hat KVM, BIOS\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\n____kasan_slab_free mm/kasan/common.c:346 [inline]\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\nkasan_slab_free include/linux/kasan.h:235 [inline]\nslab_free_hook mm/slub.c:1723 [inline]\nslab_free_freelist_hook mm/slub.c:1749 [inline]\nslab_free mm/slub.c:3513 [inline]\nkfree+0xac/0x2d0 mm/slub.c:4561\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:874 [inline]\n__se_sys_ioctl fs/ioctl.c:860 [inline]\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ef192df-48e2-4fb4-a5da-c05b483edc55",
      "id": "CVE-2021-47109",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: allow NUD_NOARP entries to be forced GCed\n\nIFF_POINTOPOINT interfaces use NUD_NOARP entries for IPv6. It's possible to\nfill up the neighbour table with enough entries that it will overflow for\nvalid connections after that.\n\nThis behaviour is more prevalent after commit 58956317c8de (\"neighbor:\nImprove garbage collection\") is applied, as it prevents removal from\nentries that are not NUD_FAILED, unless they are more than 5s old.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "228004ed-591a-436a-8a0e-f0e367ec680d",
      "id": "CVE-2021-47206",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: ohci-tmio: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c0748e8c-2a0b-460c-8bde-387e1356a76e",
      "id": "CVE-2021-47237",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hamradio: fix memory leak in mkiss_close\n\nMy local syzbot instance hit memory leak in\nmkiss_open()[1]. The problem was in missing\nfree_netdev() in mkiss_close().\n\nIn mkiss_open() netdevice is allocated and then\nregistered, but in mkiss_close() netdevice was\nonly unregistered, but not freed.\n\nFail log:\n\nBUG: memory leak\nunreferenced object 0xffff8880281ba000 (size 4096):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00  ax0.............\n    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00  .'.*............\n  backtrace:\n    [\u003cffffffff81a27201\u003e] kvmalloc_node+0x61/0xf0\n    [\u003cffffffff8706e7e8\u003e] alloc_netdev_mqs+0x98/0xe80\n    [\u003cffffffff84e64192\u003e] mkiss_open+0xb2/0x6f0 [1]\n    [\u003cffffffff842355db\u003e] tty_ldisc_open+0x9b/0x110\n    [\u003cffffffff84236488\u003e] tty_set_ldisc+0x2e8/0x670\n    [\u003cffffffff8421f7f3\u003e] tty_ioctl+0xda3/0x1440\n    [\u003cffffffff81c9f273\u003e] __x64_sys_ioctl+0x193/0x200\n    [\u003cffffffff8911263a\u003e] do_syscall_64+0x3a/0xb0\n    [\u003cffffffff89200068\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff8880141a9a00 (size 96):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff  ...(.......(....\n    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00  .....@..........\n  backtrace:\n    [\u003cffffffff8709f68b\u003e] __hw_addr_create_ex+0x5b/0x310\n    [\u003cffffffff8709fb38\u003e] __hw_addr_add_ex+0x1f8/0x2b0\n    [\u003cffffffff870a0c7b\u003e] dev_addr_init+0x10b/0x1f0\n    [\u003cffffffff8706e88b\u003e] alloc_netdev_mqs+0x13b/0xe80\n    [\u003cffffffff84e64192\u003e] mkiss_open+0xb2/0x6f0 [1]\n    [\u003cffffffff842355db\u003e] tty_ldisc_open+0x9b/0x110\n    [\u003cffffffff84236488\u003e] tty_set_ldisc+0x2e8/0x670\n    [\u003cffffffff8421f7f3\u003e] tty_ioctl+0xda3/0x1440\n    [\u003cffffffff81c9f273\u003e] __x64_sys_ioctl+0x193/0x200\n    [\u003cffffffff8911263a\u003e] do_syscall_64+0x3a/0xb0\n    [\u003cffffffff89200068\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff8880219bfc00 (size 512):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff  ...(............\n    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff81a27201\u003e] kvmalloc_node+0x61/0xf0\n    [\u003cffffffff8706eec7\u003e] alloc_netdev_mqs+0x777/0xe80\n    [\u003cffffffff84e64192\u003e] mkiss_open+0xb2/0x6f0 [1]\n    [\u003cffffffff842355db\u003e] tty_ldisc_open+0x9b/0x110\n    [\u003cffffffff84236488\u003e] tty_set_ldisc+0x2e8/0x670\n    [\u003cffffffff8421f7f3\u003e] tty_ioctl+0xda3/0x1440\n    [\u003cffffffff81c9f273\u003e] __x64_sys_ioctl+0x193/0x200\n    [\u003cffffffff8911263a\u003e] do_syscall_64+0x3a/0xb0\n    [\u003cffffffff89200068\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff888029b2b200 (size 256):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff81a27201\u003e] kvmalloc_node+0x61/0xf0\n    [\u003cffffffff8706f062\u003e] alloc_netdev_mqs+0x912/0xe80\n    [\u003cffffffff84e64192\u003e] mkiss_open+0xb2/0x6f0 [1]\n    [\u003cffffffff842355db\u003e] tty_ldisc_open+0x9b/0x110\n    [\u003cffffffff84236488\u003e] tty_set_ldisc+0x2e8/0x670\n    [\u003cffffffff8421f7f3\u003e] tty_ioctl+0xda3/0x1440\n    [\u003cffffffff81c9f273\u003e] __x64_sys_ioctl+0x193/0x200\n    [\u003cffffffff8911263a\u003e] do_syscall_64+0x3a/0xb0\n    [\u003cffffffff89200068\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5b61dd1c-c01d-4efb-95b4-bcaabbb77915",
      "id": "CVE-2021-47258",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix error handling of scsi_host_alloc()\n\nAfter device is initialized via device_initialize(), or its name is set via\ndev_set_name(), the device has to be freed via put_device().  Otherwise\ndevice name will be leaked because it is allocated dynamically in\ndev_set_name().\n\nFix the leak by replacing kfree() with put_device(). Since\nscsi_host_dev_release() properly handles IDA and kthread removal, remove\nspecial-casing these from the error handling as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ebecd18-70a4-4e7c-9af5-d840eb94d3b0",
      "id": "CVE-2021-47404",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: betop: fix slab-out-of-bounds Write in betop_probe\n\nSyzbot reported slab-out-of-bounds Write bug in hid-betopff driver.\nThe problem is the driver assumes the device must have an input report but\nsome malicious devices violate this assumption.\n\nSo this patch checks hid_device's input is non empty before it's been used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d772c4c7-e415-4efe-92a0-fbbc0ca47688",
      "id": "CVE-2021-47409",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f180f64-6122-4ff4-ab2c-de3e9abda535",
      "id": "CVE-2021-47416",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: mdio: fix memory leak\n\nSyzbot reported memory leak in MDIO bus interface, the problem was in\nwrong state logic.\n\nMDIOBUS_ALLOCATED indicates 2 states:\n\t1. Bus is only allocated\n\t2. Bus allocated and __mdiobus_register() fails, but\n\t   device_register() was called\n\nIn case of device_register() has been called we should call put_device()\nto correctly free the memory allocated for this device, but mdiobus_free()\ncalls just kfree(dev) in case of MDIOBUS_ALLOCATED state\n\nTo avoid this behaviour we need to set bus-\u003estate to MDIOBUS_UNREGISTERED\n_before_ calling device_register(), because put_device() should be\ncalled even in case of device_register() failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "25679cd8-349a-4fa6-8d44-ecff5a2ba301",
      "id": "CVE-2021-47541",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()\n\nIn mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and\ntmp-\u003etx_cq will be freed on the error path of mlx4_en_copy_priv().\nAfter that mlx4_en_alloc_resources() is called and there is a dereference\nof \u0026tmp-\u003etx_cq[t][i] in mlx4_en_alloc_resources(), which could lead to\na use after free problem on failure of mlx4_en_copy_priv().\n\nFix this bug by adding a check of mlx4_en_copy_priv()\n\nThis bug was found by a static analyzer. The analysis employs\ndifferential checking to identify inconsistent security operations\n(e.g., checks or kfrees) between two code paths and confirms that the\ninconsistent operations are not recovered in the current function or\nthe callers, so they constitute bugs.\n\nNote that, as a bug found by static analysis, it can be a false\npositive or hard to trigger. Multiple researchers have cross-reviewed\nthe bug.\n\nBuilds with CONFIG_MLX4_EN=m show no new warnings,\nand our static analyzer no longer warns about this code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "007a5d31-3478-4799-b1be-503be3f47d8a",
      "id": "CVE-2022-45888",
      "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bde9764-9a79-4f8e-b7a9-e575fee2b6bb",
      "id": "CVE-2022-2380",
      "description": "The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e5ae832-7c71-4e5d-b6f6-9d2e315880e2",
      "id": "CVE-2022-49263",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbrcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path\n\nThis avoids leaking memory if brcmf_chip_get_raminfo fails. Note that\nthe CLM blob is released in the device remove path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7b24492-95ab-4db9-827e-195a9f0eb918",
      "id": "CVE-2022-2639",
      "description": "An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2de5bf76-5c66-4f14-a05d-d74e749855f5",
      "id": "CVE-2022-33744",
      "description": "Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "482bf852-6568-4c9b-b7c3-82a8a93cbaab",
      "id": "CVE-2022-36280",
      "description": "An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ee5527c-8bbb-4a5d-ae55-6f6dc9e237f7",
      "id": "CVE-2022-4139",
      "description": "An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c1ca3ae-7ae7-4e1b-878d-48f06c194dd7",
      "id": "CVE-2022-42328",
      "description": "Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "caa7acd1-5302-4b39-b507-53ccd055019b",
      "id": "CVE-2022-49271",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent bad output lengths in smb2_ioctl_query_info()\n\nWhen calling smb2_ioctl_query_info() with\nsmb_query_info::flags=PASSTHRU_FSCTL and\nsmb_query_info::output_buffer_length=0, the following would return\n0x10\n\n\tbuffer = memdup_user(arg + sizeof(struct smb_query_info),\n\t\t\t     qi.output_buffer_length);\n\tif (IS_ERR(buffer)) {\n\t\tkfree(vars);\n\t\treturn PTR_ERR(buffer);\n\t}\n\nrather than a valid pointer thus making IS_ERR() check fail.  This\nwould then cause a NULL ptr deference in @buffer when accessing it\nlater in smb2_ioctl_query_ioctl().  While at it, prevent having a\n@buffer smaller than 8 bytes to correctly handle SMB2_SET_INFO\nFileEndOfFileInformation requests when\nsmb_query_info::flags=PASSTHRU_SET_INFO.\n\nHere is a small C reproducer which triggers a NULL ptr in @buffer when\npassing an invalid smb_query_info::flags\n\n\t#include \u003cstdio.h\u003e\n\t#include \u003cstdlib.h\u003e\n\t#include \u003cstdint.h\u003e\n\t#include \u003cunistd.h\u003e\n\t#include \u003cfcntl.h\u003e\n\t#include \u003csys/ioctl.h\u003e\n\n\t#define die(s) perror(s), exit(1)\n\t#define QUERY_INFO 0xc018cf07\n\n\tint main(int argc, char *argv[])\n\t{\n\t\tint fd;\n\n\t\tif (argc \u003c 2)\n\t\t\texit(1);\n\t\tfd = open(argv[1], O_RDONLY);\n\t\tif (fd == -1)\n\t\t\tdie(\"open\");\n\t\tif (ioctl(fd, QUERY_INFO, (uint32_t[]) { 0, 0, 0, 4, 0, 0}) == -1)\n\t\t\tdie(\"ioctl\");\n\t\tclose(fd);\n\t\treturn 0;\n\t}\n\n\tmount.cifs //srv/share /mnt -o ...\n\tgcc repro.c \u0026\u0026 ./a.out /mnt/f0\n\n\t[  114.138620] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\n\t[  114.139310] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n\t[  114.139775] CPU: 2 PID: 995 Comm: a.out Not tainted 5.17.0-rc8 #1\n\t[  114.140148] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014\n\t[  114.140818] RIP: 0010:smb2_ioctl_query_info+0x206/0x410 [cifs]\n\t[  114.141221] Code: 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c8 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 28 4c 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 9c 01 00 00 49 8b 3f e8 58 02 fb ff 48 8b 14 24\n\t[  114.142348] RSP: 0018:ffffc90000b47b00 EFLAGS: 00010256\n\t[  114.142692] RAX: dffffc0000000000 RBX: ffff888115503200 RCX: ffffffffa020580d\n\t[  114.143119] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffa043a380\n\t[  114.143544] RBP: ffff888115503278 R08: 0000000000000001 R09: 0000000000000003\n\t[  114.143983] R10: fffffbfff4087470 R11: 0000000000000001 R12: ffff888115503288\n\t[  114.144424] R13: 00000000ffffffea R14: ffff888115503228 R15: 0000000000000000\n\t[  114.144852] FS:  00007f7aeabdf740(0000) GS:ffff888151600000(0000) knlGS:0000000000000000\n\t[  114.145338] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\t[  114.145692] CR2: 00007f7aeacfdf5e CR3: 000000012000e000 CR4: 0000000000350ee0\n\t[  114.146131] Call Trace:\n\t[  114.146291]  \u003cTASK\u003e\n\t[  114.146432]  ? smb2_query_reparse_tag+0x890/0x890 [cifs]\n\t[  114.146800]  ? cifs_mapchar+0x460/0x460 [cifs]\n\t[  114.147121]  ? rcu_read_lock_sched_held+0x3f/0x70\n\t[  114.147412]  ? cifs_strndup_to_utf16+0x15b/0x250 [cifs]\n\t[  114.147775]  ? dentry_path_raw+0xa6/0xf0\n\t[  114.148024]  ? cifs_convert_path_to_utf16+0x198/0x220 [cifs]\n\t[  114.148413]  ? smb2_check_message+0x1080/0x1080 [cifs]\n\t[  114.148766]  ? rcu_read_lock_sched_held+0x3f/0x70\n\t[  114.149065]  cifs_ioctl+0x1577/0x3320 [cifs]\n\t[  114.149371]  ? lock_downgrade+0x6f0/0x6f0\n\t[  114.149631]  ? cifs_readdir+0x2e60/0x2e60 [cifs]\n\t[  114.149956]  ? rcu_read_lock_sched_held+0x3f/0x70\n\t[  114.150250]  ? __rseq_handle_notify_resume+0x80b/0xbe0\n\t[  114.150562]  ? __up_read+0x192/0x710\n\t[  114.150791]  ? __ia32_sys_rseq+0xf0/0xf0\n\t[  114.151025]  ? __x64_sys_openat+0x11f/0x1d0\n\t[  114.151296]  __x64_sys_ioctl+0x127/0x190\n\t[  114.151549]  do_syscall_64+0x3b/0x90\n\t[  114.151768]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\t[  114.152079] RIP: 0033:0x7f7aead043df\n\t[  114.152306] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ece98a6f-b859-4651-9b64-52b3d17c358b",
      "id": "CVE-2022-42721",
      "description": "A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81c2302e-93ee-4221-9788-e529554d7105",
      "id": "CVE-2022-48732",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix off by one in BIOS boundary checking\n\nBounds checking when parsing init scripts embedded in the BIOS reject\naccess to the last byte. This causes driver initialization to fail on\nApple eMac's with GeForce 2 MX GPUs, leaving the system with no working\nconsole.\n\nThis is probably only seen on OpenFirmware machines like PowerPC Macs\nbecause the BIOS image provided by OF is only the used parts of the ROM,\nnot a power-of-two blocks read from PCI directly so PCs always have\nempty bytes at the end that are never accessed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8cafd284-8972-408a-bff2-1865daead5b7",
      "id": "CVE-2022-48747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix wrong offset in bio_truncate()\n\nbio_truncate() clears the buffer outside of last block of bdev, however\ncurrent bio_truncate() is using the wrong offset of page. So it can\nreturn the uninitialized data.\n\nThis happened when both of truncated/corrupted FS and userspace (via\nbdev) are trying to read the last of bdev.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72920570-3c0d-4f27-acd2-4c05ff8eff35",
      "id": "CVE-2022-48761",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci-plat: fix crash when suspend if remote wake enable\n\nCrashed at i.mx8qm platform when suspend if enable remote wakeup\n\nInternal error: synchronous external abort: 96000210 [#1] PREEMPT SMP\nModules linked in:\nCPU: 2 PID: 244 Comm: kworker/u12:6 Not tainted 5.15.5-dirty #12\nHardware name: Freescale i.MX8QM MEK (DT)\nWorkqueue: events_unbound async_run_entry_fn\npstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : xhci_disable_hub_port_wake.isra.62+0x60/0xf8\nlr : xhci_disable_hub_port_wake.isra.62+0x34/0xf8\nsp : ffff80001394bbf0\nx29: ffff80001394bbf0 x28: 0000000000000000 x27: ffff00081193b578\nx26: ffff00081193b570 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff00081193a29c x22: 0000000000020001 x21: 0000000000000001\nx20: 0000000000000000 x19: ffff800014e90490 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000000 x13: 0000000000000002 x12: 0000000000000000\nx11: 0000000000000000 x10: 0000000000000960 x9 : ffff80001394baa0\nx8 : ffff0008145d1780 x7 : ffff0008f95b8e80 x6 : 000000001853b453\nx5 : 0000000000000496 x4 : 0000000000000000 x3 : ffff00081193a29c\nx2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff000814591620\nCall trace:\n xhci_disable_hub_port_wake.isra.62+0x60/0xf8\n xhci_suspend+0x58/0x510\n xhci_plat_suspend+0x50/0x78\n platform_pm_suspend+0x2c/0x78\n dpm_run_callback.isra.25+0x50/0xe8\n __device_suspend+0x108/0x3c0\n\nThe basic flow:\n\t1. run time suspend call xhci_suspend, xhci parent devices gate the clock.\n        2. echo mem \u003e/sys/power/state, system _device_suspend call xhci_suspend\n        3. xhci_suspend call xhci_disable_hub_port_wake, which access register,\n\t   but clock already gated by run time suspend.\n\nThis problem was hidden by power domain driver, which call run time resume before it.\n\nBut the below commit remove it and make this issue happen.\n\tcommit c1df456d0f06e (\"PM: domains: Don't runtime resume devices at genpd_prepare()\")\n\nThis patch call run time resume before suspend to make sure clock is on\nbefore access register.\n\nTesteb-by: Abel Vesa \u003cabel.vesa@nxp.com\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56bf124e-18c5-4f2f-bfb0-19e7eb9c09e2",
      "id": "CVE-2022-48961",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdio: fix unbalanced fwnode reference count in mdio_device_release()\n\nThere is warning report about of_node refcount leak\nwhile probing mdio device:\n\nOF: ERROR: memory leak, expected refcount 1 instead of 2,\nof_node_get()/of_node_put() unbalanced - destroy cset entry:\nattach overlay node /spi/soc@0/mdio@710700c0/ethernet@4\n\nIn of_mdiobus_register_device(), we increase fwnode refcount\nby fwnode_handle_get() before associating the of_node with\nmdio device, but it has never been decreased in normal path.\nSince that, in mdio_device_release(), it needs to call\nfwnode_handle_put() in addition instead of calling kfree()\ndirectly.\n\nAfter above, just calling mdio_device_free() in the error handle\npath of of_mdiobus_register_device() is enough to keep the\nrefcount balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09a083b5-558c-4b49-aea9-58cb36b5a325",
      "id": "CVE-2022-49926",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: Fix possible memory leaks in dsa_loop_init()\n\nkmemleak reported memory leaks in dsa_loop_init():\n\nkmemleak: 12 new suspected memory leaks\n\nunreferenced object 0xffff8880138ce000 (size 2048):\n  comm \"modprobe\", pid 390, jiffies 4295040478 (age 238.976s)\n  backtrace:\n    [\u003c000000006a94f1d5\u003e] kmalloc_trace+0x26/0x60\n    [\u003c00000000a9c44622\u003e] phy_device_create+0x5d/0x970\n    [\u003c00000000d0ee2afc\u003e] get_phy_device+0xf3/0x2b0\n    [\u003c00000000dca0c71f\u003e] __fixed_phy_register.part.0+0x92/0x4e0\n    [\u003c000000008a834798\u003e] fixed_phy_register+0x84/0xb0\n    [\u003c0000000055223fcb\u003e] dsa_loop_init+0xa9/0x116 [dsa_loop]\n    ...\n\nThere are two reasons for memleak in dsa_loop_init().\n\nFirst, fixed_phy_register() create and register phy_device:\n\nfixed_phy_register()\n  get_phy_device()\n    phy_device_create() # freed by phy_device_free()\n  phy_device_register() # freed by phy_device_remove()\n\nBut fixed_phy_unregister() only calls phy_device_remove().\nSo the memory allocated in phy_device_create() is leaked.\n\nSecond, when mdio_driver_register() fail in dsa_loop_init(),\nit just returns and there is no cleanup for phydevs.\n\nFix the problems by catching the error of mdio_driver_register()\nin dsa_loop_init(), then calling both fixed_phy_unregister() and\nphy_device_free() to release phydevs.\nAlso add a function for phydevs cleanup to avoid duplacate.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83bf0646-01b6-4d0e-a706-3c281af4bd5d",
      "id": "CVE-2022-49103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()\n\n[You don't often get email from xiongx18@fudan.edu.cn. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.]\n\nThe reference counting issue happens in two error paths in the\nfunction _nfs42_proc_copy_notify(). In both error paths, the function\nsimply returns the error code and forgets to balance the refcount of\nobject `ctx`, bumped by get_nfs_open_context() earlier, which may\ncause refcount leaks.\n\nFix it by balancing refcount of the `ctx` object before the function\nreturns in both error paths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6565604-6be9-4781-b207-fecc5a7b6328",
      "id": "CVE-2022-49575",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.\n\nWhile reading sysctl_tcp_thin_linear_timeouts, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "716fa0fe-861d-48df-8a9f-fd953b203390",
      "id": "CVE-2022-49110",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: revisit gc autotuning\n\nas of commit 4608fdfc07e1\n(\"netfilter: conntrack: collect all entries in one cycle\")\nconntrack gc was changed to run every 2 minutes.\n\nOn systems where conntrack hash table is set to large value, most evictions\nhappen from gc worker rather than the packet path due to hash table\ndistribution.\n\nThis causes netlink event overflows when events are collected.\n\nThis change collects average expiry of scanned entries and\nreschedules to the average remaining value, within 1 to 60 second interval.\n\nTo avoid event overflows, reschedule after each bucket and add a\nlimit for both run time and number of evictions per run.\n\nIf more entries have to be evicted, reschedule and restart 1 jiffy\ninto the future.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a949914e-da7d-43af-af4b-827e6dd9d6ef",
      "id": "CVE-2022-49185",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe\n\nThis node pointer is returned by of_parse_phandle() with refcount\nincremented in this function. Calling of_node_put() to avoid\nthe refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a683fdfa-293c-4a2e-968c-76b8fb90992b",
      "id": "CVE-2024-36949",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: sync all devices to wait all processes being evicted\n\nIf there are more than one device doing reset in parallel, the first\ndevice will call kfd_suspend_all_processes() to evict all processes\non all devices, this call takes time to finish. other device will\nstart reset and recover without waiting. if the process has not been\nevicted before doing recover, it will be restored, then caused page\nfault.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b53f25cc-edb3-49fc-beee-66b1ed4dda67",
      "id": "CVE-2022-49399",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: goldfish: Use tty_port_destroy() to destroy port\n\nIn goldfish_tty_probe(), the port initialized through tty_port_init()\nshould be destroyed in error paths.In goldfish_tty_remove(), qtty-\u003eport\nalso should be destroyed or else might leak resources.\n\nFix the above by calling tty_port_destroy().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "195f231d-669f-4ab6-949f-5448177d4223",
      "id": "CVE-2022-49442",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/base/node.c: fix compaction sysfs file leak\n\nCompaction sysfs file is created via compaction_register_node in\nregister_node.  But we forgot to remove it in unregister_node.  Thus\ncompaction sysfs file is leaked.  Using compaction_unregister_node to fix\nthis issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "129fecef-cc8c-48ec-b5d5-09da3de33d9d",
      "id": "CVE-2022-49517",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe\n\nThis node pointer is returned by of_parse_phandle() with\nrefcount incremented in this function.\nCalling of_node_put() to avoid the refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d11efa3-59b5-4cab-8992-d1b74a803055",
      "id": "CVE-2022-49670",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlinux/dim: Fix divide by 0 in RDMA DIM\n\nFix a divide 0 error in rdma_dim_stats_compare() when prev-\u003ecpe_ratio ==\n0.\n\nCallTrace:\n  Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020\n  task: ffff880194b78000 task.stack: ffffc90006714000\n  RIP: 0010:backport_rdma_dim+0x10e/0x240 [mlx_compat]\n  RSP: 0018:ffff880c10e83ec0 EFLAGS: 00010202\n  RAX: 0000000000002710 RBX: ffff88096cd7f780 RCX: 0000000000000064\n  RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001\n  RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: 000000001d7c6c09\n  R13: ffff88096cd7f780 R14: ffff880b174fe800 R15: 0000000000000000\n  FS:  0000000000000000(0000) GS:ffff880c10e80000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000a0965b00 CR3: 000000000200a003 CR4: 00000000007606e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n   \u003cIRQ\u003e\n   ib_poll_handler+0x43/0x80 [ib_core]\n   irq_poll_softirq+0xae/0x110\n   __do_softirq+0xd1/0x28c\n   irq_exit+0xde/0xf0\n   do_IRQ+0x54/0xe0\n   common_interrupt+0x8f/0x8f\n   \u003c/IRQ\u003e\n   ? cpuidle_enter_state+0xd9/0x2a0\n   ? cpuidle_enter_state+0xc7/0x2a0\n   ? do_idle+0x170/0x1d0\n   ? cpu_startup_entry+0x6f/0x80\n   ? start_secondary+0x1b9/0x210\n   ? secondary_startup_64+0xa5/0xb0\n  Code: 0f 87 e1 00 00 00 8b 4c 24 14 44 8b 43 14 89 c8 4d 63 c8 44 29 c0 99 31 d0 29 d0 31 d2 48 98 48 8d 04 80 48 8d 04 80 48 c1 e0 02 \u003c49\u003e f7 f1 48 83 f8 0a 0f 86 c1 00 00 00 44 39 c1 7f 10 48 89 df\n  RIP: backport_rdma_dim+0x10e/0x240 [mlx_compat] RSP: ffff880c10e83ec0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0ed3062-fa66-4305-b690-18b1de4a78ea",
      "id": "CVE-2022-49758",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nreset: uniphier-glue: Fix possible null-ptr-deref\n\nIt will cause null-ptr-deref when resource_size(res) invoked,\nif platform_get_resource() returns NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73b61e36-5ff4-42dd-9c08-2754174461bd",
      "id": "CVE-2022-49767",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/trans_fd: always use O_NONBLOCK read/write\n\nsyzbot is reporting hung task at p9_fd_close() [1], for p9_mux_poll_stop()\n from p9_conn_destroy() from p9_fd_close() is failing to interrupt already\nstarted kernel_read() from p9_fd_read() from p9_read_work() and/or\nkernel_write() from p9_fd_write() from p9_write_work() requests.\n\nSince p9_socket_open() sets O_NONBLOCK flag, p9_mux_poll_stop() does not\nneed to interrupt kernel_read()/kernel_write(). However, since p9_fd_open()\ndoes not set O_NONBLOCK flag, but pipe blocks unless signal is pending,\np9_mux_poll_stop() needs to interrupt kernel_read()/kernel_write() when\nthe file descriptor refers to a pipe. In other words, pipe file descriptor\nneeds to be handled as if socket file descriptor.\n\nWe somehow need to interrupt kernel_read()/kernel_write() on pipes.\n\nA minimal change, which this patch is doing, is to set O_NONBLOCK flag\n from p9_fd_open(), for O_NONBLOCK flag does not affect reading/writing\nof regular files. But this approach changes O_NONBLOCK flag on userspace-\nsupplied file descriptors (which might break userspace programs), and\nO_NONBLOCK flag could be changed by userspace. It would be possible to set\nO_NONBLOCK flag every time p9_fd_read()/p9_fd_write() is invoked, but still\nremains small race window for clearing O_NONBLOCK flag.\n\nIf we don't want to manipulate O_NONBLOCK flag, we might be able to\nsurround kernel_read()/kernel_write() with set_thread_flag(TIF_SIGPENDING)\nand recalc_sigpending(). Since p9_read_work()/p9_write_work() works are\nprocessed by kernel threads which process global system_wq workqueue,\nsignals could not be delivered from remote threads when p9_mux_poll_stop()\n from p9_conn_destroy() from p9_fd_close() is called. Therefore, calling\nset_thread_flag(TIF_SIGPENDING)/recalc_sigpending() every time would be\nneeded if we count on signals for making kernel_read()/kernel_write()\nnon-blocking.\n\n[Dominique: add comment at Christian's suggestion]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b712fbf-e905-48d9-a0cf-edc2c1a377c8",
      "id": "CVE-2022-49813",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: Fix error handling in ena_init()\n\nThe ena_init() won't destroy workqueue created by\ncreate_singlethread_workqueue() when pci_register_driver() failed.\nCall destroy_workqueue() when pci_register_driver() failed to prevent the\nresource leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1407ba07-6830-4f10-a417-f0d554631b0d",
      "id": "CVE-2022-50181",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-gpu: fix a missing check to avoid NULL dereference\n\n'cache_ent' could be set NULL inside virtio_gpu_cmd_get_capset()\nand it will lead to a NULL dereference by a lately use of it\n(i.e., ptr = cache_ent-\u003ecaps_cache). Fix it with a NULL check.\n\n\n[ kraxel: minor codestyle fixup ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "168091c3-9033-481c-8888-41326aa4684e",
      "id": "CVE-2022-50224",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Treat NX as a valid SPTE bit for NPT\n\nTreat the NX bit as valid when using NPT, as KVM will set the NX bit when\nthe NX huge page mitigation is enabled (mindblowing) and trigger the WARN\nthat fires on reserved SPTE bits being set.\n\nKVM has required NX support for SVM since commit b26a71a1a5b9 (\"KVM: SVM:\nRefuse to load kvm_amd if NX support is not available\") for exactly this\nreason, but apparently it never occurred to anyone to actually test NPT\nwith the mitigation enabled.\n\n  ------------[ cut here ]------------\n  spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000\n  WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm]\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022\n  RIP: 0010:make_spte+0x327/0x340 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm]\n   kvm_tdp_mmu_map+0x343/0x3b0 [kvm]\n   direct_page_fault+0x1ae/0x2a0 [kvm]\n   kvm_tdp_page_fault+0x7d/0x90 [kvm]\n   kvm_mmu_page_fault+0xfb/0x2e0 [kvm]\n   npf_interception+0x55/0x90 [kvm_amd]\n   svm_invoke_exit_handler+0x31/0xf0 [kvm_amd]\n   svm_handle_exit+0xf6/0x1d0 [kvm_amd]\n   vcpu_enter_guest+0xb6d/0xee0 [kvm]\n   ? kvm_pmu_trigger_event+0x6d/0x230 [kvm]\n   vcpu_run+0x65/0x2c0 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm]\n   kvm_vcpu_ioctl+0x551/0x610 [kvm]\n   __se_sys_ioctl+0x77/0xc0\n   __x64_sys_ioctl+0x1d/0x20\n   do_syscall_64+0x44/0xa0\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72dd4036-9082-4b1c-b67b-d40107341786",
      "id": "CVE-2022-50267",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: rtsx_pci: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and calling mmc_free_host() in the\nerror path, beside, runtime PM also needs be disabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d4ea79e-e859-4147-8b5d-2c80843938cc",
      "id": "CVE-2022-50272",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\n\nWei Chen reports a kernel bug as blew:\n\ngeneral protection fault, probably for non-canonical address\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n...\nCall Trace:\n\u003cTASK\u003e\n__i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109\ni2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170\ni2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297\ni2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:870 [inline]\n__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fd834a8bded\n\nIn az6027_i2c_xfer(), if msg[i].addr is 0x99,\na null-ptr-deref will caused when accessing msg[i].buf.\nFor msg[i].len is 0 and msg[i].buf is null.\n\nFix this by checking msg[i].len in az6027_i2c_xfer().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "505fda1b-c84c-4c5c-8c80-127d9fda711b",
      "id": "CVE-2022-50346",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: init quota for 'old.inode' in 'ext4_rename'\n\nSyzbot found the following issue:\next4_parse_param: s_want_extra_isize=128\next4_inode_info_init: s_want_extra_isize=32\next4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828\n__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128\n__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128\next4_xattr_block_set: inode=ffff88823869a2c8\n------------[ cut here ]------------\nWARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980\nModules linked in:\nRIP: 0010:ext4_xattr_block_set.cold+0x22/0x980\nRSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000\nRDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178\nRBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e\nR10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000\nR13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000\nFS:  00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? ext4_xattr_set_entry+0x3b7/0x2320\n ? ext4_xattr_block_set+0x0/0x2020\n ? ext4_xattr_set_entry+0x0/0x2320\n ? ext4_xattr_check_entries+0x77/0x310\n ? ext4_xattr_ibody_set+0x23b/0x340\n ext4_xattr_move_to_block+0x594/0x720\n ext4_expand_extra_isize_ea+0x59a/0x10f0\n __ext4_expand_extra_isize+0x278/0x3f0\n __ext4_mark_inode_dirty.cold+0x347/0x410\n ext4_rename+0xed3/0x174f\n vfs_rename+0x13a7/0x2510\n do_renameat2+0x55d/0x920\n __x64_sys_rename+0x7d/0xb0\n do_syscall_64+0x3b/0xa0\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nAs 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,\nwhich may trigger expand 'extra_isize' and allocate block. If inode\ndidn't init quota will lead to warning.  To solve above issue, init\n'old.inode' firstly in 'ext4_rename'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8379b1d6-3306-4876-aa46-9b8ad12533d0",
      "id": "CVE-2023-52458",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: add check that partition length needs to be aligned with block size\n\nBefore calling add partition or resize partition, there is no check\non whether the length is aligned with the logical block size.\nIf the logical block size of the disk is larger than 512 bytes,\nthen the partition size maybe not the multiple of the logical block size,\nand when the last sector is read, bio_truncate() will adjust the bio size,\nresulting in an IO error if the size of the read command is smaller than\nthe logical block size.If integrity data is supported, this will also\nresult in a null pointer dereference when calling bio_integrity_free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e24ba384-c7d9-4e39-b801-793c4ca73e28",
      "id": "CVE-2023-2019",
      "description": "A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0b4086f-6b71-4c85-a385-d91eeb09b6ba",
      "id": "CVE-2024-38582",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential hang in nilfs_detach_log_writer()\n\nSyzbot has reported a potential hang in nilfs_detach_log_writer() called\nduring nilfs2 unmount.\n\nAnalysis revealed that this is because nilfs_segctor_sync(), which\nsynchronizes with the log writer thread, can be called after\nnilfs_segctor_destroy() terminates that thread, as shown in the call trace\nbelow:\n\nnilfs_detach_log_writer\n  nilfs_segctor_destroy\n    nilfs_segctor_kill_thread  --\u003e Shut down log writer thread\n    flush_work\n      nilfs_iput_work_func\n        nilfs_dispose_list\n          iput\n            nilfs_evict_inode\n              nilfs_transaction_commit\n                nilfs_construct_segment (if inode needs sync)\n                  nilfs_segctor_sync  --\u003e Attempt to synchronize with\n                                          log writer thread\n                           *** DEADLOCK ***\n\nFix this issue by changing nilfs_segctor_sync() so that the log writer\nthread returns normally without synchronizing after it terminates, and by\nforcing tasks that are already waiting to complete once after the thread\nterminates.\n\nThe skipped inode metadata flushout will then be processed together in the\nsubsequent cleanup work in nilfs_segctor_destroy().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b38a6d0e-aaca-4a95-868d-55e335c5a64a",
      "id": "CVE-2023-23559",
      "description": "In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "950d8dc2-4e84-48d7-8f94-c13032514d36",
      "id": "CVE-2023-2860",
      "description": "An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a privileged local user to disclose sensitive information on affected installations of the Linux kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1569e4c4-4b26-478e-be32-3b808a2b8901",
      "id": "CVE-2023-3161",
      "description": "A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-\u003ewidth and font-\u003eheight greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2e5cc5e-25db-47aa-beda-a7349cc7d222",
      "id": "CVE-2023-35824",
      "description": "An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "053e118d-b843-4606-9318-6e22177d3057",
      "id": "CVE-2023-39193",
      "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4df25472-3f82-47ef-ba0b-24107dd2aa9d",
      "id": "CVE-2023-4622",
      "description": "A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.\n\nThe unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.\n\nWe recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee1ae678-f8d5-4b78-be38-42e1dbd77456",
      "id": "CVE-2023-52614",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Fix buffer overflow in trans_stat_show\n\nFix buffer overflow in trans_stat_show().\n\nConvert simple snprintf to the more secure scnprintf with size of\nPAGE_SIZE.\n\nAdd condition checking if we are exceeding PAGE_SIZE and exit early from\nloop. Also add at the end a warning that we exceeded PAGE_SIZE and that\nstats is disabled.\n\nReturn -EFBIG in the case where we don't have enough space to write the\nfull transition table.\n\nAlso document in the ABI that this function can return -EFBIG error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07d8dc52-1d88-48f2-8ee3-cbfc111e3b4e",
      "id": "CVE-2023-52633",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: time-travel: fix time corruption\n\nIn 'basic' time-travel mode (without =inf-cpu or =ext), we\nstill get timer interrupts. These can happen at arbitrary\npoints in time, i.e. while in timer_read(), which pushes\ntime forward just a little bit. Then, if we happen to get\nthe interrupt after calculating the new time to push to,\nbut before actually finishing that, the interrupt will set\nthe time to a value that's incompatible with the forward,\nand we'll crash because time goes backwards when we do the\nforwarding.\n\nFix this by reading the time_travel_time, calculating the\nadjustment, and doing the adjustment all with interrupts\ndisabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28e89a4e-7e32-4de7-a397-117c82917190",
      "id": "CVE-2023-52912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fixed bug on error when unloading amdgpu\n\nFixed bug on error when unloading amdgpu.\n\nThe error message is as follows:\n[  377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278!\n[  377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[  377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G          IOE      6.0.0-thomas #1\n[  377.706231] Hardware name: ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021\n[  377.706238] RIP: 0010:drm_buddy_free_block+0x26/0x30 [drm_buddy]\n[  377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff \u003c0f\u003e 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53\n[  377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287\n[  377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000\n[  377.706297] RDX: ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70\n[  377.706304] RBP: ffff8b1743bd59e0 R08: 0000000000000001 R09: 0000000000000001\n[  377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12: ffff8b16d1b25f70\n[  377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70\n[  377.706325] FS:  00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000\n[  377.706334] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0\n[  377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  377.706361] Call Trace:\n[  377.706365]  \u003cTASK\u003e\n[  377.706369]  drm_buddy_free_list+0x2a/0x60 [drm_buddy]\n[  377.706376]  amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu]\n[  377.706572]  amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu]\n[  377.706650]  amdgpu_bo_fini+0x22/0x90 [amdgpu]\n[  377.706727]  gmc_v11_0_sw_fini+0x26/0x30 [amdgpu]\n[  377.706821]  amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu]\n[  377.706897]  amdgpu_driver_release_kms+0x12/0x30 [amdgpu]\n[  377.706975]  drm_dev_release+0x20/0x40 [drm]\n[  377.707006]  release_nodes+0x35/0xb0\n[  377.707014]  devres_release_all+0x8b/0xc0\n[  377.707020]  device_unbind_cleanup+0xe/0x70\n[  377.707027]  device_release_driver_internal+0xee/0x160\n[  377.707033]  driver_detach+0x44/0x90\n[  377.707039]  bus_remove_driver+0x55/0xe0\n[  377.707045]  pci_unregister_driver+0x3b/0x90\n[  377.707052]  amdgpu_exit+0x11/0x6c [amdgpu]\n[  377.707194]  __x64_sys_delete_module+0x142/0x2b0\n[  377.707201]  ? fpregs_assert_state_consistent+0x22/0x50\n[  377.707208]  ? exit_to_user_mode_prepare+0x3e/0x190\n[  377.707215]  do_syscall_64+0x38/0x90\n[  377.707221]  entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "848601a8-3d73-4257-9388-7699f700897e",
      "id": "CVE-2023-53089",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix task hung in ext4_xattr_delete_inode\n\nSyzbot reported a hung task problem:\n==================================================================\nINFO: task syz-executor232:5073 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc2-syzkaller-00024-g512dee0c00ad #0\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:syz-exec232 state:D stack:21024 pid:5073 ppid:5072 flags:0x00004004\nCall Trace:\n \u003cTASK\u003e\n context_switch kernel/sched/core.c:5244 [inline]\n __schedule+0x995/0xe20 kernel/sched/core.c:6555\n schedule+0xcb/0x190 kernel/sched/core.c:6631\n __wait_on_freeing_inode fs/inode.c:2196 [inline]\n find_inode_fast+0x35a/0x4c0 fs/inode.c:950\n iget_locked+0xb1/0x830 fs/inode.c:1273\n __ext4_iget+0x22e/0x3ed0 fs/ext4/inode.c:4861\n ext4_xattr_inode_iget+0x68/0x4e0 fs/ext4/xattr.c:389\n ext4_xattr_inode_dec_ref_all+0x1a7/0xe50 fs/ext4/xattr.c:1148\n ext4_xattr_delete_inode+0xb04/0xcd0 fs/ext4/xattr.c:2880\n ext4_evict_inode+0xd7c/0x10b0 fs/ext4/inode.c:296\n evict+0x2a4/0x620 fs/inode.c:664\n ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474\n __ext4_fill_super fs/ext4/super.c:5516 [inline]\n ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644\n get_tree_bdev+0x400/0x620 fs/super.c:1282\n vfs_get_tree+0x88/0x270 fs/super.c:1489\n do_new_mount+0x289/0xad0 fs/namespace.c:3145\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fa5406fd5ea\nRSP: 002b:00007ffc7232f968 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa5406fd5ea\nRDX: 0000000020000440 RSI: 0000000020000000 RDI: 00007ffc7232f970\nRBP: 00007ffc7232f970 R08: 00007ffc7232f9b0 R09: 0000000000000432\nR10: 0000000000804a03 R11: 0000000000000202 R12: 0000000000000004\nR13: 0000555556a7a2c0 R14: 00007ffc7232f9b0 R15: 0000000000000000\n \u003c/TASK\u003e\n==================================================================\n\nThe problem is that the inode contains an xattr entry with ea_inum of 15\nwhen cleaning up an orphan inode \u003c15\u003e. When evict inode \u003c15\u003e, the reference\ncounting of the corresponding EA inode is decreased. When EA inode \u003c15\u003e is\nfound by find_inode_fast() in __ext4_iget(), it is found that the EA inode\nholds the I_FREEING flag and waits for the EA inode to complete deletion.\nAs a result, when inode \u003c15\u003e is being deleted, we wait for inode \u003c15\u003e to\ncomplete the deletion, resulting in an infinite loop and triggering Hung\nTask. To solve this problem, we only need to check whether the ino of EA\ninode and parent is the same before getting EA inode.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5c13f2e-7041-4d65-9d7c-cbe60ce9111a",
      "id": "CVE-2023-53165",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix uninitialized array access for some pathnames\n\nFor filenames that begin with . and are between 2 and 5 characters long,\nUDF charset conversion code would read uninitialized memory in the\noutput buffer. The only practical impact is that the name may be prepended a\n\"unification hash\" when it is not actually needed but still it is good\nto fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e191c8f-2e26-4920-9b5c-e7761283bccb",
      "id": "CVE-2023-53201",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: wraparound mbox producer index\n\nDriver is not handling the wraparound of the mbox producer index correctly.\nCurrently the wraparound happens once u32 max is reached.\n\nBit 31 of the producer index register is special and should be set\nonly once for the first command. Because the producer index overflow\nsetting bit31 after a long time, FW goes to initialization sequence\nand this causes FW hang.\n\nFix is to wraparound the mbox producer index once it reaches u16 max.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7583019a-58c8-4148-b474-4501be111db1",
      "id": "CVE-2023-53255",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()\n\nsvc_create_memory_pool() is only called from stratix10_svc_drv_probe().\nMost of resources in the probe are managed, but not this memremap() call.\n\nThere is also no memunmap() call in the file.\n\nSo switch to devm_memremap() to avoid a resource leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8c35e1f-5b44-4353-82a6-4380a2322609",
      "id": "CVE-2023-53297",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix \"bad unlock balance\" in l2cap_disconnect_rsp\n\nconn-\u003echan_lock isn't acquired before l2cap_get_chan_by_scid,\nif l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance'\nis triggered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27f15c81-9b81-4d5d-a674-da38e1acd828",
      "id": "CVE-2023-53298",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix memory leak of se_io context in nfc_genl_se_io\n\nThe callback context for sending/receiving APDUs to/from the selected\nsecure element is allocated inside nfc_genl_se_io and supposed to be\neventually freed in se_io_cb callback function. However, there are several\nerror paths where the bwi_timer is not charged to call se_io_cb later, and\nthe cb_context is leaked.\n\nThe patch proposes to free the cb_context explicitly on those error paths.\n\nAt the moment we can't simply check 'dev-\u003eops-\u003ese_io()' return value as it\nmay be negative in both cases: when the timer was charged and was not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "553babe5-44bd-4b84-9cba-54d73cbb7de4",
      "id": "CVE-2023-53317",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix WARNING in mb_find_extent\n\nSyzbot found the following issue:\n\nEXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!\nEXT4-fs (loop0): orphan cleanup on readonly fs\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 5067 at fs/ext4/mballoc.c:1869 mb_find_extent+0x8a1/0xe30\nModules linked in:\nCPU: 1 PID: 5067 Comm: syz-executor307 Not tainted 6.2.0-rc1-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nRIP: 0010:mb_find_extent+0x8a1/0xe30 fs/ext4/mballoc.c:1869\nRSP: 0018:ffffc90003c9e098 EFLAGS: 00010293\nRAX: ffffffff82405731 RBX: 0000000000000041 RCX: ffff8880783457c0\nRDX: 0000000000000000 RSI: 0000000000000041 RDI: 0000000000000040\nRBP: 0000000000000040 R08: ffffffff82405723 R09: ffffed10053c9402\nR10: ffffed10053c9402 R11: 1ffff110053c9401 R12: 0000000000000000\nR13: ffffc90003c9e538 R14: dffffc0000000000 R15: ffffc90003c9e2cc\nFS:  0000555556665300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000056312f6796f8 CR3: 0000000022437000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ext4_mb_complex_scan_group+0x353/0x1100 fs/ext4/mballoc.c:2307\n ext4_mb_regular_allocator+0x1533/0x3860 fs/ext4/mballoc.c:2735\n ext4_mb_new_blocks+0xddf/0x3db0 fs/ext4/mballoc.c:5605\n ext4_ext_map_blocks+0x1868/0x6880 fs/ext4/extents.c:4286\n ext4_map_blocks+0xa49/0x1cc0 fs/ext4/inode.c:651\n ext4_getblk+0x1b9/0x770 fs/ext4/inode.c:864\n ext4_bread+0x2a/0x170 fs/ext4/inode.c:920\n ext4_quota_write+0x225/0x570 fs/ext4/super.c:7105\n write_blk fs/quota/quota_tree.c:64 [inline]\n get_free_dqblk+0x34a/0x6d0 fs/quota/quota_tree.c:130\n do_insert_tree+0x26b/0x1aa0 fs/quota/quota_tree.c:340\n do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375\n do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375\n do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375\n dq_insert_tree fs/quota/quota_tree.c:401 [inline]\n qtree_write_dquot+0x3b6/0x530 fs/quota/quota_tree.c:420\n v2_write_dquot+0x11b/0x190 fs/quota/quota_v2.c:358\n dquot_acquire+0x348/0x670 fs/quota/dquot.c:444\n ext4_acquire_dquot+0x2dc/0x400 fs/ext4/super.c:6740\n dqget+0x999/0xdc0 fs/quota/dquot.c:914\n __dquot_initialize+0x3d0/0xcf0 fs/quota/dquot.c:1492\n ext4_process_orphan+0x57/0x2d0 fs/ext4/orphan.c:329\n ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474\n __ext4_fill_super fs/ext4/super.c:5516 [inline]\n ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644\n get_tree_bdev+0x400/0x620 fs/super.c:1282\n vfs_get_tree+0x88/0x270 fs/super.c:1489\n do_new_mount+0x289/0xad0 fs/namespace.c:3145\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAdd some debug information:\nmb_find_extent: mb_find_extent block=41, order=0 needed=64 next=0 ex=0/41/1@3735929054 64 64 7\nblock_bitmap: ff 3f 0c 00 fc 01 00 00 d2 3d 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAcctually, blocks per group is 64, but block bitmap indicate at least has\n128 blocks. Now, ext4_validate_block_bitmap() didn't check invalid block's\nbitmap if set.\nTo resolve above issue, add check like fsck \"Padding at end of block bitmap is\nnot set\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea7f89f1-0a53-470b-af9b-38de790bb5c0",
      "id": "CVE-2023-53337",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: do not write dirty data after degenerating to read-only\n\nAccording to syzbot's report, mark_buffer_dirty() called from\nnilfs_segctor_do_construct() outputs a warning with some patterns after\nnilfs2 detects metadata corruption and degrades to read-only mode.\n\nAfter such read-only degeneration, page cache data may be cleared through\nnilfs_clear_dirty_page() which may also clear the uptodate flag for their\nbuffer heads.  However, even after the degeneration, log writes are still\nperformed by unmount processing etc., which causes mark_buffer_dirty() to\nbe called for buffer heads without the \"uptodate\" flag and causes the\nwarning.\n\nSince any writes should not be done to a read-only file system in the\nfirst place, this fixes the warning in mark_buffer_dirty() by letting\nnilfs_segctor_do_construct() abort early if in read-only mode.\n\nThis also changes the retry check of nilfs_segctor_write_out() to avoid\nunnecessary log write retries if it detects -EROFS that\nnilfs_segctor_do_construct() returned.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "077247e9-414e-428c-a4c3-48108a121bc7",
      "id": "CVE-2023-53397",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodpost: fix off by one in is_executable_section()\n\nThe \u003e comparison should be \u003e= to prevent an out of bounds array\naccess.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96bf299c-2365-4776-a9a5-7866534d3807",
      "id": "CVE-2024-26644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't abort filesystem when attempting to snapshot deleted subvolume\n\nIf the source file descriptor to the snapshot ioctl refers to a deleted\nsubvolume, we get the following abort:\n\n  BTRFS: Transaction aborted (error -2)\n  WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs]\n  Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c\n  CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014\n  RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs]\n  RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282\n  RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027\n  RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840\n  RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998\n  R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe\n  R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80\n  FS:  00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0\n  Call Trace:\n   \u003cTASK\u003e\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   ? __warn+0x81/0x130\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   ? report_bug+0x171/0x1a0\n   ? handle_bug+0x3a/0x70\n   ? exc_invalid_op+0x17/0x70\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   create_pending_snapshots+0x92/0xc0 [btrfs]\n   btrfs_commit_transaction+0x66b/0xf40 [btrfs]\n   btrfs_mksubvol+0x301/0x4d0 [btrfs]\n   btrfs_mksnapshot+0x80/0xb0 [btrfs]\n   __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs]\n   btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs]\n   btrfs_ioctl+0x8a6/0x2650 [btrfs]\n   ? kmem_cache_free+0x22/0x340\n   ? do_sys_openat2+0x97/0xe0\n   __x64_sys_ioctl+0x97/0xd0\n   do_syscall_64+0x46/0xf0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n  RIP: 0033:0x7fe20abe83af\n  RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af\n  RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003\n  RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0\n  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n  R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n  BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry\n  BTRFS info (device vdc: state EA): forced readonly\n  BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction.\n  BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry\n\nThis happens because create_pending_snapshot() initializes the new root\nitem as a copy of the source root item. This includes the refs field,\nwhich is 0 for a deleted subvolume. The call to btrfs_insert_root()\ntherefore inserts a root with refs == 0. btrfs_get_new_fs_root() then\nfinds the root and returns -ENOENT if refs == 0, which causes\ncreate_pending_snapshot() to abort.\n\nFix it by checking the source root's refs before attempting the\nsnapshot, but after locking subvol_sem to avoid racing with deletion.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4bbd9939-d93a-4b76-82b0-5ee3b699fc20",
      "id": "CVE-2024-26700",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix MST Null Ptr for RV\n\nThe change try to fix below error specific to RV platform:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2\nHardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022\nRIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\nCode: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 \u003c48\u003e 8\u003e\nRSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\nRDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\nRBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\nR10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\nR13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\nFS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? plist_add+0xbe/0x100\n ? exc_page_fault+0x7c/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n drm_atomic_check_only+0x5c5/0xa40\n drm_mode_atomic_ioctl+0x76e/0xbc0\n ? _copy_to_user+0x25/0x30\n ? drm_ioctl+0x296/0x4b0\n ? __pfx_drm_mode_atomic_ioctl+0x10/0x10\n drm_ioctl_kernel+0xcd/0x170\n drm_ioctl+0x26d/0x4b0\n ? __pfx_drm_mode_atomic_ioctl+0x10/0x10\n amdgpu_drm_ioctl+0x4e/0x90 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n __x64_sys_ioctl+0x94/0xd0\n do_syscall_64+0x60/0x90\n ? do_syscall_64+0x6c/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7f4dad17f76f\nCode: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 \u003c89\u003e c\u003e\nRSP: 002b:00007ffd9ae859f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 000055e255a55900 RCX: 00007f4dad17f76f\nRDX: 00007ffd9ae85a90 RSI: 00000000c03864bc RDI: 000000000000000b\nRBP: 00007ffd9ae85a90 R08: 0000000000000003 R09: 0000000000000003\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000c03864bc\nR13: 000000000000000b R14: 000055e255a7fc60 R15: 000055e255a01eb0\n \u003c/TASK\u003e\nModules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device ccm cmac algif_hash algif_skcipher af_alg joydev mousedev bnep \u003e\n typec libphy k10temp ipmi_msghandler roles i2c_scmi acpi_cpufreq mac_hid nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_mas\u003e\nCR2: 0000000000000008\n---[ end trace 0000000000000000 ]---\nRIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\nCode: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 \u003c48\u003e 8\u003e\nRSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\nRDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\nRBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\nR10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\nR13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\nFS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d3c4e9f-930e-43f2-a26a-075f3f1c7fa8",
      "id": "CVE-2024-26715",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend\n\nIn current scenario if Plug-out and Plug-In performed continuously\nthere could be a chance while checking for dwc-\u003egadget_driver in\ndwc3_gadget_suspend, a NULL pointer dereference may occur.\n\nCall Stack:\n\n\tCPU1:                           CPU2:\n\tgadget_unbind_driver            dwc3_suspend_common\n\tdwc3_gadget_stop                dwc3_gadget_suspend\n                                        dwc3_disconnect_gadget\n\nCPU1 basically clears the variable and CPU2 checks the variable.\nConsider CPU1 is running and right before gadget_driver is cleared\nand in parallel CPU2 executes dwc3_gadget_suspend where it finds\ndwc-\u003egadget_driver which is not NULL and resumes execution and then\nCPU1 completes execution. CPU2 executes dwc3_disconnect_gadget where\nit checks dwc-\u003egadget_driver is already NULL because of which the\nNULL pointer deference occur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "208d8c0d-642e-4060-ad64-119c2628b884",
      "id": "CVE-2024-26739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don't override retval if we already lost the skb\n\nIf we're redirecting the skb, and haven't called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dffc018b-08ae-41bf-84ba-d4f83e355d47",
      "id": "CVE-2024-26740",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: use the backlog for mirred ingress\n\nThe test Davide added in commit ca22da2fbd69 (\"act_mirred: use the backlog\nfor nested calls to mirred ingress\") hangs our testing VMs every 10 or so\nruns, with the familiar tcp_v4_rcv -\u003e tcp_v4_rcv deadlock reported by\nlockdep.\n\nThe problem as previously described by Davide (see Link) is that\nif we reverse flow of traffic with the redirect (egress -\u003e ingress)\nwe may reach the same socket which generated the packet. And we may\nstill be holding its socket lock. The common solution to such deadlocks\nis to put the packet in the Rx backlog, rather than run the Rx path\ninline. Do that for all egress -\u003e ingress reversals, not just once\nwe started to nest mirred calls.\n\nIn the past there was a concern that the backlog indirection will\nlead to loss of error reporting / less accurate stats. But the current\nworkaround does not seem to address the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e828d6c8-15a0-4515-84cf-91b5cada91b3",
      "id": "CVE-2024-26788",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fsl-qdma: init irq after reg initialization\n\nInitialize the qDMA irqs after the registers are configured so that\ninterrupts that may have been pending from a primary kernel don't get\nprocessed by the irq handler before it is ready to and cause panic with\nthe following trace:\n\n  Call trace:\n   fsl_qdma_queue_handler+0xf8/0x3e8\n   __handle_irq_event_percpu+0x78/0x2b0\n   handle_irq_event_percpu+0x1c/0x68\n   handle_irq_event+0x44/0x78\n   handle_fasteoi_irq+0xc8/0x178\n   generic_handle_irq+0x24/0x38\n   __handle_domain_irq+0x90/0x100\n   gic_handle_irq+0x5c/0xb8\n   el1_irq+0xb8/0x180\n   _raw_spin_unlock_irqrestore+0x14/0x40\n   __setup_irq+0x4bc/0x798\n   request_threaded_irq+0xd8/0x190\n   devm_request_threaded_irq+0x74/0xe8\n   fsl_qdma_probe+0x4d4/0xca8\n   platform_drv_probe+0x50/0xa0\n   really_probe+0xe0/0x3f8\n   driver_probe_device+0x64/0x130\n   device_driver_attach+0x6c/0x78\n   __driver_attach+0xbc/0x158\n   bus_for_each_dev+0x5c/0x98\n   driver_attach+0x20/0x28\n   bus_add_driver+0x158/0x220\n   driver_register+0x60/0x110\n   __platform_driver_register+0x44/0x50\n   fsl_qdma_driver_init+0x18/0x20\n   do_one_initcall+0x48/0x258\n   kernel_init_freeable+0x1a4/0x23c\n   kernel_init+0x10/0xf8\n   ret_from_fork+0x10/0x18",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b138a27-8190-4b4e-b944-9ac3bdc0d375",
      "id": "CVE-2024-26825",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: free rx_data_reassembly skb on NCI device cleanup\n\nrx_data_reassembly skb is stored during NCI data exchange for processing\nfragmented packets. It is dropped only when the last fragment is processed\nor when an NTF packet with NCI_OP_RF_DEACTIVATE_NTF opcode is received.\nHowever, the NCI device may be deallocated before that which leads to skb\nleak.\n\nAs by design the rx_data_reassembly skb is bound to the NCI device and\nnothing prevents the device to be freed before the skb is processed in\nsome way and cleaned, free it on the NCI device cleanup.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3246455c-21f1-4060-bd88-ea0e33c7aafc",
      "id": "CVE-2024-26842",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix shift issue in ufshcd_clear_cmd()\n\nWhen task_tag \u003e= 32 (in MCQ mode) and sizeof(unsigned int) == 4, 1U \u003c\u003c\ntask_tag will out of bounds for a u32 mask. Fix this up to prevent\nSHIFT_ISSUE (bitwise shifts that are out of bounds for their data type).\n\n[name:debug_monitors\u0026]Unexpected kernel BRK exception at EL1\n[name:traps\u0026]Internal error: BRK handler: 00000000f2005514 [#1] PREEMPT SMP\n[name:mediatek_cpufreq_hw\u0026]cpufreq stop DVFS log done\n[name:mrdump\u0026]Kernel Offset: 0x1ba5800000 from 0xffffffc008000000\n[name:mrdump\u0026]PHYS_OFFSET: 0x80000000\n[name:mrdump\u0026]pstate: 22400005 (nzCv daif +PAN -UAO)\n[name:mrdump\u0026]pc : [0xffffffdbaf52bb2c] ufshcd_clear_cmd+0x280/0x288\n[name:mrdump\u0026]lr : [0xffffffdbaf52a774] ufshcd_wait_for_dev_cmd+0x3e4/0x82c\n[name:mrdump\u0026]sp : ffffffc0081471b0\n\u003csnip\u003e\nWorkqueue: ufs_eh_wq_0 ufshcd_err_handler\nCall trace:\n dump_backtrace+0xf8/0x144\n show_stack+0x18/0x24\n dump_stack_lvl+0x78/0x9c\n dump_stack+0x18/0x44\n mrdump_common_die+0x254/0x480 [mrdump]\n ipanic_die+0x20/0x30 [mrdump]\n notify_die+0x15c/0x204\n die+0x10c/0x5f8\n arm64_notify_die+0x74/0x13c\n do_debug_exception+0x164/0x26c\n el1_dbg+0x64/0x80\n el1h_64_sync_handler+0x3c/0x90\n el1h_64_sync+0x68/0x6c\n ufshcd_clear_cmd+0x280/0x288\n ufshcd_wait_for_dev_cmd+0x3e4/0x82c\n ufshcd_exec_dev_cmd+0x5bc/0x9ac\n ufshcd_verify_dev_init+0x84/0x1c8\n ufshcd_probe_hba+0x724/0x1ce0\n ufshcd_host_reset_and_restore+0x260/0x574\n ufshcd_reset_and_restore+0x138/0xbd0\n ufshcd_err_handler+0x1218/0x2f28\n process_one_work+0x5fc/0x1140\n worker_thread+0x7d8/0xe20\n kthread+0x25c/0x468\n ret_from_fork+0x10/0x20",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c729809-dc37-4b59-9a0c-ccc75c36f8d5",
      "id": "CVE-2024-26851",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\n\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds for their data type.\n\nvmlinux   get_bitmap(b=75) + 712\n\u003cnet/netfilter/nf_conntrack_h323_asn1.c:0\u003e\nvmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956\n\u003cnet/netfilter/nf_conntrack_h323_asn1.c:592\u003e\nvmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216\n\u003cnet/netfilter/nf_conntrack_h323_asn1.c:814\u003e\nvmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812\n\u003cnet/netfilter/nf_conntrack_h323_asn1.c:576\u003e\nvmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216\n\u003cnet/netfilter/nf_conntrack_h323_asn1.c:814\u003e\nvmlinux   DecodeRasMessage() + 304\n\u003cnet/netfilter/nf_conntrack_h323_asn1.c:833\u003e\nvmlinux   ras_help() + 684\n\u003cnet/netfilter/nf_conntrack_h323_main.c:1728\u003e\nvmlinux   nf_confirm() + 188\n\u003cnet/netfilter/nf_conntrack_proto.c:137\u003e\n\nDue to abnormal data in skb-\u003edata, the extension bitmap length\nexceeds 32 when decoding ras message then uses the length to make\na shift operation. It will change into negative after several loop.\nUBSAN load could detect a negative shift as an undefined behaviour\nand reports exception.\nSo we add the protection to avoid the length exceeding 32. Or else\nit will return out of range error and stop decoding.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "945df82d-6d56-44d4-b7c3-033d6b97c4c6",
      "id": "CVE-2024-26874",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip\n\nIt's possible that mtk_crtc-\u003eevent is NULL in\nmtk_drm_crtc_finish_page_flip().\n\npending_needs_vblank value is set by mtk_crtc-\u003eevent, but in\nmtk_drm_crtc_atomic_flush(), it's is not guarded by the same\nlock in mtk_drm_finish_page_flip(), thus a race condition happens.\n\nConsider the following case:\n\nCPU1                              CPU2\nstep 1:\nmtk_drm_crtc_atomic_begin()\nmtk_crtc-\u003eevent is not null,\n                                  step 1:\n                                  mtk_drm_crtc_atomic_flush:\n                                  mtk_drm_crtc_update_config(\n                                      !!mtk_crtc-\u003eevent)\nstep 2:\nmtk_crtc_ddp_irq -\u003e\nmtk_drm_finish_page_flip:\nlock\nmtk_crtc-\u003eevent set to null,\npending_needs_vblank set to false\nunlock\n                                  pending_needs_vblank set to true,\n\n                                  step 2:\n                                  mtk_crtc_ddp_irq -\u003e\n                                  mtk_drm_finish_page_flip called again,\n                                  pending_needs_vblank is still true\n                                  //null pointer\n\nInstead of guarding the entire mtk_drm_crtc_atomic_flush(), it's more\nefficient to just check if mtk_crtc-\u003eevent is null before use.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b4c54c8-bf81-4eac-8cd9-9003839afd0f",
      "id": "CVE-2024-27046",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: flower: handle acti_netdevs allocation failure\n\nThe kmalloc_array() in nfp_fl_lag_do_work() will return null, if\nthe physical memory has run out. As a result, if we dereference\nthe acti_netdevs, the null pointer dereference bugs will happen.\n\nThis patch adds a check to judge whether allocation failure occurs.\nIf it happens, the delayed work will be rescheduled and try again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac08f62b-768e-4c44-9d0f-cd8310618f2f",
      "id": "CVE-2024-35965",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix not validating setsockopt user input\n\nCheck user input length before copying data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c113f0b5-ee90-4c5a-9b4a-598249fa0290",
      "id": "CVE-2024-36940",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: core: delete incorrect free in pinctrl_enable()\n\nThe \"pctldev\" struct is allocated in devm_pinctrl_register_and_init().\nIt's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(),\nso freeing it in pinctrl_enable() will lead to a double free.\n\nThe devm_pinctrl_dev_release() function frees the pindescs and destroys\nthe mutex as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e461c02-d79b-4750-92da-8c367118f8d8",
      "id": "CVE-2024-39485",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l: async: Properly re-initialise notifier entry in unregister\n\nThe notifier_entry of a notifier is not re-initialised after unregistering\nthe notifier. This leads to dangling pointers being left there so use\nlist_del_init() to return the notifier_entry an empty list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8527c5d6-523b-42f5-8efd-6ea037fae5d3",
      "id": "CVE-2024-40901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory\n\nThere is a potential out-of-bounds access when using test_bit() on a single\nword. The test_bit() and set_bit() functions operate on long values, and\nwhen testing or setting a single word, they can exceed the word\nboundary. KASAN detects this issue and produces a dump:\n\n\t BUG: KASAN: slab-out-of-bounds in _scsih_add_device.constprop.0 (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 drivers/scsi/mpt3sas/mpt3sas_scsih.c:7331) mpt3sas\n\n\t Write of size 8 at addr ffff8881d26e3c60 by task kworker/u1536:2/2965\n\nFor full log, please look at [1].\n\nMake the allocation at least the size of sizeof(unsigned long) so that\nset_bit() and test_bit() have sufficient room for read/write operations\nwithout overwriting unallocated memory.\n\n[1] Link: https://lore.kernel.org/all/ZkNcALr3W3KGYYJG@gmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bc1eba5-95c9-44b7-8719-e4a92f2e7422",
      "id": "CVE-2019-3819",
      "description": "A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user (\"root\") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9d17c4d-df5c-4504-a4b2-5fc3e10dbcc1",
      "id": "CVE-2024-41002",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec - Fix memory leak for sec resource release\n\nThe AIV is one of the SEC resources. When releasing resources,\nit need to release the AIV resources at the same time.\nOtherwise, memory leakage occurs.\n\nThe aiv resource release is added to the sec resource release\nfunction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f0abc5d-aa49-487a-8090-61ec1be0c3a2",
      "id": "CVE-2024-41067",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: handle RST lookup error correctly\n\n[BUG]\nWhen running btrfs/060 with forced RST feature, it would crash the\nfollowing ASSERT() inside scrub_read_endio():\n\n\tASSERT(sector_nr \u003c stripe-\u003enr_sectors);\n\nBefore that, we would have tree dump from\nbtrfs_get_raid_extent_offset(), as we failed to find the RST entry for\nthe range.\n\n[CAUSE]\nInside scrub_submit_extent_sector_read() every time we allocated a new\nbbio we immediately called btrfs_map_block() to make sure there was some\nRST range covering the scrub target.\n\nBut if btrfs_map_block() fails, we immediately call endio for the bbio,\nwhile the bbio is newly allocated, it's completely empty.\n\nThen inside scrub_read_endio(), we go through the bvecs to find\nthe sector number (as bi_sector is no longer reliable if the bio is\nsubmitted to lower layers).\n\nAnd since the bio is empty, such bvecs iteration would not find any\nsector matching the sector, and return sector_nr == stripe-\u003enr_sectors,\ntriggering the ASSERT().\n\n[FIX]\nInstead of calling btrfs_map_block() after allocating a new bbio, call\nbtrfs_map_block() first.\n\nSince our only objective of calling btrfs_map_block() is only to update\nstripe_len, there is really no need to do that after btrfs_alloc_bio().\n\nThis new timing would avoid the problem of handling empty bbio\ncompletely, and in fact fixes a possible race window for the old code,\nwhere if the submission thread is the only owner of the pending_io, the\nscrub would never finish (since we didn't decrease the pending_io\ncounter).\n\nAlthough the root cause of RST lookup failure still needs to be\naddressed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c0ec3a8-05d1-489c-bce9-2fd89b875657",
      "id": "CVE-2024-41069",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Fix references to freed memory\n\nMost users after parsing a topology file, release memory used by it, so\nhaving pointer references directly into topology file contents is wrong.\nUse devm_kmemdup(), to allocate memory as needed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9ad09e1-df78-45d5-8209-2e295c54059a",
      "id": "CVE-2024-46844",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: line: always fill *error_out in setup_one_line()\n\nThe pointer isn't initialized by callers, but I have\nencountered cases where it's still printed; initialize\nit in all possible cases in setup_one_line().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9cb9c8c-0448-417b-84ff-19715bd0001f",
      "id": "CVE-2024-41078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix quota root leak after quota disable failure\n\nIf during the quota disable we fail when cleaning the quota tree or when\ndeleting the root from the root tree, we jump to the 'out' label without\never dropping the reference on the quota root, resulting in a leak of the\nroot since fs_info-\u003equota_root is no longer pointing to the root (we have\nset it to NULL just before those steps).\n\nFix this by always doing a btrfs_put_root() call under the 'out' label.\nThis is a problem that exists since qgroups were first added in 2012 by\ncommit bed92eae26cc (\"Btrfs: qgroup implementation and prototypes\"), but\nback then we missed a kfree on the quota root and free_extent_buffer()\ncalls on its root and commit root nodes, since back then roots were not\nyet reference counted.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54c845e2-d53c-43b8-b6dd-6c25f544b4c3",
      "id": "CVE-2024-42110",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\n\nThe following is emitted when using idxd (DSA) dmanegine as the data\nmover for ntb_transport that ntb_netdev uses.\n\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\n[74412.556784] caller is netif_rx_internal+0x42/0x130\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\n[74412.581699] Call Trace:\n[74412.584514]  \u003cTASK\u003e\n[74412.586933]  dump_stack_lvl+0x55/0x70\n[74412.591129]  check_preemption_disabled+0xc8/0xf0\n[74412.596374]  netif_rx_internal+0x42/0x130\n[74412.600957]  __netif_rx+0x20/0xd0\n[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\n[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]\n[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\n[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]\n[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]\n[74412.634046]  irq_thread_fn+0x21/0x60\n[74412.638134]  ? irq_thread+0xa8/0x290\n[74412.642218]  irq_thread+0x1a0/0x290\n[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10\n[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10\n[74412.656117]  ? __pfx_irq_thread+0x10/0x10\n[74412.660686]  kthread+0x100/0x130\n[74412.664384]  ? __pfx_kthread+0x10/0x10\n[74412.668639]  ret_from_fork+0x31/0x50\n[74412.672716]  ? __pfx_kthread+0x10/0x10\n[74412.676978]  ret_from_fork_asm+0x1a/0x30\n[74412.681457]  \u003c/TASK\u003e\n\nThe cause is due to the idxd driver interrupt completion handler uses\nthreaded interrupt and the threaded handler is not hard or soft interrupt\ncontext. However __netif_rx() can only be called from interrupt context.\nChange the call to netif_rx() in order to allow completion via normal\ncontext for dmaengine drivers that utilize threaded irq handling.\n\nWhile the following commit changed from netif_rx() to __netif_rx(),\nbaebdf48c360 (\"net: dev: Makes sure netif_rx() can be invoked in any context.\"),\nthe change should've been a noop instead. However, the code precedes this\nfix should've been using netif_rx_ni() or netif_rx_any_context().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd593bd0-0dcf-4ad4-86c6-72f01c29d78c",
      "id": "CVE-2024-42127",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/lima: fix shared irq handling on driver remove\n\nlima uses a shared interrupt, so the interrupt handlers must be prepared\nto be called at any time. At driver removal time, the clocks are\ndisabled early and the interrupts stay registered until the very end of\nthe remove process due to the devm usage.\nThis is potentially a bug as the interrupts access device registers\nwhich assumes clocks are enabled. A crash can be triggered by removing\nthe driver in a kernel with CONFIG_DEBUG_SHIRQ enabled.\nThis patch frees the interrupts at each lima device finishing callback\nso that the handlers are already unregistered by the time we fully\ndisable clocks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bebc93df-cee9-4331-a57c-96985ba5767b",
      "id": "CVE-2024-42290",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/imx-irqsteer: Handle runtime power management correctly\n\nThe power domain is automatically activated from clk_prepare(). However, on\ncertain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes\nsleeping functions, which triggers the 'scheduling while atomic' bug in the\ncontext switch path during device probing:\n\n BUG: scheduling while atomic: kworker/u13:1/48/0x00000002\n Call trace:\n  __schedule_bug+0x54/0x6c\n  __schedule+0x7f0/0xa94\n  schedule+0x5c/0xc4\n  schedule_preempt_disabled+0x24/0x40\n  __mutex_lock.constprop.0+0x2c0/0x540\n  __mutex_lock_slowpath+0x14/0x20\n  mutex_lock+0x48/0x54\n  clk_prepare_lock+0x44/0xa0\n  clk_prepare+0x20/0x44\n  imx_irqsteer_resume+0x28/0xe0\n  pm_generic_runtime_resume+0x2c/0x44\n  __genpd_runtime_resume+0x30/0x80\n  genpd_runtime_resume+0xc8/0x2c0\n  __rpm_callback+0x48/0x1d8\n  rpm_callback+0x6c/0x78\n  rpm_resume+0x490/0x6b4\n  __pm_runtime_resume+0x50/0x94\n  irq_chip_pm_get+0x2c/0xa0\n  __irq_do_set_handler+0x178/0x24c\n  irq_set_chained_handler_and_data+0x60/0xa4\n  mxc_gpio_probe+0x160/0x4b0\n\nCure this by implementing the irq_bus_lock/sync_unlock() interrupt chip\ncallbacks and handle power management in them as they are invoked from\nnon-atomic context.\n\n[ tglx: Rewrote change log, added Fixes tag ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2eb5a539-e5b3-49a9-9066-0ec76c5443cc",
      "id": "CVE-2024-42311",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()\n\nSyzbot reports uninitialized value access issue as below:\n\nloop0: detected capacity change from 0 to 64\n=====================================================\nBUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n d_revalidate fs/namei.c:862 [inline]\n lookup_fast+0x89e/0x8e0 fs/namei.c:1649\n walk_component fs/namei.c:2001 [inline]\n link_path_walk+0x817/0x1480 fs/namei.c:2332\n path_lookupat+0xd9/0x6f0 fs/namei.c:2485\n filename_lookup+0x22e/0x740 fs/namei.c:2515\n user_path_at_empty+0x8b/0x390 fs/namei.c:2924\n user_path_at include/linux/namei.h:57 [inline]\n do_mount fs/namespace.c:3689 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x66b/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nBUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\nBUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\n hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271\n hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39\n filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426\n do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553\n do_read_cache_page mm/filemap.c:3595 [inline]\n read_cache_page+0xfb/0x2f0 mm/filemap.c:3604\n read_mapping_page include/linux/pagemap.h:755 [inline]\n hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78\n hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204\n hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406\n mount_bdev+0x628/0x920 fs/super.c:1359\n hfs_mount+0xcd/0xe0 fs/hfs/super.c:456\n legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610\n vfs_get_tree+0xdc/0x5d0 fs/super.c:1489\n do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145\n path_mount+0xf98/0x26a0 fs/namespace.c:3475\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674\n __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674\n do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\nUninit was created at:\n __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n alloc_slab_page mm/slub.c:2190 [inline]\n allocate_slab mm/slub.c:2354 [inline]\n new_slab+0x2d7/0x1400 mm/slub.c:2407\n ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540\n __slab_alloc mm/slub.c:3625 [inline]\n __slab_alloc_node mm/slub.c:3678 [inline]\n slab_alloc_node mm/slub.c:3850 [inline]\n kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879\n alloc_inode_sb include/linux/fs.h:3018 [inline]\n hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165\n alloc_inode+0x83/0x440 fs/inode.c:260\n new_inode_pseudo fs/inode.c:1005 [inline]\n new_inode+0x38/0x4f0 fs/inode.c:1031\n hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186\n hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228\n vfs_mkdir+0x49a/0x700 fs/namei.c:4126\n do_mkdirat+0x529/0x810 fs/namei.c:4149\n __do_sys_mkdirat fs/namei.c:4164 [inline]\n __se_sys_mkdirat fs/namei.c:4162 [inline]\n __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nIt missed to initialize .tz_secondswest, .cached_start and .cached_blocks\nfields in struct hfs_inode_info after hfs_alloc_inode(), fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b5f07fc-4b0a-4ca1-a814-eaf3c9120378",
      "id": "CVE-2024-44954",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Fix racy access to midibuf\n\nThere can be concurrent accesses to line6 midibuf from both the URB\ncompletion callback and the rawmidi API access.  This could be a cause\nof KMSAN warning triggered by syzkaller below (so put as reported-by\nhere).\n\nThis patch protects the midibuf call of the former code path with a\nspinlock for avoiding the possible races.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9006c880-f207-4b3f-837c-15eb5ed61013",
      "id": "CVE-2024-46673",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aacraid: Fix double-free on probe failure\n\naac_probe_one() calls hardware-specific init functions through the\naac_driver_ident::init pointer, all of which eventually call down to\naac_init_adapter().\n\nIf aac_init_adapter() fails after allocating memory for aac_dev::queues,\nit frees the memory but does not clear that member.\n\nAfter the hardware-specific init function returns an error,\naac_probe_one() goes down an error path that frees the memory pointed to\nby aac_dev::queues, resulting.in a double-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23d3eefb-8a70-46de-84ce-fc8d72626040",
      "id": "CVE-2024-47749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cxgb4: Added NULL check for lookup_atid\n\nThe lookup_atid() function can return NULL if the ATID is\ninvalid or does not exist in the identifier table, which\ncould lead to dereferencing a null pointer without a\ncheck in the `act_establish()` and `act_open_rpl()` functions.\nAdd a NULL check to prevent null pointer dereferencing.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "156afaac-c02c-45bb-83d0-70d9da0b9552",
      "id": "CVE-2024-49891",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths\n\nWhen the HBA is undergoing a reset or is handling an errata event, NULL ptr\ndereference crashes may occur in routines such as\nlpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or\nlpfc_abort_handler().\n\nAdd NULL ptr checks before dereferencing hdwq pointers that may have been\nfreed due to operations colliding with a reset or errata event handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "164c38b2-84cb-42bf-b4ec-87201b2b1380",
      "id": "CVE-2024-50008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()\n\nReplace one-element array with a flexible-array member in\n`struct host_cmd_ds_802_11_scan_ext`.\n\nWith this, fix the following warning:\n\nelo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------\nelo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field \"ext_scan-\u003etlv_buffer\" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1)\nelo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb62d037-3de5-4204-a160-967661f3d2da",
      "id": "CVE-2024-50115",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory\n\nIgnore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits\n4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't\nenforce 32-byte alignment of nCR3.\n\nIn the absolute worst case scenario, failure to ignore bits 4:0 can result\nin an out-of-bounds read, e.g. if the target page is at the end of a\nmemslot, and the VMM isn't using guard pages.\n\nPer the APM:\n\n  The CR3 register points to the base address of the page-directory-pointer\n  table. The page-directory-pointer table is aligned on a 32-byte boundary,\n  with the low 5 address bits 4:0 assumed to be 0.\n\nAnd the SDM's much more explicit:\n\n  4:0    Ignored\n\nNote, KVM gets this right when loading PDPTRs, it's only the nSVM flow\nthat is broken.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e42df327-0844-442b-9183-15fa68f25f0c",
      "id": "CVE-2024-50193",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/entry_32: Clear CPU buffers after register restore in NMI return\n\nCPU buffers are currently cleared after call to exc_nmi, but before\nregister state is restored. This may be okay for MDS mitigation but not for\nRDFS. Because RDFS mitigation requires CPU buffers to be cleared when\nregisters don't have any sensitive data.\n\nMove CLEAR_CPU_BUFFERS after RESTORE_ALL_NMI.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f56cdf96-2ab3-4869-a59d-86cf9b142a5c",
      "id": "CVE-2024-50251",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: sanitize offset and length before calling skb_checksum()\n\nIf access to offset + length is larger than the skbuff length, then\nskb_checksum() triggers BUG_ON().\n\nskb_checksum() internally subtracts the length parameter while iterating\nover skbuff, BUG_ON(len) at the end of it checks that the expected\nlength to be included in the checksum calculation is fully consumed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7f09939-d7bd-4c84-a995-e8ac9398b35d",
      "id": "CVE-2024-53195",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Get rid of userspace_irqchip_in_use\n\nImproper use of userspace_irqchip_in_use led to syzbot hitting the\nfollowing WARN_ON() in kvm_timer_update_irq():\n\nWARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459\nkvm_timer_update_irq+0x21c/0x394\nCall trace:\n  kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459\n  kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968\n  kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264\n  kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]\n  kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]\n  kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695\n  kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893\n  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n  invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49\n  el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132\n  do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151\n  el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\n\nThe following sequence led to the scenario:\n - Userspace creates a VM and a vCPU.\n - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during\n   KVM_ARM_VCPU_INIT.\n - Without any other setup, such as vGIC or vPMU, userspace issues\n   KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,\n   kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().\n   As a result, KVM_RUN returns after enabling the timer, but before\n   incrementing 'userspace_irqchip_in_use':\n   kvm_arch_vcpu_run_pid_change()\n       ret = kvm_arm_pmu_v3_enable()\n           if (!vcpu-\u003earch.pmu.created)\n               return -EINVAL;\n       if (ret)\n           return ret;\n       [...]\n       if (!irqchip_in_kernel(kvm))\n           static_branch_inc(\u0026userspace_irqchip_in_use);\n - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.\n   Since the timer is already enabled, control moves through the\n   following flow, ultimately hitting the WARN_ON():\n   kvm_timer_vcpu_reset()\n       if (timer-\u003eenabled)\n          kvm_timer_update_irq()\n              if (!userspace_irqchip())\n                  ret = kvm_vgic_inject_irq()\n                      ret = vgic_lazy_init()\n                          if (unlikely(!vgic_initialized(kvm)))\n                              if (kvm-\u003earch.vgic.vgic_model !=\n                                  KVM_DEV_TYPE_ARM_VGIC_V2)\n                                      return -EBUSY;\n                  WARN_ON(ret);\n\nTheoretically, since userspace_irqchip_in_use's functionality can be\nsimply replaced by '!irqchip_in_kernel()', get rid of the static key\nto avoid the mismanagement, which also helps with the syzbot issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5495188e-8489-4f99-9d3c-fe64bb4b8595",
      "id": "CVE-2024-53227",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bfa: Fix use-after-free in bfad_im_module_exit()\n\nBUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20\nRead of size 8 at addr ffff8881082d80c8 by task modprobe/25303\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x95/0xe0\n print_report+0xcb/0x620\n kasan_report+0xbd/0xf0\n __lock_acquire+0x2aca/0x3a20\n lock_acquire+0x19b/0x520\n _raw_spin_lock+0x2b/0x40\n attribute_container_unregister+0x30/0x160\n fc_release_transport+0x19/0x90 [scsi_transport_fc]\n bfad_im_module_exit+0x23/0x60 [bfa]\n bfad_init+0xdb/0xff0 [bfa]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nAllocated by task 25303:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]\n bfad_im_module_init+0x17/0x80 [bfa]\n bfad_init+0x23/0xff0 [bfa]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 25303:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x38/0x50\n kfree+0x212/0x480\n bfad_im_module_init+0x7e/0x80 [bfa]\n bfad_init+0x23/0xff0 [bfa]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nAbove issue happens as follows:\n\nbfad_init\n  error = bfad_im_module_init()\n    fc_release_transport(bfad_im_scsi_transport_template);\n  if (error)\n    goto ext;\n\next:\n  bfad_im_module_exit();\n    fc_release_transport(bfad_im_scsi_transport_template);\n    --\u003e Trigger double release\n\nDon't call bfad_im_module_exit() if bfad_im_module_init() failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c6b1feb-2766-4d54-a5ed-152562060215",
      "id": "CVE-2025-21639",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: sysctl: rto_min/max: avoid using current-\u003ensproxy\n\nAs mentioned in a previous commit of this series, using the 'net'\nstructure via 'current' is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader's/writer's netns vs only\n  from the opener's netns.\n\n- current-\u003ensproxy can be NULL in some cases, resulting in an 'Oops'\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe 'net' structure can be obtained from the table-\u003edata using\ncontainer_of().\n\nNote that table-\u003edata could also be used directly, as this is the only\nmember needed from the 'net' structure, but that would increase the size\nof this fix, to use '*data' everywhere 'net-\u003esctp.rto_min/max' is used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1efcbe16-6f7b-44d8-9db2-0d87ef93afd0",
      "id": "CVE-2025-23136",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: int340x: Add NULL check for adev\n\nNot all devices have an ACPI companion fwnode, so adev might be NULL.\nThis is similar to the commit cd2fd6eab480\n(\"platform/x86: int3472: Check for adev == NULL\").\n\nAdd a check for adev not being set and return -ENODEV in that case to\navoid a possible NULL pointer deref in int3402_thermal_probe().\n\nNote, under the same directory, int3400_thermal_probe() has such a\ncheck.\n\n[ rjw: Subject edit, added Fixes: ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3a146b73-40f6-449c-89e8-8e43d8a93eaf",
      "id": "CVE-2025-23143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.\n\nWhen I ran the repro [0] and waited a few seconds, I observed two\nLOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1]\n\nReproduction Steps:\n\n  1) Mount CIFS\n  2) Add an iptables rule to drop incoming FIN packets for CIFS\n  3) Unmount CIFS\n  4) Unload the CIFS module\n  5) Remove the iptables rule\n\nAt step 3), the CIFS module calls sock_release() for the underlying\nTCP socket, and it returns quickly.  However, the socket remains in\nFIN_WAIT_1 because incoming FIN packets are dropped.\n\nAt this point, the module's refcnt is 0 while the socket is still\nalive, so the following rmmod command succeeds.\n\n  # ss -tan\n  State      Recv-Q Send-Q Local Address:Port  Peer Address:Port\n  FIN-WAIT-1 0      477        10.0.2.15:51062   10.0.0.137:445\n\n  # lsmod | grep cifs\n  cifs                 1159168  0\n\nThis highlights a discrepancy between the lifetime of the CIFS module\nand the underlying TCP socket.  Even after CIFS calls sock_release()\nand it returns, the TCP socket does not die immediately in order to\nclose the connection gracefully.\n\nWhile this is generally fine, it causes an issue with LOCKDEP because\nCIFS assigns a different lock class to the TCP socket's sk-\u003esk_lock\nusing sock_lock_init_class_and_name().\n\nOnce an incoming packet is processed for the socket or a timer fires,\nsk-\u003esk_lock is acquired.\n\nThen, LOCKDEP checks the lock context in check_wait_context(), where\nhlock_class() is called to retrieve the lock class.  However, since\nthe module has already been unloaded, hlock_class() logs a warning\nand returns NULL, triggering the null-ptr-deref.\n\nIf LOCKDEP is enabled, we must ensure that a module calling\nsock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded\nwhile such a socket is still alive to prevent this issue.\n\nLet's hold the module reference in sock_lock_init_class_and_name()\nand release it when the socket is freed in sk_prot_free().\n\nNote that sock_lock_init() clears sk-\u003esk_owner for svc_create_socket()\nthat calls sock_lock_init_class_and_name() for a listening socket,\nwhich clones a socket by sk_clone_lock() without GFP_ZERO.\n\n[0]:\nCIFS_SERVER=\"10.0.0.137\"\nCIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\"\nDEV=\"enp0s3\"\nCRED=\"/root/WindowsCredential.txt\"\n\nMNT=$(mktemp -d /tmp/XXXXXX)\nmount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1\n\niptables -A INPUT -s ${CIFS_SERVER} -j DROP\n\nfor i in $(seq 10);\ndo\n    umount ${MNT}\n    rmmod cifs\n    sleep 1\ndone\n\nrm -r ${MNT}\n\niptables -D INPUT -s ${CIFS_SERVER} -j DROP\n\n[1]:\nDEBUG_LOCKS_WARN_ON(1)\nWARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\nModules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\n...\nCall Trace:\n \u003cIRQ\u003e\n __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178)\n lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)\n _raw_spin_lock_nested (kernel/locking/spinlock.c:379)\n tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350)\n...\n\nBUG: kernel NULL pointer dereference, address: 00000000000000c4\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\nPGD 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G        W          6.14.0 #36\nTainted: [W]=WARN\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:__lock_acquire (kernel/\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8401e527-cf9f-4c9d-b6a1-c38da44c90a5",
      "id": "CVE-2025-37805",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[    8.713282][  T221] Call trace:\n[    8.713365][  T221]  __flush_work+0x8d0/0x914\n[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc\n[    8.713570][  T221]  cancel_work_sync+0x24/0x34\n[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390\n[    8.714139][  T221]  really_probe+0x1bc/0x4c8\n...\n\nIt seems we're hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()-\u003evirtsnd_build_devs()-\u003evirtsnd_pcm_parse_cfg()\n\nWe set snd-\u003ensubstreams, allocate the snd-\u003esubstreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a380f475-eece-41f3-901e-6306f15f1a74",
      "id": "CVE-2025-37840",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: brcmnand: fix PM resume warning\n\nFixed warning on PM resume as shown below caused due to uninitialized\nstruct nand_operation that checks chip select field :\nWARN_ON(op-\u003ecs \u003e= nanddev_ntargets(\u0026chip-\u003ebase)\n\n[   14.588522] ------------[ cut here ]------------\n[   14.588529] WARNING: CPU: 0 PID: 1392 at drivers/mtd/nand/raw/internals.h:139 nand_reset_op+0x1e0/0x1f8\n[   14.588553] Modules linked in: bdc udc_core\n[   14.588579] CPU: 0 UID: 0 PID: 1392 Comm: rtcwake Tainted: G        W          6.14.0-rc4-g5394eea10651 #16\n[   14.588590] Tainted: [W]=WARN\n[   14.588593] Hardware name: Broadcom STB (Flattened Device Tree)\n[   14.588598] Call trace:\n[   14.588604]  dump_backtrace from show_stack+0x18/0x1c\n[   14.588622]  r7:00000009 r6:0000008b r5:60000153 r4:c0fa558c\n[   14.588625]  show_stack from dump_stack_lvl+0x70/0x7c\n[   14.588639]  dump_stack_lvl from dump_stack+0x18/0x1c\n[   14.588653]  r5:c08d40b0 r4:c1003cb0\n[   14.588656]  dump_stack from __warn+0x84/0xe4\n[   14.588668]  __warn from warn_slowpath_fmt+0x18c/0x194\n[   14.588678]  r7:c08d40b0 r6:c1003cb0 r5:00000000 r4:00000000\n[   14.588681]  warn_slowpath_fmt from nand_reset_op+0x1e0/0x1f8\n[   14.588695]  r8:70c40dff r7:89705f41 r6:36b4a597 r5:c26c9444 r4:c26b0048\n[   14.588697]  nand_reset_op from brcmnand_resume+0x13c/0x150\n[   14.588714]  r9:00000000 r8:00000000 r7:c24f8010 r6:c228a3f8 r5:c26c94bc r4:c26b0040\n[   14.588717]  brcmnand_resume from platform_pm_resume+0x34/0x54\n[   14.588735]  r5:00000010 r4:c0840a50\n[   14.588738]  platform_pm_resume from dpm_run_callback+0x5c/0x14c\n[   14.588757]  dpm_run_callback from device_resume+0xc0/0x324\n[   14.588776]  r9:c24f8054 r8:c24f80a0 r7:00000000 r6:00000000 r5:00000010 r4:c24f8010\n[   14.588779]  device_resume from dpm_resume+0x130/0x160\n[   14.588799]  r9:c22539e4 r8:00000010 r7:c22bebb0 r6:c24f8010 r5:c22539dc r4:c22539b0\n[   14.588802]  dpm_resume from dpm_resume_end+0x14/0x20\n[   14.588822]  r10:c2204e40 r9:00000000 r8:c228a3fc r7:00000000 r6:00000003 r5:c228a414\n[   14.588826]  r4:00000010\n[   14.588828]  dpm_resume_end from suspend_devices_and_enter+0x274/0x6f8\n[   14.588848]  r5:c228a414 r4:00000000\n[   14.588851]  suspend_devices_and_enter from pm_suspend+0x228/0x2bc\n[   14.588868]  r10:c3502910 r9:c3501f40 r8:00000004 r7:c228a438 r6:c0f95e18 r5:00000000\n[   14.588871]  r4:00000003\n[   14.588874]  pm_suspend from state_store+0x74/0xd0\n[   14.588889]  r7:c228a438 r6:c0f934c8 r5:00000003 r4:00000003\n[   14.588892]  state_store from kobj_attr_store+0x1c/0x28\n[   14.588913]  r9:00000000 r8:00000000 r7:f09f9f08 r6:00000004 r5:c3502900 r4:c0283250\n[   14.588916]  kobj_attr_store from sysfs_kf_write+0x40/0x4c\n[   14.588936]  r5:c3502900 r4:c0d92a48\n[   14.588939]  sysfs_kf_write from kernfs_fop_write_iter+0x104/0x1f0\n[   14.588956]  r5:c3502900 r4:c3501f40\n[   14.588960]  kernfs_fop_write_iter from vfs_write+0x250/0x420\n[   14.588980]  r10:c0e14b48 r9:00000000 r8:c25f5780 r7:00443398 r6:f09f9f68 r5:c34f7f00\n[   14.588983]  r4:c042a88c\n[   14.588987]  vfs_write from ksys_write+0x74/0xe4\n[   14.589005]  r10:00000004 r9:c25f5780 r8:c02002fA0 r7:00000000 r6:00000000 r5:c34f7f00\n[   14.589008]  r4:c34f7f00\n[   14.589011]  ksys_write from sys_write+0x10/0x14\n[   14.589029]  r7:00000004 r6:004421c0 r5:00443398 r4:00000004\n[   14.589032]  sys_write from ret_fast_syscall+0x0/0x5c\n[   14.589044] Exception stack(0xf09f9fa8 to 0xf09f9ff0)\n[   14.589050] 9fa0:                   00000004 00443398 00000004 00443398 00000004 00000001\n[   14.589056] 9fc0: 00000004 00443398 004421c0 00000004 b6ecbd58 00000008 bebfbc38 0043eb78\n[   14.589062] 9fe0: 00440eb0 bebfbaf8 b6de18a0 b6e579e8\n[   14.589065] ---[ end trace 0000000000000000 ]---\n\nThe fix uses the higher level nand_reset(chip, chipnr); where chipnr = 0, when\ndoing PM resume operation in compliance with the controller support for single\ndie nand chip. Switching from nand_reset_op() to nan\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed658671-a5c0-40ec-b17a-10d70ed1ae03",
      "id": "CVE-2025-37909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: Fix memleak issue when GSO enabled\n\nAlways map the `skb` to the LS descriptor. Previously skb was\nmapped to EXT descriptor when the number of fragments is zero with\nGSO enabled. Mapping the skb to EXT descriptor prevents it from\nbeing freed, leading to a memory leak",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b72c7dc2-249a-42d4-93bc-67cdbeee724b",
      "id": "CVE-2025-37954",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn't consider it\nvalid, and thinks it's newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99fa7951-8973-46b5-b596-38cf16c43aab",
      "id": "CVE-2025-37969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo\n\nPrevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in\ncase pattern_len is equal to zero and the device FIFO is not empty.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "755edf51-4a89-41f3-84c7-25429ee3d001",
      "id": "CVE-2025-38058",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock\n\n... or we risk stealing final mntput from sync umount - raising mnt_count\nafter umount(2) has verified that victim is not busy, but before it\nhas set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see\nthat it's safe to quietly undo mnt_count increment and leaves dropping\nthe reference to caller, where it'll be a full-blown mntput().\n\nCheck under mount_lock is needed; leaving the current one done before\ntaking that makes no sense - it's nowhere near common enough to bother\nwith.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c680e711-9807-4fca-91dc-45b449e1f28e",
      "id": "CVE-2025-38159",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds\n\nSet the size to 6 instead of 2, since 'para' array is passed to\n'rtw_fw_bt_wifi_control(rtwdev, para[0], \u0026para[1])', which reads\n5 bytes:\n\nvoid rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)\n{\n    ...\n    SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);\n    SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));\n    ...\n    SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));\n\nDetected using the static analysis tool - Svace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d61107b-a702-4bcb-98ea-d9d93165869b",
      "id": "CVE-2025-38438",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.\n\nsof_pdata-\u003etplg_filename can have address allocated by kstrdup()\nand can be overwritten. Memory leak was detected with kmemleak:\n\nunreferenced object 0xffff88812391ff60 (size 16):\n  comm \"kworker/4:1\", pid 161, jiffies 4294802931\n  hex dump (first 16 bytes):\n    73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00  sof-hda-generic.\n  backtrace (crc 4bf1675c):\n    __kmalloc_node_track_caller_noprof+0x49c/0x6b0\n    kstrdup+0x46/0xc0\n    hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic]\n    sof_init_environment+0x16f/0xb50 [snd_sof]\n    sof_probe_continue+0x45/0x7c0 [snd_sof]\n    sof_probe_work+0x1e/0x40 [snd_sof]\n    process_one_work+0x894/0x14b0\n    worker_thread+0x5e5/0xfb0\n    kthread+0x39d/0x760\n    ret_from_fork+0x31/0x70\n    ret_from_fork_asm+0x1a/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13b95f71-9aef-45c2-9698-24cfe5fe5ea6",
      "id": "CVE-2025-38474",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: net: sierra: check for no status endpoint\n\nThe driver checks for having three endpoints and\nhaving bulk in and out endpoints, but not that\nthe third endpoint is interrupt input.\nRectify the omission.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb396430-7b6e-4e79-ac78-5c925ccbf058",
      "id": "CVE-2025-38664",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix a null pointer dereference in ice_copy_and_init_pkg()\n\nAdd check for the return value of devm_kmemdup()\nto prevent potential null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5609155b-0860-4686-83cb-a059e529e356",
      "id": "CVE-2025-39789",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: x86/aegis - Add missing error checks\n\nThe skcipher_walk functions can allocate memory and can fail, so\nchecking for errors is necessary.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86ee68da-732b-47ec-a20c-8236912a541e",
      "id": "CVE-2007-4998",
      "description": "cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "abbea301-28fe-4179-9f53-dafb2b8a3588",
      "id": "CVE-2024-46743",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/irq: Prevent device address out-of-bounds read in interrupt map walk\n\nWhen of_irq_parse_raw() is invoked with a device address smaller than\nthe interrupt parent node (from #address-cells property), KASAN detects\nthe following out-of-bounds read when populating the initial match table\n(dyndbg=\"func of_irq_parse_* +p\"):\n\n  OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0\n  OF:  parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2\n  OF:  intspec=4\n  OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2\n  OF:  -\u003e addrsize=3\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0\n  Read of size 4 at addr ffffff81beca5608 by task bash/764\n\n  CPU: 1 PID: 764 Comm: bash Tainted: G           O       6.1.67-484c613561-nokia_sm_arm64 #1\n  Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023\n  Call trace:\n   dump_backtrace+0xdc/0x130\n   show_stack+0x1c/0x30\n   dump_stack_lvl+0x6c/0x84\n   print_report+0x150/0x448\n   kasan_report+0x98/0x140\n   __asan_load4+0x78/0xa0\n   of_irq_parse_raw+0x2b8/0x8d0\n   of_irq_parse_one+0x24c/0x270\n   parse_interrupts+0xc0/0x120\n   of_fwnode_add_links+0x100/0x2d0\n   fw_devlink_parse_fwtree+0x64/0xc0\n   device_add+0xb38/0xc30\n   of_device_add+0x64/0x90\n   of_platform_device_create_pdata+0xd0/0x170\n   of_platform_bus_create+0x244/0x600\n   of_platform_notify+0x1b0/0x254\n   blocking_notifier_call_chain+0x9c/0xd0\n   __of_changeset_entry_notify+0x1b8/0x230\n   __of_changeset_apply_notify+0x54/0xe4\n   of_overlay_fdt_apply+0xc04/0xd94\n   ...\n\n  The buggy address belongs to the object at ffffff81beca5600\n   which belongs to the cache kmalloc-128 of size 128\n  The buggy address is located 8 bytes inside of\n   128-byte region [ffffff81beca5600, ffffff81beca5680)\n\n  The buggy address belongs to the physical page:\n  page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4\n  head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0\n  flags: 0x8000000000010200(slab|head|zone=2)\n  raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300\n  raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n   ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  \u003effffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                        ^\n   ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n   ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc\n  ==================================================================\n  OF:  -\u003e got it !\n\nPrevent the out-of-bounds read by copying the device address into a\nbuffer of sufficient size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "065328a2-3d7c-4b2f-b6fc-76e9da129b0b",
      "id": "CVE-2020-36322",
      "description": "An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1788d965-e7aa-4f8c-9a8f-27326043fefa",
      "id": "CVE-2020-36691",
      "description": "An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19da2f22-a551-423b-8ca3-62fb4cfbecea",
      "id": "CVE-2021-20194",
      "description": "There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y , CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution, the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6dcf82a7-2510-47e4-8cb3-43d7aba25d5a",
      "id": "CVE-2021-47238",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix memory leak in ip_mc_add1_src\n\nBUG: memory leak\nunreferenced object 0xffff888101bc4c00 (size 32):\n  comm \"syz-executor527\", pid 360, jiffies 4294807421 (age 19.329s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n    01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................\n  backtrace:\n    [\u003c00000000f17c5244\u003e] kmalloc include/linux/slab.h:558 [inline]\n    [\u003c00000000f17c5244\u003e] kzalloc include/linux/slab.h:688 [inline]\n    [\u003c00000000f17c5244\u003e] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline]\n    [\u003c00000000f17c5244\u003e] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095\n    [\u003c000000001cb99709\u003e] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416\n    [\u003c0000000052cf19ed\u003e] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline]\n    [\u003c0000000052cf19ed\u003e] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423\n    [\u003c00000000477edfbc\u003e] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857\n    [\u003c00000000e75ca9bb\u003e] __sys_setsockopt+0x158/0x270 net/socket.c:2117\n    [\u003c00000000bdb993a8\u003e] __do_sys_setsockopt net/socket.c:2128 [inline]\n    [\u003c00000000bdb993a8\u003e] __se_sys_setsockopt net/socket.c:2125 [inline]\n    [\u003c00000000bdb993a8\u003e] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125\n    [\u003c000000006a1ffdbd\u003e] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47\n    [\u003c00000000b11467c4\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nIn commit 24803f38a5c0 (\"igmp: do not remove igmp souce list info when set\nlink down\"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed,\nbecause it was also called in igmpv3_clear_delrec().\n\nRough callgraph:\n\ninetdev_destroy\n-\u003e ip_mc_destroy_dev\n     -\u003e igmpv3_clear_delrec\n        -\u003e ip_mc_clear_src\n-\u003e RCU_INIT_POINTER(dev-\u003eip_ptr, NULL)\n\nHowever, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't\nrelease in_dev-\u003emc_list-\u003esources. And RCU_INIT_POINTER() assigns the\nNULL to dev-\u003eip_ptr. As a result, in_dev cannot be obtained through\ninetdev_by_index() and then in_dev-\u003emc_list-\u003esources cannot be released\nby ip_mc_del1_src() in the sock_close. Rough call sequence goes like:\n\nsock_close\n-\u003e __sock_release\n   -\u003e inet_release\n      -\u003e ip_mc_drop_socket\n         -\u003e inetdev_by_index\n         -\u003e ip_mc_leave_src\n            -\u003e ip_mc_del_src\n               -\u003e ip_mc_del1_src\n\nSo we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free\nin_dev-\u003emc_list-\u003esources.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54a5e283-632b-4186-9f56-ffb83cf501fd",
      "id": "CVE-2021-47385",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val \u0026 0x08) \u0026\u0026 (!(val \u0026 0x80)) \u0026\u0026 ((val \u0026 0x7) == ((val \u003e\u003e 4) \u0026 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed62cac6-1c3a-496d-8e0b-6f4af0c63c9c",
      "id": "CVE-2021-47391",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\n\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\non the same id_priv. While this cannot happen without going through the\nwork, it violates the invariant that the same address resolution\nbackground request cannot be active twice.\n\n       CPU 1                                  CPU 2\n\nrdma_resolve_addr():\n  RDMA_CM_IDLE -\u003e RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)  #1\n\n\t\t\t process_one_req(): for #1\n                          addr_handler():\n                            RDMA_CM_ADDR_QUERY -\u003e RDMA_CM_ADDR_BOUND\n                            mutex_unlock(\u0026id_priv-\u003ehandler_mutex);\n                            [.. handler still running ..]\n\nrdma_resolve_addr():\n  RDMA_CM_ADDR_BOUND -\u003e RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)\n    !! two requests are now on the req_list\n\nrdma_destroy_id():\n destroy_id_handler_unlock():\n  _destroy_id():\n   cma_cancel_operation():\n    rdma_addr_cancel()\n\n                          // process_one_req() self removes it\n\t\t          spin_lock_bh(\u0026lock);\n                           cancel_delayed_work(\u0026req-\u003ework);\n\t                   if (!list_empty(\u0026req-\u003elist)) == true\n\n      ! rdma_addr_cancel() returns after process_on_req #1 is done\n\n   kfree(id_priv)\n\n\t\t\t process_one_req(): for #2\n                          addr_handler():\n\t                    mutex_lock(\u0026id_priv-\u003ehandler_mutex);\n                            !! Use after free on id_priv\n\nrdma_addr_cancel() expects there to be one req on the list and only\ncancels the first one. The self-removal behavior of the work only happens\nafter the handler has returned. This yields a situations where the\nreq_list can have two reqs for the same \"handle\" but rdma_addr_cancel()\nonly cancels the first one.\n\nThe second req remains active beyond rdma_destroy_id() and will\nuse-after-free id_priv once it inevitably triggers.\n\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\nalways cancel before calling it again. This ensures the req_list never\ngets more than one item in it and doesn't cost anything in the normal flow\nthat never uses this strange error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "569f17f0-c699-413b-a4e9-578c073bc825",
      "id": "CVE-2021-47403",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipack: ipoctal: fix module reference leak\n\nA reference to the carrier module was taken on every open but was only\nreleased once when the final reference to the tty struct was dropped.\n\nFix this by taking the module reference and initialising the tty driver\ndata when installing the tty.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7dd98aaa-fa54-4a39-9dbf-ac6bff469da3",
      "id": "CVE-2021-47522",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bigbenff: prevent null pointer dereference\n\nWhen emulating the device through uhid, there is a chance we don't have\noutput reports and so report_field is null.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "212a8792-6cd0-471e-b87d-3c7dcedbd805",
      "id": "CVE-2022-0492",
      "description": "A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40b91379-da6b-4a92-a12b-e37337515233",
      "id": "CVE-2022-2078",
      "description": "A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "486f9db0-6b1b-4cb0-9bf8-17b06c90d9ef",
      "id": "CVE-2022-21505",
      "description": "In the linux kernel, if IMA appraisal is used with the \"ima_appraise=log\" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting \"ima_appraise=log\" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8cbb11af-25ab-4455-9ca6-616f14b2da51",
      "id": "CVE-2022-49025",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free when reverting termination table\n\nWhen having multiple dests with termination tables and second one\nor afterwards fails the driver reverts usage of term tables but\ndoesn't reset the assignment in attr-\u003edests[num_vport_dests].termtbl\nwhich case a use-after-free when releasing the rule.\nFix by resetting the assignment of termtbl to null.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08689d13-615d-48e2-b3f5-3dbed2f148df",
      "id": "CVE-2022-2602",
      "description": "io_uring UAF, Unix SCM garbage collection",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "437eb7e6-ff11-4c9d-8627-6c554e27eb27",
      "id": "CVE-2022-3545",
      "description": "A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36488ebd-d23a-425d-91e3-9585179b0f15",
      "id": "CVE-2022-39188",
      "description": "An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cac9278-e5e3-484d-8fc7-824388c4a27f",
      "id": "CVE-2022-40768",
      "description": "drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef34664b-cc51-438b-abc0-dd068ea349d8",
      "id": "CVE-2022-48982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix crash when replugging CSR fake controllers\n\nIt seems fake CSR 5.0 clones can cause the suspend notifier to be\nregistered twice causing the following kernel panic:\n\n[   71.986122] Call Trace:\n[   71.986124]  \u003cTASK\u003e\n[   71.986125]  blocking_notifier_chain_register+0x33/0x60\n[   71.986130]  hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da]\n[   71.986154]  btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477]\n[   71.986159]  ? __pm_runtime_set_status+0x1a9/0x300\n[   71.986162]  ? ktime_get_mono_fast_ns+0x3e/0x90\n[   71.986167]  usb_probe_interface+0xe3/0x2b0\n[   71.986171]  really_probe+0xdb/0x380\n[   71.986174]  ? pm_runtime_barrier+0x54/0x90\n[   71.986177]  __driver_probe_device+0x78/0x170\n[   71.986180]  driver_probe_device+0x1f/0x90\n[   71.986183]  __device_attach_driver+0x89/0x110\n[   71.986186]  ? driver_allows_async_probing+0x70/0x70\n[   71.986189]  bus_for_each_drv+0x8c/0xe0\n[   71.986192]  __device_attach+0xb2/0x1e0\n[   71.986195]  bus_probe_device+0x92/0xb0\n[   71.986198]  device_add+0x422/0x9a0\n[   71.986201]  ? sysfs_merge_group+0xd4/0x110\n[   71.986205]  usb_set_configuration+0x57a/0x820\n[   71.986208]  usb_generic_driver_probe+0x4f/0x70\n[   71.986211]  usb_probe_device+0x3a/0x110\n[   71.986213]  really_probe+0xdb/0x380\n[   71.986216]  ? pm_runtime_barrier+0x54/0x90\n[   71.986219]  __driver_probe_device+0x78/0x170\n[   71.986221]  driver_probe_device+0x1f/0x90\n[   71.986224]  __device_attach_driver+0x89/0x110\n[   71.986227]  ? driver_allows_async_probing+0x70/0x70\n[   71.986230]  bus_for_each_drv+0x8c/0xe0\n[   71.986232]  __device_attach+0xb2/0x1e0\n[   71.986235]  bus_probe_device+0x92/0xb0\n[   71.986237]  device_add+0x422/0x9a0\n[   71.986239]  ? _dev_info+0x7d/0x98\n[   71.986242]  ? blake2s_update+0x4c/0xc0\n[   71.986246]  usb_new_device.cold+0x148/0x36d\n[   71.986250]  hub_event+0xa8a/0x1910\n[   71.986255]  process_one_work+0x1c4/0x380\n[   71.986259]  worker_thread+0x51/0x390\n[   71.986262]  ? rescuer_thread+0x3b0/0x3b0\n[   71.986264]  kthread+0xdb/0x110\n[   71.986266]  ? kthread_complete_and_exit+0x20/0x20\n[   71.986268]  ret_from_fork+0x1f/0x30\n[   71.986273]  \u003c/TASK\u003e\n[   71.986274] ---[ end trace 0000000000000000 ]---\n[   71.986284] btusb: probe of 2-1.6:1.0 failed with error -17",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5571d68-9d0d-44b3-8567-16e80c30986f",
      "id": "CVE-2022-49054",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests\n\nhv_panic_page might contain guest-sensitive information, do not dump it\nover to Hyper-V by default in isolated guests.\n\nWhile at it, update some comments in hyperv_{panic,die}_event().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8104cb9f-42b4-4863-b0cf-705a649ab24f",
      "id": "CVE-2022-49106",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances\n\nvchiq_get_state() can return a NULL pointer. So handle this cases and\navoid a NULL pointer derefence in vchiq_dump_platform_instances.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1609b759-786f-44fb-9556-dc636497d25e",
      "id": "CVE-2022-49111",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix use after free in hci_send_acl\n\nThis fixes the following trace caused by receiving\nHCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without\nfirst checking if conn-\u003etype is in fact AMP_LINK and in case it is\ndo properly cleanup upper layers with hci_disconn_cfm:\n\n ==================================================================\n    BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50\n    Read of size 8 at addr ffff88800e404818 by task bluetoothd/142\n\n    CPU: 0 PID: 142 Comm: bluetoothd Not tainted\n    5.17.0-rc5-00006-gda4022eeac1a #7\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n    rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n    Call Trace:\n     \u003cTASK\u003e\n     dump_stack_lvl+0x45/0x59\n     print_address_description.constprop.0+0x1f/0x150\n     kasan_report.cold+0x7f/0x11b\n     hci_send_acl+0xaba/0xc50\n     l2cap_do_send+0x23f/0x3d0\n     l2cap_chan_send+0xc06/0x2cc0\n     l2cap_sock_sendmsg+0x201/0x2b0\n     sock_sendmsg+0xdc/0x110\n     sock_write_iter+0x20f/0x370\n     do_iter_readv_writev+0x343/0x690\n     do_iter_write+0x132/0x640\n     vfs_writev+0x198/0x570\n     do_writev+0x202/0x280\n     do_syscall_64+0x38/0x90\n     entry_SYSCALL_64_after_hwframe+0x44/0xae\n    RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\n    Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3\n    0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05\n    \u003c48\u003e 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10\n    RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015\n    RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77\n    R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580\n    RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001\n    \u003c/TASK\u003e\n    R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0\n\n    Allocated by task 45:\n        kasan_save_stack+0x1e/0x40\n        __kasan_kmalloc+0x81/0xa0\n        hci_chan_create+0x9a/0x2f0\n        l2cap_conn_add.part.0+0x1a/0xdc0\n        l2cap_connect_cfm+0x236/0x1000\n        le_conn_complete_evt+0x15a7/0x1db0\n        hci_le_conn_complete_evt+0x226/0x2c0\n        hci_le_meta_evt+0x247/0x450\n        hci_event_packet+0x61b/0xe90\n        hci_rx_work+0x4d5/0xc50\n        process_one_work+0x8fb/0x15a0\n        worker_thread+0x576/0x1240\n        kthread+0x29d/0x340\n        ret_from_fork+0x1f/0x30\n\n    Freed by task 45:\n        kasan_save_stack+0x1e/0x40\n        kasan_set_track+0x21/0x30\n        kasan_set_free_info+0x20/0x30\n        __kasan_slab_free+0xfb/0x130\n        kfree+0xac/0x350\n        hci_conn_cleanup+0x101/0x6a0\n        hci_conn_del+0x27e/0x6c0\n        hci_disconn_phylink_complete_evt+0xe0/0x120\n        hci_event_packet+0x812/0xe90\n        hci_rx_work+0x4d5/0xc50\n        process_one_work+0x8fb/0x15a0\n        worker_thread+0x576/0x1240\n        kthread+0x29d/0x340\n        ret_from_fork+0x1f/0x30\n\n    The buggy address belongs to the object at ffff88800c0f0500\n    The buggy address is located 24 bytes inside of\n    which belongs to the cache kmalloc-128 of size 128\n    The buggy address belongs to the page:\n    128-byte region [ffff88800c0f0500, ffff88800c0f0580)\n    flags: 0x100000000000200(slab|node=0|zone=1)\n    page:00000000fe45cd86 refcount:1 mapcount:0\n    mapping:0000000000000000 index:0x0 pfn:0xc0f0\n    raw: 0000000000000000 0000000080100010 00000001ffffffff\n    0000000000000000\n    raw: 0100000000000200 ffffea00003a2c80 dead000000000004\n    ffff8880078418c0\n    page dumped because: kasan: bad access detected\n    ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc\n    Memory state around the buggy address:\n    \u003effff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n    ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n    ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                   \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4fc867be-d5e6-46bd-85fe-880973d9ff9b",
      "id": "CVE-2022-49292",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: oss: Fix PCM OSS buffer allocation overflow\n\nWe've got syzbot reports hitting INT_MAX overflow at vmalloc()\nallocation that is called from snd_pcm_plug_alloc().  Although we\napply the restrictions to input parameters, it's based only on the\nhw_params of the underlying PCM device.  Since the PCM OSS layer\nallocates a temporary buffer for the data conversion, the size may\nbecome unexpectedly large when more channels or higher rates is given;\nin the reported case, it went over INT_MAX, hence it hits WARN_ON().\n\nThis patch is an attempt to avoid such an overflow and an allocation\nfor too large buffers.  First off, it adds the limit of 1MB as the\nupper bound for period bytes.  This must be large enough for all use\ncases, and we really don't want to handle a larger temporary buffer\nthan this size.  The size check is performed at two places, where the\noriginal period bytes is calculated and where the plugin buffer size\nis calculated.\n\nIn addition, the driver uses array_size() and array3_size() for\nmultiplications to catch overflows for the converted period size and\nbuffer bytes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ea0b5e5-aa01-4971-a631-9961071b400c",
      "id": "CVE-2022-49568",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Don't null dereference ops-\u003edestroy\n\nA KVM device cleanup happens in either of two callbacks:\n1) destroy() which is called when the VM is being destroyed;\n2) release() which is called when a device fd is closed.\n\nMost KVM devices use 1) but Book3s's interrupt controller KVM devices\n(XICS, XIVE, XIVE-native) use 2) as they need to close and reopen during\nthe machine execution. The error handling in kvm_ioctl_create_device()\nassumes destroy() is always defined which leads to NULL dereference as\ndiscovered by Syzkaller.\n\nThis adds a checks for destroy!=NULL and adds a missing release().\n\nThis is not changing kvm_destroy_devices() as devices with defined\nrelease() should have been removed from the KVM devices list by then.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4333cb71-fdf3-4eb2-b90a-2853e598110b",
      "id": "CVE-2022-49832",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map\n\nHere is the BUG report by KASAN about null pointer dereference:\n\nBUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50\nRead of size 1 at addr 0000000000000000 by task python3/2640\nCall Trace:\n strcmp\n __of_find_property\n of_find_property\n pinctrl_dt_to_map\n\nkasprintf() would return NULL pointer when kmalloc() fail to allocate.\nSo directly return ENOMEM, if kasprintf() return NULL pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e303072-c97d-4e90-a908-fe41ddff205b",
      "id": "CVE-2022-50105",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/spufs: Fix refcount leak in spufs_init_isolated_loader\n\nof_find_node_by_path() returns remote device nodepointer with\nrefcount incremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59cb514c-e336-4e06-9efe-5ca8e15bf172",
      "id": "CVE-2022-50142",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nintel_th: msu: Fix vmalloced buffers\n\nAfter commit f5ff79fddf0e (\"dma-mapping: remove CONFIG_DMA_REMAP\") there's\na chance of DMA buffer getting allocated via vmalloc(), which messes up\nthe mmapping code:\n\n\u003e RIP: msc_mmap_fault [intel_th_msu]\n\u003e Call Trace:\n\u003e  \u003cTASK\u003e\n\u003e  __do_fault\n\u003e  do_fault\n...\n\nFix this by accounting for vmalloc possibility.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c1e2f39-71c2-46c3-bb9a-e360f46920a8",
      "id": "CVE-2023-23003",
      "description": "In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39cbbf54-ed87-4efa-817d-1cbcb3e348db",
      "id": "CVE-2022-50198",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4e4da6f-8c32-41f6-a4c4-0cedd63740ef",
      "id": "CVE-2022-50202",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: hibernate: defer device probing when resuming from hibernation\n\nsyzbot is reporting hung task at misc_open() [1], for there is a race\nwindow of AB-BA deadlock which involves probe_count variable. Currently\nwait_for_device_probe() from snapshot_open() from misc_open() can sleep\nforever with misc_mtx held if probe_count cannot become 0.\n\nWhen a device is probed by hub_event() work function, probe_count is\nincremented before the probe function starts, and probe_count is\ndecremented after the probe function completed.\n\nThere are three cases that can prevent probe_count from dropping to 0.\n\n  (a) A device being probed stopped responding (i.e. broken/malicious\n      hardware).\n\n  (b) A process emulating a USB device using /dev/raw-gadget interface\n      stopped responding for some reason.\n\n  (c) New device probe requests keeps coming in before existing device\n      probe requests complete.\n\nThe phenomenon syzbot is reporting is (b). A process which is holding\nsystem_transition_mutex and misc_mtx is waiting for probe_count to become\n0 inside wait_for_device_probe(), but the probe function which is called\n from hub_event() work function is waiting for the processes which are\nblocked at mutex_lock(\u0026misc_mtx) to respond via /dev/raw-gadget interface.\n\nThis patch mitigates (b) by deferring wait_for_device_probe() from\nsnapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that\nthe possibility of (b) remains as long as any thread which is emulating a\nUSB device via /dev/raw-gadget interface can be blocked by uninterruptible\nblocking operations (e.g. mutex_lock()).\n\nPlease also note that (a) and (c) are not addressed. Regarding (c), we\nshould change the code to wait for only one device which contains the\nimage for resuming from hibernation. I don't know how to address (a), for\nuse of timeout for wait_for_device_probe() might result in loss of user\ndata in the image. Maybe we should require the userland to wait for the\nimage device before opening /dev/snapshot interface.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5de191fd-19ab-4f16-978c-23bc086f3f79",
      "id": "CVE-2023-35788",
      "description": "An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "821acbeb-6022-45e2-a641-8ecf9aa2bfec",
      "id": "CVE-2023-52340",
      "description": "The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1282841a-63ae-43a4-89bc-d217fb1166e6",
      "id": "CVE-2023-52439",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix use-after-free in uio_open\n\ncore-1\t\t\t\tcore-2\n-------------------------------------------------------\nuio_unregister_device\t\tuio_open\n\t\t\t\tidev = idr_find()\ndevice_unregister(\u0026idev-\u003edev)\nput_device(\u0026idev-\u003edev)\nuio_device_release\n\t\t\t\tget_device(\u0026idev-\u003edev)\nkfree(idev)\nuio_free_minor(minor)\n\t\t\t\tuio_release\n\t\t\t\tput_device(\u0026idev-\u003edev)\n\t\t\t\tkfree(idev)\n-------------------------------------------------------\n\nIn the core-1 uio_unregister_device(), the device_unregister will kfree\nidev when the idev-\u003edev kobject ref is 1. But after core-1\ndevice_unregister, put_device and before doing kfree, the core-2 may\nget_device. Then:\n1. After core-1 kfree idev, the core-2 will do use-after-free for idev.\n2. When core-2 do uio_release and put_device, the idev will be double\n   freed.\n\nTo address this issue, we can get idev atomic \u0026 inc idev reference with\nminor_lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "121de449-6e8b-4183-8077-7d3d1394e5ea",
      "id": "CVE-2024-35863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in is_valid_oplock_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dde8f026-8ff4-483d-8917-046264aa3517",
      "id": "CVE-2023-52561",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved\n\nAdding a reserved memory region for the framebuffer memory\n(the splash memory region set up by the bootloader).\n\nIt fixes a kernel panic (arm-smmu: Unhandled context fault\nat this particular memory region) reported on DB845c running\nv5.10.y.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "285d5067-9138-42d7-a8f4-694239984281",
      "id": "CVE-2023-52572",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix UAF in cifs_demultiplex_thread()\n\nThere is a UAF when xfstests on cifs:\n\n  BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160\n  Read of size 4 at addr ffff88810103fc08 by task cifsd/923\n\n  CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x44\n   print_report+0x171/0x472\n   kasan_report+0xad/0x130\n   kasan_check_range+0x145/0x1a0\n   smb2_is_network_name_deleted+0x27/0x160\n   cifs_demultiplex_thread.cold+0x172/0x5a4\n   kthread+0x165/0x1a0\n   ret_from_fork+0x1f/0x30\n   \u003c/TASK\u003e\n\n  Allocated by task 923:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   __kasan_slab_alloc+0x54/0x60\n   kmem_cache_alloc+0x147/0x320\n   mempool_alloc+0xe1/0x260\n   cifs_small_buf_get+0x24/0x60\n   allocate_buffers+0xa1/0x1c0\n   cifs_demultiplex_thread+0x199/0x10d0\n   kthread+0x165/0x1a0\n   ret_from_fork+0x1f/0x30\n\n  Freed by task 921:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   kasan_save_free_info+0x2a/0x40\n   ____kasan_slab_free+0x143/0x1b0\n   kmem_cache_free+0xe3/0x4d0\n   cifs_small_buf_release+0x29/0x90\n   SMB2_negotiate+0x8b7/0x1c60\n   smb2_negotiate+0x51/0x70\n   cifs_negotiate_protocol+0xf0/0x160\n   cifs_get_smb_ses+0x5fa/0x13c0\n   mount_get_conns+0x7a/0x750\n   cifs_mount+0x103/0xd00\n   cifs_smb3_do_mount+0x1dd/0xcb0\n   smb3_get_tree+0x1d5/0x300\n   vfs_get_tree+0x41/0xf0\n   path_mount+0x9b3/0xdd0\n   __x64_sys_mount+0x190/0x1d0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe UAF is because:\n\n mount(pid: 921)               | cifsd(pid: 923)\n-------------------------------|-------------------------------\n                               | cifs_demultiplex_thread\nSMB2_negotiate                 |\n cifs_send_recv                |\n  compound_send_recv           |\n   smb_send_rqst               |\n    wait_for_response          |\n     wait_event_state      [1] |\n                               |  standard_receive3\n                               |   cifs_handle_standard\n                               |    handle_mid\n                               |     mid-\u003eresp_buf = buf;  [2]\n                               |     dequeue_mid           [3]\n     KILL the process      [4] |\n    resp_iov[i].iov_base = buf |\n free_rsp_buf              [5] |\n                               |   is_network_name_deleted [6]\n                               |   callback\n\n1. After send request to server, wait the response until\n    mid-\u003emid_state != SUBMITTED;\n2. Receive response from server, and set it to mid;\n3. Set the mid state to RECEIVED;\n4. Kill the process, the mid state already RECEIVED, get 0;\n5. Handle and release the negotiate response;\n6. UAF.\n\nIt can be easily reproduce with add some delay in [3] - [6].\n\nOnly sync call has the problem since async call's callback is\nexecuted in cifsd process.\n\nAdd an extra state to mark the mid state to READY before wakeup the\nwaitter, then it can get the resp safely.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54cbeb02-3cf1-4f26-a48b-5feb4e87a948",
      "id": "CVE-2023-52604",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nFS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n\nSyzkaller reported the following issue:\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6\nindex 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]')\nCPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\n dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867\n dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834\n dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331\n dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]\n dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402\n txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534\n txUpdateMap+0x342/0x9e0\n txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\n jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732\n kthread+0x2d3/0x370 kernel/kthread.c:388\n ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n \u003c/TASK\u003e\n================================================================================\nKernel panic - not syncing: UBSAN: panic_on_warn set ...\nCPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n panic+0x30f/0x770 kernel/panic.c:340\n check_panic_on_warn+0x82/0xa0 kernel/panic.c:236\n ubsan_epilogue lib/ubsan.c:223 [inline]\n __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348\n dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867\n dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834\n dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331\n dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]\n dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402\n txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534\n txUpdateMap+0x342/0x9e0\n txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\n jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732\n kthread+0x2d3/0x370 kernel/kthread.c:388\n ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n \u003c/TASK\u003e\nKernel Offset: disabled\nRebooting in 86400 seconds..\n\nThe issue is caused when the value of lp becomes greater than\nCTLTREESIZE which is the max size of stree. Adding a simple check\nsolves this issue.\n\nDave:\nAs the function returns a void, good error handling\nwould require a more intrusive code reorganization, so I modified\nOsama's patch at use WARN_ON_ONCE for lack of a cleaner option.\n\nThe patch is tested via syzbot.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61b8cece-4b9c-4d09-8bbe-ac36407772d9",
      "id": "CVE-2023-52619",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: Fix crash when setting number of cpus to an odd number\n\nWhen the number of cpu cores is adjusted to 7 or other odd numbers,\nthe zone size will become an odd number.\nThe address of the zone will become:\n    addr of zone0 = BASE\n    addr of zone1 = BASE + zone_size\n    addr of zone2 = BASE + zone_size*2\n    ...\nThe address of zone1/3/5/7 will be mapped to non-alignment va.\nEventually crashes will occur when accessing these va.\n\nSo, use ALIGN_DOWN() to make sure the zone size is even\nto avoid this bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0ed59a7-5369-43cf-a30c-cfa8873158a5",
      "id": "CVE-2023-52752",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free bug in cifs_debug_data_proc_show()\n\nSkip SMB sessions that are being teared down\n(e.g. @ses-\u003eses_status == SES_EXITING) in cifs_debug_data_proc_show()\nto avoid use-after-free in @ses.\n\nThis fixes the following GPF when reading from /proc/fs/cifs/DebugData\nwhile mounting and umounting\n\n  [ 816.251274] general protection fault, probably for non-canonical\n  address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI\n  ...\n  [  816.260138] Call Trace:\n  [  816.260329]  \u003cTASK\u003e\n  [  816.260499]  ? die_addr+0x36/0x90\n  [  816.260762]  ? exc_general_protection+0x1b3/0x410\n  [  816.261126]  ? asm_exc_general_protection+0x26/0x30\n  [  816.261502]  ? cifs_debug_tcon+0xbd/0x240 [cifs]\n  [  816.261878]  ? cifs_debug_tcon+0xab/0x240 [cifs]\n  [  816.262249]  cifs_debug_data_proc_show+0x516/0xdb0 [cifs]\n  [  816.262689]  ? seq_read_iter+0x379/0x470\n  [  816.262995]  seq_read_iter+0x118/0x470\n  [  816.263291]  proc_reg_read_iter+0x53/0x90\n  [  816.263596]  ? srso_alias_return_thunk+0x5/0x7f\n  [  816.263945]  vfs_read+0x201/0x350\n  [  816.264211]  ksys_read+0x75/0x100\n  [  816.264472]  do_syscall_64+0x3f/0x90\n  [  816.264750]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n  [  816.265135] RIP: 0033:0x7fd5e669d381",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a052db94-baf0-40ec-b95e-220434e0cac4",
      "id": "CVE-2023-53139",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties\n\ndevm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause\nout-of-bounds write in device_property_read_u8_array later.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "253875cc-74bd-462b-949d-a9f70e816dd9",
      "id": "CVE-2023-53322",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Wait for io return on terminate rport\n\nSystem crash due to use after free.\nCurrent code allows terminate_rport_io to exit before making\nsure all IOs has returned. For FCP-2 device, IO's can hang\non in HW because driver has not tear down the session in FW at\nfirst sign of cable pull. When dev_loss_tmo timer pops,\nterminate_rport_io is called and upper layer is about to\nfree various resources. Terminate_rport_io trigger qla to do\nthe final cleanup, but the cleanup might not be fast enough where it\nleave qla still holding on to the same resource.\n\nWait for IO's to return to upper layer before resources are freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "296bf1b4-d941-4acb-8af7-fe7c017b7c76",
      "id": "CVE-2024-1151",
      "description": "A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ec2cf72-300a-4c38-85e1-56a2d4eee6e7",
      "id": "CVE-2024-26593",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: i801: Fix block process call transactions\n\nAccording to the Intel datasheets, software must reset the block\nbuffer index twice for block process call transactions: once before\nwriting the outgoing data to the buffer, and once again before\nreading the incoming data from the buffer.\n\nThe driver is currently missing the second reset, causing the wrong\nportion of the block buffer to be read.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d6f435c-49d0-43a8-bb97-465bf4e3f76c",
      "id": "CVE-2024-26654",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: sh: aica: reorder cleanup operations to avoid UAF bugs\n\nThe dreamcastcard-\u003etimer could schedule the spu_dma_work and the\nspu_dma_work could also arm the dreamcastcard-\u003etimer.\n\nWhen the snd_pcm_substream is closing, the aica_channel will be\ndeallocated. But it could still be dereferenced in the worker\nthread. The reason is that del_timer() will return directly\nregardless of whether the timer handler is running or not and\nthe worker could be rescheduled in the timer handler. As a result,\nthe UAF bug will happen. The racy situation is shown below:\n\n      (Thread 1)                 |      (Thread 2)\nsnd_aicapcm_pcm_close()          |\n ...                             |  run_spu_dma() //worker\n                                 |    mod_timer()\n  flush_work()                   |\n  del_timer()                    |  aica_period_elapsed() //timer\n  kfree(dreamcastcard-\u003echannel)  |    schedule_work()\n                                 |  run_spu_dma() //worker\n  ...                            |    dreamcastcard-\u003echannel-\u003e //USE\n\nIn order to mitigate this bug and other possible corner cases,\ncall mod_timer() conditionally in run_spu_dma(), then implement\nPCM sync_stop op to cancel both the timer and worker. The sync_stop\nop will be called from PCM core appropriately when needed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f99f975-633f-41be-825e-47aa080fca90",
      "id": "CVE-2024-26744",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Support specifying the srpt_service_guid parameter\n\nMake loading ib_srpt with this parameter set work. The current behavior is\nthat setting that parameter while loading the ib_srpt kernel module\ntriggers the following kernel crash:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCall Trace:\n \u003cTASK\u003e\n parse_one+0x18c/0x1d0\n parse_args+0xe1/0x230\n load_module+0x8de/0xa60\n init_module_from_file+0x8b/0xd0\n idempotent_init_module+0x181/0x240\n __x64_sys_finit_module+0x5a/0xb0\n do_syscall_64+0x5f/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e14ebc79-2f5a-4828-8ea6-54b6aeed8d43",
      "id": "CVE-2024-26754",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()\n\nThe gtp_net_ops pernet operations structure for the subsystem must be\nregistered before registering the generic netlink family.\n\nSyzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:\n\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\nCPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014\nRIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]\nCode: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86\n      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u003c80\u003e\n      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74\nRSP: 0018:ffff888014107220 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000\nFS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? show_regs+0x90/0xa0\n ? die_addr+0x50/0xd0\n ? exc_general_protection+0x148/0x220\n ? asm_exc_general_protection+0x22/0x30\n ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]\n ? __alloc_skb+0x1dd/0x350\n ? __pfx___alloc_skb+0x10/0x10\n genl_dumpit+0x11d/0x230\n netlink_dump+0x5b9/0xce0\n ? lockdep_hardirqs_on_prepare+0x253/0x430\n ? __pfx_netlink_dump+0x10/0x10\n ? kasan_save_track+0x10/0x40\n ? __kasan_kmalloc+0x9b/0xa0\n ? genl_start+0x675/0x970\n __netlink_dump_start+0x6fc/0x9f0\n genl_family_rcv_msg_dumpit+0x1bb/0x2d0\n ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10\n ? genl_op_from_small+0x2a/0x440\n ? cap_capable+0x1d0/0x240\n ? __pfx_genl_start+0x10/0x10\n ? __pfx_genl_dumpit+0x10/0x10\n ? __pfx_genl_done+0x10/0x10\n ? security_capable+0x9d/0xe0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39803fae-c152-4ffa-b130-5f0fc15f1b85",
      "id": "CVE-2025-38459",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix infinite recursive call of clip_push().\n\nsyzbot reported the splat below. [0]\n\nThis happens if we call ioctl(ATMARP_MKIP) more than once.\n\nDuring the first call, clip_mkip() sets clip_push() to vcc-\u003epush(),\nand the second call copies it to clip_vcc-\u003eold_push().\n\nLater, when the socket is close()d, vcc_destroy_socket() passes\nNULL skb to clip_push(), which calls clip_vcc-\u003eold_push(),\ntriggering the infinite recursion.\n\nLet's prevent the second ioctl(ATMARP_MKIP) by checking\nvcc-\u003euser_back, which is allocated by the first call as clip_vcc.\n\nNote also that we use lock_sock() to prevent racy calls.\n\n[0]:\nBUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000)\nOops: stack guard page: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191\nCode: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 \u003c41\u003e 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00\nRSP: 0018:ffffc9000d670000 EFLAGS: 00010246\nRAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000\nRBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e\nR10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300\nR13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578\nFS:  000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0\nCall Trace:\n \u003cTASK\u003e\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n...\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n vcc_destroy_socket net/atm/common.c:183 [inline]\n vcc_release+0x157/0x460 net/atm/common.c:205\n __sock_release net/socket.c:647 [inline]\n sock_close+0xc0/0x240 net/socket.c:1391\n __fput+0x449/0xa70 fs/file_table.c:465\n task_work_run+0x1d1/0x260 kernel/task_work.c:227\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114\n exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]\n syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]\n syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]\n do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7ff31c98e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4\nRAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929\nRDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003\nRBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f\nR10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c\nR13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090\n \u003c/TASK\u003e\nModules linked in:",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8bc1dcf-33b3-4243-a080-2922a970adba",
      "id": "CVE-2024-27075",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: avoid stack overflow warnings with clang\n\nA previous patch worked around a KASAN issue in stv0367, now a similar\nproblem showed up with clang:\n\ndrivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-Wframe-larger-than]\n 1214 | static int stv0367ter_set_frontend(struct dvb_frontend *fe)\n\nRework the stv0367_writereg() function to be simpler and mark both\nregister access functions as noinline_for_stack so the temporary\ni2c_msg structures do not get duplicated on the stack when KASAN_STACK\nis enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f964f721-6fdd-4e30-b995-eb8bfd534e69",
      "id": "CVE-2024-35930",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()\n\nThe call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an\nunsuccessful status.  In such cases, the elsiocb is not issued, the\ncompletion is not called, and thus the elsiocb resource is leaked.\n\nCheck return value after calling lpfc_sli4_resume_rpi() and conditionally\nrelease the elsiocb resource.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "559728b4-1c24-47f6-8115-edfd79733586",
      "id": "CVE-2024-35982",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Avoid infinite loop trying to resize local TT\n\nIf the MTU of one of an attached interface becomes too small to transmit\nthe local translation table then it must be resized to fit inside all\nfragments (when enabled) or a single packet.\n\nBut if the MTU becomes too low to transmit even the header + the VLAN\nspecific part then the resizing of the local TT will never succeed. This\ncan for example happen when the usable space is 110 bytes and 11 VLANs are\non top of batman-adv. In this case, at least 116 byte would be needed.\nThere will just be an endless spam of\n\n   batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)\n\nin the log but the function will never finish. Problem here is that the\ntimeout will be halved all the time and will then stagnate at 0 and\ntherefore never be able to reduce the table even more.\n\nThere are other scenarios possible with a similar result. The number of\nBATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too\nhigh to fit inside a packet. Such a scenario can therefore happen also with\nonly a single VLAN + 7 non-purgable addresses - requiring at least 120\nbytes.\n\nWhile this should be handled proactively when:\n\n* interface with too low MTU is added\n* VLAN is added\n* non-purgeable local mac is added\n* MTU of an attached interface is reduced\n* fragmentation setting gets disabled (which most likely requires dropping\n  attached interfaces)\n\nnot all of these scenarios can be prevented because batman-adv is only\nconsuming events without the the possibility to prevent these actions\n(non-purgable MAC address added, MTU of an attached interface is reduced).\nIt is therefore necessary to also make sure that the code is able to handle\nalso the situations when there were already incompatible system\nconfiguration are present.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e242645-163f-453e-bb8f-3329cd384c4b",
      "id": "CVE-2024-40943",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix races between hole punching and AIO+DIO\n\nAfter commit \"ocfs2: return real error code in ocfs2_dio_wr_get_block\",\nfstests/generic/300 become from always failed to sometimes failed:\n\n========================================================================\n[  473.293420 ] run fstests generic/300\n\n[  475.296983 ] JBD2: Ignoring recovery information on journal\n[  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.\n[  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found\n[  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.\n[  494.292018 ] OCFS2: File system is now read-only.\n[  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30\n[  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3\nfio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072\n=========================================================================\n\nIn __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten\nextents to a list.  extents are also inserted into extent tree in\nocfs2_write_begin_nolock.  Then another thread call fallocate to puch a\nhole at one of the unwritten extent.  The extent at cpos was removed by\nocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list\nfound there is no such extent at the cpos.\n\n    T1                        T2                T3\n                              inode lock\n                                ...\n                                insert extents\n                                ...\n                              inode unlock\nocfs2_fallocate\n __ocfs2_change_file_space\n  inode lock\n  lock ip_alloc_sem\n  ocfs2_remove_inode_range inode\n   ocfs2_remove_btree_range\n    ocfs2_remove_extent\n    ^---remove the extent at cpos 78723\n  ...\n  unlock ip_alloc_sem\n  inode unlock\n                                       ocfs2_dio_end_io\n                                        ocfs2_dio_end_io_write\n                                         lock ip_alloc_sem\n                                         ocfs2_mark_extent_written\n                                          ocfs2_change_extent_flag\n                                           ocfs2_search_extent_list\n                                           ^---failed to find extent\n                                          ...\n                                          unlock ip_alloc_sem\n\nIn most filesystems, fallocate is not compatible with racing with AIO+DIO,\nso fix it by adding to wait for all dio before fallocate/punch_hole like\next4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e342a8d7-8570-4767-bf5d-1fc3d6790acb",
      "id": "CVE-2024-41079",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: always initialize cqe.result\n\nThe spec doesn't mandate that the first two double words (aka results)\nfor the command queue entry need to be set to 0 when they are not\nused (not specified). Though, the target implemention returns 0 for TCP\nand FC but not for RDMA.\n\nLet's make RDMA behave the same and thus explicitly initializing the\nresult field. This prevents leaking any data from the stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2be25acf-923d-496d-a03f-719d2ac088e0",
      "id": "CVE-2025-38643",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()\n\nCallers of wdev_chandef() must hold the wiphy mutex.\n\nBut the worker cfg80211_propagate_cac_done_wk() never takes the lock.\nWhich triggers the warning below with the mesh_peer_connected_dfs\ntest from hostapd and not (yet) released mac80211 code changes:\n\nWARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165\nModules linked in:\nCPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf\nWorkqueue: cfg80211 cfg80211_propagate_cac_done_wk\nStack:\n 00000000 00000001 ffffff00 6093267c\n 00000000 6002ec30 6d577c50 60037608\n 00000000 67e8d108 6063717b 00000000\nCall Trace:\n [\u003c6002ec30\u003e] ? _printk+0x0/0x98\n [\u003c6003c2b3\u003e] show_stack+0x10e/0x11a\n [\u003c6002ec30\u003e] ? _printk+0x0/0x98\n [\u003c60037608\u003e] dump_stack_lvl+0x71/0xb8\n [\u003c6063717b\u003e] ? wdev_chandef+0x60/0x165\n [\u003c6003766d\u003e] dump_stack+0x1e/0x20\n [\u003c6005d1b7\u003e] __warn+0x101/0x20f\n [\u003c6005d3a8\u003e] warn_slowpath_fmt+0xe3/0x15d\n [\u003c600b0c5c\u003e] ? mark_lock.part.0+0x0/0x4ec\n [\u003c60751191\u003e] ? __this_cpu_preempt_check+0x0/0x16\n [\u003c600b11a2\u003e] ? mark_held_locks+0x5a/0x6e\n [\u003c6005d2c5\u003e] ? warn_slowpath_fmt+0x0/0x15d\n [\u003c60052e53\u003e] ? unblock_signals+0x3a/0xe7\n [\u003c60052f2d\u003e] ? um_set_signals+0x2d/0x43\n [\u003c60751191\u003e] ? __this_cpu_preempt_check+0x0/0x16\n [\u003c607508b2\u003e] ? lock_is_held_type+0x207/0x21f\n [\u003c6063717b\u003e] wdev_chandef+0x60/0x165\n [\u003c605f89b4\u003e] regulatory_propagate_dfs_state+0x247/0x43f\n [\u003c60052f00\u003e] ? um_set_signals+0x0/0x43\n [\u003c605e6bfd\u003e] cfg80211_propagate_cac_done_wk+0x3a/0x4a\n [\u003c6007e460\u003e] process_scheduled_works+0x3bc/0x60e\n [\u003c6007d0ec\u003e] ? move_linked_works+0x4d/0x81\n [\u003c6007d120\u003e] ? assign_work+0x0/0xaa\n [\u003c6007f81f\u003e] worker_thread+0x220/0x2dc\n [\u003c600786ef\u003e] ? set_pf_worker+0x0/0x57\n [\u003c60087c96\u003e] ? to_kthread+0x0/0x43\n [\u003c6008ab3c\u003e] kthread+0x2d3/0x2e2\n [\u003c6007f5ff\u003e] ? worker_thread+0x0/0x2dc\n [\u003c6006c05b\u003e] ? calculate_sigpending+0x0/0x56\n [\u003c6003b37d\u003e] new_thread_handler+0x4a/0x64\nirq event stamp: 614611\nhardirqs last  enabled at (614621): [\u003c00000000600bc96b\u003e] __up_console_sem+0x82/0xaf\nhardirqs last disabled at (614630): [\u003c00000000600bc92c\u003e] __up_console_sem+0x43/0xaf\nsoftirqs last  enabled at (614268): [\u003c00000000606c55c6\u003e] __ieee80211_wake_queue+0x933/0x985\nsoftirqs last disabled at (614266): [\u003c00000000606c52d6\u003e] __ieee80211_wake_queue+0x643/0x985",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c8aff7c-1082-43c9-be64-f9a2fc5f38ed",
      "id": "CVE-2024-43830",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: Unregister sysfs attributes before calling deactivate()\n\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\n\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\n\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\n\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c46d9a0b-9ced-4aea-95e9-cf13a1595ef3",
      "id": "CVE-2024-43871",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevres: Fix memory leakage caused by driver API devm_free_percpu()\n\nIt will cause memory leakage when use driver API devm_free_percpu()\nto free memory allocated by devm_alloc_percpu(), fixed by using\ndevres_release() instead of devres_destroy() within devm_free_percpu().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43bd07c8-2c2a-4f3d-b9a7-046972c8dfef",
      "id": "CVE-2024-48875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't take dev_replace rwsem on task already holding it\n\nRunning fstests btrfs/011 with MKFS_OPTIONS=\"-O rst\" to force the usage of\nthe RAID stripe-tree, we get the following splat from lockdep:\n\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\n\n ============================================\n WARNING: possible recursive locking detected\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\n --------------------------------------------\n btrfs/2326 is trying to acquire lock:\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n but task is already holding lock:\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n other info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n 1 lock held by btrfs/2326:\n  #0: ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n stack backtrace:\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x5b/0x80\n  __lock_acquire+0x2798/0x69d0\n  ? __pfx___lock_acquire+0x10/0x10\n  ? __pfx___lock_acquire+0x10/0x10\n  lock_acquire+0x19d/0x4a0\n  ? btrfs_map_block+0x39f/0x2250\n  ? __pfx_lock_acquire+0x10/0x10\n  ? find_held_lock+0x2d/0x110\n  ? lock_is_held_type+0x8f/0x100\n  down_read+0x8e/0x440\n  ? btrfs_map_block+0x39f/0x2250\n  ? __pfx_down_read+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  btrfs_map_block+0x39f/0x2250\n  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\n  ? __kasan_slab_alloc+0x6e/0x70\n  ? __pfx_btrfs_map_block+0x10/0x10\n  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\n  ? mempool_alloc_noprof+0xed/0x2b0\n  btrfs_submit_chunk+0x28d/0x17e0\n  ? __pfx_btrfs_submit_chunk+0x10/0x10\n  ? bvec_alloc+0xd7/0x1b0\n  ? bio_add_folio+0x171/0x270\n  ? __pfx_bio_add_folio+0x10/0x10\n  ? __kasan_check_read+0x20/0x20\n  btrfs_submit_bio+0x37/0x80\n  read_extent_buffer_pages+0x3df/0x6c0\n  btrfs_read_extent_buffer+0x13e/0x5f0\n  read_tree_block+0x81/0xe0\n  read_block_for_search+0x4bd/0x7a0\n  ? __pfx_read_block_for_search+0x10/0x10\n  btrfs_search_slot+0x78d/0x2720\n  ? __pfx_btrfs_search_slot+0x10/0x10\n  ? lock_is_held_type+0x8f/0x100\n  ? kasan_save_track+0x14/0x30\n  ? __kasan_slab_alloc+0x6e/0x70\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\n  btrfs_get_raid_extent_offset+0x181/0x820\n  ? __pfx_lock_acquire+0x10/0x10\n  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\n  ? down_read+0x194/0x440\n  ? __pfx_down_read+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  btrfs_map_block+0x5b5/0x2250\n  ? __pfx_btrfs_map_block+0x10/0x10\n  scrub_submit_initial_read+0x8fe/0x11b0\n  ? __pfx_scrub_submit_initial_read+0x10/0x10\n  submit_initial_group_read+0x161/0x3a0\n  ? lock_release+0x20e/0x710\n  ? __pfx_submit_initial_group_read+0x10/0x10\n  ? __pfx_lock_release+0x10/0x10\n  scrub_simple_mirror.isra.0+0x3eb/0x580\n  scrub_stripe+0xe4d/0x1440\n  ? lock_release+0x20e/0x710\n  ? __pfx_scrub_stripe+0x10/0x10\n  ? __pfx_lock_release+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  scrub_chunk+0x257/0x4a0\n  scrub_enumerate_chunks+0x64c/0xf70\n  ? __mutex_unlock_slowpath+0x147/0x5f0\n  ? __pfx_scrub_enumerate_chunks+0x10/0x10\n  ? bit_wait_timeout+0xb0/0x170\n  ? __up_read+0x189/0x700\n  ? scrub_workers_get+0x231/0x300\n  ? up_write+0x490/0x4f0\n  btrfs_scrub_dev+0x52e/0xcd0\n  ? create_pending_snapshots+0x230/0x250\n  ? __pfx_btrfs_scrub_dev+0x10/0x10\n  btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n  ? lock_acquire+0x19d/0x4a0\n  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\n  ?\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00ebfa9b-7c6c-4101-9e24-8451a6900eb0",
      "id": "CVE-2024-57898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: clear link ID from bitmap during link delete after clean up\n\nCurrently, during link deletion, the link ID is first removed from the\nvalid_links bitmap before performing any clean-up operations. However, some\nfunctions require the link ID to remain in the valid_links bitmap. One\nsuch example is cfg80211_cac_event(). The flow is -\n\nnl80211_remove_link()\n    cfg80211_remove_link()\n        ieee80211_del_intf_link()\n            ieee80211_vif_set_links()\n                ieee80211_vif_update_links()\n                    ieee80211_link_stop()\n                        cfg80211_cac_event()\n\ncfg80211_cac_event() requires link ID to be present but it is cleared\nalready in cfg80211_remove_link(). Ultimately, WARN_ON() is hit.\n\nTherefore, clear the link ID from the bitmap only after completing the link\nclean-up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ac41fca-7a35-4c55-a993-c8e8bbaccb01",
      "id": "CVE-2022-48850",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet-sysfs: add check for netdevice being present to speed_show\n\nWhen bringing down the netdevice or system shutdown, a panic can be\ntriggered while accessing the sysfs path because the device is already\nremoved.\n\n    [  755.549084] mlx5_core 0000:12:00.1: Shutdown was called\n    [  756.404455] mlx5_core 0000:12:00.0: Shutdown was called\n    ...\n    [  757.937260] BUG: unable to handle kernel NULL pointer dereference at           (null)\n    [  758.031397] IP: [\u003cffffffff8ee11acb\u003e] dma_pool_alloc+0x1ab/0x280\n\n    crash\u003e bt\n    ...\n    PID: 12649  TASK: ffff8924108f2100  CPU: 1   COMMAND: \"amsd\"\n    ...\n     #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778\n        [exception RIP: dma_pool_alloc+0x1ab]\n        RIP: ffffffff8ee11acb  RSP: ffff89240e1a3968  RFLAGS: 00010046\n        RAX: 0000000000000246  RBX: ffff89243d874100  RCX: 0000000000001000\n        RDX: 0000000000000000  RSI: 0000000000000246  RDI: ffff89243d874090\n        RBP: ffff89240e1a39c0   R8: 000000000001f080   R9: ffff8905ffc03c00\n        R10: ffffffffc04680d4  R11: ffffffff8edde9fd  R12: 00000000000080d0\n        R13: ffff89243d874090  R14: ffff89243d874080  R15: 0000000000000000\n        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n    #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core]\n    #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core]\n    #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core]\n    #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core]\n    #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core]\n    #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core]\n    #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core]\n    #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46\n    #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208\n    #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3\n    #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf\n    #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596\n    #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10\n    #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5\n    #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff\n    #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f\n    #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92\n\n    crash\u003e net_device.state ffff89443b0c0000\n      state = 0x5  (__LINK_STATE_START| __LINK_STATE_NOCARRIER)\n\nTo prevent this scenario, we also make sure that the netdevice is present.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02c7f9d6-5473-4e19-ad02-62d0b54efa69",
      "id": "CVE-2025-21894",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC\n\nActually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only\nENETC PF can access PMa_SINGLE_STEP registers. And there will be a crash\nif VFs are used to test one-step timestamp, the crash log as follows.\n\n[  129.110909] Unable to handle kernel paging request at virtual address 00000000000080c0\n[  129.287769] Call trace:\n[  129.290219]  enetc_port_mac_wr+0x30/0xec (P)\n[  129.294504]  enetc_start_xmit+0xda4/0xe74\n[  129.298525]  enetc_xmit+0x70/0xec\n[  129.301848]  dev_hard_start_xmit+0x98/0x118",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "723df3a3-cfdd-4827-b0a2-e9057ee7bd29",
      "id": "CVE-2025-21898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Avoid potential division by zero in function_stat_show()\n\nCheck whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64}\nproduce zero and skip stddev computation in that case.\n\nFor now don't care about rec-\u003ecounter * rec-\u003ecounter overflow because\nrec-\u003etime * rec-\u003etime overflow will likely happen earlier.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43653529-b41d-48b8-8702-86eb4f1f11c4",
      "id": "CVE-2025-22060",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: Prevent parser TCAM memory corruption\n\nProtect the parser TCAM/SRAM memory, and the cached (shadow) SRAM\ninformation, from concurrent modifications.\n\nBoth the TCAM and SRAM tables are indirectly accessed by configuring\nan index register that selects the row to read or write to. This means\nthat operations must be atomic in order to, e.g., avoid spreading\nwrites across multiple rows. Since the shadow SRAM array is used to\nfind free rows in the hardware table, it must also be protected in\norder to avoid TOCTOU errors where multiple cores allocate the same\nrow.\n\nThis issue was detected in a situation where `mvpp2_set_rx_mode()` ran\nconcurrently on two CPUs. In this particular case the\nMVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the\nclassifier unit to drop all incoming unicast - indicated by the\n`rx_classifier_drops` counter.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b52423ec-6b79-4daa-bf8a-5a4a6182e708",
      "id": "CVE-2025-37773",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: add filesystem context source name check\n\nIn certain scenarios, for example, during fuzz testing, the source\nname may be NULL, which could lead to a kernel panic. Therefore, an\nextra check for the source name should be added.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84b2b564-a537-4383-a810-a9930e8d36ce",
      "id": "CVE-2025-38157",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Abort software beacon handling if disabled\n\nA malicious USB device can send a WMI_SWBA_EVENTID event from an\nath9k_htc-managed device before beaconing has been enabled. This causes\na device-by-zero error in the driver, leading to either a crash or an\nout of bounds read.\n\nPrevent this by aborting the handling in ath9k_htc_swba() if beacons are\nnot enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "506c09b1-6878-4ccf-965d-2fc30f257e67",
      "id": "CVE-2025-38214",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var\n\nIf fb_add_videomode() in fb_set_var() fails to allocate memory for\nfb_videomode, later it may lead to a null-ptr dereference in\nfb_videomode_to_var(), as the fb_info is registered while not having the\nmode in modelist that is expected to be there, i.e. the one that is\ndescribed in fb_info-\u003evar.\n\n================================================================\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\nCall Trace:\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n================================================================\n\nThe reason is that fb_info-\u003evar is being modified in fb_set_var(), and\nthen fb_videomode_to_var() is called. If it fails to add the mode to\nfb_info-\u003emodelist, fb_set_var() returns error, but does not restore the\nold value of fb_info-\u003evar. Restore fb_info-\u003evar on failure the same way\nit is done earlier in the function.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c73dff0a-e5ab-41fb-b3ae-92cf0b050d69",
      "id": "CVE-2025-38234",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt: Fix race in push_rt_task\n\nOverview\n========\nWhen a CPU chooses to call push_rt_task and picks a task to push to\nanother CPU's runqueue then it will call find_lock_lowest_rq method\nwhich would take a double lock on both CPUs' runqueues. If one of the\nlocks aren't readily available, it may lead to dropping the current\nrunqueue lock and reacquiring both the locks at once. During this window\nit is possible that the task is already migrated and is running on some\nother CPU. These cases are already handled. However, if the task is\nmigrated and has already been executed and another CPU is now trying to\nwake it up (ttwu) such that it is queued again on the runqeue\n(on_rq is 1) and also if the task was run by the same CPU, then the\ncurrent checks will pass even though the task was migrated out and is no\nlonger in the pushable tasks list.\n\nCrashes\n=======\nThis bug resulted in quite a few flavors of crashes triggering kernel\npanics with various crash signatures such as assert failures, page\nfaults, null pointer dereferences, and queue corruption errors all\ncoming from scheduler itself.\n\nSome of the crashes:\n-\u003e kernel BUG at kernel/sched/rt.c:1616! BUG_ON(idx \u003e= MAX_RT_PRIO)\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? die+0x2a/0x50\n   ? do_trap+0x85/0x100\n   ? pick_next_task_rt+0x6e/0x1d0\n   ? do_error_trap+0x64/0xa0\n   ? pick_next_task_rt+0x6e/0x1d0\n   ? exc_invalid_op+0x4c/0x60\n   ? pick_next_task_rt+0x6e/0x1d0\n   ? asm_exc_invalid_op+0x12/0x20\n   ? pick_next_task_rt+0x6e/0x1d0\n   __schedule+0x5cb/0x790\n   ? update_ts_time_stats+0x55/0x70\n   schedule_idle+0x1e/0x40\n   do_idle+0x15e/0x200\n   cpu_startup_entry+0x19/0x20\n   start_secondary+0x117/0x160\n   secondary_startup_64_no_verify+0xb0/0xbb\n\n-\u003e BUG: kernel NULL pointer dereference, address: 00000000000000c0\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? no_context+0x183/0x350\n   ? __warn+0x8a/0xe0\n   ? exc_page_fault+0x3d6/0x520\n   ? asm_exc_page_fault+0x1e/0x30\n   ? pick_next_task_rt+0xb5/0x1d0\n   ? pick_next_task_rt+0x8c/0x1d0\n   __schedule+0x583/0x7e0\n   ? update_ts_time_stats+0x55/0x70\n   schedule_idle+0x1e/0x40\n   do_idle+0x15e/0x200\n   cpu_startup_entry+0x19/0x20\n   start_secondary+0x117/0x160\n   secondary_startup_64_no_verify+0xb0/0xbb\n\n-\u003e BUG: unable to handle page fault for address: ffff9464daea5900\n   kernel BUG at kernel/sched/rt.c:1861! BUG_ON(rq-\u003ecpu != task_cpu(p))\n\n-\u003e kernel BUG at kernel/sched/rt.c:1055! BUG_ON(!rq-\u003enr_running)\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? die+0x2a/0x50\n   ? do_trap+0x85/0x100\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   ? do_error_trap+0x64/0xa0\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   ? exc_invalid_op+0x4c/0x60\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   ? asm_exc_invalid_op+0x12/0x20\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   dequeue_rt_entity+0x1f/0x70\n   dequeue_task_rt+0x2d/0x70\n   __schedule+0x1a8/0x7e0\n   ? blk_finish_plug+0x25/0x40\n   schedule+0x3c/0xb0\n   futex_wait_queue_me+0xb6/0x120\n   futex_wait+0xd9/0x240\n   do_futex+0x344/0xa90\n   ? get_mm_exe_file+0x30/0x60\n   ? audit_exe_compare+0x58/0x70\n   ? audit_filter_rules.constprop.26+0x65e/0x1220\n   __x64_sys_futex+0x148/0x1f0\n   do_syscall_64+0x30/0x80\n   entry_SYSCALL_64_after_hwframe+0x62/0xc7\n\n-\u003e BUG: unable to handle page fault for address: ffff8cf3608bc2c0\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? no_context+0x183/0x350\n   ? spurious_kernel_fault+0x171/0x1c0\n   ? exc_page_fault+0x3b6/0x520\n   ? plist_check_list+0x15/0x40\n   ? plist_check_list+0x2e/0x40\n   ? asm_exc_page_fault+0x1e/0x30\n   ? _cond_resched+0x15/0x30\n   ? futex_wait_queue_me+0xc8/0x120\n   ? futex_wait+0xd9/0x240\n   ? try_to_wake_up+0x1b8/0x490\n   ? futex_wake+0x78/0x160\n   ? do_futex+0xcd/0xa90\n   ? plist_check_list+0x15/0x40\n   ? plist_check_list+0x2e/0x40\n   ? plist_del+0x6a/0xd0\n   ? plist_check_list+0x15/0x40\n   ? plist_check_list+0x2e/0x40\n   ? dequeue_pushable_task+0x20/0x70\n   ? __schedule+0x382/0x7e0\n   ? asm_sysvec_reschedule_i\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d01d0aa-3898-4c3f-baec-38b3580d7898",
      "id": "CVE-2020-14381",
      "description": "A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c02406f-2b74-44a2-af2a-52c157d55ec9",
      "id": "CVE-2020-15780",
      "description": "An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a89c867e-e340-4ee6-bbbd-7b911469917f",
      "id": "CVE-2020-25641",
      "description": "A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "877c809f-b6ad-4a24-af74-cdcbe09c55aa",
      "id": "CVE-2021-20268",
      "description": "An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83cc9a8e-694e-46a0-8e18-1d8082ad2ab2",
      "id": "CVE-2021-30002",
      "description": "An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c4e0978-bfe4-4508-bc6b-c37dc825677d",
      "id": "CVE-2021-38202",
      "description": "fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ac5f02f-c29b-4596-8af0-7f484a515bd2",
      "id": "CVE-2024-41098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: Fix null pointer dereference on error\n\nIf the ata_port_alloc() call in ata_host_alloc() fails,\nata_host_release() will get called.\n\nHowever, the code in ata_host_release() tries to free ata_port struct\nmembers unconditionally, which can lead to the following:\n\nBUG: unable to handle page fault for address: 0000000000003990\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:ata_host_release.cold+0x2f/0x6e [libata]\nCode: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41\nRSP: 0018:ffffc90000ebb968 EFLAGS: 00010246\nRAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0\nRBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68\nR10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004\nR13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006\nFS:  00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __die_body.cold+0x19/0x27\n ? page_fault_oops+0x15a/0x2f0\n ? exc_page_fault+0x7e/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? ata_host_release.cold+0x2f/0x6e [libata]\n ? ata_host_release.cold+0x2f/0x6e [libata]\n release_nodes+0x35/0xb0\n devres_release_group+0x113/0x140\n ata_host_alloc+0xed/0x120 [libata]\n ata_host_alloc_pinfo+0x14/0xa0 [libata]\n ahci_init_one+0x6c9/0xd20 [ahci]\n\nDo not access ata_port struct members unconditionally.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d31a8e04-9a89-4910-b0b7-64de26c00908",
      "id": "CVE-2021-41864",
      "description": "prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dae8b955-c26e-4bad-8c2f-5f4c45f0992d",
      "id": "CVE-2021-45402",
      "description": "The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a \"pointer leak.\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "642071e7-506a-46ec-b32c-97356cb78e86",
      "id": "CVE-2021-46939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Restructure trace_clock_global() to never block\n\nIt was reported that a fix to the ring buffer recursion detection would\ncause a hung machine when performing suspend / resume testing. The\nfollowing backtrace was extracted from debugging that case:\n\nCall Trace:\n trace_clock_global+0x91/0xa0\n __rb_reserve_next+0x237/0x460\n ring_buffer_lock_reserve+0x12a/0x3f0\n trace_buffer_lock_reserve+0x10/0x50\n __trace_graph_return+0x1f/0x80\n trace_graph_return+0xb7/0xf0\n ? trace_clock_global+0x91/0xa0\n ftrace_return_to_handler+0x8b/0xf0\n ? pv_hash+0xa0/0xa0\n return_to_handler+0x15/0x30\n ? ftrace_graph_caller+0xa0/0xa0\n ? trace_clock_global+0x91/0xa0\n ? __rb_reserve_next+0x237/0x460\n ? ring_buffer_lock_reserve+0x12a/0x3f0\n ? trace_event_buffer_lock_reserve+0x3c/0x120\n ? trace_event_buffer_reserve+0x6b/0xc0\n ? trace_event_raw_event_device_pm_callback_start+0x125/0x2d0\n ? dpm_run_callback+0x3b/0xc0\n ? pm_ops_is_empty+0x50/0x50\n ? platform_get_irq_byname_optional+0x90/0x90\n ? trace_device_pm_callback_start+0x82/0xd0\n ? dpm_run_callback+0x49/0xc0\n\nWith the following RIP:\n\nRIP: 0010:native_queued_spin_lock_slowpath+0x69/0x200\n\nSince the fix to the recursion detection would allow a single recursion to\nhappen while tracing, this lead to the trace_clock_global() taking a spin\nlock and then trying to take it again:\n\nring_buffer_lock_reserve() {\n  trace_clock_global() {\n    arch_spin_lock() {\n      queued_spin_lock_slowpath() {\n        /* lock taken */\n        (something else gets traced by function graph tracer)\n          ring_buffer_lock_reserve() {\n            trace_clock_global() {\n              arch_spin_lock() {\n                queued_spin_lock_slowpath() {\n                /* DEAD LOCK! */\n\nTracing should *never* block, as it can lead to strange lockups like the\nabove.\n\nRestructure the trace_clock_global() code to instead of simply taking a\nlock to update the recorded \"prev_time\" simply use it, as two events\nhappening on two different CPUs that calls this at the same time, really\ndoesn't matter which one goes first. Use a trylock to grab the lock for\nupdating the prev_time, and if it fails, simply try again the next time.\nIf it failed to be taken, that means something else is already updating\nit.\n\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212761",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "368094e5-74d1-47ae-aabc-ee0aedb8f82a",
      "id": "CVE-2021-46963",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()\n\n    RIP: 0010:kmem_cache_free+0xfa/0x1b0\n    Call Trace:\n       qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]\n       scsi_queue_rq+0x5e2/0xa40\n       __blk_mq_try_issue_directly+0x128/0x1d0\n       blk_mq_request_issue_directly+0x4e/0xb0\n\nFix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now\nallocated by upper layers. This fixes smatch warning of srb unintended\nfree.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c02dd40-8e66-4aa6-a6ac-794a4e3f6bae",
      "id": "CVE-2021-46992",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nftables: avoid overflows in nft_hash_buckets()\n\nNumber of buckets being stored in 32bit variables, we have to\nensure that no overflows occur in nft_hash_buckets()\n\nsyzbot injected a size == 0x40000000 and reported:\n\nUBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13\nshift exponent 64 is too large for 64-bit type 'long unsigned int'\nCPU: 1 PID: 29539 Comm: syz-executor.4 Not tainted 5.12.0-rc7-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:79 [inline]\n dump_stack+0x141/0x1d7 lib/dump_stack.c:120\n ubsan_epilogue+0xb/0x5a lib/ubsan.c:148\n __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327\n __roundup_pow_of_two include/linux/log2.h:57 [inline]\n nft_hash_buckets net/netfilter/nft_set_hash.c:411 [inline]\n nft_hash_estimate.cold+0x19/0x1e net/netfilter/nft_set_hash.c:652\n nft_select_set_ops net/netfilter/nf_tables_api.c:3586 [inline]\n nf_tables_newset+0xe62/0x3110 net/netfilter/nf_tables_api.c:4322\n nfnetlink_rcv_batch+0xa09/0x24b0 net/netfilter/nfnetlink.c:488\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:612 [inline]\n nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:630\n netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338\n netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927\n sock_sendmsg_nosec net/socket.c:654 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:674\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2404\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29c32a06-fd66-40d9-a049-c4e7e678c1cf",
      "id": "CVE-2021-47073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios\n\ninit_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems\nwhere the Dell WMI interface is supported. While exit_dell_smbios_wmi()\nunregisters it unconditionally, this leads to the following oops:\n\n[  175.722921] ------------[ cut here ]------------\n[  175.722925] Unexpected driver unregister!\n[  175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40\n...\n[  175.723089] Call Trace:\n[  175.723094]  cleanup_module+0x5/0xedd [dell_smbios]\n...\n[  175.723148] ---[ end trace 064c34e1ad49509d ]---\n\nMake the unregister happen on the same condition the register happens\nto fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cf62c9f-c7cb-465e-b6f4-28be6986e591",
      "id": "CVE-2021-47194",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncfg80211: call cfg80211_stop_ap when switch from P2P_GO type\n\nIf the userspace tools switch from NL80211_IFTYPE_P2P_GO to\nNL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it\ndoes not call the cleanup cfg80211_stop_ap(), this leads to the\ninitialization of in-use data. For example, this path re-init the\nsdata-\u003eassigned_chanctx_list while it is still an element of\nassigned_vifs list, and makes that linked list corrupt.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a47db426-5117-4c27-8f99-a128f9fa977c",
      "id": "CVE-2021-47259",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix use-after-free in nfs4_init_client()\n\nKASAN reports a use-after-free when attempting to mount two different\nexports through two different NICs that belong to the same server.\n\nOlga was able to hit this with kernels starting somewhere between 5.7\nand 5.10, but I traced the patch that introduced the clear_bit() call to\n4.13. So something must have changed in the refcounting of the clp\npointer to make this call to nfs_put_client() the very last one.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "423822b7-9186-4a68-b904-5484dacc7611",
      "id": "CVE-2021-47333",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: alcor_pci: fix null-ptr-deref when there is no PCI bridge\n\nThere is an issue with the ASPM(optional) capability checking function.\nA device might be attached to root complex directly, in this case,\nbus-\u003eself(bridge) will be NULL, thus priv-\u003eparent_pdev is NULL.\nSince alcor_pci_init_check_aspm(priv-\u003eparent_pdev) checks the PCI link's\nASPM capability and populate parent_cap_off, which will be used later by\nalcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do\nhere is to avoid checking the capability if we are on the root complex.\nThis will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply\nreturn when bring called, effectively disable ASPM for the device.\n\n[    1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[    1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40\n[    1.253998] Call Trace:\n[    1.254131]  ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci]\n[    1.254476]  alcor_pci_probe+0x169/0x2d5 [alcor_pci]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f15ce8e-04e4-458c-9992-5ad3287775a3",
      "id": "CVE-2021-47352",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: Add validation for used length\n\nThis adds validation for used length (might come\nfrom an untrusted device) to avoid data corruption\nor loss.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f9b8fab-d0c5-46d7-9ee3-af098743e2e7",
      "id": "CVE-2021-47378",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\n\nWe should always destroy cm_id before destroy qp to avoid to get cma\nevent after qp was destroyed, which may lead to use after free.\nIn RDMA connection establishment error flow, don't destroy qp in cm\nevent handler.Just report cm_error to upper level, qp will be destroy\nin nvme_rdma_alloc_queue() after destroy cm id.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a20078af-4cd8-4ee4-84fa-ea6146908fee",
      "id": "CVE-2021-47423",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/debugfs: fix file release memory leak\n\nWhen using single_open() for opening, single_release() should be\ncalled, otherwise the 'op' allocated in single_open() will be leaked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8629d675-4ced-4009-ad69-e812e23d7b49",
      "id": "CVE-2021-47509",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Limit the period size to 16MB\n\nSet the practical limit to the period size (the fragment shift in OSS)\ninstead of a full 31bit; a too large value could lead to the exhaust\nof memory as we allocate temporary buffers of the period size, too.\n\nAs of this patch, we set to 16MB limit, which should cover all use\ncases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "998cb48c-ab5a-4993-8c73-9a7383904be5",
      "id": "CVE-2021-47622",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: Fix a deadlock in the error handler\n\nThe following deadlock has been observed on a test setup:\n\n - All tags allocated\n\n - The SCSI error handler calls ufshcd_eh_host_reset_handler()\n\n - ufshcd_eh_host_reset_handler() queues work that calls\n   ufshcd_err_handler()\n\n - ufshcd_err_handler() locks up as follows:\n\nWorkqueue: ufs_eh_wq_0 ufshcd_err_handler.cfi_jt\nCall trace:\n __switch_to+0x298/0x5d8\n __schedule+0x6cc/0xa94\n schedule+0x12c/0x298\n blk_mq_get_tag+0x210/0x480\n __blk_mq_alloc_request+0x1c8/0x284\n blk_get_request+0x74/0x134\n ufshcd_exec_dev_cmd+0x68/0x640\n ufshcd_verify_dev_init+0x68/0x35c\n ufshcd_probe_hba+0x12c/0x1cb8\n ufshcd_host_reset_and_restore+0x88/0x254\n ufshcd_reset_and_restore+0xd0/0x354\n ufshcd_err_handler+0x408/0xc58\n process_one_work+0x24c/0x66c\n worker_thread+0x3e8/0xa4c\n kthread+0x150/0x1b4\n ret_from_fork+0x10/0x30\n\nFix this lockup by making ufshcd_exec_dev_cmd() allocate a reserved\nrequest.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3ce1108-e756-4dc4-940c-1574ab5acd97",
      "id": "CVE-2022-0171",
      "description": "A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "572939a1-f78d-485b-9ca4-1be02d131056",
      "id": "CVE-2022-0382",
      "description": "An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6adf9bbb-4561-4b69-b5a1-517380a5d5da",
      "id": "CVE-2022-1205",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a90ffcf-142f-4eea-afd8-01157d246e60",
      "id": "CVE-2022-25636",
      "description": "net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b60878a3-1770-4e8e-bbec-6d2b0eb6e6cc",
      "id": "CVE-2022-28356",
      "description": "In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6a4c96f0-1903-4060-8cd7-c83a35819027",
      "id": "CVE-2022-30594",
      "description": "The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f64b691c-4fcf-40fc-8b9f-c2a35fce4216",
      "id": "CVE-2022-4378",
      "description": "A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "010ec525-3c42-4ea5-85ba-61e419b7adbe",
      "id": "CVE-2022-48738",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Reject out of bounds values in snd_soc_put_volsw()\n\nWe don't currently validate that the values being set are within the range\nwe advertised to userspace as being valid, do so and reject any values\nthat are out of range.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3cf6c1d9-c07c-4bfc-9708-e6d5a50c315e",
      "id": "CVE-2022-48786",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: remove vsock from connected table when connect is interrupted by a signal\n\nvsock_connect() expects that the socket could already be in the\nTCP_ESTABLISHED state when the connecting task wakes up with a signal\npending. If this happens the socket will be in the connected table, and\nit is not removed when the socket state is reset. In this situation it's\ncommon for the process to retry connect(), and if the connection is\nsuccessful the socket will be added to the connected table a second\ntime, corrupting the list.\n\nPrevent this by calling vsock_remove_connected() if a signal is received\nwhile waiting for a connection. This is harmless if the socket is not in\nthe connected table, and if it is in the table then removing it will\nprevent list corruption from a double add.\n\nNote for backporting: this patch requires d5afa82c977e (\"vsock: correct\nremoval of socket from the list\"), which is in all current stable trees\nexcept 4.9.y.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23596f6a-e6e5-4e6d-9d69-aa8031eb75ab",
      "id": "CVE-2022-48802",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: task_mmu.c: don't read mapcount for migration entry\n\nThe syzbot reported the below BUG:\n\n  kernel BUG at include/linux/page-flags.h:785!\n  invalid opcode: 0000 [#1] PREEMPT SMP KASAN\n  CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline]\n  RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744\n  Call Trace:\n    page_mapcount include/linux/mm.h:837 [inline]\n    smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466\n    smaps_pte_entry fs/proc/task_mmu.c:538 [inline]\n    smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601\n    walk_pmd_range mm/pagewalk.c:128 [inline]\n    walk_pud_range mm/pagewalk.c:205 [inline]\n    walk_p4d_range mm/pagewalk.c:240 [inline]\n    walk_pgd_range mm/pagewalk.c:277 [inline]\n    __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379\n    walk_page_vma+0x277/0x350 mm/pagewalk.c:530\n    smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768\n    smap_gather_stats fs/proc/task_mmu.c:741 [inline]\n    show_smap+0xc6/0x440 fs/proc/task_mmu.c:822\n    seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272\n    seq_read+0x3e0/0x5b0 fs/seq_file.c:162\n    vfs_read+0x1b5/0x600 fs/read_write.c:479\n    ksys_read+0x12d/0x250 fs/read_write.c:619\n    do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n    entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe reproducer was trying to read /proc/$PID/smaps when calling\nMADV_FREE at the mean time.  MADV_FREE may split THPs if it is called\nfor partial THP.  It may trigger the below race:\n\n           CPU A                         CPU B\n           -----                         -----\n  smaps walk:                      MADV_FREE:\n  page_mapcount()\n    PageCompound()\n                                   split_huge_page()\n    page = compound_head(page)\n    PageDoubleMap(page)\n\nWhen calling PageDoubleMap() this page is not a tail page of THP anymore\nso the BUG is triggered.\n\nThis could be fixed by elevated refcount of the page before calling\nmapcount, but that would prevent it from counting migration entries, and\nit seems overkilling because the race just could happen when PMD is\nsplit so all PTE entries of tail pages are actually migration entries,\nand smaps_account() does treat migration entries as mapcount == 1 as\nKirill pointed out.\n\nAdd a new parameter for smaps_account() to tell this entry is migration\nentry then skip calling page_mapcount().  Don't skip getting mapcount\nfor device private entries since they do track references with mapcount.\n\nPagemap also has the similar issue although it was not reported.  Fixed\nit as well.\n\n[shy828301@gmail.com: v4]\n[nathan@kernel.org: avoid unused variable warning in pagemap_pmd_range()]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a514f395-eb3c-481d-9857-988f374ec8a9",
      "id": "CVE-2022-48829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes\n\niattr::ia_size is a loff_t, so these NFSv3 procedures must be\ncareful to deal with incoming client size values that are larger\nthan s64_max without corrupting the value.\n\nSilently capping the value results in storing a different value\nthan the client passed in which is unexpected behavior, so remove\nthe min_t() check in decode_sattr3().\n\nNote that RFC 1813 permits only the WRITE procedure to return\nNFS3ERR_FBIG. We believe that NFSv3 reference implementations\nalso return NFS3ERR_FBIG when ia_size is too large.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc38baba-c202-4611-8c26-84256623ca14",
      "id": "CVE-2022-48951",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()\n\nThe bounds checks in snd_soc_put_volsw_sx() are only being applied to the\nfirst channel, meaning it is possible to write out of bounds values to the\nsecond channel in stereo controls. Add appropriate checks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd5efa0a-fa0a-46e7-8f2d-23d7ffb56a26",
      "id": "CVE-2022-48999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Handle attempt to delete multipath route when fib_info contains an nh reference\n\nGwangun Jung reported a slab-out-of-bounds access in fib_nh_match:\n    fib_nh_match+0xf98/0x1130 linux-6.0-rc7/net/ipv4/fib_semantics.c:961\n    fib_table_delete+0x5f3/0xa40 linux-6.0-rc7/net/ipv4/fib_trie.c:1753\n    inet_rtm_delroute+0x2b3/0x380 linux-6.0-rc7/net/ipv4/fib_frontend.c:874\n\nSeparate nexthop objects are mutually exclusive with the legacy\nmultipath spec. Fix fib_nh_match to return if the config for the\nto be deleted route contains a multipath spec while the fib_info\nis using a nexthop object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6675aa07-af95-45bf-b103-ccf390c8bf92",
      "id": "CVE-2022-49051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: aqc111: Fix out-of-bounds accesses in RX fixup\n\naqc111_rx_fixup() contains several out-of-bounds accesses that can be\ntriggered by a malicious (or defective) USB device, in particular:\n\n - The metadata array (desc_offset..desc_offset+2*pkt_count) can be out of bounds,\n   causing OOB reads and (on big-endian systems) OOB endianness flips.\n - A packet can overlap the metadata array, causing a later OOB\n   endianness flip to corrupt data used by a cloned SKB that has already\n   been handed off into the network stack.\n - A packet SKB can be constructed whose tail is far beyond its end,\n   causing out-of-bounds heap data to be considered part of the SKB's\n   data.\n\nFound doing variant analysis. Tested it with another driver (ax88179_178a), since\nI don't have a aqc111 device to test it, but the code looks very similar.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a691b347-4f03-4c53-b6d8-4e76ea0b77e3",
      "id": "CVE-2022-49095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()\n\nThe error handling path of the probe releases a resource that is not freed\nin the remove function. In some cases, a ioremap() must be undone.\n\nAdd the missing iounmap() call in the remove function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2163164e-faa1-449c-b199-691da4c4b18a",
      "id": "CVE-2022-49107",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix memory leak in ceph_readdir when note_last_dentry returns error\n\nReset the last_readdir at the same time, and add a comment explaining\nwhy we don't free last_readdir when dir_emit returns false.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ca7d17d-b473-437e-a1a1-25d93abe35a1",
      "id": "CVE-2022-49118",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Free irq vectors in order for v3 HW\n\nIf the driver probe fails to request the channel IRQ or fatal IRQ, the\ndriver will free the IRQ vectors before freeing the IRQs in free_irq(),\nand this will cause a kernel BUG like this:\n\n------------[ cut here ]------------\nkernel BUG at drivers/pci/msi.c:369!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\nCall trace:\n   free_msi_irqs+0x118/0x13c\n   pci_disable_msi+0xfc/0x120\n   pci_free_irq_vectors+0x24/0x3c\n   hisi_sas_v3_probe+0x360/0x9d0 [hisi_sas_v3_hw]\n   local_pci_probe+0x44/0xb0\n   work_for_cpu_fn+0x20/0x34\n   process_one_work+0x1d0/0x340\n   worker_thread+0x2e0/0x460\n   kthread+0x180/0x190\n   ret_from_fork+0x10/0x20\n---[ end trace b88990335b610c11 ]---\n\nSo we use devm_add_action() to control the order in which we free the\nvectors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4845f00-b2ed-4de7-9ee7-c1afa8a12496",
      "id": "CVE-2022-49175",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: core: keep irq flags in device_pm_check_callbacks()\n\nThe function device_pm_check_callbacks() can be called under the spin\nlock (in the reported case it happens from genpd_add_device() -\u003e\ndev_pm_domain_set(), when the genpd uses spinlocks rather than mutexes.\n\nHowever this function uncoditionally uses spin_lock_irq() /\nspin_unlock_irq(), thus not preserving the CPU flags. Use the\nirqsave/irqrestore instead.\n\nThe backtrace for the reference:\n[    2.752010] ------------[ cut here ]------------\n[    2.756769] raw_local_irq_restore() called with IRQs enabled\n[    2.762596] WARNING: CPU: 4 PID: 1 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x34/0x50\n[    2.772338] Modules linked in:\n[    2.775487] CPU: 4 PID: 1 Comm: swapper/0 Tainted: G S                5.17.0-rc6-00384-ge330d0d82eff-dirty #684\n[    2.781384] Freeing initrd memory: 46024K\n[    2.785839] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    2.785841] pc : warn_bogus_irq_restore+0x34/0x50\n[    2.785844] lr : warn_bogus_irq_restore+0x34/0x50\n[    2.785846] sp : ffff80000805b7d0\n[    2.785847] x29: ffff80000805b7d0 x28: 0000000000000000 x27: 0000000000000002\n[    2.785850] x26: ffffd40e80930b18 x25: ffff7ee2329192b8 x24: ffff7edfc9f60800\n[    2.785853] x23: ffffd40e80930b18 x22: ffffd40e80930d30 x21: ffff7edfc0dffa00\n[    2.785856] x20: ffff7edfc09e3768 x19: 0000000000000000 x18: ffffffffffffffff\n[    2.845775] x17: 6572206f74206465 x16: 6c696166203a3030 x15: ffff80008805b4f7\n[    2.853108] x14: 0000000000000000 x13: ffffd40e809550b0 x12: 00000000000003d8\n[    2.860441] x11: 0000000000000148 x10: ffffd40e809550b0 x9 : ffffd40e809550b0\n[    2.867774] x8 : 00000000ffffefff x7 : ffffd40e809ad0b0 x6 : ffffd40e809ad0b0\n[    2.875107] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000\n[    2.882440] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff7edfc03a8000\n[    2.889774] Call trace:\n[    2.892290]  warn_bogus_irq_restore+0x34/0x50\n[    2.896770]  _raw_spin_unlock_irqrestore+0x94/0xa0\n[    2.901690]  genpd_unlock_spin+0x20/0x30\n[    2.905724]  genpd_add_device+0x100/0x2d0\n[    2.909850]  __genpd_dev_pm_attach+0xa8/0x23c\n[    2.914329]  genpd_dev_pm_attach_by_id+0xc4/0x190\n[    2.919167]  genpd_dev_pm_attach_by_name+0x3c/0xd0\n[    2.924086]  dev_pm_domain_attach_by_name+0x24/0x30\n[    2.929102]  psci_dt_attach_cpu+0x24/0x90\n[    2.933230]  psci_cpuidle_probe+0x2d4/0x46c\n[    2.937534]  platform_probe+0x68/0xe0\n[    2.941304]  really_probe.part.0+0x9c/0x2fc\n[    2.945605]  __driver_probe_device+0x98/0x144\n[    2.950085]  driver_probe_device+0x44/0x15c\n[    2.954385]  __device_attach_driver+0xb8/0x120\n[    2.958950]  bus_for_each_drv+0x78/0xd0\n[    2.962896]  __device_attach+0xd8/0x180\n[    2.966843]  device_initial_probe+0x14/0x20\n[    2.971144]  bus_probe_device+0x9c/0xa4\n[    2.975092]  device_add+0x380/0x88c\n[    2.978679]  platform_device_add+0x114/0x234\n[    2.983067]  platform_device_register_full+0x100/0x190\n[    2.988344]  psci_idle_init+0x6c/0xb0\n[    2.992113]  do_one_initcall+0x74/0x3a0\n[    2.996060]  kernel_init_freeable+0x2fc/0x384\n[    3.000543]  kernel_init+0x28/0x130\n[    3.004132]  ret_from_fork+0x10/0x20\n[    3.007817] irq event stamp: 319826\n[    3.011404] hardirqs last  enabled at (319825): [\u003cffffd40e7eda0268\u003e] __up_console_sem+0x78/0x84\n[    3.020332] hardirqs last disabled at (319826): [\u003cffffd40e7fd6d9d8\u003e] el1_dbg+0x24/0x8c\n[    3.028458] softirqs last  enabled at (318312): [\u003cffffd40e7ec90410\u003e] _stext+0x410/0x588\n[    3.036678] softirqs last disabled at (318299): [\u003cffffd40e7ed1bf68\u003e] __irq_exit_rcu+0x158/0x174\n[    3.045607] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "68e1e33d-9a49-432a-a3b1-9f16824569f4",
      "id": "CVE-2022-49178",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick/mspro_block: fix handling of read-only devices\n\nUse set_disk_ro to propagate the read-only state to the block layer\ninstead of checking for it in -\u003eopen and leaking a reference in case\nof a read-only device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8838b505-6943-4d91-82a5-906f15f7c58f",
      "id": "CVE-2022-49179",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: don't move oom_bfqq\n\nOur test report a UAF:\n\n[ 2073.019181] ==================================================================\n[ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168\n[ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584\n[ 2073.019192]\n[ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5\n[ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n[ 2073.019200] Call trace:\n[ 2073.019203]  dump_backtrace+0x0/0x310\n[ 2073.019206]  show_stack+0x28/0x38\n[ 2073.019210]  dump_stack+0xec/0x15c\n[ 2073.019216]  print_address_description+0x68/0x2d0\n[ 2073.019220]  kasan_report+0x238/0x2f0\n[ 2073.019224]  __asan_store8+0x88/0xb0\n[ 2073.019229]  __bfq_put_async_bfqq+0xa0/0x168\n[ 2073.019233]  bfq_put_async_queues+0xbc/0x208\n[ 2073.019236]  bfq_pd_offline+0x178/0x238\n[ 2073.019240]  blkcg_deactivate_policy+0x1f0/0x420\n[ 2073.019244]  bfq_exit_queue+0x128/0x178\n[ 2073.019249]  blk_mq_exit_sched+0x12c/0x160\n[ 2073.019252]  elevator_exit+0xc8/0xd0\n[ 2073.019256]  blk_exit_queue+0x50/0x88\n[ 2073.019259]  blk_cleanup_queue+0x228/0x3d8\n[ 2073.019267]  null_del_dev+0xfc/0x1e0 [null_blk]\n[ 2073.019274]  null_exit+0x90/0x114 [null_blk]\n[ 2073.019278]  __arm64_sys_delete_module+0x358/0x5a0\n[ 2073.019282]  el0_svc_common+0xc8/0x320\n[ 2073.019287]  el0_svc_handler+0xf8/0x160\n[ 2073.019290]  el0_svc+0x10/0x218\n[ 2073.019291]\n[ 2073.019294] Allocated by task 14163:\n[ 2073.019301]  kasan_kmalloc+0xe0/0x190\n[ 2073.019305]  kmem_cache_alloc_node_trace+0x1cc/0x418\n[ 2073.019308]  bfq_pd_alloc+0x54/0x118\n[ 2073.019313]  blkcg_activate_policy+0x250/0x460\n[ 2073.019317]  bfq_create_group_hierarchy+0x38/0x110\n[ 2073.019321]  bfq_init_queue+0x6d0/0x948\n[ 2073.019325]  blk_mq_init_sched+0x1d8/0x390\n[ 2073.019330]  elevator_switch_mq+0x88/0x170\n[ 2073.019334]  elevator_switch+0x140/0x270\n[ 2073.019338]  elv_iosched_store+0x1a4/0x2a0\n[ 2073.019342]  queue_attr_store+0x90/0xe0\n[ 2073.019348]  sysfs_kf_write+0xa8/0xe8\n[ 2073.019351]  kernfs_fop_write+0x1f8/0x378\n[ 2073.019359]  __vfs_write+0xe0/0x360\n[ 2073.019363]  vfs_write+0xf0/0x270\n[ 2073.019367]  ksys_write+0xdc/0x1b8\n[ 2073.019371]  __arm64_sys_write+0x50/0x60\n[ 2073.019375]  el0_svc_common+0xc8/0x320\n[ 2073.019380]  el0_svc_handler+0xf8/0x160\n[ 2073.019383]  el0_svc+0x10/0x218\n[ 2073.019385]\n[ 2073.019387] Freed by task 72584:\n[ 2073.019391]  __kasan_slab_free+0x120/0x228\n[ 2073.019394]  kasan_slab_free+0x10/0x18\n[ 2073.019397]  kfree+0x94/0x368\n[ 2073.019400]  bfqg_put+0x64/0xb0\n[ 2073.019404]  bfqg_and_blkg_put+0x90/0xb0\n[ 2073.019408]  bfq_put_queue+0x220/0x228\n[ 2073.019413]  __bfq_put_async_bfqq+0x98/0x168\n[ 2073.019416]  bfq_put_async_queues+0xbc/0x208\n[ 2073.019420]  bfq_pd_offline+0x178/0x238\n[ 2073.019424]  blkcg_deactivate_policy+0x1f0/0x420\n[ 2073.019429]  bfq_exit_queue+0x128/0x178\n[ 2073.019433]  blk_mq_exit_sched+0x12c/0x160\n[ 2073.019437]  elevator_exit+0xc8/0xd0\n[ 2073.019440]  blk_exit_queue+0x50/0x88\n[ 2073.019443]  blk_cleanup_queue+0x228/0x3d8\n[ 2073.019451]  null_del_dev+0xfc/0x1e0 [null_blk]\n[ 2073.019459]  null_exit+0x90/0x114 [null_blk]\n[ 2073.019462]  __arm64_sys_delete_module+0x358/0x5a0\n[ 2073.019467]  el0_svc_common+0xc8/0x320\n[ 2073.019471]  el0_svc_handler+0xf8/0x160\n[ 2073.019474]  el0_svc+0x10/0x218\n[ 2073.019475]\n[ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00\n which belongs to the cache kmalloc-1024 of size 1024\n[ 2073.019484] The buggy address is located 552 bytes inside of\n 1024-byte region [ffff8000ccf63f00, ffff8000ccf64300)\n[ 2073.019486] The buggy address belongs to the page:\n[ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compound_mapcount: 0\n[ 2073.020123] flags: 0x7ffff0000008100(slab|head)\n[ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00\n[ 2073.020409] ra\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56982719-70dc-4fbc-b664-83a969468068",
      "id": "CVE-2022-49219",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: fix memory leak during D3hot to D0 transition\n\nIf 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does\nnot have No_Soft_Reset bit set in its PMCSR config register), then\nthe current PCI state will be saved locally in\n'vfio_pci_core_device::pm_save' during D0-\u003eD3hot transition and same\nwill be restored back during D3hot-\u003eD0 transition.\nFor saving the PCI state locally, pci_store_saved_state() is being\nused and the pci_load_and_free_saved_state() will free the allocated\nmemory.\n\nBut for reset related IOCTLs, vfio driver calls PCI reset-related\nAPI's which will internally change the PCI power state back to D0. So,\nwhen the guest resumes, then it will get the current state as D0 and it\nwill skip the call to vfio_pci_set_power_state() for changing the\npower state to D0 explicitly. In this case, the memory pointed by\n'pm_save' will never be freed. In a malicious sequence, the state changing\nto D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be\nrun in a loop and it can cause an OOM situation.\n\nThis patch frees the earlier allocated memory first before overwriting\n'pm_save' to prevent the mentioned memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "abe32831-ccf8-4ad0-92e4-ab7ed9368e8f",
      "id": "CVE-2022-49259",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't delete queue kobject before its children\n\nkobjects aren't supposed to be deleted before their child kobjects are\ndeleted.  Apparently this is usually benign; however, a WARN will be\ntriggered if one of the child kobjects has a named attribute group:\n\n    sysfs group 'modes' not found for kobject 'crypto'\n    WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80\n    ...\n    Call Trace:\n      sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312\n      __kobject_del+0x20/0x80 lib/kobject.c:611\n      kobject_cleanup+0xa4/0x140 lib/kobject.c:696\n      kobject_release lib/kobject.c:736 [inline]\n      kref_put include/linux/kref.h:65 [inline]\n      kobject_put+0x53/0x70 lib/kobject.c:753\n      blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159\n      blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962\n      del_gendisk+0x117/0x250 block/genhd.c:610\n\nFix this by moving the kobject_del() and the corresponding\nkobject_uevent() to the correct place.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e15a815c-eaf5-45b8-baee-02e46bf7ad4f",
      "id": "CVE-2022-49305",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()\n\nThere is a deadlock in ieee80211_beacons_stop(), which is shown below:\n\n   (Thread 1)              |      (Thread 2)\n                           | ieee80211_send_beacon()\nieee80211_beacons_stop()   |  mod_timer()\n spin_lock_irqsave() //(1) |  (wait a time)\n ...                       | ieee80211_send_beacon_cb()\n del_timer_sync()          |  spin_lock_irqsave() //(2)\n (wait timer to stop)      |  ...\n\nWe hold ieee-\u003ebeacon_lock in position (1) of thread 1 and use\ndel_timer_sync() to wait timer to stop, but timer handler\nalso need ieee-\u003ebeacon_lock in position (2) of thread 2.\nAs a result, ieee80211_beacons_stop() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_irqsave(), which could let timer handler to obtain\nthe needed lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "069035ce-3dcb-45b3-b22a-d117d356829c",
      "id": "CVE-2022-49367",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\n\nmv88e6xxx_mdio_register() pass the device node to of_mdiobus_register().\nWe don't need the device node after it.\n\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c969af7-12e4-4584-a764-f7215abb42e9",
      "id": "CVE-2022-49371",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix deadlock in __device_attach\n\nIn __device_attach function, The lock holding logic is as follows:\n...\n__device_attach\ndevice_lock(dev)      // get lock dev\n  async_schedule_dev(__device_attach_async_helper, dev); // func\n    async_schedule_node\n      async_schedule_node_domain(func)\n        entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC);\n\t/* when fail or work limit, sync to execute func, but\n\t   __device_attach_async_helper will get lock dev as\n\t   well, which will lead to A-A deadlock.  */\n\tif (!entry || atomic_read(\u0026entry_count) \u003e MAX_WORK) {\n\t  func;\n\telse\n\t  queue_work_node(node, system_unbound_wq, \u0026entry-\u003ework)\n  device_unlock(dev)\n\nAs shown above, when it is allowed to do async probes, because of\nout of memory or work limit, async work is not allowed, to do\nsync execute instead. it will lead to A-A deadlock because of\n__device_attach_async_helper getting lock dev.\n\nTo fix the deadlock, move the async_schedule_dev outside device_lock,\nas we can see, in async_schedule_node_domain, the parameter of\nqueue_work_node is system_unbound_wq, so it can accept concurrent\noperations. which will also not change the code logic, and will\nnot lead to deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8aabbea9-de99-4336-9b54-9bec2f5f5ea2",
      "id": "CVE-2022-49414",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race condition between ext4_write and ext4_convert_inline_data\n\nHulk Robot reported a BUG_ON:\n ==================================================================\n EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0,\n block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters\n kernel BUG at fs/ext4/ext4_jbd2.c:53!\n invalid opcode: 0000 [#1] SMP KASAN PTI\n CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1\n RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline]\n RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116\n [...]\n Call Trace:\n  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795\n  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344\n  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270\n  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520\n  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732\n  do_iter_write+0x107/0x430 fs/read_write.c:861\n  vfs_writev fs/read_write.c:934 [inline]\n  do_pwritev+0x1e5/0x380 fs/read_write.c:1031\n [...]\n ==================================================================\n\nAbove issue may happen as follows:\n           cpu1                     cpu2\n__________________________|__________________________\ndo_pwritev\n vfs_writev\n  do_iter_write\n   ext4_file_write_iter\n    ext4_buffered_write_iter\n     generic_perform_write\n      ext4_da_write_begin\n                           vfs_fallocate\n                            ext4_fallocate\n                             ext4_convert_inline_data\n                              ext4_convert_inline_data_nolock\n                               ext4_destroy_inline_data_nolock\n                                clear EXT4_STATE_MAY_INLINE_DATA\n                               ext4_map_blocks\n                                ext4_ext_map_blocks\n                                 ext4_mb_new_blocks\n                                  ext4_mb_regular_allocator\n                                   ext4_mb_good_group_nolock\n                                    ext4_mb_init_group\n                                     ext4_mb_init_cache\n                                      ext4_mb_generate_buddy  --\u003e error\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n                                ext4_restore_inline_data\n                                 set EXT4_STATE_MAY_INLINE_DATA\n       ext4_block_write_begin\n      ext4_da_write_end\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n       ext4_write_inline_data_end\n        handle=NULL\n        ext4_journal_stop(handle)\n         __ext4_journal_stop\n          ext4_put_nojournal(handle)\n           ref_cnt = (unsigned long)handle\n           BUG_ON(ref_cnt == 0)  ---\u003e BUG_ON\n\nThe lock held by ext4_convert_inline_data is xattr_sem, but the lock\nheld by generic_perform_write is i_rwsem. Therefore, the two locks can\nbe concurrent.\n\nTo solve above issue, we add inode_lock() for ext4_convert_inline_data().\nAt the same time, move ext4_convert_inline_data() in front of\next4_punch_hole(), remove similar handling from ext4_punch_hole().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7a7ddd9-392e-426b-80a4-736a9fc33f05",
      "id": "CVE-2022-49503",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath9k_htc: fix potential out of bounds access with invalid rxstatus-\u003ers_keyix\n\nThe \"rxstatus-\u003ers_keyix\" eventually gets passed to test_bit() so we need to\nensure that it is within the bitmap.\n\ndrivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()\nerror: passing untrusted data 'rx_stats-\u003ers_keyix' to 'test_bit()'",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1eafb91d-8202-4ab2-a87d-67e2b941a9c4",
      "id": "CVE-2022-49623",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive/spapr: correct bitmap allocation size\n\nkasan detects access beyond the end of the xibm-\u003ebitmap allocation:\n\nBUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140\nRead of size 8 at addr c00000001d1d0118 by task swapper/0/1\n\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28\nCall Trace:\n[c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable)\n[c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710\n[c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354\n[c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0\n[c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140\n[c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260\n[c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450\n[c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118\n[c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac\n[c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640\n[c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0\n[c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64\n\nAllocated by task 0:\n kasan_save_stack+0x34/0x70\n __kasan_kmalloc+0xb4/0xf0\n __kmalloc+0x268/0x540\n xive_spapr_init+0x4d0/0x77c\n pseries_init_irq+0x40/0x27c\n init_IRQ+0x44/0x84\n start_kernel+0x2a4/0x538\n start_here_common+0x1c/0x20\n\nThe buggy address belongs to the object at c00000001d1d0118\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n 8-byte region [c00000001d1d0118, c00000001d1d0120)\n\nThe buggy address belongs to the physical page:\npage:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d\nflags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff)\nraw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480\nraw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003ec00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc\n                            ^\n c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc\n c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc\n\nThis happens because the allocation uses the wrong unit (bits) when it\nshould pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small\nnumbers of bits, the allocated object can be smaller than sizeof(long),\nwhich results in invalid accesses.\n\nUse bitmap_zalloc() to allocate and initialize the irq bitmap, paired with\nbitmap_free() for consistency.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f31754c1-e21d-408e-b685-844015a1de0d",
      "id": "CVE-2022-49680",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: exynos: Fix refcount leak in exynos_map_pmu\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.\nof_node_put() checks null pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "237aa691-b12a-42e6-86f6-52ddbe07599c",
      "id": "CVE-2022-49948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6a965eb9-1f95-4e69-aef5-76a8624d99ce",
      "id": "CVE-2022-50020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid resizing to a partial cluster size\n\nThis patch avoids an attempt to resize the filesystem to an\nunaligned cluster boundary.  An online resize to a size that is not\nintegral to cluster size results in the last iteration attempting to\ngrow the fs by a negative amount, which trips a BUG_ON and leaves the fs\nwith a corrupted in-memory superblock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9324995-88b4-4d4e-988b-b0d29f905204",
      "id": "CVE-2022-50104",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: Fix refcount leak in xive_get_max_prio\n\nof_find_node_by_path() returns a node pointer with\nrefcount incremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "35bedda4-4574-4f96-a1e6-634c96e1da03",
      "id": "CVE-2023-22998",
      "description": "In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc2a477d-0dd4-4d79-b04c-fd3d4087cc59",
      "id": "CVE-2022-50199",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: OMAP2+: Fix refcount leak in omapdss_init_of\n\nomapdss_find_dss_of_node() calls of_find_compatible_node() to get device\nnode. of_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() in later error path and normal path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59221aff-83cc-451d-951f-54f390268dde",
      "id": "CVE-2022-50233",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix using strlen with hdev-\u003e{dev_name,short_name}\n\nBoth dev_name and short_name are not guaranteed to be NULL terminated so\nthis instead use strnlen and then attempt to determine if the resulting\nstring needs to be truncated or not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af58a0d8-4ce0-460b-b825-1abaf260e53f",
      "id": "CVE-2022-50279",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()\n\nThere is a global-out-of-bounds reported by KASAN:\n\n  BUG: KASAN: global-out-of-bounds in\n  _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]\n  Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411\n\n  CPU: 6 PID: 411 Comm: NetworkManager Tainted: G      D\n  6.1.0-rc8+ #144 e15588508517267d37\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),\n  Call Trace:\n   \u003cTASK\u003e\n   ...\n   kasan_report+0xbb/0x1c0\n   _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]\n   rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]\n   rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]\n   ...\n   \u003c/TASK\u003e\n\nThe root cause of the problem is that the comparison order of\n\"prate_section\" in _rtl8812ae_phy_set_txpower_limit() is wrong. The\n_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two\nstrings from tail to head, which causes the problem. In the\n_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet\nthis requirement by carefully designing the comparison order.\nFor example, \"pregulation\" and \"pbandwidth\" are compared in order of\nlength from small to large, first is 3 and last is 4. However, the\ncomparison order of \"prate_section\" dose not obey such order requirement,\ntherefore when \"prate_section\" is \"HT\", when comparing from tail to head,\nit will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As\nmentioned above, the _rtl8812ae_eq_n_byte() has the same function as\nstrcmp(), so just strcmp() is enough.\n\nFix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.\nAlthough it can be fixed by adjusting the comparison order of\n\"prate_section\", this may cause the value of \"rate_section\" to not be\nfrom 0 to 5. In addition, commit \"21e4b0726dc6\" not only moved driver\nfrom staging to regular tree, but also added setting txpower limit\nfunction during the driver config phase, so the problem was introduced\nby this commit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14aa6ef9-bc43-4bc2-8789-cbbb72480f53",
      "id": "CVE-2022-50320",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address\n\nOn a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table\nwhich contains invalid physical addresses, with high bits set which fall\noutside the range of the CPU-s supported physical address range.\n\nCalling acpi_os_map_memory() on such an invalid phys address leads to\nthe below WARN_ON in ioremap triggering resulting in an oops/stacktrace.\n\nAdd code to verify the physical address before calling acpi_os_map_memory()\nto fix / avoid the oops.\n\n[    1.226900] ioremap: invalid physical address 3001000000000000\n[    1.226949] ------------[ cut here ]------------\n[    1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f\n[    1.226996] Modules linked in:\n[    1.227016] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490\n[    1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[    1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f\n[    1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 \u003c0f\u003e 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00\n[    1.227067] RSP: 0000:ffffb18c40033d60 EFLAGS: 00010286\n[    1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX: 0000000000000000\n[    1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff\n[    1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18\n[    1.227115] R10: 0000000000000003 R11: ffffffff99d62fe8 R12: 0000000000000008\n[    1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000\n[    1.227135] FS:  0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000\n[    1.227146] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.227156] CR2: 0000000000000000 CR3: 0000000018c26000 CR4: 00000000000006e0\n[    1.227167] Call Trace:\n[    1.227176]  \u003cTASK\u003e\n[    1.227185]  ? acpi_os_map_iomem+0x1c9/0x1e0\n[    1.227215]  ? kmem_cache_alloc_trace+0x187/0x370\n[    1.227254]  acpi_os_map_iomem+0x1c9/0x1e0\n[    1.227288]  acpi_init_fpdt+0xa8/0x253\n[    1.227308]  ? acpi_debugfs_init+0x1f/0x1f\n[    1.227339]  do_one_initcall+0x5a/0x300\n[    1.227406]  ? rcu_read_lock_sched_held+0x3f/0x80\n[    1.227442]  kernel_init_freeable+0x28b/0x2cc\n[    1.227512]  ? rest_init+0x170/0x170\n[    1.227538]  kernel_init+0x16/0x140\n[    1.227552]  ret_from_fork+0x1f/0x30\n[    1.227639]  \u003c/TASK\u003e\n[    1.227647] irq event stamp: 186819\n[    1.227656] hardirqs last  enabled at (186825): [\u003cffffffff98184a6e\u003e] __up_console_sem+0x5e/0x70\n[    1.227672] hardirqs last disabled at (186830): [\u003cffffffff98184a53\u003e] __up_console_sem+0x43/0x70\n[    1.227686] softirqs last  enabled at (186576): [\u003cffffffff980fbc9d\u003e] __irq_exit_rcu+0xed/0x160\n[    1.227701] softirqs last disabled at (186569): [\u003cffffffff980fbc9d\u003e] __irq_exit_rcu+0xed/0x160\n[    1.227715] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f10975e5-e284-4d6d-8ffd-51adbe33de7f",
      "id": "CVE-2023-1192",
      "description": "A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "335eb7fb-d4e9-4b06-90b1-7ed9e762b752",
      "id": "CVE-2023-1829",
      "description": "A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.\nWe recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b952248-c477-45cf-a53a-069613d39d18",
      "id": "CVE-2023-2002",
      "description": "A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "18b7629f-dacf-4a33-bd3b-a7fd2adcbc8f",
      "id": "CVE-2023-23004",
      "description": "In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6600ad98-cba9-4b3a-833b-463037b8f500",
      "id": "CVE-2023-53406",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ddeb917-e880-48ee-8ebf-66e79eede1cb",
      "id": "CVE-2023-23006",
      "description": "In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33fa9e6c-dee7-43e1-94ce-cfb77cdbab4d",
      "id": "CVE-2023-28327",
      "description": "A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "acd983e4-b8cd-4a02-812d-286eba5833bb",
      "id": "CVE-2023-28866",
      "description": "In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0814bba4-a253-40ab-8d6b-1acb407e4f25",
      "id": "CVE-2023-52448",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump\n\nSyzkaller has reported a NULL pointer dereference when accessing\nrgd-\u003erd_rgl in gfs2_rgrp_dump().  This can happen when creating\nrgd-\u003erd_gl fails in read_rindex_entry().  Add a NULL pointer check in\ngfs2_rgrp_dump() to prevent that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97163bbf-f2c4-44cf-97d9-ac05436e1b6f",
      "id": "CVE-2023-52451",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries/memhp: Fix access beyond end of drmem array\n\ndlpar_memory_remove_by_index() may access beyond the bounds of the\ndrmem lmb array when the LMB lookup fails to match an entry with the\ngiven DRC index. When the search fails, the cursor is left pointing to\n\u0026drmem_info-\u003elmbs[drmem_info-\u003en_lmbs], which is one element past the\nlast valid entry in the array. The debug message at the end of the\nfunction then dereferences this pointer:\n\n        pr_debug(\"Failed to hot-remove memory at %llx\\n\",\n                 lmb-\u003ebase_addr);\n\nThis was found by inspection and confirmed with KASAN:\n\n  pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658\n  Read of size 8 at addr c000000364e97fd0 by task bash/949\n\n  dump_stack_lvl+0xa4/0xfc (unreliable)\n  print_report+0x214/0x63c\n  kasan_report+0x140/0x2e0\n  __asan_load8+0xa8/0xe0\n  dlpar_memory+0x298/0x1658\n  handle_dlpar_errorlog+0x130/0x1d0\n  dlpar_store+0x18c/0x3e0\n  kobj_attr_store+0x68/0xa0\n  sysfs_kf_write+0xc4/0x110\n  kernfs_fop_write_iter+0x26c/0x390\n  vfs_write+0x2d4/0x4e0\n  ksys_write+0xac/0x1a0\n  system_call_exception+0x268/0x530\n  system_call_vectored_common+0x15c/0x2ec\n\n  Allocated by task 1:\n   kasan_save_stack+0x48/0x80\n   kasan_set_track+0x34/0x50\n   kasan_save_alloc_info+0x34/0x50\n   __kasan_kmalloc+0xd0/0x120\n   __kmalloc+0x8c/0x320\n   kmalloc_array.constprop.0+0x48/0x5c\n   drmem_init+0x2a0/0x41c\n   do_one_initcall+0xe0/0x5c0\n   kernel_init_freeable+0x4ec/0x5a0\n   kernel_init+0x30/0x1e0\n   ret_from_kernel_user_thread+0x14/0x1c\n\n  The buggy address belongs to the object at c000000364e80000\n   which belongs to the cache kmalloc-128k of size 131072\n  The buggy address is located 0 bytes to the right of\n   allocated 98256-byte region [c000000364e80000, c000000364e97fd0)\n\n  ==================================================================\n  pseries-hotplug-mem: Failed to hot-remove memory at 0\n\nLog failed lookups with a separate message and dereference the\ncursor only when it points to a valid entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5395e46-1081-4d44-8484-6a63d7fa1a8b",
      "id": "CVE-2023-6931",
      "description": "A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.\n\nA perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().\n\nWe recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ec60986-ff06-49f2-876b-05d30ae44595",
      "id": "CVE-2023-52454",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\n\nIf the host sends an H2CData command with an invalid DATAL,\nthe kernel may crash in nvmet_tcp_build_pdu_iovec().\n\nUnable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\nlr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp]\nCall trace:\n  process_one_work+0x174/0x3c8\n  worker_thread+0x2d0/0x3e8\n  kthread+0x104/0x110\n\nFix the bug by raising a fatal error if DATAL isn't coherent\nwith the packet size.\nAlso, the PDU length should never exceed the MAXH2CDATA parameter which\nhas been communicated to the host in nvmet_tcp_handle_icreq().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d59f79d6-31e1-4d95-a7bd-ab7802ee1e3e",
      "id": "CVE-2023-52500",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "789aff01-11b6-4795-904d-e7d9b8f438e2",
      "id": "CVE-2023-53006",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix oops due to uncleared server-\u003esmbd_conn in reconnect\n\nIn smbd_destroy(), clear the server-\u003esmbd_conn pointer after freeing the\nsmbd_connection struct that it points to so that reconnection doesn't get\nconfused.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8c82c48-7bdc-454b-90d8-e3fcb5db83c8",
      "id": "CVE-2023-52509",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nravb: Fix use-after-free issue in ravb_tx_timeout_work()\n\nThe ravb_stop() should call cancel_work_sync(). Otherwise,\nravb_tx_timeout_work() is possible to use the freed priv after\nravb_remove() was called like below:\n\nCPU0\t\t\tCPU1\n\t\t\travb_tx_timeout()\nravb_remove()\nunregister_netdev()\nfree_netdev(ndev)\n// free priv\n\t\t\travb_tx_timeout_work()\n\t\t\t// use priv\n\nunregister_netdev() will call .ndo_stop() so that ravb_stop() is\ncalled. And, after phy_stop() is called, netif_carrier_off()\nis also called. So that .ndo_tx_timeout() will not be called\nafter phy_stop().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c87c372-c36a-4ddd-ba53-558ec222972a",
      "id": "CVE-2023-52589",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkisp1: Fix IRQ disable race issue\n\nIn rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the\ninterrupts and then apparently assumes that the interrupt handler won't\nbe running, and proceeds in the stop procedure. This is not the case, as\nthe interrupt handler can already be running, which would lead to the\nISP being disabled while the interrupt handler handling a captured\nframe.\n\nThis brings up two issues: 1) the ISP could be powered off while the\ninterrupt handler is still running and accessing registers, leading to\nboard lockup, and 2) the interrupt handler code and the code that\ndisables the streaming might do things that conflict.\n\nIt is not clear to me if 2) causes a real issue, but 1) can be seen with\na suitable delay (or printk in my case) in the interrupt handler,\nleading to board lockup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28dc64f1-2aae-40af-a5d9-51b9966e88aa",
      "id": "CVE-2023-52601",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in dbAdjTree\n\nCurrently there is a bound check missing in the dbAdjTree while\naccessing the dmt_stree. To add the required check added the bool is_ctl\nwhich is required to determine the size as suggest in the following\ncommit.\nhttps://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6dc922ea-3916-40f1-936f-7c485958f3a6",
      "id": "CVE-2024-36016",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm-\u003elen\n  Reason: gsm-\u003elen is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm-\u003ebuf\n  Reason: Neither gsm-\u003estate nor gsm-\u003elen have been reset after\n  reconfiguration.\n\nFix this by changing gsm-\u003ecount to gsm-\u003elen comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm-\u003elen and gsm-\u003emru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0f94c6b-6d5f-4da0-ab53-800c869add5a",
      "id": "CVE-2023-52854",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix refcnt handling in padata_free_shell()\n\nIn a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead\nto system UAF (Use-After-Free) issues. Due to the lengthy analysis of\nthe pcrypt_aead01 function call, I'll describe the problem scenario\nusing a simplified model:\n\nSuppose there's a user of padata named `user_function` that adheres to\nthe padata requirement of calling `padata_free_shell` after `serial()`\nhas been invoked, as demonstrated in the following code:\n\n```c\nstruct request {\n    struct padata_priv padata;\n    struct completion *done;\n};\n\nvoid parallel(struct padata_priv *padata) {\n    do_something();\n}\n\nvoid serial(struct padata_priv *padata) {\n    struct request *request = container_of(padata,\n    \t\t\t\tstruct request,\n\t\t\t\tpadata);\n    complete(request-\u003edone);\n}\n\nvoid user_function() {\n    DECLARE_COMPLETION(done)\n    padata-\u003eparallel = parallel;\n    padata-\u003eserial = serial;\n    padata_do_parallel();\n    wait_for_completion(\u0026done);\n    padata_free_shell();\n}\n```\n\nIn the corresponding padata.c file, there's the following code:\n\n```c\nstatic void padata_serial_worker(struct work_struct *serial_work) {\n    ...\n    cnt = 0;\n\n    while (!list_empty(\u0026local_list)) {\n        ...\n        padata-\u003eserial(padata);\n        cnt++;\n    }\n\n    local_bh_enable();\n\n    if (refcount_sub_and_test(cnt, \u0026pd-\u003erefcnt))\n        padata_free_pd(pd);\n}\n```\n\nBecause of the high system load and the accumulation of unexecuted\nsoftirq at this moment, `local_bh_enable()` in padata takes longer\nto execute than usual. Subsequently, when accessing `pd-\u003erefcnt`,\n`pd` has already been released by `padata_free_shell()`, resulting\nin a UAF issue with `pd-\u003erefcnt`.\n\nThe fix is straightforward: add `refcount_dec_and_test` before calling\n`padata_free_pd` in `padata_free_shell`.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc7f46e5-ac6e-4a4f-a81f-a2a831f8b988",
      "id": "CVE-2023-52918",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: cx23885: check cx23885_vdev_init() return\n\ncx23885_vdev_init() can return a NULL pointer, but that pointer\nis used in the next line without a check.\n\nAdd a NULL pointer check and go to the error unwind if it is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ddc4d928-d247-4f9c-a52e-530ff6763b0a",
      "id": "CVE-2023-52993",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL\n\nBaoquan reported that after triggering a crash the subsequent crash-kernel\nfails to boot about half of the time. It triggers a NULL pointer\ndereference in the periodic tick code.\n\nThis happens because the legacy timer interrupt (IRQ0) is resent in\nsoftware which happens in soft interrupt (tasklet) context. In this context\nget_irq_regs() returns NULL which leads to the NULL pointer dereference.\n\nThe reason for the resend is a spurious APIC interrupt on the IRQ0 vector\nwhich is captured and leads to a resend when the legacy timer interrupt is\nenabled. This is wrong because the legacy PIC interrupts are level\ntriggered and therefore should never be resent in software, but nothing\never sets the IRQ_LEVEL flag on those interrupts, so the core code does not\nknow about their trigger type.\n\nEnsure that IRQ_LEVEL is set when the legacy PCI interrupts are set up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e14c45c0-c97e-4709-a9a3-5eb0ecde5d80",
      "id": "CVE-2023-53359",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8cd21d0a-35ab-465b-8f85-a33d71e7c840",
      "id": "CVE-2023-53370",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix memory leak in mes self test\n\nThe fences associated with mes queue have to be freed\nup during amdgpu_ring_fini.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce4dff73-e447-4843-8a4c-c902d60fd3e7",
      "id": "CVE-2023-53405",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: gr_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e818de59-43ce-41f1-93bf-2a8937fd7ff0",
      "id": "CVE-2024-25744",
      "description": "In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "129a5d86-e719-4e1e-aec3-ebb8e47b7686",
      "id": "CVE-2024-27038",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: Fix clk_core_get NULL dereference\n\nIt is possible for clk_core_get to dereference a NULL in the following\nsequence:\n\nclk_core_get()\n    of_clk_get_hw_from_clkspec()\n        __of_clk_get_hw_from_provider()\n            __clk_get_hw()\n\n__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at\nhw-\u003ecore.\n\nPrior to commit dde4eff47c82 (\"clk: Look for parents with clkdev based\nclk_lookups\") the check IS_ERR_OR_NULL() was performed which would have\ncaught the NULL.\n\nReading the description of this function it talks about returning NULL but\nthat cannot be so at the moment.\n\nUpdate the function to check for hw before dereferencing it and return NULL\nif hw is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae43120a-b246-4bb8-b2f6-99c89e54aca0",
      "id": "CVE-2024-27056",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\n\nThe resume code path assumes that the TX queue for the offloading TID\nhas been configured. At resume time it then tries to sync the write\npointer as it may have been updated by the firmware.\n\nIn the unusual event that no packets have been send on TID 0, the queue\nwill not have been allocated and this causes a crash. Fix this by\nensuring the queue exist at suspend time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab0b3f6c-bc40-4242-81ec-8c7df2b2ea4f",
      "id": "CVE-2024-35896",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: validate user input for expected length\n\nI got multiple syzbot reports showing old bugs exposed\nby BPF after commit 20f2505fb436 (\"bpf: Try to avoid kzalloc\nin cgroup/{s,g}etsockopt\")\n\nsetsockopt() @optlen argument should be taken into account\nbefore copying data.\n\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\nRead of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238\n\nCPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n  do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\n  nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\nRIP: 0033:0x7fd22067dde9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8\n \u003c/TASK\u003e\n\nAllocated by task 7238:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:4069 [inline]\n  __kmalloc_noprof+0x200/0x410 mm/slub.c:4082\n  kmalloc_noprof include/linux/slab.h:664 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\n\nThe buggy address belongs to the object at ffff88802cd73da0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)\n\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73\nflags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)\npage_type: 0xffffefff(slab)\nraw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122\nraw: ffff88802cd73020 000000008080007f 00000001ffffefff 00\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b7b7886-d513-4463-b228-28bd3593f884",
      "id": "CVE-2024-35935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: send: handle path ref underflow in header iterate_inode_ref()\n\nChange BUG_ON to proper error handling if building the path buffer\nfails. The pointers are not printed so we don't accidentally leak kernel\naddresses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f55fadc6-69b4-4b69-a0dc-9881b8d1117b",
      "id": "CVE-2025-21881",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes: Reject the shared zeropage in uprobe_write_opcode()\n\nWe triggered the following crash in syzkaller tests:\n\n  BUG: Bad page state in process syz.7.38  pfn:1eff3\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3\n  flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff)\n  raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000\n  raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000\n  page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x32/0x50\n   bad_page+0x69/0xf0\n   free_unref_page_prepare+0x401/0x500\n   free_unref_page+0x6d/0x1b0\n   uprobe_write_opcode+0x460/0x8e0\n   install_breakpoint.part.0+0x51/0x80\n   register_for_each_vma+0x1d9/0x2b0\n   __uprobe_register+0x245/0x300\n   bpf_uprobe_multi_link_attach+0x29b/0x4f0\n   link_create+0x1e2/0x280\n   __sys_bpf+0x75f/0xac0\n   __x64_sys_bpf+0x1a/0x30\n   do_syscall_64+0x56/0x100\n   entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\n   BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1\n\nThe following syzkaller test case can be used to reproduce:\n\n  r2 = creat(\u0026(0x7f0000000000)='./file0\\x00', 0x8)\n  write$nbd(r2, \u0026(0x7f0000000580)=ANY=[], 0x10)\n  r4 = openat(0xffffffffffffff9c, \u0026(0x7f0000000040)='./file0\\x00', 0x42, 0x0)\n  mmap$IORING_OFF_SQ_RING(\u0026(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0)\n  r5 = userfaultfd(0x80801)\n  ioctl$UFFDIO_API(r5, 0xc018aa3f, \u0026(0x7f0000000040)={0xaa, 0x20})\n  r6 = userfaultfd(0x80801)\n  ioctl$UFFDIO_API(r6, 0xc018aa3f, \u0026(0x7f0000000140))\n  ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, \u0026(0x7f0000000100)={{\u0026(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2})\n  ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, \u0026(0x7f0000000000)={{\u0026(0x7f0000ffd000/0x1000)=nil, 0x1000}})\n  r7 = bpf$PROG_LOAD(0x5, \u0026(0x7f0000000140)={0x2, 0x3, \u0026(0x7f0000000200)=ANY=[@ANYBLOB=\"1800000000120000000000000000000095\"], \u0026(0x7f0000000000)='GPL\\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)\n  bpf$BPF_LINK_CREATE_XDP(0x1c, \u0026(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={\u0026(0x7f0000000080)='./file0\\x00', \u0026(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40)\n\nThe cause is that zero pfn is set to the PTE without increasing the RSS\ncount in mfill_atomic_pte_zeropage() and the refcount of zero folio does\nnot increase accordingly. Then, the operation on the same pfn is performed\nin uprobe_write_opcode()-\u003e__replace_page() to unconditional decrease the\nRSS count and old_folio's refcount.\n\nTherefore, two bugs are introduced:\n\n 1. The RSS count is incorrect, when process exit, the check_mm() report\n    error \"Bad rss-count\".\n\n 2. The reserved folio (zero folio) is freed when folio-\u003erefcount is zero,\n    then free_pages_prepare-\u003efree_page_is_bad() report error\n    \"Bad page state\".\n\nThere is more, the following warning could also theoretically be triggered:\n\n  __replace_page()\n    -\u003e ...\n      -\u003e folio_remove_rmap_pte()\n        -\u003e VM_WARN_ON_FOLIO(is_zero_folio(folio), folio)\n\nConsidering that uprobe hit on the zero folio is a very rare case, just\nreject zero old folio immediately after get_user_page_vma_remote().\n\n[ mingo: Cleaned up the changelog ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78dda454-2d39-49c1-b774-2805485e9c01",
      "id": "CVE-2024-36911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhv_netvsc: Don't free decrypted memory\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe netvsc driver could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the gpadl\nto decide whether to free the memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "786c819d-5950-49ec-b886-5ead9c3b9211",
      "id": "CVE-2024-40911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Lock wiphy in cfg80211_get_station\n\nWiphy should be locked before calling rdev_get_station() (see lockdep\nassert in ieee80211_get_station()).\n\nThis fixes the following kernel NULL dereference:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\n Mem abort info:\n   ESR = 0x0000000096000006\n   EC = 0x25: DABT (current EL), IL = 32 bits\n   SET = 0, FnV = 0\n   EA = 0, S1PTW = 0\n   FSC = 0x06: level 2 translation fault\n Data abort info:\n   ISV = 0, ISS = 0x00000006\n   CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=0000000003001000\n [0000000000000050] pgd=0800000002dca003, p4d=0800000002dca003, pud=08000000028e9003, pmd=0000000000000000\n Internal error: Oops: 0000000096000006 [#1] SMP\n Modules linked in: netconsole dwc3_meson_g12a dwc3_of_simple dwc3 ip_gre gre ath10k_pci ath10k_core ath9k ath9k_common ath9k_hw ath\n CPU: 0 PID: 1091 Comm: kworker/u8:0 Not tainted 6.4.0-02144-g565f9a3a7911-dirty #705\n Hardware name: RPT (r1) (DT)\n Workqueue: bat_events batadv_v_elp_throughput_metric_update\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\n lr : sta_set_sinfo+0xcc/0xbd4\n sp : ffff000007b43ad0\n x29: ffff000007b43ad0 x28: ffff0000071fa900 x27: ffff00000294ca98\n x26: ffff000006830880 x25: ffff000006830880 x24: ffff00000294c000\n x23: 0000000000000001 x22: ffff000007b43c90 x21: ffff800008898acc\n x20: ffff00000294c6e8 x19: ffff000007b43c90 x18: 0000000000000000\n x17: 445946354d552d78 x16: 62661f7200000000 x15: 57464f445946354d\n x14: 0000000000000000 x13: 00000000000000e3 x12: d5f0acbcebea978e\n x11: 00000000000000e3 x10: 000000010048fe41 x9 : 0000000000000000\n x8 : ffff000007b43d90 x7 : 000000007a1e2125 x6 : 0000000000000000\n x5 : ffff0000024e0900 x4 : ffff800000a0250c x3 : ffff000007b43c90\n x2 : ffff00000294ca98 x1 : ffff000006831920 x0 : 0000000000000000\n Call trace:\n  ath10k_sta_statistics+0x10/0x2dc [ath10k_core]\n  sta_set_sinfo+0xcc/0xbd4\n  ieee80211_get_station+0x2c/0x44\n  cfg80211_get_station+0x80/0x154\n  batadv_v_elp_get_throughput+0x138/0x1fc\n  batadv_v_elp_throughput_metric_update+0x1c/0xa4\n  process_one_work+0x1ec/0x414\n  worker_thread+0x70/0x46c\n  kthread+0xdc/0xe0\n  ret_from_fork+0x10/0x20\n Code: a9bb7bfd 910003fd a90153f3 f9411c40 (f9402814)\n\nThis happens because STA has time to disconnect and reconnect before\nbatadv_v_elp_throughput_metric_update() delayed work gets scheduled. In\nthis situation, ath10k_sta_state() can be in the middle of resetting\narsta data when the work queue get chance to be scheduled and ends up\naccessing it. Locking wiphy prevents that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "790487b9-33c8-42dc-a3d0-cac174848853",
      "id": "CVE-2024-40973",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-vcodec: potential null pointer deference in SCP\n\nThe return value of devm_kzalloc() needs to be checked to avoid\nNULL pointer deference. This is similar to CVE-2022-3113.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c9e03c1-c3b7-41e3-9857-446a69580d12",
      "id": "CVE-2021-42252",
      "description": "An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "763d3d9c-71e7-46dd-9c4c-b4029e3eef29",
      "id": "CVE-2024-41072",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: wext: add extra SIOCSIWSCAN data check\n\nIn 'cfg80211_wext_siwscan()', add extra check whether number of\nchannels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed\nIW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef162217-9656-4a36-87cf-bdf776500cb7",
      "id": "CVE-2024-42119",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip finding free audio for unknown engine_id\n\n[WHY]\nENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it\nalso means it is uninitialized and does not need free audio.\n\n[HOW]\nSkip and return NULL.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7502a51c-6633-4c5b-85aa-6d08ab34f583",
      "id": "CVE-2024-42122",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL pointer check for kzalloc\n\n[Why \u0026 How]\nCheck return pointer of kzalloc before using it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b4a765f-62f7-4289-bffe-5af0d6f1e8dd",
      "id": "CVE-2024-42152",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix a possible leak when destroy a ctrl during qp establishment\n\nIn nvmet_sq_destroy we capture sq-\u003ectrl early and if it is non-NULL we\nknow that a ctrl was allocated (in the admin connect request handler)\nand we need to release pending AERs, clear ctrl-\u003esqs and sq-\u003ectrl\n(for nvme-loop primarily), and drop the final reference on the ctrl.\n\nHowever, a small window is possible where nvmet_sq_destroy starts (as\na result of the client giving up and disconnecting) concurrently with\nthe nvme admin connect cmd (which may be in an early stage). But *before*\nkill_and_confirm of sq-\u003eref (i.e. the admin connect managed to get an sq\nlive reference). In this case, sq-\u003ectrl was allocated however after it was\ncaptured in a local variable in nvmet_sq_destroy.\nThis prevented the final reference drop on the ctrl.\n\nSolve this by re-capturing the sq-\u003ectrl after all inflight request has\ncompleted, where for sure sq-\u003ectrl reference is final, and move forward\nbased on that.\n\nThis issue was observed in an environment with many hosts connecting\nmultiple ctrls simoutanuosly, creating a delay in allocating a ctrl\nleading up to this race window.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5828a2f7-170c-47e9-a452-926f0c0069f0",
      "id": "CVE-2024-42253",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\n\nEnsure that `i2c_lock' is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\n\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\n\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\n\n * Normal case\n\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n\n * Race case\n\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d03b473-62df-4803-ac35-2b7e6cdf8af3",
      "id": "CVE-2021-46936",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix use-after-free in tw_timer_handler\n\nA real world panic issue was found as follow in Linux 5.4.\n\n    BUG: unable to handle page fault for address: ffffde49a863de28\n    PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0\n    RIP: 0010:tw_timer_handler+0x20/0x40\n    Call Trace:\n     \u003cIRQ\u003e\n     call_timer_fn+0x2b/0x120\n     run_timer_softirq+0x1ef/0x450\n     __do_softirq+0x10d/0x2b8\n     irq_exit+0xc7/0xd0\n     smp_apic_timer_interrupt+0x68/0x120\n     apic_timer_interrupt+0xf/0x20\n\nThis issue was also reported since 2017 in the thread [1],\nunfortunately, the issue was still can be reproduced after fixing\nDCCP.\n\nThe ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net\nnamespace is destroyed since tcp_sk_ops is registered befrore\nipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops\nin the list of pernet_list. There will be a use-after-free on\nnet-\u003emib.net_statistics in tw_timer_handler after ipv4_mib_exit_net\nif there are some inflight time-wait timers.\n\nThis bug is not introduced by commit f2bf415cfed7 (\"mib: add net to\nNET_ADD_STATS_BH\") since the net_statistics is a global variable\ninstead of dynamic allocation and freeing. Actually, commit\n61a7e26028b9 (\"mib: put net statistics on struct net\") introduces\nthe bug since it put net statistics on struct net and free it when\nnet namespace is destroyed.\n\nMoving init_ipv4_mibs() to the front of tcp_init() to fix this bug\nand replace pr_crit() with panic() since continuing is meaningless\nwhen init_ipv4_mibs() fails.\n\n[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0212c2e4-bc93-4aab-9374-2d43f5cfad30",
      "id": "CVE-2024-42285",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix a use-after-free related to destroying CM IDs\n\niw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with\nan existing struct iw_cm_id (cm_id) as follows:\n\n        conn_id-\u003ecm_id.iw = cm_id;\n        cm_id-\u003econtext = conn_id;\n        cm_id-\u003ecm_handler = cma_iw_handler;\n\nrdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make\nsure that cm_work_handler() does not trigger a use-after-free by only\nfreeing of the struct rdma_id_private after all pending work has finished.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d47eb6aa-2a5f-4cbf-b289-26cbbbfd7e4a",
      "id": "CVE-2024-43872",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup under heavy CEQE load\n\nCEQEs are handled in interrupt handler currently. This may cause the\nCPU core staying in interrupt context too long and lead to soft lockup\nunder heavy load.\n\nHandle CEQEs in BH workqueue and set an upper limit for the number of\nCEQE handled by a single call of work handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9215a3e0-6272-41ef-9661-c39f4376c420",
      "id": "CVE-2024-43883",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: vhci-hcd: Do not drop references before new references are gained\n\nAt a few places the driver carries stale pointers\nto references that can still be used. Make sure that does not happen.\nThis strictly speaking closes ZDI-CAN-22273, though there may be\nsimilar races in the driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8bb26034-3139-40ad-9a41-3e97b8b78507",
      "id": "CVE-2024-43908",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix the null pointer dereference to ras_manager\n\nCheck ras_manager before using it",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c8bc481-be1c-4c0c-ba54-ae212bc80fa4",
      "id": "CVE-2025-21782",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: fix a oob in orangefs_debug_write\n\nI got a syzbot report: slab-out-of-bounds Read in\norangefs_debug_write... several people suggested fixes,\nI tested Al Viro's suggestion and made this patch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c0830f9-05ba-4e53-8f3a-265e4980d8ce",
      "id": "CVE-2024-44944",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use helper function to calculate expect ID\n\nDelete expectation path is missing a call to the nf_expect_get_id()\nhelper function to calculate the expectation ID, otherwise LSB of the\nexpectation object address is leaked to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3fea0c18-942c-4776-b3ff-939827f035b4",
      "id": "CVE-2024-45015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()\n\nFor cases where the crtc's connectors_changed was set without enable/active\ngetting toggled , there is an atomic_enable() call followed by an\natomic_disable() but without an atomic_mode_set().\n\nThis results in a NULL ptr access for the dpu_encoder_get_drm_fmt() call in\nthe atomic_enable() as the dpu_encoder's connector was cleared in the\natomic_disable() but not re-assigned as there was no atomic_mode_set() call.\n\nFix the NULL ptr access by moving the assignment for atomic_enable() and also\nuse drm_atomic_get_new_connector_for_encoder() to get the connector from\nthe atomic_state.\n\nPatchwork: https://patchwork.freedesktop.org/patch/606729/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e96de0d4-4f8a-4f44-bc96-f546ccb69241",
      "id": "CVE-2024-46726",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Ensure index calculation will not overflow\n\n[WHY \u0026 HOW]\nMake sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will\nnever overflow and exceess array size.\n\nThis fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12cbd13e-0ef0-4b25-97ad-f86e7309a07d",
      "id": "CVE-2024-49884",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix slab-use-after-free in ext4_split_extent_at()\n\nWe hit the following use-after-free:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0\nRead of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40\nCPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirty #724\nCall Trace:\n \u003cTASK\u003e\n kasan_report+0x93/0xc0\n ext4_split_extent_at+0xba8/0xcc0\n ext4_split_extent.isra.0+0x18f/0x500\n ext4_split_convert_extents+0x275/0x750\n ext4_ext_handle_unwritten_extents+0x73e/0x1580\n ext4_ext_map_blocks+0xe20/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n\nAllocated by task 40:\n __kmalloc_noprof+0x1ac/0x480\n ext4_find_extent+0xf3b/0x1e70\n ext4_ext_map_blocks+0x188/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n\nFreed by task 40:\n kfree+0xf1/0x2b0\n ext4_find_extent+0xa71/0x1e70\n ext4_ext_insert_extent+0xa22/0x3260\n ext4_split_extent_at+0x3ef/0xcc0\n ext4_split_extent.isra.0+0x18f/0x500\n ext4_split_convert_extents+0x275/0x750\n ext4_ext_handle_unwritten_extents+0x73e/0x1580\n ext4_ext_map_blocks+0xe20/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n==================================================================\n\nThe flow of issue triggering is as follows:\n\next4_split_extent_at\n  path = *ppath\n  ext4_ext_insert_extent(ppath)\n    ext4_ext_create_new_leaf(ppath)\n      ext4_find_extent(orig_path)\n        path = *orig_path\n        read_extent_tree_block\n          // return -ENOMEM or -EIO\n        ext4_free_ext_path(path)\n          kfree(path)\n        *orig_path = NULL\n  a. If err is -ENOMEM:\n  ext4_ext_dirty(path + path-\u003ep_depth)\n  // path use-after-free !!!\n  b. If err is -EIO and we have EXT_DEBUG defined:\n  ext4_ext_show_leaf(path)\n    eh = path[depth].p_hdr\n    // path also use-after-free !!!\n\nSo when trying to zeroout or fix the extent length, call ext4_find_extent()\nto update the path.\n\nIn addition we use *ppath directly as an ext4_ext_show_leaf() input to\navoid possible use-after-free when EXT_DEBUG is defined, and to avoid\nunnecessary path updates.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f577058f-59b8-4b15-9005-273a11839c66",
      "id": "CVE-2024-49925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: efifb: Register sysfs groups through driver core\n\nThe driver core can register and cleanup sysfs groups already.\nMake use of that functionality to simplify the error handling and\ncleanup.\n\nAlso avoid a UAF race during unregistering where the sysctl attributes\nwere usable after the info struct was freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9868a7fd-8be3-45a5-a0ae-0be0a140f0e2",
      "id": "CVE-2025-21866",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC\n\nErhard reported the following KASAN hit while booting his PowerMac G4\nwith a KASAN-enabled kernel 6.13-rc6:\n\n  BUG: KASAN: vmalloc-out-of-bounds in copy_to_kernel_nofault+0xd8/0x1c8\n  Write of size 8 at addr f1000000 by task chronyd/1293\n\n  CPU: 0 UID: 123 PID: 1293 Comm: chronyd Tainted: G        W          6.13.0-rc6-PMacG4 #2\n  Tainted: [W]=WARN\n  Hardware name: PowerMac3,6 7455 0x80010303 PowerMac\n  Call Trace:\n  [c2437590] [c1631a84] dump_stack_lvl+0x70/0x8c (unreliable)\n  [c24375b0] [c0504998] print_report+0xdc/0x504\n  [c2437610] [c050475c] kasan_report+0xf8/0x108\n  [c2437690] [c0505a3c] kasan_check_range+0x24/0x18c\n  [c24376a0] [c03fb5e4] copy_to_kernel_nofault+0xd8/0x1c8\n  [c24376c0] [c004c014] patch_instructions+0x15c/0x16c\n  [c2437710] [c00731a8] bpf_arch_text_copy+0x60/0x7c\n  [c2437730] [c0281168] bpf_jit_binary_pack_finalize+0x50/0xac\n  [c2437750] [c0073cf4] bpf_int_jit_compile+0xb30/0xdec\n  [c2437880] [c0280394] bpf_prog_select_runtime+0x15c/0x478\n  [c24378d0] [c1263428] bpf_prepare_filter+0xbf8/0xc14\n  [c2437990] [c12677ec] bpf_prog_create_from_user+0x258/0x2b4\n  [c24379d0] [c027111c] do_seccomp+0x3dc/0x1890\n  [c2437ac0] [c001d8e0] system_call_exception+0x2dc/0x420\n  [c2437f30] [c00281ac] ret_from_syscall+0x0/0x2c\n  --- interrupt: c00 at 0x5a1274\n  NIP:  005a1274 LR: 006a3b3c CTR: 005296c8\n  REGS: c2437f40 TRAP: 0c00   Tainted: G        W           (6.13.0-rc6-PMacG4)\n  MSR:  0200f932 \u003cVEC,EE,PR,FP,ME,IR,DR,RI\u003e  CR: 24004422  XER: 00000000\n\n  GPR00: 00000166 af8f3fa0 a7ee3540 00000001 00000000 013b6500 005a5858 0200f932\n  GPR08: 00000000 00001fe9 013d5fc8 005296c8 2822244c 00b2fcd8 00000000 af8f4b57\n  GPR16: 00000000 00000001 00000000 00000000 00000000 00000001 00000000 00000002\n  GPR24: 00afdbb0 00000000 00000000 00000000 006e0004 013ce060 006e7c1c 00000001\n  NIP [005a1274] 0x5a1274\n  LR [006a3b3c] 0x6a3b3c\n  --- interrupt: c00\n\n  The buggy address belongs to the virtual mapping at\n   [f1000000, f1002000) created by:\n   text_area_cpu_up+0x20/0x190\n\n  The buggy address belongs to the physical page:\n  page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x76e30\n  flags: 0x80000000(zone=2)\n  raw: 80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001\n  raw: 00000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   f0ffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n   f0ffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  \u003ef1000000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n             ^\n   f1000080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   f1000100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ==================================================================\n\nf8 corresponds to KASAN_VMALLOC_INVALID which means the area is not\ninitialised hence not supposed to be used yet.\n\nPowerpc text patching infrastructure allocates a virtual memory area\nusing get_vm_area() and flags it as VM_ALLOC. But that flag is meant\nto be used for vmalloc() and vmalloc() allocated memory is not\nsupposed to be used before a call to __vmalloc_node_range() which is\nnever called for that area.\n\nThat went undetected until commit e4137f08816b (\"mm, kasan, kmsan:\ninstrument copy_from/to_kernel_nofault\")\n\nThe area allocated by text_area_cpu_up() is not vmalloc memory, it is\nmapped directly on demand when needed by map_kernel_page(). There is\nno VM flag corresponding to such usage, so just pass no flag. That way\nthe area will be unpoisonned and usable immediately.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8390d2b5-7499-4317-ba22-61251ef7cee6",
      "id": "CVE-2024-47658",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: stm32/cryp - call finalize with bh disabled\n\nThe finalize operation in interrupt mode produce a produces a spinlock\nrecursion warning. The reason is the fact that BH must be disabled\nduring this process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84fb7a40-166c-4bf5-81c2-35949a3bc653",
      "id": "CVE-2024-50167",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: fix potential memory leak in be_xmit()\n\nThe be_xmit() returns NETDEV_TX_OK without freeing skb\nin case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96813ea6-d759-4d5a-b6e5-f60683cc6518",
      "id": "CVE-2024-53108",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust VSDB parser for replay feature\n\nAt some point, the IEEE ID identification for the replay check in the\nAMD EDID was added. However, this check causes the following\nout-of-bounds issues when using KASAN:\n\n[   27.804016] BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps+0xefa/0x17a0 [amdgpu]\n[   27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383\n\n...\n\n[   27.821207] Memory state around the buggy address:\n[   27.821215]  ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   27.821224]  ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   27.821234] \u003effff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   27.821243]                    ^\n[   27.821250]  ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   27.821259]  ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   27.821268] ==================================================================\n\nThis is caused because the ID extraction happens outside of the range of\nthe edid lenght. This commit addresses this issue by considering the\namd_vsdb_block size.\n\n(cherry picked from commit b7e381b1ccd5e778e3d9c44c669ad38439a861d8)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5c3cdaf-c00b-4185-b39b-c0f07b7820a1",
      "id": "CVE-2024-56592",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Call free_htab_elem() after htab_unlock_bucket()\n\nFor htab of maps, when the map is removed from the htab, it may hold the\nlast reference of the map. bpf_map_fd_put_ptr() will invoke\nbpf_map_free_id() to free the id of the removed map element. However,\nbpf_map_fd_put_ptr() is invoked while holding a bucket lock\n(raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock\n(spinlock_t), triggering the following lockdep warning:\n\n  =============================\n  [ BUG: Invalid wait context ]\n  6.11.0-rc4+ #49 Not tainted\n  -----------------------------\n  test_maps/4881 is trying to lock:\n  ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70\n  other info that might help us debug this:\n  context-{5:5}\n  2 locks held by test_maps/4881:\n   #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270\n   #1: ffff888149ced148 (\u0026htab-\u003elockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80\n  stack backtrace:\n  CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6e/0xb0\n   dump_stack+0x10/0x20\n   __lock_acquire+0x73e/0x36c0\n   lock_acquire+0x182/0x450\n   _raw_spin_lock_irqsave+0x43/0x70\n   bpf_map_free_id.part.0+0x21/0x70\n   bpf_map_put+0xcf/0x110\n   bpf_map_fd_put_ptr+0x9a/0xb0\n   free_htab_elem+0x69/0xe0\n   htab_map_update_elem+0x50f/0xa80\n   bpf_fd_htab_map_update_elem+0x131/0x270\n   htab_map_update_elem+0x50f/0xa80\n   bpf_fd_htab_map_update_elem+0x131/0x270\n   bpf_map_update_value+0x266/0x380\n   __sys_bpf+0x21bb/0x36b0\n   __x64_sys_bpf+0x45/0x60\n   x64_sys_call+0x1b2a/0x20d0\n   do_syscall_64+0x5d/0x100\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOne way to fix the lockdep warning is using raw_spinlock_t for\nmap_idr_lock as well. However, bpf_map_alloc_id() invokes\nidr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a\nsimilar lockdep warning because the slab's lock (s-\u003ecpu_slab-\u003elock) is\nstill a spinlock.\n\nInstead of changing map_idr_lock's type, fix the issue by invoking\nhtab_put_fd_value() after htab_unlock_bucket(). However, only deferring\nthe invocation of htab_put_fd_value() is not enough, because the old map\npointers in htab of maps can not be saved during batched deletion.\nTherefore, also defer the invocation of free_htab_elem(), so these\nto-be-freed elements could be linked together similar to lru map.\n\nThere are four callers for -\u003emap_fd_put_ptr:\n\n(1) alloc_htab_elem() (through htab_put_fd_value())\nIt invokes -\u003emap_fd_put_ptr() under a raw_spinlock_t. The invocation of\nhtab_put_fd_value() can not simply move after htab_unlock_bucket(),\nbecause the old element has already been stashed in htab-\u003eextra_elems.\nIt may be reused immediately after htab_unlock_bucket() and the\ninvocation of htab_put_fd_value() after htab_unlock_bucket() may release\nthe newly-added element incorrectly. Therefore, saving the map pointer\nof the old element for htab of maps before unlocking the bucket and\nreleasing the map_ptr after unlock. Beside the map pointer in the old\nelement, should do the same thing for the special fields in the old\nelement as well.\n\n(2) free_htab_elem() (through htab_put_fd_value())\nIts caller includes __htab_map_lookup_and_delete_elem(),\nhtab_map_delete_elem() and __htab_map_lookup_and_delete_batch().\n\nFor htab_map_delete_elem(), simply invoke free_htab_elem() after\nhtab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just\nlike lru map, linking the to-be-freed element into node_to_free list\nand invoking free_htab_elem() for these element after unlock. It is safe\nto reuse batch_flink as the link for node_to_free, because these\nelements have been removed from the hash llist.\n\nBecause htab of maps doesn't support lookup_and_delete operation,\n__htab_map_lookup_and_delete_elem() doesn't have the problem, so kept\nit as\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc7095d9-65d1-429a-8d9c-7e8139965af7",
      "id": "CVE-2024-56605",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()\n\nbt_sock_alloc() allocates the sk object and attaches it to the provided\nsock object. On error l2cap_sock_alloc() frees the sk object, but the\ndangling pointer is still attached to the sock object, which may create\nuse-after-free in other code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "053d20ef-1e54-4763-986b-660313f28e80",
      "id": "CVE-2024-56664",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix race between element replace and close()\n\nElement replace (with a socket different from the one stored) may race\nwith socket's close() link popping \u0026 unlinking. __sock_map_delete()\nunconditionally unrefs the (wrong) element:\n\n// set map[0] = s0\nmap_update_elem(map, 0, s0)\n\n// drop fd of s0\nclose(s0)\n  sock_map_close()\n    lock_sock(sk)               (s0!)\n    sock_map_remove_links(sk)\n      link = sk_psock_link_pop()\n      sock_map_unlink(sk, link)\n        sock_map_delete_from_link\n                                        // replace map[0] with s1\n                                        map_update_elem(map, 0, s1)\n                                          sock_map_update_elem\n                                (s1!)       lock_sock(sk)\n                                            sock_map_update_common\n                                              psock = sk_psock(sk)\n                                              spin_lock(\u0026stab-\u003elock)\n                                              osk = stab-\u003esks[idx]\n                                              sock_map_add_link(..., \u0026stab-\u003esks[idx])\n                                              sock_map_unref(osk, \u0026stab-\u003esks[idx])\n                                                psock = sk_psock(osk)\n                                                sk_psock_put(sk, psock)\n                                                  if (refcount_dec_and_test(\u0026psock))\n                                                    sk_psock_drop(sk, psock)\n                                              spin_unlock(\u0026stab-\u003elock)\n                                            unlock_sock(sk)\n          __sock_map_delete\n            spin_lock(\u0026stab-\u003elock)\n            sk = *psk                        // s1 replaced s0; sk == s1\n            if (!sk_test || sk_test == sk)   // sk_test (s0) != sk (s1); no branch\n              sk = xchg(psk, NULL)\n            if (sk)\n              sock_map_unref(sk, psk)        // unref s1; sks[idx] will dangle\n                psock = sk_psock(sk)\n                sk_psock_put(sk, psock)\n                  if (refcount_dec_and_test())\n                    sk_psock_drop(sk, psock)\n            spin_unlock(\u0026stab-\u003elock)\n    release_sock(sk)\n\nThen close(map) enqueues bpf_map_free_deferred, which finally calls\nsock_map_free(). This results in some refcount_t warnings along with\na KASAN splat [1].\n\nFix __sock_map_delete(), do not allow sock_map_unref() on elements that\nmay have been replaced.\n\n[1]:\nBUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330\nWrite of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063\n\nCPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\nWorkqueue: events_unbound bpf_map_free_deferred\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n kasan_check_range+0x10f/0x1e0\n sock_map_free+0x10e/0x330\n bpf_map_free_deferred+0x173/0x320\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x29e/0x360\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 1202:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n unix_create1+0x88/0x8a0\n unix_create+0xc5/0x180\n __sock_create+0x241/0x650\n __sys_socketpair+0x1ce/0x420\n __x64_sys_socketpair+0x92/0x100\n do_syscall_64+0x93/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 46:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n sk_psock_destroy+0x73e/0xa50\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x29e/0x360\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n\nThe bu\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36940225-d5ae-4678-8fdb-3c5e5fcab98c",
      "id": "CVE-2024-56701",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Fix dtl_access_lock to be a rw_semaphore\n\nThe dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because\nthe code calls kmalloc() while holding it, which can sleep:\n\n  # echo 1 \u003e /proc/powerpc/vcpudispatch_stats\n  BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh\n  preempt_count: 1, expected: 0\n  3 locks held by sh/199:\n   #0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x324/0x438\n   #1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at: vcpudispatch_stats_write+0xd4/0x5f4\n   #2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at: vcpudispatch_stats_write+0x220/0x5f4\n  CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152\n  Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries\n  Call Trace:\n    dump_stack_lvl+0x130/0x148 (unreliable)\n    __might_resched+0x174/0x410\n    kmem_cache_alloc_noprof+0x340/0x3d0\n    alloc_dtl_buffers+0x124/0x1ac\n    vcpudispatch_stats_write+0x2a8/0x5f4\n    proc_reg_write+0xf4/0x150\n    vfs_write+0xfc/0x438\n    ksys_write+0x88/0x148\n    system_call_exception+0x1c4/0x5a0\n    system_call_common+0xf4/0x258",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "315c29cd-044a-4eef-825c-a38c347e941d",
      "id": "CVE-2024-56703",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix soft lockups in fib6_select_path under high next hop churn\n\nSoft lockups have been observed on a cluster of Linux-based edge routers\nlocated in a highly dynamic environment. Using the `bird` service, these\nrouters continuously update BGP-advertised routes due to frequently\nchanging nexthop destinations, while also managing significant IPv6\ntraffic. The lockups occur during the traversal of the multipath\ncircular linked-list in the `fib6_select_path` function, particularly\nwhile iterating through the siblings in the list. The issue typically\narises when the nodes of the linked list are unexpectedly deleted\nconcurrently on a different core—indicated by their 'next' and\n'previous' elements pointing back to the node itself and their reference\ncount dropping to zero. This results in an infinite loop, leading to a\nsoft lockup that triggers a system panic via the watchdog timer.\n\nApply RCU primitives in the problematic code sections to resolve the\nissue. Where necessary, update the references to fib6_siblings to\nannotate or use the RCU APIs.\n\nInclude a test script that reproduces the issue. The script\nperiodically updates the routing table while generating a heavy load\nof outgoing IPv6 traffic through multiple iperf3 clients. It\nconsistently induces infinite soft lockups within a couple of minutes.\n\nKernel log:\n\n 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb\n 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3\n 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4\n 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03\n 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f\n 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756\n 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af\n 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d\n-- \u003cIRQ stack\u003e --\n 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb\n    [exception RIP: fib6_select_path+299]\n    RIP: ffffffff8ddafe7b  RSP: ffffbd13003d37b8  RFLAGS: 00000287\n    RAX: ffff975850b43600  RBX: ffff975850b40200  RCX: 0000000000000000\n    RDX: 000000003fffffff  RSI: 0000000051d383e4  RDI: ffff975850b43618\n    RBP: ffffbd13003d3800   R8: 0000000000000000   R9: ffff975850b40200\n    R10: 0000000000000000  R11: 0000000000000000  R12: ffffbd13003d3830\n    R13: ffff975850b436a8  R14: ffff975850b43600  R15: 0000000000000007\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c\n10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c\n11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5\n12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47\n13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0\n14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274\n15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474\n16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615\n17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec\n18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3\n19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9\n20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice]\n21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice]\n22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice]\n23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000\n24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581\n25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9\n26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47\n27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30\n28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f\n29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64\n30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e78d06b0-3ed6-4ece-b76b-d1ebac30175d",
      "id": "CVE-2024-57795",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Remove the direct link to net_device\n\nThe similar patch in siw is in the link:\nhttps://git.kernel.org/rdma/rdma/c/16b87037b48889\n\nThis problem also occurred in RXE. The following analyze this problem.\nIn the following Call Traces:\n\"\nBUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\nRead of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295\n\nCPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted\n6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0\nHardware name: Google Compute Engine/Google Compute Engine,\nBIOS Google 09/13/2024\nWorkqueue: infiniband ib_cache_event_task\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n dev_get_flags+0x188/0x1d0 net/core/dev.c:8782\n rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60\n __ib_query_port drivers/infiniband/core/device.c:2111 [inline]\n ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143\n ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494\n ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f2/0x390 kernel/kthread.c:389\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\"\n\n1). In the link [1],\n\n\"\n infiniband syz2: set down\n\"\n\nThis means that on 839.350575, the event ib_cache_event_task was sent andi\nqueued in ib_wq.\n\n2). In the link [1],\n\n\"\n team0 (unregistering): Port device team_slave_0 removed\n\"\n\nIt indicates that before 843.251853, the net device should be freed.\n\n3). In the link [1],\n\n\"\n BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0\n\"\n\nThis means that on 850.559070, this slab-use-after-free problem occurred.\n\nIn all, on 839.350575, the event ib_cache_event_task was sent and queued\nin ib_wq,\n\nbefore 843.251853, the net device veth was freed.\n\non 850.559070, this event was executed, and the mentioned freed net device\nwas called. Thus, the above call trace occurred.\n\n[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b3a93f1-1bbb-4de6-b828-7764434aba2a",
      "id": "CVE-2024-58011",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: int3472: Check for adev == NULL\n\nNot all devices have an ACPI companion fwnode, so adev might be NULL. This\ncan e.g. (theoretically) happen when a user manually binds one of\nthe int3472 drivers to another i2c/platform device through sysfs.\n\nAdd a check for adev not being set and return -ENODEV in that case to\navoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8ad90cc-34b6-46ec-91b4-4a06916da367",
      "id": "CVE-2025-37801",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-imx: Add check for spi_imx_setupxfer()\n\nAdd check for the return value of spi_imx_setupxfer().\nspi_imx-\u003erx and spi_imx-\u003etx function pointer can be NULL when\nspi_imx_setupxfer() return error, and make NULL pointer dereference.\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n Call trace:\n  0x0\n  spi_imx_pio_transfer+0x50/0xd8\n  spi_imx_transfer_one+0x18c/0x858\n  spi_transfer_one_message+0x43c/0x790\n  __spi_pump_transfer_message+0x238/0x5d4\n  __spi_sync+0x2b0/0x454\n  spi_write_then_read+0x11c/0x200",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7bc2bf1a-99d3-442c-9935-7ac60619b496",
      "id": "CVE-2025-37807",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix kmemleak warning for percpu hashmap\n\nVlad Poenaru reported the following kmemleak issue:\n\n  unreferenced object 0x606fd7c44ac8 (size 32):\n    backtrace (crc 0):\n      pcpu_alloc_noprof+0x730/0xeb0\n      bpf_map_alloc_percpu+0x69/0xc0\n      prealloc_init+0x9d/0x1b0\n      htab_map_alloc+0x363/0x510\n      map_create+0x215/0x3a0\n      __sys_bpf+0x16b/0x3e0\n      __x64_sys_bpf+0x18/0x20\n      do_syscall_64+0x7b/0x150\n      entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFurther investigation shows the reason is due to not 8-byte aligned\nstore of percpu pointer in htab_elem_set_ptr():\n  *(void __percpu **)(l-\u003ekey + key_size) = pptr;\n\nNote that the whole htab_elem alignment is 8 (for x86_64). If the key_size\nis 4, that means pptr is stored in a location which is 4 byte aligned but\nnot 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based\non 8 byte stride, so it won't detect above pptr, hence reporting the memory\nleak.\n\nIn htab_map_alloc(), we already have\n\n        htab-\u003eelem_size = sizeof(struct htab_elem) +\n                          round_up(htab-\u003emap.key_size, 8);\n        if (percpu)\n                htab-\u003eelem_size += sizeof(void *);\n        else\n                htab-\u003eelem_size += round_up(htab-\u003emap.value_size, 8);\n\nSo storing pptr with 8-byte alignment won't cause any problem and can fix\nkmemleak too.\n\nThe issue can be reproduced with bpf selftest as well:\n  1. Enable CONFIG_DEBUG_KMEMLEAK config\n  2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c.\n     The purpose is to keep map available so kmemleak can be detected.\n  3. run './test_progs -t for_each/hash_map \u0026' and a kmemleak should be reported.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df87e75d-8046-4364-86d7-09884e69a016",
      "id": "CVE-2025-37890",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc\n\nAs described in Gerrard's report [1], we have a UAF case when an hfsc class\nhas a netem child qdisc. The crux of the issue is that hfsc is assuming\nthat checking for cl-\u003eqdisc-\u003eq.qlen == 0 guarantees that it hasn't inserted\nthe class in the vttree or eltree (which is not true for the netem\nduplicate case).\n\nThis patch checks the n_active class variable to make sure that the code\nwon't insert the class in the vttree or eltree twice, catering for the\nreentrant case.\n\n[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "774fc9f5-b493-4ddb-a590-f677b5c63cf3",
      "id": "CVE-2025-38001",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Address reentrant enqueue adding class to eltree twice\n\nSavino says:\n    \"We are writing to report that this recent patch\n    (141d34391abbb315d68556b7c67ad97885407547) [1]\n    can be bypassed, and a UAF can still occur when HFSC is utilized with\n    NETEM.\n\n    The patch only checks the cl-\u003ecl_nactive field to determine whether\n    it is the first insertion or not [2], but this field is only\n    incremented by init_vf [3].\n\n    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the\n    check and insert the class twice in the eltree.\n    Under normal conditions, this would lead to an infinite loop in\n    hfsc_dequeue for the reasons we already explained in this report [5].\n\n    However, if TBF is added as root qdisc and it is configured with a\n    very low rate,\n    it can be utilized to prevent packets from being dequeued.\n    This behavior can be exploited to perform subsequent insertions in the\n    HFSC eltree and cause a UAF.\"\n\nTo fix both the UAF and the infinite loop, with netem as an hfsc child,\ncheck explicitly in hfsc_enqueue whether the class is already in the eltree\nwhenever the HFSC_RSC flag is set.\n\n[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547\n[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572\n[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677\n[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574\n[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d988ecdb-2ee6-4a4d-8614-f21ab8c5e2f2",
      "id": "CVE-2025-38035",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: don't restore null sk_state_change\n\nqueue-\u003estate_change is set as part of nvmet_tcp_set_queue_sock(), but if\nthe TCP connection isn't established when nvmet_tcp_set_queue_sock() is\ncalled then queue-\u003estate_change isn't set and sock-\u003esk-\u003esk_state_change\nisn't replaced.\n\nAs such we don't need to restore sock-\u003esk-\u003esk_state_change if\nqueue-\u003estate_change is NULL.\n\nThis avoids NULL pointer dereferences such as this:\n\n[  286.462026][    C0] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[  286.462814][    C0] #PF: supervisor instruction fetch in kernel mode\n[  286.463796][    C0] #PF: error_code(0x0010) - not-present page\n[  286.464392][    C0] PGD 8000000140620067 P4D 8000000140620067 PUD 114201067 PMD 0\n[  286.465086][    C0] Oops: Oops: 0010 [#1] SMP KASAN PTI\n[  286.465559][    C0] CPU: 0 UID: 0 PID: 1628 Comm: nvme Not tainted 6.15.0-rc2+ #11 PREEMPT(voluntary)\n[  286.466393][    C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n[  286.467147][    C0] RIP: 0010:0x0\n[  286.467420][    C0] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[  286.467977][    C0] RSP: 0018:ffff8883ae008580 EFLAGS: 00010246\n[  286.468425][    C0] RAX: 0000000000000000 RBX: ffff88813fd34100 RCX: ffffffffa386cc43\n[  286.469019][    C0] RDX: 1ffff11027fa68b6 RSI: 0000000000000008 RDI: ffff88813fd34100\n[  286.469545][    C0] RBP: ffff88813fd34160 R08: 0000000000000000 R09: ffffed1027fa682c\n[  286.470072][    C0] R10: ffff88813fd34167 R11: 0000000000000000 R12: ffff88813fd344c3\n[  286.470585][    C0] R13: ffff88813fd34112 R14: ffff88813fd34aec R15: ffff888132cdd268\n[  286.471070][    C0] FS:  00007fe3c04c7d80(0000) GS:ffff88840743f000(0000) knlGS:0000000000000000\n[  286.471644][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  286.472543][    C0] CR2: ffffffffffffffd6 CR3: 000000012daca000 CR4: 00000000000006f0\n[  286.473500][    C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  286.474467][    C0] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400\n[  286.475453][    C0] Call Trace:\n[  286.476102][    C0]  \u003cIRQ\u003e\n[  286.476719][    C0]  tcp_fin+0x2bb/0x440\n[  286.477429][    C0]  tcp_data_queue+0x190f/0x4e60\n[  286.478174][    C0]  ? __build_skb_around+0x234/0x330\n[  286.478940][    C0]  ? rcu_is_watching+0x11/0xb0\n[  286.479659][    C0]  ? __pfx_tcp_data_queue+0x10/0x10\n[  286.480431][    C0]  ? tcp_try_undo_loss+0x640/0x6c0\n[  286.481196][    C0]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[  286.482046][    C0]  ? kvm_clock_get_cycles+0x14/0x30\n[  286.482769][    C0]  ? ktime_get+0x66/0x150\n[  286.483433][    C0]  ? rcu_is_watching+0x11/0xb0\n[  286.484146][    C0]  tcp_rcv_established+0x6e4/0x2050\n[  286.484857][    C0]  ? rcu_is_watching+0x11/0xb0\n[  286.485523][    C0]  ? ipv4_dst_check+0x160/0x2b0\n[  286.486203][    C0]  ? __pfx_tcp_rcv_established+0x10/0x10\n[  286.486917][    C0]  ? lock_release+0x217/0x2c0\n[  286.487595][    C0]  tcp_v4_do_rcv+0x4d6/0x9b0\n[  286.488279][    C0]  tcp_v4_rcv+0x2af8/0x3e30\n[  286.488904][    C0]  ? raw_local_deliver+0x51b/0xad0\n[  286.489551][    C0]  ? rcu_is_watching+0x11/0xb0\n[  286.490198][    C0]  ? __pfx_tcp_v4_rcv+0x10/0x10\n[  286.490813][    C0]  ? __pfx_raw_local_deliver+0x10/0x10\n[  286.491487][    C0]  ? __pfx_nf_confirm+0x10/0x10 [nf_conntrack]\n[  286.492275][    C0]  ? rcu_is_watching+0x11/0xb0\n[  286.492900][    C0]  ip_protocol_deliver_rcu+0x8f/0x370\n[  286.493579][    C0]  ip_local_deliver_finish+0x297/0x420\n[  286.494268][    C0]  ip_local_deliver+0x168/0x430\n[  286.494867][    C0]  ? __pfx_ip_local_deliver+0x10/0x10\n[  286.495498][    C0]  ? __pfx_ip_local_deliver_finish+0x10/0x10\n[  286.496204][    C0]  ? ip_rcv_finish_core+0x19a/0x1f20\n[  286.496806][    C0]  ? lock_release+0x217/0x2c0\n[  286.497414][    C0]  ip_rcv+0x455/0x6e0\n[  286.497945][    C0]  ? __pfx_ip_rcv+0x10/0x10\n[ \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "758af830-6144-4df8-8c5d-25255ef1023a",
      "id": "CVE-2020-25671",
      "description": "A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1afbf70-e40f-4b2f-bff2-7eaa7c4be38e",
      "id": "CVE-2025-38102",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify\n\nDuring our test, it is found that a warning can be trigger in try_grab_folio\nas follow:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef)\n  RIP: 0010:try_grab_folio+0x106/0x130\n  Call Trace:\n   \u003cTASK\u003e\n   follow_huge_pmd+0x240/0x8e0\n   follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0\n   follow_pud_mask.constprop.0.isra.0+0x14a/0x170\n   follow_page_mask+0x1c2/0x1f0\n   __get_user_pages+0x176/0x950\n   __gup_longterm_locked+0x15b/0x1060\n   ? gup_fast+0x120/0x1f0\n   gup_fast_fallback+0x17e/0x230\n   get_user_pages_fast+0x5f/0x80\n   vmci_host_unlocked_ioctl+0x21c/0xf80\n  RIP: 0033:0x54d2cd\n  ---[ end trace 0000000000000000 ]---\n\nDigging into the source, context-\u003enotify_page may init by get_user_pages_fast\nand can be seen in vmci_ctx_unset_notify which will try to put_page. However\nget_user_pages_fast is not finished here and lead to following\ntry_grab_folio warning. The race condition is shown as follow:\n\ncpu0\t\t\tcpu1\nvmci_host_do_set_notify\nvmci_host_setup_notify\nget_user_pages_fast(uva, 1, FOLL_WRITE, \u0026context-\u003enotify_page);\nlockless_pages_from_mm\ngup_pgd_range\ngup_huge_pmd  // update \u0026context-\u003enotify_page\n\t\t\tvmci_host_do_set_notify\n\t\t\tvmci_ctx_unset_notify\n\t\t\tnotify_page = context-\u003enotify_page;\n\t\t\tif (notify_page)\n\t\t\tput_page(notify_page);\t// page is freed\n__gup_longterm_locked\n__get_user_pages\nfollow_trans_huge_pmd\ntry_grab_folio // warn here\n\nTo slove this, use local variable page to make notify_page can be seen\nafter finish get_user_pages_fast.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78999d60-8f0b-42a2-84d9-6e7587691679",
      "id": "CVE-2025-38403",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: Clear the vmci transport packet properly when initializing it\n\nIn vmci_transport_packet_init memset the vmci_transport_packet before\npopulating the fields to avoid any uninitialised data being left in the\nstructure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f1b0830-059e-45a0-80eb-f980728762b9",
      "id": "CVE-2025-38464",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free in tipc_conn_close().\n\nsyzbot reported a null-ptr-deref in tipc_conn_close() during netns\ndismantle. [0]\n\ntipc_topsrv_stop() iterates tipc_net(net)-\u003etopsrv-\u003econn_idr and calls\ntipc_conn_close() for each tipc_conn.\n\nThe problem is that tipc_conn_close() is called after releasing the\nIDR lock.\n\nAt the same time, there might be tipc_conn_recv_work() running and it\ncould call tipc_conn_close() for the same tipc_conn and release its\nlast -\u003ekref.\n\nOnce we release the IDR lock in tipc_topsrv_stop(), there is no\nguarantee that the tipc_conn is alive.\n\nLet's hold the ref before releasing the lock and put the ref after\ntipc_conn_close() in tipc_topsrv_stop().\n\n[0]:\nBUG: KASAN: use-after-free in tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165\nRead of size 8 at addr ffff888099305a08 by task kworker/u4:3/435\n\nCPU: 0 PID: 435 Comm: kworker/u4:3 Not tainted 4.19.204-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: netns cleanup_net\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1fc/0x2ef lib/dump_stack.c:118\n print_address_description.cold+0x54/0x219 mm/kasan/report.c:256\n kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354\n kasan_report mm/kasan/report.c:412 [inline]\n __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433\n tipc_conn_close+0x122/0x140 net/tipc/topsrv.c:165\n tipc_topsrv_stop net/tipc/topsrv.c:701 [inline]\n tipc_topsrv_exit_net+0x27b/0x5c0 net/tipc/topsrv.c:722\n ops_exit_list+0xa5/0x150 net/core/net_namespace.c:153\n cleanup_net+0x3b4/0x8b0 net/core/net_namespace.c:553\n process_one_work+0x864/0x1570 kernel/workqueue.c:2153\n worker_thread+0x64c/0x1130 kernel/workqueue.c:2296\n kthread+0x33f/0x460 kernel/kthread.c:259\n ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415\n\nAllocated by task 23:\n kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625\n kmalloc include/linux/slab.h:515 [inline]\n kzalloc include/linux/slab.h:709 [inline]\n tipc_conn_alloc+0x43/0x4f0 net/tipc/topsrv.c:192\n tipc_topsrv_accept+0x1b5/0x280 net/tipc/topsrv.c:470\n process_one_work+0x864/0x1570 kernel/workqueue.c:2153\n worker_thread+0x64c/0x1130 kernel/workqueue.c:2296\n kthread+0x33f/0x460 kernel/kthread.c:259\n ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415\n\nFreed by task 23:\n __cache_free mm/slab.c:3503 [inline]\n kfree+0xcc/0x210 mm/slab.c:3822\n tipc_conn_kref_release net/tipc/topsrv.c:150 [inline]\n kref_put include/linux/kref.h:70 [inline]\n conn_put+0x2cd/0x3a0 net/tipc/topsrv.c:155\n process_one_work+0x864/0x1570 kernel/workqueue.c:2153\n worker_thread+0x64c/0x1130 kernel/workqueue.c:2296\n kthread+0x33f/0x460 kernel/kthread.c:259\n ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415\n\nThe buggy address belongs to the object at ffff888099305a00\n which belongs to the cache kmalloc-512 of size 512\nThe buggy address is located 8 bytes inside of\n 512-byte region [ffff888099305a00, ffff888099305c00)\nThe buggy address belongs to the page:\npage:ffffea000264c140 count:1 mapcount:0 mapping:ffff88813bff0940 index:0x0\nflags: 0xfff00000000100(slab)\nraw: 00fff00000000100 ffffea00028b6b88 ffffea0002cd2b08 ffff88813bff0940\nraw: 0000000000000000 ffff888099305000 0000000100000006 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888099305900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff888099305980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff888099305a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                      ^\n ffff888099305a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff888099305b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e5d474f-345e-4cf4-bcd5-ea776ce1f47f",
      "id": "CVE-2025-38480",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix use of uninitialized data in insn_rw_emulate_bits()\n\nFor Comedi `INSN_READ` and `INSN_WRITE` instructions on \"digital\"\nsubdevices (subdevice types `COMEDI_SUBD_DI`, `COMEDI_SUBD_DO`, and\n`COMEDI_SUBD_DIO`), it is common for the subdevice driver not to have\n`insn_read` and `insn_write` handler functions, but to have an\n`insn_bits` handler function for handling Comedi `INSN_BITS`\ninstructions.  In that case, the subdevice's `insn_read` and/or\n`insn_write` function handler pointers are set to point to the\n`insn_rw_emulate_bits()` function by `__comedi_device_postconfig()`.\n\nFor `INSN_WRITE`, `insn_rw_emulate_bits()` currently assumes that the\nsupplied `data[0]` value is a valid copy from user memory.  It will at\nleast exist because `do_insnlist_ioctl()` and `do_insn_ioctl()` in\n\"comedi_fops.c\" ensure at lease `MIN_SAMPLES` (16) elements are\nallocated.  However, if `insn-\u003en` is 0 (which is allowable for\n`INSN_READ` and `INSN_WRITE` instructions, then `data[0]` may contain\nuninitialized data, and certainly contains invalid data, possibly from a\ndifferent instruction in the array of instructions handled by\n`do_insnlist_ioctl()`.  This will result in an incorrect value being\nwritten to the digital output channel (or to the digital input/output\nchannel if configured as an output), and may be reflected in the\ninternal saved state of the channel.\n\nFix it by returning 0 early if `insn-\u003en` is 0, before reaching the code\nthat accesses `data[0]`.  Previously, the function always returned 1 on\nsuccess, but it is supposed to be the number of data samples actually\nread or written up to `insn-\u003en`, which is 0 in this case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b13171b-89e9-4868-9ab3-db447afb0832",
      "id": "CVE-2025-39746",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: shutdown driver when hardware is unreliable\n\nIn rare cases, ath10k may lose connection with the PCIe bus due to\nsome unknown reasons, which could further lead to system crashes during\nresuming due to watchdog timeout:\n\nath10k_pci 0000:01:00.0: wmi command 20486 timeout, restarting hardware\nath10k_pci 0000:01:00.0: already restarting\nath10k_pci 0000:01:00.0: failed to stop WMI vdev 0: -11\nath10k_pci 0000:01:00.0: failed to stop vdev 0: -11\nieee80211 phy0: PM: **** DPM device timeout ****\nCall Trace:\n panic+0x125/0x315\n dpm_watchdog_set+0x54/0x54\n dpm_watchdog_handler+0x57/0x57\n call_timer_fn+0x31/0x13c\n\nAt this point, all WMI commands will timeout and attempt to restart\ndevice. So set a threshold for consecutive restart failures. If the\nthreshold is exceeded, consider the hardware is unreliable and all\nath10k operations should be skipped to avoid system crash.\n\nfail_cont_count and pending_recovery are atomic variables, and\ndo not involve complex conditional logic. Therefore, even if recovery\ncheck and reconfig complete are executed concurrently, the recovery\nmechanism will not be broken.\n\nTested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f590f3e-d8cf-40b1-86b1-1a9c62b7c591",
      "id": "CVE-2020-8428",
      "description": "fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ef4d354-dbbb-46c3-80f4-57e38658c702",
      "id": "CVE-2021-28375",
      "description": "An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f683073f-c0df-4af0-8007-d186b3660191",
      "id": "CVE-2021-28688",
      "description": "The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39c08cf0-c761-4f97-8b08-d9da244229bd",
      "id": "CVE-2021-29648",
      "description": "An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6084bafc-13d4-4726-ba50-8eb932b4d318",
      "id": "CVE-2021-3679",
      "description": "A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c19f381b-8a01-4023-8be6-eafcb8f9d959",
      "id": "CVE-2021-47113",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort in rename_exchange if we fail to insert the second ref\n\nError injection stress uncovered a problem where we'd leave a dangling\ninode ref if we failed during a rename_exchange.  This happens because\nwe insert the inode ref for one side of the rename, and then for the\nother side.  If this second inode ref insert fails we'll leave the first\none dangling and leave a corrupt file system behind.  Fix this by\naborting if we did the insert for the first inode ref.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b4f6ed22-400e-4268-82fc-4a5b3f0d0a22",
      "id": "CVE-2021-47189",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory ordering between normal and ordered work functions\n\nOrdered work functions aren't guaranteed to be handled by the same thread\nwhich executed the normal work functions. The only way execution between\nnormal/ordered functions is synchronized is via the WORK_DONE_BIT,\nunfortunately the used bitops don't guarantee any ordering whatsoever.\n\nThis manifested as seemingly inexplicable crashes on ARM64, where\nasync_chunk::inode is seen as non-null in async_cow_submit which causes\nsubmit_compressed_extents to be called and crash occurs because\nasync_chunk::inode suddenly became NULL. The call trace was similar to:\n\n    pc : submit_compressed_extents+0x38/0x3d0\n    lr : async_cow_submit+0x50/0xd0\n    sp : ffff800015d4bc20\n\n    \u003cregisters omitted for brevity\u003e\n\n    Call trace:\n     submit_compressed_extents+0x38/0x3d0\n     async_cow_submit+0x50/0xd0\n     run_ordered_work+0xc8/0x280\n     btrfs_work_helper+0x98/0x250\n     process_one_work+0x1f0/0x4ac\n     worker_thread+0x188/0x504\n     kthread+0x110/0x114\n     ret_from_fork+0x10/0x18\n\nFix this by adding respective barrier calls which ensure that all\naccesses preceding setting of WORK_DONE_BIT are strictly ordered before\nsetting the flag. At the same time add a read barrier after reading of\nWORK_DONE_BIT in run_ordered_work which ensures all subsequent loads\nwould be strictly ordered after reading the bit. This in turn ensures\nare all accesses before WORK_DONE_BIT are going to be strictly ordered\nbefore any access that can occur in ordered_func.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1e306b7-aa68-4d61-97e4-f2f44be36698",
      "id": "CVE-2021-47204",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dpaa2-eth: fix use-after-free in dpaa2_eth_remove\n\nAccess to netdev after free_netdev() will cause use-after-free bug.\nMove debug log before free_netdev() call to avoid it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2dff1cf1-a51e-4dd3-abee-55ce0a1f28db",
      "id": "CVE-2021-47281",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix race of snd_seq_timer_open()\n\nThe timer instance per queue is exclusive, and snd_seq_timer_open()\nshould have managed the concurrent accesses.  It looks as if it's\nchecking the already existing timer instance at the beginning, but\nit's not right, because there is no protection, hence any later\nconcurrent call of snd_seq_timer_open() may override the timer\ninstance easily.  This may result in UAF, as the leftover timer\ninstance can keep running while the queue itself gets closed, as\nspotted by syzkaller recently.\n\nFor avoiding the race, add a proper check at the assignment of\ntmr-\u003etimeri again, and return -EBUSY if it's been already registered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6871442d-d8f8-4347-9084-16acaeef6e9f",
      "id": "CVE-2021-3564",
      "description": "A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36b699c3-9848-480c-a4f2-2d60d084527e",
      "id": "CVE-2021-47324",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix possible use-after-free in wdt_startup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91c4ad3b-0a5c-4fc2-9bf7-49b731bf5571",
      "id": "CVE-2021-47442",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: fix possible memory leak in digital_in_send_sdd_req()\n\n'skb' is allocated in digital_in_send_sdd_req(), but not free when\ndigital_in_send_cmd() failed, which will cause memory leak. Fix it\nby freeing 'skb' if digital_in_send_cmd() return failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5760d79-46a2-4f48-bd33-85458f9b9a73",
      "id": "CVE-2021-47490",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix memleak in ttm_transfered_destroy\n\nWe need to cleanup the fences for ghost objects as well.\n\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=214029\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=214447",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29b4b730-dc1f-43be-97d4-2bb9badb7c96",
      "id": "CVE-2021-47493",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix race between searching chunks and release journal_head from buffer_head\n\nEncountered a race between ocfs2_test_bg_bit_allocatable() and\njbd2_journal_put_journal_head() resulting in the below vmcore.\n\n  PID: 106879  TASK: ffff880244ba9c00  CPU: 2   COMMAND: \"loop3\"\n  Call trace:\n    panic\n    oops_end\n    no_context\n    __bad_area_nosemaphore\n    bad_area_nosemaphore\n    __do_page_fault\n    do_page_fault\n    page_fault\n      [exception RIP: ocfs2_block_group_find_clear_bits+316]\n    ocfs2_block_group_find_clear_bits [ocfs2]\n    ocfs2_cluster_group_search [ocfs2]\n    ocfs2_search_chain [ocfs2]\n    ocfs2_claim_suballoc_bits [ocfs2]\n    __ocfs2_claim_clusters [ocfs2]\n    ocfs2_claim_clusters [ocfs2]\n    ocfs2_local_alloc_slide_window [ocfs2]\n    ocfs2_reserve_local_alloc_bits [ocfs2]\n    ocfs2_reserve_clusters_with_limit [ocfs2]\n    ocfs2_reserve_clusters [ocfs2]\n    ocfs2_lock_refcount_allocators [ocfs2]\n    ocfs2_make_clusters_writable [ocfs2]\n    ocfs2_replace_cow [ocfs2]\n    ocfs2_refcount_cow [ocfs2]\n    ocfs2_file_write_iter [ocfs2]\n    lo_rw_aio\n    loop_queue_work\n    kthread_worker_fn\n    kthread\n    ret_from_fork\n\nWhen ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the\nbg_bh-\u003eb_private NULL as jbd2_journal_put_journal_head() raced and\nreleased the jounal head from the buffer head.  Needed to take bit lock\nfor the bit 'BH_JournalHead' to fix this race.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0db40e8c-8ae4-4bc2-9aed-b4360cae1d00",
      "id": "CVE-2021-47520",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: pch_can: pch_can_rx_normal: fix use after free\n\nAfter calling netif_receive_skb(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is dereferenced\njust after the call netif_receive_skb(skb).\n\nReordering the lines solves the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6a7200e-c540-4b81-94d9-80aeaa0bc04e",
      "id": "CVE-2021-47580",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix type in min_t to avoid stack OOB\n\nChange min_t() to use type \"u32\" instead of type \"int\" to avoid stack out\nof bounds. With min_t() type \"int\" the values get sign extended and the\nlarger value gets used causing stack out of bounds.\n\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline]\nBUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976\nRead of size 127 at addr ffff888072607128 by task syz-executor.7/18707\n\nCPU: 1 PID: 18707 Comm: syz-executor.7 Not tainted 5.15.0-syzk #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\n print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:256\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189\n memcpy+0x23/0x60 mm/kasan/shadow.c:65\n memcpy include/linux/fortify-string.h:191 [inline]\n sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976\n sg_copy_from_buffer+0x33/0x40 lib/scatterlist.c:1000\n fill_from_dev_buffer.part.34+0x82/0x130 drivers/scsi/scsi_debug.c:1162\n fill_from_dev_buffer drivers/scsi/scsi_debug.c:1888 [inline]\n resp_readcap16+0x365/0x3b0 drivers/scsi/scsi_debug.c:1887\n schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478\n scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533\n scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]\n scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62\n sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:836\n sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:774\n sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:939\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5601d626-c84f-4107-a398-21a51cb208bb",
      "id": "CVE-2021-47589",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: fix double free in `igbvf_probe`\n\nIn `igbvf_probe`, if register_netdev() fails, the program will go to\nlabel err_hw_init, and then to label err_ioremap. In free_netdev() which\nis just below label err_ioremap, there is `list_for_each_entry_safe` and\n`netif_napi_del` which aims to delete all entries in `dev-\u003enapi_list`.\nThe program has added an entry `adapter-\u003erx_ring-\u003enapi` which is added by\n`netif_napi_add` in igbvf_alloc_queues(). However, adapter-\u003erx_ring has\nbeen freed below label err_hw_init. So this a UAF.\n\nIn terms of how to patch the problem, we can refer to igbvf_remove() and\ndelete the entry before `adapter-\u003erx_ring`.\n\nThe KASAN logs are as follows:\n\n[   35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450\n[   35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366\n[   35.128360]\n[   35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14\n[   35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[   35.131749] Call Trace:\n[   35.132199]  dump_stack_lvl+0x59/0x7b\n[   35.132865]  print_address_description+0x7c/0x3b0\n[   35.133707]  ? free_netdev+0x1fd/0x450\n[   35.134378]  __kasan_report+0x160/0x1c0\n[   35.135063]  ? free_netdev+0x1fd/0x450\n[   35.135738]  kasan_report+0x4b/0x70\n[   35.136367]  free_netdev+0x1fd/0x450\n[   35.137006]  igbvf_probe+0x121d/0x1a10 [igbvf]\n[   35.137808]  ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf]\n[   35.138751]  local_pci_probe+0x13c/0x1f0\n[   35.139461]  pci_device_probe+0x37e/0x6c0\n[   35.165526]\n[   35.165806] Allocated by task 366:\n[   35.166414]  ____kasan_kmalloc+0xc4/0xf0\n[   35.167117]  foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf]\n[   35.168078]  igbvf_probe+0x9c5/0x1a10 [igbvf]\n[   35.168866]  local_pci_probe+0x13c/0x1f0\n[   35.169565]  pci_device_probe+0x37e/0x6c0\n[   35.179713]\n[   35.179993] Freed by task 366:\n[   35.180539]  kasan_set_track+0x4c/0x80\n[   35.181211]  kasan_set_free_info+0x1f/0x40\n[   35.181942]  ____kasan_slab_free+0x103/0x140\n[   35.182703]  kfree+0xe3/0x250\n[   35.183239]  igbvf_probe+0x1173/0x1a10 [igbvf]\n[   35.184040]  local_pci_probe+0x13c/0x1f0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13c111e8-3407-40f3-ba53-f819f48a63fa",
      "id": "CVE-2021-47612",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix segfault in nfc_genl_dump_devices_done\n\nWhen kmalloc in nfc_genl_dump_devices() fails then\nnfc_genl_dump_devices_done() segfaults as below\n\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014\nWorkqueue: events netlink_sock_destruct_work\nRIP: 0010:klist_iter_exit+0x26/0x80\nCall Trace:\n\u003cTASK\u003e\nclass_dev_iter_exit+0x15/0x20\nnfc_genl_dump_devices_done+0x3b/0x50\ngenl_lock_done+0x84/0xd0\nnetlink_sock_destruct+0x8f/0x270\n__sk_destruct+0x64/0x3b0\nsk_destruct+0xa8/0xd0\n__sk_free+0x2e8/0x3d0\nsk_free+0x51/0x90\nnetlink_sock_destruct_work+0x1c/0x20\nprocess_one_work+0x411/0x710\nworker_thread+0x6fd/0xa80",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1dd796a-08af-4e6b-9eb2-6ba13db1ca11",
      "id": "CVE-2024-47683",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip Recompute DSC Params if no Stream on Link\n\n[why]\nEncounter NULL pointer dereference uner mst + dsc setup.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n    PGD 0 P4D 0\n    Oops: 0000 [#1] PREEMPT SMP NOPTI\n    CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2\n    Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022\n    RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\n    Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 \u003c48\u003e 8\u003e\n    RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\n    RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\n    RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\n    RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\n    R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\n    R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\n    FS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0\n    Call Trace:\n\u003cTASK\u003e\n     ? __die+0x23/0x70\n     ? page_fault_oops+0x171/0x4e0\n     ? plist_add+0xbe/0x100\n     ? exc_page_fault+0x7c/0x180\n     ? asm_exc_page_fault+0x26/0x30\n     ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n     ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n     compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     drm_atomic_check_only+0x5c5/0xa40\n     drm_mode_atomic_ioctl+0x76e/0xbc0\n\n[how]\ndsc recompute should be skipped if no mode change detected on the new\nrequest. If detected, keep checking whether the stream is already on\ncurrent state or not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ef50456-d214-4a4e-b158-79093cc41e04",
      "id": "CVE-2022-1353",
      "description": "A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9aa8d5e5-dede-4c70-aa1b-d7509625bec7",
      "id": "CVE-2022-25258",
      "description": "An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "518058c6-be4d-4242-a3a3-fd1cd5658323",
      "id": "CVE-2022-48711",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: improve size validations for received domain records\n\nThe function tipc_mon_rcv() allows a node to receive and process\ndomain_record structs from peer nodes to track their views of the\nnetwork topology.\n\nThis patch verifies that the number of members in a received domain\nrecord does not exceed the limit defined by MAX_MON_DOMAIN, something\nthat may otherwise lead to a stack overflow.\n\ntipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where\nwe are reading a 32 bit message data length field into a uint16.  To\navert any risk of bit overflow, we add an extra sanity check for this in\nthat function.  We cannot see that happen with the current code, but\nfuture designers being unaware of this risk, may introduce it by\nallowing delivery of very large (\u003e 64k) sk buffers from the bearer\nlayer.  This potential problem was identified by Eric Dumazet.\n\nThis fixes CVE-2022-0435",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2cedfb8-7779-4688-bc55-e52129eae2b2",
      "id": "CVE-2022-48810",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path\n\nip[6]mr_free_table() can only be called under RTNL lock.\n\nRTNL: assertion failed at net/core/dev.c (10367)\nWARNING: CPU: 1 PID: 5890 at net/core/dev.c:10367 unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367\nModules linked in:\nCPU: 1 PID: 5890 Comm: syz-executor.2 Not tainted 5.16.0-syzkaller-11627-g422ee58dc0ef #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:unregister_netdevice_many+0x1246/0x1850 net/core/dev.c:10367\nCode: 0f 85 9b ee ff ff e8 69 07 4b fa ba 7f 28 00 00 48 c7 c6 00 90 ae 8a 48 c7 c7 40 90 ae 8a c6 05 6d b1 51 06 01 e8 8c 90 d8 01 \u003c0f\u003e 0b e9 70 ee ff ff e8 3e 07 4b fa 4c 89 e7 e8 86 2a 59 fa e9 ee\nRSP: 0018:ffffc900046ff6e0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff888050f51d00 RSI: ffffffff815fa008 RDI: fffff520008dfece\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815f3d6e R11: 0000000000000000 R12: 00000000fffffff4\nR13: dffffc0000000000 R14: ffffc900046ff750 R15: ffff88807b7dc000\nFS:  00007f4ab736e700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fee0b4f8990 CR3: 000000001e7d2000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n mroute_clean_tables+0x244/0xb40 net/ipv6/ip6mr.c:1509\n ip6mr_free_table net/ipv6/ip6mr.c:389 [inline]\n ip6mr_rules_init net/ipv6/ip6mr.c:246 [inline]\n ip6mr_net_init net/ipv6/ip6mr.c:1306 [inline]\n ip6mr_net_init+0x3f0/0x4e0 net/ipv6/ip6mr.c:1298\n ops_init+0xaf/0x470 net/core/net_namespace.c:140\n setup_net+0x54f/0xbb0 net/core/net_namespace.c:331\n copy_net_ns+0x318/0x760 net/core/net_namespace.c:475\n create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110\n copy_namespaces+0x391/0x450 kernel/nsproxy.c:178\n copy_process+0x2e0c/0x7300 kernel/fork.c:2167\n kernel_clone+0xe7/0xab0 kernel/fork.c:2555\n __do_sys_clone+0xc8/0x110 kernel/fork.c:2672\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f4ab89f9059\nCode: Unable to access opcode bytes at RIP 0x7f4ab89f902f.\nRSP: 002b:00007f4ab736e118 EFLAGS: 00000206 ORIG_RAX: 0000000000000038\nRAX: ffffffffffffffda RBX: 00007f4ab8b0bf60 RCX: 00007f4ab89f9059\nRDX: 0000000020000280 RSI: 0000000020000270 RDI: 0000000040200000\nRBP: 00007f4ab8a5308d R08: 0000000020000300 R09: 0000000020000300\nR10: 00000000200002c0 R11: 0000000000000206 R12: 0000000000000000\nR13: 00007ffc3977cc1f R14: 00007f4ab736e300 R15: 0000000000022000\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12a15bde-405f-4f08-91f0-22c8be6c8fc1",
      "id": "CVE-2022-48967",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n  memcpy: detected field-spanning write (size 129) of single field \"target-\u003esensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "edb0a5da-0cb4-4630-8a22-847b156d14d9",
      "id": "CVE-2022-49019",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: nixge: fix NULL dereference\n\nIn function nixge_hw_dma_bd_release() dereference of NULL pointer\npriv-\u003erx_bd_v is possible for the case of its allocation failure in\nnixge_hw_dma_bd_init().\n\nMove for() loop with priv-\u003erx_bd_v dereference under the check for\nits validity.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7cc5e3e-a217-4b5d-8449-6f81ad582533",
      "id": "CVE-2022-41858",
      "description": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3909abeb-fde4-43c2-a52c-3444b2e20a35",
      "id": "CVE-2022-49044",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm integrity: fix memory corruption when tag_size is less than digest size\n\nIt is possible to set up dm-integrity in such a way that the\n\"tag_size\" parameter is less than the actual digest size. In this\nsituation, a part of the digest beyond tag_size is ignored.\n\nIn this case, dm-integrity would write beyond the end of the\nic-\u003erecalc_tags array and corrupt memory. The corruption happened in\nintegrity_recalc-\u003eintegrity_sector_checksum-\u003ecrypto_shash_final.\n\nFix this corruption by increasing the tags array so that it has enough\npadding at the end to accomodate the loop in integrity_recalc() being\nable to write a full digest size for the last member of the tags\narray.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e877825-b8c2-42ba-aa43-5d7d814b5614",
      "id": "CVE-2022-49067",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc: Fix virt_addr_valid() for 64-bit Book3E \u0026 32-bit\n\nmpe: On 64-bit Book3E vmalloc space starts at 0x8000000000000000.\n\nBecause of the way __pa() works we have:\n  __pa(0x8000000000000000) == 0, and therefore\n  virt_to_pfn(0x8000000000000000) == 0, and therefore\n  virt_addr_valid(0x8000000000000000) == true\n\nWhich is wrong, virt_addr_valid() should be false for vmalloc space.\nIn fact all vmalloc addresses that alias with a valid PFN will return\ntrue from virt_addr_valid(). That can cause bugs with hardened usercopy\nas described below by Kefeng Wang:\n\n  When running ethtool eth0 on 64-bit Book3E, a BUG occurred:\n\n    usercopy: Kernel memory exposure attempt detected from SLUB object not in SLUB page?! (offset 0, size 1048)!\n    kernel BUG at mm/usercopy.c:99\n    ...\n    usercopy_abort+0x64/0xa0 (unreliable)\n    __check_heap_object+0x168/0x190\n    __check_object_size+0x1a0/0x200\n    dev_ethtool+0x2494/0x2b20\n    dev_ioctl+0x5d0/0x770\n    sock_do_ioctl+0xf0/0x1d0\n    sock_ioctl+0x3ec/0x5a0\n    __se_sys_ioctl+0xf0/0x160\n    system_call_exception+0xfc/0x1f0\n    system_call_common+0xf8/0x200\n\n  The code shows below,\n\n    data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));\n    copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))\n\n  The data is alloced by vmalloc(), virt_addr_valid(ptr) will return true\n  on 64-bit Book3E, which leads to the panic.\n\n  As commit 4dd7554a6456 (\"powerpc/64: Add VIRTUAL_BUG_ON checks for __va\n  and __pa addresses\") does, make sure the virt addr above PAGE_OFFSET in\n  the virt_addr_valid() for 64-bit, also add upper limit check to make\n  sure the virt is below high_memory.\n\n  Meanwhile, for 32-bit PAGE_OFFSET is the virtual address of the start\n  of lowmem, high_memory is the upper low virtual address, the check is\n  suitable for 32-bit, this will fix the issue mentioned in commit\n  602946ec2f90 (\"powerpc: Set max_mapnr correctly\") too.\n\nOn 32-bit there is a similar problem with high memory, that was fixed in\ncommit 602946ec2f90 (\"powerpc: Set max_mapnr correctly\"), but that\ncommit breaks highmem and needs to be reverted.\n\nWe can't easily fix __pa(), we have code that relies on its current\nbehaviour. So for now add extra checks to virt_addr_valid().\n\nFor 64-bit Book3S the extra checks are not necessary, the combination of\nvirt_to_pfn() and pfn_valid() should yield the correct result, but they\nare harmless.\n\n[mpe: Add additional change log detail]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1558332f-39b3-4527-8180-925980e3c36c",
      "id": "CVE-2022-49157",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix premature hw access after PCI error\n\nAfter a recoverable PCI error has been detected and recovered, qla driver\nneeds to check to see if the error condition still persist and/or wait\nfor the OS to give the resume signal.\n\nSep  8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440\nqla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx]\nSep  8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60\n[qla2xxx]\nSep  8 22:26:03 localhost kernel: Call Trace:\nSep  8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx]\nSep  8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160\n[qla2xxx]\nSep  8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx]\nSep  8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120\n[qla2xxx]\nSep  8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80\nSep  8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80\nSep  8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90\nSep  8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0\nSep  8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240\nSep  8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0\nSep  8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360\n..\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI\ndisconnect.\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22:\nqla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to\ncapture FW dump\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0,\nwaited 5221 msecs\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio\nenabled returning.\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX\nCommand timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5\nmb[0-3]=[0xffff 0xffff 0xffff 0xffff]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "853fb5a3-9e79-4e68-b2be-d4207c4cc6cf",
      "id": "CVE-2022-49357",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: Do not import certificates from UEFI Secure Boot for T2 Macs\n\nOn Apple T2 Macs, when Linux attempts to read the db and dbx efi variables\nat early boot to load UEFI Secure Boot certificates, a page fault occurs\nin Apple firmware code and EFI runtime services are disabled with the\nfollowing logs:\n\n[Firmware Bug]: Page fault caused by firmware at PA: 0xffffb1edc0068000\nWARNING: CPU: 3 PID: 104 at arch/x86/platform/efi/quirks.c:735 efi_crash_gracefully_on_page_fault+0x50/0xf0\n(Removed some logs from here)\nCall Trace:\n \u003cTASK\u003e\n page_fault_oops+0x4f/0x2c0\n ? search_bpf_extables+0x6b/0x80\n ? search_module_extables+0x50/0x80\n ? search_exception_tables+0x5b/0x60\n kernelmode_fixup_or_oops+0x9e/0x110\n __bad_area_nosemaphore+0x155/0x190\n bad_area_nosemaphore+0x16/0x20\n do_kern_addr_fault+0x8c/0xa0\n exc_page_fault+0xd8/0x180\n asm_exc_page_fault+0x1e/0x30\n(Removed some logs from here)\n ? __efi_call+0x28/0x30\n ? switch_mm+0x20/0x30\n ? efi_call_rts+0x19a/0x8e0\n ? process_one_work+0x222/0x3f0\n ? worker_thread+0x4a/0x3d0\n ? kthread+0x17a/0x1a0\n ? process_one_work+0x3f0/0x3f0\n ? set_kthread_struct+0x40/0x40\n ? ret_from_fork+0x22/0x30\n \u003c/TASK\u003e\n---[ end trace 1f82023595a5927f ]---\nefi: Froze efi_rts_wq and disabled EFI Runtime Services\nintegrity: Couldn't get size: 0x8000000000000015\nintegrity: MODSIGN: Couldn't get UEFI db list\nefi: EFI Runtime Services are disabled!\nintegrity: Couldn't get size: 0x8000000000000015\nintegrity: Couldn't get UEFI dbx list\nintegrity: Couldn't get size: 0x8000000000000015\nintegrity: Couldn't get mokx list\nintegrity: Couldn't get size: 0x80000000\n\nSo we avoid reading these UEFI variables and thus prevent the crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c8566de-bbd9-4f02-875d-4fc87c2aa735",
      "id": "CVE-2022-49455",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ocxl: fix possible double free in ocxl_file_register_afu\n\ninfo_release() will be called in device_unregister() when info-\u003edev's\nreference count is 0. So there is no need to call ocxl_afu_put() and\nkfree() again.\n\nFix this by adding free_minor() and return to err_unregister error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "353a5a78-f9c9-46f2-bb2e-578d3aa9b8e2",
      "id": "CVE-2022-49583",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix handling of dummy receive descriptors\n\nFix memory leak caused by not handling dummy receive descriptor properly.\niavf_get_rx_buffer now sets the rx_buffer return value for dummy receive\ndescriptors. Without this patch, when the hardware writes a dummy\ndescriptor, iavf would not free the page allocated for the previous receive\nbuffer. This is an unlikely event but can still happen.\n\n[Jesse: massaged commit message]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b524b50-cf89-4481-abf0-2921e9cad503",
      "id": "CVE-2022-49598",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_mtu_probing.\n\nWhile reading sysctl_tcp_mtu_probing, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79e7c0f8-e167-4382-9671-8fcb8365fc3c",
      "id": "CVE-2022-49652",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not needed anymore.\n\nAdd missing of_node_put() in to fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63928728-d995-4299-83b0-6dc9c89669b5",
      "id": "CVE-2022-49751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: fix WARNING after calling w1_process()\n\nI got the following WARNING message while removing driver(ds2482):\n\n------------[ cut here ]------------\ndo not call blocking ops when !TASK_RUNNING; state=1 set at [\u003c000000002d50bfb6\u003e] w1_process+0x9e/0x1d0 [wire]\nWARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0\nCPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G                 N 6.1.0-rc3+ #307\nRIP: 0010:__might_sleep+0x98/0xa0\nCall Trace:\n exit_signals+0x6c/0x550\n do_exit+0x2b4/0x17e0\n kthread_exit+0x52/0x60\n kthread+0x16d/0x1e0\n ret_from_fork+0x1f/0x30\n\nThe state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(),\nset it to TASK_RUNNING when it breaks out of the loop to avoid the\nwarning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d1b6bb7-8ad9-443f-a352-0da089b77a4b",
      "id": "CVE-2022-49873",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix wrong reg type conversion in release_reference()\n\nSome helper functions will allocate memory. To avoid memory leaks, the\nverifier requires the eBPF program to release these memories by calling\nthe corresponding helper functions.\n\nWhen a resource is released, all pointer registers corresponding to the\nresource should be invalidated. The verifier use release_references() to\ndo this job, by apply  __mark_reg_unknown() to each relevant register.\n\nIt will give these registers the type of SCALAR_VALUE. A register that\nwill contain a pointer value at runtime, but of type SCALAR_VALUE, which\nmay allow the unprivileged user to get a kernel pointer by storing this\nregister into a map.\n\nUsing __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this\nproblem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f0c312c-88b8-4df5-8e41-c545f1ab925b",
      "id": "CVE-2022-49914",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix inode list leak during backref walking at resolve_indirect_refs()\n\nDuring backref walking, at resolve_indirect_refs(), if we get an error\nwe jump to the 'out' label and call ulist_free() on the 'parents' ulist,\nwhich frees all the elements in the ulist - however that does not free\nany inode lists that may be attached to elements, through the 'aux' field\nof a ulist node, so we end up leaking lists if we have any attached to\nthe unodes.\n\nFix this by calling free_leaf_list() instead of ulist_free() when we exit\nfrom resolve_indirect_refs(). The static function free_leaf_list() is\nmoved up for this to be possible and it's slightly simplified by removing\nunnecessary code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "104d87d1-a17b-4f5a-9a10-c72e54fbb694",
      "id": "CVE-2022-49939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF of ref-\u003eproc caused by race condition\n\nA transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the\nreference for a node. In this case, the target proc normally releases\nthe failed reference upon close as expected. However, if the target is\ndying in parallel the call will race with binder_deferred_release(), so\nthe target could have released all of its references by now leaving the\ncleanup of the new failed reference unhandled.\n\nThe transaction then ends and the target proc gets released making the\nref-\u003eproc now a dangling pointer. Later on, ref-\u003enode is closed and we\nattempt to take spin_lock(\u0026ref-\u003eproc-\u003einner_lock), which leads to the\nuse-after-free bug reported below. Let's fix this by cleaning up the\nfailed reference on the spot instead of relying on the target to do so.\n\n  ==================================================================\n  BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150\n  Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590\n\n  CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10\n  Hardware name: linux,dummy-virt (DT)\n  Workqueue: events binder_deferred_func\n  Call trace:\n   dump_backtrace.part.0+0x1d0/0x1e0\n   show_stack+0x18/0x70\n   dump_stack_lvl+0x68/0x84\n   print_report+0x2e4/0x61c\n   kasan_report+0xa4/0x110\n   kasan_check_range+0xfc/0x1a4\n   __kasan_check_write+0x3c/0x50\n   _raw_spin_lock+0xa8/0x150\n   binder_deferred_func+0x5e0/0x9b0\n   process_one_work+0x38c/0x5f0\n   worker_thread+0x9c/0x694\n   kthread+0x188/0x190\n   ret_from_fork+0x10/0x20",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6405d70-8709-4506-9289-4d5a14df8cde",
      "id": "CVE-2022-50316",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: Fix kmemleak in orangefs_sysfs_init()\n\nWhen insert and remove the orangefs module, there are kobjects memory\nleaked as below:\n\nunreferenced object 0xffff88810f95af00 (size 64):\n  comm \"insmod\", pid 783, jiffies 4294813439 (age 65.512s)\n  hex dump (first 32 bytes):\n    a0 83 af 01 81 88 ff ff 08 af 95 0f 81 88 ff ff  ................\n    08 af 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000031ab7788\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c000000005a6e4dfe\u003e] orangefs_sysfs_init+0x42/0x3a0\n    [\u003c00000000722645ca\u003e] 0xffffffffa02780fe\n    [\u003c000000004232d9f7\u003e] do_one_initcall+0x87/0x2a0\n    [\u003c0000000054f22384\u003e] do_init_module+0xdf/0x320\n    [\u003c000000003263bdea\u003e] load_module+0x2f98/0x3330\n    [\u003c0000000052cd4153\u003e] __do_sys_finit_module+0x113/0x1b0\n    [\u003c00000000250ae02b\u003e] do_syscall_64+0x35/0x80\n    [\u003c00000000f11c03c7\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ae80 (size 64):\n  comm \"insmod\", pid 783, jiffies 4294813439 (age 65.512s)\n  hex dump (first 32 bytes):\n    c8 90 0f 02 81 88 ff ff 88 ae 95 0f 81 88 ff ff  ................\n    88 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000031ab7788\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c000000001a4841fa\u003e] orangefs_sysfs_init+0xc7/0x3a0\n    [\u003c00000000722645ca\u003e] 0xffffffffa02780fe\n    [\u003c000000004232d9f7\u003e] do_one_initcall+0x87/0x2a0\n    [\u003c0000000054f22384\u003e] do_init_module+0xdf/0x320\n    [\u003c000000003263bdea\u003e] load_module+0x2f98/0x3330\n    [\u003c0000000052cd4153\u003e] __do_sys_finit_module+0x113/0x1b0\n    [\u003c00000000250ae02b\u003e] do_syscall_64+0x35/0x80\n    [\u003c00000000f11c03c7\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ae00 (size 64):\n  comm \"insmod\", pid 783, jiffies 4294813440 (age 65.511s)\n  hex dump (first 32 bytes):\n    60 87 a1 00 81 88 ff ff 08 ae 95 0f 81 88 ff ff  `...............\n    08 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000031ab7788\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c000000005915e797\u003e] orangefs_sysfs_init+0x12b/0x3a0\n    [\u003c00000000722645ca\u003e] 0xffffffffa02780fe\n    [\u003c000000004232d9f7\u003e] do_one_initcall+0x87/0x2a0\n    [\u003c0000000054f22384\u003e] do_init_module+0xdf/0x320\n    [\u003c000000003263bdea\u003e] load_module+0x2f98/0x3330\n    [\u003c0000000052cd4153\u003e] __do_sys_finit_module+0x113/0x1b0\n    [\u003c00000000250ae02b\u003e] do_syscall_64+0x35/0x80\n    [\u003c00000000f11c03c7\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ad80 (size 64):\n  comm \"insmod\", pid 783, jiffies 4294813440 (age 65.511s)\n  hex dump (first 32 bytes):\n    78 90 0f 02 81 88 ff ff 88 ad 95 0f 81 88 ff ff  x...............\n    88 ad 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000031ab7788\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c000000007a14eb35\u003e] orangefs_sysfs_init+0x1ac/0x3a0\n    [\u003c00000000722645ca\u003e] 0xffffffffa02780fe\n    [\u003c000000004232d9f7\u003e] do_one_initcall+0x87/0x2a0\n    [\u003c0000000054f22384\u003e] do_init_module+0xdf/0x320\n    [\u003c000000003263bdea\u003e] load_module+0x2f98/0x3330\n    [\u003c0000000052cd4153\u003e] __do_sys_finit_module+0x113/0x1b0\n    [\u003c00000000250ae02b\u003e] do_syscall_64+0x35/0x80\n    [\u003c00000000f11c03c7\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nunreferenced object 0xffff88810f95ac00 (size 64):\n  comm \"insmod\", pid 783, jiffies 4294813440 (age 65.531s)\n  hex dump (first 32 bytes):\n    e0 ff 67 02 81 88 ff ff 08 ac 95 0f 81 88 ff ff  ..g.............\n    08 ac 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000031ab7788\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c000000001f38adcb\u003e] orangefs_sysfs_init+0x291/0x3a0\n    [\u003c00000000722645ca\u003e] 0xffffffffa02780fe\n    [\u003c000000004232d9f7\u003e] do_one_initcall+0x87/0x2a0\n    [\u003c0000000054f22384\u003e] do_init_module+0xdf/0x320\n    [\u003c000000003263bdea\u003e] load_module+0x2f98/0x3330\n    [\u003c0000000052cd4153\u003e] __do_sys_finit_module+0x113/0x1b0\n    [\u003c00000000250ae02b\u003e] do_syscall_64+0x35/\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4f813d7-4441-49ea-8410-0af3372f1b72",
      "id": "CVE-2022-50324",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: maps: pxa2xx-flash: fix memory leak in probe\n\nFree 'info' upon remapping error to avoid a memory leak.\n\n[\u003cmiquel.raynal@bootlin.com\u003e: Reword the commit log]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "70c8fd45-7bac-45e0-bd5c-fe63e42a73d5",
      "id": "CVE-2022-50356",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: sfb: fix null pointer access issue when sfb_init() fails\n\nWhen the default qdisc is sfb, if the qdisc of dev_queue fails to be\ninited during mqprio_init(), sfb_reset() is invoked to clear resources.\nIn this case, the q-\u003eqdisc is NULL, and it will cause gpf issue.\n\nThe process is as follows:\nqdisc_create_dflt()\n\tsfb_init()\n\t\ttcf_block_get()          ---\u003efailed, q-\u003eqdisc is NULL\n\t...\n\tqdisc_put()\n\t\t...\n\t\tsfb_reset()\n\t\t\tqdisc_reset(q-\u003eqdisc)    ---\u003eq-\u003eqdisc is NULL\n\t\t\t\tops = qdisc-\u003eops\n\nThe following is the Call Trace information:\ngeneral protection fault, probably for non-canonical address\n0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\nRIP: 0010:qdisc_reset+0x2b/0x6f0\nCall Trace:\n\u003cTASK\u003e\nsfb_reset+0x37/0xd0\nqdisc_reset+0xed/0x6f0\nqdisc_destroy+0x82/0x4c0\nqdisc_put+0x9e/0xb0\nqdisc_create_dflt+0x2c3/0x4a0\nmqprio_init+0xa71/0x1760\nqdisc_create+0x3eb/0x1000\ntc_modify_qdisc+0x408/0x1720\nrtnetlink_rcv_msg+0x38e/0xac0\nnetlink_rcv_skb+0x12d/0x3a0\nnetlink_unicast+0x4a2/0x740\nnetlink_sendmsg+0x826/0xcc0\nsock_sendmsg+0xc5/0x100\n____sys_sendmsg+0x583/0x690\n___sys_sendmsg+0xe8/0x160\n__sys_sendmsg+0xbf/0x160\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f2164122d04\n\u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd8ab867-6259-4664-9f9e-c9674a68e298",
      "id": "CVE-2023-52805",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in diAlloc\n\nCurrently there is not check against the agno of the iag while\nallocating new inodes to avoid fragmentation problem. Added the check\nwhich is required.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa6db547-9128-41ba-86bc-e1d6281b5fa8",
      "id": "CVE-2023-52881",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: do not accept ACK of bytes we never sent\n\nThis patch is based on a detailed report and ideas from Yepeng Pan\nand Christian Rossow.\n\nACK seq validation is currently following RFC 5961 5.2 guidelines:\n\n   The ACK value is considered acceptable only if\n   it is in the range of ((SND.UNA - MAX.SND.WND) \u003c= SEG.ACK \u003c=\n   SND.NXT).  All incoming segments whose ACK value doesn't satisfy the\n   above condition MUST be discarded and an ACK sent back.  It needs to\n   be noted that RFC 793 on page 72 (fifth check) says: \"If the ACK is a\n   duplicate (SEG.ACK \u003c SND.UNA), it can be ignored.  If the ACK\n   acknowledges something not yet sent (SEG.ACK \u003e SND.NXT) then send an\n   ACK, drop the segment, and return\".  The \"ignored\" above implies that\n   the processing of the incoming data segment continues, which means\n   the ACK value is treated as acceptable.  This mitigation makes the\n   ACK check more stringent since any ACK \u003c SND.UNA wouldn't be\n   accepted, instead only ACKs that are in the range ((SND.UNA -\n   MAX.SND.WND) \u003c= SEG.ACK \u003c= SND.NXT) get through.\n\nThis can be refined for new (and possibly spoofed) flows,\nby not accepting ACK for bytes that were never sent.\n\nThis greatly improves TCP security at a little cost.\n\nI added a Fixes: tag to make sure this patch will reach stable trees,\neven if the 'blamed' patch was adhering to the RFC.\n\ntp-\u003ebytes_acked was added in linux-4.2\n\nFollowing packetdrill test (courtesy of Yepeng Pan) shows\nthe issue at hand:\n\n0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3\n+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0\n+0 bind(3, ..., ...) = 0\n+0 listen(3, 1024) = 0\n\n// ---------------- Handshake ------------------- //\n\n// when window scale is set to 14 the window size can be extended to\n// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet\n// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)\n// ,though this ack number acknowledges some data never\n// sent by the server.\n\n+0 \u003c S 0:0(0) win 65535 \u003cmss 1400,nop,wscale 14\u003e\n+0 \u003e S. 0:0(0) ack 1 \u003c...\u003e\n+0 \u003c . 1:1(0) ack 1 win 65535\n+0 accept(3, ..., ...) = 4\n\n// For the established connection, we send an ACK packet,\n// the ack packet uses ack number 1 - 1073725300 + 2^32,\n// where 2^32 is used to wrap around.\n// Note: we used 1073725300 instead of 1073725440 to avoid possible\n// edge cases.\n// 1 - 1073725300 + 2^32 = 3221241997\n\n// Oops, old kernels happily accept this packet.\n+0 \u003c . 1:1001(1000) ack 3221241997 win 65535\n\n// After the kernel fix the following will be replaced by a challenge ACK,\n// and prior malicious frame would be dropped.\n+0 \u003e . 1:1(0) ack 1001",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a93f5ff7-ff7a-40d5-ba4f-6c55341d9da7",
      "id": "CVE-2023-35827",
      "description": "An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c93810b4-779d-4c58-b2f4-607dd55928d7",
      "id": "CVE-2023-47233",
      "description": "The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this \"could be exploited in a real world scenario.\" This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a20343b-644b-4a70-a438-d467b029cfc7",
      "id": "CVE-2023-52474",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests\n\nhfi1 user SDMA request processing has two bugs that can cause data\ncorruption for user SDMA requests that have multiple payload iovecs\nwhere an iovec other than the tail iovec does not run up to the page\nboundary for the buffer pointed to by that iovec.a\n\nHere are the specific bugs:\n1. user_sdma_txadd() does not use struct user_sdma_iovec-\u003eiov.iov_len.\n   Rather, user_sdma_txadd() will add up to PAGE_SIZE bytes from iovec\n   to the packet, even if some of those bytes are past\n   iovec-\u003eiov.iov_len and are thus not intended to be in the packet.\n2. user_sdma_txadd() and user_sdma_send_pkts() fail to advance to the\n   next iovec in user_sdma_request-\u003eiovs when the current iovec\n   is not PAGE_SIZE and does not contain enough data to complete the\n   packet. The transmitted packet will contain the wrong data from the\n   iovec pages.\n\nThis has not been an issue with SDMA packets from hfi1 Verbs or PSM2\nbecause they only produce iovecs that end short of PAGE_SIZE as the tail\niovec of an SDMA request.\n\nFixing these bugs exposes other bugs with the SDMA pin cache\n(struct mmu_rb_handler) that get in way of supporting user SDMA requests\nwith multiple payload iovecs whose buffers do not end at PAGE_SIZE. So\nthis commit fixes those issues as well.\n\nHere are the mmu_rb_handler bugs that non-PAGE_SIZE-end multi-iovec\npayload user SDMA requests can hit:\n1. Overlapping memory ranges in mmu_rb_handler will result in duplicate\n   pinnings.\n2. When extending an existing mmu_rb_handler entry (struct mmu_rb_node),\n   the mmu_rb code (1) removes the existing entry under a lock, (2)\n   releases that lock, pins the new pages, (3) then reacquires the lock\n   to insert the extended mmu_rb_node.\n\n   If someone else comes in and inserts an overlapping entry between (2)\n   and (3), insert in (3) will fail.\n\n   The failure path code in this case unpins _all_ pages in either the\n   original mmu_rb_node or the new mmu_rb_node that was inserted between\n   (2) and (3).\n3. In hfi1_mmu_rb_remove_unless_exact(), mmu_rb_node-\u003erefcount is\n   incremented outside of mmu_rb_handler-\u003elock. As a result, mmu_rb_node\n   could be evicted by another thread that gets mmu_rb_handler-\u003elock and\n   checks mmu_rb_node-\u003erefcount before mmu_rb_node-\u003erefcount is\n   incremented.\n4. Related to #2 above, SDMA request submission failure path does not\n   check mmu_rb_node-\u003erefcount before freeing mmu_rb_node object.\n\n   If there are other SDMA requests in progress whose iovecs have\n   pointers to the now-freed mmu_rb_node(s), those pointers to the\n   now-freed mmu_rb nodes will be dereferenced when those SDMA requests\n   complete.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3661c7dd-7c58-49a0-8278-3023d047fbd5",
      "id": "CVE-2023-52653",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix a memleak in gss_import_v2_context\n\nThe ctx-\u003emech_used.data allocated by kmemdup is not freed in neither\ngss_import_v2_context nor it only caller gss_krb5_import_sec_context,\nwhich frees ctx on error.\n\nThus, this patch reform the last call of gss_import_v2_context to the\ngss_krb5_import_ctx_v2, preventing the memleak while keepping the return\nformation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "970ede32-6015-47ee-a8e3-d33a27642ad1",
      "id": "CVE-2023-52691",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix a double-free in si_dpm_init\n\nWhen the allocation of\nadev-\u003epm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails,\namdgpu_free_extended_power_table is called to free some fields of adev.\nHowever, when the control flow returns to si_dpm_sw_init, it goes to\nlabel dpm_failed and calls si_dpm_fini, which calls\namdgpu_free_extended_power_table again and free those fields again. Thus\na double-free is triggered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c36b8e7-9f24-48e5-9cb5-8cdfd2bf1c11",
      "id": "CVE-2023-52693",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: video: check for error while searching for backlight device parent\n\nIf acpi_get_parent() called in acpi_video_dev_register_backlight()\nfails, for example, because acpi_ut_acquire_mutex() fails inside\nacpi_get_parent), this can lead to incorrect (uninitialized)\nacpi_parent handle being passed to acpi_get_pci_dev() for detecting\nthe parent pci device.\n\nCheck acpi_get_parent() result and set parent device only in case of success.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ecdffae1-3cc9-4c30-b910-24080c1b124d",
      "id": "CVE-2023-52992",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip task with pid=1 in send_signal_common()\n\nThe following kernel panic can be triggered when a task with pid=1 attaches\na prog that attempts to send killing signal to itself, also see [1] for more\ndetails:\n\n  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n  CPU: 3 PID: 1 Comm: systemd Not tainted 6.1.0-09652-g59fe41b5255f #148\n  Call Trace:\n  \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x100/0x178 lib/dump_stack.c:106\n  panic+0x2c4/0x60f kernel/panic.c:275\n  do_exit.cold+0x63/0xe4 kernel/exit.c:789\n  do_group_exit+0xd4/0x2a0 kernel/exit.c:950\n  get_signal+0x2460/0x2600 kernel/signal.c:2858\n  arch_do_signal_or_restart+0x78/0x5d0 arch/x86/kernel/signal.c:306\n  exit_to_user_mode_loop kernel/entry/common.c:168 [inline]\n  exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203\n  __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]\n  syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296\n  do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nSo skip task with pid=1 in bpf_send_signal_common() to avoid the panic.\n\n  [1] https://lore.kernel.org/bpf/20221222043507.33037-1-sunhao.th@gmail.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54740f7c-d3fb-4c55-b748-a10ffec71186",
      "id": "CVE-2023-53091",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: update s_journal_inum if it changes after journal replay\n\nWhen mounting a crafted ext4 image, s_journal_inum may change after journal\nreplay, which is obviously unreasonable because we have successfully loaded\nand replayed the journal through the old s_journal_inum. And the new\ns_journal_inum bypasses some of the checks in ext4_get_journal(), which\nmay trigger a null pointer dereference problem. So if s_journal_inum\nchanges after the journal replay, we ignore the change, and rewrite the\ncurrent journal_inum to the superblock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bbdf8c9f-90cf-4fcd-9bee-e89b0c6daf19",
      "id": "CVE-2023-53097",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efd412ea-7cdd-4c93-8aea-ef85817bf0b4",
      "id": "CVE-2023-53106",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st-nci: Fix use after free bug in ndlc_remove due to race condition\n\nThis bug influences both st_nci_i2c_remove and st_nci_spi_remove.\nTake st_nci_i2c_remove as an example.\n\nIn st_nci_i2c_probe, it called ndlc_probe and bound \u0026ndlc-\u003esm_work\nwith llt_ndlc_sm_work.\n\nWhen it calls ndlc_recv or timeout handler, it will finally call\nschedule_work to start the work.\n\nWhen we call st_nci_i2c_remove to remove the driver, there\nmay be a sequence as follows:\n\nFix it by finishing the work before cleanup in ndlc_remove\n\nCPU0                  CPU1\n\n                    |llt_ndlc_sm_work\nst_nci_i2c_remove   |\n  ndlc_remove       |\n     st_nci_remove  |\n     nci_free_device|\n     kfree(ndev)    |\n//free ndlc-\u003endev   |\n                    |llt_ndlc_rcv_queue\n                    |nci_recv_frame\n                    |//use ndlc-\u003endev",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46346eaf-1835-4d6c-b441-61b7b19cfee1",
      "id": "CVE-2023-53171",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/type1: prevent underflow of locked_vm via exec()\n\nWhen a vfio container is preserved across exec, the task does not change,\nbut it gets a new mm with locked_vm=0, and loses the count from existing\ndma mappings.  If the user later unmaps a dma mapping, locked_vm underflows\nto a large unsigned value, and a subsequent dma map request fails with\nENOMEM in __account_locked_vm.\n\nTo avoid underflow, grab and save the mm at the time a dma is mapped.\nUse that mm when adjusting locked_vm, rather than re-acquiring the saved\ntask's mm, which may have changed.  If the saved mm is dead, do nothing.\n\nlocked_vm is incremented for existing mappings in a subsequent patch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "089c3864-af5c-4c3a-b696-674ccf2723f6",
      "id": "CVE-2023-53305",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free\n\nFix potential use-after-free in l2cap_le_command_rej.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "62e4e395-7a4a-4cfc-aecf-fb97a97119ed",
      "id": "CVE-2024-49908",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)\n\nThis commit adds a null check for the 'afb' variable in the\namdgpu_dm_update_cursor function. Previously, 'afb' was assumed to be\nnull at line 8388, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433 amdgpu_dm_update_cursor()\n\terror: we previously assumed 'afb' could be null (see line 8388)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd2d2f21-6e2a-44b2-88d1-95d4324e7d09",
      "id": "CVE-2023-53357",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: check slab-out-of-bounds in md_bitmap_get_counter\n\nIf we write a large number to md/bitmap_set_bits, md_bitmap_checkpage()\nwill return -EINVAL because 'page \u003e= bitmap-\u003epages', but the return value\nwas not checked immediately in md_bitmap_get_counter() in order to set\n*blocks value and slab-out-of-bounds occurs.\n\nMove check of 'page \u003e= bitmap-\u003epages' to md_bitmap_get_counter() and\nreturn directly if true.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "137ac127-66b0-474e-aae7-aa7eba44176e",
      "id": "CVE-2023-53446",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free\n\nStruct pcie_link_state-\u003edownstream is a pointer to the pci_dev of function\n0.  Previously we retained that pointer when removing function 0, and\nsubsequent ASPM policy changes dereferenced it, resulting in a\nuse-after-free warning from KASAN, e.g.:\n\n  # echo 1 \u003e /sys/bus/pci/devices/0000:03:00.0/remove\n  # echo powersave \u003e /sys/module/pcie_aspm/parameters/policy\n\n  BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500\n  Call Trace:\n   kasan_report+0xae/0xe0\n   pcie_config_aspm_link+0x42d/0x500\n   pcie_aspm_set_policy+0x8e/0x1a0\n   param_attr_store+0x162/0x2c0\n   module_attr_store+0x3e/0x80\n\nPCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM\nControl value in all functions of multi-function devices.\n\nDisable ASPM and free the pcie_link_state when any child function is\nremoved so we can discard the dangling pcie_link_state-\u003edownstream pointer\nand maintain the same ASPM Control configuration for all functions.\n\n[bhelgaas: commit log and comment]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec13eedc-3704-4454-a5e0-bd70d9f8df99",
      "id": "CVE-2024-26668",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_limit: reject configurations that cause integer overflow\n\nReject bogus configs where internal token counter wraps around.\nThis only occurs with very very large requests, such as 17gbyte/s.\n\nIts better to reject this rather than having incorrect ratelimit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee173564-0e27-4b9f-ba19-fe4f72c1bfef",
      "id": "CVE-2024-26696",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix hang in nilfs_lookup_dirty_data_buffers()\n\nSyzbot reported a hang issue in migrate_pages_batch() called by mbind()\nand nilfs_lookup_dirty_data_buffers() called in the log writer of nilfs2.\n\nWhile migrate_pages_batch() locks a folio and waits for the writeback to\ncomplete, the log writer thread that should bring the writeback to\ncompletion picks up the folio being written back in\nnilfs_lookup_dirty_data_buffers() that it calls for subsequent log\ncreation and was trying to lock the folio.  Thus causing a deadlock.\n\nIn the first place, it is unexpected that folios/pages in the middle of\nwriteback will be updated and become dirty.  Nilfs2 adds a checksum to\nverify the validity of the log being written and uses it for recovery at\nmount, so data changes during writeback are suppressed.  Since this is\nbroken, an unclean shutdown could potentially cause recovery to fail.\n\nInvestigation revealed that the root cause is that the wait for writeback\ncompletion in nilfs_page_mkwrite() is conditional, and if the backing\ndevice does not require stable writes, data may be modified without\nwaiting.\n\nFix these issues by making nilfs_page_mkwrite() wait for writeback to\nfinish regardless of the stable write requirement of the backing device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b97116b3-44cd-4d3a-9730-40c23b28b342",
      "id": "CVE-2024-26759",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix race when skipping swapcache\n\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\nswapin the same entry at the same time, they get different pages (A, B). \nBefore one thread (T0) finishes the swapin and installs page (A) to the\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\nentry, then swap out the possibly modified page reusing the same entry. \nIt breaks the pte_same check in (T0) because PTE value is unchanged,\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\nPTE and cause data corruption.\n\nOne possible callstack is like this:\n\nCPU0                                 CPU1\n----                                 ----\ndo_swap_page()                       do_swap_page() with same entry\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\n\u003calloc page A\u003e                       \u003calloc page B\u003e\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\n...                                  set_pte_at()\n                                     swap_free() \u003c- entry is free\n                                     \u003cwrite to page B, now page A stalled\u003e\n                                     \u003cswap out page B to same swap entry\u003e\npte_same() \u003c- Check pass, PTE seems\n              unchanged, but page A\n              is stalled!\nswap_free() \u003c- page B content lost!\nset_pte_at() \u003c- staled page A installed!\n\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\nentry content, so even if page (B) is not modified, if swap_read_folio()\non CPU0 happens later than swap_free() on CPU1, it may also cause data\nloss.\n\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\nthe cache flag, and allow only one thread to swap it in, also prevent any\nparallel code from putting the entry in the cache.  Release the pin after\nPT unlocked.\n\nRacers just loop and wait since it's a rare and very short event.  A\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\nfaults wasting too much CPU, causing livelock or adding too much noise to\nperf statistics.  A similar livelock issue was described in commit\n029c4628b2eb (\"mm: swap: get rid of livelock in swapin readahead\")\n\nReproducer:\n\nThis race issue can be triggered easily using a well constructed\nreproducer and patched brd (with a delay in read path) [1]:\n\nWith latest 6.8 mainline, race caused data loss can be observed easily:\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\n  Polulating 32MB of memory region...\n  Keep swapping out...\n  Starting round 0...\n  Spawning 65536 workers...\n  32746 workers spawned, wait for done...\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\n  Round 0 Failed, 15 data loss!\n\nThis reproducer spawns multiple threads sharing the same memory region\nusing a small swap device.  Every two threads updates mapped pages one by\none in opposite direction trying to create a race, with one dedicated\nthread keep swapping out the data out using madvise.\n\nThe reproducer created a reproduce rate of about once every 5 minutes, so\nthe race should be totally possible in production.\n\nAfter this patch, I ran the reproducer for over a few hundred rounds and\nno data loss observed.\n\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\nzram:\n\nBefore:     10934698 us\nAfter:      11157121 us\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\n\n[kasong@tencent.com: v4]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3e77b88-bb27-4f25-8245-62d65dd60349",
      "id": "CVE-2024-35808",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/dm-raid: don't call md_reap_sync_thread() directly\n\nCurrently md_reap_sync_thread() is called from raid_message() directly\nwithout holding 'reconfig_mutex', this is definitely unsafe because\nmd_reap_sync_thread() can change many fields that is protected by\n'reconfig_mutex'.\n\nHowever, hold 'reconfig_mutex' here is still problematic because this\nwill cause deadlock, for example, commit 130443d60b1b (\"md: refactor\nidle/frozen_sync_thread() to fix deadlock\").\n\nFix this problem by using stop_sync_thread() to unregister sync_thread,\nlike md/raid did.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db1b0660-ca63-4e5c-9e01-011d14b17a4c",
      "id": "CVE-2024-26816",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86, relocs: Ignore relocations in .notes section\n\nWhen building with CONFIG_XEN_PV=y, .text symbols are emitted into\nthe .notes section so that Xen can find the \"startup_xen\" entry point.\nThis information is used prior to booting the kernel, so relocations\nare not useful. In fact, performing relocations against the .notes\nsection means that the KASLR base is exposed since /sys/kernel/notes\nis world-readable.\n\nTo avoid leaking the KASLR base without breaking unprivileged tools that\nare expecting to read /sys/kernel/notes, skip performing relocations in\nthe .notes section. The values readable in .notes are then identical to\nthose found in System.map.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd98b115-59fa-4742-8aaf-20658204e926",
      "id": "CVE-2024-26843",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: runtime: Fix potential overflow of soft-reserved region size\n\nmd_size will have been narrowed if we have \u003e= 4GB worth of pages in a\nsoft-reserved region.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd8e796a-2fb0-495e-96c6-4d217dd442bd",
      "id": "CVE-2024-26862",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: annotate data-races around ignore_outgoing\n\nignore_outgoing is read locklessly from dev_queue_xmit_nit()\nand packet_getsockopt()\n\nAdd appropriate READ_ONCE()/WRITE_ONCE() annotations.\n\nsyzbot reported:\n\nBUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt\n\nwrite to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0:\n packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003\n do_sock_setsockopt net/socket.c:2311 [inline]\n __sys_setsockopt+0x1d8/0x250 net/socket.c:2334\n __do_sys_setsockopt net/socket.c:2343 [inline]\n __se_sys_setsockopt net/socket.c:2340 [inline]\n __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340\n do_syscall_64+0xd3/0x1d0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nread to 0xffff888107804542 of 1 bytes by task 27 on cpu 1:\n dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248\n xmit_one net/core/dev.c:3527 [inline]\n dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547\n __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335\n dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108\n batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127\n batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]\n batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]\n batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335\n worker_thread+0x526/0x730 kernel/workqueue.c:3416\n kthread+0x1d1/0x210 kernel/kthread.c:388\n ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n\nvalue changed: 0x00 -\u003e 0x01\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G        W          6.8.0-syzkaller-08073-g480e035fc4c7 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\nWorkqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aadc528a-cc7b-49aa-a816-11707cf0781e",
      "id": "CVE-2024-26937",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Reset queue_priority_hint on parking\n\nOriginally, with strict in order execution, we could complete execution\nonly when the queue was empty. Preempt-to-busy allows replacement of an\nactive request that may complete before the preemption is processed by\nHW. If that happens, the request is retired from the queue, but the\nqueue_priority_hint remains set, preventing direct submission until\nafter the next CS interrupt is processed.\n\nThis preempt-to-busy race can be triggered by the heartbeat, which will\nalso act as the power-management barrier and upon completion allow us to\nidle the HW. We may process the completion of the heartbeat, and begin\nparking the engine before the CS event that restores the\nqueue_priority_hint, causing us to fail the assertion that it is MIN.\n\n\u003c3\u003e[  166.210729] __engine_park:283 GEM_BUG_ON(engine-\u003esched_engine-\u003equeue_priority_hint != (-((int)(~0U \u003e\u003e 1)) - 1))\n\u003c0\u003e[  166.210781] Dumping ftrace buffer:\n\u003c0\u003e[  166.210795] ---------------------------------\n...\n\u003c0\u003e[  167.302811] drm_fdin-1097      2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 }\n\u003c0\u003e[  167.302861] drm_fdin-1097      2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646\n\u003c0\u003e[  167.302928] drm_fdin-1097      2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0\n\u003c0\u003e[  167.302992] drm_fdin-1097      2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659\n\u003c0\u003e[  167.303044] drm_fdin-1097      2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40\n\u003c0\u003e[  167.303095] drm_fdin-1097      2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 }\n\u003c0\u003e[  167.303159] kworker/-89       11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2\n\u003c0\u003e[  167.303208] kworker/-89       11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin\n\u003c0\u003e[  167.303272] kworker/-89       11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2\n\u003c0\u003e[  167.303321] kworker/-89       11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin\n\u003c0\u003e[  167.303384] kworker/-89       11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660\n\u003c0\u003e[  167.303434] kworker/-89       11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns }\n\u003c0\u003e[  167.303484] kworker/-89       11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked\n\u003c0\u003e[  167.303534]   \u003cidle\u003e-0         5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040\n\u003c0\u003e[  167.303583] kworker/-89       11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns }\n\u003c0\u003e[  167.303756] kworker/-89       11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns }\n\u003c0\u003e[  167.303806] kworker/-89       11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine-\u003esched_engine-\u003equeue_priority_hint != (-((int)(~0U \u003e\u003e 1)) - 1))\n\u003c0\u003e[  167.303811] ---------------------------------\n\u003c4\u003e[  167.304722] ------------[ cut here ]------------\n\u003c2\u003e[  167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283!\n\u003c4\u003e[  167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n\u003c4\u003e[  167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G        W          6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1\n\u003c4\u003e[  167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022\n\u003c4\u003e[  167.304738] Workqueue: i915-unordered retire_work_handler [i915]\n\u003c4\u003e[  16\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "982d76bc-65de-431b-8b59-9e4d6f9d6e59",
      "id": "CVE-2024-26948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add a dc_state NULL check in dc_state_release\n\n[How]\nCheck wheather state is NULL before releasing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "821530b1-abe8-4d85-9bb7-12613bfeb7e1",
      "id": "CVE-2024-27415",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: confirm multicast packets before passing them up the stack\n\nconntrack nf_confirm logic cannot handle cloned skbs referencing\nthe same nf_conn entry, which will happen for multicast (broadcast)\nframes on bridges.\n\n Example:\n    macvlan0\n       |\n      br0\n     /  \\\n  ethX    ethY\n\n ethX (or Y) receives a L2 multicast or broadcast packet containing\n an IP packet, flow is not yet in conntrack table.\n\n 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting.\n    -\u003e skb-\u003e_nfct now references a unconfirmed entry\n 2. skb is broad/mcast packet. bridge now passes clones out on each bridge\n    interface.\n 3. skb gets passed up the stack.\n 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb\n    and schedules a work queue to send them out on the lower devices.\n\n    The clone skb-\u003e_nfct is not a copy, it is the same entry as the\n    original skb.  The macvlan rx handler then returns RX_HANDLER_PASS.\n 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb.\n\nThe Macvlan broadcast worker and normal confirm path will race.\n\nThis race will not happen if step 2 already confirmed a clone. In that\ncase later steps perform skb_clone() with skb-\u003e_nfct already confirmed (in\nhash table).  This works fine.\n\nBut such confirmation won't happen when eb/ip/nftables rules dropped the\npackets before they reached the nf_confirm step in postrouting.\n\nPablo points out that nf_conntrack_bridge doesn't allow use of stateful\nnat, so we can safely discard the nf_conn entry and let inet call\nconntrack again.\n\nThis doesn't work for bridge netfilter: skb could have a nat\ntransformation. Also bridge nf prevents re-invocation of inet prerouting\nvia 'sabotage_in' hook.\n\nWork around this problem by explicit confirmation of the entry at LOCAL_IN\ntime, before upper layer has a chance to clone the unconfirmed entry.\n\nThe downside is that this disables NAT and conntrack helpers.\n\nAlternative fix would be to add locking to all code parts that deal with\nunconfirmed packets, but even if that could be done in a sane way this\nopens up other problems, for example:\n\n-m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4\n-m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5\n\nFor multicast case, only one of such conflicting mappings will be\ncreated, conntrack only handles 1:1 NAT mappings.\n\nUsers should set create a setup that explicitly marks such traffic\nNOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass\nthem, ruleset might have accept rules for untracked traffic already,\nso user-visible behaviour would change.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c45d86a1-3245-437d-a79e-bb962fd0b13f",
      "id": "CVE-2024-46733",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix qgroup reserve leaks in cow_file_range\n\nIn the buffered write path, the dirty page owns the qgroup reserve until\nit creates an ordered_extent.\n\nTherefore, any errors that occur before the ordered_extent is created\nmust free that reservation, or else the space is leaked. The fstest\ngeneric/475 exercises various IO error paths, and is able to trigger\nerrors in cow_file_range where we fail to get to allocating the ordered\nextent. Note that because we *do* clear delalloc, we are likely to\nremove the inode from the delalloc list, so the inodes/pages to not have\ninvalidate/launder called on them in the commit abort path.\n\nThis results in failures at the unmount stage of the test that look like:\n\n  BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure\n  BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure\n  BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672\n  ------------[ cut here ]------------\n  WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs]\n  Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq\n  CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W          6.10.0-rc7-gab56fde445b8 #21\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\n  RIP: 0010:close_ctree+0x222/0x4d0 [btrfs]\n  RSP: 0018:ffffb4465283be00 EFLAGS: 00010202\n  RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001\n  RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8\n  RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000\n  R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c\n  R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n  FS:  00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0\n  Call Trace:\n   \u003cTASK\u003e\n   ? close_ctree+0x222/0x4d0 [btrfs]\n   ? __warn.cold+0x8e/0xea\n   ? close_ctree+0x222/0x4d0 [btrfs]\n   ? report_bug+0xff/0x140\n   ? handle_bug+0x3b/0x70\n   ? exc_invalid_op+0x17/0x70\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? close_ctree+0x222/0x4d0 [btrfs]\n   generic_shutdown_super+0x70/0x160\n   kill_anon_super+0x11/0x40\n   btrfs_kill_super+0x11/0x20 [btrfs]\n   deactivate_locked_super+0x2e/0xa0\n   cleanup_mnt+0xb5/0x150\n   task_work_run+0x57/0x80\n   syscall_exit_to_user_mode+0x121/0x130\n   do_syscall_64+0xab/0x1a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x7f916847a887\n  ---[ end trace 0000000000000000 ]---\n  BTRFS error (device dm-8 state EA): qgroup reserved space leaked\n\nCases 2 and 3 in the out_reserve path both pertain to this type of leak\nand must free the reserved qgroup data. Because it is already an error\npath, I opted not to handle the possible errors in\nbtrfs_free_qgroup_data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27c8722e-097d-438f-be67-047d438bfcc0",
      "id": "CVE-2024-35886",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix infinite recursion in fib6_dump_done().\n\nsyzkaller reported infinite recursive calls of fib6_dump_done() during\nnetlink socket destruction.  [1]\n\nFrom the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then\nthe response was generated.  The following recvmmsg() resumed the dump\nfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due\nto the fault injection.  [0]\n\n  12:01:34 executing program 3:\n  r0 = socket$nl_route(0x10, 0x3, 0x0)\n  sendmsg$nl_route(r0, ... snip ...)\n  recvmmsg(r0, ... snip ...) (fail_nth: 8)\n\nHere, fib6_dump_done() was set to nlk_sk(sk)-\u003ecb.done, and the next call\nof inet6_dump_fib() set it to nlk_sk(sk)-\u003ecb.args[3].  syzkaller stopped\nreceiving the response halfway through, and finally netlink_sock_destruct()\ncalled nlk_sk(sk)-\u003ecb.done().\n\nfib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)-\u003ecb.done() if it\nis still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)-\u003ecb.done() by\nnlk_sk(sk)-\u003ecb.args[3], but it has the same function, not NULL, calling\nitself recursively and hitting the stack guard page.\n\nTo avoid the issue, let's set the destructor after kzalloc().\n\n[0]:\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:117)\n should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153)\n should_failslab (mm/slub.c:3733)\n kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992)\n inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662)\n rtnl_dump_all (net/core/rtnetlink.c:4029)\n netlink_dump (net/netlink/af_netlink.c:2269)\n netlink_recvmsg (net/netlink/af_netlink.c:1988)\n ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801)\n ___sys_recvmsg (net/socket.c:2846)\n do_recvmmsg (net/socket.c:2943)\n __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)\n\n[1]:\nBUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)\nstack guard page: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nWorkqueue: events netlink_sock_destruct_work\nRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)\nCode: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd \u003c53\u003e 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d980000 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3\nRDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358\nRBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000\nR13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68\nFS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003c#DF\u003e\n \u003c/#DF\u003e\n \u003cTASK\u003e\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n ...\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n netlink_sock_destruct (net/netlink/af_netlink.c:401)\n __sk_destruct (net/core/sock.c:2177 (discriminator 2))\n sk_destruct (net/core/sock.c:2224)\n __sk_free (net/core/sock.c:2235)\n sk_free (net/core/sock.c:2246)\n process_one_work (kernel/workqueue.c:3259)\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c748e1d1-1105-4d9d-a2e0-02f4871f791d",
      "id": "CVE-2024-35895",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Prevent lock inversion deadlock in map delete elem\n\nsyzkaller started using corpuses where a BPF tracing program deletes\nelements from a sockmap/sockhash map. Because BPF tracing programs can be\ninvoked from any interrupt context, locks taken during a map_delete_elem\noperation must be hardirq-safe. Otherwise a deadlock due to lock inversion\nis possible, as reported by lockdep:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026htab-\u003ebuckets[i].lock);\n                               local_irq_disable();\n                               lock(\u0026host-\u003elock);\n                               lock(\u0026htab-\u003ebuckets[i].lock);\n  \u003cInterrupt\u003e\n    lock(\u0026host-\u003elock);\n\nLocks in sockmap are hardirq-unsafe by design. We expects elements to be\ndeleted from sockmap/sockhash only in task (normal) context with interrupts\nenabled, or in softirq context.\n\nDetect when map_delete_elem operation is invoked from a context which is\n_not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an\nerror.\n\nNote that map updates are not affected by this issue. BPF verifier does not\nallow updating sockmap/sockhash from a BPF tracing program today.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3b5da09d-c1e9-4b83-b660-71cf8d2070ce",
      "id": "CVE-2024-35937",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check A-MSDU format more carefully\n\nIf it looks like there's another subframe in the A-MSDU\nbut the header isn't fully there, we can end up reading\ndata out of bounds, only to discard later. Make this a\nbit more careful and check if the subframe header can\neven be present.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d3e8505-25de-4552-acc2-229b49829a1e",
      "id": "CVE-2024-35944",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()\n\nSyzkaller hit 'WARNING in dg_dispatch_as_host' bug.\n\nmemcpy: detected field-spanning write (size 56) of single field \"\u0026dg_info-\u003emsg\"\nat drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24)\n\nWARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237\ndg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237\n\nSome code commentry, based on my understanding:\n\n544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)-\u003epayload_size)\n/// This is 24 + payload_size\n\nmemcpy(\u0026dg_info-\u003emsg, dg, dg_size);\n\tDestination = dg_info-\u003emsg ---\u003e this is a 24 byte\n\t\t\t\t\tstructure(struct vmci_datagram)\n\tSource = dg --\u003e this is a 24 byte structure (struct vmci_datagram)\n\tSize = dg_size = 24 + payload_size\n\n{payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32.\n\n 35 struct delayed_datagram_info {\n 36         struct datagram_entry *entry;\n 37         struct work_struct work;\n 38         bool in_dg_host_queue;\n 39         /* msg and msg_payload must be together. */\n 40         struct vmci_datagram msg;\n 41         u8 msg_payload[];\n 42 };\n\nSo those extra bytes of payload are copied into msg_payload[], a run time\nwarning is seen while fuzzing with Syzkaller.\n\nOne possible way to fix the warning is to split the memcpy() into\ntwo parts -- one -- direct assignment of msg and second taking care of payload.\n\nGustavo quoted:\n\"Under FORTIFY_SOURCE we should not copy data across multiple members\nin a structure.\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15a38a88-7a53-4b85-8c57-3f9488a20511",
      "id": "CVE-2024-35951",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()\n\nSubject: [PATCH] drm/panfrost: Fix the error path in\n panfrost_mmu_map_fault_addr()\n\nIf some the pages or sgt allocation failed, we shouldn't release the\npages ref we got earlier, otherwise we will end up with unbalanced\nget/put_pages() calls. We should instead leave everything in place\nand let the BO release function deal with extra cleanup when the object\nis destroyed, or let the fault handler try again next time it's called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f5fc199-5513-4d68-8cd0-3958c493b0ff",
      "id": "CVE-2024-36013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()\n\nExtend a critical section to prevent chan from early freeing.\nAlso make the l2cap_connect() return type void. Nothing is using the\nreturned value but it is ugly to return a potentially freed pointer.\nMaking it void will help with backports because earlier kernels did use\nthe return value. Now the compile will break for kernels where this\npatch is not a complete fix.\n\nCall stack summary:\n\n[use]\nl2cap_bredr_sig_cmd\n  l2cap_connect\n  ┌ mutex_lock(\u0026conn-\u003echan_lock);\n  │ chan = pchan-\u003eops-\u003enew_connection(pchan); \u003c- alloc chan\n  │ __l2cap_chan_add(conn, chan);\n  │   l2cap_chan_hold(chan);\n  │   list_add(\u0026chan-\u003elist, \u0026conn-\u003echan_l);   ... (1)\n  └ mutex_unlock(\u0026conn-\u003echan_lock);\n    chan-\u003econf_state              ... (4) \u003c- use after free\n\n[free]\nl2cap_conn_del\n┌ mutex_lock(\u0026conn-\u003echan_lock);\n│ foreach chan in conn-\u003echan_l:            ... (2)\n│   l2cap_chan_put(chan);\n│     l2cap_chan_destroy\n│       kfree(chan)               ... (3) \u003c- chan freed\n└ mutex_unlock(\u0026conn-\u003echan_lock);\n\n==================================================================\nBUG: KASAN: slab-use-after-free in instrument_atomic_read\ninclude/linux/instrumented.h:68 [inline]\nBUG: KASAN: slab-use-after-free in _test_bit\ninclude/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0\nnet/bluetooth/l2cap_core.c:4260\nRead of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06b31de7-9201-4920-b591-edc179fb2aae",
      "id": "CVE-2024-39508",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/io-wq: Use set_bit() and test_bit() at worker-\u003eflags\n\nUtilize set_bit() and test_bit() on worker-\u003eflags within io_uring/io-wq\nto address potential data races.\n\nThe structure io_worker-\u003eflags may be accessed through various data\npaths, leading to concurrency issues. When KCSAN is enabled, it reveals\ndata races occurring in io_worker_handle_work and\nio_wq_activate_free_worker functions.\n\n\t BUG: KCSAN: data-race in io_worker_handle_work / io_wq_activate_free_worker\n\t write to 0xffff8885c4246404 of 4 bytes by task 49071 on cpu 28:\n\t io_worker_handle_work (io_uring/io-wq.c:434 io_uring/io-wq.c:569)\n\t io_wq_worker (io_uring/io-wq.c:?)\n\u003csnip\u003e\n\n\t read to 0xffff8885c4246404 of 4 bytes by task 49024 on cpu 5:\n\t io_wq_activate_free_worker (io_uring/io-wq.c:? io_uring/io-wq.c:285)\n\t io_wq_enqueue (io_uring/io-wq.c:947)\n\t io_queue_iowq (io_uring/io_uring.c:524)\n\t io_req_task_submit (io_uring/io_uring.c:1511)\n\t io_handle_tw_list (io_uring/io_uring.c:1198)\n\u003csnip\u003e\n\nLine numbers against commit 18daea77cca6 (\"Merge tag 'for-linus' of\ngit://git.kernel.org/pub/scm/virt/kvm/kvm\").\n\nThese races involve writes and reads to the same memory location by\ndifferent tasks running on different CPUs. To mitigate this, refactor\nthe code to use atomic operations such as set_bit(), test_bit(), and\nclear_bit() instead of basic \"and\" and \"or\" operations. This ensures\nthread-safe manipulation of worker flags.\n\nAlso, move `create_index` to avoid holes in the structure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ddcd42e-cb5c-4c19-a611-3a821c577db8",
      "id": "CVE-2024-40929",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: check n_ssids before accessing the ssids\n\nIn some versions of cfg80211, the ssids poinet might be a valid one even\nthough n_ssids is 0. Accessing the pointer in this case will cuase an\nout-of-bound access. Fix this by checking n_ssids first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f798005-75d5-4f58-b1ca-43d0ba936005",
      "id": "CVE-2024-40959",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()\n\nip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.\n\nsyzbot reported:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nWorkqueue: wg-kex-wg1 wg_packet_handshake_send_worker\n RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64\nCode: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00\nRSP: 0018:ffffc90000117378 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7\nRDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98\nRBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000\nR10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline]\n  xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline]\n  xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541\n  xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835\n  xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline]\n  xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201\n  xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline]\n  xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309\n  ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256\n  send6+0x611/0xd20 drivers/net/wireguard/socket.c:139\n  wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178\n  wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200\n  wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40\n  wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51\n  process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n  process_scheduled_works kernel/workqueue.c:3312 [inline]\n  worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393\n  kthread+0x2c1/0x3a0 kernel/kthread.c:389\n  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f32d4e0b-8e25-44df-8741-e63fe93b360b",
      "id": "CVE-2024-40967",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: imx: Introduce timeout when waiting on transmitter empty\n\nBy waiting at most 1 second for USR2_TXDC to be set, we avoid a potential\ndeadlock.\n\nIn case of the timeout, there is not much we can do, so we simply ignore\nthe transmitter state and optimistically try to continue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2fda3035-1efe-48c7-bebf-e41a02ff21cd",
      "id": "CVE-2024-41095",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes\n\nIn nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "044d45de-177c-477e-96ae-1280adeca145",
      "id": "CVE-2024-42084",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftruncate: pass a signed offset\n\nThe old ftruncate() syscall, using the 32-bit off_t misses a sign\nextension when called in compat mode on 64-bit architectures.  As a\nresult, passing a negative length accidentally succeeds in truncating\nto file size between 2GiB and 4GiB.\n\nChanging the type of the compat syscall to the signed compat_off_t\nchanges the behavior so it instead returns -EINVAL.\n\nThe native entry point, the truncate() syscall and the corresponding\nloff_t based variants are all correct already and do not suffer\nfrom this mistake.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8aafb4d2-8097-4df8-b387-69ed2198ae23",
      "id": "CVE-2024-36921",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: guard against invalid STA ID on removal\n\nGuard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would\nresult in out-of-bounds array accesses. This prevents issues should the\ndriver get into a bad state during error handling.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f31dc2cd-399b-402a-8123-b78ced5058ef",
      "id": "CVE-2024-42090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER\n\nIn create_pinctrl(), pinctrl_maps_mutex is acquired before calling\nadd_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl()\ncalls pinctrl_free(). However, pinctrl_free() attempts to acquire\npinctrl_maps_mutex, which is already held by create_pinctrl(), leading to\na potential deadlock.\n\nThis patch resolves the issue by releasing pinctrl_maps_mutex before\ncalling pinctrl_free(), preventing the deadlock.\n\nThis bug was discovered and resolved using Coverity Static Analysis\nSecurity Testing (SAST) by Synopsys, Inc.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8690084-6c75-42fa-b2da-06b2cfea1bfe",
      "id": "CVE-2024-42094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: Avoid explicit cpumask var allocation on stack\n\nFor CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask\nvariable on stack is not recommended since it can cause potential stack\noverflow.\n\nInstead, kernel code should always use *cpumask_var API(s) to allocate\ncpumask var in config-neutral way, leaving allocation strategy to\nCONFIG_CPUMASK_OFFSTACK.\n\nUse *cpumask_var API(s) to address it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3759b95-afeb-4e5c-9bc8-05fed83fa53b",
      "id": "CVE-2024-42104",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: add missing check for inode numbers on directory entries\n\nSyzbot reported that mounting and unmounting a specific pattern of\ncorrupted nilfs2 filesystem images causes a use-after-free of metadata\nfile inodes, which triggers a kernel bug in lru_add_fn().\n\nAs Jan Kara pointed out, this is because the link count of a metadata file\ngets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),\ntries to delete that inode (ifile inode in this case).\n\nThe inconsistency occurs because directories containing the inode numbers\nof these metadata files that should not be visible in the namespace are\nread without checking.\n\nFix this issue by treating the inode numbers of these internal files as\nerrors in the sanity check helper when reading directory folios/pages.\n\nAlso thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer\nanalysis.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34e7b9c1-4e0f-4841-898f-820118eef43b",
      "id": "CVE-2024-42106",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet_diag: Initialize pad field in struct inet_diag_req_v2\n\nKMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw\nsockets uses the pad field in struct inet_diag_req_v2 for the\nunderlying protocol. This field corresponds to the sdiag_raw_protocol\nfield in struct inet_diag_req_raw.\n\ninet_diag_get_exact_compat() converts inet_diag_req to\ninet_diag_req_v2, but leaves the pad field uninitialized. So the issue\noccurs when raw_lookup() accesses the sdiag_raw_protocol field.\n\nFix this by initializing the pad field in\ninet_diag_get_exact_compat(). Also, do the same fix in\ninet_diag_dump_compat() to avoid the similar issue in the future.\n\n[1]\nBUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline]\nBUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71\n raw_lookup net/ipv4/raw_diag.c:49 [inline]\n raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71\n raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99\n inet_diag_cmd_exact+0x7d9/0x980\n inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline]\n inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426\n sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282\n netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564\n sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297\n netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]\n netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x332/0x3d0 net/socket.c:745\n ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639\n __sys_sendmsg net/socket.c:2668 [inline]\n __do_sys_sendmsg net/socket.c:2677 [inline]\n __se_sys_sendmsg net/socket.c:2675 [inline]\n __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675\n x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was stored to memory at:\n raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71\n raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99\n inet_diag_cmd_exact+0x7d9/0x980\n inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline]\n inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426\n sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282\n netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564\n sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297\n netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]\n netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x332/0x3d0 net/socket.c:745\n ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639\n __sys_sendmsg net/socket.c:2668 [inline]\n __do_sys_sendmsg net/socket.c:2677 [inline]\n __se_sys_sendmsg net/socket.c:2675 [inline]\n __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675\n x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable req.i created at:\n inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline]\n inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426\n sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282\n\nCPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7f06975-4561-4374-aba8-aa2b268a9b51",
      "id": "CVE-2024-42148",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnx2x: Fix multiple UBSAN array-index-out-of-bounds\n\nFix UBSAN warnings that occur when using a system with 32 physical\ncpu cores or more, or when the user defines a number of Ethernet\nqueues greater than or equal to FP_SB_MAX_E1x using the num_queues\nmodule parameter.\n\nCurrently there is a read/write out of bounds that occurs on the array\n\"struct stats_query_entry query\" present inside the \"bnx2x_fw_stats_req\"\nstruct in \"drivers/net/ethernet/broadcom/bnx2x/bnx2x.h\".\nLooking at the definition of the \"struct stats_query_entry query\" array:\n\nstruct stats_query_entry query[FP_SB_MAX_E1x+\n         BNX2X_FIRST_QUEUE_QUERY_IDX];\n\nFP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and\nhas a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3\nmeaning the array has a total size of 19.\nSince accesses to \"struct stats_query_entry query\" are offset-ted by\nBNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet\nqueues should not exceed FP_SB_MAX_E1x (16). However one of these queues\nis reserved for FCOE and thus the number of Ethernet queues should be set\nto [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if\nit is not.\n\nThis is also described in a comment in the source code in\ndrivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition\nof FP_SB_MAX_E1x. Below is the part of this explanation that it important\nfor this patch\n\n/*\n  * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is\n  * control by the number of fast-path status blocks supported by the\n  * device (HW/FW). Each fast-path status block (FP-SB) aka non-default\n  * status block represents an independent interrupts context that can\n  * serve a regular L2 networking queue. However special L2 queues such\n  * as the FCoE queue do not require a FP-SB and other components like\n  * the CNIC may consume FP-SB reducing the number of possible L2 queues\n  *\n  * If the maximum number of FP-SB available is X then:\n  * a. If CNIC is supported it consumes 1 FP-SB thus the max number of\n  *    regular L2 queues is Y=X-1\n  * b. In MF mode the actual number of L2 queues is Y= (X-1/MF_factor)\n  * c. If the FCoE L2 queue is supported the actual number of L2 queues\n  *    is Y+1\n  * d. The number of irqs (MSIX vectors) is either Y+1 (one extra for\n  *    slow-path interrupts) or Y+2 if CNIC is supported (one additional\n  *    FP interrupt context for the CNIC).\n  * e. The number of HW context (CID count) is always X or X+1 if FCoE\n  *    L2 queue is supported. The cid for the FCoE L2 queue is always X.\n  */\n\nHowever this driver also supports NICs that use the E2 controller which can\nhandle more queues due to having more FP-SB represented by FP_SB_MAX_E2.\nLooking at the commits when the E2 support was added, it was originally\nusing the E1x parameters: commit f2e0899f0f27 (\"bnx2x: Add 57712 support\").\nBack then FP_SB_MAX_E2 was set to 16 the same as E1x. However the driver\nwas later updated to take full advantage of the E2 instead of having it be\nlimited to the capabilities of the E1x. But as far as we can tell, the\narray \"stats_query_entry query\" was still limited to using the FP-SB\navailable to the E1x cards as part of an oversignt when the driver was\nupdated to take full advantage of the E2, and now with the driver being\naware of the greater queue size supported by E2 NICs, it causes the UBSAN\nwarnings seen in the stack traces below.\n\nThis patch increases the size of the \"stats_query_entry query\" array by\nreplacing FP_SB_MAX_E1x with FP_SB_MAX_E2 to be large enough to handle\nboth types of NICs.\n\nStack traces:\n\nUBSAN: array-index-out-of-bounds in\n       drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11\nindex 20 is out of range for type 'stats_query_entry [19]'\nCPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic\n\t     #202405052133\nHardware name: HP ProLiant DL360 Gen9/ProLiant DL360 \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "884f4da7-0325-438a-8d52-abe3426738c9",
      "id": "CVE-2024-42224",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: Correct check for empty list\n\nSince commit a3c53be55c95 (\"net: dsa: mv88e6xxx: Support multiple MDIO\nbusses\") mv88e6xxx_default_mdio_bus() has checked that the\nreturn value of list_first_entry() is non-NULL.\n\nThis appears to be intended to guard against the list chip-\u003emdios being\nempty.  However, it is not the correct check as the implementation of\nlist_first_entry is not designed to return NULL for empty lists.\n\nInstead, use list_first_entry_or_null() which does return NULL if the\nlist is empty.\n\nFlagged by Smatch.\nCompile tested only.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1707eab-f5e4-43c1-a3b2-72b17ebdbd4c",
      "id": "CVE-2024-42237",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: cs_dsp: Validate payload length before processing block\n\nMove the payload length check in cs_dsp_load() and cs_dsp_coeff_load()\nto be done before the block is processed.\n\nThe check that the length of a block payload does not exceed the number\nof remaining bytes in the firwmware file buffer was being done near the\nend of the loop iteration. However, some code before that check used the\nlength field without validating it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f42afafd-6ec7-4458-a8aa-f9be77f6c962",
      "id": "CVE-2024-43894",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: fix null pointer dereference in drm_client_modeset_probe\n\nIn drm_client_modeset_probe(), the return value of drm_mode_duplicate() is\nassigned to modeset-\u003emode, which will lead to a possible NULL pointer\ndereference on failure of drm_mode_duplicate(). Add a check to avoid npd.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "446a0d14-4a08-40ef-8f17-699379412e49",
      "id": "CVE-2024-44998",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: idt77252: prevent use after free in dequeue_rx()\n\nWe can't dereference \"skb\" after calling vcc-\u003epush() because the skb\nis released.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa582370-1600-4a06-af3f-75b1539782ac",
      "id": "CVE-2024-46675",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: core: Prevent USB core invalid event buffer address access\n\nThis commit addresses an issue where the USB core could access an\ninvalid event buffer address during runtime suspend, potentially causing\nSMMU faults and other memory issues in Exynos platforms. The problem\narises from the following sequence.\n        1. In dwc3_gadget_suspend, there is a chance of a timeout when\n        moving the USB core to the halt state after clearing the\n        run/stop bit by software.\n        2. In dwc3_core_exit, the event buffer is cleared regardless of\n        the USB core's status, which may lead to an SMMU faults and\n        other memory issues. if the USB core tries to access the event\n        buffer address.\n\nTo prevent this hardware quirk on Exynos platforms, this commit ensures\nthat the event buffer address is not cleared by software  when the USB\ncore is active during runtime suspend by checking its status before\nclearing the buffer address.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "250ad952-eedc-4479-88db-152262147e9b",
      "id": "CVE-2024-46732",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Assign linear_pitch_alignment even for VM\n\n[Description]\nAssign linear_pitch_alignment so we don't cause a divide by 0\nerror in VM environments",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83cbea98-3ccb-47fd-a2d8-2b5c6c6b8a67",
      "id": "CVE-2024-46807",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdgpu: Check tbo resource pointer\n\nValidate tbo resource pointer, skip if NULL",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96ec9fd4-6c45-4a8b-b864-169433281586",
      "id": "CVE-2024-46870",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Disable DMCUB timeout for DCN35\n\n[Why]\nDMCUB can intermittently take longer than expected to process commands.\n\nOld ASIC policy was to continue while logging a diagnostic error - which\nworks fine for ASIC without IPS, but with IPS this could lead to a race\ncondition where we attempt to access DCN state while it's inaccessible,\nleading to a system hang when the NIU port is not disabled or register\naccesses that timeout and the display configuration in an undefined\nstate.\n\n[How]\nWe need to investigate why these accesses take longer than expected, but\nfor now we should disable the timeout on DCN35 to avoid this race\ncondition. Since the waits happen only at lower interrupt levels the\nrisk of taking too long at higher IRQ and causing a system watchdog\ntimeout are minimal.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf2065a5-c76b-48cb-b9fc-dbd9a17fab6c",
      "id": "CVE-2024-47757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential oob read in nilfs_btree_check_delete()\n\nThe function nilfs_btree_check_delete(), which checks whether degeneration\nto direct mapping occurs before deleting a b-tree entry, causes memory\naccess outside the block buffer when retrieving the maximum key if the\nroot node has no entries.\n\nThis does not usually happen because b-tree mappings with 0 child nodes\nare never created by mkfs.nilfs2 or nilfs2 itself.  However, it can happen\nif the b-tree root node read from a device is configured that way, so fix\nthis potential issue by adding a check for that case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "522fb7c3-cb1b-413f-82e3-73ffd4c530dc",
      "id": "CVE-2024-54458",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: bsg: Set bsg_queue to NULL after removal\n\nCurrently, this does not cause any issues, but I believe it is necessary to\nset bsg_queue to NULL after removing it to prevent potential use-after-free\n(UAF) access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "784aa102-6498-4f9f-82ea-46a7a86f29a5",
      "id": "CVE-2024-49851",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Clean up TPM space after command failure\n\ntpm_dev_transmit prepares the TPM space before attempting command\ntransmission. However if the command fails no rollback of this\npreparation is done. This can result in transient handles being leaked\nif the device is subsequently closed with no further commands performed.\n\nFix this by flushing the space in the event of command transmission\nfailure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ba12862-2606-4fdb-9f94-d310157f81ab",
      "id": "CVE-2024-49890",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: ensure the fw_info is not null before using it\n\nThis resolves the dereference null return value warning\nreported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6a9f0245-06c1-419f-a0d8-9b986dcb8048",
      "id": "CVE-2024-49928",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid reading out of bounds when loading TX power FW elements\n\nBecause the loop-expression will do one more time before getting false from\ncond-expression, the original code copied one more entry size beyond valid\nregion.\n\nFix it by moving the entry copy to loop-body.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c423f1ea-8987-4b19-98f1-1e9f2f5ab9de",
      "id": "CVE-2024-50049",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointer before dereferencing se\n\n[WHAT \u0026 HOW]\nse is null checked previously in the same function, indicating\nit might be null; therefore, it must be checked when used again.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f80a142-f879-4629-a04b-2b3941e78187",
      "id": "CVE-2024-50096",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error\n\nThe `nouveau_dmem_copy_one` function ensures that the copy push command is\nsent to the device firmware but does not track whether it was executed\nsuccessfully.\n\nIn the case of a copy error (e.g., firmware or hardware failure), the\ncopy push command will be sent via the firmware channel, and\n`nouveau_dmem_copy_one` will likely report success, leading to the\n`migrate_to_ram` function returning a dirty HIGH_USER page to the user.\n\nThis can result in a security vulnerability, as a HIGH_USER page that may\ncontain sensitive or corrupted data could be returned to the user.\n\nTo prevent this vulnerability, we allocate a zero page. Thus, in case of\nan error, a non-dirty (zero) page will be returned to the user.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7801a784-916a-4ba7-b5ec-ae04013e7298",
      "id": "CVE-2022-49585",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout.\n\nWhile reading sysctl_tcp_fastopen_blackhole_timeout, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0aa3a304-0bd2-4285-81f2-534da91860d6",
      "id": "CVE-2024-56598",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: array-index-out-of-bounds fix in dtReadFirst\n\nThe value of stbl can be sometimes out of bounds due\nto a bad filesystem. Added a check with appopriate return\nof error code in that case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26c5c51a-4482-47e7-b53a-9c01b14229ce",
      "id": "CVE-2024-50179",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: remove the incorrect Fw reference check when dirtying pages\n\nWhen doing the direct-io reads it will also try to mark pages dirty,\nbut for the read path it won't hold the Fw caps and there is case\nwill it get the Fw reference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48f1ec2c-ca2c-4ff9-897e-94d6d58b2582",
      "id": "CVE-2024-50191",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't set SB_RDONLY after filesystem errors\n\nWhen the filesystem is mounted with errors=remount-ro, we were setting\nSB_RDONLY flag to stop all filesystem modifications. We knew this misses\nproper locking (sb-\u003es_umount) and does not go through proper filesystem\nremount procedure but it has been the way this worked since early ext2\ndays and it was good enough for catastrophic situation damage\nmitigation. Recently, syzbot has found a way (see link) to trigger\nwarnings in filesystem freezing because the code got confused by\nSB_RDONLY changing under its hands. Since these days we set\nEXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all\nfilesystem modifications, modifying SB_RDONLY shouldn't be needed. So\nstop doing that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ae8bead-458a-44b9-83f0-06a200994b0f",
      "id": "CVE-2024-53084",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Break an object reference loop\n\nWhen remaining resources are being cleaned up on driver close,\noutstanding VM mappings may result in resources being leaked, due\nto an object reference loop, as shown below, with each object (or\nset of objects) referencing the object below it:\n\n    PVR GEM Object\n    GPU scheduler \"finished\" fence\n    GPU scheduler “scheduled” fence\n    PVR driver “done” fence\n    PVR Context\n    PVR VM Context\n    PVR VM Mappings\n    PVR GEM Object\n\nThe reference that the PVR VM Context has on the VM mappings is a\nsoft one, in the sense that the freeing of outstanding VM mappings\nis done as part of VM context destruction; no reference counts are\ninvolved, as is the case for all the other references in the loop.\n\nTo break the reference loop during cleanup, free the outstanding\nVM mappings before destroying the PVR Context associated with the\nVM context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a9e0fa8-2be4-4d0b-95d6-cdeb40325034",
      "id": "CVE-2024-53197",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev-\u003econfig.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "017a6884-b862-49bc-895c-1c260c60d1db",
      "id": "CVE-2024-53218",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix race in concurrent f2fs_stop_gc_thread\n\nIn my test case, concurrent calls to f2fs shutdown report the following\nstack trace:\n\n Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI\n CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85\n Call Trace:\n  \u003cTASK\u003e\n  ? show_regs+0x8b/0xa0\n  ? __die_body+0x26/0xa0\n  ? die_addr+0x54/0x90\n  ? exc_general_protection+0x24b/0x5c0\n  ? asm_exc_general_protection+0x26/0x30\n  ? kthread_stop+0x46/0x390\n  f2fs_stop_gc_thread+0x6c/0x110\n  f2fs_do_shutdown+0x309/0x3a0\n  f2fs_ioc_shutdown+0x150/0x1c0\n  __f2fs_ioctl+0xffd/0x2ac0\n  f2fs_ioctl+0x76/0xe0\n  vfs_ioctl+0x23/0x60\n  __x64_sys_ioctl+0xce/0xf0\n  x64_sys_call+0x2b1b/0x4540\n  do_syscall_64+0xa7/0x240\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe root cause is a race condition in f2fs_stop_gc_thread() called from\ndifferent f2fs shutdown paths:\n\n  [CPU0]                       [CPU1]\n  ----------------------       -----------------------\n  f2fs_stop_gc_thread          f2fs_stop_gc_thread\n                                 gc_th = sbi-\u003egc_thread\n    gc_th = sbi-\u003egc_thread\n    kfree(gc_th)\n    sbi-\u003egc_thread = NULL\n                                 \u003c gc_th != NULL \u003e\n                                 kthread_stop(gc_th-\u003ef2fs_gc_task) //UAF\n\nThe commit c7f114d864ac (\"f2fs: fix to avoid use-after-free in\nf2fs_stop_gc_thread()\") attempted to fix this issue by using a read\nsemaphore to prevent races between shutdown and remount threads, but\nit fails to prevent all race conditions.\n\nFix it by converting to write lock of s_umount in f2fs_do_shutdown().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "974abd3e-973c-47fc-b979-a1d384ff859c",
      "id": "CVE-2024-56700",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: wl128x: Fix atomicity violation in fmc_send_cmd()\n\nAtomicity violation occurs when the fmc_send_cmd() function is executed\nsimultaneously with the modification of the fmdev-\u003eresp_skb value.\nConsider a scenario where, after passing the validity check within the\nfunction, a non-null fmdev-\u003eresp_skb variable is assigned a null value.\nThis results in an invalid fmdev-\u003eresp_skb variable passing the validity\ncheck. As seen in the later part of the function, skb = fmdev-\u003eresp_skb;\nwhen the invalid fmdev-\u003eresp_skb passes the check, a null pointer\ndereference error may occur at line 478, evt_hdr = (void *)skb-\u003edata;\n\nTo address this issue, it is recommended to include the validity check of\nfmdev-\u003eresp_skb within the locked section of the function. This\nmodification ensures that the value of fmdev-\u003eresp_skb does not change\nduring the validation process, thereby maintaining its validity.\n\nThis possible bug is found by an experimental static analysis tool\ndeveloped by our team. This tool analyzes the locking APIs\nto extract function pairs that can be concurrently executed, and then\nanalyzes the instructions in the paired functions to identify possible\nconcurrency bugs including data races and atomicity violations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd803ed3-0101-4b9b-815a-e96952b60ee2",
      "id": "CVE-2024-56722",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix cpu stuck caused by printings during reset\n\nDuring reset, cmd to destroy resources such as qp, cq, and mr may fail,\nand error logs will be printed. When a large number of resources are\ndestroyed, there will be lots of printings, and it may lead to a cpu\nstuck.\n\nDelete some unnecessary printings and replace other printing functions\nin these paths with the ratelimited version.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd1a4d8e-177e-4ef8-9de1-2dfe155199a3",
      "id": "CVE-2024-56770",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: netem: account for backlog updates from child qdisc\n\nIn general, 'qlen' of any classful qdisc should keep track of the\nnumber of packets that the qdisc itself and all of its children holds.\nIn case of netem, 'qlen' only accounts for the packets in its internal\ntfifo. When netem is used with a child qdisc, the child qdisc can use\n'qdisc_tree_reduce_backlog' to inform its parent, netem, about created\nor dropped SKBs. This function updates 'qlen' and the backlog statistics\nof netem, but netem does not account for changes made by a child qdisc.\n'qlen' then indicates the wrong number of packets in the tfifo.\nIf a child qdisc creates new SKBs during enqueue and informs its parent\nabout this, netem's 'qlen' value is increased. When netem dequeues the\nnewly created SKBs from the child, the 'qlen' in netem is not updated.\nIf 'qlen' reaches the configured sch-\u003elimit, the enqueue function stops\nworking, even though the tfifo is not full.\n\nReproduce the bug:\nEnsure that the sender machine has GSO enabled. Configure netem as root\nqdisc and tbf as its child on the outgoing interface of the machine\nas follows:\n$ tc qdisc add dev \u003coif\u003e root handle 1: netem delay 100ms limit 100\n$ tc qdisc add dev \u003coif\u003e parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms\n\nSend bulk TCP traffic out via this interface, e.g., by running an iPerf3\nclient on the machine. Check the qdisc statistics:\n$ tc -s qdisc show dev \u003coif\u003e\n\nStatistics after 10s of iPerf3 TCP test before the fix (note that\nnetem's backlog \u003e limit, netem stopped accepting packets):\nqdisc netem 1: root refcnt 2 limit 1000 delay 100ms\n Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0)\n backlog 4294528236b 1155p requeues 0\nqdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms\n Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0)\n backlog 0b 0p requeues 0\n\nStatistics after the fix:\nqdisc netem 1: root refcnt 2 limit 1000 delay 100ms\n Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0\nqdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms\n Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0)\n backlog 0b 0p requeues 0\n\ntbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'.\nThe interface fully stops transferring packets and \"locks\". In this case,\nthe child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at\nits limit and no more packets are accepted.\n\nThis patch adds a counter for the entries in the tfifo. Netem's 'qlen' is\nonly decreased when a packet is returned by its dequeue function, and not\nduring enqueuing into the child qdisc. External updates to 'qlen' are thus\naccounted for and only the behavior of the backlog statistics changes. As\nin other qdiscs, 'qlen' then keeps track of  how many packets are held in\nnetem and all of its children. As before, sch-\u003elimit remains as the\nmaximum number of packets in the tfifo. The same applies to netem's\nbacklog statistics.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a70066e-cd7e-49f4-bf97-2018dfd0c2a3",
      "id": "CVE-2024-57981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix NULL pointer dereference on certain command aborts\n\nIf a command is queued to the final usable TRB of a ring segment, the\nenqueue pointer is advanced to the subsequent link TRB and no further.\nIf the command is later aborted, when the abort completion is handled\nthe dequeue pointer is advanced to the first TRB of the next segment.\n\nIf no further commands are queued, xhci_handle_stopped_cmd_ring() sees\nthe ring pointers unequal and assumes that there is a pending command,\nso it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL.\n\nDon't attempt timer setup if cur_cmd is NULL. The subsequent doorbell\nring likely is unnecessary too, but it's harmless. Leave it alone.\n\nThis is probably Bug 219532, but no confirmation has been received.\n\nThe issue has been independently reproduced and confirmed fixed using\na USB MCU programmed to NAK the Status stage of SET_ADDRESS forever.\nEverything continued working normally after several prevented crashes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4e55cdf-a0d7-4883-9bf2-03688bec592f",
      "id": "CVE-2025-21861",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()\n\nIf migration succeeded, we called\nfolio_migrate_flags()-\u003emem_cgroup_migrate() to migrate the memcg from the\nold to the new folio.  This will set memcg_data of the old folio to 0.\n\nSimilarly, if migration failed, memcg_data of the dst folio is left unset.\n\nIf we call folio_putback_lru() on such folios (memcg_data == 0), we will\nadd the folio to be freed to the LRU, making memcg code unhappy.  Running\nthe hmm selftests:\n\n  # ./hmm-tests\n  ...\n  #  RUN           hmm.hmm_device_private.migrate ...\n  [  102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00\n  [  102.079974][T14893] anon flags: 0x17ff00000020018(uptodate|dirty|swapbacked|node=0|zone=2|lastcpupid=0x7ff)\n  [  102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9\n  [  102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000\n  [  102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg \u0026\u0026 !mem_cgroup_disabled())\n  [  102.087230][T14893] ------------[ cut here ]------------\n  [  102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170\n  [  102.090478][T14893] Modules linked in:\n  [  102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151\n  [  102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  [  102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170\n  [  102.096104][T14893] Code: ...\n  [  102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293\n  [  102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426\n  [  102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880\n  [  102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\n  [  102.105757][T14893] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900236c37d8\n  [  102.107296][T14893] R13: ffff888277a2bcb0 R14: 000000000000001f R15: 0000000000000000\n  [  102.108830][T14893] FS:  00007ff27dbdd740(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000\n  [  102.110643][T14893] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [  102.111924][T14893] CR2: 00007ff27d400000 CR3: 000000010866e000 CR4: 0000000000750ef0\n  [  102.113478][T14893] PKRU: 55555554\n  [  102.114172][T14893] Call Trace:\n  [  102.114805][T14893]  \u003cTASK\u003e\n  [  102.115397][T14893]  ? folio_lruvec_lock_irqsave+0x10e/0x170\n  [  102.116547][T14893]  ? __warn.cold+0x110/0x210\n  [  102.117461][T14893]  ? folio_lruvec_lock_irqsave+0x10e/0x170\n  [  102.118667][T14893]  ? report_bug+0x1b9/0x320\n  [  102.119571][T14893]  ? handle_bug+0x54/0x90\n  [  102.120494][T14893]  ? exc_invalid_op+0x17/0x50\n  [  102.121433][T14893]  ? asm_exc_invalid_op+0x1a/0x20\n  [  102.122435][T14893]  ? __wake_up_klogd.part.0+0x76/0xd0\n  [  102.123506][T14893]  ? dump_page+0x4f/0x60\n  [  102.124352][T14893]  ? folio_lruvec_lock_irqsave+0x10e/0x170\n  [  102.125500][T14893]  folio_batch_move_lru+0xd4/0x200\n  [  102.126577][T14893]  ? __pfx_lru_add+0x10/0x10\n  [  102.127505][T14893]  __folio_batch_add_and_move+0x391/0x720\n  [  102.128633][T14893]  ? __pfx_lru_add+0x10/0x10\n  [  102.129550][T14893]  folio_putback_lru+0x16/0x80\n  [  102.130564][T14893]  migrate_device_finalize+0x9b/0x530\n  [  102.131640][T14893]  dmirror_migrate_to_device.constprop.0+0x7c5/0xad0\n  [  102.133047][T14893]  dmirror_fops_unlocked_ioctl+0x89b/0xc80\n\nLikely, nothing else goes wrong: putting the last folio reference will\nremove the folio from the LRU again.  So besides memcg complaining, adding\nthe folio to be freed to the LRU is just an unnecessary step.\n\nThe new flow resembles what we have in migrate_folio_move(): add the dst\nto the lru, rem\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "298ffb38-b2db-4c57-9ca5-9e57fe0c06aa",
      "id": "CVE-2024-58005",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Change to kvalloc() in eventlog/acpi.c\n\nThe following failure was reported on HPE ProLiant D320:\n\n[   10.693310][    T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0)\n[   10.848132][    T1] ------------[ cut here ]------------\n[   10.853559][    T1] WARNING: CPU: 59 PID: 1 at mm/page_alloc.c:4727 __alloc_pages_noprof+0x2ca/0x330\n[   10.862827][    T1] Modules linked in:\n[   10.866671][    T1] CPU: 59 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-lp155.2.g52785e2-default #1 openSUSE Tumbleweed (unreleased) 588cd98293a7c9eba9013378d807364c088c9375\n[   10.882741][    T1] Hardware name: HPE ProLiant DL320 Gen12/ProLiant DL320 Gen12, BIOS 1.20 10/28/2024\n[   10.892170][    T1] RIP: 0010:__alloc_pages_noprof+0x2ca/0x330\n[   10.898103][    T1] Code: 24 08 e9 4a fe ff ff e8 34 36 fa ff e9 88 fe ff ff 83 fe 0a 0f 86 b3 fd ff ff 80 3d 01 e7 ce 01 00 75 09 c6 05 f8 e6 ce 01 01 \u003c0f\u003e 0b 45 31 ff e9 e5 fe ff ff f7 c2 00 00 08 00 75 42 89 d9 80 e1\n[   10.917750][    T1] RSP: 0000:ffffb7cf40077980 EFLAGS: 00010246\n[   10.923777][    T1] RAX: 0000000000000000 RBX: 0000000000040cc0 RCX: 0000000000000000\n[   10.931727][    T1] RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000040cc0\n\nThe above transcript shows that ACPI pointed a 16 MiB buffer for the log\nevents because RSI maps to the 'order' parameter of __alloc_pages_noprof().\nAddress the bug by moving from devm_kmalloc() to devm_add_action() and\nkvmalloc() and devm_add_action().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff2d9066-d29e-4c9f-b164-6017143c791f",
      "id": "CVE-2024-58063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: fix memory leaks and invalid access at probe error path\n\nDeinitialize at reverse order when probe fails.\n\nWhen init_sw_vars fails, rtl_deinit_core should not be called, specially\nnow that it destroys the rtl_wq workqueue.\n\nAnd call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be\nleaked.\n\nRemove pci_set_drvdata call as it will already be cleaned up by the core\ndriver code and could lead to memory leaks too. cf. commit 8d450935ae7f\n(\"wireless: rtlwifi: remove unnecessary pci_set_drvdata()\") and\ncommit 3d86b93064c7 (\"rtlwifi: Fix PCI probe error path orphaned memory\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1a6005c-191a-4c9b-945a-01810250be3d",
      "id": "CVE-2025-21648",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: clamp maximum hashtable size to INT_MAX\n\nUse INT_MAX as maximum size for the conntrack hashtable. Otherwise, it\nis possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when\nresizing hashtable because __GFP_NOWARN is unset. See:\n\n  0708a0afe291 (\"mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls\")\n\nNote: hashtable resize is only possible from init_netns.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bddb41a8-3095-4826-86ba-058f466fecd8",
      "id": "CVE-2025-21731",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: don't allow reconnect after disconnect\n\nFollowing process can cause nbd_config UAF:\n\n1) grab nbd_config temporarily;\n\n2) nbd_genl_disconnect() flush all recv_work() and release the\ninitial reference:\n\n  nbd_genl_disconnect\n   nbd_disconnect_and_put\n    nbd_disconnect\n     flush_workqueue(nbd-\u003erecv_workq)\n    if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))\n     nbd_config_put\n     -\u003e due to step 1), reference is still not zero\n\n3) nbd_genl_reconfigure() queue recv_work() again;\n\n  nbd_genl_reconfigure\n   config = nbd_get_config_unlocked(nbd)\n   if (!config)\n   -\u003e succeed\n   if (!test_bit(NBD_RT_BOUND, ...))\n   -\u003e succeed\n   nbd_reconnect_socket\n    queue_work(nbd-\u003erecv_workq, \u0026args-\u003ework)\n\n4) step 1) release the reference;\n\n5) Finially, recv_work() will trigger UAF:\n\n  recv_work\n   nbd_config_put(nbd)\n   -\u003e nbd_config is freed\n   atomic_dec(\u0026config-\u003erecv_threads)\n   -\u003e UAF\n\nFix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so\nthat nbd_genl_reconfigure() will fail.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c9f3d76-d2e6-43ea-9134-97fce334556c",
      "id": "CVE-2025-21780",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()\n\nIt malicious user provides a small pptable through sysfs and then\na bigger pptable, it may cause buffer overflow attack in function\nsmu_sys_set_pp_table().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e46f1d1-4339-439d-aeaf-bb78b6aacb3e",
      "id": "CVE-2025-37834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmscan: don't try to reclaim hwpoison folio\n\nSyzkaller reports a bug as follows:\n\nInjecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000\nMemory failure: 0x18b00e: dirty swapcache page still referenced by 2 users\nMemory failure: 0x18b00e: recovery action for dirty swapcache page: Failed\npage: refcount:2 mapcount:0 mapping:0000000000000000 index:0x20ffd pfn:0x18b00e\nmemcg:ffff0000dd6d9000\nanon flags: 0x5ffffe00482011(locked|dirty|arch_1|swapbacked|hwpoison|node=0|zone=2|lastcpupid=0xfffff)\nraw: 005ffffe00482011 dead000000000100 dead000000000122 ffff0000e232a7c9\nraw: 0000000000020ffd 0000000000000000 00000002ffffffff ffff0000dd6d9000\npage dumped because: VM_BUG_ON_FOLIO(!folio_test_uptodate(folio))\n------------[ cut here ]------------\nkernel BUG at mm/swap_state.c:184!\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\nModules linked in:\nCPU: 0 PID: 60 Comm: kswapd0 Not tainted 6.6.0-gcb097e7de84e #3\nHardware name: linux,dummy-virt (DT)\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : add_to_swap+0xbc/0x158\nlr : add_to_swap+0xbc/0x158\nsp : ffff800087f37340\nx29: ffff800087f37340 x28: fffffc00052c0380 x27: ffff800087f37780\nx26: ffff800087f37490 x25: ffff800087f37c78 x24: ffff800087f377a0\nx23: ffff800087f37c50 x22: 0000000000000000 x21: fffffc00052c03b4\nx20: 0000000000000000 x19: fffffc00052c0380 x18: 0000000000000000\nx17: 296f696c6f662865 x16: 7461646f7470755f x15: 747365745f6f696c\nx14: 6f6621284f494c4f x13: 0000000000000001 x12: ffff600036d8b97b\nx11: 1fffe00036d8b97a x10: ffff600036d8b97a x9 : dfff800000000000\nx8 : 00009fffc9274686 x7 : ffff0001b6c5cbd3 x6 : 0000000000000001\nx5 : ffff0000c25896c0 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : ffff0000c25896c0 x0 : 0000000000000000\nCall trace:\n add_to_swap+0xbc/0x158\n shrink_folio_list+0x12ac/0x2648\n shrink_inactive_list+0x318/0x948\n shrink_lruvec+0x450/0x720\n shrink_node_memcgs+0x280/0x4a8\n shrink_node+0x128/0x978\n balance_pgdat+0x4f0/0xb20\n kswapd+0x228/0x438\n kthread+0x214/0x230\n ret_from_fork+0x10/0x20\n\nI can reproduce this issue with the following steps:\n\n1) When a dirty swapcache page is isolated by reclaim process and the\n   page isn't locked, inject memory failure for the page. \n   me_swapcache_dirty() clears uptodate flag and tries to delete from lru,\n   but fails.  Reclaim process will put the hwpoisoned page back to lru.\n\n2) The process that maps the hwpoisoned page exits, the page is deleted\n   the page will never be freed and will be in the lru forever.\n\n3) If we trigger a reclaim again and tries to reclaim the page,\n   add_to_swap() will trigger VM_BUG_ON_FOLIO due to the uptodate flag is\n   cleared.\n\nTo fix it, skip the hwpoisoned page in shrink_folio_list().  Besides, the\nhwpoison folio may not be unmapped by hwpoison_user_mappings() yet, unmap\nit in shrink_folio_list(), otherwise the folio will fail to be unmaped by\nhwpoison_user_mappings() since the folio isn't in lru list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45913d4f-dd85-4190-a9db-08a0d04c65f2",
      "id": "CVE-2025-21905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: limit printed string from FW file\n\nThere's no guarantee here that the file is always with a\nNUL-termination, so reading the string may read beyond the\nend of the TLV. If that's the last TLV in the file, it can\nperhaps even read beyond the end of the file buffer.\n\nFix that by limiting the print format to the size of the\nbuffer we have.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9c753cc-8715-44fb-b0e2-a4af85bc3e3a",
      "id": "CVE-2025-22057",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: decrease cached dst counters in dst_release\n\nUpstream fix ac888d58869b (\"net: do not delay dst_entries_add() in\ndst_release()\") moved decrementing the dst count from dst_destroy to\ndst_release to avoid accessing already freed data in case of netns\ndismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels\nare used, this fix is incomplete as the same issue will be seen for\ncached dsts:\n\n  Unable to handle kernel paging request at virtual address ffff5aabf6b5c000\n  Call trace:\n   percpu_counter_add_batch+0x3c/0x160 (P)\n   dst_release+0xec/0x108\n   dst_cache_destroy+0x68/0xd8\n   dst_destroy+0x13c/0x168\n   dst_destroy_rcu+0x1c/0xb0\n   rcu_do_batch+0x18c/0x7d0\n   rcu_core+0x174/0x378\n   rcu_core_si+0x18/0x30\n\nFix this by invalidating the cache, and thus decrementing cached dst\ncounters, in dst_release too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3086160b-a938-46d3-9347-c53ea3ce52df",
      "id": "CVE-2025-37796",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x: fix use after free access in at76_disconnect\n\nThe memory pointed to by priv is freed at the end of at76_delete_device\nfunction (using ieee80211_free_hw). But the code then accesses the udev\nfield of the freed object to put the USB device. This may also lead to a\nmemory leak of the usb device. Fix this by using udev from interface.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f9bb7f1b-4744-4a1f-b08b-99a8486ee7c0",
      "id": "CVE-2025-37951",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Add job to pending list if the reset was skipped\n\nWhen a CL/CSD job times out, we check if the GPU has made any progress\nsince the last timeout. If so, instead of resetting the hardware, we skip\nthe reset and let the timer get rearmed. This gives long-running jobs a\nchance to complete.\n\nHowever, when `timedout_job()` is called, the job in question is removed\nfrom the pending list, which means it won't be automatically freed through\n`free_job()`. Consequently, when we skip the reset and keep the job\nrunning, the job won't be freed when it finally completes.\n\nThis situation leads to a memory leak, as exposed in [1] and [2].\n\nSimilarly to commit 704d3d60fec4 (\"drm/etnaviv: don't block scheduler when\nGPU is still active\"), this patch ensures the job is put back on the\npending list when extending the timeout.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "546f8bc3-d349-4700-a0f3-3826ee7b748f",
      "id": "CVE-2025-37968",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: opt3001: fix deadlock due to concurrent flag access\n\nThe threaded IRQ function in this driver is reading the flag twice: once to\nlock a mutex and once to unlock it. Even though the code setting the flag\nis designed to prevent it, there are subtle cases where the flag could be\ntrue at the mutex_lock stage and false at the mutex_unlock stage. This\nresults in the mutex not being unlocked, resulting in a deadlock.\n\nFix it by making the opt3001_irq() code generally more robust, reading the\nflag into a variable and using the variable value at both stages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a07450c-923b-4256-8c96-893a424b3478",
      "id": "CVE-2025-38040",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: mctrl_gpio: split disable_ms into sync and no_sync APIs\n\nThe following splat has been observed on a SAMA5D27 platform using\natmel_serial:\n\nBUG: sleeping function called from invalid context at kernel/irq/manage.c:738\nin_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 27, name: kworker/u5:0\npreempt_count: 1, expected: 0\nINFO: lockdep is turned off.\nirq event stamp: 0\nhardirqs last  enabled at (0): [\u003c00000000\u003e] 0x0\nhardirqs last disabled at (0): [\u003cc01588f0\u003e] copy_process+0x1c4c/0x7bec\nsoftirqs last  enabled at (0): [\u003cc0158944\u003e] copy_process+0x1ca0/0x7bec\nsoftirqs last disabled at (0): [\u003c00000000\u003e] 0x0\nCPU: 0 UID: 0 PID: 27 Comm: kworker/u5:0 Not tainted 6.13.0-rc7+ #74\nHardware name: Atmel SAMA5\nWorkqueue: hci0 hci_power_on [bluetooth]\nCall trace:\n  unwind_backtrace from show_stack+0x18/0x1c\n  show_stack from dump_stack_lvl+0x44/0x70\n  dump_stack_lvl from __might_resched+0x38c/0x598\n  __might_resched from disable_irq+0x1c/0x48\n  disable_irq from mctrl_gpio_disable_ms+0x74/0xc0\n  mctrl_gpio_disable_ms from atmel_disable_ms.part.0+0x80/0x1f4\n  atmel_disable_ms.part.0 from atmel_set_termios+0x764/0x11e8\n  atmel_set_termios from uart_change_line_settings+0x15c/0x994\n  uart_change_line_settings from uart_set_termios+0x2b0/0x668\n  uart_set_termios from tty_set_termios+0x600/0x8ec\n  tty_set_termios from ttyport_set_flow_control+0x188/0x1e0\n  ttyport_set_flow_control from wilc_setup+0xd0/0x524 [hci_wilc]\n  wilc_setup [hci_wilc] from hci_dev_open_sync+0x330/0x203c [bluetooth]\n  hci_dev_open_sync [bluetooth] from hci_dev_do_open+0x40/0xb0 [bluetooth]\n  hci_dev_do_open [bluetooth] from hci_power_on+0x12c/0x664 [bluetooth]\n  hci_power_on [bluetooth] from process_one_work+0x998/0x1a38\n  process_one_work from worker_thread+0x6e0/0xfb4\n  worker_thread from kthread+0x3d4/0x484\n  kthread from ret_from_fork+0x14/0x28\n\nThis warning is emitted when trying to toggle, at the highest level,\nsome flow control (with serdev_device_set_flow_control) in a device\ndriver. At the lowest level, the atmel_serial driver is using\nserial_mctrl_gpio lib to enable/disable the corresponding IRQs\naccordingly.  The warning emitted by CONFIG_DEBUG_ATOMIC_SLEEP is due to\ndisable_irq (called in mctrl_gpio_disable_ms) being possibly called in\nsome atomic context (some tty drivers perform modem lines configuration\nin regions protected by port lock).\n\nSplit mctrl_gpio_disable_ms into two differents APIs, a non-blocking one\nand a blocking one. Replace mctrl_gpio_disable_ms calls with the\nrelevant version depending on whether the call is protected by some port\nlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d045e59-b6d9-4aea-87d6-e1981ca6f5b8",
      "id": "CVE-2025-38079",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_hash - fix double free in hash_accept\n\nIf accept(2) is called on socket type algif_hash with\nMSG_MORE flag set and crypto_ahash_import fails,\nsk2 is freed. However, it is also freed in af_alg_release,\nleading to slab-use-after-free error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6aa8308f-596f-49da-89d6-4255ed510337",
      "id": "CVE-2025-38094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cadence: macb: Fix a possible deadlock in macb_halt_tx.\n\nThere is a situation where after THALT is set high, TGO stays high as\nwell. Because jiffies are never updated, as we are in a context with\ninterrupts disabled, we never exit that loop and have a deadlock.\n\nThat deadlock was noticed on a sama5d4 device that stayed locked for days.\n\nUse retries instead of jiffies so that the timeout really works and we do\nnot have a deadlock anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc47df53-2b9e-4e12-8228-f799678acd0d",
      "id": "CVE-2025-38207",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix uprobe pte be overwritten when expanding vma\n\nPatch series \"Fix uprobe pte be overwritten when expanding vma\".\n\n\nThis patch (of 4):\n\nWe encountered a BUG alert triggered by Syzkaller as follows:\n   BUG: Bad rss-counter state mm:00000000b4a60fca type:MM_ANONPAGES val:1\n\nAnd we can reproduce it with the following steps:\n1. register uprobe on file at zero offset\n2. mmap the file at zero offset:\n   addr1 = mmap(NULL, 2 * 4096, PROT_NONE, MAP_PRIVATE, fd, 0);\n3. mremap part of vma1 to new vma2:\n   addr2 = mremap(addr1, 4096, 2 * 4096, MREMAP_MAYMOVE);\n4. mremap back to orig addr1:\n   mremap(addr2, 4096, 4096, MREMAP_MAYMOVE | MREMAP_FIXED, addr1);\n\nIn step 3, the vma1 range [addr1, addr1 + 4096] will be remap to new vma2\nwith range [addr2, addr2 + 8192], and remap uprobe anon page from the vma1\nto vma2, then unmap the vma1 range [addr1, addr1 + 4096].\n\nIn step 4, the vma2 range [addr2, addr2 + 4096] will be remap back to the\naddr range [addr1, addr1 + 4096].  Since the addr range [addr1 + 4096,\naddr1 + 8192] still maps the file, it will take vma_merge_new_range to\nexpand the range, and then do uprobe_mmap in vma_complete.  Since the\nmerged vma pgoff is also zero offset, it will install uprobe anon page to\nthe merged vma.  However, the upcomming move_page_tables step, which use\nset_pte_at to remap the vma2 uprobe pte to the merged vma, will overwrite\nthe newly uprobe pte in the merged vma, and lead that pte to be orphan.\n\nSince the uprobe pte will be remapped to the merged vma, we can remove the\nunnecessary uprobe_mmap upon merged vma.\n\nThis problem was first found in linux-6.6.y and also exists in the\ncommunity syzkaller:\nhttps://lore.kernel.org/all/000000000000ada39605a5e71711@google.com/T/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "04612279-4528-46a6-8034-eb123ef8d309",
      "id": "CVE-2025-38269",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: exit after state insertion failure at btrfs_convert_extent_bit()\n\nIf insert_state() state failed it returns an error pointer and we call\nextent_io_tree_panic() which will trigger a BUG() call. However if\nCONFIG_BUG is disabled, which is an uncommon and exotic scenario, then\nwe fallthrough and call cache_state() which will dereference the error\npointer, resulting in an invalid memory access.\n\nSo jump to the 'out' label after calling extent_io_tree_panic(), it also\nmakes the code more clear besides dealing with the exotic scenario where\nCONFIG_BUG is disabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d15d6a51-3f32-4e80-8fdd-9fa996dd6d03",
      "id": "CVE-2025-38384",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix memory leak of ECC engine conf\n\nMemory allocated for the ECC engine conf is not released during spinand\ncleanup. Below kmemleak trace is seen for this memory leak:\n\nunreferenced object 0xffffff80064f00e0 (size 8):\n  comm \"swapper/0\", pid 1, jiffies 4294937458\n  hex dump (first 8 bytes):\n    00 00 00 00 00 00 00 00                          ........\n  backtrace (crc 0):\n    kmemleak_alloc+0x30/0x40\n    __kmalloc_cache_noprof+0x208/0x3c0\n    spinand_ondie_ecc_init_ctx+0x114/0x200\n    nand_ecc_init_ctx+0x70/0xa8\n    nanddev_ecc_engine_init+0xec/0x27c\n    spinand_probe+0xa2c/0x1620\n    spi_mem_probe+0x130/0x21c\n    spi_probe+0xf0/0x170\n    really_probe+0x17c/0x6e8\n    __driver_probe_device+0x17c/0x21c\n    driver_probe_device+0x58/0x180\n    __device_attach_driver+0x15c/0x1f8\n    bus_for_each_drv+0xec/0x150\n    __device_attach+0x188/0x24c\n    device_initial_probe+0x10/0x20\n    bus_probe_device+0x11c/0x160\n\nFix the leak by calling nanddev_ecc_engine_cleanup() inside\nspinand_cleanup().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa658e60-c70a-4652-9643-64a68f728e34",
      "id": "CVE-2025-38546",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix memory leak of struct clip_vcc.\n\nioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to\nvcc-\u003euser_back.\n\nThe code assumes that vcc_destroy_socket() passes NULL skb\nto vcc-\u003epush() when the socket is close()d, and then clip_push()\nfrees clip_vcc.\n\nHowever, ioctl(ATMARPD_CTRL) sets NULL to vcc-\u003epush() in\natm_init_atmarp(), resulting in memory leak.\n\nLet's serialise two ioctl() by lock_sock() and check vcc-\u003epush()\nin atm_init_atmarp() to prevent memleak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5642e2fc-3929-451d-a2a9-0737805206be",
      "id": "CVE-2020-27777",
      "description": "A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0c92a1f-85ff-40e2-b55f-a98e7811b068",
      "id": "CVE-2020-28941",
      "description": "An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e03d73a3-46a2-4836-99a5-89c473e6beec",
      "id": "CVE-2020-36312",
      "description": "An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df461226-f844-4f4f-828e-a4d8b3d203e2",
      "id": "CVE-2021-29647",
      "description": "An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23fb30c1-70a2-4050-95d8-1d06892568a4",
      "id": "CVE-2021-31916",
      "description": "An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e36fbc30-390a-4d68-864b-7a434da94753",
      "id": "CVE-2021-33656",
      "description": "When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb97b4fa-af18-443d-9a5c-78e4aed52b4d",
      "id": "CVE-2021-33909",
      "description": "fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3de311d9-7dd9-40ae-b46f-7ee7c7fdb060",
      "id": "CVE-2021-3411",
      "description": "A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3e7809a2-df0f-4843-8e56-bacbbb930426",
      "id": "CVE-2021-38200",
      "description": "arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a \"perf record\" command.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "961cba9a-b047-43e1-b60f-f21a8209e625",
      "id": "CVE-2021-4203",
      "description": "A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a2ed162-e1ca-447e-aa5c-2c6848750c5a",
      "id": "CVE-2021-46924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: st21nfca: Fix memory leak in device probe and remove\n\n'phy-\u003epending_skb' is alloced when device probe, but forgot to free\nin the error handling path and remove path, this cause memory leak\nas follows:\n\nunreferenced object 0xffff88800bc06800 (size 512):\n  comm \"8\", pid 11775, jiffies 4295159829 (age 9.032s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c00000000d66c09ce\u003e] __kmalloc_node_track_caller+0x1ed/0x450\n    [\u003c00000000c93382b3\u003e] kmalloc_reserve+0x37/0xd0\n    [\u003c000000005fea522c\u003e] __alloc_skb+0x124/0x380\n    [\u003c0000000019f29f9a\u003e] st21nfca_hci_i2c_probe+0x170/0x8f2\n\nFix it by freeing 'pending_skb' in error and remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f2414ce-1dab-4afb-8eaf-2ead77cb8a2b",
      "id": "CVE-2021-47006",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook\n\nThe commit 1879445dfa7b (\"perf/core: Set event's default\n::overflow_handler()\") set a default event-\u003eoverflow_handler in\nperf_event_alloc(), and replace the check event-\u003eoverflow_handler with\nis_default_overflow_handler(), but one is missing.\n\nCurrently, the bp-\u003eoverflow_handler can not be NULL. As a result,\nenable_single_step() is always not invoked.\n\nComments from Zhen Lei:\n\n https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210207105934.2001-1-thunder.leizhen@huawei.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a745ed65-272a-4b6a-ac6e-c2c9fdeb4cab",
      "id": "CVE-2021-47100",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module\n\nHi,\n\nWhen testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko,\nthe system crashed.\n\nThe log as follows:\n[  141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a\n[  141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0\n[  141.087464] Oops: 0010 [#1] SMP NOPTI\n[  141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47\n[  141.088009] Workqueue: events 0xffffffffc09b3a40\n[  141.088009] RIP: 0010:0xffffffffc09b3a5a\n[  141.088009] Code: Bad RIP value.\n[  141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246\n[  141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000\n[  141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\n[  141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1\n[  141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700\n[  141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8\n[  141.088009] FS:  0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000\n[  141.088009] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0\n[  141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  141.088009] PKRU: 55555554\n[  141.088009] Call Trace:\n[  141.088009]  ? process_one_work+0x195/0x390\n[  141.088009]  ? worker_thread+0x30/0x390\n[  141.088009]  ? process_one_work+0x390/0x390\n[  141.088009]  ? kthread+0x10d/0x130\n[  141.088009]  ? kthread_flush_work_fn+0x10/0x10\n[  141.088009]  ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a\n[  200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0\n[  200.223464] Oops: 0010 [#1] SMP NOPTI\n[  200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46\n[  200.224008] Workqueue: events 0xffffffffc0b28a40\n[  200.224008] RIP: 0010:0xffffffffc0b28a5a\n[  200.224008] Code: Bad RIP value.\n[  200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246\n[  200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000\n[  200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\n[  200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5\n[  200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700\n[  200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8\n[  200.224008] FS:  0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000\n[  200.224008] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0\n[  200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  200.224008] PKRU: 55555554\n[  200.224008] Call Trace:\n[  200.224008]  ? process_one_work+0x195/0x390\n[  200.224008]  ? worker_thread+0x30/0x390\n[  200.224008]  ? process_one_work+0x390/0x390\n[  200.224008]  ? kthread+0x10d/0x130\n[  200.224008]  ? kthread_flush_work_fn+0x10/0x10\n[  200.224008]  ? ret_from_fork+0x35/0x40\n[  200.224008] kernel fault(0x1) notification starting on CPU 63\n[  200.224008] kernel fault(0x1) notification finished on CPU 63\n[  200.224008] CR2: ffffffffc0b28a5a\n[  200.224008] ---[ end trace c82a412d93f57412 ]---\n\nThe reason is as follows:\nT1: rmmod ipmi_si.\n    -\u003eipmi_unregister_smi()\n        -\u003e ipmi_bmc_unregister()\n            -\u003e __ipmi_bmc_unregister()\n                -\u003e kref_put(\u0026bmc-\u003eusecount, cleanup_bmc_device);\n                    -\u003e schedule_work(\u0026bmc-\u003eremove_work);\n\nT2: rmmod ipmi_msghandl\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f1ee8b4-5171-4d40-a776-1b6822d7d775",
      "id": "CVE-2021-47145",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON in link_to_fixup_dir\n\nWhile doing error injection testing I got the following panic\n\n  kernel BUG at fs/btrfs/tree-log.c:1862!\n  invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  RIP: 0010:link_to_fixup_dir+0xd5/0xe0\n  RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216\n  RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0\n  RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000\n  RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001\n  R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800\n  R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065\n  FS:  00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0\n  Call Trace:\n   replay_one_buffer+0x409/0x470\n   ? btree_read_extent_buffer_pages+0xd0/0x110\n   walk_up_log_tree+0x157/0x1e0\n   walk_log_tree+0xa6/0x1d0\n   btrfs_recover_log_trees+0x1da/0x360\n   ? replay_one_extent+0x7b0/0x7b0\n   open_ctree+0x1486/0x1720\n   btrfs_mount_root.cold+0x12/0xea\n   ? __kmalloc_track_caller+0x12f/0x240\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   vfs_kern_mount.part.0+0x71/0xb0\n   btrfs_mount+0x10d/0x380\n   ? vfs_parse_fs_string+0x4d/0x90\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   path_mount+0x433/0xa10\n   __x64_sys_mount+0xe3/0x120\n   do_syscall_64+0x3d/0x80\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nWe can get -EIO or any number of legitimate errors from\nbtrfs_search_slot(), panicing here is not the appropriate response.  The\nerror path for this code handles errors properly, simply return the\nerror.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b13a319-9250-404f-a1d0-d629a8682dd4",
      "id": "CVE-2021-47166",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()\n\nThe value of mirror-\u003epg_bytes_written should only be updated after a\nsuccessful attempt to flush out the requests on the list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a8068e1-96cb-4006-8425-b132eb1d3ce7",
      "id": "CVE-2021-47247",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\n\nFunction mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\n\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260]  dump_stack+0xbb/0x107\n [23827.477906]  print_address_description.constprop.0+0x18/0x140\n [23827.478896]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905]  kasan_report.cold+0x7c/0xd8\n [23827.481701]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744]  kasan_check_range+0x145/0x1a0\n [23827.493112]  mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054]  ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296]  mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338]  ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486]  ? read_word_at_a_time+0xe/0x20\n [23827.498250]  ? strscpy+0xa0/0x2a0\n [23827.498889]  process_one_work+0x8ac/0x14e0\n [23827.499638]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359]  ? rwlock_bug.part.0+0x90/0x90\n [23827.502116]  worker_thread+0x53b/0x1220\n [23827.502831]  ? process_one_work+0x14e0/0x14e0\n [23827.503627]  kthread+0x328/0x3f0\n [23827.504254]  ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065]  ? __kthread_bind_mask+0x90/0x90\n [23827.505912]  ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694]  kasan_save_stack+0x1b/0x40\n [23827.508476]  __kasan_kmalloc+0x7c/0x90\n [23827.509197]  mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194]  mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218]  __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234]  mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298]  tc_setup_cb_add+0x1d5/0x420\n [23827.514023]  fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975]  fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821]  tc_new_tfilter+0x89a/0x2070\n [23827.516548]  rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300]  netlink_rcv_skb+0x11d/0x340\n [23827.518021]  netlink_unicast+0x42b/0x700\n [23827.518742]  netlink_sendmsg+0x743/0xc20\n [23827.519467]  sock_sendmsg+0xb2/0xe0\n [23827.520131]  ____sys_sendmsg+0x590/0x770\n [23827.520851]  ___sys_sendmsg+0xd8/0x160\n [23827.521552]  __sys_sendmsg+0xb7/0x140\n [23827.522238]  do_syscall_64+0x3a/0x70\n [23827.522907]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780]  kasan_save_stack+0x1b/0x40\n [23827.525488]  kasan_set_track+0x1c/0x30\n [23827.526187]  kasan_set_free_info+0x20/0x30\n [23827.526968]  __kasan_slab_free+0xed/0x130\n [23827.527709]  slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528]  kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317]  kfree_rcu_work+0x55f/0xb70\n [23827.530024]  process_one_work+0x8ac/0x14e0\n [23827.530770]  worker_thread+0x53b/0x1220\n [23827.531480]  kthread+0x328/0x3f0\n [23827.532114]  ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007]  kasan_save_stack+0x1b/0x40\n [23827.534710]  kasan_record_aux_stack+0xab/0xc0\n [23827.535492]  kvfree_call_rcu+0x31/0x7b0\n [23827.536206]  mlx5e_tc_del\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1925a005-8565-4a0c-b438-aa72398d2d34",
      "id": "CVE-2021-47327",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails\n\narm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the\nrefcount of the \"smmu\" even though the return value is less than 0.\n\nThe reference counting issue happens in some error handling paths of\narm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()\nfails, the caller functions forget to decrease the refcount of \"smmu\"\nincreased by arm_smmu_rpm_get(), causing a refcount leak.\n\nFix this issue by calling pm_runtime_resume_and_get() instead of\npm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount\nbalanced in case of failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cba6cf91-c61f-4284-92d3-360c579330aa",
      "id": "CVE-2021-47346",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()\n\ncommit 6f755e85c332 (\"coresight: Add helper for inserting synchronization\npackets\") removed trailing '\\0' from barrier_pkt array and updated the\ncall sites like etb_update_buffer() to have proper checks for barrier_pkt\nsize before read but missed updating tmc_update_etf_buffer() which still\nreads barrier_pkt past the array size resulting in KASAN out-of-bounds\nbug. Fix this by adding a check for barrier_pkt size before accessing\nlike it is done in etb_update_buffer().\n\n BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698\n Read of size 4 at addr ffffffd05b7d1030 by task perf/2629\n\n Call trace:\n  dump_backtrace+0x0/0x27c\n  show_stack+0x20/0x2c\n  dump_stack+0x11c/0x188\n  print_address_description+0x3c/0x4a4\n  __kasan_report+0x140/0x164\n  kasan_report+0x10/0x18\n  __asan_report_load4_noabort+0x1c/0x24\n  tmc_update_etf_buffer+0x4b8/0x698\n  etm_event_stop+0x248/0x2d8\n  etm_event_del+0x20/0x2c\n  event_sched_out+0x214/0x6f0\n  group_sched_out+0xd0/0x270\n  ctx_sched_out+0x2ec/0x518\n  __perf_event_task_sched_out+0x4fc/0xe6c\n  __schedule+0x1094/0x16a0\n  preempt_schedule_irq+0x88/0x170\n  arm64_preempt_schedule_irq+0xf0/0x18c\n  el1_irq+0xe8/0x180\n  perf_event_exec+0x4d8/0x56c\n  setup_new_exec+0x204/0x400\n  load_elf_binary+0x72c/0x18c0\n  search_binary_handler+0x13c/0x420\n  load_script+0x500/0x6c4\n  search_binary_handler+0x13c/0x420\n  exec_binprm+0x118/0x654\n  __do_execve_file+0x77c/0xba4\n  __arm64_compat_sys_execve+0x98/0xac\n  el0_svc_common+0x1f8/0x5e0\n  el0_svc_compat_handler+0x84/0xb0\n  el0_svc_compat+0x10/0x50\n\n The buggy address belongs to the variable:\n  barrier_pkt+0x10/0x40\n\n Memory state around the buggy address:\n  ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00\n  ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03\n                                      ^\n  ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa\n  ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa\n ==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7047d694-e533-45c1-a44b-64c2da479fde",
      "id": "CVE-2021-47456",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_pci: peak_pci_remove(): fix UAF\n\nWhen remove the module peek_pci, referencing 'chan' again after\nreleasing 'dev' will cause UAF.\n\nFix this by releasing 'dev' later.\n\nThe following log reveals it:\n\n[   35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]\n[   35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537\n[   35.965513 ] Call Trace:\n[   35.965718 ]  dump_stack_lvl+0xa8/0xd1\n[   35.966028 ]  print_address_description+0x87/0x3b0\n[   35.966420 ]  kasan_report+0x172/0x1c0\n[   35.966725 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]\n[   35.967137 ]  ? trace_irq_enable_rcuidle+0x10/0x170\n[   35.967529 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]\n[   35.967945 ]  __asan_report_load8_noabort+0x14/0x20\n[   35.968346 ]  peak_pci_remove+0x16f/0x270 [peak_pci]\n[   35.968752 ]  pci_device_remove+0xa9/0x250",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3a86ce1-3343-4e20-b1ce-55d1b16f2ecb",
      "id": "CVE-2021-47465",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()\n\nIn commit 10d91611f426 (\"powerpc/64s: Reimplement book3s idle code in\nC\") kvm_start_guest() became idle_kvm_start_guest(). The old code\nallocated a stack frame on the emergency stack, but didn't use the\nframe to store anything, and also didn't store anything in its caller's\nframe.\n\nidle_kvm_start_guest() on the other hand is written more like a normal C\nfunction, it creates a frame on entry, and also stores CR/LR into its\ncallers frame (per the ABI). The problem is that there is no caller\nframe on the emergency stack.\n\nThe emergency stack for a given CPU is allocated with:\n\n  paca_ptrs[i]-\u003eemergency_sp = alloc_stack(limit, i) + THREAD_SIZE;\n\nSo emergency_sp actually points to the first address above the emergency\nstack allocation for a given CPU, we must not store above it without\nfirst decrementing it to create a frame. This is different to the\nregular kernel stack, paca-\u003ekstack, which is initialised to point at an\ninitial frame that is ready to use.\n\nidle_kvm_start_guest() stores the backchain, CR and LR all of which\nwrite outside the allocation for the emergency stack. It then creates a\nstack frame and saves the non-volatile registers. Unfortunately the\nframe it creates is not large enough to fit the non-volatiles, and so\nthe saving of the non-volatile registers also writes outside the\nemergency stack allocation.\n\nThe end result is that we corrupt whatever is at 0-24 bytes, and 112-248\nbytes above the emergency stack allocation.\n\nIn practice this has gone unnoticed because the memory immediately above\nthe emergency stack happens to be used for other stack allocations,\neither another CPUs mc_emergency_sp or an IRQ stack. See the order of\ncalls to irqstack_early_init() and emergency_stack_init().\n\nThe low addresses of another stack are the top of that stack, and so are\nonly used if that stack is under extreme pressue, which essentially\nnever happens in practice - and if it did there's a high likelyhood we'd\ncrash due to that stack overflowing.\n\nStill, we shouldn't be corrupting someone else's stack, and it is purely\nluck that we aren't corrupting something else.\n\nTo fix it we save CR/LR into the caller's frame using the existing r1 on\nentry, we then create a SWITCH_FRAME_SIZE frame (which has space for\npt_regs) on the emergency stack with the backchain pointing to the\nexisting stack, and then finally we switch to the new frame on the\nemergency stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41a4d204-b7e4-460e-8692-4e1ad390a942",
      "id": "CVE-2020-35519",
      "description": "An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2cbcce05-0cdb-40a5-a0cf-92dbb0371cdf",
      "id": "CVE-2021-47576",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()\n\nIn resp_mode_select() sanity check the block descriptor len to avoid UAF.\n\nBUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509\nRead of size 1 at addr ffff888026670f50 by task scsicmd/15032\n\nCPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107\n print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257\n kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443\n __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306\n resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509\n schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483\n scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537\n scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63\n sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837\n sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775\n sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50\n entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe4cb3ac-3900-416b-a61d-b954ad30d5ae",
      "id": "CVE-2021-47644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging: media: zoran: move videodev alloc\n\nMove some code out of zr36057_init() and create new functions for handling\nzr-\u003evideo_dev. This permit to ease code reading and fix a zr-\u003evideo_dev\nmemory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5898074-6a20-46a0-8b44-66ce705caa59",
      "id": "CVE-2022-0494",
      "description": "A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b7a280d-ce63-415c-bf47-d78ef9e9c1a0",
      "id": "CVE-2022-24959",
      "description": "An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c967e5c0-c1d0-43b4-9009-7937ffe7c1aa",
      "id": "CVE-2022-2873",
      "description": "An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95b39c1b-d6bd-4d3c-9517-03f3e325070d",
      "id": "CVE-2022-3577",
      "description": "An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumption, leaking to out-of-bound write.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0cff9c9c-7dd1-4781-8902-0072cc8640e8",
      "id": "CVE-2022-36879",
      "description": "An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fca3e92-53bf-47e3-b39d-3ca62eeafa9b",
      "id": "CVE-2022-48733",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free after failure to create a snapshot\n\nAt ioctl.c:create_snapshot(), we allocate a pending snapshot structure and\nthen attach it to the transaction's list of pending snapshots. After that\nwe call btrfs_commit_transaction(), and if that returns an error we jump\nto 'fail' label, where we kfree() the pending snapshot structure. This can\nresult in a later use-after-free of the pending snapshot:\n\n1) We allocated the pending snapshot and added it to the transaction's\n   list of pending snapshots;\n\n2) We call btrfs_commit_transaction(), and it fails either at the first\n   call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().\n   In both cases, we don't abort the transaction and we release our\n   transaction handle. We jump to the 'fail' label and free the pending\n   snapshot structure. We return with the pending snapshot still in the\n   transaction's list;\n\n3) Another task commits the transaction. This time there's no error at\n   all, and then during the transaction commit it accesses a pointer\n   to the pending snapshot structure that the snapshot creation task\n   has already freed, resulting in a user-after-free.\n\nThis issue could actually be detected by smatch, which produced the\nfollowing warning:\n\n  fs/btrfs/ioctl.c:843 create_snapshot() warn: '\u0026pending_snapshot-\u003elist' not removed from list\n\nSo fix this by not having the snapshot creation ioctl directly add the\npending snapshot to the transaction's list. Instead add the pending\nsnapshot to the transaction handle, and then at btrfs_commit_transaction()\nwe add the snapshot to the list only when we can guarantee that any error\nreturned after that point will result in a transaction abort, in which\ncase the ioctl code can safely free the pending snapshot and no one can\naccess it anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d656bf02-0dcf-47bc-af96-32a2cc6c5481",
      "id": "CVE-2022-48804",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt_ioctl: fix array_index_nospec in vt_setactivate\n\narray_index_nospec ensures that an out-of-bounds value is set to zero\non the transient path. Decreasing the value by one afterwards causes\na transient integer underflow. vsa.console should be decreased first\nand then sanitized with array_index_nospec.\n\nKasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh\nRazavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU\nAmsterdam.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d94b8cd8-2dea-48bd-b22d-bf11c4419d50",
      "id": "CVE-2022-48928",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: men_z188_adc: Fix a resource leak in an error handling path\n\nIf iio_device_register() fails, a previous ioremap() is left unbalanced.\n\nUpdate the error handling path and add the missing iounmap() call, as\nalready done in the remove function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e19bf9b4-1897-4cc1-9603-d648aa7cb428",
      "id": "CVE-2022-49967",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a data-race around bpf_jit_limit.\n\nWhile reading bpf_jit_limit, it can be changed concurrently via sysctl,\nWRITE_ONCE() in __do_proc_doulongvec_minmax(). The size of bpf_jit_limit\nis long, so we need to add a paired READ_ONCE() to avoid load-tearing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d58be192-b05d-4e60-ac6f-f33ae4423760",
      "id": "CVE-2022-49137",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj\n\nThis issue takes place in an error path in\namdgpu_cs_fence_to_handle_ioctl(). When `info-\u003ein.what` falls into\ndefault case, the function simply returns -EINVAL, forgetting to\ndecrement the reference count of a dma_fence obj, which is bumped\nearlier by amdgpu_cs_get_fence(). This may result in reference count\nleaks.\n\nFix it by decreasing the refcount of specific object before returning\nthe error code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad70338c-ab9c-4414-808b-b381f58cbc74",
      "id": "CVE-2022-48997",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nchar: tpm: Protect tpm_pm_suspend with locks\n\nCurrently tpm transactions are executed unconditionally in\ntpm_pm_suspend() function, which may lead to races with other tpm\naccessors in the system.\n\nSpecifically, the hw_random tpm driver makes use of tpm_get_random(),\nand this function is called in a loop from a kthread, which means it's\nnot frozen alongside userspace, and so can race with the work done\nduring system suspend:\n\n  tpm tpm0: tpm_transmit: tpm_recv: error -52\n  tpm tpm0: invalid TPM_STS.x 0xff, dumping stack for forensics\n  CPU: 0 PID: 1 Comm: init Not tainted 6.1.0-rc5+ #135\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\n  Call Trace:\n   tpm_tis_status.cold+0x19/0x20\n   tpm_transmit+0x13b/0x390\n   tpm_transmit_cmd+0x20/0x80\n   tpm1_pm_suspend+0xa6/0x110\n   tpm_pm_suspend+0x53/0x80\n   __pnp_bus_suspend+0x35/0xe0\n   __device_suspend+0x10f/0x350\n\nFix this by calling tpm_try_get_ops(), which itself is a wrapper around\ntpm_chip_start(), but takes the appropriate mutex.\n\n[Jason: reworked commit message, added metadata]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fe6f07a-3f95-4417-b29d-ddb66f37f59c",
      "id": "CVE-2022-49061",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link\n\nWhen using a fixed-link, the altr_tse_pcs driver crashes\ndue to null-pointer dereference as no phy_device is provided to\ntse_pcs_fix_mac_speed function. Fix this by adding a check for\nphy_dev before calling the tse_pcs_fix_mac_speed() function.\n\nAlso clean up the tse_pcs_fix_mac_speed function a bit. There is\nno need to check for splitter_base and sgmii_adapter_base\nbecause the driver will fail if these 2 variables are not\nderived from the device tree.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2cdd279f-f8f8-47f5-b0c9-88f6baed5936",
      "id": "CVE-2022-49073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: sata_dwc_460ex: Fix crash due to OOB write\n\nthe driver uses libata's \"tag\" values from in various arrays.\nSince the mentioned patch bumped the ATA_TAG_INTERNAL to 32,\nthe value of the SATA_DWC_QCMD_MAX needs to account for that.\n\nOtherwise ATA_TAG_INTERNAL usage cause similar crashes like\nthis as reported by Tice Rex on the OpenWrt Forum and\nreproduced (with symbols) here:\n\n| BUG: Kernel NULL pointer dereference at 0x00000000\n| Faulting instruction address: 0xc03ed4b8\n| Oops: Kernel access of bad area, sig: 11 [#1]\n| BE PAGE_SIZE=4K PowerPC 44x Platform\n| CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0\n| NIP:  c03ed4b8 LR: c03d27e8 CTR: c03ed36c\n| REGS: cfa59950 TRAP: 0300   Not tainted  (5.4.163)\n| MSR:  00021000 \u003cCE,ME\u003e  CR: 42000222  XER: 00000000\n| DEAR: 00000000 ESR: 00000000\n| GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...]\n| [..]\n| NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254\n| LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc\n| Call Trace:\n| [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable)\n| [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc\n| [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524\n| [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0\n| [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204\n| [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130\n| [...]\n\nThis is because sata_dwc_dma_xfer_complete() NULLs the\ndma_pending's next neighbour \"chan\" (a *dma_chan struct) in\nthis '32' case right here (line ~735):\n\u003e hsdevp-\u003edma_pending[tag] = SATA_DWC_DMA_PENDING_NONE;\n\nThen the next time, a dma gets issued; dma_dwc_xfer_setup() passes\nthe NULL'd hsdevp-\u003echan to the dmaengine_slave_config() which then\ncauses the crash.\n\nWith this patch, SATA_DWC_QCMD_MAX is now set to ATA_MAX_QUEUE + 1.\nThis avoids the OOB. But please note, there was a worthwhile discussion\non what ATA_TAG_INTERNAL and ATA_MAX_QUEUE is. And why there should not\nbe a \"fake\" 33 command-long queue size.\n\nIdeally, the dw driver should account for the ATA_TAG_INTERNAL.\nIn Damien Le Moal's words: \"... having looked at the driver, it\nis a bigger change than just faking a 33rd \"tag\" that is in fact\nnot a command tag at all.\"\n\nBugLink: https://github.com/openwrt/openwrt/issues/9505",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ca97b3e-e99c-4cf4-8c47-21619693a707",
      "id": "CVE-2022-49080",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix mpol_new leak in shared_policy_replace\n\nIf mpol_new is allocated but not used in restart loop, mpol_new will be\nfreed via mpol_put before returning to the caller.  But refcnt is not\ninitialized yet, so mpol_put could not do the right things and might\nleak the unused mpol_new.  This would happen if mempolicy was updated on\nthe shared shmem file while the sp-\u003elock has been dropped during the\nmemory allocation.\n\nThis issue could be triggered easily with the below code snippet if\nthere are many processes doing the below work at the same time:\n\n  shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT);\n  shm = shmat(shmid, 0, 0);\n  loop many times {\n    mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0);\n    mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask,\n          maxnode, 0);\n  }",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "784839f6-da87-483a-8f7f-8777034fcfff",
      "id": "CVE-2022-49113",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/secvar: fix refcount leak in format_show()\n\nRefcount leak will happen when format_show returns failure in multiple\ncases. Unified management of of_node_put can fix this problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7bd2390f-1007-4f27-aa9e-4b0010270c80",
      "id": "CVE-2022-49117",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: ralink: fix a refcount leak in ill_acc_of_setup()\n\nof_node_put(np) needs to be called when pdev == NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b541bd4-868e-4371-b32d-fd0dbd80032b",
      "id": "CVE-2020-26541",
      "description": "The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4394a8d2-c27c-472e-a0c4-1cd6fbaed599",
      "id": "CVE-2022-49311",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()\n\nThere is a deadlock in rtw_joinbss_event_prehandle(), which is shown\nbelow:\n\n   (Thread 1)                |      (Thread 2)\n                             | _set_timer()\nrtw_joinbss_event_prehandle()|  mod_timer()\n spin_lock_bh() //(1)        |  (wait a time)\n ...                         | _rtw_join_timeout_handler()\n del_timer_sync()            |  spin_lock_bh() //(2)\n (wait timer to stop)        |  ...\n\nWe hold pmlmepriv-\u003elock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need pmlmepriv-\u003elock in position (2) of thread 2.\nAs a result, rtw_joinbss_event_prehandle() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_bh(), which could let timer handler to obtain\nthe needed lock. What`s more, we change spin_lock_bh() to\nspin_lock_irq() in _rtw_join_timeout_handler() in order to\nprevent deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "951e224f-b450-47a8-b5c0-9a035941ecd7",
      "id": "CVE-2022-49314",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: Fix a possible resource leak in icom_probe\n\nWhen pci_read_config_dword failed, call pci_release_regions() and\npci_disable_device() to recycle the resource previously allocated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a883ba87-c6fa-4b50-9821-3546e8d3d426",
      "id": "CVE-2022-49349",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in ext4_rename_dir_prepare\n\nWe got issue as follows:\nEXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue\next4_get_first_dir_block: bh-\u003eb_data=0xffff88810bee6000 len=34478\next4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh-\u003eb_data=0xffff88810bee6000\next4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae\n==================================================================\nBUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220\nRead of size 4 at addr ffff88810beee6ae by task rep/1895\n\nCPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241\nCall Trace:\n dump_stack+0xbe/0xf9\n print_address_description.constprop.0+0x1e/0x220\n kasan_report.cold+0x37/0x7f\n ext4_rename_dir_prepare+0x152/0x220\n ext4_rename+0xf44/0x1ad0\n ext4_rename2+0x11c/0x170\n vfs_rename+0xa84/0x1440\n do_renameat2+0x683/0x8f0\n __x64_sys_renameat+0x53/0x60\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\nRIP: 0033:0x7f45a6fc41c9\nRSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9\nRDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005\nRBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080\nR10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0\nR13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000\n\nThe buggy address belongs to the page:\npage:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee\nflags: 0x200000000000000()\nraw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000\nraw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\u003effff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                                  ^\n ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n==================================================================\nDisabling lock debugging due to kernel taint\next4_rename_dir_prepare: [2] parent_de-\u003einode=3537895424\next4_rename_dir_prepare: [3] dir=0xffff888124170140\next4_rename_dir_prepare: [4] ino=2\next4_rename_dir_prepare: ent-\u003edir-\u003ei_ino=2 parent=-757071872\n\nReason is first directory entry which 'rec_len' is 34478, then will get illegal\nparent entry. Now, we do not check directory entry after read directory block\nin 'ext4_get_first_dir_block'.\nTo solve this issue, check directory entry in 'ext4_get_first_dir_block'.\n\n[ Trigger an ext4_error() instead of just warning if the directory is\n  missing a '.' or '..' entry.   Also make sure we return an error code\n  if the file system is corrupted.  -TYT ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fac15704-7dc2-460c-a559-48afe813cfac",
      "id": "CVE-2022-49390",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacsec: fix UAF bug for real_dev\n\nCreate a new macsec device but not get reference to real_dev. That can\nnot ensure that real_dev is freed after macsec. That will trigger the\nUAF bug for real_dev as following:\n\n==================================================================\nBUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662\nCall Trace:\n ...\n macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662\n dev_get_iflink+0x73/0xe0 net/core/dev.c:637\n default_operstate net/core/link_watch.c:42 [inline]\n rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54\n linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161\n\nAllocated by task 22209:\n ...\n alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549\n rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235\n veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748\n\nFreed by task 8:\n ...\n kfree+0xd6/0x4d0 mm/slub.c:4552\n kvfree+0x42/0x50 mm/util.c:615\n device_release+0x9f/0x240 drivers/base/core.c:2229\n kobject_cleanup lib/kobject.c:673 [inline]\n kobject_release lib/kobject.c:704 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x1c8/0x540 lib/kobject.c:721\n netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327\n\nAfter commit faab39f63c1f (\"net: allow out-of-order netdev unregistration\")\nand commit e5f80fcf869a (\"ipv6: give an IPv6 dev to blackhole_netdev\"), we\ncan add dev_hold_track() in macsec_dev_init() and dev_put_track() in\nmacsec_free_netdev() to fix the problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8618aaec-aea3-464e-b699-838789755c2e",
      "id": "CVE-2022-49433",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Prevent use of lock before it is initialized\n\nIf there is a failure during probe of hfi1 before the sdma_map_lock is\ninitialized, the call to hfi1_free_devdata() will attempt to use a lock\nthat has not been initialized. If the locking correctness validator is on\nthen an INFO message and stack trace resembling the following may be seen:\n\n  INFO: trying to register non-static key.\n  The code is fine but needs lockdep annotation, or maybe\n  you didn't initialize this object before use?\n  turning off the locking correctness validator.\n  Call Trace:\n  register_lock_class+0x11b/0x880\n  __lock_acquire+0xf3/0x7930\n  lock_acquire+0xff/0x2d0\n  _raw_spin_lock_irq+0x46/0x60\n  sdma_clean+0x42a/0x660 [hfi1]\n  hfi1_free_devdata+0x3a7/0x420 [hfi1]\n  init_one+0x867/0x11a0 [hfi1]\n  pci_device_probe+0x40e/0x8d0\n\nThe use of sdma_map_lock in sdma_clean() is for freeing the sdma_map\nmemory, and sdma_map is not allocated/initialized until after\nsdma_map_lock has been initialized. This code only needs to be run if\nsdma_map is not NULL, and so checking for that condition will avoid trying\nto use the lock before it is initialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c03e20a-dc70-4bd1-8476-904169868c5b",
      "id": "CVE-2022-49492",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags\n\nIn nvme_alloc_admin_tags, the admin_q can be set to an error (typically\n-ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which\nis checked immediately after the call. However, when we return the error\nmessage up the stack, to nvme_reset_work the error takes us to\nnvme_remove_dead_ctrl()\n  nvme_dev_disable()\n   nvme_suspend_queue(\u0026dev-\u003equeues[0]).\n\nHere, we only check that the admin_q is non-NULL, rather than not\nan error or NULL, and begin quiescing a queue that never existed, leading\nto bad / NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d679c50e-f0ce-45b0-ad63-9dc537689f27",
      "id": "CVE-2022-49726",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource: hyper-v: unexport __init-annotated hv_init_clocksource()\n\nEXPORT_SYMBOL and __init is a bad combination because the .init.text\nsection is freed up after the initialization. Hence, modules cannot\nuse symbols annotated __init. The access to a freed symbol may end up\nwith kernel panic.\n\nmodpost used to detect it, but it has been broken for a decade.\n\nRecently, I fixed modpost so it started to warn it again, then this\nshowed up in linux-next builds.\n\nThere are two ways to fix it:\n\n  - Remove __init\n  - Remove EXPORT_SYMBOL\n\nI chose the latter for this case because the only in-tree call-site,\narch/x86/kernel/cpu/mshyperv.c is never compiled as modular.\n(CONFIG_HYPERVISOR_GUEST is boolean)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1a98bd5-09fd-4bbd-85da-1033fe6476b8",
      "id": "CVE-2022-49727",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix signed integer overflow in l2tp_ip6_sendmsg\n\nWhen len \u003e= INT_MAX - transhdrlen, ulen = len + transhdrlen will be\noverflow. To fix, we can follow what udpv6 does and subtract the\ntranshdrlen from the max.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5dfcecde-ae21-417b-8fce-0038057e13e2",
      "id": "CVE-2022-49731",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()\n\nIn an unlikely (and probably wrong?) case that the 'ppi' parameter of\nata_host_alloc_pinfo() points to an array starting with a NULL pointer,\nthere's going to be a kernel oops as the 'pi' local variable won't get\nreassigned from the initial value of NULL. Initialize 'pi' instead to\n'\u0026ata_dummy_port_info' to fix the possible kernel oops for good...\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "678bc0ee-1627-4845-9c9e-ee408a9abb0a",
      "id": "CVE-2022-49740",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads\n\nThis patch fixes slab-out-of-bounds reads in brcmfmac that occur in\nbrcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count\nvalue of channel specifications provided by the device is greater than\nthe length of 'list-\u003eelement[]', decided by the size of the 'list'\nallocated with kzalloc(). The patch adds checks that make the functions\nfree the buffer and return -EINVAL if that is the case. Note that the\nnegative return is handled by the caller, brcmf_setup_wiphybands() or\nbrcmf_cfg80211_attach().\n\nFound by a modified version of syzkaller.\n\nCrash Report from brcmf_construct_chaninfo():\n==================================================================\nBUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430\nRead of size 4 at addr ffff888115f24600 by task kworker/0:2/1896\n\nCPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n dump_stack_lvl+0x57/0x7d\n print_address_description.constprop.0.cold+0x93/0x334\n kasan_report.cold+0x83/0xdf\n brcmf_setup_wiphybands+0x1238/0x1430\n brcmf_cfg80211_attach+0x2118/0x3fd0\n brcmf_attach+0x389/0xd40\n brcmf_usb_probe+0x12de/0x1690\n usb_probe_interface+0x25f/0x710\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_set_configuration+0x984/0x1770\n usb_generic_driver_probe+0x69/0x90\n usb_probe_device+0x9c/0x220\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_new_device.cold+0x463/0xf66\n hub_event+0x10d5/0x3330\n process_one_work+0x873/0x13e0\n worker_thread+0x8b/0xd10\n kthread+0x379/0x450\n ret_from_fork+0x1f/0x30\n\nAllocated by task 1896:\n kasan_save_stack+0x1b/0x40\n __kasan_kmalloc+0x7c/0x90\n kmem_cache_alloc_trace+0x19e/0x330\n brcmf_setup_wiphybands+0x290/0x1430\n brcmf_cfg80211_attach+0x2118/0x3fd0\n brcmf_attach+0x389/0xd40\n brcmf_usb_probe+0x12de/0x1690\n usb_probe_interface+0x25f/0x710\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_set_configuration+0x984/0x1770\n usb_generic_driver_probe+0x69/0x90\n usb_probe_device+0x9c/0x220\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_new_device.cold+0x463/0xf66\n hub_event+0x10d5/0x3330\n process_one_work+0x873/0x13e0\n worker_thread+0x8b/0xd10\n kthread+0x379/0x450\n ret_from_fork+0x1f/0x30\n\nThe buggy address belongs to the object at ffff888115f24000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1536 bytes inside of\n 2048-byte region [ffff888115f24000, ffff888115f24800)\n\nMemory state around the buggy address:\n ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003effff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                   ^\n ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n==================================================================\n\nCrash Report from brcmf_enable_bw40_2g():\n==========\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ec61804-43a2-40f4-b411-d53818576ab9",
      "id": "CVE-2022-49743",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Use \"buf\" flexible array for memcpy() destination\n\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\n\n  memcpy: detected field-spanning write (size 93) of single field \"\u0026fh-\u003efb\"\n  at fs/overlayfs/export.c:799 (size 21)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e62f5783-0799-4805-b6c9-35724aeb07c9",
      "id": "CVE-2022-49764",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent bpf program recursion for raw tracepoint probes\n\nWe got report from sysbot [1] about warnings that were caused by\nbpf program attached to contention_begin raw tracepoint triggering\nthe same tracepoint by using bpf_trace_printk helper that takes\ntrace_printk_lock lock.\n\n Call Trace:\n  \u003cTASK\u003e\n  ? trace_event_raw_event_bpf_trace_printk+0x5f/0x90\n  bpf_trace_printk+0x2b/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  bpf_trace_printk+0x3f/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  bpf_trace_printk+0x3f/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  bpf_trace_printk+0x3f/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  __unfreeze_partials+0x5b/0x160\n  ...\n\nThe can be reproduced by attaching bpf program as raw tracepoint on\ncontention_begin tracepoint. The bpf prog calls bpf_trace_printk\nhelper. Then by running perf bench the spin lock code is forced to\ntake slow path and call contention_begin tracepoint.\n\nFixing this by skipping execution of the bpf program if it's\nalready running, Using bpf prog 'active' field, which is being\ncurrently used by trampoline programs for the same reason.\n\nMoving bpf_prog_inc_misses_counter to syscall.c because\ntrampoline.c is compiled in just for CONFIG_BPF_JIT option.\n\n[1] https://lore.kernel.org/bpf/YxhFe3EwqchC%2FfYf@krava/T/#t",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "210562a4-0506-479b-bef2-c50db0696ff4",
      "id": "CVE-2022-49968",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154/adf7242: defer destroy_workqueue call\n\nThere is a possible race condition (use-after-free) like below\n\n  (FREE)                     |  (USE)\n  adf7242_remove             |  adf7242_channel\n   cancel_delayed_work_sync  |\n    destroy_workqueue (1)    |   adf7242_cmd_rx\n                             |    mod_delayed_work (2)\n                             |\n\nThe root cause for this race is that the upper layer (ieee802154) is\nunaware of this detaching event and the function adf7242_channel can\nbe called without any checks.\n\nTo fix this, we can add a flag write at the beginning of adf7242_remove\nand add flag check in adf7242_channel. Or we can just defer the\ndestructive operation like other commit 3e0588c291d6 (\"hamradio: defer\nax25 kfree after unregister_netdev\") which let the\nieee802154_unregister_hw() to handle the synchronization. This patch\ntakes the second option.\n\nruns\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd3d0912-6cc8-4cf3-82a0-1fadc4b05edb",
      "id": "CVE-2022-50108",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: max77620: Fix refcount leak in max77620_initialise_fps\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2aeb7038-a5fd-44df-9c7c-9540f12e991b",
      "id": "CVE-2022-50151",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix random warning message when driver load\n\nWarning log:\n[    4.141392] Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xa20 (GFP_ATOMIC). Fix your code!\n[    4.150340] CPU: 1 PID: 175 Comm: 1-0050 Not tainted 5.15.5-00039-g2fd9ae1b568c #20\n[    4.158010] Hardware name: Freescale i.MX8QXP MEK (DT)\n[    4.163155] Call trace:\n[    4.165600]  dump_backtrace+0x0/0x1b0\n[    4.169286]  show_stack+0x18/0x68\n[    4.172611]  dump_stack_lvl+0x68/0x84\n[    4.176286]  dump_stack+0x18/0x34\n[    4.179613]  kmalloc_fix_flags+0x60/0x88\n[    4.183550]  new_slab+0x334/0x370\n[    4.186878]  ___slab_alloc.part.108+0x4d4/0x748\n[    4.191419]  __slab_alloc.isra.109+0x30/0x78\n[    4.195702]  kmem_cache_alloc+0x40c/0x420\n[    4.199725]  dma_pool_alloc+0xac/0x1f8\n[    4.203486]  cdns3_allocate_trb_pool+0xb4/0xd0\n\npool_alloc_page(struct dma_pool *pool, gfp_t mem_flags)\n{\n\t...\n\tpage = kmalloc(sizeof(*page), mem_flags);\n\tpage-\u003evaddr = dma_alloc_coherent(pool-\u003edev, pool-\u003eallocation,\n\t\t\t\t\t \u0026page-\u003edma, mem_flags);\n\t...\n}\n\nkmalloc was called with mem_flags, which is passed down in\ncdns3_allocate_trb_pool() and have GFP_DMA32 flags.\nkmall_fix_flags() report warning.\n\nGFP_DMA32 is not useful at all. dma_alloc_coherent() will handle\nDMA memory region correctly by pool-\u003edev. GFP_DMA32 can be removed\nsafely.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "321d3c89-975d-45cb-a6d7-1b3223175076",
      "id": "CVE-2022-50205",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: Add more validity checks for inode counts\n\nAdd checks verifying number of inodes stored in the superblock matches\nthe number computed from number of inodes per group. Also verify we have\nat least one block worth of inodes per group. This prevents crashes on\ncorrupted filesystems.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e72a4c33-f825-4e26-9666-95bf8f39141f",
      "id": "CVE-2022-50207",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: bcm: Fix refcount leak in bcm_kona_smc_init\n\nof_find_matching_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc2d2dde-48a6-4422-b54d-b4277e66773d",
      "id": "CVE-2023-0590",
      "description": "A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (\"net: sched: fix race condition in qdisc_graft()\") not applied yet, then kernel could be affected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13081473-fb32-4e47-9d69-bfa1d6cdd32b",
      "id": "CVE-2022-50245",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix possible UAF when kfifo_alloc() fails\n\nIf kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free\npriv. But priv is still in the chdev-\u003efile_list, then list traversal\nmay cause UAF. This fixes the following smatch warning:\n\ndrivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '\u0026priv-\u003elist' not removed from list",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3ca0235-a5dd-474f-8a88-b35f0a97b1b4",
      "id": "CVE-2022-50251",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host(), besides, the timer added before mmc_add_host() needs be del.\n\nAnd this patch fixes another missing call mmc_free_host() if usb_control_msg()\nfails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a17c6b4-c560-45ef-834e-2e611d971b0a",
      "id": "CVE-2022-50328",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix potential use-after-free in jbd2_fc_wait_bufs\n\nIn 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count\nwhich may lead to use-after-free.\nSo judge buffer if uptodate before put buffer head reference count.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03ee3664-ef1b-4e32-b278-a04f2ea35877",
      "id": "CVE-2022-50386",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix user-after-free\n\nThis uses l2cap_chan_hold_unless_zero() after calling\n__l2cap_get_chan_blah() to prevent the following trace:\n\nBluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref\n*kref)\nBluetooth: chan 0000000023c4974d\nBluetooth: parent 00000000ae861c08\n==================================================================\nBUG: KASAN: use-after-free in __mutex_waiter_is_first\nkernel/locking/mutex.c:191 [inline]\nBUG: KASAN: use-after-free in __mutex_lock_common\nkernel/locking/mutex.c:671 [inline]\nBUG: KASAN: use-after-free in __mutex_lock+0x278/0x400\nkernel/locking/mutex.c:729\nRead of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed8c09d3-a312-4f39-bc0b-58bcfb1a4f13",
      "id": "CVE-2024-26813",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/platform: Create persistent IRQ handlers\n\nThe vfio-platform SET_IRQS ioctl currently allows loopback triggering of\nan interrupt before a signaling eventfd has been configured by the user,\nwhich thereby allows a NULL pointer dereference.\n\nRather than register the IRQ relative to a valid trigger, register all\nIRQs in a disabled state in the device open path.  This allows mask\noperations on the IRQ to nest within the overall enable state governed\nby a valid eventfd signal.  This decouples @masked, protected by the\n@locked spinlock from @trigger, protected via the @igate mutex.\n\nIn doing so, it's guaranteed that changes to @trigger cannot race the\nIRQ handlers because the IRQ handler is synchronously disabled before\nmodifying the trigger, and loopback triggering of the IRQ via ioctl is\nsafe due to serialization with trigger changes via igate.\n\nFor compatibility, request_irq() failures are maintained to be local to\nthe SET_IRQS ioctl rather than a fatal error in the open device path.\nThis allows, for example, a userspace driver with polling mode support\nto continue to work regardless of moving the request_irq() call site.\nThis necessarily blocks all SET_IRQS access to the failed index.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fee75fb6-ff47-4ae8-af89-99aa4145a3fe",
      "id": "CVE-2023-25012",
      "description": "The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be480ab0-9a5b-4f8f-b810-aa6fe61022c9",
      "id": "CVE-2023-2985",
      "description": "A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "731b94e2-8532-4209-acc8-b7b7dbe68cf8",
      "id": "CVE-2023-34324",
      "description": "Closing of an event channel in the Linux kernel can result in a deadlock.\nThis happens when the close is being performed in parallel to an unrelated\nXen console action and the handling of a Xen console interrupt in an\nunprivileged guest.\n\nThe closing of an event channel is e.g. triggered by removal of a\nparavirtual device on the other side. As this action will cause console\nmessages to be issued on the other side quite often, the chance of\ntriggering the deadlock is not neglectable.\n\nNote that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel\non Arm doesn't use queued-RW-locks, which are required to trigger the\nissue (on Arm32 a waiting writer doesn't block further readers to get\nthe lock).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2da1e819-d57b-4a6a-83b8-f767dccfadfd",
      "id": "CVE-2023-3611",
      "description": "An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.\n\nThe qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.\n\nWe recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d18a3c9-a22b-4153-aa8f-6b39fb7992cd",
      "id": "CVE-2023-4387",
      "description": "A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3b1c2d34-9972-42d0-a235-af5f08de1976",
      "id": "CVE-2023-52585",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()\n\nReturn invalid error code -EINVAL for invalid block id.\n\nFixes the below:\n\ndrivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "36074e38-3961-4e65-9444-6c89971fb335",
      "id": "CVE-2023-52597",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: fix setting of fpc register\n\nkvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control\n(fpc) register of a guest cpu. The new value is tested for validity by\ntemporarily loading it into the fpc register.\n\nThis may lead to corruption of the fpc register of the host process:\nif an interrupt happens while the value is temporarily loaded into the fpc\nregister, and within interrupt context floating point or vector registers\nare used, the current fp/vx registers are saved with save_fpu_regs()\nassuming they belong to user space and will be loaded into fp/vx registers\nwhen returning to user space.\n\ntest_fp_ctl() restores the original user space / host process fpc register\nvalue, however it will be discarded, when returning to user space.\n\nIn result the host process will incorrectly continue to run with the value\nthat was supposed to be used for a guest cpu.\n\nFix this by simply removing the test. There is another test right before\nthe SIE context is entered which will handles invalid values.\n\nThis results in a change of behaviour: invalid values will now be accepted\ninstead of that the ioctl fails with -EINVAL. This seems to be acceptable,\ngiven that this interface is most likely not used anymore, and this is in\naddition the same behaviour implemented with the memory mapped interface\n(replace invalid values with zero) - see sync_regs() in kvm-s390.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "051b7588-8b8b-4111-a40f-062dca7e07e4",
      "id": "CVE-2023-53093",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not let histogram values have some modifiers\n\nHistogram values can not be strings, stacktraces, graphs, symbols,\nsyscalls, or grouped in buckets or log. Give an error if a value is set to\ndo so.\n\nNote, the histogram code was not prepared to handle these modifiers for\nhistograms and caused a bug.\n\nMark Rutland reported:\n\n # echo 'p:copy_to_user __arch_copy_to_user n=$arg2' \u003e\u003e /sys/kernel/tracing/kprobe_events\n # echo 'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' \u003e /sys/kernel/tracing/events/kprobes/copy_to_user/trigger\n # cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist\n[  143.694628] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[  143.695190] Mem abort info:\n[  143.695362]   ESR = 0x0000000096000004\n[  143.695604]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  143.695889]   SET = 0, FnV = 0\n[  143.696077]   EA = 0, S1PTW = 0\n[  143.696302]   FSC = 0x04: level 0 translation fault\n[  143.702381] Data abort info:\n[  143.702614]   ISV = 0, ISS = 0x00000004\n[  143.702832]   CM = 0, WnR = 0\n[  143.703087] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000\n[  143.703407] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n[  143.704137] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[  143.704714] Modules linked in:\n[  143.705273] CPU: 0 PID: 133 Comm: cat Not tainted 6.2.0-00003-g6fc512c10a7c #3\n[  143.706138] Hardware name: linux,dummy-virt (DT)\n[  143.706723] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  143.707120] pc : hist_field_name.part.0+0x14/0x140\n[  143.707504] lr : hist_field_name.part.0+0x104/0x140\n[  143.707774] sp : ffff800008333a30\n[  143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0\n[  143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800\n[  143.708776] x23: ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001\n[  143.709127] x20: ffff10d303ec2000 x19: 0000000000000000 x18: 0000000000000000\n[  143.709478] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[  143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023\n[  143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c\n[  143.710584] x8 : 000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c\n[  143.710915] x5 : ffff10d303b0103e x4 : ffffd7a653b20261 x3 : 000000000000003d\n[  143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 : 0000000000000000\n[  143.711746] Call trace:\n[  143.712115]  hist_field_name.part.0+0x14/0x140\n[  143.712642]  hist_field_name.part.0+0x104/0x140\n[  143.712925]  hist_field_print+0x28/0x140\n[  143.713125]  event_hist_trigger_print+0x174/0x4d0\n[  143.713348]  hist_show+0xf8/0x980\n[  143.713521]  seq_read_iter+0x1bc/0x4b0\n[  143.713711]  seq_read+0x8c/0xc4\n[  143.713876]  vfs_read+0xc8/0x2a4\n[  143.714043]  ksys_read+0x70/0xfc\n[  143.714218]  __arm64_sys_read+0x24/0x30\n[  143.714400]  invoke_syscall+0x50/0x120\n[  143.714587]  el0_svc_common.constprop.0+0x4c/0x100\n[  143.714807]  do_el0_svc+0x44/0xd0\n[  143.714970]  el0_svc+0x2c/0x84\n[  143.715134]  el0t_64_sync_handler+0xbc/0x140\n[  143.715334]  el0t_64_sync+0x190/0x194\n[  143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000)\n[  143.716510] ---[ end trace 0000000000000000 ]---\nSegmentation fault",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94dfbcec-2b15-40dc-a851-8ade0fc04c5a",
      "id": "CVE-2023-53409",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: component: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "743250ad-4fc8-4391-80b7-f653b2333866",
      "id": "CVE-2023-53437",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Handle cameras with invalid descriptors\n\nIf the source entity does not contain any pads, do not create a link.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e6f13ac-3864-4817-9bee-0934e3296a71",
      "id": "CVE-2024-0564",
      "description": "A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is \"max page sharing=256\", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's \"max page share\". Through these operations, the attacker can leak the victim's page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4194175c-b380-4576-b1fa-f6bb2a50782e",
      "id": "CVE-2022-48619",
      "description": "An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ffc9848-4320-4c60-b386-39705ff66cc2",
      "id": "CVE-2024-0841",
      "description": "A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d75b2a5d-b28a-4a4c-8f46-8c9fe4f599e7",
      "id": "CVE-2024-26812",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Create persistent INTx handler\n\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\n\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those.  The igate mutex cannot be acquired from the\natomic context of the eventfd wake function.  Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\n\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd.  Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7938a041-3901-4afe-9a10-eb449bcb16fd",
      "id": "CVE-2024-26875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\nRead of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26\n\nCPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc4/0x620 mm/kasan/report.c:488\n kasan_report+0xda/0x110 mm/kasan/report.c:601\n pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\n pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]\n pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272\n\nFreed by task 906:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:47\nkasan_save_track+0x14/0x30 mm/kasan/common.c:68\nkasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\npoison_slab_object mm/kasan/common.c:241 [inline]\n__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257\nkasan_slab_free include/linux/kasan.h:184 [inline]\nslab_free_hook mm/slub.c:2121 [inline]\nslab_free mm/slub.c:4299 [inline]\nkfree+0x105/0x340 mm/slub.c:4409\npvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]\npvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158\n\n[Analyze]\nTask A set disconnect_flag = !0, which resulted in Task B's condition being met\nand releasing mp, leading to this issue.\n\n[Fix]\nPlace the disconnect_flag assignment operation after all code in pvr2_context_disconnect()\nto avoid this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aed9688f-25e5-45a5-978d-1d3a82ff1b71",
      "id": "CVE-2024-26903",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n\nDuring our fuzz testing of the connection and disconnection process at the\nRFCOMM layer, we discovered this bug. By comparing the packets from a\nnormal connection and disconnection process with the testcase that\ntriggered a KASAN report. We analyzed the cause of this bug as follows:\n\n1. In the packets captured during a normal connection, the host sends a\n`Read Encryption Key Size` type of `HCI_CMD` packet\n(Command Opcode: 0x1408) to the controller to inquire the length of\nencryption key.After receiving this packet, the controller immediately\nreplies with a Command Completepacket (Event Code: 0x0e) to return the\nEncryption Key Size.\n\n2. In our fuzz test case, the timing of the controller's response to this\npacket was delayed to an unexpected point: after the RFCOMM and L2CAP\nlayers had disconnected but before the HCI layer had disconnected.\n\n3. After receiving the Encryption Key Size Response at the time described\nin point 2, the host still called the rfcomm_check_security function.\nHowever, by this time `struct l2cap_conn *conn = l2cap_pi(sk)-\u003echan-\u003econn;`\nhad already been released, and when the function executed\n`return hci_conn_security(conn-\u003ehcon, d-\u003esec_level, auth_type, d-\u003eout);`,\nspecifically when accessing `conn-\u003ehcon`, a null-ptr-deref error occurred.\n\nTo fix this bug, check if `sk-\u003esk_state` is BT_CLOSED before calling\nrfcomm_recv_frame in rfcomm_process_rx.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b72bfc2-7fa0-4a6f-be90-caeb3c2bd10c",
      "id": "CVE-2024-26960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: swap: fix race between free_swap_and_cache() and swapoff()\n\nThere was previously a theoretical window where swapoff() could run and\nteardown a swap_info_struct while a call to free_swap_and_cache() was\nrunning in another thread.  This could cause, amongst other bad\npossibilities, swap_page_trans_huge_swapped() (called by\nfree_swap_and_cache()) to access the freed memory for swap_map.\n\nThis is a theoretical problem and I haven't been able to provoke it from a\ntest case.  But there has been agreement based on code review that this is\npossible (see link below).\n\nFix it by using get_swap_device()/put_swap_device(), which will stall\nswapoff().  There was an extra check in _swap_info_get() to confirm that\nthe swap entry was not free.  This isn't present in get_swap_device()\nbecause it doesn't make sense in general due to the race between getting\nthe reference and swapoff.  So I've added an equivalent check directly in\nfree_swap_and_cache().\n\nDetails of how to provoke one possible issue (thanks to David Hildenbrand\nfor deriving this):\n\n--8\u003c-----\n\n__swap_entry_free() might be the last user and result in\n\"count == SWAP_HAS_CACHE\".\n\nswapoff-\u003etry_to_unuse() will stop as soon as soon as si-\u003einuse_pages==0.\n\nSo the question is: could someone reclaim the folio and turn\nsi-\u003einuse_pages==0, before we completed swap_page_trans_huge_swapped().\n\nImagine the following: 2 MiB folio in the swapcache. Only 2 subpages are\nstill references by swap entries.\n\nProcess 1 still references subpage 0 via swap entry.\nProcess 2 still references subpage 1 via swap entry.\n\nProcess 1 quits. Calls free_swap_and_cache().\n-\u003e count == SWAP_HAS_CACHE\n[then, preempted in the hypervisor etc.]\n\nProcess 2 quits. Calls free_swap_and_cache().\n-\u003e count == SWAP_HAS_CACHE\n\nProcess 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls\n__try_to_reclaim_swap().\n\n__try_to_reclaim_swap()-\u003efolio_free_swap()-\u003edelete_from_swap_cache()-\u003e\nput_swap_folio()-\u003efree_swap_slot()-\u003eswapcache_free_entries()-\u003e\nswap_entry_free()-\u003eswap_range_free()-\u003e\n...\nWRITE_ONCE(si-\u003einuse_pages, si-\u003einuse_pages - nr_entries);\n\nWhat stops swapoff to succeed after process 2 reclaimed the swap cache\nbut before process1 finished its call to swap_page_trans_huge_swapped()?\n\n--8\u003c-----",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15c365a1-28b2-474c-914e-d95dcf38bb06",
      "id": "CVE-2024-27025",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: null check for nla_nest_start\n\nnla_nest_start() may fail and return NULL. Insert a check and set errno\nbased on other call sites within the same source code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b9e5d4e-a179-4b57-b098-d3fc35715eae",
      "id": "CVE-2024-27059",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: usb-storage: Prevent divide-by-0 error in isd200_ata_command\n\nThe isd200 sub-driver in usb-storage uses the HEADS and SECTORS values\nin the ATA ID information to calculate cylinder and head values when\ncreating a CDB for READ or WRITE commands.  The calculation involves\ndivision and modulus operations, which will cause a crash if either of\nthese values is 0.  While this never happens with a genuine device, it\ncould happen with a flawed or subversive emulation, as reported by the\nsyzbot fuzzer.\n\nProtect against this possibility by refusing to bind to the device if\neither the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID\ninformation is 0.  This requires isd200_Initialization() to return a\nnegative error code when initialization fails; currently it always\nreturns 0 (even when there is an error).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1b12ed2-b170-43f1-8f14-27974d827be0",
      "id": "CVE-2024-35247",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: region: add owner module and take its refcount\n\nThe current implementation of the fpga region assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module's refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the region\nduring programming if the parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_region\nstruct and use it to take the module's refcount. Modify the functions for\nregistering a region to take an additional owner module parameter and\nrename them to avoid conflicts. Use the old function names for helper\nmacros that automatically set the module that registers the region as the\nowner. This ensures compatibility with existing low-level control modules\nand reduces the chances of registering a region without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga region.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ff17b76-68a4-4386-8681-379e480128da",
      "id": "CVE-2024-35852",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work\n\nThe rehash delayed work is rescheduled with a delay if the number of\ncredits at end of the work is not negative as supposedly it means that\nthe migration ended. Otherwise, it is rescheduled immediately.\n\nAfter \"mlxsw: spectrum_acl_tcam: Fix possible use-after-free during\nrehash\" the above is no longer accurate as a non-negative number of\ncredits is no longer indicative of the migration being done. It can also\nhappen if the work encountered an error in which case the migration will\nresume the next time the work is scheduled.\n\nThe significance of the above is that it is possible for the work to be\npending and associated with hints that were allocated when the migration\nstarted. This leads to the hints being leaked [1] when the work is\ncanceled while pending as part of ACL region dismantle.\n\nFix by freeing the hints if hints are associated with a work that was\ncanceled while pending.\n\nBlame the original commit since the reliance on not having a pending\nwork associated with hints is fragile.\n\n[1]\nunreferenced object 0xffff88810e7c3000 (size 256):\n  comm \"kworker/0:16\", pid 176, jiffies 4295460353\n  hex dump (first 32 bytes):\n    00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80  .0......a.......\n    00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00  ..a.@...........\n  backtrace (crc 2544ddb9):\n    [\u003c00000000cf8cfab3\u003e] kmalloc_trace+0x23f/0x2a0\n    [\u003c000000004d9a1ad9\u003e] objagg_hints_get+0x42/0x390\n    [\u003c000000000b143cf3\u003e] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400\n    [\u003c0000000059bdb60a\u003e] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160\n    [\u003c00000000e81fd734\u003e] process_one_work+0x59c/0xf20\n    [\u003c00000000ceee9e81\u003e] worker_thread+0x799/0x12c0\n    [\u003c00000000bda6fe39\u003e] kthread+0x246/0x300\n    [\u003c0000000070056d23\u003e] ret_from_fork+0x34/0x70\n    [\u003c00000000dea2b93e\u003e] ret_from_fork_asm+0x1a/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9a41243-dcfa-43ad-80a6-84c32cf0448b",
      "id": "CVE-2024-35945",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: phy_device: Prevent nullptr exceptions on ISR\n\nIf phydev-\u003eirq is set unconditionally, check\nfor valid interrupt handler or fall back to polling mode to prevent\nnullptr exceptions in interrupt service routine.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ea9cd65-1d82-4424-bfc2-8d4245b61f3b",
      "id": "CVE-2022-48634",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix BUG: sleeping function called from invalid context errors\n\ngma_crtc_page_flip() was holding the event_lock spinlock while calling\ncrtc_funcs-\u003emode_set_base() which takes ww_mutex.\n\nThe only reason to hold event_lock is to clear gma_crtc-\u003epage_flip_event\non mode_set_base() errors.\n\nInstead unlock it after setting gma_crtc-\u003epage_flip_event and on\nerrors re-take the lock and clear gma_crtc-\u003epage_flip_event it\nit is still set.\n\nThis fixes the following WARN/stacktrace:\n\n[  512.122953] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:870\n[  512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, name: gnome-shell\n[  512.123031] preempt_count: 1, expected: 0\n[  512.123048] RCU nest depth: 0, expected: 0\n[  512.123066] INFO: lockdep is turned off.\n[  512.123080] irq event stamp: 0\n[  512.123094] hardirqs last  enabled at (0): [\u003c0000000000000000\u003e] 0x0\n[  512.123134] hardirqs last disabled at (0): [\u003cffffffff8d0ec28c\u003e] copy_process+0x9fc/0x1de0\n[  512.123176] softirqs last  enabled at (0): [\u003cffffffff8d0ec28c\u003e] copy_process+0x9fc/0x1de0\n[  512.123207] softirqs last disabled at (0): [\u003c0000000000000000\u003e] 0x0\n[  512.123233] Preemption disabled at:\n[  512.123241] [\u003c0000000000000000\u003e] 0x0\n[  512.123275] CPU: 3 PID: 1253 Comm: gnome-shell Tainted: G        W         5.19.0+ #1\n[  512.123304] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[  512.123323] Call Trace:\n[  512.123346]  \u003cTASK\u003e\n[  512.123370]  dump_stack_lvl+0x5b/0x77\n[  512.123412]  __might_resched.cold+0xff/0x13a\n[  512.123458]  ww_mutex_lock+0x1e/0xa0\n[  512.123495]  psb_gem_pin+0x2c/0x150 [gma500_gfx]\n[  512.123601]  gma_pipe_set_base+0x76/0x240 [gma500_gfx]\n[  512.123708]  gma_crtc_page_flip+0x95/0x130 [gma500_gfx]\n[  512.123808]  drm_mode_page_flip_ioctl+0x57d/0x5d0\n[  512.123897]  ? drm_mode_cursor2_ioctl+0x10/0x10\n[  512.123936]  drm_ioctl_kernel+0xa1/0x150\n[  512.123984]  drm_ioctl+0x21f/0x420\n[  512.124025]  ? drm_mode_cursor2_ioctl+0x10/0x10\n[  512.124070]  ? rcu_read_lock_bh_held+0xb/0x60\n[  512.124104]  ? lock_release+0x1ef/0x2d0\n[  512.124161]  __x64_sys_ioctl+0x8d/0xd0\n[  512.124203]  do_syscall_64+0x58/0x80\n[  512.124239]  ? do_syscall_64+0x67/0x80\n[  512.124267]  ? trace_hardirqs_on_prepare+0x55/0xe0\n[  512.124300]  ? do_syscall_64+0x67/0x80\n[  512.124340]  ? rcu_read_lock_sched_held+0x10/0x80\n[  512.124377]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  512.124411] RIP: 0033:0x7fcc4a70740f\n[  512.124442] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 \u003c89\u003e c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00\n[  512.124470] RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n[  512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f\n[  512.124524] RDX: 00007ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009\n[  512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034\n[  512.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0\n[  512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0\n[  512.124647]  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93c4a009-1f36-4ade-b079-7046e1c93926",
      "id": "CVE-2024-36481",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/probes: fix error check in parse_btf_field()\n\nbtf_find_struct_member() might return NULL or an error via the\nERR_PTR() macro. However, its caller in parse_btf_field() only checks\nfor the NULL condition. Fix this by using IS_ERR() and returning the\nerror up the stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "911d8017-63dc-413f-9fb2-5859057337f5",
      "id": "CVE-2021-46938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm rq: fix double free of blk_mq_tag_set in dev remove after table load fails\n\nWhen loading a device-mapper table for a request-based mapped device,\nand the allocation/initialization of the blk_mq_tag_set for the device\nfails, a following device remove will cause a double free.\n\nE.g. (dmesg):\n  device-mapper: core: Cannot initialize queue for request-based dm-mq mapped device\n  device-mapper: ioctl: unable to set up device queue for new table.\n  Unable to handle kernel pointer dereference in virtual kernel address space\n  Failing address: 0305e098835de000 TEID: 0305e098835de803\n  Fault in home space mode while using kernel ASCE.\n  AS:000000025efe0007 R3:0000000000000024\n  Oops: 0038 ilc:3 [#1] SMP\n  Modules linked in: ... lots of modules ...\n  Supported: Yes, External\n  CPU: 0 PID: 7348 Comm: multipathd Kdump: loaded Tainted: G        W      X    5.3.18-53-default #1 SLE15-SP3\n  Hardware name: IBM 8561 T01 7I2 (LPAR)\n  Krnl PSW : 0704e00180000000 000000025e368eca (kfree+0x42/0x330)\n             R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\n  Krnl GPRS: 000000000000004a 000000025efe5230 c1773200d779968d 0000000000000000\n             000000025e520270 000000025e8d1b40 0000000000000003 00000007aae10000\n             000000025e5202a2 0000000000000001 c1773200d779968d 0305e098835de640\n             00000007a8170000 000003ff80138650 000000025e5202a2 000003e00396faa8\n  Krnl Code: 000000025e368eb8: c4180041e100       lgrl    %r1,25eba50b8\n             000000025e368ebe: ecba06b93a55       risbg   %r11,%r10,6,185,58\n            #000000025e368ec4: e3b010000008       ag      %r11,0(%r1)\n            \u003e000000025e368eca: e310b0080004       lg      %r1,8(%r11)\n             000000025e368ed0: a7110001           tmll    %r1,1\n             000000025e368ed4: a7740129           brc     7,25e369126\n             000000025e368ed8: e320b0080004       lg      %r2,8(%r11)\n             000000025e368ede: b904001b           lgr     %r1,%r11\n  Call Trace:\n   [\u003c000000025e368eca\u003e] kfree+0x42/0x330\n   [\u003c000000025e5202a2\u003e] blk_mq_free_tag_set+0x72/0xb8\n   [\u003c000003ff801316a8\u003e] dm_mq_cleanup_mapped_device+0x38/0x50 [dm_mod]\n   [\u003c000003ff80120082\u003e] free_dev+0x52/0xd0 [dm_mod]\n   [\u003c000003ff801233f0\u003e] __dm_destroy+0x150/0x1d0 [dm_mod]\n   [\u003c000003ff8012bb9a\u003e] dev_remove+0x162/0x1c0 [dm_mod]\n   [\u003c000003ff8012a988\u003e] ctl_ioctl+0x198/0x478 [dm_mod]\n   [\u003c000003ff8012ac8a\u003e] dm_ctl_ioctl+0x22/0x38 [dm_mod]\n   [\u003c000000025e3b11ee\u003e] ksys_ioctl+0xbe/0xe0\n   [\u003c000000025e3b127a\u003e] __s390x_sys_ioctl+0x2a/0x40\n   [\u003c000000025e8c15ac\u003e] system_call+0xd8/0x2c8\n  Last Breaking-Event-Address:\n   [\u003c000000025e52029c\u003e] blk_mq_free_tag_set+0x6c/0xb8\n  Kernel panic - not syncing: Fatal exception: panic_on_oops\n\nWhen allocation/initialization of the blk_mq_tag_set fails in\ndm_mq_init_request_queue(), it is uninitialized/freed, but the pointer\nis not reset to NULL; so when dev_remove() later gets into\ndm_mq_cleanup_mapped_device() it sees the pointer and tries to\nuninitialize and free it again.\n\nFix this by setting the pointer to NULL in dm_mq_init_request_queue()\nerror-handling. Also set it to NULL in dm_mq_cleanup_mapped_device().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "061eeda7-d74b-4c11-84a2-9c6274a2f6b1",
      "id": "CVE-2024-36971",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix __dst_negative_advice() race\n\n__dst_negative_advice() does not enforce proper RCU rules when\nsk-\u003edst_cache must be cleared, leading to possible UAF.\n\nRCU rules are that we must first clear sk-\u003esk_dst_cache,\nthen call dst_release(old_dst).\n\nNote that sk_dst_reset(sk) is implementing this protocol correctly,\nwhile __dst_negative_advice() uses the wrong order.\n\nGiven that ip6_negative_advice() has special logic\nagainst RTF_CACHE, this means each of the three -\u003enegative_advice()\nexisting methods must perform the sk_dst_reset() themselves.\n\nNote the check against NULL dst is centralized in\n__dst_negative_advice(), there is no need to duplicate\nit in various callbacks.\n\nMany thanks to Clement Lecigne for tracking this issue.\n\nThis old bug became visible after the blamed commit, using UDP sockets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc6b8402-8cbb-46fa-934c-639082859e79",
      "id": "CVE-2024-38615",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: exit() callback is optional\n\nThe exit() callback is optional and shouldn't be called without checking\na valid pointer first.\n\nAlso, we must clear freq_table pointer even if the exit() callback isn't\npresent.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0d6dfcb-009c-494d-a678-d7cd4a47cb66",
      "id": "CVE-2024-39480",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkdb: Fix buffer overflow during tab-complete\n\nCurrently, when the user attempts symbol completion with the Tab key, kdb\nwill use strncpy() to insert the completed symbol into the command buffer.\nUnfortunately it passes the size of the source buffer rather than the\ndestination to strncpy() with predictably horrible results. Most obviously\nif the command buffer is already full but cp, the cursor position, is in\nthe middle of the buffer, then we will write past the end of the supplied\nbuffer.\n\nFix this by replacing the dubious strncpy() calls with memmove()/memcpy()\ncalls plus explicit boundary checks to make sure we have enough space\nbefore we start moving characters around.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e11ce836-15b1-4a94-a548-ce1ca97cfbbb",
      "id": "CVE-2024-40966",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: add the option to have a tty reject a new ldisc\n\n... and use it to limit the virtual terminals to just N_TTY.  They are\nkind of special, and in particular, the \"con_write()\" routine violates\nthe \"writes cannot sleep\" rule that some ldiscs rely on.\n\nThis avoids the\n\n   BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659\n\nwhen N_GSM has been attached to a virtual console, and gsmld_write()\ncalls con_write() while holding a spinlock, and con_write() then tries\nto get the console lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "168ea6a0-a80e-4950-bb00-5b0d7a7dca7c",
      "id": "CVE-2024-40977",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921s: fix potential hung tasks during chip recovery\n\nDuring chip recovery (e.g. chip reset), there is a possible situation that\nkernel worker reset_work is holding the lock and waiting for kernel thread\nstat_worker to be parked, while stat_worker is waiting for the release of\nthe same lock.\nIt causes a deadlock resulting in the dumping of hung tasks messages and\npossible rebooting of the device.\n\nThis patch prevents the execution of stat_worker during the chip recovery.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92d1b6b3-4519-4712-a81b-7d0c7f3daf17",
      "id": "CVE-2024-49934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name\n\nIt's observed that a crash occurs during hot-remove a memory device,\nin which user is accessing the hugetlb. See calltrace as following:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790\nModules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s\nmirror dm_region_hash dm_log dm_mod\nCPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:do_user_addr_fault+0x2a0/0x790\nCode: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff \u003c0f\u003e 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41\nRSP: 0000:ffffc90000a575f0 EFLAGS: 00010046\nRAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658\nR13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000\nFS:  00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? __warn+0x8d/0x190\n ? do_user_addr_fault+0x2a0/0x790\n ? report_bug+0x1c3/0x1d0\n ? handle_bug+0x3c/0x70\n ? exc_invalid_op+0x14/0x70\n ? asm_exc_invalid_op+0x16/0x20\n ? do_user_addr_fault+0x2a0/0x790\n ? exc_page_fault+0x31/0x200\n exc_page_fault+0x68/0x200\n\u003c...snip...\u003e\nBUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n ---[ end trace 0000000000000000 ]---\n BUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G        W          6.10.0-rc2-lizhijian+ #492\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:dentry_name+0x1f4/0x440\n\u003c...snip...\u003e\n? dentry_name+0x2fa/0x440\nvsnprintf+0x1f3/0x4f0\nvprintk_store+0x23a/0x540\nvprintk_emit+0x6d/0x330\n_printk+0x58/0x80\ndump_mapping+0x10b/0x1a0\n? __pfx_free_object_rcu+0x10/0x10\n__dump_page+0x26b/0x3e0\n? vprintk_emit+0xe0/0x330\n? _printk+0x58/0x80\n? dump_page+0x17/0x50\ndump_page+0x17/0x50\ndo_migrate_range+0x2f7/0x7f0\n? do_migrate_range+0x42/0x7f0\n? offline_pages+0x2f4/0x8c0\noffline_pages+0x60a/0x8c0\nmemory_subsys_offline+0x9f/0x1c0\n? lockdep_hardirqs_on+0x77/0x100\n? _raw_spin_unlock_irqrestore+0x38/0x60\ndevice_offline+0xe3/0x110\nstate_store+0x6e/0xc0\nkernfs_fop_write_iter+0x143/0x200\nvfs_write+0x39f/0x560\nksys_write+0x65/0xf0\ndo_syscall_64+0x62/0x130\n\nPreviously, some sanity check have been done in dump_mapping() before\nthe print facility parsing '%pd' though, it's still possible to run into\nan invalid dentry.d_name.name.\n\nSince dump_mapping() only needs to dump the filename only, retrieve it\nby itself in a safer way to prevent an unnecessary crash.\n\nNote that either retrieving the filename with '%pd' or\nstrncpy_from_kernel_nofault(), the filename could be unreliable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0cbd2836-20ff-4149-b76a-bceb4dc043b1",
      "id": "CVE-2024-50015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: dax: fix overflowing extents beyond inode size when partially writing\n\nThe dax_iomap_rw() does two things in each iteration: map written blocks\nand copy user data to blocks. If the process is killed by user(See signal\nhandling in dax_iomap_iter()), the copied data will be returned and added\non inode size, which means that the length of written extents may exceed\nthe inode size, then fsck will fail. An example is given as:\n\ndd if=/dev/urandom of=file bs=4M count=1\n dax_iomap_rw\n  iomap_iter // round 1\n   ext4_iomap_begin\n    ext4_iomap_alloc // allocate 0~2M extents(written flag)\n  dax_iomap_iter // copy 2M data\n  iomap_iter // round 2\n   iomap_iter_advance\n    iter-\u003epos += iter-\u003eprocessed // iter-\u003epos = 2M\n   ext4_iomap_begin\n    ext4_iomap_alloc // allocate 2~4M extents(written flag)\n  dax_iomap_iter\n   fatal_signal_pending\n  done = iter-\u003epos - iocb-\u003eki_pos // done = 2M\n ext4_handle_inode_extension\n  ext4_update_inode_size // inode size = 2M\n\nfsck reports: Inode 13, i_size is 2097152, should be 4194304.  Fix?\n\nFix the problem by truncating extents if the written length is smaller\nthan expected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01591229-d74f-48c6-b051-aa4afca97ef9",
      "id": "CVE-2022-1012",
      "description": "A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0a93525-1fa3-47d6-a2d3-ee285eb97bc2",
      "id": "CVE-2024-41008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: change vm-\u003etask_info handling\n\nThis patch changes the handling and lifecycle of vm-\u003etask_info object.\nThe major changes are:\n- vm-\u003etask_info is a dynamically allocated ptr now, and its uasge is\n  reference counted.\n- introducing two new helper funcs for task_info lifecycle management\n    - amdgpu_vm_get_task_info: reference counts up task_info before\n      returning this info\n    - amdgpu_vm_put_task_info: reference counts down task_info\n- last put to task_info() frees task_info from the vm.\n\nThis patch also does logistical changes required for existing usage\nof vm-\u003etask_info.\n\nV2: Do not block all the prints when task_info not found (Felix)\n\nV3: Fixed review comments from Felix\n   - Fix wrong indentation\n   - No debug message for -ENOMEM\n   - Add NULL check for task_info\n   - Do not duplicate the debug messages (ti vs no ti)\n   - Get first reference of task_info in vm_init(), put last\n     in vm_fini()\n\nV4: Fixed review comments from Felix\n   - fix double reference increment in create_task_info\n   - change amdgpu_vm_get_task_info_pasid\n   - additional changes in amdgpu_gem.c while porting",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc97d05c-7da2-474e-b4a2-e93eb0339eb2",
      "id": "CVE-2024-41041",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().\n\nsyzkaller triggered the warning [0] in udp_v4_early_demux().\n\nIn udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount\nof the looked-up sk and use sock_pfree() as skb-\u003edestructor, so we check\nSOCK_RCU_FREE to ensure that the sk is safe to access during the RCU grace\nperiod.\n\nCurrently, SOCK_RCU_FREE is flagged for a bound socket after being put\ninto the hash table.  Moreover, the SOCK_RCU_FREE check is done too early\nin udp_v[46]_early_demux() and sk_lookup(), so there could be a small race\nwindow:\n\n  CPU1                                 CPU2\n  ----                                 ----\n  udp_v4_early_demux()                 udp_lib_get_port()\n  |                                    |- hlist_add_head_rcu()\n  |- sk = __udp4_lib_demux_lookup()    |\n  |- DEBUG_NET_WARN_ON_ONCE(sk_is_refcounted(sk));\n                                       `- sock_set_flag(sk, SOCK_RCU_FREE)\n\nWe had the same bug in TCP and fixed it in commit 871019b22d1b (\"net:\nset SOCK_RCU_FREE before inserting socket into hashtable\").\n\nLet's apply the same fix for UDP.\n\n[0]:\nWARNING: CPU: 0 PID: 11198 at net/ipv4/udp.c:2599 udp_v4_early_demux+0x481/0xb70 net/ipv4/udp.c:2599\nModules linked in:\nCPU: 0 PID: 11198 Comm: syz-executor.1 Not tainted 6.9.0-g93bda33046e7 #13\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:udp_v4_early_demux+0x481/0xb70 net/ipv4/udp.c:2599\nCode: c5 7a 15 fe bb 01 00 00 00 44 89 e9 31 ff d3 e3 81 e3 bf ef ff ff 89 de e8 2c 74 15 fe 85 db 0f 85 02 06 00 00 e8 9f 7a 15 fe \u003c0f\u003e 0b e8 98 7a 15 fe 49 8d 7e 60 e8 4f 39 2f fe 49 c7 46 60 20 52\nRSP: 0018:ffffc9000ce3fa58 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8318c92c\nRDX: ffff888036ccde00 RSI: ffffffff8318c2f1 RDI: 0000000000000001\nRBP: ffff88805a2dd6e0 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0001ffffffffffff R12: ffff88805a2dd680\nR13: 0000000000000007 R14: ffff88800923f900 R15: ffff88805456004e\nFS:  00007fc449127640(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fc449126e38 CR3: 000000003de4b002 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ip_rcv_finish_core.constprop.0+0xbdd/0xd20 net/ipv4/ip_input.c:349\n ip_rcv_finish+0xda/0x150 net/ipv4/ip_input.c:447\n NF_HOOK include/linux/netfilter.h:314 [inline]\n NF_HOOK include/linux/netfilter.h:308 [inline]\n ip_rcv+0x16c/0x180 net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0xb3/0xe0 net/core/dev.c:5624\n __netif_receive_skb+0x21/0xd0 net/core/dev.c:5738\n netif_receive_skb_internal net/core/dev.c:5824 [inline]\n netif_receive_skb+0x271/0x300 net/core/dev.c:5884\n tun_rx_batched drivers/net/tun.c:1549 [inline]\n tun_get_user+0x24db/0x2c50 drivers/net/tun.c:2002\n tun_chr_write_iter+0x107/0x1a0 drivers/net/tun.c:2048\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0x76f/0x8d0 fs/read_write.c:590\n ksys_write+0xbf/0x190 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0x41/0x50 fs/read_write.c:652\n x64_sys_call+0xe66/0x1990 arch/x86/include/generated/asm/syscalls_64.h:2\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x4b/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\nRIP: 0033:0x7fc44a68bc1f\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 e9 cf f5 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 3c d0 f5 ff 48\nRSP: 002b:00007fc449126c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00000000004bc050 RCX: 00007fc44a68bc1f\nR\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16fdb122-2e5e-4c52-9efa-d888a09edf41",
      "id": "CVE-2024-42128",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: an30259a: Use devm_mutex_init() for mutex initialization\n\nIn this driver LEDs are registered using devm_led_classdev_register()\nso they are automatically unregistered after module's remove() is done.\nled_classdev_unregister() calls module's led_set_brightness() to turn off\nthe LEDs and that callback uses mutex which was destroyed already\nin module's remove() so use devm API instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4749c597-394a-46d7-8463-1a5bb49f641f",
      "id": "CVE-2024-43854",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: initialize integrity buffer to zero before writing it to media\n\nMetadata added by bio_integrity_prep is using plain kmalloc, which leads\nto random kernel memory being written media.  For PI metadata this is\nlimited to the app tag that isn't used by kernel generated metadata,\nbut for non-PI metadata the entire buffer leaks kernel memory.\n\nFix this by adding the __GFP_ZERO flag to allocations for writes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa59263f-d4ae-457c-8b75-b2a8b61f3243",
      "id": "CVE-2024-44958",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/smt: Fix unbalance sched_smt_present dec/inc\n\nI got the following warn report while doing stress test:\n\njump label: negative count!\nWARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0\nCall Trace:\n \u003cTASK\u003e\n __static_key_slow_dec_cpuslocked+0x16/0x70\n sched_cpu_deactivate+0x26e/0x2a0\n cpuhp_invoke_callback+0x3ad/0x10d0\n cpuhp_thread_fun+0x3f5/0x680\n smpboot_thread_fn+0x56d/0x8d0\n kthread+0x309/0x400\n ret_from_fork+0x41/0x70\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e\n\nBecause when cpuset_cpu_inactive() fails in sched_cpu_deactivate(),\nthe cpu offline failed, but sched_smt_present is decremented before\ncalling sched_cpu_deactivate(), it leads to unbalanced dec/inc, so\nfix it by incrementing sched_smt_present in the error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84b4e387-78d8-4439-b66f-4515a262af1d",
      "id": "CVE-2024-46729",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix incorrect size calculation for loop\n\n[WHY]\nfe_clk_en has size of 5 but sizeof(fe_clk_en) has byte size 20 which is\nlager than the array size.\n\n[HOW]\nDivide byte size 20 by its element size.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "869c392c-f3fd-42c0-8e45-24e45ca6406d",
      "id": "CVE-2024-46780",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: protect references to superblock parameters exposed in sysfs\n\nThe superblock buffers of nilfs2 can not only be overwritten at runtime\nfor modifications/repairs, but they are also regularly swapped, replaced\nduring resizing, and even abandoned when degrading to one side due to\nbacking device issues.  So, accessing them requires mutual exclusion using\nthe reader/writer semaphore \"nilfs-\u003ens_sem\".\n\nSome sysfs attribute show methods read this superblock buffer without the\nnecessary mutual exclusion, which can cause problems with pointer\ndereferencing and memory access, so fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4f0ae07-4837-4eed-94ee-018f440fc46d",
      "id": "CVE-2024-46781",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix missing cleanup on rollforward recovery error\n\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\n\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\n\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "18784839-153c-46ee-82a0-cc4332885ff3",
      "id": "CVE-2024-49938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit\n\nSyzbot points out that skb_trim() has a sanity check on the existing length of\nthe skb, which can be uninitialised in some error paths. The intent here is\nclearly just to reset the length to zero before resubmitting, so switch to\ncalling __skb_set_length(skb, 0) directly. In addition, __skb_set_length()\nalready contains a call to skb_reset_tail_pointer(), so remove the redundant\ncall.\n\nThe syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar\nusage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ffcbbceb-a542-4e41-ba56-fb068c3813c4",
      "id": "CVE-2024-49966",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: cancel dqi_sync_work before freeing oinfo\n\nocfs2_global_read_info() will initialize and schedule dqi_sync_work at the\nend, if error occurs after successfully reading global quota, it will\ntrigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:\n\nODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c\n\nThis reports that there is an active delayed work when freeing oinfo in\nerror handling, so cancel dqi_sync_work first.  BTW, return status instead\nof -1 when .read_file_info fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "acda50d7-07c1-4447-a43f-1919d6879ddd",
      "id": "CVE-2024-49988",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add refcnt to ksmbd_conn struct\n\nWhen sending an oplock break request, opinfo-\u003econn is used,\nBut freed -\u003econn can be used on multichannel.\nThis patch add a reference count to the ksmbd_conn struct\nso that it can be freed when it is no longer used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d16b4d48-806a-4e1c-9bc2-a4bf31ba028b",
      "id": "CVE-2024-49990",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hdcp: Check GSC structure validity\n\nSometimes xe_gsc is not initialized when checked at HDCP capability\ncheck. Add gsc structure check to avoid null pointer error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8236a204-4221-4a6e-ba1c-892695a98b6f",
      "id": "CVE-2022-1263",
      "description": "A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b26e1ddc-f4a9-42c7-911d-2b00e12e80df",
      "id": "CVE-2024-50036",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not delay dst_entries_add() in dst_release()\n\ndst_entries_add() uses per-cpu data that might be freed at netns\ndismantle from ip6_route_net_exit() calling dst_entries_destroy()\n\nBefore ip6_route_net_exit() can be called, we release all\nthe dsts associated with this netns, via calls to dst_release(),\nwhich waits an rcu grace period before calling dst_destroy()\n\ndst_entries_add() use in dst_destroy() is racy, because\ndst_entries_destroy() could have been called already.\n\nDecrementing the number of dsts must happen sooner.\n\nNotes:\n\n1) in CONFIG_XFRM case, dst_destroy() can call\n   dst_release_immediate(child), this might also cause UAF\n   if the child does not have DST_NOCOUNT set.\n   IPSEC maintainers might take a look and see how to address this.\n\n2) There is also discussion about removing this count of dst,\n   which might happen in future kernels.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0661590c-6919-4352-9783-3c765fe649fe",
      "id": "CVE-2024-53121",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, lock FTE when checking if active\n\nThe referenced commits introduced a two-step process for deleting FTEs:\n\n- Lock the FTE, delete it from hardware, set the hardware deletion function\n  to NULL and unlock the FTE.\n- Lock the parent flow group, delete the software copy of the FTE, and\n  remove it from the xarray.\n\nHowever, this approach encounters a race condition if a rule with the same\nmatch value is added simultaneously. In this scenario, fs_core may set the\nhardware deletion function to NULL prematurely, causing a panic during\nsubsequent rule deletions.\n\nTo prevent this, ensure the active flag of the FTE is checked under a lock,\nwhich will prevent the fs_core layer from attaching a new steering rule to\nan FTE that is in the process of deletion.\n\n[  438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func\n[  438.968205] ------------[ cut here ]------------\n[  438.968654] refcount_t: decrement hit 0; leaking memory.\n[  438.969249] WARNING: CPU: 0 PID: 8957 at lib/refcount.c:31 refcount_warn_saturate+0xfb/0x110\n[  438.970054] Modules linked in: act_mirred cls_flower act_gact sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core zram zsmalloc fuse [last unloaded: cls_flower]\n[  438.973288] CPU: 0 UID: 0 PID: 8957 Comm: tc Not tainted 6.12.0-rc1+ #8\n[  438.973888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[  438.974874] RIP: 0010:refcount_warn_saturate+0xfb/0x110\n[  438.975363] Code: 40 66 3b 82 c6 05 16 e9 4d 01 01 e8 1f 7c a0 ff 0f 0b c3 cc cc cc cc 48 c7 c7 10 66 3b 82 c6 05 fd e8 4d 01 01 e8 05 7c a0 ff \u003c0f\u003e 0b c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90\n[  438.976947] RSP: 0018:ffff888124a53610 EFLAGS: 00010286\n[  438.977446] RAX: 0000000000000000 RBX: ffff888119d56de0 RCX: 0000000000000000\n[  438.978090] RDX: ffff88852c828700 RSI: ffff88852c81b3c0 RDI: ffff88852c81b3c0\n[  438.978721] RBP: ffff888120fa0e88 R08: 0000000000000000 R09: ffff888124a534b0\n[  438.979353] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888119d56de0\n[  438.979979] R13: ffff888120fa0ec0 R14: ffff888120fa0ee8 R15: ffff888119d56de0\n[  438.980607] FS:  00007fe6dcc0f800(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000\n[  438.983984] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  438.984544] CR2: 00000000004275e0 CR3: 0000000186982001 CR4: 0000000000372eb0\n[  438.985205] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  438.985842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  438.986507] Call Trace:\n[  438.986799]  \u003cTASK\u003e\n[  438.987070]  ? __warn+0x7d/0x110\n[  438.987426]  ? refcount_warn_saturate+0xfb/0x110\n[  438.987877]  ? report_bug+0x17d/0x190\n[  438.988261]  ? prb_read_valid+0x17/0x20\n[  438.988659]  ? handle_bug+0x53/0x90\n[  438.989054]  ? exc_invalid_op+0x14/0x70\n[  438.989458]  ? asm_exc_invalid_op+0x16/0x20\n[  438.989883]  ? refcount_warn_saturate+0xfb/0x110\n[  438.990348]  mlx5_del_flow_rules+0x2f7/0x340 [mlx5_core]\n[  438.990932]  __mlx5_eswitch_del_rule+0x49/0x170 [mlx5_core]\n[  438.991519]  ? mlx5_lag_is_sriov+0x3c/0x50 [mlx5_core]\n[  438.992054]  ? xas_load+0x9/0xb0\n[  438.992407]  mlx5e_tc_rule_unoffload+0x45/0xe0 [mlx5_core]\n[  438.993037]  mlx5e_tc_del_fdb_flow+0x2a6/0x2e0 [mlx5_core]\n[  438.993623]  mlx5e_flow_put+0x29/0x60 [mlx5_core]\n[  438.994161]  mlx5e_delete_flower+0x261/0x390 [mlx5_core]\n[  438.994728]  tc_setup_cb_destroy+0xb9/0x190\n[  438.995150]  fl_hw_destroy_filter+0x94/0xc0 [cls_flower]\n[  438.995650]  fl_change+0x11a4/0x13c0 [cls_flower]\n[  438.996105]  tc_new_tfilter+0x347/0xbc0\n[  438.996503]  ? __\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0abce6a9-efe5-4194-98c6-b44fa0cfd614",
      "id": "CVE-2024-56602",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\n\nClear the sk pointer in the sock object on error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cee28d95-deb5-41cb-a407-f17ca2c8227f",
      "id": "CVE-2024-56659",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lapb: increase LAPB_HEADER_LEN\n\nIt is unclear if net/lapb code is supposed to be ready for 8021q.\n\nWe can at least avoid crashes like the following :\n\nskbuff: skb_under_panic: text:ffffffff8aabe1f6 len:24 put:20 head:ffff88802824a400 data:ffff88802824a3fe tail:0x16 end:0x140 dev:nr0.2\n------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 UID: 0 PID: 5508 Comm: dhcpcd Not tainted 6.12.0-rc7-syzkaller-00144-g66418447d27b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0d 8d 48 c7 c6 2e 9e 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 1a 6f 37 02 48 83 c4 20 90 \u003c0f\u003e 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc90002ddf638 EFLAGS: 00010282\nRAX: 0000000000000086 RBX: dffffc0000000000 RCX: 7a24750e538ff600\nRDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000\nRBP: ffff888034a86650 R08: ffffffff8174b13c R09: 1ffff920005bbe60\nR10: dffffc0000000000 R11: fffff520005bbe61 R12: 0000000000000140\nR13: ffff88802824a400 R14: ffff88802824a3fe R15: 0000000000000016\nFS:  00007f2a5990d740(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c2631fd CR3: 0000000029504000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  nr_header+0x36/0x320 net/netrom/nr_dev.c:69\n  dev_hard_header include/linux/netdevice.h:3148 [inline]\n  vlan_dev_hard_header+0x359/0x480 net/8021q/vlan_dev.c:83\n  dev_hard_header include/linux/netdevice.h:3148 [inline]\n  lapbeth_data_transmit+0x1f6/0x2a0 drivers/net/wan/lapbether.c:257\n  lapb_data_transmit+0x91/0xb0 net/lapb/lapb_iface.c:447\n  lapb_transmit_buffer+0x168/0x1f0 net/lapb/lapb_out.c:149\n lapb_establish_data_link+0x84/0xd0\n lapb_device_event+0x4e0/0x670\n  notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n __dev_notify_flags+0x207/0x400\n  dev_change_flags+0xf0/0x1a0 net/core/dev.c:8922\n  devinet_ioctl+0xa4e/0x1aa0 net/ipv4/devinet.c:1188\n  inet_ioctl+0x3d7/0x4f0 net/ipv4/af_inet.c:1003\n  sock_do_ioctl+0x158/0x460 net/socket.c:1227\n  sock_ioctl+0x626/0x8e0 net/socket.c:1346\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e07171bd-721d-4600-aa75-23f235414898",
      "id": "CVE-2024-56767",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset\n\nThe at_xdmac_memset_create_desc may return NULL, which will lead to a\nnull pointer dereference. For example, the len input is error, or the\natchan-\u003efree_descs_list is empty and memory is exhausted. Therefore, add\ncheck to avoid this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fe4245ee-8392-4923-9c35-19f79388d546",
      "id": "CVE-2025-21687",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/platform: check the bounds of read/write syscalls\n\ncount and offset are passed from user space and not checked, only\noffset is capped to 40 bits, which can be used to read/write out of\nbounds of the device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "151cafb3-c241-4253-94d7-fbb06152ea13",
      "id": "CVE-2025-21697",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Ensure job pointer is set to NULL after job completion\n\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9395f3c2-d07b-4c3d-b0a0-106a2418b7b9",
      "id": "CVE-2025-21823",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Drop unmanaged ELP metric worker\n\nThe ELP worker needs to calculate new metric values for all neighbors\n\"reachable\" over an interface. Some of the used metric sources require\nlocks which might need to sleep. This sleep is incompatible with the RCU\nlist iterator used for the recorded neighbors. The initial approach to work\naround of this problem was to queue another work item per neighbor and then\nrun this in a new context.\n\nEven when this solved the RCU vs might_sleep() conflict, it has a major\nproblems: Nothing was stopping the work item in case it is not needed\nanymore - for example because one of the related interfaces was removed or\nthe batman-adv module was unloaded - resulting in potential invalid memory\naccesses.\n\nDirectly canceling the metric worker also has various problems:\n\n* cancel_work_sync for a to-be-deactivated interface is called with\n  rtnl_lock held. But the code in the ELP metric worker also tries to use\n  rtnl_lock() - which will never return in this case. This also means that\n  cancel_work_sync would never return because it is waiting for the worker\n  to finish.\n* iterating over the neighbor list for the to-be-deactivated interface is\n  currently done using the RCU specific methods. Which means that it is\n  possible to miss items when iterating over it without the associated\n  spinlock - a behaviour which is acceptable for a periodic metric check\n  but not for a cleanup routine (which must \"stop\" all still running\n  workers)\n\nThe better approch is to get rid of the per interface neighbor metric\nworker and handle everything in the interface worker. The original problems\nare solved by:\n\n* creating a list of neighbors which require new metric information inside\n  the RCU protected context, gathering the metric according to the new list\n  outside the RCU protected context\n* only use rcu_trylock inside metric gathering code to avoid a deadlock\n  when the cancel_delayed_work_sync is called in the interface removal code\n  (which is called with the rtnl_lock held)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dea5e70-2916-4b5f-aa85-f63f397bebce",
      "id": "CVE-2025-21925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: do not use skb_get() before dev_queue_xmit()\n\nsyzbot is able to crash hosts [1], using llc and devices\nnot supporting IFF_TX_SKB_SHARING.\n\nIn this case, e1000 driver calls eth_skb_pad(), while\nthe skb is shared.\n\nSimply replace skb_get() by skb_clone() in net/llc/llc_s_ac.c\n\nNote that e1000 driver might have an issue with pktgen,\nbecause it does not clear IFF_TX_SKB_SHARING, this is an\northogonal change.\n\nWe need to audit other skb_get() uses in net/llc.\n\n[1]\n\nkernel BUG at net/core/skbuff.c:2178 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 16371 Comm: syz.2.2764 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:pskb_expand_head+0x6ce/0x1240 net/core/skbuff.c:2178\nCall Trace:\n \u003cTASK\u003e\n  __skb_pad+0x18a/0x610 net/core/skbuff.c:2466\n  __skb_put_padto include/linux/skbuff.h:3843 [inline]\n  skb_put_padto include/linux/skbuff.h:3862 [inline]\n  eth_skb_pad include/linux/etherdevice.h:656 [inline]\n  e1000_xmit_frame+0x2d99/0x5800 drivers/net/ethernet/intel/e1000/e1000_main.c:3128\n  __netdev_start_xmit include/linux/netdevice.h:5151 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5160 [inline]\n  xmit_one net/core/dev.c:3806 [inline]\n  dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3822\n  sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343\n  __dev_xmit_skb net/core/dev.c:4045 [inline]\n  __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4621\n  dev_queue_xmit include/linux/netdevice.h:3313 [inline]\n  llc_sap_action_send_test_c+0x268/0x320 net/llc/llc_s_ac.c:144\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x239/0x510 net/llc/llc_sap.c:209\n  llc_ui_sendmsg+0xd0d/0x14e0 net/llc/af_llc.c:993\n  sock_sendmsg_nosec net/socket.c:718 [inline]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cfeaf8c-9c81-497e-a0e2-4cec7a0a5482",
      "id": "CVE-2025-37740",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add sanity check for agwidth in dbMount\n\nThe width in dmapctl of the AG is zero, it trigger a divide error when\ncalculating the control page level in dbAllocAG.\n\nTo avoid this issue, add a check for agwidth in dbAllocAG.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b542f6c6-cbc9-4643-a65b-362abc6021ea",
      "id": "CVE-2025-38119",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: ufs: Fix a hang in the error handler\n\nufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter\nfunction can only succeed if UFSHCD_EH_IN_PROGRESS is not set because\nresuming involves submitting a SCSI command and ufshcd_queuecommand()\nreturns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this\nhang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has\nbeen called instead of before.\n\nBacktrace:\n__switch_to+0x174/0x338\n__schedule+0x600/0x9e4\nschedule+0x7c/0xe8\nschedule_timeout+0xa4/0x1c8\nio_schedule_timeout+0x48/0x70\nwait_for_common_io+0xa8/0x160 //waiting on START_STOP\nwait_for_completion_io_timeout+0x10/0x20\nblk_execute_rq+0xe4/0x1e4\nscsi_execute_cmd+0x108/0x244\nufshcd_set_dev_pwr_mode+0xe8/0x250\n__ufshcd_wl_resume+0x94/0x354\nufshcd_wl_runtime_resume+0x3c/0x174\nscsi_runtime_resume+0x64/0xa4\nrpm_resume+0x15c/0xa1c\n__pm_runtime_resume+0x4c/0x90 // Runtime resume ongoing\nufshcd_err_handler+0x1a0/0xd08\nprocess_one_work+0x174/0x808\nworker_thread+0x15c/0x490\nkthread+0xf4/0x1ec\nret_from_fork+0x10/0x20\n\n[ bvanassche: rewrote patch description ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fe91d66-cb98-421a-a48c-a4205978b0f3",
      "id": "CVE-2025-38181",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: Fix null-ptr-deref in calipso_req_{set,del}attr().\n\nsyzkaller reported a null-ptr-deref in sock_omalloc() while allocating\na CALIPSO option.  [0]\n\nThe NULL is of struct sock, which was fetched by sk_to_full_sk() in\ncalipso_req_setattr().\n\nSince commit a1a5344ddbe8 (\"tcp: avoid two atomic ops for syncookies\"),\nreqsk-\u003ersk_listener could be NULL when SYN Cookie is returned to its\nclient, as hinted by the leading SYN Cookie log.\n\nHere are 3 options to fix the bug:\n\n  1) Return 0 in calipso_req_setattr()\n  2) Return an error in calipso_req_setattr()\n  3) Alaways set rsk_listener\n\n1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie\nfor CALIPSO.  3) is also no go as there have been many efforts to reduce\natomic ops and make TCP robust against DDoS.  See also commit 3b24d854cb35\n(\"tcp/dccp: do not touch listener sk_refcnt under synflood\").\n\nAs of the blamed commit, SYN Cookie already did not need refcounting,\nand no one has stumbled on the bug for 9 years, so no CALIPSO user will\ncare about SYN Cookie.\n\nLet's return an error in calipso_req_setattr() and calipso_req_delattr()\nin the SYN Cookie case.\n\nThis can be reproduced by [1] on Fedora and now connect() of nc times out.\n\n[0]:\nTCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies.\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\nCPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:read_pnet include/net/net_namespace.h:406 [inline]\nRIP: 0010:sock_net include/net/sock.h:655 [inline]\nRIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806\nCode: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b\nRSP: 0018:ffff88811af89038 EFLAGS: 00010216\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400\nRDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030\nRBP: 0000000000000050 R08: 0000000000000000 R09: ffff88810526640e\nR10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000\nR13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050\nFS:  00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f863ba096f4 CR3: 00000000163c0005 CR4: 0000000000770ef0\nPKRU: 80000000\nCall Trace:\n \u003cIRQ\u003e\n ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288\n calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204\n calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597\n netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249\n selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342\n selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551\n security_inet_conn_request+0x50/0xa0 security/security.c:4945\n tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825\n tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275\n tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328\n tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781\n tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667\n tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904\n ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436\n ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480\n NF_HOOK include/linux/netfilter.h:314 [inline]\n NF_HOOK include/linux/netfilter.h:308 [inline]\n ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491\n dst_input include/net/dst.h:469 [inline]\n ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]\n ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69\n NF_HOOK include/linux/netfilter.h:314 [inline]\n NF_HOOK include/linux/netf\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f68bdd5-a43e-46c1-9736-acd5680ca1c9",
      "id": "CVE-2025-38215",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var\n\nIf fb_add_videomode() in do_register_framebuffer() fails to allocate\nmemory for fb_videomode, it will later lead to a null-ptr dereference in\nfb_videomode_to_var(), as the fb_info is registered while not having the\nmode in modelist that is expected to be there, i.e. the one that is\ndescribed in fb_info-\u003evar.\n\n================================================================\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\nCall Trace:\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n================================================================\n\nEven though fbcon_init() checks beforehand if fb_match_mode() in\nvar_to_display() fails, it can not prevent the panic because fbcon_init()\ndoes not return error code. Considering this and the comment in the code\nabout fb_match_mode() returning NULL - \"This should not happen\" - it is\nbetter to prevent registering the fb_info if its mode was not set\nsuccessfully. Also move fb_add_videomode() closer to the beginning of\ndo_register_framebuffer() to avoid having to do the cleanup on fail.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74b224ff-ed33-4a54-a1aa-2fceaab771b8",
      "id": "CVE-2025-38425",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: tegra: check msg length in SMBUS block read\n\nFor SMBUS block read, do not continue to read if the message length\npassed from the device is '0' or greater than the maximum allowed bytes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2a7b063-0402-43dc-ad51-a1af4650fd9f",
      "id": "CVE-2025-38426",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Add basic validation for RAS header\n\nIf RAS header read from EEPROM is corrupted, it could result in trying\nto allocate huge memory for reading the records. Add some validation to\nheader fields.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e47bf95f-e607-4985-9c51-9e1ee3360867",
      "id": "CVE-2025-38460",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix potential null-ptr-deref in to_atmarpd().\n\natmarpd is protected by RTNL since commit f3a0592b37b8 (\"[ATM]: clip\ncauses unregister hang\").\n\nHowever, it is not enough because to_atmarpd() is called without RTNL,\nespecially clip_neigh_solicit() / neigh_ops-\u003esolicit() is unsleepable.\n\nAlso, there is no RTNL dependency around atmarpd.\n\nLet's use a private mutex and RCU to protect access to atmarpd in\nto_atmarpd().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f22c41aa-9297-4180-8f22-d99deca7e1d7",
      "id": "CVE-2025-38665",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\n\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\nrestarted from Bus Off and the driver does not implement the struct\ncan_priv::do_set_mode callback.\n\nThere are 2 code path that call struct can_priv::do_set_mode:\n- directly by a manual restart from the user space, via\n  can_changelink()\n- delayed automatic restart after bus off (deactivated by default)\n\nTo prevent the NULL pointer deference, refuse a manual restart or\nconfigure the automatic restart delay in can_changelink() and report\nthe error via extack to user space.\n\nAs an additional safety measure let can_restart() return an error if\ncan_priv::do_set_mode is not set instead of dereferencing it\nunchecked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "325cbc1b-f48a-4672-9eab-97bbd58025f9",
      "id": "CVE-2025-38699",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bfa: Double-free fix\n\nWhen the bfad_im_probe() function fails during initialization, the memory\npointed to by bfad-\u003eim is freed without setting bfad-\u003eim to NULL.\n\nSubsequently, during driver uninstallation, when the state machine enters\nthe bfad_sm_stopping state and calls the bfad_im_probe_undo() function,\nit attempts to free the memory pointed to by bfad-\u003eim again, thereby\ntriggering a double-free vulnerability.\n\nSet bfad-\u003eim to NULL if probing fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aaaedc46-5425-45a1-b2a6-8ff1d53bd073",
      "id": "CVE-2025-39748",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Forget ranges when refining tnum after JSET\n\nSyzbot reported a kernel warning due to a range invariant violation on\nthe following BPF program.\n\n  0: call bpf_get_netns_cookie\n  1: if r0 == 0 goto \u003cexit\u003e\n  2: if r0 \u0026 Oxffffffff goto \u003cexit\u003e\n\nThe issue is on the path where we fall through both jumps.\n\nThat path is unreachable at runtime: after insn 1, we know r0 != 0, but\nwith the sign extension on the jset, we would only fallthrough insn 2\nif r0 == 0. Unfortunately, is_branch_taken() isn't currently able to\nfigure this out, so the verifier walks all branches. The verifier then\nrefines the register bounds using the second condition and we end\nup with inconsistent bounds on this unreachable path:\n\n  1: if r0 == 0 goto \u003cexit\u003e\n    r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)\n  2: if r0 \u0026 0xffffffff goto \u003cexit\u003e\n    r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)\n    r0 after reg_bounds_sync:  u64=[0x1, 0] var_off=(0, 0)\n\nImproving the range refinement for JSET to cover all cases is tricky. We\nalso don't expect many users to rely on JSET given LLVM doesn't generate\nthose instructions. So instead of improving the range refinement for\nJSETs, Eduard suggested we forget the ranges whenever we're narrowing\ntnums after a JSET. This patch implements that approach.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "056aea12-e938-47e2-b238-857d934f2a61",
      "id": "CVE-2025-39927",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix race condition validating r_parent before applying state\n\nAdd validation to ensure the cached parent directory inode matches the\ndirectory info in MDS replies. This prevents client-side race conditions\nwhere concurrent operations (e.g. rename) cause r_parent to become stale\nbetween request initiation and reply processing, which could lead to\napplying state changes to incorrect directory inodes.\n\n[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to\n  move CEPH_CAP_PIN reference when r_parent is updated:\n\n  When the parent directory lock is not held, req-\u003er_parent can become\n  stale and is updated to point to the correct inode.  However, the\n  associated CEPH_CAP_PIN reference was not being adjusted.  The\n  CEPH_CAP_PIN is a reference on an inode that is tracked for\n  accounting purposes.  Moving this pin is important to keep the\n  accounting balanced. When the pin was not moved from the old parent\n  to the new one, it created two problems: The reference on the old,\n  stale parent was never released, causing a reference leak.\n  A reference for the new parent was never acquired, creating the risk\n  of a reference underflow later in ceph_mdsc_release_request().  This\n  patch corrects the logic by releasing the pin from the old parent and\n  acquiring it for the new parent when r_parent is switched.  This\n  ensures reference accounting stays balanced. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76c688f6-785f-46a2-9cec-b8e635cee913",
      "id": "CVE-2020-12768",
      "description": "An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24741f7d-547a-4a01-b147-a9bf15deb97a",
      "id": "CVE-2020-29372",
      "description": "An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a41db92f-1a24-4012-a04f-9b1d479fafab",
      "id": "CVE-2021-28714",
      "description": "Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5512251c-0b12-4015-bae9-d24a98377b90",
      "id": "CVE-2021-3506",
      "description": "An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7147c38-b380-48b7-9a86-338a646634fa",
      "id": "CVE-2021-3612",
      "description": "An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac0d3f7c-91cd-422f-9be5-93b97c64b3f5",
      "id": "CVE-2021-3760",
      "description": "A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "417b53c0-a76a-4b6c-87a2-924947294a0d",
      "id": "CVE-2021-46904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hso: fix null-ptr-deref during tty device unregistration\n\nMultiple ttys try to claim the same the minor number causing a double\nunregistration of the same device. The first unregistration succeeds\nbut the next one results in a null-ptr-deref.\n\nThe get_free_serial_index() function returns an available minor number\nbut doesn't assign it immediately. The assignment is done by the caller\nlater. But before this assignment, calls to get_free_serial_index()\nwould return the same minor number.\n\nFix this by modifying get_free_serial_index to assign the minor number\nimmediately after one is found to be and rename it to obtain_minor()\nto better reflect what it does. Similary, rename set_serial_by_index()\nto release_minor() and modify it to free up the minor number of the\ngiven hso_serial. Every obtain_minor() should have corresponding\nrelease_minor() call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2bdd9a6-ee26-4bcd-8631-fd856cbb4a91",
      "id": "CVE-2021-47121",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: caif: fix memory leak in cfusbl_device_notify\n\nIn case of caif_enroll_dev() fail, allocated\nlink_support won't be assigned to the corresponding\nstructure. So simply free allocated pointer in case\nof error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e5425d58-0502-4b14-b131-043984f5a9b4",
      "id": "CVE-2021-47260",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a potential NULL dereference in nfs_get_client()\n\nNone of the callers are expecting NULL returns from nfs_get_client() so\nthis code will lead to an Oops.  It's better to return an error\npointer.  I expect that this is dead code so hopefully no one is\naffected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1d200fa-4477-4b97-a2d3-ca97068c3c32",
      "id": "CVE-2021-47270",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: fix various gadgets null ptr deref on 10gbps cabling.\n\nThis avoids a null pointer dereference in\nf_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm}\nby simply reusing the 5gbps config for 10gbps.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce8c2e3d-05aa-4a01-81db-0606b11a6702",
      "id": "CVE-2023-53432",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: fix use after free in fwnet_finish_incoming_packet()\n\nThe netif_rx() function frees the skb so we can't dereference it to\nsave the skb-\u003elen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d5290c8-2a01-42b4-919d-f99b0b631090",
      "id": "CVE-2021-47334",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/libmasm/module: Fix two use after free in ibmasm_init_one\n\nIn ibmasm_init_one, it calls ibmasm_init_remote_input_dev().\nInside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are\nallocated by input_allocate_device(), and assigned to\nsp-\u003eremote.mouse_dev and sp-\u003eremote.keybd_dev respectively.\n\nIn the err_free_devices error branch of ibmasm_init_one,\nmouse_dev and keybd_dev are freed by input_free_device(), and return\nerror. Then the execution runs into error_send_message error branch\nof ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called\nto unregister the freed sp-\u003eremote.mouse_dev and sp-\u003eremote.keybd_dev.\n\nMy patch add a \"error_init_remote\" label to handle the error of\nibmasm_init_remote_input_dev(), to avoid the uaf bugs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72bbb32c-e0ea-48e8-98c2-283c4141b9e5",
      "id": "CVE-2021-47474",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix bulk-buffer overflow\n\nThe driver is using endpoint-sized buffers but must not assume that the\ntx and rx buffers are of equal size or a malicious device could overflow\nthe slab-allocated receive buffer when doing bulk transfers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79475c1c-643e-46a6-93de-5b9bb033807a",
      "id": "CVE-2021-47504",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: ensure task_work gets run as part of cancelations\n\nIf we successfully cancel a work item but that work item needs to be\nprocessed through task_work, then we can be sleeping uninterruptibly\nin io_uring_cancel_generic() and never process it. Hence we don't\nmake forward progress and we end up with an uninterruptible sleep\nwarning.\n\nWhile in there, correct a comment that should be IFF, not IIF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17e50986-9053-45d6-ba5e-19db9bb78464",
      "id": "CVE-2021-47670",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: fix use after free bugs\n\nAfter calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the peak_usb_netif_rx_ni().\n\nReordering the lines solves the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "556a660d-e666-4446-a72a-f976430ec3e4",
      "id": "CVE-2022-2318",
      "description": "There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed0dfdf9-858e-47db-9413-d70d3540c779",
      "id": "CVE-2023-53433",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add vlan_get_protocol_and_depth() helper\n\nBefore blamed commit, pskb_may_pull() was used instead\nof skb_header_pointer() in __vlan_get_protocol() and friends.\n\nFew callers depended on skb-\u003ehead being populated with MAC header,\nsyzbot caught one of them (skb_mac_gso_segment())\n\nAdd vlan_get_protocol_and_depth() to make the intent clearer\nand use it where sensible.\n\nThis is a more generic fix than commit e9d3f80935b6\n(\"net/af_packet: make sure to pull mac header\") which was\ndealing with a similar issue.\n\nkernel BUG at include/linux/skbuff.h:2655 !\ninvalid opcode: 0000 [#1] SMP KASAN\nCPU: 0 PID: 1441 Comm: syz-executor199 Not tainted 6.1.24-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023\nRIP: 0010:__skb_pull include/linux/skbuff.h:2655 [inline]\nRIP: 0010:skb_mac_gso_segment+0x68f/0x6a0 net/core/gro.c:136\nCode: fd 48 8b 5c 24 10 44 89 6b 70 48 c7 c7 c0 ae 0d 86 44 89 e6 e8 a1 91 d0 00 48 c7 c7 00 af 0d 86 48 89 de 31 d2 e8 d1 4a e9 ff \u003c0f\u003e 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41\nRSP: 0018:ffffc90001bd7520 EFLAGS: 00010286\nRAX: ffffffff8469736a RBX: ffff88810f31dac0 RCX: ffff888115a18b00\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc90001bd75e8 R08: ffffffff84697183 R09: fffff5200037adf9\nR10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000012\nR13: 000000000000fee5 R14: 0000000000005865 R15: 000000000000fed7\nFS: 000055555633f300(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000000 CR3: 0000000116fea000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\n[\u003cffffffff847018dd\u003e] __skb_gso_segment+0x32d/0x4c0 net/core/dev.c:3419\n[\u003cffffffff8470398a\u003e] skb_gso_segment include/linux/netdevice.h:4819 [inline]\n[\u003cffffffff8470398a\u003e] validate_xmit_skb+0x3aa/0xee0 net/core/dev.c:3725\n[\u003cffffffff84707042\u003e] __dev_queue_xmit+0x1332/0x3300 net/core/dev.c:4313\n[\u003cffffffff851a9ec7\u003e] dev_queue_xmit+0x17/0x20 include/linux/netdevice.h:3029\n[\u003cffffffff851b4a82\u003e] packet_snd net/packet/af_packet.c:3111 [inline]\n[\u003cffffffff851b4a82\u003e] packet_sendmsg+0x49d2/0x6470 net/packet/af_packet.c:3142\n[\u003cffffffff84669a12\u003e] sock_sendmsg_nosec net/socket.c:716 [inline]\n[\u003cffffffff84669a12\u003e] sock_sendmsg net/socket.c:736 [inline]\n[\u003cffffffff84669a12\u003e] __sys_sendto+0x472/0x5f0 net/socket.c:2139\n[\u003cffffffff84669c75\u003e] __do_sys_sendto net/socket.c:2151 [inline]\n[\u003cffffffff84669c75\u003e] __se_sys_sendto net/socket.c:2147 [inline]\n[\u003cffffffff84669c75\u003e] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147\n[\u003cffffffff8551d40f\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[\u003cffffffff8551d40f\u003e] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80\n[\u003cffffffff85600087\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc42bfb2-fafe-44cf-b6ea-d14ba1e0ea41",
      "id": "CVE-2022-24958",
      "description": "drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev-\u003ebuf release.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bd4b0301-720a-406b-be29-94540f59b213",
      "id": "CVE-2022-3108",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87a21e6c-d658-44fa-9f13-9b02823b6c69",
      "id": "CVE-2022-41218",
      "description": "In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "85ba3f8f-e844-4071-a28e-1b2241531bcd",
      "id": "CVE-2022-42719",
      "description": "A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8eeaa8d-0fc2-40c1-b1a8-0f701e782161",
      "id": "CVE-2022-49126",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix memory leaks\n\nFix memory leaks related to operational reply queue's memory segments which\nare not getting freed while unloading the driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61bd7131-056c-420b-8860-0a2e57b479dd",
      "id": "CVE-2022-43945",
      "description": "The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d0e0a45-8261-4e1d-83f8-cc9ba8bee17b",
      "id": "CVE-2022-48659",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: fix to return errno if kmalloc() fails\n\nIn create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to\nout-of-memory, if it fails, return errno correctly rather than\ntriggering panic via BUG_ON();\n\nkernel BUG at mm/slub.c:5893!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\n\nCall trace:\n sysfs_slab_add+0x258/0x260 mm/slub.c:5973\n __kmem_cache_create+0x60/0x118 mm/slub.c:4899\n create_cache mm/slab_common.c:229 [inline]\n kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335\n kmem_cache_create+0x1c/0x28 mm/slab_common.c:390\n f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]\n f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808\n f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149\n mount_bdev+0x1b8/0x210 fs/super.c:1400\n f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512\n legacy_get_tree+0x30/0x74 fs/fs_context.c:610\n vfs_get_tree+0x40/0x140 fs/super.c:1530\n do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040\n path_mount+0x358/0x914 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb2adbe4-8a50-43c0-86cc-7e6d6ad6270e",
      "id": "CVE-2022-48765",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: LAPIC: Also cancel preemption timer during SET_LAPIC\n\nThe below warning is splatting during guest reboot.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\n  CPU: 0 PID: 1931 Comm: qemu-system-x86 Tainted: G          I       5.17.0-rc1+ #5\n  RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\n  Call Trace:\n   \u003cTASK\u003e\n   kvm_vcpu_ioctl+0x279/0x710 [kvm]\n   __x64_sys_ioctl+0x83/0xb0\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  RIP: 0033:0x7fd39797350b\n\nThis can be triggered by not exposing tsc-deadline mode and doing a reboot in\nthe guest. The lapic_shutdown() function which is called in sys_reboot path\nwill not disarm the flying timer, it just masks LVTT. lapic_shutdown() clears\nAPIC state w/ LVT_MASKED and timer-mode bit is 0, this can trigger timer-mode\nswitch between tsc-deadline and oneshot/periodic, which can result in preemption\ntimer be cancelled in apic_update_lvtt(). However, We can't depend on this when\nnot exposing tsc-deadline mode and oneshot/periodic modes emulated by preemption\ntimer. Qemu will synchronise states around reset, let's cancel preemption timer\nunder KVM_SET_LAPIC.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7209e615-e3a2-41cc-91dc-d73b29a7c9a6",
      "id": "CVE-2022-49011",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()\n\nAs comment of pci_get_domain_bus_and_slot() says, it returns\na pci device with refcount increment, when finish using it,\nthe caller must decrement the reference count by calling\npci_dev_put(). So call it after using to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d2a0358-4a8c-47c9-841f-c410f6fcc75e",
      "id": "CVE-2022-49077",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\n\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\ni.e.  with an empty range.\n\nThis causes a WARN in KVM's mmu_notifier.  In the past, empty ranges\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\nlow (so far) number of unique reports, the benefits of detecting more\nbuggy callers seem to outweigh the cost of having to fix cases such as\nthis one, where userspace is doing something silly.  In this particular\ncase, an early return from move_page_tables() is enough to fix the\nissue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d781b67-3c6f-4f35-b28b-b266ece53f40",
      "id": "CVE-2022-49264",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Force single empty string when argv is empty\n\nQuoting[1] Ariadne Conill:\n\n\"In several other operating systems, it is a hard requirement that the\nsecond argument to execve(2) be the name of a program, thus prohibiting\na scenario where argc \u003c 1. POSIX 2017 also recommends this behaviour,\nbut it is not an explicit requirement[2]:\n\n    The argument arg0 should point to a filename string that is\n    associated with the process being started by one of the exec\n    functions.\n...\nInterestingly, Michael Kerrisk opened an issue about this in 2008[3],\nbut there was no consensus to support fixing this issue then.\nHopefully now that CVE-2021-4034 shows practical exploitative use[4]\nof this bug in a shellcode, we can reconsider.\n\nThis issue is being tracked in the KSPP issue tracker[5].\"\n\nWhile the initial code searches[6][7] turned up what appeared to be\nmostly corner case tests, trying to that just reject argv == NULL\n(or an immediately terminated pointer list) quickly started tripping[8]\nexisting userspace programs.\n\nThe next best approach is forcing a single empty string into argv and\nadjusting argc to match. The number of programs depending on argc == 0\nseems a smaller set than those calling execve with a NULL argv.\n\nAccount for the additional stack space in bprm_stack_limits(). Inject an\nempty string when argc == 0 (and set argc = 1). Warn about the case so\nuserspace has some notice about the change:\n\n    process './argc0' launched './argc0' with NULL argv: empty string added\n\nAdditionally WARN() and reject NULL argv usage for kernel threads.\n\n[1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereferenced.org/\n[2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html\n[3] https://bugzilla.kernel.org/show_bug.cgi?id=8408\n[4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt\n[5] https://github.com/KSPP/linux/issues/176\n[6] https://codesearch.debian.net/search?q=execve%5C+*%5C%28%5B%5E%2C%5D%2B%2C+*NULL\u0026literal=0\n[7] https://codesearch.debian.net/search?q=execlp%3F%5Cs*%5C%28%5B%5E%2C%5D%2B%2C%5Cs*NULL\u0026literal=0\n[8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "caa1bf43-943d-4fe6-85c8-664bb98aa624",
      "id": "CVE-2022-49315",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()\n\nThere is a deadlock in rtllib_beacons_stop(), which is shown\nbelow:\n\n   (Thread 1)              |      (Thread 2)\n                           | rtllib_send_beacon()\nrtllib_beacons_stop()      |  mod_timer()\n spin_lock_irqsave() //(1) |  (wait a time)\n ...                       | rtllib_send_beacon_cb()\n del_timer_sync()          |  spin_lock_irqsave() //(2)\n (wait timer to stop)      |  ...\n\nWe hold ieee-\u003ebeacon_lock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need ieee-\u003ebeacon_lock in position (2) of thread 2.\nAs a result, rtllib_beacons_stop() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_irqsave(), which could let timer handler to obtain\nthe needed lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d103a6ee-b8fe-4d60-94bc-5376db1c1c95",
      "id": "CVE-2022-49320",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type\n\nIn zynqmp_dma_alloc/free_chan_resources functions there is a\npotential overflow in the below expressions.\n\ndma_alloc_coherent(chan-\u003edev, (2 * chan-\u003edesc_size *\n\t\t   ZYNQMP_DMA_NUM_DESCS),\n\t\t   \u0026chan-\u003edesc_pool_p, GFP_KERNEL);\n\ndma_free_coherent(chan-\u003edev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *\n                 ZYNQMP_DMA_NUM_DESCS),\n                chan-\u003edesc_pool_v, chan-\u003edesc_pool_p);\n\nThe arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though\nthis overflow condition is not observed but it is a potential problem\nin the case of 32-bit multiplication. Hence fix it by changing the\ndesc_size data type to size_t.\n\nIn addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in\ndma_alloc_coherent API argument.\n\nAddresses-Coverity: Event overflow_before_widen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b1b9ee0-ecc5-491a-9bd8-9337fb2b97d3",
      "id": "CVE-2022-49360",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on total_data_blocks\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215916\n\nThe kernel message is shown below:\n\nkernel BUG at fs/f2fs/segment.c:2560!\nCall Trace:\n allocate_segment_by_default+0x228/0x440\n f2fs_allocate_data_block+0x13d1/0x31f0\n do_write_page+0x18d/0x710\n f2fs_outplace_write_data+0x151/0x250\n f2fs_do_write_data_page+0xef9/0x1980\n move_data_page+0x6af/0xbc0\n do_garbage_collect+0x312f/0x46f0\n f2fs_gc+0x6b0/0x3bc0\n f2fs_balance_fs+0x921/0x2260\n f2fs_write_single_data_page+0x16be/0x2370\n f2fs_write_cache_pages+0x428/0xd00\n f2fs_write_data_pages+0x96e/0xd50\n do_writepages+0x168/0x550\n __writeback_single_inode+0x9f/0x870\n writeback_sb_inodes+0x47d/0xb20\n __writeback_inodes_wb+0xb2/0x200\n wb_writeback+0x4bd/0x660\n wb_workfn+0x5f3/0xab0\n process_one_work+0x79f/0x13e0\n worker_thread+0x89/0xf60\n kthread+0x26a/0x300\n ret_from_fork+0x22/0x30\nRIP: 0010:new_curseg+0xe8d/0x15f0\n\nThe root cause is: ckpt.valid_block_count is inconsistent with SIT table,\nstat info indicates filesystem has free blocks, but SIT table indicates\nfilesystem has no free segment.\n\nSo that during garbage colloection, it triggers panic when LFS allocator\nfails to find free segment.\n\nThis patch tries to fix this issue by checking consistency in between\nckpt.valid_block_count and block accounted from SIT.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7326c7b-36b5-4f13-9b64-dbcdb892c214",
      "id": "CVE-2022-49376",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix potential NULL pointer dereference\n\nIf sd_probe() sees an early error before sdkp-\u003edevice is initialized,\nsd_zbc_release_disk() is called. This causes a NULL pointer dereference\nwhen sd_is_zoned() is called inside that function. Avoid this by removing\nthe call to sd_zbc_release_disk() in sd_probe() error path.\n\nThis change is safe and does not result in zone information memory leakage\nbecause the zone information for a zoned disk is allocated only when\nsd_revalidate_disk() is called, at which point sdkp-\u003edisk_dev is fully set,\nresulting in sd_disk_release() being called when needed to cleanup a disk\nzone information using sd_zbc_release_disk().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b454039-4257-41a1-8181-5c5d33be1244",
      "id": "CVE-2024-53157",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Check the DVFS OPP count returned by the firmware\n\nFix a kernel crash with the below call trace when the SCPI firmware\nreturns OPP count of zero.\n\ndvfs_info.opp_count may be zero on some platforms during the reboot\ntest, and the kernel will crash after dereferencing the pointer to\nkcalloc(info-\u003ecount, sizeof(*opp), GFP_KERNEL).\n\n  |  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028\n  |  Mem abort info:\n  |    ESR = 0x96000004\n  |    Exception class = DABT (current EL), IL = 32 bits\n  |    SET = 0, FnV = 0\n  |    EA = 0, S1PTW = 0\n  |  Data abort info:\n  |    ISV = 0, ISS = 0x00000004\n  |    CM = 0, WnR = 0\n  |  user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c\n  |  [0000000000000028] pgd=0000000000000000\n  |  Internal error: Oops: 96000004 [#1] SMP\n  |  scpi-hwmon: probe of PHYT000D:00 failed with error -110\n  |  Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)\n  |  CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1\n  |  Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS\n  |  pstate: 60000005 (nZCv daif -PAN -UAO)\n  |  pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]\n  |  lr : clk_register+0x438/0x720\n  |  Call trace:\n  |   scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]\n  |   devm_clk_hw_register+0x50/0xa0\n  |   scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]\n  |   scpi_clocks_probe+0x528/0x70c [clk_scpi]\n  |   platform_drv_probe+0x58/0xa8\n  |   really_probe+0x260/0x3d0\n  |   driver_probe_device+0x12c/0x148\n  |   device_driver_attach+0x74/0x98\n  |   __driver_attach+0xb4/0xe8\n  |   bus_for_each_dev+0x88/0xe0\n  |   driver_attach+0x30/0x40\n  |   bus_add_driver+0x178/0x2b0\n  |   driver_register+0x64/0x118\n  |   __platform_driver_register+0x54/0x60\n  |   scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]\n  |   do_one_initcall+0x54/0x220\n  |   do_init_module+0x54/0x1c8\n  |   load_module+0x14a4/0x1668\n  |   __se_sys_finit_module+0xf8/0x110\n  |   __arm64_sys_finit_module+0x24/0x30\n  |   el0_svc_common+0x78/0x170\n  |   el0_svc_handler+0x38/0x78\n  |   el0_svc+0x8/0x340\n  |  Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)\n  |  ---[ end trace 06feb22469d89fa8 ]---\n  |  Kernel panic - not syncing: Fatal exception\n  |  SMP: stopping secondary CPUs\n  |  Kernel Offset: disabled\n  |  CPU features: 0x10,a0002008\n  |  Memory Limit: none",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5672507-c169-4a55-a77f-9916cbaab05f",
      "id": "CVE-2022-49382",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: rockchip: Fix refcount leak in rockchip_grf_init\n\nof_find_matching_node_and_match returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c52834d3-31d1-4162-806d-a980ca2b703e",
      "id": "CVE-2022-49404",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Fix potential integer multiplication overflow errors\n\nWhen multiplying of different types, an overflow is possible even when\nstoring the result in a larger type. This is because the conversion is\ndone after the multiplication. So arithmetic overflow and thus in\nincorrect value is possible.\n\nCorrect an instance of this in the inter packet delay calculation.  Fix by\nensuring one of the operands is u64 which will promote the other to u64 as\nwell ensuring no overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e13c7bc8-ce72-4692-8ce3-01845ad59936",
      "id": "CVE-2022-49561",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: re-fetch conntrack after insertion\n\nIn case the conntrack is clashing, insertion can free skb-\u003e_nfct and\nset skb-\u003e_nfct to the already-confirmed entry.\n\nThis wasn't found before because the conntrack entry and the extension\nspace used to free'd after an rcu grace period, plus the race needs\nevents enabled to trigger.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f625585a-ea3c-42b8-8754-a99ed537b8b2",
      "id": "CVE-2022-49587",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_notsent_lowat.\n\nWhile reading sysctl_tcp_notsent_lowat, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15012ea4-ddb6-4d87-9040-9731789b7837",
      "id": "CVE-2022-49596",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_min_snd_mss.\n\nWhile reading sysctl_tcp_min_snd_mss, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92a503cb-21c5-4477-9b61-7b529c9073e5",
      "id": "CVE-2022-49631",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nraw: Fix a data-race around sysctl_raw_l3mdev_accept.\n\nWhile reading sysctl_raw_l3mdev_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "675e8c28-6c9a-43ea-9d48-47fb047de56d",
      "id": "CVE-2022-49639",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: Fix data-races around sysctl.\n\nWhile reading cipso sysctl variables, they can be changed concurrently.\nSo, we need to add READ_ONCE() to avoid data-races.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b10c77ad-d224-499e-bc7c-86be98c0cc85",
      "id": "CVE-2022-49861",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()\n\nA clk_prepare_enable() call in the probe is not balanced by a corresponding\nclk_disable_unprepare() in the remove function.\n\nAdd the missing call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08d94adc-c133-490e-96ac-bb2140f9646f",
      "id": "CVE-2022-50001",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_tproxy: restrict to prerouting hook\n\nTPROXY is only allowed from prerouting, but nft_tproxy doesn't check this.\nThis fixes a crash (null dereference) when using tproxy from e.g. output.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db894ef3-92ce-42ba-8eb2-56d880691844",
      "id": "CVE-2022-50016",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot\n\nIt is not yet clear, but it is possible to create a firmware so broken\nthat it will send a reply message before a FW_READY message (it is not\nyet clear if FW_READY will arrive later).\nSince the reply_data is allocated only after the FW_READY message, this\nwill lead to a NULL pointer dereference if not filtered out.\n\nThe issue was reported with IPC4 firmware but the same condition is present\nfor IPC3.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f1f2125-671a-42f4-a4ee-7f72e8e3edb1",
      "id": "CVE-2022-50038",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()\n\nIn this function, there are two refcount leak bugs:\n(1) when breaking out of for_each_endpoint_of_node(), we need call\nthe of_node_put() for the 'ep';\n(2) we should call of_node_put() for the reference returned by\nof_graph_get_remote_port() when it is not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54a641e6-49aa-4c5e-a114-ced7b7fe3458",
      "id": "CVE-2022-50099",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: arkfb: Check the size of screen before memset_io()\n\nIn the function arkfb_set_par(), the value of 'screen_size' is\ncalculated by the user input. If the user provides the improper value,\nthe value of 'screen_size' may larger than 'info-\u003escreen_size', which\nmay cause the following bug:\n\n[  659.399066] BUG: unable to handle page fault for address: ffffc90003000000\n[  659.399077] #PF: supervisor write access in kernel mode\n[  659.399079] #PF: error_code(0x0002) - not-present page\n[  659.399094] RIP: 0010:memset_orig+0x33/0xb0\n[  659.399116] Call Trace:\n[  659.399122]  arkfb_set_par+0x143f/0x24c0\n[  659.399130]  fb_set_var+0x604/0xeb0\n[  659.399161]  do_fb_ioctl+0x234/0x670\n[  659.399189]  fb_ioctl+0xdd/0x130\n\nFix the this by checking the value of 'screen_size' before memset_io().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8cf0a278-3866-41e3-843b-893046fd3833",
      "id": "CVE-2022-50138",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()\n\n__qedr_alloc_mr() allocates a memory chunk for \"mr-\u003einfo.pbl_table\" with\ninit_mr_info(). When rdma_alloc_tid() and rdma_register_tid() fail, \"mr\"\nis released while \"mr-\u003einfo.pbl_table\" is not released, which will lead\nto a memory leak.\n\nWe should release the \"mr-\u003einfo.pbl_table\" with qedr_free_pbl() when error\noccurs to fix the memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d117542-66e0-4969-8731-5569f92994cf",
      "id": "CVE-2024-26928",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_debug_files_proc_show()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "619baa48-563b-4884-b50d-58ae58992d5e",
      "id": "CVE-2022-50365",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nskbuff: Account for tail adjustment during pull operations\n\nExtending the tail can have some unexpected side effects if a program uses\na helper like BPF_FUNC_skb_pull_data to read partial content beyond the\nhead skb headlen when all the skbs in the gso frag_list are linear with no\nhead_frag -\n\n  kernel BUG at net/core/skbuff.c:4219!\n  pc : skb_segment+0xcf4/0xd2c\n  lr : skb_segment+0x63c/0xd2c\n  Call trace:\n   skb_segment+0xcf4/0xd2c\n   __udp_gso_segment+0xa4/0x544\n   udp4_ufo_fragment+0x184/0x1c0\n   inet_gso_segment+0x16c/0x3a4\n   skb_mac_gso_segment+0xd4/0x1b0\n   __skb_gso_segment+0xcc/0x12c\n   udp_rcv_segment+0x54/0x16c\n   udp_queue_rcv_skb+0x78/0x144\n   udp_unicast_rcv_skb+0x8c/0xa4\n   __udp4_lib_rcv+0x490/0x68c\n   udp_rcv+0x20/0x30\n   ip_protocol_deliver_rcu+0x1b0/0x33c\n   ip_local_deliver+0xd8/0x1f0\n   ip_rcv+0x98/0x1a4\n   deliver_ptype_list_skb+0x98/0x1ec\n   __netif_receive_skb_core+0x978/0xc60\n\nFix this by marking these skbs as GSO_DODGY so segmentation can handle\nthe tail updates accordingly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be070646-f614-40ae-8788-02d959ac49a3",
      "id": "CVE-2022-50415",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: led: Fix potential null-ptr-deref in start_task()\n\nstart_task() calls create_singlethread_workqueue() and not checked the\nret value, which may return NULL. And a null-ptr-deref may happen:\n\nstart_task()\n    create_singlethread_workqueue() # failed, led_wq is NULL\n    queue_delayed_work()\n        queue_delayed_work_on()\n            __queue_delayed_work()  # warning here, but continue\n                __queue_work()      # access wq-\u003eflags, null-ptr-deref\n\nCheck the ret value and return -ENOMEM if it is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a310b2e3-f668-490f-8521-939820135960",
      "id": "CVE-2024-23848",
      "description": "In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d13830e8-8e17-4a40-957d-9bb5d7d3ac36",
      "id": "CVE-2023-1390",
      "description": "A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "67e61c3b-fcdf-4218-ab11-ca25f114485c",
      "id": "CVE-2023-1989",
      "description": "A use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8013e59c-352e-40ad-aec2-d148aa2d0334",
      "id": "CVE-2024-49875",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: map the EBADMSG to nfserr_io to avoid warning\n\nExt4 will throw -EBADMSG through ext4_readdir when a checksum error\noccurs, resulting in the following WARNING.\n\nFix it by mapping EBADMSG to nfserr_io.\n\nnfsd_buffered_readdir\n iterate_dir // -EBADMSG -74\n  ext4_readdir // .iterate_shared\n   ext4_dx_readdir\n    ext4_htree_fill_tree\n     htree_dirblock_to_tree\n      ext4_read_dirblock\n       __ext4_read_dirblock\n        ext4_dirblock_csum_verify\n         warn_no_space_for_csum\n          __warn_no_space_for_csum\n        return ERR_PTR(-EFSBADCRC) // -EBADMSG -74\n nfserrno // WARNING\n\n[  161.115610] ------------[ cut here ]------------\n[  161.116465] nfsd: non-standard errno: -74\n[  161.117315] WARNING: CPU: 1 PID: 780 at fs/nfsd/nfsproc.c:878 nfserrno+0x9d/0xd0\n[  161.118596] Modules linked in:\n[  161.119243] CPU: 1 PID: 780 Comm: nfsd Not tainted 5.10.0-00014-g79679361fd5d #138\n[  161.120684] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qe\nmu.org 04/01/2014\n[  161.123601] RIP: 0010:nfserrno+0x9d/0xd0\n[  161.124676] Code: 0f 87 da 30 dd 00 83 e3 01 b8 00 00 00 05 75 d7 44 89 ee 48 c7 c7 c0 57 24 98 89 44 24 04 c6\n 05 ce 2b 61 03 01 e8 99 20 d8 00 \u003c0f\u003e 0b 8b 44 24 04 eb b5 4c 89 e6 48 c7 c7 a0 6d a4 99 e8 cc 15 33\n[  161.127797] RSP: 0018:ffffc90000e2f9c0 EFLAGS: 00010286\n[  161.128794] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  161.130089] RDX: 1ffff1103ee16f6d RSI: 0000000000000008 RDI: fffff520001c5f2a\n[  161.131379] RBP: 0000000000000022 R08: 0000000000000001 R09: ffff8881f70c1827\n[  161.132664] R10: ffffed103ee18304 R11: 0000000000000001 R12: 0000000000000021\n[  161.133949] R13: 00000000ffffffb6 R14: ffff8881317c0000 R15: ffffc90000e2fbd8\n[  161.135244] FS:  0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000\n[  161.136695] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  161.137761] CR2: 00007fcaad70b348 CR3: 0000000144256006 CR4: 0000000000770ee0\n[  161.139041] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  161.140291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  161.141519] PKRU: 55555554\n[  161.142076] Call Trace:\n[  161.142575]  ? __warn+0x9b/0x140\n[  161.143229]  ? nfserrno+0x9d/0xd0\n[  161.143872]  ? report_bug+0x125/0x150\n[  161.144595]  ? handle_bug+0x41/0x90\n[  161.145284]  ? exc_invalid_op+0x14/0x70\n[  161.146009]  ? asm_exc_invalid_op+0x12/0x20\n[  161.146816]  ? nfserrno+0x9d/0xd0\n[  161.147487]  nfsd_buffered_readdir+0x28b/0x2b0\n[  161.148333]  ? nfsd4_encode_dirent_fattr+0x380/0x380\n[  161.149258]  ? nfsd_buffered_filldir+0xf0/0xf0\n[  161.150093]  ? wait_for_concurrent_writes+0x170/0x170\n[  161.151004]  ? generic_file_llseek_size+0x48/0x160\n[  161.151895]  nfsd_readdir+0x132/0x190\n[  161.152606]  ? nfsd4_encode_dirent_fattr+0x380/0x380\n[  161.153516]  ? nfsd_unlink+0x380/0x380\n[  161.154256]  ? override_creds+0x45/0x60\n[  161.155006]  nfsd4_encode_readdir+0x21a/0x3d0\n[  161.155850]  ? nfsd4_encode_readlink+0x210/0x210\n[  161.156731]  ? write_bytes_to_xdr_buf+0x97/0xe0\n[  161.157598]  ? __write_bytes_to_xdr_buf+0xd0/0xd0\n[  161.158494]  ? lock_downgrade+0x90/0x90\n[  161.159232]  ? nfs4svc_decode_voidarg+0x10/0x10\n[  161.160092]  nfsd4_encode_operation+0x15a/0x440\n[  161.160959]  nfsd4_proc_compound+0x718/0xe90\n[  161.161818]  nfsd_dispatch+0x18e/0x2c0\n[  161.162586]  svc_process_common+0x786/0xc50\n[  161.163403]  ? nfsd_svc+0x380/0x380\n[  161.164137]  ? svc_printk+0x160/0x160\n[  161.164846]  ? svc_xprt_do_enqueue.part.0+0x365/0x380\n[  161.165808]  ? nfsd_svc+0x380/0x380\n[  161.166523]  ? rcu_is_watching+0x23/0x40\n[  161.167309]  svc_process+0x1a5/0x200\n[  161.168019]  nfsd+0x1f5/0x380\n[  161.168663]  ? nfsd_shutdown_threads+0x260/0x260\n[  161.169554]  kthread+0x1c4/0x210\n[  161.170224]  ? kthread_insert_work_sanity_check+0x80/0x80\n[  161.171246]  ret_from_fork+0x1f/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c5bfafd-2a45-45e8-9c7d-e986b75c2bae",
      "id": "CVE-2023-2162",
      "description": "A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91e4c865-2eea-42d2-ba9b-eb9ec4f4c47c",
      "id": "CVE-2023-23005",
      "description": "In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6a26755-ee6c-4cc8-9eba-bf0b2f8b0072",
      "id": "CVE-2023-45863",
      "description": "An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa059e97-3149-4543-b4bf-3a2ac29788b1",
      "id": "CVE-2024-26659",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: handle isoc Babble and Buffer Overrun events properly\n\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\nownership of a multi-TRB TD when it reports an error on one of the\nearly TRBs. Yet the driver makes such assumption and releases the TD,\nallowing the remaining TRBs to be freed or overwritten by new TDs.\n\nThe xHC should also report completion of the final TRB due to its IOC\nflag being set by us, regardless of prior errors. This event cannot\nbe recognized if the TD has already been freed earlier, resulting in\n\"Transfer event TRB DMA ptr not part of current TD\" error message.\n\nFix this by reusing the logic for processing isoc Transaction Errors.\nThis also handles hosts which fail to report the final completion.\n\nFix transfer length reporting on Babble errors. They may be caused by\ndevice malfunction, no guarantee that the buffer has been filled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d4b6524-b6a3-4d4e-90e3-e5f756161933",
      "id": "CVE-2023-52429",
      "description": "dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8514d022-e9d8-4e18-8ffe-66c03c3f9fb4",
      "id": "CVE-2023-52435",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent mss overflow in skb_segment()\n\nOnce again syzbot is able to crash the kernel in skb_segment() [1]\n\nGSO_BY_FRAGS is a forbidden value, but unfortunately the following\ncomputation in skb_segment() can reach it quite easily :\n\n\tmss = mss * partial_segs;\n\n65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to\na bad final result.\n\nMake sure to limit segmentation so that the new mss value is smaller\nthan GSO_BY_FRAGS.\n\n[1]\n\ngeneral protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]\nCPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nRIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551\nCode: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00\nRSP: 0018:ffffc900043473d0 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597\nRDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070\nRBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff\nR10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0\nR13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046\nFS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\nudp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109\nipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120\nskb_mac_gso_segment+0x290/0x610 net/core/gso.c:53\n__skb_gso_segment+0x339/0x710 net/core/gso.c:124\nskb_gso_segment include/net/gso.h:83 [inline]\nvalidate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626\n__dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\npacket_xmit+0x257/0x380 net/packet/af_packet.c:276\npacket_snd net/packet/af_packet.c:3087 [inline]\npacket_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg+0xd5/0x180 net/socket.c:745\n__sys_sendto+0x255/0x340 net/socket.c:2190\n__do_sys_sendto net/socket.c:2202 [inline]\n__se_sys_sendto net/socket.c:2198 [inline]\n__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\nRIP: 0033:0x7f8692032aa9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9\nRDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003\nRBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480\nR13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003\n\u003c/TASK\u003e\nModules linked in:\n---[ end trace 0000000000000000 ]---\nRIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551\nCode: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00\nRSP: 0018:ffffc900043473d0 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597\nRDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070\nRBP: ffffc90004347578 R0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f72ba414-1f7a-4d1a-8ec2-98dae45014ae",
      "id": "CVE-2024-27078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-tpg: fix some memleaks in tpg_alloc\n\nIn tpg_alloc, resources should be deallocated in each and every\nerror-handling paths, since they are allocated in for statements.\nOtherwise there would be memleaks because tpg_free is called only when\ntpg_alloc return 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1c48c2e-219a-4706-a2f7-923fa3ca1aa6",
      "id": "CVE-2023-52476",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/lbr: Filter vsyscall addresses\n\nWe found that a panic can occur when a vsyscall is made while LBR sampling\nis active. If the vsyscall is interrupted (NMI) for perf sampling, this\ncall sequence can occur (most recent at top):\n\n    __insn_get_emulate_prefix()\n    insn_get_emulate_prefix()\n    insn_get_prefixes()\n    insn_get_opcode()\n    decode_branch_type()\n    get_branch_type()\n    intel_pmu_lbr_filter()\n    intel_pmu_handle_irq()\n    perf_event_nmi_handler()\n\nWithin __insn_get_emulate_prefix() at frame 0, a macro is called:\n\n    peek_nbyte_next(insn_byte_t, insn, i)\n\nWithin this macro, this dereference occurs:\n\n    (insn)-\u003enext_byte\n\nInspecting registers at this point, the value of the next_byte field is the\naddress of the vsyscall made, for example the location of the vsyscall\nversion of gettimeofday() at 0xffffffffff600000. The access to an address\nin the vsyscall region will trigger an oops due to an unhandled page fault.\n\nTo fix the bug, filtering for vsyscalls can be done when\ndetermining the branch type. This patch will return\na \"none\" branch if a kernel address if found to lie in the\nvsyscall region.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7b69f04-ad24-4b6d-ba4d-64462b8a5a16",
      "id": "CVE-2023-52609",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix race between mmput() and do_exit()\n\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\n\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\n\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it's dead).\n\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\n\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm-\u003easync_put_work WQ instead of Task A.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f2bd0fea-9cab-4fc2-a904-457d21a47f1b",
      "id": "CVE-2023-52624",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wake DMCUB before executing GPINT commands\n\n[Why]\nDMCUB can be in idle when we attempt to interface with the HW through\nthe GPINT mailbox resulting in a system hang.\n\n[How]\nAdd dc_wake_and_execute_gpint() to wrap the wake, execute, sleep\nsequence.\n\nIf the GPINT executes successfully then DMCUB will be put back into\nsleep after the optional response is returned.\n\nIt functions similar to the inbox command interface.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b035ff12-73d3-47fb-9507-ccd981160033",
      "id": "CVE-2023-52675",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/imc-pmu: Add a null pointer check in update_events_in_group()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16cddc85-66c9-411b-9fe0-516c8441c8e0",
      "id": "CVE-2023-52871",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: llcc: Handle a second device without data corruption\n\nUsually there is only one llcc device. But if there were a second, even\na failed probe call would modify the global drv_data pointer. So check\nif drv_data is valid before overwriting it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82a8b505-9d50-44d8-8ba3-d7dca5015e4d",
      "id": "CVE-2024-27402",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet/pep: fix racy skb_queue_empty() use\n\nThe receive queues are protected by their respective spin-lock, not\nthe socket lock. This could lead to skb_peek() unexpectedly\nreturning NULL or a pointer to an already dequeued socket buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9068f640-fe90-4f29-93cb-d1a5dd4289ba",
      "id": "CVE-2023-53026",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix ib block iterator counter overflow\n\nWhen registering a new DMA MR after selecting the best aligned page size\nfor it, we iterate over the given sglist to split each entry to smaller,\naligned to the selected page size, DMA blocks.\n\nIn given circumstances where the sg entry and page size fit certain\nsizes and the sg entry is not aligned to the selected page size, the\ntotal size of the aligned pages we need to cover the sg entry is \u003e= 4GB.\nUnder this circumstances, while iterating page aligned blocks, the\ncounter responsible for counting how much we advanced from the start of\nthe sg entry is overflowed because its type is u32 and we pass 4GB in\nsize. This can lead to an infinite loop inside the iterator function\nbecause the overflow prevents the counter to be larger\nthan the size of the sg entry.\n\nFix the presented problem by changing the advancement condition to\neliminate overflow.\n\nBacktrace:\n[  192.374329] efa_reg_user_mr_dmabuf\n[  192.376783] efa_register_mr\n[  192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000\n[  192.386423] pg_sz [0x80000000] umem_length[0xc0000000]\n[  192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3\n[  192.399559] hp_cnt[3], pages_in_hp[524288]\n[  192.403690] umem-\u003esgt_append.sgt.nents[1]\n[  192.407905] number entries: [1], pg_bit: [31]\n[  192.411397] biter-\u003e__sg_nents [1] biter-\u003e__sg [0000000008b0c5d8]\n[  192.415601] biter-\u003e__sg_advance [665837568] sg_dma_len[3221225472]\n[  192.419823] biter-\u003e__sg_nents [1] biter-\u003e__sg [0000000008b0c5d8]\n[  192.423976] biter-\u003e__sg_advance [2813321216] sg_dma_len[3221225472]\n[  192.428243] biter-\u003e__sg_nents [1] biter-\u003e__sg [0000000008b0c5d8]\n[  192.432397] biter-\u003e__sg_advance [665837568] sg_dma_len[3221225472]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db8603f0-dcc0-4c02-9762-50cd884321c8",
      "id": "CVE-2023-53045",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: don't let userspace block driver unbind\n\nIn the unbind callback for f_uac1 and f_uac2, a call to snd_card_free()\nvia g_audio_cleanup() will disconnect the card and then wait for all\nresources to be released, which happens when the refcount falls to zero.\nSince userspace can keep the refcount incremented by not closing the\nrelevant file descriptor, the call to unbind may block indefinitely.\nThis can cause a deadlock during reboot, as evidenced by the following\nblocked task observed on my machine:\n\n  task:reboot  state:D stack:0   pid:2827  ppid:569    flags:0x0000000c\n  Call trace:\n   __switch_to+0xc8/0x140\n   __schedule+0x2f0/0x7c0\n   schedule+0x60/0xd0\n   schedule_timeout+0x180/0x1d4\n   wait_for_completion+0x78/0x180\n   snd_card_free+0x90/0xa0\n   g_audio_cleanup+0x2c/0x64\n   afunc_unbind+0x28/0x60\n   ...\n   kernel_restart+0x4c/0xac\n   __do_sys_reboot+0xcc/0x1ec\n   __arm64_sys_reboot+0x28/0x30\n   invoke_syscall+0x4c/0x110\n   ...\n\nThe issue can also be observed by opening the card with arecord and\nthen stopping the process through the shell before unbinding:\n\n  # arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null\n  Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo\n  ^Z[1]+  Stopped                    arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null\n  # echo gadget.0 \u003e /sys/bus/gadget/drivers/configfs-gadget/unbind\n  (observe that the unbind command never finishes)\n\nFix the problem by using snd_card_free_when_closed() instead, which will\nstill disconnect the card as desired, but defer the task of freeing the\nresources to the core once userspace closes its file descriptor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f38a0f0-8125-492d-90a3-6fcf5e71f891",
      "id": "CVE-2023-53279",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: vmw_balloon: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "384afcaa-014d-40b8-b202-4fec2a302ef5",
      "id": "CVE-2023-53334",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: chipidea: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4882f157-9c40-4514-9ce1-9bb555a42414",
      "id": "CVE-2023-53408",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntrace/blktrace: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f56132f-3422-4587-9ab3-0c360025ab21",
      "id": "CVE-2023-6040",
      "description": "An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an attacker to achieve out-of-bounds access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e50c5f8-02f7-44e1-aec6-40ccf6da2cf5",
      "id": "CVE-2024-21803",
      "description": "Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.\n\nThis issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a47acef6-cc25-4703-9c13-400b69a102fe",
      "id": "CVE-2024-26656",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free bug\n\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\nFor example the following code:\n\nstatic void Syzkaller1(int fd)\n{\n\tstruct drm_amdgpu_gem_userptr arg;\n\tint ret;\n\n\targ.addr = 0xffffffffffff0000;\n\targ.size = 0x80000000; /*2 Gb*/\n\targ.flags = 0x7;\n\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\n}\n\nDue to the address and size are not valid there is a failure in\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\nThe following stack is below when the issue is reproduced when Kazan is enabled:\n\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\n[  +0.000010] Call Trace:\n[  +0.000006]  \u003cTASK\u003e\n[  +0.000007]  ? show_regs+0x6a/0x80\n[  +0.000018]  ? __warn+0xa5/0x1b0\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000018]  ? report_bug+0x24a/0x290\n[  +0.000022]  ? handle_bug+0x46/0x90\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b648fa0-2b21-4f9d-a7e7-e7d66559adc9",
      "id": "CVE-2024-26672",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'\n\nFixes the below:\n\ndrivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variable dereferenced before check 'mca_funcs' (see line 368)\n\n357 int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev,\n\t\t\t\t     enum amdgpu_mca_error_type type,\n358                                  int idx, struct mca_bank_entry *entry)\n359 {\n360         const struct amdgpu_mca_smu_funcs *mca_funcs =\n\t\t\t\t\t\tadev-\u003emca.mca_funcs;\n361         int count;\n362\n363         switch (type) {\n364         case AMDGPU_MCA_ERROR_TYPE_UE:\n365                 count = mca_funcs-\u003emax_ue_count;\n\nmca_funcs is dereferenced here.\n\n366                 break;\n367         case AMDGPU_MCA_ERROR_TYPE_CE:\n368                 count = mca_funcs-\u003emax_ce_count;\n\nmca_funcs is dereferenced here.\n\n369                 break;\n370         default:\n371                 return -EINVAL;\n372         }\n373\n374         if (idx \u003e= count)\n375                 return -EINVAL;\n376\n377         if (mca_funcs \u0026\u0026 mca_funcs-\u003emca_get_mca_entry)\n\t        ^^^^^^^^^\n\nChecked too late!",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5cc928f3-51d9-43fb-b82e-6243f4c15e42",
      "id": "CVE-2024-26686",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: do_task_stat: use sig-\u003estats_lock to gather the threads/children stats\n\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\n\nChange do_task_stat() to use sig-\u003estats_lock to gather the statistics\noutside of -\u003esiglock protected section, in the likely case this code will\nrun lockless.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2b7e8bf-36b8-42ed-ab55-ce625c994e2a",
      "id": "CVE-2024-26876",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: adv7511: fix crash on irq during probe\n\nMoved IRQ registration down to end of adv7511_probe().\n\nIf an IRQ already is pending during adv7511_probe\n(before adv7511_cec_init) then cec_received_msg_ts\ncould crash using uninitialized data:\n\n    Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5\n    Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP\n    Call trace:\n     cec_received_msg_ts+0x48/0x990 [cec]\n     adv7511_cec_irq_process+0x1cc/0x308 [adv7511]\n     adv7511_irq_process+0xd8/0x120 [adv7511]\n     adv7511_irq_handler+0x1c/0x30 [adv7511]\n     irq_thread_fn+0x30/0xa0\n     irq_thread+0x14c/0x238\n     kthread+0x190/0x1a8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b304d73-747e-4658-bedc-3e4b1723a363",
      "id": "CVE-2024-35821",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Set page uptodate in the correct place\n\nPage cache reads are lockless, so setting the freshly allocated page\nuptodate before we've overwritten it with the data it's supposed to have\nin it will allow a simultaneous reader to see old data.  Move the call\nto SetPageUptodate into ubifs_write_end(), which is after we copied the\nnew data into the page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "19116370-5aa6-4d62-9a82-f1f31aee1ba9",
      "id": "CVE-2024-35967",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix not validating setsockopt user input\n\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "928e2add-5896-4705-8cf1-3d948a583abc",
      "id": "CVE-2024-35998",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix lock ordering potential deadlock in cifs_sync_mid_result\n\nCoverity spotted that the cifs_sync_mid_result function could deadlock\n\n\"Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires\nlock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock\"\n\nAddresses-Coverity: 1590401 (\"Thread deadlock (ORDER_REVERSAL)\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1f47567-fb8f-43e2-a0f5-b42f65c6c67c",
      "id": "CVE-2021-3847",
      "description": "An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72d277ae-7e9f-48ff-9077-86e0accb9079",
      "id": "CVE-2024-38547",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries\n\nThe allocation failure of mycs-\u003eyuv_scaler_binary in load_video_binaries()\nis followed with a dereference of mycs-\u003eyuv_scaler_binary after the\nfollowing call chain:\n\nsh_css_pipe_load_binaries()\n  |-\u003e load_video_binaries(mycs-\u003eyuv_scaler_binary == NULL)\n  |\n  |-\u003e sh_css_pipe_unload_binaries()\n        |-\u003e unload_video_binaries()\n\nIn unload_video_binaries(), it calls to ia_css_binary_unload with argument\n\u0026pipe-\u003epipe_settings.video.yuv_scaler_binary[i], which refers to the\nsame memory slot as mycs-\u003eyuv_scaler_binary. Thus, a null-pointer\ndereference is triggered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef04344c-4c91-43c8-b584-aa38c1097921",
      "id": "CVE-2024-38634",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: max3100: Lock port-\u003elock when calling uart_handle_cts_change()\n\nuart_handle_cts_change() has to be called with port lock taken,\nSince we run it in a separate work, the lock may not be taken at\nthe time of running. Make sure that it's taken by explicitly doing\nthat. Without it we got a splat:\n\n  WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0\n  ...\n  Workqueue: max3100-0 max3100_work [max3100]\n  RIP: 0010:uart_handle_cts_change+0xa6/0xb0\n  ...\n   max3100_handlerx+0xc5/0x110 [max3100]\n   max3100_work+0x12a/0x340 [max3100]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b415ebfb-8b08-4e3b-8f92-e8b11b03a00e",
      "id": "CVE-2024-49571",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the field iparea_offset\nand the field ipv6_prefixes_cnt in proposal msg are from the\nremote client and can not be fully trusted. Especially the\nfield iparea_offset, once exceed the max value, there has the\nchance to access wrong address, and crash may happen.\n\nThis patch checks iparea_offset and ipv6_prefixes_cnt before using them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42ef83de-b13c-410f-82e0-138823b32dc1",
      "id": "CVE-2024-39509",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: remove unnecessary WARN_ON() in implement()\n\nSyzkaller hit a warning [1] in a call to implement() when trying\nto write a value into a field of smaller size in an output report.\n\nSince implement() already has a warn message printed out with the\nhelp of hid_warn() and value in question gets trimmed with:\n\t...\n\tvalue \u0026= m;\n\t...\nWARN_ON may be considered superfluous. Remove it to suppress future\nsyzkaller triggers.\n\n[1]\nWARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline]\nWARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863\nModules linked in:\nCPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nRIP: 0010:implement drivers/hid/hid-core.c:1451 [inline]\nRIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863\n...\nCall Trace:\n \u003cTASK\u003e\n __usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline]\n usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636\n hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:904 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "811b504b-4df7-4dbd-904a-fe40ddc35889",
      "id": "CVE-2024-42223",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: tda10048: Fix integer overflow\n\nstate-\u003extal_hz can be up to 16M, so it can overflow a 32 bit integer\nwhen multiplied by pll_mfactor.\n\nCreate a new 64 bit variable to hold the calculations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "853ce67d-3a6c-4a57-aa0d-26426c1778e5",
      "id": "CVE-2024-45003",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don't evict inode under the inode lru traversing context\n\nThe inode reclaiming process(See function prune_icache_sb) collects all\nreclaimable inodes and mark them with I_FREEING flag at first, at that\ntime, other processes will be stuck if they try getting these inodes\n(See function find_inode_fast), then the reclaiming process destroy the\ninodes by function dispose_list(). Some filesystems(eg. ext4 with\nea_inode feature, ubifs with xattr) may do inode lookup in the inode\nevicting callback function, if the inode lookup is operated under the\ninode lru traversing context, deadlock problems may happen.\n\nCase 1: In function ext4_evict_inode(), the ea inode lookup could happen\n        if ea_inode feature is enabled, the lookup process will be stuck\n\tunder the evicting context like this:\n\n 1. File A has inode i_reg and an ea inode i_ea\n 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru-\u003ei_ea\n 3. Then, following three processes running like this:\n\n    PA                              PB\n echo 2 \u003e /proc/sys/vm/drop_caches\n  shrink_slab\n   prune_dcache_sb\n   // i_reg is added into lru, lru-\u003ei_ea-\u003ei_reg\n   prune_icache_sb\n    list_lru_walk_one\n     inode_lru_isolate\n      i_ea-\u003ei_state |= I_FREEING // set inode state\n     inode_lru_isolate\n      __iget(i_reg)\n      spin_unlock(\u0026i_reg-\u003ei_lock)\n      spin_unlock(lru_lock)\n                                     rm file A\n                                      i_reg-\u003enlink = 0\n      iput(i_reg) // i_reg-\u003enlink is 0, do evict\n       ext4_evict_inode\n        ext4_xattr_delete_inode\n         ext4_xattr_inode_dec_ref_all\n          ext4_xattr_inode_iget\n           ext4_iget(i_ea-\u003ei_ino)\n            iget_locked\n             find_inode_fast\n              __wait_on_freeing_inode(i_ea) ----→ AA deadlock\n    dispose_list // cannot be executed by prune_icache_sb\n     wake_up_bit(\u0026i_ea-\u003ei_state)\n\nCase 2: In deleted inode writing function ubifs_jnl_write_inode(), file\n        deleting process holds BASEHD's wbuf-\u003eio_mutex while getting the\n\txattr inode, which could race with inode reclaiming process(The\n        reclaiming process could try locking BASEHD's wbuf-\u003eio_mutex in\n\tinode evicting function), then an ABBA deadlock problem would\n\thappen as following:\n\n 1. File A has inode ia and a xattr(with inode ixa), regular file B has\n    inode ib and a xattr.\n 2. getfattr(A, xattr_buf) // ixa is added into lru // lru-\u003eixa\n 3. Then, following three processes running like this:\n\n        PA                PB                        PC\n                echo 2 \u003e /proc/sys/vm/drop_caches\n                 shrink_slab\n                  prune_dcache_sb\n                  // ib and ia are added into lru, lru-\u003eixa-\u003eib-\u003eia\n                  prune_icache_sb\n                   list_lru_walk_one\n                    inode_lru_isolate\n                     ixa-\u003ei_state |= I_FREEING // set inode state\n                    inode_lru_isolate\n                     __iget(ib)\n                     spin_unlock(\u0026ib-\u003ei_lock)\n                     spin_unlock(lru_lock)\n                                                   rm file B\n                                                    ib-\u003enlink = 0\n rm file A\n  iput(ia)\n   ubifs_evict_inode(ia)\n    ubifs_jnl_delete_inode(ia)\n     ubifs_jnl_write_inode(ia)\n      make_reservation(BASEHD) // Lock wbuf-\u003eio_mutex\n      ubifs_iget(ixa-\u003ei_ino)\n       iget_locked\n        find_inode_fast\n         __wait_on_freeing_inode(ixa)\n          |          iput(ib) // ib-\u003enlink is 0, do evict\n          |           ubifs_evict_inode\n          |            ubifs_jnl_delete_inode(ib)\n          ↓             ubifs_jnl_write_inode\n     ABBA deadlock ←-----make_reservation(BASEHD)\n                   dispose_list // cannot be executed by prune_icache_sb\n                    wake_up_bit(\u0026ixa-\u003ei_state)\n\nFix the possible deadlock by using new inode state flag I_LRU_ISOLATING\nto pin the inode in memory while inode_lru_isolate(\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69f82e0b-87a0-42d6-ab52-0612bbf27bd1",
      "id": "CVE-2024-45016",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetem: fix return value if duplicate enqueue fails\n\nThere is a bug in netem_enqueue() introduced by\ncommit 5845f706388a (\"net: netem: fix skb length BUG_ON in __skb_to_sgvec\")\nthat can lead to a use-after-free.\n\nThis commit made netem_enqueue() always return NET_XMIT_SUCCESS\nwhen a packet is duplicated, which can cause the parent qdisc's q.qlen\nto be mistakenly incremented. When this happens qlen_notify() may be\nskipped on the parent during destruction, leaving a dangling pointer\nfor some classful qdiscs like DRR.\n\nThere are two ways for the bug happen:\n\n- If the duplicated packet is dropped by rootq-\u003eenqueue() and then\n  the original packet is also dropped.\n- If rootq-\u003eenqueue() sends the duplicated packet to a different qdisc\n  and the original packet is dropped.\n\nIn both cases NET_XMIT_SUCCESS is returned even though no packets\nare enqueued at the netem qdisc.\n\nThe fix is to defer the enqueue of the duplicate packet until after\nthe original packet has been guaranteed to return NET_XMIT_SUCCESS.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aef85c6e-e5af-4b4c-90d6-db29b5c80357",
      "id": "CVE-2024-46819",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: the warning dereferencing obj for nbio_v7_4\n\nif ras_manager obj null, don't print NBIO err data",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00a6bf06-b3c4-418e-895a-51ed45e09164",
      "id": "CVE-2024-47141",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc-\u003epinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL pointer issue while accessing\ndesc-\u003emux_owner.\n\nLet's say two processes A, B executing in pin_request() for the same pin\nand process A updates the desc-\u003emux_usecount but not yet updated the\ndesc-\u003emux_owner while process B see the desc-\u003emux_usecount which got\nupdated by A path and further executes strcmp and while accessing\ndesc-\u003emux_owner it crashes with NULL pointer.\n\nSerialize the access to mux related setting with a mutex lock.\n\n\tcpu0 (process A)\t\t\tcpu1(process B)\n\npinctrl_select_state() {\t\t  pinctrl_select_state() {\n  pin_request() {\t\t\t\tpin_request() {\n  ...\n\t\t\t\t\t\t ....\n    } else {\n         desc-\u003emux_usecount++;\n    \t\t\t\t\t\tdesc-\u003emux_usecount \u0026\u0026 strcmp(desc-\u003emux_owner, owner)) {\n\n         if (desc-\u003emux_usecount \u003e 1)\n               return 0;\n         desc-\u003emux_owner = owner;\n\n  }\t\t\t\t\t\t}",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "583a861b-e2cb-459e-81f1-48562e42fc36",
      "id": "CVE-2024-50039",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: accept TCA_STAB only for root qdisc\n\nMost qdiscs maintain their backlog using qdisc_pkt_len(skb)\non the assumption it is invariant between the enqueue()\nand dequeue() handlers.\n\nUnfortunately syzbot can crash a host rather easily using\na TBF + SFQ combination, with an STAB on SFQ [1]\n\nWe can't support TCA_STAB on arbitrary level, this would\nrequire to maintain per-qdisc storage.\n\n[1]\n[   88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[   88.798611] #PF: supervisor read access in kernel mode\n[   88.799014] #PF: error_code(0x0000) - not-present page\n[   88.799506] PGD 0 P4D 0\n[   88.799829] Oops: Oops: 0000 [#1] SMP NOPTI\n[   88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117\n[   88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq\n[ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a \u003c4c\u003e 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00\nAll code\n========\n   0:\t0f b7 50 12          \tmovzwl 0x12(%rax),%edx\n   4:\t48 8d 04 d5 00 00 00 \tlea    0x0(,%rdx,8),%rax\n   b:\t00\n   c:\t48 89 d6             \tmov    %rdx,%rsi\n   f:\t48 29 d0             \tsub    %rdx,%rax\n  12:\t48 8b 91 c0 01 00 00 \tmov    0x1c0(%rcx),%rdx\n  19:\t48 c1 e0 03          \tshl    $0x3,%rax\n  1d:\t48 01 c2             \tadd    %rax,%rdx\n  20:\t66 83 7a 1a 00       \tcmpw   $0x0,0x1a(%rdx)\n  25:\t7e c0                \tjle    0xffffffffffffffe7\n  27:\t48 8b 3a             \tmov    (%rdx),%rdi\n  2a:*\t4c 8b 07             \tmov    (%rdi),%r8\t\t\u003c-- trapping instruction\n  2d:\t4c 89 02             \tmov    %r8,(%rdx)\n  30:\t49 89 50 08          \tmov    %rdx,0x8(%r8)\n  34:\t48 c7 47 08 00 00 00 \tmovq   $0x0,0x8(%rdi)\n  3b:\t00\n  3c:\t48                   \trex.W\n  3d:\tc7                   \t.byte 0xc7\n  3e:\t07                   \t(bad)\n\t...\n\nCode starting with the faulting instruction\n===========================================\n   0:\t4c 8b 07             \tmov    (%rdi),%r8\n   3:\t4c 89 02             \tmov    %r8,(%rdx)\n   6:\t49 89 50 08          \tmov    %rdx,0x8(%r8)\n   a:\t48 c7 47 08 00 00 00 \tmovq   $0x0,0x8(%rdi)\n  11:\t00\n  12:\t48                   \trex.W\n  13:\tc7                   \t.byte 0xc7\n  14:\t07                   \t(bad)\n\t...\n[   88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206\n[   88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800\n[   88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000\n[   88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f\n[   88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140\n[   88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac\n[   88.806734] FS:  00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000\n[   88.807225] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0\n[   88.808165] Call Trace:\n[   88.808459]  \u003cTASK\u003e\n[   88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)\n[   88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715)\n[   88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)\n[   88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)\n[   88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq\n[   88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq\n[   88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f453121-d3db-487a-b087-4a638e96d786",
      "id": "CVE-2024-50166",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsl/fman: Fix refcount handling of fman-related devices\n\nIn mac_probe() there are multiple calls to of_find_device_by_node(),\nfman_bind() and fman_port_bind() which takes references to of_dev-\u003edev.\nNot all references taken by these calls are released later on error path\nin mac_probe() and in mac_remove() which lead to reference leaks.\n\nAdd references release.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bf4c7ff-3d26-4705-a0fd-b2f903afab06",
      "id": "CVE-2024-50282",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()\n\nAvoid a possible buffer overflow if size is larger than 4K.\n\n(cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8e1bb6b-840f-4b24-8369-8d1d4e910e69",
      "id": "CVE-2024-50299",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: properly validate chunk size in sctp_sf_ootb()\n\nA size validation fix similar to that in Commit 50619dbf8db7 (\"sctp: add\nsize validation when walking chunks\") is also required in sctp_sf_ootb()\nto address a crash reported by syzbot:\n\n  BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712\n  sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712\n  sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166\n  sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407\n  sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88\n  sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243\n  sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159\n  ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c805a8e7-f0de-418f-b93f-f222d122bd98",
      "id": "CVE-2024-53126",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: solidrun: Fix UB bug with devres\n\nIn psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to\npcim_iomap_regions() is placed on the stack. Neither\npcim_iomap_regions() nor the functions it calls copy that string.\n\nShould the string later ever be used, this, consequently, causes\nundefined behavior since the stack frame will by then have disappeared.\n\nFix the bug by allocating the strings on the heap through\ndevm_kasprintf().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "627aeaaf-4f01-49e0-b3e9-40dd8f4353a7",
      "id": "CVE-2024-53144",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE\n\nThis aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4\n(\"Bluetooth: Always request for user confirmation for Just Works\")\nalways request user confirmation with confirm_hint set since the\nlikes of bluetoothd have dedicated policy around JUST_WORKS method\n(e.g. main.conf:JustWorksRepairing).\n\nCVE: CVE-2024-8805",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e467ed6-b7d8-4acd-9543-c6ac8bad0587",
      "id": "CVE-2024-36938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue\n\nFix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which\nsyzbot reported [1].\n\n[1]\nBUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue\n\nwrite to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:\n sk_psock_stop_verdict net/core/skmsg.c:1257 [inline]\n sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843\n sk_psock_put include/linux/skmsg.h:459 [inline]\n sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648\n unix_release+0x4b/0x80 net/unix/af_unix.c:1048\n __sock_release net/socket.c:659 [inline]\n sock_close+0x68/0x150 net/socket.c:1421\n __fput+0x2c1/0x660 fs/file_table.c:422\n __fput_sync+0x44/0x60 fs/file_table.c:507\n __do_sys_close fs/open.c:1556 [inline]\n __se_sys_close+0x101/0x1b0 fs/open.c:1541\n __x64_sys_close+0x1f/0x30 fs/open.c:1541\n do_syscall_64+0xd3/0x1d0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nread to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:\n sk_psock_data_ready include/linux/skmsg.h:464 [inline]\n sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555\n sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606\n sk_psock_verdict_apply net/core/skmsg.c:1008 [inline]\n sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202\n unix_read_skb net/unix/af_unix.c:2546 [inline]\n unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682\n sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223\n unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x140/0x180 net/socket.c:745\n ____sys_sendmsg+0x312/0x410 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x1e9/0x280 net/socket.c:2667\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674\n do_syscall_64+0xd3/0x1d0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nvalue changed: 0xffffffff83d7feb0 -\u003e 0x0000000000000000\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G        W          6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\n\nPrior to this, commit 4cd12c6065df (\"bpf, sockmap: Fix NULL pointer\ndereference in sk_psock_verdict_data_ready()\") fixed one NULL pointer\nsimilarly due to no protection of saved_data_ready. Here is another\ndifferent caller causing the same issue because of the same reason. So\nwe should protect it with sk_callback_lock read lock because the writer\nside in the sk_psock_drop() uses \"write_lock_bh(\u0026sk-\u003esk_callback_lock);\".\n\nTo avoid errors that could happen in future, I move those two pairs of\nlock into the sk_psock_data_ready(), which is suggested by John Fastabend.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8bfe671-57e7-45b0-917f-f2884ed7c4c2",
      "id": "CVE-2024-53690",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: prevent use of deleted inode\n\nsyzbot reported a WARNING in nilfs_rmdir. [1]\n\nBecause the inode bitmap is corrupted, an inode with an inode number that\nshould exist as a \".nilfs\" file was reassigned by nilfs_mkdir for \"file0\",\ncausing an inode duplication during execution.  And this causes an\nunderflow of i_nlink in rmdir operations.\n\nThe inode is used twice by the same task to unmount and remove directories\n\".nilfs\" and \"file0\", it trigger warning in nilfs_rmdir.\n\nAvoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means\nthat this inode has been deleted, and iput is executed to reclaim it.\n\n[1]\nWARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407\n...\nCall Trace:\n \u003cTASK\u003e\n nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342\n vfs_rmdir+0x3a3/0x510 fs/namei.c:4394\n do_rmdir+0x3b5/0x580 fs/namei.c:4453\n __do_sys_rmdir fs/namei.c:4472 [inline]\n __se_sys_rmdir fs/namei.c:4470 [inline]\n __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26d8476a-58ef-48fa-a3ad-33ffaad3bc3e",
      "id": "CVE-2024-56548",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: don't query the device logical block size multiple times\n\nDevices block sizes may change. One of these cases is a loop device by\nusing ioctl LOOP_SET_BLOCK_SIZE.\n\nWhile this may cause other issues like IO being rejected, in the case of\nhfsplus, it will allocate a block by using that size and potentially write\nout-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the\nlatter function reads a different io_size.\n\nUsing a new min_io_size initally set to sb_min_blocksize works for the\npurposes of the original fix, since it will be set to the max between\nHFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the\nmax between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not\ninitialized.\n\nTested by mounting an hfsplus filesystem with loop block sizes 512, 1024\nand 4096.\n\nThe produced KASAN report before the fix looks like this:\n\n[  419.944641] ==================================================================\n[  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a\n[  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678\n[  419.947612]\n[  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84\n[  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[  419.950035] Call Trace:\n[  419.950384]  \u003cTASK\u003e\n[  419.950676]  dump_stack_lvl+0x57/0x78\n[  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.951830]  print_report+0x14c/0x49e\n[  419.952361]  ? __virt_addr_valid+0x267/0x278\n[  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d\n[  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.954231]  kasan_report+0x89/0xb0\n[  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.955367]  hfsplus_read_wrapper+0x659/0xa0a\n[  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10\n[  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9\n[  419.957214]  ? _raw_spin_unlock+0x1a/0x2e\n[  419.957772]  hfsplus_fill_super+0x348/0x1590\n[  419.958355]  ? hlock_class+0x4c/0x109\n[  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10\n[  419.959499]  ? __pfx_string+0x10/0x10\n[  419.960006]  ? lock_acquire+0x3e2/0x454\n[  419.960532]  ? bdev_name.constprop.0+0xce/0x243\n[  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10\n[  419.961799]  ? pointer+0x3f0/0x62f\n[  419.962277]  ? __pfx_pointer+0x10/0x10\n[  419.962761]  ? vsnprintf+0x6c4/0xfba\n[  419.963178]  ? __pfx_vsnprintf+0x10/0x10\n[  419.963621]  ? setup_bdev_super+0x376/0x3b3\n[  419.964029]  ? snprintf+0x9d/0xd2\n[  419.964344]  ? __pfx_snprintf+0x10/0x10\n[  419.964675]  ? lock_acquired+0x45c/0x5e9\n[  419.965016]  ? set_blocksize+0x139/0x1c1\n[  419.965381]  ? sb_set_blocksize+0x6d/0xae\n[  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10\n[  419.966179]  mount_bdev+0x12f/0x1bf\n[  419.966512]  ? __pfx_mount_bdev+0x10/0x10\n[  419.966886]  ? vfs_parse_fs_string+0xce/0x111\n[  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10\n[  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10\n[  419.968073]  legacy_get_tree+0x104/0x178\n[  419.968414]  vfs_get_tree+0x86/0x296\n[  419.968751]  path_mount+0xba3/0xd0b\n[  419.969157]  ? __pfx_path_mount+0x10/0x10\n[  419.969594]  ? kmem_cache_free+0x1e2/0x260\n[  419.970311]  do_mount+0x99/0xe0\n[  419.970630]  ? __pfx_do_mount+0x10/0x10\n[  419.971008]  __do_sys_mount+0x199/0x1c9\n[  419.971397]  do_syscall_64+0xd0/0x135\n[  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  419.972233] RIP: 0033:0x7c3cb812972e\n[  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48\n[  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5\n[  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e\n[  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI:\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "159968c7-f1c2-40fc-91b8-f45a2272b04a",
      "id": "CVE-2024-56574",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ts2020: fix null-ptr-deref in ts2020_probe()\n\nKASAN reported a null-ptr-deref issue when executing the following\ncommand:\n\n  # echo ts2020 0x20 \u003e /sys/bus/i2c/devices/i2c-0/new_device\n    KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n    CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n    RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020]\n    RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202\n    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffc0714809\n    RDX: 0000000000000002 RSI: ffff88811550be00 RDI: 0000000000000010\n    RBP: ffff888109868800 R08: 0000000000000001 R09: fffff52001577eb6\n    R10: 0000000000000000 R11: ffffc9000abbff50 R12: ffffffffc0714790\n    R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: 0000000000000001\n    FS:  00007f95f13b98c0(0000) GS:ffff888149280000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000555d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n    Call Trace:\n     \u003cTASK\u003e\n     ts2020_probe+0xad/0xe10 [ts2020]\n     i2c_device_probe+0x421/0xb40\n     really_probe+0x266/0x850\n    ...\n\nThe cause of the problem is that when using sysfs to dynamically register\nan i2c device, there is no platform data, but the probe process of ts2020\nneeds to use platform data, resulting in a null pointer being accessed.\n\nSolve this problem by adding checks to platform data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ff252f5-6942-4574-b01c-3ed5a394ff7a",
      "id": "CVE-2024-56644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: release expired exception dst cached in socket\n\nDst objects get leaked in ip6_negative_advice() when this function is\nexecuted for an expired IPv6 route located in the exception table. There\nare several conditions that must be fulfilled for the leak to occur:\n* an ICMPv6 packet indicating a change of the MTU for the path is received,\n  resulting in an exception dst being created\n* a TCP connection that uses the exception dst for routing packets must\n  start timing out so that TCP begins retransmissions\n* after the exception dst expires, the FIB6 garbage collector must not run\n  before TCP executes ip6_negative_advice() for the expired exception dst\n\nWhen TCP executes ip6_negative_advice() for an exception dst that has\nexpired and if no other socket holds a reference to the exception dst, the\nrefcount of the exception dst is 2, which corresponds to the increment\nmade by dst_init() and the increment made by the TCP socket for which the\nconnection is timing out. The refcount made by the socket is never\nreleased. The refcount of the dst is decremented in sk_dst_reset() but\nthat decrement is counteracted by a dst_hold() intentionally placed just\nbefore the sk_dst_reset() in ip6_negative_advice(). After\nip6_negative_advice() has finished, there is no other object tied to the\ndst. The socket lost its reference stored in sk_dst_cache and the dst is\nno longer in the exception table. The exception dst becomes a leaked\nobject.\n\nAs a result of this dst leak, an unbalanced refcount is reported for the\nloopback device of a net namespace being destroyed under kernels that do\nnot contain e5f80fcf869a (\"ipv6: give an IPv6 dev to blackhole_netdev\"):\nunregister_netdevice: waiting for lo to become free. Usage count = 2\n\nFix the dst leak by removing the dst_hold() in ip6_negative_advice(). The\npatch that introduced the dst_hold() in ip6_negative_advice() was\n92f1655aa2b22 (\"net: fix __dst_negative_advice() race\"). But 92f1655aa2b22\nmerely refactored the code with regards to the dst refcount so the issue\nwas present even before 92f1655aa2b22. The bug was introduced in\n54c1a859efd9f (\"ipv6: Don't drop cache route entry unless timer actually\nexpired.\") where the expired cached route is deleted and the sk_dst_cache\nmember of the socket is set to NULL by calling dst_negative_advice() but\nthe refcount belonging to the socket is left unbalanced.\n\nThe IPv4 version - ipv4_negative_advice() - is not affected by this bug.\nWhen the TCP connection times out ipv4_negative_advice() merely resets the\nsk_dst_cache of the socket while decrementing the refcount of the\nexception dst.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0fbf6b1e-5155-499d-a03c-1e12c1843ae4",
      "id": "CVE-2024-58014",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()\n\nIn 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN()\ninstead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access.\nCompile tested only.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0f15e26-3704-41b1-b822-ffdb6baeaddf",
      "id": "CVE-2024-40960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible NULL dereference in rt6_probe()\n\nsyzbot caught a NULL dereference in rt6_probe() [1]\n\nBail out if  __in6_dev_get() returns NULL.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f]\nCPU: 1 PID: 22444 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\n RIP: 0010:rt6_probe net/ipv6/route.c:656 [inline]\n RIP: 0010:find_match+0x8c4/0xf50 net/ipv6/route.c:758\nCode: 14 fd f7 48 8b 85 38 ff ff ff 48 c7 45 b0 00 00 00 00 48 8d b8 5c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 19\nRSP: 0018:ffffc900034af070 EFLAGS: 00010203\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004521000\nRDX: 00000000000000cb RSI: ffffffff8990d0cd RDI: 000000000000065c\nRBP: ffffc900034af150 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a\nR13: 1ffff92000695e18 R14: ffff8880244a1d20 R15: 0000000000000000\nFS:  00007f4844a5a6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31b27000 CR3: 000000002d42c000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  rt6_nh_find_match+0xfa/0x1a0 net/ipv6/route.c:784\n  nexthop_for_each_fib6_nh+0x26d/0x4a0 net/ipv4/nexthop.c:1496\n  __find_rr_leaf+0x6e7/0xe00 net/ipv6/route.c:825\n  find_rr_leaf net/ipv6/route.c:853 [inline]\n  rt6_select net/ipv6/route.c:897 [inline]\n  fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2195\n  ip6_pol_route+0x1cd/0x1150 net/ipv6/route.c:2231\n  pol_lookup_func include/net/ip6_fib.h:616 [inline]\n  fib6_rule_lookup+0x386/0x720 net/ipv6/fib6_rules.c:121\n  ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline]\n  ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2651\n  ip6_dst_lookup_tail.constprop.0+0x961/0x1760 net/ipv6/ip6_output.c:1147\n  ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250\n  rawv6_sendmsg+0xdab/0x4340 net/ipv6/raw.c:898\n  inet_sendmsg+0x119/0x140 net/ipv4/af_inet.c:853\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_write_iter+0x4b8/0x5c0 net/socket.c:1160\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x6b6/0x1140 fs/read_write.c:590\n  ksys_write+0x1f8/0x260 fs/read_write.c:643\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69c7a080-6ba4-43b2-b2ac-a08a89ae5643",
      "id": "CVE-2025-21640",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: sysctl: cookie_hmac_alg: avoid using current-\u003ensproxy\n\nAs mentioned in a previous commit of this series, using the 'net'\nstructure via 'current' is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader's/writer's netns vs only\n  from the opener's netns.\n\n- current-\u003ensproxy can be NULL in some cases, resulting in an 'Oops'\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe 'net' structure can be obtained from the table-\u003edata using\ncontainer_of().\n\nNote that table-\u003edata could also be used directly, as this is the only\nmember needed from the 'net' structure, but that would increase the size\nof this fix, to use '*data' everywhere 'net-\u003esctp.sctp_hmac_alg' is\nused.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "25e97879-db50-48e6-8065-3cfd971f0e3b",
      "id": "CVE-2025-21690",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Ratelimit warning logs to prevent VM denial of service\n\nIf there's a persistent error in the hypervisor, the SCSI warning for\nfailed I/O can flood the kernel log and max out CPU utilization,\npreventing troubleshooting from the VM side. Ratelimit the warning so\nit doesn't DoS the VM.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "59fdd173-dd29-4b2b-b266-b2b95b4afd33",
      "id": "CVE-2025-21772",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npartitions: mac: fix handling of bogus partition table\n\nFix several issues in partition probing:\n\n - The bailout for a bad partoffset must use put_dev_sector(), since the\n   preceding read_part_sector() succeeded.\n - If the partition table claims a silly sector size like 0xfff bytes\n   (which results in partition table entries straddling sector boundaries),\n   bail out instead of accessing out-of-bounds memory.\n - We must not assume that the partition table contains proper NUL\n   termination - use strnlen() and strncmp() instead of strlen() and\n   strcmp().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b094b0e-f6fc-4da7-87cf-69402034c504",
      "id": "CVE-2025-21833",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid use of NULL after WARN_ON_ONCE\n\nThere is a WARN_ON_ONCE to catch an unlikely situation when\ndomain_remove_dev_pasid can't find the `pasid`. In case it nevertheless\nhappens we must avoid using a NULL pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fece8ae1-4957-4414-b898-bd234dd92c2a",
      "id": "CVE-2025-21862",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix incorrect initialization order\n\nSyzkaller reports the following bug:\n\nBUG: spinlock bad magic on CPU#1, syz-executor.0/7995\n lock: 0xffff88805303f3e0, .magic: 00000000, .owner: \u003cnone\u003e/-1, .owner_cpu: 0\nCPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G            E     5.10.209+ #1\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x119/0x179 lib/dump_stack.c:118\n debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]\n do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]\n _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159\n reset_per_cpu_data+0xe6/0x240 [drop_monitor]\n net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor]\n genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739\n genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800\n netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497\n genl_rcv+0x29/0x40 net/netlink/genetlink.c:811\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec net/socket.c:651 [inline]\n __sock_sendmsg+0x157/0x190 net/socket.c:663\n ____sys_sendmsg+0x712/0x870 net/socket.c:2378\n ___sys_sendmsg+0xf8/0x170 net/socket.c:2432\n __sys_sendmsg+0xea/0x1b0 net/socket.c:2461\n do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x62/0xc7\nRIP: 0033:0x7f3f9815aee9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f3f9826d050 RCX: 00007f3f9815aee9\nRDX: 0000000020000000 RSI: 0000000020001300 RDI: 0000000000000007\nRBP: 00007f3f981b63bd R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768\n\nIf drop_monitor is built as a kernel module, syzkaller may have time\nto send a netlink NET_DM_CMD_START message during the module loading.\nThis will call the net_dm_monitor_start() function that uses\na spinlock that has not yet been initialized.\n\nTo fix this, let's place resource initialization above the registration\nof a generic netlink family.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40007626-c071-4f68-9f7b-5b75c1668d87",
      "id": "CVE-2025-37850",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()\n\nWith CONFIG_COMPILE_TEST \u0026\u0026 !CONFIG_HAVE_CLK, pwm_mediatek_config() has a\ndivide-by-zero in the following line:\n\n\tdo_div(resolution, clk_get_rate(pc-\u003eclk_pwms[pwm-\u003ehwpwm]));\n\ndue to the fact that the !CONFIG_HAVE_CLK version of clk_get_rate()\nreturns zero.\n\nThis is presumably just a theoretical problem: COMPILE_TEST overrides\nthe dependency on RALINK which would select COMMON_CLK.  Regardless it's\na good idea to check for the error explicitly to avoid divide-by-zero.\n\nFixes the following warning:\n\n  drivers/pwm/pwm-mediatek.o: warning: objtool: .text: unexpected end of section\n\n[ukleinek: s/CONFIG_CLK/CONFIG_HAVE_CLK/]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "976ac599-b9a0-44ff-87cc-6480f0707abb",
      "id": "CVE-2025-37892",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: inftlcore: Add error check for inftl_read_oob()\n\nIn INFTL_findwriteunit(), the return value of inftl_read_oob()\nneed to be checked. A proper implementation can be\nfound in INFTL_deleteblock(). The status will be set as\nSECTOR_IGNORE to break from the while-loop correctly\nif the inftl_read_oob() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9ae05bf-ebb4-4a4d-9fc1-152a1cf030e1",
      "id": "CVE-2025-38000",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()\n\nWhen enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the\nchild qdisc's peek() operation before incrementing sch-\u003eq.qlen and\nsch-\u003eqstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may\ntrigger an immediate dequeue and potential packet drop. In such cases,\nqdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog\nhave not yet been updated, leading to inconsistent queue accounting. This\ncan leave an empty HFSC class in the active list, causing further\nconsequences like use-after-free.\n\nThis patch fixes the bug by moving the increment of sch-\u003eq.qlen and\nsch-\u003eqstats.backlog before the call to the child qdisc's peek() operation.\nThis ensures that queue length and backlog are always accurate when packet\ndrops or dequeues are triggered during the peek.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34b43840-679a-4388-8a23-ca809868c65a",
      "id": "CVE-2025-38072",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibnvdimm/labels: Fix divide error in nd_label_data_init()\n\nIf a faulty CXL memory device returns a broken zero LSA size in its\nmemory device information (Identify Memory Device (Opcode 4000h), CXL\nspec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm\ndriver:\n\n Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI\n RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]\n\nCode and flow:\n\n1) CXL Command 4000h returns LSA size = 0\n2) config_size is assigned to zero LSA size (CXL pmem driver):\n\ndrivers/cxl/pmem.c:             .config_size = mds-\u003elsa_size,\n\n3) max_xfer is set to zero (nvdimm driver):\n\ndrivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd-\u003ensarea.max_xfer, config_size);\n\n4) A subsequent DIV_ROUND_UP() causes a division by zero:\n\ndrivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */\ndrivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,\ndrivers/nvdimm/label.c-                 config_size);\n\nFix this by checking the config size parameter by extending an\nexisting check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10965370-d0cb-4928-a001-29a8d7343d98",
      "id": "CVE-2025-38075",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix timeout on deleted connection\n\nNOPIN response timer may expire on a deleted connection and crash with\nsuch logs:\n\nDid not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d\n\nBUG: Kernel NULL pointer dereference on read at 0x00000000\nNIP  strlcpy+0x8/0xb0\nLR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod]\nCall Trace:\n iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod]\n call_timer_fn+0x58/0x1f0\n run_timer_softirq+0x740/0x860\n __do_softirq+0x16c/0x420\n irq_exit+0x188/0x1c0\n timer_interrupt+0x184/0x410\n\nThat is because nopin response timer may be re-started on nopin timer\nexpiration.\n\nStop nopin timer before stopping the nopin response timer to be sure\nthat no one of them will be re-started.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2942015f-06a9-458f-91a5-26362f358321",
      "id": "CVE-2025-38333",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to bail out in get_new_segment()\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 579 at fs/f2fs/segment.c:2832 new_curseg+0x5e8/0x6dc\npc : new_curseg+0x5e8/0x6dc\nCall trace:\n new_curseg+0x5e8/0x6dc\n f2fs_allocate_data_block+0xa54/0xe28\n do_write_page+0x6c/0x194\n f2fs_do_write_node_page+0x38/0x78\n __write_node_page+0x248/0x6d4\n f2fs_sync_node_pages+0x524/0x72c\n f2fs_write_checkpoint+0x4bc/0x9b0\n __checkpoint_and_complete_reqs+0x80/0x244\n issue_checkpoint_thread+0x8c/0xec\n kthread+0x114/0x1bc\n ret_from_fork+0x10/0x20\n\nget_new_segment() detects inconsistent status in between free_segmap\nand free_secmap, let's record such error into super block, and bail\nout get_new_segment() instead of continue using the segment.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9343abf-dff8-4e62-b2d8-38e1eb47e63e",
      "id": "CVE-2025-38395",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: gpio: Fix the out-of-bounds access to drvdata::gpiods\n\ndrvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But\nthe memory is allocated for only one pointer. This will lead to\nout-of-bounds access later in the code if 'config::ngpios' is \u003e 1. So\nfix the code to allocate enough memory to hold 'config::ngpios' of GPIO\ndescriptors.\n\nWhile at it, also move the check for memory allocation failure to be below\nthe allocation to make it more readable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c7cb4451-0d31-4e38-90b4-d74990be0ae3",
      "id": "CVE-2025-38416",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: uart: Set tty-\u003edisc_data only in success path\n\nSetting tty-\u003edisc_data before opening the NCI device means we need to\nclean it up on error paths.  This also opens some short window if device\nstarts sending data, even before NCIUARTSETDRIVER IOCTL succeeded\n(broken hardware?).  Close the window by exposing tty-\u003edisc_data only on\nthe success path, when opening of the NCI device and try_module_get()\nsucceeds.\n\nThe code differs in error path in one aspect: tty-\u003edisc_data won't be\never assigned thus NULL-ified.  This however should not be relevant\ndifference, because of \"tty-\u003edisc_data=NULL\" in nci_uart_tty_open().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1021c79-ce1a-47fc-9d14-fec24c046315",
      "id": "CVE-2025-38436",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/scheduler: signal scheduled fence when kill job\n\nWhen an entity from application B is killed, drm_sched_entity_kill()\nremoves all jobs belonging to that entity through\ndrm_sched_entity_kill_jobs_work(). If application A's job depends on a\nscheduled fence from application B's job, and that fence is not properly\nsignaled during the killing process, application A's dependency cannot be\ncleared.\n\nThis leads to application A hanging indefinitely while waiting for a\ndependency that will never be resolved. Fix this issue by ensuring that\nscheduled fences are properly signaled when an entity is killed, allowing\ndependent applications to continue execution.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a4bec39-7edf-479e-9448-3477f0c770b0",
      "id": "CVE-2025-38584",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Fix pd UAF once and for all\n\nThere is a race condition/UAF in padata_reorder that goes back\nto the initial commit.  A reference count is taken at the start\nof the process in padata_do_parallel, and released at the end in\npadata_serial_worker.\n\nThis reference count is (and only is) required for padata_replace\nto function correctly.  If padata_replace is never called then\nthere is no issue.\n\nIn the function padata_reorder which serves as the core of padata,\nas soon as padata is added to queue-\u003eserial.list, and the associated\nspin lock released, that padata may be processed and the reference\ncount on pd would go away.\n\nFix this by getting the next padata before the squeue-\u003eserial lock\nis released.\n\nIn order to make this possible, simplify padata_reorder by only\ncalling it once the next padata arrives.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7245298-bfae-4512-803f-725e72b54a31",
      "id": "CVE-2025-38626",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode\n\nw/ \"mode=lfs\" mount option, generic/299 will cause system panic as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2835!\nCall Trace:\n \u003cTASK\u003e\n f2fs_allocate_data_block+0x6f4/0xc50\n f2fs_map_blocks+0x970/0x1550\n f2fs_iomap_begin+0xb2/0x1e0\n iomap_iter+0x1d6/0x430\n __iomap_dio_rw+0x208/0x9a0\n f2fs_file_write_iter+0x6b3/0xfa0\n aio_write+0x15d/0x2e0\n io_submit_one+0x55e/0xab0\n __x64_sys_io_submit+0xa5/0x230\n do_syscall_64+0x84/0x2f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0010:new_curseg+0x70f/0x720\n\nThe root cause of we run out-of-space is: in f2fs_map_blocks(), f2fs may\ntrigger foreground gc only if it allocates any physical block, it will be\na little bit later when there is multiple threads writing data w/\naio/dio/bufio method in parallel, since we always use OPU in lfs mode, so\nf2fs_map_blocks() does block allocations aggressively.\n\nIn order to fix this issue, let's give a chance to trigger foreground\ngc in prior to block allocation in f2fs_map_blocks().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9fe20c09-f84a-4577-bcb4-9d09d542b324",
      "id": "CVE-2024-40995",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()\n\nsyzbot found hanging tasks waiting on rtnl_lock [1]\n\nA reproducer is available in the syzbot bug.\n\nWhen a request to add multiple actions with the same index is sent, the\nsecond request will block forever on the first request. This holds\nrtnl_lock, and causes tasks to hang.\n\nReturn -EAGAIN to prevent infinite looping, while keeping documented\nbehavior.\n\n[1]\n\nINFO: task kworker/1:0:5088 blocked for more than 143 seconds.\nNot tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000\nWorkqueue: events_power_efficient reg_check_chans_work\nCall Trace:\n\u003cTASK\u003e\ncontext_switch kernel/sched/core.c:5409 [inline]\n__schedule+0xf15/0x5d00 kernel/sched/core.c:6746\n__schedule_loop kernel/sched/core.c:6823 [inline]\nschedule+0xe7/0x350 kernel/sched/core.c:6838\nschedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895\n__mutex_lock_common kernel/locking/mutex.c:684 [inline]\n__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752\nwiphy_lock include/net/cfg80211.h:5953 [inline]\nreg_leave_invalid_chans net/wireless/reg.c:2466 [inline]\nreg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4436ca80-6503-485d-a13e-de95ea485f43",
      "id": "CVE-2025-39829",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntrace/fgraph: Fix the warning caused by missing unregister notifier\n\nThis warning was triggered during testing on v6.16:\n\nnotifier callback ftrace_suspend_notifier_call already registered\nWARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0\n...\nCall Trace:\n \u003cTASK\u003e\n blocking_notifier_chain_register+0x34/0x60\n register_ftrace_graph+0x330/0x410\n ftrace_profile_write+0x1e9/0x340\n vfs_write+0xf8/0x420\n ? filp_flush+0x8a/0xa0\n ? filp_close+0x1f/0x30\n ? do_dup2+0xaf/0x160\n ksys_write+0x65/0xe0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nWhen writing to the function_profile_enabled interface, the notifier was\nnot unregistered after start_graph_tracing failed, causing a warning the\nnext time function_profile_enabled was written.\n\nFixed by adding unregister_pm_notifier in the exception path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c6f5133-01e7-4fc2-a27c-f6835f565a3f",
      "id": "CVE-2019-25162",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: Fix a potential use after free\n\nFree the adap structure only after we are done using it.\nThis patch just moves the put_device() down a bit to avoid the\nuse after free.\n\n[wsa: added comment to the code, added Fixes tag]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "58b2bb65-6521-48c4-9c4c-fd940e6b3516",
      "id": "CVE-2020-11565",
      "description": "An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9dfe202b-6377-4468-918f-e782007d4f4a",
      "id": "CVE-2020-36313",
      "description": "An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0774a964ef56. This affects arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3e1dccd-4c8d-4385-a46b-819f7b23abbf",
      "id": "CVE-2020-36783",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: img-scb: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in functions img_i2c_xfer and img_i2c_init.\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec71a683-40aa-46c0-8e6c-e9c796353567",
      "id": "CVE-2020-36784",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cadence: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in functions cdns_i2c_master_xfer and cdns_reg_slave.\n\nHowever, pm_runtime_get_sync will increment pm usage counter\neven failed. Forgetting to putting operation will result in a\nreference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ad07cfb-f9aa-4ed1-aca3-6c16701cc3f4",
      "id": "CVE-2024-53114",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client\n\nA number of Zen4 client SoCs advertise the ability to use virtualized\nVMLOAD/VMSAVE, but using these instructions is reported to be a cause\nof a random host reboot.\n\nThese instructions aren't intended to be advertised on Zen4 client\nso clear the capability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06bfb67d-e1ed-461c-91d5-fa81f8c2e290",
      "id": "CVE-2021-47086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet/pep: refuse to enable an unbound pipe\n\nThis ioctl() implicitly assumed that the socket was already bound to\na valid local socket name, i.e. Phonet object. If the socket was not\nbound, two separate problems would occur:\n\n1) We'd send an pipe enablement request with an invalid source object.\n2) Later socket calls could BUG on the socket unexpectedly being\n   connected yet not bound to a valid object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93300c70-c2cd-46af-a05a-b0a9e4aee5e4",
      "id": "CVE-2021-47233",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: rt4801: Fix NULL pointer dereference if priv-\u003eenable_gpios is NULL\n\ndevm_gpiod_get_array_optional may return NULL if no GPIO was assigned.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a5b6757-9042-4c06-8acf-0ac4e57dea87",
      "id": "CVE-2021-47355",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: nicstar: Fix possible use-after-free in nicstar_cleanup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc12e119-02a1-4d74-b2d8-89f8b0e2f6ef",
      "id": "CVE-2022-3176",
      "description": "There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34a99f5e-809d-484e-816d-ad4c12c3a6f2",
      "id": "CVE-2022-47519",
      "description": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4eb010bc-5c10-48a8-ad52-b038f84e9c67",
      "id": "CVE-2022-48654",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()\n\nnf_osf_find() incorrectly returns true on mismatch, this leads to\ncopying uninitialized memory area in nft_osf which can be used to leak\nstale kernel stack data to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17708f11-2160-44b5-b7a1-9d0f4415fbc1",
      "id": "CVE-2022-48758",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()\n\nThe bnx2fc_destroy() functions are removing the interface before calling\ndestroy_work. This results multiple WARNings from sysfs_remove_group() as\nthe controller rport device attributes are removed too early.\n\nReplace the fcoe_port's destroy_work queue. It's not needed.\n\nThe problem is easily reproducible with the following steps.\n\nExample:\n\n  $ dmesg -w \u0026\n  $ systemctl enable --now fcoe\n  $ fipvlan -s -c ens2f1\n  $ fcoeadm -d ens2f1.802\n  [  583.464488] host2: libfc: Link down on port (7500a1)\n  [  583.472651] bnx2fc: 7500a1 - rport not created Yet!!\n  [  583.490468] ------------[ cut here ]------------\n  [  583.538725] sysfs group 'power' not found for kobject 'rport-2:0-0'\n  [  583.568814] WARNING: CPU: 3 PID: 192 at fs/sysfs/group.c:279 sysfs_remove_group+0x6f/0x80\n  [  583.607130] Modules linked in: dm_service_time 8021q garp mrp stp llc bnx2fc cnic uio rpcsec_gss_krb5 auth_rpcgss nfsv4 ...\n  [  583.942994] CPU: 3 PID: 192 Comm: kworker/3:2 Kdump: loaded Not tainted 5.14.0-39.el9.x86_64 #1\n  [  583.984105] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013\n  [  584.016535] Workqueue: fc_wq_2 fc_rport_final_delete [scsi_transport_fc]\n  [  584.050691] RIP: 0010:sysfs_remove_group+0x6f/0x80\n  [  584.074725] Code: ff 5b 48 89 ef 5d 41 5c e9 ee c0 ff ff 48 89 ef e8 f6 b8 ff ff eb d1 49 8b 14 24 48 8b 33 48 c7 c7 ...\n  [  584.162586] RSP: 0018:ffffb567c15afdc0 EFLAGS: 00010282\n  [  584.188225] RAX: 0000000000000000 RBX: ffffffff8eec4220 RCX: 0000000000000000\n  [  584.221053] RDX: ffff8c1586ce84c0 RSI: ffff8c1586cd7cc0 RDI: ffff8c1586cd7cc0\n  [  584.255089] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb567c15afc00\n  [  584.287954] R10: ffffb567c15afbf8 R11: ffffffff8fbe7f28 R12: ffff8c1486326400\n  [  584.322356] R13: ffff8c1486326480 R14: ffff8c1483a4a000 R15: 0000000000000004\n  [  584.355379] FS:  0000000000000000(0000) GS:ffff8c1586cc0000(0000) knlGS:0000000000000000\n  [  584.394419] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [  584.421123] CR2: 00007fe95a6f7840 CR3: 0000000107674002 CR4: 00000000000606e0\n  [  584.454888] Call Trace:\n  [  584.466108]  device_del+0xb2/0x3e0\n  [  584.481701]  device_unregister+0x13/0x60\n  [  584.501306]  bsg_unregister_queue+0x5b/0x80\n  [  584.522029]  bsg_remove_queue+0x1c/0x40\n  [  584.541884]  fc_rport_final_delete+0xf3/0x1d0 [scsi_transport_fc]\n  [  584.573823]  process_one_work+0x1e3/0x3b0\n  [  584.592396]  worker_thread+0x50/0x3b0\n  [  584.609256]  ? rescuer_thread+0x370/0x370\n  [  584.628877]  kthread+0x149/0x170\n  [  584.643673]  ? set_kthread_struct+0x40/0x40\n  [  584.662909]  ret_from_fork+0x22/0x30\n  [  584.680002] ---[ end trace 53575ecefa942ece ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f43c54c5-263e-4a62-9eaf-252f3b44b77a",
      "id": "CVE-2022-49112",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: fix monitor mode crash with sdio driver\n\nmt7921s driver may receive frames with fragment buffers. If there is a\nCTS packet received in monitor mode, the payload is 10 bytes only and\nneed 6 bytes header padding after RXD buffer. However, only RXD in the\nfirst linear buffer, if we pull buffer size RXD-size+6 bytes with\nskb_pull(), that would trigger \"BUG_ON(skb-\u003elen \u003c skb-\u003edata_len)\" in\n__skb_pull().\n\nTo avoid the nonlinear buffer issue, enlarge the RXD size from 128 to\n256 to make sure all MCU operation in linear buffer.\n\n[   52.007562] kernel BUG at include/linux/skbuff.h:2313!\n[   52.007578] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP\n[   52.007987] pc : skb_pull+0x48/0x4c\n[   52.008015] lr : mt7921_queue_rx_skb+0x494/0x890 [mt7921_common]\n[   52.008361] Call trace:\n[   52.008377]  skb_pull+0x48/0x4c\n[   52.008400]  mt76s_net_worker+0x134/0x1b0 [mt76_sdio 35339a92c6eb7d4bbcc806a1d22f56365565135c]\n[   52.008431]  __mt76_worker_fn+0xe8/0x170 [mt76 ef716597d11a77150bc07e3fdd68eeb0f9b56917]\n[   52.008449]  kthread+0x148/0x3ac\n[   52.008466]  ret_from_fork+0x10/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c47041b1-482b-4088-bcde-8c1d23b4dc8a",
      "id": "CVE-2022-49275",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: m_can: m_can_tx_handler(): fix use after free of skb\n\ncan_put_echo_skb() will clone skb then free the skb. Move the\ncan_put_echo_skb() for the m_can version 3.0.x directly before the\nstart of the xmit in hardware, similar to the 3.1.x branch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "204daa37-6d76-4d25-933b-5fb57720d5ce",
      "id": "CVE-2022-49295",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: call genl_unregister_family() first in nbd_cleanup()\n\nOtherwise there may be race between module removal and the handling of\nnetlink command, which can lead to the oops as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000098\n  Oops: 0002 [#1] SMP PTI\n  CPU: 1 PID: 31299 Comm: nbd-client Tainted: G            E     5.14.0-rc4\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  RIP: 0010:down_write+0x1a/0x50\n  Call Trace:\n   start_creating+0x89/0x130\n   debugfs_create_dir+0x1b/0x130\n   nbd_start_device+0x13d/0x390 [nbd]\n   nbd_genl_connect+0x42f/0x748 [nbd]\n   genl_family_rcv_msg_doit.isra.0+0xec/0x150\n   genl_rcv_msg+0xe5/0x1e0\n   netlink_rcv_skb+0x55/0x100\n   genl_rcv+0x29/0x40\n   netlink_unicast+0x1a8/0x250\n   netlink_sendmsg+0x21b/0x430\n   ____sys_sendmsg+0x2a4/0x2d0\n   ___sys_sendmsg+0x81/0xc0\n   __sys_sendmsg+0x62/0xb0\n   __x64_sys_sendmsg+0x1f/0x30\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  Modules linked in: nbd(E-)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b5f3ab12-2f46-48ae-8625-cf3f48ac61ab",
      "id": "CVE-2022-49354",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe\n\nof_find_device_by_node() takes reference, we should use put_device()\nto release it when not need anymore.\nAdd missing put_device() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c0af385f-e3dd-44b0-9a47-2514e1ce9994",
      "id": "CVE-2022-49975",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't redirect packets with invalid pkt_len\n\nSyzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any\nskbs, that is, the flow-\u003ehead is null.\nThe root cause, as the [2] says, is because that bpf_prog_test_run_skb()\nrun a bpf prog which redirects empty skbs.\nSo we should determine whether the length of the packet modified by bpf\nprog or others like bpf_prog_test is valid before forwarding it directly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "123e0784-3884-4d19-af5b-ad9ee333277b",
      "id": "CVE-2022-49987",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: call __md_stop_writes in md_stop\n\nFrom the link [1], we can see raid1d was running even after the path\nraid_dtr -\u003e md_stop -\u003e __md_stop.\n\nLet's stop write first in destructor to align with normal md-raid to\nfix the KASAN issue.\n\n[1]. https://lore.kernel.org/linux-raid/CAPhsuW5gc4AakdGNdF8ubpezAuDLFOYUO_sfMZcec6hQFm8nhg@mail.gmail.com/T/#m7f12bf90481c02c6d2da68c64aeed4779b7df74a",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "535ebf46-f722-4077-a098-54cf8f83eaff",
      "id": "CVE-2022-50077",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix reference count leak in aa_pivotroot()\n\nThe aa_pivotroot() function has a reference counting bug in a specific\npath. When aa_replace_current_label() returns on success, the function\nforgets to decrement the reference count of “target”, which is\nincreased earlier by build_pivotroot(), causing a reference leak.\n\nFix it by decreasing the refcount of “target” in that path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "387d88a8-6e86-4394-b5e1-6a663ec345d7",
      "id": "CVE-2024-42267",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()\n\nHandle VM_FAULT_SIGSEGV in the page fault path so that we correctly\nkill the process and we don't BUG() the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a89e93e-ee2b-495f-a0f1-b063fb311a31",
      "id": "CVE-2022-50140",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick/ms_block: Fix a memory leak\n\n'erased_blocks_bitmap' is never freed. As it is allocated at the same time\nas 'used_blocks_bitmap', it is likely that it should be freed also at the\nsame time.\n\nAdd the corresponding bitmap_free() in msb_data_clear().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fb77aca-74b9-4ae2-8599-c29c2a5e21c3",
      "id": "CVE-2022-50340",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vimc: Fix wrong function called when vimc_init() fails\n\nIn vimc_init(), when platform_driver_register(\u0026vimc_pdrv) fails,\nplatform_driver_unregister(\u0026vimc_pdrv) is wrongly called rather than\nplatform_device_unregister(\u0026vimc_pdev), which causes kernel warning:\n\n Unexpected driver unregister!\n WARNING: CPU: 1 PID: 14517 at drivers/base/driver.c:270 driver_unregister+0x8f/0xb0\n RIP: 0010:driver_unregister+0x8f/0xb0\n Call Trace:\n  \u003cTASK\u003e\n  vimc_init+0x7d/0x1000 [vimc]\n  do_one_initcall+0xd0/0x4e0\n  do_init_module+0x1cf/0x6b0\n  load_module+0x65c2/0x7820",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d9520fdd-17ea-4e20-a803-333e0f9c7ddd",
      "id": "CVE-2022-50366",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowercap: intel_rapl: fix UBSAN shift-out-of-bounds issue\n\nWhen value \u003c time_unit, the parameter of ilog2() will be zero and\nthe return value is -1. u64(-1) is too large for shift exponent\nand then will trigger shift-out-of-bounds:\n\nshift exponent 18446744073709551615 is too large for 32-bit type 'int'\nCall Trace:\n rapl_compute_time_window_core\n rapl_write_data_raw\n set_time_window\n store_constraint_time_window_us",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98d22e07-f6dc-4dce-9e01-bbaebc51c9ae",
      "id": "CVE-2023-1859",
      "description": "A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97daa52b-ce5d-47a6-86c8-7aae5abf04a1",
      "id": "CVE-2023-52607",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: Fix null-pointer dereference in pgtable_cache_add\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5aca6b30-d4cb-451d-802a-dd46967f9eae",
      "id": "CVE-2023-52612",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: scomp - fix req-\u003edst buffer overflow\n\nThe req-\u003edst buffer size should be checked before copying from the\nscomp_scratch-\u003edst to avoid req-\u003edst buffer overflow problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9ac2060a-221c-41b4-b778-8dc2a776789d",
      "id": "CVE-2023-52867",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: possible buffer overflow\n\nBuffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is\nchecked after access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1915d424-7474-4175-a45e-c8cbb7a3eed7",
      "id": "CVE-2023-52887",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new\n\nThis patch enhances error handling in scenarios with RTS (Request to\nSend) messages arriving closely. It replaces the less informative WARN_ON_ONCE\nbacktraces with a new error handling method. This provides clearer error\nmessages and allows for the early termination of problematic sessions.\nPreviously, sessions were only released at the end of j1939_xtp_rx_rts().\n\nPotentially this could be reproduced with something like:\ntestj1939 -r vcan0:0x80 \u0026\nwhile true; do\n\t# send first RTS\n\tcansend vcan0 18EC8090#1014000303002301;\n\t# send second RTS\n\tcansend vcan0 18EC8090#1014000303002301;\n\t# send abort\n\tcansend vcan0 18EC8090#ff00000000002301;\ndone",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7178d82a-48da-4253-8bb8-521703125784",
      "id": "CVE-2023-53178",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix zswap writeback race condition\n\nThe zswap writeback mechanism can cause a race condition resulting in\nmemory corruption, where a swapped out page gets swapped in with data that\nwas written to a different page.\n\nThe race unfolds like this:\n1. a page with data A and swap offset X is stored in zswap\n2. page A is removed off the LRU by zpool driver for writeback in\n   zswap-shrink work, data for A is mapped by zpool driver\n3. user space program faults and invalidates page entry A, offset X is\n   considered free\n4. kswapd stores page B at offset X in zswap (zswap could also be\n   full, if so, page B would then be IOed to X, then skip step 5.)\n5. entry A is replaced by B in tree-\u003erbroot, this doesn't affect the\n   local reference held by zswap-shrink work\n6. zswap-shrink work writes back A at X, and frees zswap entry A\n7. swapin of slot X brings A in memory instead of B\n\nThe fix:\nOnce the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW),\nzswap-shrink work just checks that the local zswap_entry reference is\nstill the same as the one in the tree.  If it's not the same it means that\nit's either been invalidated or replaced, in both cases the writeback is\naborted because the local entry contains stale data.\n\nReproducer:\nI originally found this by running `stress` overnight to validate my work\non the zswap writeback mechanism, it manifested after hours on my test\nmachine.  The key to make it happen is having zswap writebacks, so\nwhatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do\nthe trick.\n\nIn order to reproduce this faster on a vm, I setup a system with ~100M of\navailable memory and a 500M swap file, then running `stress --vm 1\n--vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens\nof minutes.  One can speed things up even more by swinging\n/sys/module/zswap/parameters/max_pool_percent up and down between, say, 20\nand 1; this makes it reproduce in tens of seconds.  It's crucial to set\n`--vm-stride` to something other than 4096 otherwise `stress` won't\nrealize that memory has been corrupted because all pages would have the\nsame data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c33a719-6e40-43d8-95c8-6d9caa1a9a42",
      "id": "CVE-2023-53179",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c\n\nThe missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can\nlead to the use of wrong `CIDR_POS(c)` for calculating array offsets,\nwhich can lead to integer underflow. As a result, it leads to slab\nout-of-bound access.\nThis patch adds back the IP_SET_HASH_WITH_NET0 macro to\nip_set_hash_netportnet to address the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a5e2c2c-51f3-4257-b4d5-8df050f90775",
      "id": "CVE-2024-43098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Use i3cdev-\u003edesc-\u003einfo instead of calling i3c_device_get_info() to avoid deadlock\n\nA deadlock may happen since the i3c_master_register() acquires\n\u0026i3cbus-\u003elock twice. See the log below.\nUse i3cdev-\u003edesc-\u003einfo instead of calling i3c_device_info() to\navoid acquiring the lock twice.\n\nv2:\n  - Modified the title and commit message\n\n============================================\nWARNING: possible recursive locking detected\n6.11.0-mainline\n--------------------------------------------\ninit/1 is trying to acquire lock:\nf1ffff80a6a40dc0 (\u0026i3cbus-\u003elock){++++}-{3:3}, at: i3c_bus_normaluse_lock\n\nbut task is already holding lock:\nf1ffff80a6a40dc0 (\u0026i3cbus-\u003elock){++++}-{3:3}, at: i3c_master_register\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(\u0026i3cbus-\u003elock);\n  lock(\u0026i3cbus-\u003elock);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n2 locks held by init/1:\n #0: fcffff809b6798f8 (\u0026dev-\u003emutex){....}-{3:3}, at: __driver_attach\n #1: f1ffff80a6a40dc0 (\u0026i3cbus-\u003elock){++++}-{3:3}, at: i3c_master_register\n\nstack backtrace:\nCPU: 6 UID: 0 PID: 1 Comm: init\nCall trace:\n dump_backtrace+0xfc/0x17c\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xc0\n dump_stack+0x18/0x24\n print_deadlock_bug+0x388/0x390\n __lock_acquire+0x18bc/0x32ec\n lock_acquire+0x134/0x2b0\n down_read+0x50/0x19c\n i3c_bus_normaluse_lock+0x14/0x24\n i3c_device_get_info+0x24/0x58\n i3c_device_uevent+0x34/0xa4\n dev_uevent+0x310/0x384\n kobject_uevent_env+0x244/0x414\n kobject_uevent+0x14/0x20\n device_add+0x278/0x460\n device_register+0x20/0x34\n i3c_master_register_new_i3c_devs+0x78/0x154\n i3c_master_register+0x6a0/0x6d4\n mtk_i3c_master_probe+0x3b8/0x4d8\n platform_probe+0xa0/0xe0\n really_probe+0x114/0x454\n __driver_probe_device+0xa0/0x15c\n driver_probe_device+0x3c/0x1ac\n __driver_attach+0xc4/0x1f0\n bus_for_each_dev+0x104/0x160\n driver_attach+0x24/0x34\n bus_add_driver+0x14c/0x294\n driver_register+0x68/0x104\n __platform_driver_register+0x20/0x30\n init_module+0x20/0xfe4\n do_one_initcall+0x184/0x464\n do_init_module+0x58/0x1ec\n load_module+0xefc/0x10c8\n __arm64_sys_finit_module+0x238/0x33c\n invoke_syscall+0x58/0x10c\n el0_svc_common+0xa8/0xdc\n do_el0_svc+0x1c/0x28\n el0_svc+0x50/0xac\n el0t_64_sync_handler+0x70/0xbc\n el0t_64_sync+0x1a8/0x1ac",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77c16bda-872c-4976-8a28-04c234ee5b2f",
      "id": "CVE-2024-41063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: cancel all works upon hci_unregister_dev()\n\nsyzbot is reporting that calling hci_release_dev() from hci_error_reset()\ndue to hci_dev_put() from hci_error_reset() can cause deadlock at\ndestroy_workqueue(), for hci_error_reset() is called from\nhdev-\u003ereq_workqueue which destroy_workqueue() needs to flush.\n\nWe need to make sure that hdev-\u003e{rx_work,cmd_work,tx_work} which are\nqueued into hdev-\u003eworkqueue and hdev-\u003e{power_on,error_reset} which are\nqueued into hdev-\u003ereq_workqueue are no longer running by the moment\n\n       destroy_workqueue(hdev-\u003eworkqueue);\n       destroy_workqueue(hdev-\u003ereq_workqueue);\n\nare called from hci_release_dev().\n\nCall cancel_work_sync() on these work items from hci_unregister_dev()\nas soon as hdev-\u003elist is removed from hci_dev_list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21689bd1-1126-473d-a0f1-46408c113633",
      "id": "CVE-2024-26663",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Check the bearer type before calling tipc_udp_nl_bearer_add()\n\nsyzbot reported the following general protection fault [1]:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]\n...\nRIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291\n...\nCall Trace:\n \u003cTASK\u003e\n tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646\n tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089\n genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972\n genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]\n genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067\n netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0xd5/0x180 net/socket.c:745\n ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584\n ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638\n __sys_sendmsg+0x117/0x1e0 net/socket.c:2667\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nThe cause of this issue is that when tipc_nl_bearer_add() is called with\nthe TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called\neven if the bearer is not UDP.\n\ntipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that\nthe media_ptr field of the tipc_bearer has an udp_bearer type object, so\nthe function goes crazy for non-UDP bearers.\n\nThis patch fixes the issue by checking the bearer type before calling\ntipc_udp_nl_bearer_add() in tipc_nl_bearer_add().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09479529-b7c3-427a-b3ff-49a8ac3e36eb",
      "id": "CVE-2024-26795",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sparse-Memory/vmemmap out-of-bounds fix\n\nOffset vmemmap so that the first page of vmemmap will be mapped\nto the first page of physical memory in order to ensure that\nvmemmap’s bounds will be respected during\npfn_to_page()/page_to_pfn() operations.\nThe conversion macros will produce correct SV39/48/57 addresses\nfor every possible/valid DRAM_BASE inside the physical memory limits.\n\nv2:Address Alex's comments",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9ed63f4-7def-4f03-9be7-421059d81bc1",
      "id": "CVE-2024-26855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()\n\nThe function ice_bridge_setlink() may encounter a NULL pointer dereference\nif nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently\nin nla_for_each_nested(). To address this issue, add a check to ensure that\nbr_spec is not NULL before proceeding with the nested attribute iteration.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "85251e66-59d3-4fcc-b094-00418a48fa9d",
      "id": "CVE-2024-26857",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: make sure to pull inner header in geneve_rx()\n\nsyzbot triggered a bug in geneve_rx() [1]\n\nIssue is similar to the one I fixed in commit 8d975c15c0cd\n(\"ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\")\n\nWe have to save skb-\u003enetwork_header in a temporary variable\nin order to be able to recompute the network_header pointer\nafter a pskb_inet_may_pull() call.\n\npskb_inet_may_pull() makes sure the needed headers are in skb-\u003ehead.\n\n[1]\nBUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline]\n BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]\n  geneve_rx drivers/net/geneve.c:279 [inline]\n  geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391\n  udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108\n  udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186\n  udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346\n  __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422\n  udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604\n  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254\n  dst_input include/net/dst.h:461 [inline]\n  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569\n  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648\n  process_backlog+0x480/0x8b0 net/core/dev.c:5976\n  __napi_poll+0xe3/0x980 net/core/dev.c:6576\n  napi_poll net/core/dev.c:6645 [inline]\n  net_rx_action+0x8b8/0x1870 net/core/dev.c:6778\n  __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553\n  do_softirq+0x9a/0xf0 kernel/softirq.c:454\n  __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381\n  local_bh_enable include/linux/bottom_half.h:33 [inline]\n  rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline]\n  __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378\n  dev_queue_xmit include/linux/netdevice.h:3171 [inline]\n  packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3819 [inline]\n  slab_alloc_node mm/slub.c:3860 [inline]\n  kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x352/0x790 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1296 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  __sys_sendto+0x735/0xa10 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9bdf17d7-6aeb-4cbb-8032-e1a4c87ac211",
      "id": "CVE-2024-35893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_skbmod: prevent kernel-infoleak\n\nsyzbot found that tcf_skbmod_dump() was copying four bytes\nfrom kernel stack to user space [1].\n\nThe issue here is that 'struct tc_skbmod' has a four bytes hole.\n\nWe need to clear the structure before filling fields.\n\n[1]\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]\n BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]\n BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]\n BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185\n  instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n  copy_to_user_iter lib/iov_iter.c:24 [inline]\n  iterate_ubuf include/linux/iov_iter.h:29 [inline]\n  iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n  iterate_and_advance include/linux/iov_iter.h:271 [inline]\n  _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185\n  copy_to_iter include/linux/uio.h:196 [inline]\n  simple_copy_to_iter net/core/datagram.c:532 [inline]\n  __skb_datagram_iter+0x185/0x1000 net/core/datagram.c:420\n  skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546\n  skb_copy_datagram_msg include/linux/skbuff.h:4050 [inline]\n  netlink_recvmsg+0x432/0x1610 net/netlink/af_netlink.c:1962\n  sock_recvmsg_nosec net/socket.c:1046 [inline]\n  sock_recvmsg+0x2c4/0x340 net/socket.c:1068\n  __sys_recvfrom+0x35a/0x5f0 net/socket.c:2242\n  __do_sys_recvfrom net/socket.c:2260 [inline]\n  __se_sys_recvfrom net/socket.c:2256 [inline]\n  __x64_sys_recvfrom+0x126/0x1d0 net/socket.c:2256\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was stored to memory at:\n  pskb_expand_head+0x30f/0x19d0 net/core/skbuff.c:2253\n  netlink_trim+0x2c2/0x330 net/netlink/af_netlink.c:1317\n  netlink_unicast+0x9f/0x1260 net/netlink/af_netlink.c:1351\n  nlmsg_unicast include/net/netlink.h:1144 [inline]\n  nlmsg_notify+0x21d/0x2f0 net/netlink/af_netlink.c:2610\n  rtnetlink_send+0x73/0x90 net/core/rtnetlink.c:741\n  rtnetlink_maybe_send include/linux/rtnetlink.h:17 [inline]\n  tcf_add_notify net/sched/act_api.c:2048 [inline]\n  tcf_action_add net/sched/act_api.c:2071 [inline]\n  tc_ctl_action+0x146e/0x19d0 net/sched/act_api.c:2119\n  rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595\n  netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2559\n  rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6613\n  netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]\n  netlink_unicast+0xf4c/0x1260 net/netlink/af_netlink.c:1361\n  netlink_sendmsg+0x10df/0x11f0 net/netlink/af_netlink.c:1905\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  ____sys_sendmsg+0x877/0xb60 net/socket.c:2584\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n  __sys_sendmsg net/socket.c:2667 [inline]\n  __do_sys_sendmsg net/socket.c:2676 [inline]\n  __se_sys_sendmsg net/socket.c:2674 [inline]\n  __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was stored to memory at:\n  __nla_put lib/nlattr.c:1041 [inline]\n  nla_put+0x1c6/0x230 lib/nlattr.c:1099\n  tcf_skbmod_dump+0x23f/0xc20 net/sched/act_skbmod.c:256\n  tcf_action_dump_old net/sched/act_api.c:1191 [inline]\n  tcf_action_dump_1+0x85e/0x970 net/sched/act_api.c:1227\n  tcf_action_dump+0x1fd/0x460 net/sched/act_api.c:1251\n  tca_get_fill+0x519/0x7a0 net/sched/act_api.c:1628\n  tcf_add_notify_msg net/sched/act_api.c:2023 [inline]\n  tcf_add_notify net/sched/act_api.c:2042 [inline]\n  tcf_action_add net/sched/act_api.c:2071 [inline]\n  tc_ctl_action+0x1365/0x19d0 net/sched/act_api.c:2119\n  rtnetlink_rcv_msg+0x1737/0x1900 net/core/rtnetlink.c:6595\n  netlink_rcv_skb+0x375/0x650 net/netlink/af_netli\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cfe9a9af-562a-4ff8-8124-f20e22c2e5ee",
      "id": "CVE-2024-35898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()\n\nnft_unregister_flowtable_type() within nf_flow_inet_module_exit() can\nconcurrent with __nft_flowtable_type_get() within nf_tables_newflowtable().\nAnd thhere is not any protection when iterate over nf_tables_flowtables\nlist in __nft_flowtable_type_get(). Therefore, there is pertential\ndata-race of nf_tables_flowtables list entry.\n\nUse list_for_each_entry_rcu() to iterate over nf_tables_flowtables list\nin __nft_flowtable_type_get(), and use rcu_read_lock() in the caller\nnft_flowtable_type_get() to protect the entire type query process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72f6b060-0180-4a5d-a408-c54495261ac6",
      "id": "CVE-2024-46722",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix mc_data out-of-bounds read warning\n\nClear warning that read mc_data[i-1] may out-of-bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff80e2a7-ef76-4bbf-bf5a-23952672fea1",
      "id": "CVE-2024-49965",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: remove unreasonable unlock in ocfs2_read_blocks\n\nPatch series \"Misc fixes for ocfs2_read_blocks\", v5.\n\nThis series contains 2 fixes for ocfs2_read_blocks().  The first patch fix\nthe issue reported by syzbot, which detects bad unlock balance in\nocfs2_read_blocks().  The second patch fixes an issue reported by Heming\nZhao when reviewing above fix.\n\n\nThis patch (of 2):\n\nThere was a lock release before exiting, so remove the unreasonable unlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af29775e-e353-4fae-bf66-29ebffd2f9bd",
      "id": "CVE-2024-50218",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: pass u64 to ocfs2_truncate_inline maybe overflow\n\nSyzbot reported a kernel BUG in ocfs2_truncate_inline.  There are two\nreasons for this: first, the parameter value passed is greater than\nocfs2_max_inline_data_with_xattr, second, the start and end parameters of\nocfs2_truncate_inline are \"unsigned int\".\n\nSo, we need to add a sanity check for byte_start and byte_len right before\nocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater\nthan ocfs2_max_inline_data_with_xattr return -EINVAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd5192de-e4da-4179-8128-b3843e4caa86",
      "id": "CVE-2024-53103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhv_sock: Initializing vsk-\u003etrans to NULL to prevent a dangling pointer\n\nWhen hvs is released, there is a possibility that vsk-\u003etrans may not\nbe initialized to NULL, which could lead to a dangling pointer.\nThis issue is resolved by initializing vsk-\u003etrans to NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a608c562-a278-44b2-8e10-30a12e9ae203",
      "id": "CVE-2024-23307",
      "description": "Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ebbea553-26bb-423c-8e8f-317df4fc2097",
      "id": "CVE-2019-20810",
      "description": "go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c4716fe-e295-4059-8a4c-67d36d625a17",
      "id": "CVE-2024-54683",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: IDLETIMER: Fix for possible ABBA deadlock\n\nDeletion of the last rule referencing a given idletimer may happen at\nthe same time as a read of its file in sysfs:\n\n| ======================================================\n| WARNING: possible circular locking dependency detected\n| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted\n| ------------------------------------------------------\n| iptables/3303 is trying to acquire lock:\n| ffff8881057e04b8 (kn-\u003eactive#48){++++}-{0:0}, at: __kernfs_remove+0x20\n|\n| but task is already holding lock:\n| ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v]\n|\n| which lock already depends on the new lock.\n\nA simple reproducer is:\n\n| #!/bin/bash\n|\n| while true; do\n|         iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label \"testme\"\n|         iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label \"testme\"\n| done \u0026\n| while true; do\n|         cat /sys/class/xt_idletimer/timers/testme \u003e/dev/null\n| done\n\nAvoid this by freeing list_mutex right after deleting the element from\nthe list, then continuing with the teardown.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "70dca1c2-84dd-49f7-afeb-8de3b775d1a8",
      "id": "CVE-2024-56634",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: grgpio: Add NULL check in grgpio_probe\n\ndevm_kasprintf() can return a NULL pointer on failure,but this\nreturned value in grgpio_probe is not checked.\nAdd NULL check in grgpio_probe, to handle kernel NULL\npointer dereference error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34e4899e-2db6-4f29-ade0-1a409901f3c7",
      "id": "CVE-2025-21835",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: fix MIDI Streaming descriptor lengths\n\nWhile the MIDI jacks are configured correctly, and the MIDIStreaming\nendpoint descriptors are filled with the correct information,\nbNumEmbMIDIJack and bLength are set incorrectly in these descriptors.\n\nThis does not matter when the numbers of in and out ports are equal, but\nwhen they differ the host will receive broken descriptors with\nuninitialized stack memory leaking into the descriptor for whichever\nvalue is smaller.\n\nThe precise meaning of \"in\" and \"out\" in the port counts is not clearly\ndefined and can be confusing.  But elsewhere the driver consistently\nuses this to match the USB meaning of IN and OUT viewed from the host,\nso that \"in\" ports send data to the host and \"out\" ports receive data\nfrom it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e8e84c1-ac8c-47c5-a378-bfc67ddaae02",
      "id": "CVE-2025-21848",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: bpf: Add check for nfp_app_ctrl_msg_alloc()\n\nAdd check for the return value of nfp_app_ctrl_msg_alloc() in\nnfp_bpf_cmsg_alloc() to prevent null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dcf60c4-6bc7-44f7-b417-436c0ec0a9e1",
      "id": "CVE-2025-37817",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmcb: fix a double free bug in chameleon_parse_gdd()\n\nIn chameleon_parse_gdd(), if mcb_device_register() fails, 'mdev'\nwould be released in mcb_device_register() via put_device().\nThus, goto 'err' label and free 'mdev' again causes a double free.\nJust return if mcb_device_register() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1db9abf-b0e1-4a89-9524-2d45f9ac1338",
      "id": "CVE-2022-39190",
      "description": "An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5719678a-0cd1-4853-80aa-e38daf1b6cec",
      "id": "CVE-2025-37948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: bpf: Add BHB mitigation to the epilogue for cBPF programs\n\nA malicious BPF program may manipulate the branch history to influence\nwhat the hardware speculates will happen next.\n\nOn exit from a BPF program, emit the BHB mititgation sequence.\n\nThis is only applied for 'classic' cBPF programs that are loaded by\nseccomp.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1f901d81-904b-4bb4-9e50-fc628c398cfa",
      "id": "CVE-2025-38041",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: sunxi-ng: h616: Reparent GPU clock during frequency changes\n\nThe H616 manual does not state that the GPU PLL supports\ndynamic frequency configuration, so we must take extra care when changing\nthe frequency. Currently any attempt to do device DVFS on the GPU lead\nto panfrost various ooops, and GPU hangs.\n\nThe manual describes the algorithm for changing the PLL\nfrequency, which the CPU PLL notifier code already support, so we reuse\nthat to reparent the GPU clock to GPU1 clock during frequency\nchanges.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "009d3a70-4892-42cf-9f89-c10683ea47d5",
      "id": "CVE-2025-39754",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/smaps: fix race between smaps_hugetlb_range and migration\n\nsmaps_hugetlb_range() handles the pte without holdling ptl, and may be\nconcurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). \nThe race is as follows.\n\nsmaps_hugetlb_range              migrate_pages\n  huge_ptep_get\n                                   remove_migration_ptes\n\t\t\t\t   folio_unlock\n  pfn_swap_entry_folio\n    BUG_ON\n\nTo fix it, hold ptl lock in smaps_hugetlb_range().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87562777-ee92-4a4b-b9ea-5fcb7d824136",
      "id": "CVE-2020-11725",
      "description": "snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info-\u003eowner line, which later affects a private_size*count multiplication for unspecified \"interesting side effects.\" NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info-\u003eowner field to represent data unrelated to the \"owner\" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misuse the info-\u003eowner field in a safe way",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "edab7887-954a-45c9-aa74-7bb6982e729e",
      "id": "CVE-2020-12352",
      "description": "Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38fa3f59-3ab2-4735-ba62-fd5b9a9394be",
      "id": "CVE-2020-28915",
      "description": "A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b0f901c-7302-4450-a790-3e4cfe2bd572",
      "id": "CVE-2020-28974",
      "description": "A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "375dc6d6-eb77-4397-81b9-ae9dfe3d8525",
      "id": "CVE-2020-36777",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: Fix memory leak in dvb_media_device_free()\n\ndvb_media_device_free() is leaking memory. Free `dvbdev-\u003eadapter-\u003econn`\nbefore setting it to NULL, as documented in include/media/media-device.h:\n\"The media_entity instance itself must be freed explicitly by the driver\nif required.\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c061e70-082b-4b22-9855-14a9a8bb74d4",
      "id": "CVE-2020-36782",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in lpi2c_imx_master_enable.\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "609e5e38-0e80-4be7-a675-46f4162d5c74",
      "id": "CVE-2021-28950",
      "description": "An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A \"stall on CPU\" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ec31169-0ac3-4701-b16d-b8d501ff2341",
      "id": "CVE-2021-29155",
      "description": "An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24559bcd-08d6-4c98-8730-a92e796dda43",
      "id": "CVE-2021-4032",
      "description": "A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f10dd90-c39c-4db5-b8fd-08a2bb17e820",
      "id": "CVE-2021-4202",
      "description": "A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4cf2041-c9d5-4b77-86a4-03333ca90440",
      "id": "CVE-2021-44733",
      "description": "A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c6594fdc-1094-4f8b-8b2f-631901b374a4",
      "id": "CVE-2022-3565",
      "description": "A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0acf03b8-f741-4bfa-ae7a-aa9cd04051bf",
      "id": "CVE-2021-47012",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix a use after free in siw_alloc_mr\n\nOur code analyzer reported a UAF.\n\nIn siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of\nsiw_mr_add_mem(), mem is assigned to mr-\u003emem and then mem is freed via\nkfree(mem) if xa_alloc_cyclic() failed. Here, mr-\u003emem still point to a\nfreed object. After, the execution continue up to the err_out branch of\nsiw_alloc_mr, and the freed mr-\u003emem is used in siw_mr_drop_mem(mr).\n\nMy patch moves \"mr-\u003emem = mem\" behind the if (xa_alloc_cyclic(..)\u003c0) {}\nsection, to avoid the uaf.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66228a38-63d7-4d11-822b-85598cf43abe",
      "id": "CVE-2021-47149",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fujitsu: fix potential null-ptr-deref\n\nIn fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer\nderef. To fix this, check the return value of ioremap and return -1\nto the caller in case of failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "daae0e7e-bdea-4cad-b0fc-42f6cd5822bf",
      "id": "CVE-2021-47203",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output.  The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter.  If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a50ca109-4ac8-410a-93e2-5f36d1e2b1f0",
      "id": "CVE-2021-47222",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst refcnt when egressing\n\nThe egress tunnel code uses dst_clone() and directly sets the result\nwhich is wrong because the entry might have 0 refcnt or be already deleted,\ncausing number of problems. It also triggers the WARN_ON() in dst_hold()[1]\nwhen a refcnt couldn't be taken. Fix it by using dst_hold_safe() and\nchecking if a reference was actually taken before setting the dst.\n\n[1] dmesg WARN_ON log and following refcnt errors\n WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net\n CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]\n Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 \u003c0f\u003e 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49\n RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0\n RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001\n R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000\n R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401\n FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0\n Call Trace:\n  br_handle_vlan+0xbc/0xca [bridge]\n  __br_forward+0x23/0x164 [bridge]\n  deliver_clone+0x41/0x48 [bridge]\n  br_handle_frame_finish+0x36f/0x3aa [bridge]\n  ? skb_dst+0x2e/0x38 [bridge]\n  ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  br_handle_frame+0x2c3/0x377 [bridge]\n  ? __skb_pull+0x33/0x51\n  ? vlan_do_receive+0x4f/0x36a\n  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]\n  __netif_receive_skb_core+0x539/0x7c6\n  ? __list_del_entry_valid+0x16e/0x1c2\n  __netif_receive_skb_list_core+0x6d/0xd6\n  netif_receive_skb_list_internal+0x1d9/0x1fa\n  gro_normal_list+0x22/0x3e\n  dev_gro_receive+0x55b/0x600\n  ? detach_buf_split+0x58/0x140\n  napi_gro_receive+0x94/0x12e\n  virtnet_poll+0x15d/0x315 [virtio_net]\n  __napi_poll+0x2c/0x1c9\n  net_rx_action+0xe6/0x1fb\n  __do_softirq+0x115/0x2d8\n  run_ksoftirqd+0x18/0x20\n  smpboot_thread_fn+0x183/0x19c\n  ? smpboot_unregister_percpu_thread+0x66/0x66\n  kthread+0x10a/0x10f\n  ? kthread_mod_delayed_work+0xb6/0xb6\n  ret_from_fork+0x22/0x30\n ---[ end trace 49f61b07f775fd2b ]---\n dst_release: dst:00000000c02d677a refcnt:-1\n dst_release underflow",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24a8fda8-e38b-4b82-b700-f879c61a0bad",
      "id": "CVE-2021-47224",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "060630f6-956f-4218-bac8-8ce5080cb701",
      "id": "CVE-2021-47236",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_eem: fix tx fixup skb leak\n\nwhen usbnet transmit a skb, eem fixup it in eem_tx_fixup(),\nif skb_copy_expand() failed, it return NULL,\nusbnet_start_xmit() will have no chance to free original skb.\n\nfix it by free orginal skb in eem_tx_fixup() first,\nthen check skb clone status, if failed, return NULL to usbnet.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c4a9f26-cd66-4321-ba28-bcc00c3e9aaa",
      "id": "CVE-2022-3595",
      "description": "A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "44e5cd63-41d0-4860-87e1-556025a75544",
      "id": "CVE-2021-47265",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA: Verify port when creating flow rule\n\nValidate port value provided by the user and with that remove no longer\nneeded validation by the driver.  The missing check in the mlx5_ib driver\ncould cause to the below oops.\n\nCall trace:\n  _create_flow_rule+0x2d4/0xf28 [mlx5_ib]\n  mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib]\n  ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs]\n  ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs]\n  ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs]\n  ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs]\n  do_vfs_ioctl+0xd0/0xaf0\n  ksys_ioctl+0x84/0xb4\n  __arm64_sys_ioctl+0x28/0xc4\n  el0_svc_common.constprop.3+0xa4/0x254\n  el0_svc_handler+0x84/0xa0\n  el0_svc+0x10/0x26c\n Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90da59ed-ee53-4d53-94fe-af8aa33b135b",
      "id": "CVE-2021-47293",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_skbmod: Skip non-Ethernet packets\n\nCurrently tcf_skbmod_act() assumes that packets use Ethernet as their L2\nprotocol, which is not always the case.  As an example, for CAN devices:\n\n\t$ ip link add dev vcan0 type vcan\n\t$ ip link set up vcan0\n\t$ tc qdisc add dev vcan0 root handle 1: htb\n\t$ tc filter add dev vcan0 parent 1: protocol ip prio 10 \\\n\t\tmatchall action skbmod swap mac\n\nDoing the above silently corrupts all the packets.  Do not perform skbmod\nactions for non-Ethernet packets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3278b176-92dc-4ca1-b50e-a1c1c3925a17",
      "id": "CVE-2021-47305",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sync_file: Don't leak fences on merge failure\n\nEach add_fence() call does a dma_fence_get() on the relevant fence.  In\nthe error path, we weren't calling dma_fence_put() so all those fences\ngot leaked.  Also, in the krealloc_array failure case, we weren't\nfreeing the fences array.  Instead, ensure that i and fences are always\nzero-initialized and dma_fence_put() all the fences and kfree(fences) on\nevery error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3bd4503f-050f-445d-8470-87896aaa3eae",
      "id": "CVE-2021-47311",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qcom/emac: fix UAF in emac_remove\n\nadpt is netdev private data and it cannot be\nused after free_netdev() call. Using adpt after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "16272266-0e63-4e72-be76-7a1599610a5f",
      "id": "CVE-2021-47332",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: Don't call free_pages_exact() with NULL address\n\nUnlike some other functions, we can't pass NULL pointer to\nfree_pages_exact().  Add a proper NULL check for avoiding possible\nOops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8beb23f4-e8ad-44a8-b2c8-d053f8a0ea86",
      "id": "CVE-2021-47418",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: fix NULL deref in fifo_set_limit()\n\nsyzbot reported another NULL deref in fifo_set_limit() [1]\n\nI could repro the issue with :\n\nunshare -n\ntc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit\ntc qd replace dev lo parent 1:0 pfifo_fast\ntc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit\n\npfifo_fast does not have a change() operation.\nMake fifo_set_limit() more robust about this.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0\nOops: 0010 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at RIP 0xffffffffffffffd6.\nRSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000\nRBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910\nR13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800\nFS:  00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n fifo_set_limit net/sched/sch_fifo.c:242 [inline]\n fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227\n tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418\n qdisc_change net/sched/sch_api.c:1332 [inline]\n tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504\n netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340\n netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "590de98d-787f-4234-86a4-ca07dfa337ec",
      "id": "CVE-2021-47445",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix null pointer dereference on pointer edp\n\nThe initialization of pointer dev dereferences pointer edp before\nedp is null checked, so there is a potential null pointer deference\nissue. Fix this by only dereferencing edp after edp has been null\nchecked.\n\nAddresses-Coverity: (\"Dereference before null check\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "078b96f1-6620-4f3a-a606-2bf08004665a",
      "id": "CVE-2021-47559",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()\n\nCoverity reports a possible NULL dereferencing problem:\n\nin smc_vlan_by_tcpsk():\n6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times).\n7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next.\n1623                ndev = (struct net_device *)netdev_lower_get_next(ndev, \u0026lower);\nCID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS)\n8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev.\n1624                if (is_vlan_dev(ndev)) {\n\nRemove the manual implementation and use netdev_walk_all_lower_dev() to\niterate over the lower devices. While on it remove an obsolete function\nparameter comment.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d3c1e96-345b-4c23-ab9d-eb7966e34491",
      "id": "CVE-2021-47600",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: fix use after free in rebalance_children()\n\nMove dm_tm_unlock() after dm_tm_dec().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c4ebf78-ecd8-46f8-ad1b-b7e365a25938",
      "id": "CVE-2021-47635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix to add refcount once page is set private\n\nMM defined the rule [1] very clearly that once page was set with PG_private\nflag, we should increment the refcount in that page, also main flows like\npageout(), migrate_page() will assume there is one additional page\nreference count if page_has_private() returns true. Otherwise, we may\nget a BUG in page migration:\n\n  page:0000000080d05b9d refcount:-1 mapcount:0 mapping:000000005f4d82a8\n  index:0xe2 pfn:0x14c12\n  aops:ubifs_file_address_operations [ubifs] ino:8f1 dentry name:\"f30e\"\n  flags: 0x1fffff80002405(locked|uptodate|owner_priv_1|private|node=0|\n  zone=1|lastcpupid=0x1fffff)\n  page dumped because: VM_BUG_ON_PAGE(page_count(page) != 0)\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/page_ref.h:184!\n  invalid opcode: 0000 [#1] SMP\n  CPU: 3 PID: 38 Comm: kcompactd0 Not tainted 5.15.0-rc5\n  RIP: 0010:migrate_page_move_mapping+0xac3/0xe70\n  Call Trace:\n    ubifs_migrate_page+0x22/0xc0 [ubifs]\n    move_to_new_page+0xb4/0x600\n    migrate_pages+0x1523/0x1cc0\n    compact_zone+0x8c5/0x14b0\n    kcompactd+0x2bc/0x560\n    kthread+0x18c/0x1e0\n    ret_from_fork+0x1f/0x30\n\nBefore the time, we should make clean a concept, what does refcount means\nin page gotten from grab_cache_page_write_begin(). There are 2 situations:\nSituation 1: refcount is 3, page is created by __page_cache_alloc.\n  TYPE_A - the write process is using this page\n  TYPE_B - page is assigned to one certain mapping by calling\n\t   __add_to_page_cache_locked()\n  TYPE_C - page is added into pagevec list corresponding current cpu by\n\t   calling lru_cache_add()\nSituation 2: refcount is 2, page is gotten from the mapping's tree\n  TYPE_B - page has been assigned to one certain mapping\n  TYPE_A - the write process is using this page (by calling\n\t   page_cache_get_speculative())\nFilesystem releases one refcount by calling put_page() in xxx_write_end(),\nthe released refcount corresponds to TYPE_A (write task is using it). If\nthere are any processes using a page, page migration process will skip the\npage by judging whether expected_page_refs() equals to page refcount.\n\nThe BUG is caused by following process:\n    PA(cpu 0)                           kcompactd(cpu 1)\n\t\t\t\tcompact_zone\nubifs_write_begin\n  page_a = grab_cache_page_write_begin\n    add_to_page_cache_lru\n      lru_cache_add\n        pagevec_add // put page into cpu 0's pagevec\n  (refcnf = 3, for page creation process)\nubifs_write_end\n  SetPagePrivate(page_a) // doesn't increase page count !\n  unlock_page(page_a)\n  put_page(page_a)  // refcnt = 2\n\t\t\t\t[...]\n\n    PB(cpu 0)\nfilemap_read\n  filemap_get_pages\n    add_to_page_cache_lru\n      lru_cache_add\n        __pagevec_lru_add // traverse all pages in cpu 0's pagevec\n\t  __pagevec_lru_add_fn\n\t    SetPageLRU(page_a)\n\t\t\t\tisolate_migratepages\n                                  isolate_migratepages_block\n\t\t\t\t    get_page_unless_zero(page_a)\n\t\t\t\t    // refcnt = 3\n                                      list_add(page_a, from_list)\n\t\t\t\tmigrate_pages(from_list)\n\t\t\t\t  __unmap_and_move\n\t\t\t\t    move_to_new_page\n\t\t\t\t      ubifs_migrate_page(page_a)\n\t\t\t\t        migrate_page_move_mapping\n\t\t\t\t\t  expected_page_refs get 3\n                                  (migration[1] + mapping[1] + private[1])\n\t release_pages\n\t   put_page_testzero(page_a) // refcnt = 3\n                                          page_ref_freeze  // refcnt = 0\n\t     page_ref_dec_and_test(0 - 1 = -1)\n                                          page_ref_unfreeze\n                                            VM_BUG_ON_PAGE(-1 != 0, page)\n\nUBIFS doesn't increase the page refcount after setting private flag, which\nleads to page migration task believes the page is not used by any other\nprocesses, so the page is migrated. This causes concurrent accessing on\npage refcount between put_page() called by other process(eg. read process\ncalls lru_cache_add) and page_ref_unfreeze() called by mi\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2daaa96-d91a-473d-bd8a-0f8d593c0fbb",
      "id": "CVE-2021-47642",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow\n\nCoverity complains of a possible buffer overflow. However,\ngiven the 'static' scope of nvidia_setup_i2c_bus() it looks\nlike that can't happen after examiniing the call sites.\n\nCID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)\n1. fixed_size_dest: You might overrun the 48-character fixed-size string\n  chan-\u003eadapter.name by copying name without checking the length.\n2. parameter_as_source: Note: This defect has an elevated risk because the\n  source argument is a parameter of the current function.\n 89        strcpy(chan-\u003eadapter.name, name);\n\nFix this warning by using strscpy() which will silence the warning and\nprevent any future buffer overflows should the names used to identify the\nchannel become much longer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33bbb44d-589b-4a57-989d-4032439059b6",
      "id": "CVE-2022-0433",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c61ca7a-a0ab-485a-8fef-6ff95eb99628",
      "id": "CVE-2022-0516",
      "description": "A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f137137-93f4-4d97-98ab-890a84a9852f",
      "id": "CVE-2022-28389",
      "description": "mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "326bc9a0-38ea-496f-ae6c-869429c268f0",
      "id": "CVE-2022-2938",
      "description": "A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to crash the system or have other memory-corruption side effects.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90200af6-d2df-42e3-8b2a-e39338e29c85",
      "id": "CVE-2022-3107",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82392119-ad8e-495f-880f-62701a98d596",
      "id": "CVE-2022-3114",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcffa615-2573-43eb-ac51-118c5faaa9ce",
      "id": "CVE-2022-32250",
      "description": "net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2752fa5e-e58f-4cbb-9724-e9c538d71af0",
      "id": "CVE-2022-3606",
      "description": "A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "702b8d6f-ed25-47f9-8a82-a1403063cd3d",
      "id": "CVE-2022-3643",
      "description": "Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2d3d460-3415-4df0-ba7f-86235713c111",
      "id": "CVE-2022-39189",
      "description": "An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45638d64-77c6-4b84-950c-b2056f76c9cf",
      "id": "CVE-2022-44032",
      "description": "An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cmm_open() and cm4000_detach().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f3db7abf-9dbf-4525-8295-a3a6a4a4844b",
      "id": "CVE-2022-48739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: hdmi-codec: Fix OOB memory accesses\n\nCorrect size of iec_status array by changing it to the size of status\narray of the struct snd_aes_iec958. This fixes out-of-bounds slab\nread accesses made by memcpy() of the hdmi-codec driver. This problem\nis reported by KASAN.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "39d9d70e-5446-49db-ae37-aae0622a219d",
      "id": "CVE-2022-48910",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ensure we call ipv6_mc_down() at most once\n\nThere are two reasons for addrconf_notify() to be called with NETDEV_DOWN:\neither the network device is actually going down, or IPv6 was disabled\non the interface.\n\nIf either of them stays down while the other is toggled, we repeatedly\ncall the code for NETDEV_DOWN, including ipv6_mc_down(), while never\ncalling the corresponding ipv6_mc_up() in between. This will cause a\nnew entry in idev-\u003emc_tomb to be allocated for each multicast group\nthe interface is subscribed to, which in turn leaks one struct ifmcaddr6\nper nontrivial multicast group the interface is subscribed to.\n\nThe following reproducer will leak at least $n objects:\n\nip addr add ff2e::4242/32 dev eth0 autojoin\nsysctl -w net.ipv6.conf.eth0.disable_ipv6=1\nfor i in $(seq 1 $n); do\n\tip link set up eth0; ip link set down eth0\ndone\n\nJoining groups with IPV6_ADD_MEMBERSHIP (unprivileged) or setting the\nsysctl net.ipv6.conf.eth0.forwarding to 1 (=\u003e subscribing to ff02::2)\ncan also be used to create a nontrivial idev-\u003emc_list, which will the\nleak objects with the right up-down-sequence.\n\nBased on both sources for NETDEV_DOWN events the interface IPv6 state\nshould be considered:\n\n - not ready if the network interface is not ready OR IPv6 is disabled\n   for it\n - ready if the network interface is ready AND IPv6 is enabled for it\n\nThe functions ipv6_mc_up() and ipv6_down() should only be run when this\nstate changes.\n\nImplement this by remembering when the IPv6 state is ready, and only\nrun ipv6_mc_down() if it actually changed from ready to not ready.\n\nThe other direction (not ready -\u003e ready) already works correctly, as:\n\n - the interface notification triggered codepath for NETDEV_UP /\n   NETDEV_CHANGE returns early if ipv6 is disabled, and\n - the disable_ipv6=0 triggered codepath skips fully initializing the\n   interface as long as addrconf_link_ready(dev) returns false\n - calling ipv6_mc_up() repeatedly does not leak anything",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb9284d7-373f-4047-a663-7d228f07041b",
      "id": "CVE-2022-48935",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee1b7dad-01c0-45f6-ac87-4b089fe1f441",
      "id": "CVE-2022-48950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()'d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current-\u003etask_works list is already empty and\ntask_work_cancel() won't be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c5a5b62-2bb8-4a2a-b717-41cf00272004",
      "id": "CVE-2022-49023",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: fix buffer overflow in elem comparison\n\nFor vendor elements, the code here assumes that 5 octets\nare present without checking. Since the element itself is\nalready checked to fit, we only need to check the length.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a69a2d8f-f31d-4458-bfbd-1847bf3a6c7f",
      "id": "CVE-2022-49060",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix NULL pointer dereference in smc_pnet_find_ib()\n\ndev_name() was called with dev.parent as argument but without to\nNULL-check it before.\nSolve this by checking the pointer before the call to dev_name().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4f12d50-93b8-4b7d-9889-0f4180a3cec4",
      "id": "CVE-2022-49100",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_console: eliminate anonymous module_init \u0026 module_exit\n\nEliminate anonymous module_init() and module_exit(), which can lead to\nconfusion or ambiguity when reading System.map, crashes/oops/bugs,\nor an initcall_debug log.\n\nGive each of these init and exit functions unique driver-specific\nnames to eliminate the anonymous names.\n\nExample 1: (System.map)\n ffffffff832fc78c t init\n ffffffff832fc79e t init\n ffffffff832fc8f8 t init\n\nExample 2: (initcall_debug log)\n calling  init+0x0/0x12 @ 1\n initcall init+0x0/0x12 returned 0 after 15 usecs\n calling  init+0x0/0x60 @ 1\n initcall init+0x0/0x60 returned 0 after 2 usecs\n calling  init+0x0/0x9a @ 1\n initcall init+0x0/0x9a returned 0 after 74 usecs",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4367c4ee-5be3-4f8e-89f3-df40dda4c3f0",
      "id": "CVE-2022-49170",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on curseg-\u003ealloc_type\n\nAs Wenqing Liu reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215657\n\n- Overview\nUBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image\n\n- Reproduce\ntested on kernel 5.17-rc4, 5.17-rc6\n\n1. mkdir test_crash\n2. cd test_crash\n3. unzip tmp2.zip\n4. mkdir mnt\n5. ./single_test.sh f2fs 2\n\n- Kernel dump\n[   46.434454] loop0: detected capacity change from 0 to 131072\n[   46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9\n[   46.738319] ================================================================================\n[   46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2\n[   46.738475] index 231 is out of range for type 'unsigned int [2]'\n[   46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1\n[   46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n[   46.738551] Call Trace:\n[   46.738556]  \u003cTASK\u003e\n[   46.738563]  dump_stack_lvl+0x47/0x5c\n[   46.738581]  ubsan_epilogue+0x5/0x50\n[   46.738592]  __ubsan_handle_out_of_bounds+0x68/0x80\n[   46.738604]  f2fs_allocate_data_block+0xdff/0xe60 [f2fs]\n[   46.738819]  do_write_page+0xef/0x210 [f2fs]\n[   46.738934]  f2fs_do_write_node_page+0x3f/0x80 [f2fs]\n[   46.739038]  __write_node_page+0x2b7/0x920 [f2fs]\n[   46.739162]  f2fs_sync_node_pages+0x943/0xb00 [f2fs]\n[   46.739293]  f2fs_write_checkpoint+0x7bb/0x1030 [f2fs]\n[   46.739405]  kill_f2fs_super+0x125/0x150 [f2fs]\n[   46.739507]  deactivate_locked_super+0x60/0xc0\n[   46.739517]  deactivate_super+0x70/0xb0\n[   46.739524]  cleanup_mnt+0x11a/0x200\n[   46.739532]  __cleanup_mnt+0x16/0x20\n[   46.739538]  task_work_run+0x67/0xa0\n[   46.739547]  exit_to_user_mode_prepare+0x18c/0x1a0\n[   46.739559]  syscall_exit_to_user_mode+0x26/0x40\n[   46.739568]  do_syscall_64+0x46/0xb0\n[   46.739584]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is we missed to do sanity check on curseg-\u003ealloc_type,\nresult in out-of-bound accessing on sbi-\u003eblock_count[] array, fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "393dcd04-b109-4f6c-b4b5-80f449713fba",
      "id": "CVE-2022-49189",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: clk-rcg2: Update logic to calculate D value for RCG\n\nThe display pixel clock has a requirement on certain newer platforms to\nsupport M/N as (2/3) and the final D value calculated results in\nunderflow errors.\nAs the current implementation does not check for D value is within\nthe accepted range for a given M \u0026 N value. Update the logic to\ncalculate the final D value based on the range.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17dbbb21-612a-4a2d-88cc-35cace241b93",
      "id": "CVE-2022-49285",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: mma8452: use the correct logic to get mma8452_data\n\nThe original logic to get mma8452_data is wrong, the *dev point to\nthe device belong to iio_dev. we can't use this dev to find the\ncorrect i2c_client. The original logic happen to work because it\nfinally use dev-\u003edriver_data to get iio_dev. Here use the API\nto_i2c_client() is wrong and make reader confuse. To correct the\nlogic, it should be like this\n\n  struct mma8452_data *data = iio_priv(dev_get_drvdata(dev));\n\nBut after commit 8b7651f25962 (\"iio: iio_device_alloc(): Remove\nunnecessary self drvdata\"), the upper logic also can't work.\nWhen try to show the avialable scale in userspace, will meet kernel\ndump, kernel handle NULL pointer dereference.\n\nSo use dev_to_iio_dev() to correct the logic.\n\nDual fixes tags as the second reflects when the bug was exposed, whilst\nthe first reflects when the original bug was introduced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "542e46f6-e169-4ef6-98a7-fd4b4d689f18",
      "id": "CVE-2022-49287",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix reference counting for struct tpm_chip\n\nThe following sequence of operations results in a refcount warning:\n\n1. Open device /dev/tpmrm.\n2. Remove module tpm_tis_spi.\n3. Write a TPM command to the file descriptor opened at step 1.\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4\nrefcount_t: addition on 0; use-after-free.\nModules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac\nsha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4\nbrcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes\nraspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm\nsnd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]\nCPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2\nHardware name: BCM2711\n[\u003cc0410c3c\u003e] (unwind_backtrace) from [\u003cc040b580\u003e] (show_stack+0x10/0x14)\n[\u003cc040b580\u003e] (show_stack) from [\u003cc1092174\u003e] (dump_stack+0xc4/0xd8)\n[\u003cc1092174\u003e] (dump_stack) from [\u003cc0445a30\u003e] (__warn+0x104/0x108)\n[\u003cc0445a30\u003e] (__warn) from [\u003cc0445aa8\u003e] (warn_slowpath_fmt+0x74/0xb8)\n[\u003cc0445aa8\u003e] (warn_slowpath_fmt) from [\u003cc08435d0\u003e] (kobject_get+0xa0/0xa4)\n[\u003cc08435d0\u003e] (kobject_get) from [\u003cbf0a715c\u003e] (tpm_try_get_ops+0x14/0x54 [tpm])\n[\u003cbf0a715c\u003e] (tpm_try_get_ops [tpm]) from [\u003cbf0a7d6c\u003e] (tpm_common_write+0x38/0x60 [tpm])\n[\u003cbf0a7d6c\u003e] (tpm_common_write [tpm]) from [\u003cc05a7ac0\u003e] (vfs_write+0xc4/0x3c0)\n[\u003cc05a7ac0\u003e] (vfs_write) from [\u003cc05a7ee4\u003e] (ksys_write+0x58/0xcc)\n[\u003cc05a7ee4\u003e] (ksys_write) from [\u003cc04001a0\u003e] (ret_fast_syscall+0x0/0x4c)\nException stack(0xc226bfa8 to 0xc226bff0)\nbfa0:                   00000000 000105b4 00000003 beafe664 00000014 00000000\nbfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684\nbfe0: 0000006c beafe648 0001056c b6eb6944\n---[ end trace d4b8409def9b8b1f ]---\n\nThe reason for this warning is the attempt to get the chip-\u003edev reference\nin tpm_common_write() although the reference counter is already zero.\n\nSince commit 8979b02aaf1d (\"tpm: Fix reference count to main device\") the\nextra reference used to prevent a premature zero counter is never taken,\nbecause the required TPM_CHIP_FLAG_TPM2 flag is never set.\n\nFix this by moving the TPM 2 character device handling from\ntpm_chip_alloc() to tpm_add_char_device() which is called at a later point\nin time when the flag has been set in case of TPM2.\n\nCommit fdc915f7f719 (\"tpm: expose spaces via a device link /dev/tpmrm\u003cn\u003e\")\nalready introduced function tpm_devs_release() to release the extra\nreference but did not implement the required put on chip-\u003edevs that results\nin the call of this function.\n\nFix this by putting chip-\u003edevs in tpm_chip_unregister().\n\nFinally move the new implementation for the TPM 2 handling into a new\nfunction to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the\ngood case and error cases.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b9eceda-0726-468b-b5f6-4ee48a9808ff",
      "id": "CVE-2022-49337",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: dlmfs: fix error handling of user_dlm_destroy_lock\n\nWhen user_dlm_destroy_lock failed, it didn't clean up the flags it set\nbefore exit.  For USER_LOCK_IN_TEARDOWN, if this function fails because of\nlock is still in used, next time when unlink invokes this function, it\nwill return succeed, and then unlink will remove inode and dentry if lock\nis not in used(file closed), but the dlm lock is still linked in dlm lock\nresource, then when bast come in, it will trigger a panic due to\nuser-after-free.  See the following panic call trace.  To fix this,\nUSER_LOCK_IN_TEARDOWN should be reverted if fail.  And also error should\nbe returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink\nfail.\n\nFor the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN,\nUSER_LOCK_BUSY is also required to be cleared.  Even though spin lock is\nreleased in between, but USER_LOCK_IN_TEARDOWN is still set, for\nUSER_LOCK_BUSY, if before every place that waits on this flag,\nUSER_LOCK_IN_TEARDOWN is checked to bail out, that will make sure no flow\nwaits on the busy flag set by user_dlm_destroy_lock(), then we can\nsimplely revert USER_LOCK_BUSY when ocfs2_dlm_unlock fails.  Fix\nuser_dlm_cluster_lock() which is the only function not following this.\n\n[  941.336392] (python,26174,16):dlmfs_unlink:562 ERROR: unlink\n004fb0000060000b5a90b8c847b72e1, error -16 from destroy\n[  989.757536] ------------[ cut here ]------------\n[  989.757709] kernel BUG at fs/ocfs2/dlmfs/userdlm.c:173!\n[  989.757876] invalid opcode: 0000 [#1] SMP\n[  989.758027] Modules linked in: ksplice_2zhuk2jr_ib_ipoib_new(O)\nksplice_2zhuk2jr(O) mptctl mptbase xen_netback xen_blkback xen_gntalloc\nxen_gntdev xen_evtchn cdc_ether usbnet mii ocfs2 jbd2 rpcsec_gss_krb5\nauth_rpcgss nfsv4 nfsv3 nfs_acl nfs fscache lockd grace ocfs2_dlmfs\nocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc\nfcoe libfcoe libfc scsi_transport_fc sunrpc ipmi_devintf bridge stp llc\nrds_rdma rds bonding ib_sdp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad\nrdma_cm ib_cm iw_cm falcon_lsm_serviceable(PE) falcon_nf_netcontain(PE)\nmlx4_vnic falcon_kal(E) falcon_lsm_pinned_13402(E) mlx4_ib ib_sa ib_mad\nib_core ib_addr xenfs xen_privcmd dm_multipath iTCO_wdt iTCO_vendor_support\npcspkr sb_edac edac_core i2c_i801 lpc_ich mfd_core ipmi_ssif i2c_core ipmi_si\nipmi_msghandler\n[  989.760686]  ioatdma sg ext3 jbd mbcache sd_mod ahci libahci ixgbe dca ptp\npps_core vxlan udp_tunnel ip6_udp_tunnel megaraid_sas mlx4_core crc32c_intel\nbe2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio\nlibiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi\ndm_mirror dm_region_hash dm_log dm_mod [last unloaded:\nksplice_2zhuk2jr_ib_ipoib_old]\n[  989.761987] CPU: 10 PID: 19102 Comm: dlm_thread Tainted: P           OE\n4.1.12-124.57.1.el6uek.x86_64 #2\n[  989.762290] Hardware name: Oracle Corporation ORACLE SERVER\nX5-2/ASM,MOTHERBOARD,1U, BIOS 30350100 06/17/2021\n[  989.762599] task: ffff880178af6200 ti: ffff88017f7c8000 task.ti:\nffff88017f7c8000\n[  989.762848] RIP: e030:[\u003cffffffffc07d4316\u003e]  [\u003cffffffffc07d4316\u003e]\n__user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs]\n[  989.763185] RSP: e02b:ffff88017f7cbcb8  EFLAGS: 00010246\n[  989.763353] RAX: 0000000000000000 RBX: ffff880174d48008 RCX:\n0000000000000003\n[  989.763565] RDX: 0000000000120012 RSI: 0000000000000003 RDI:\nffff880174d48170\n[  989.763778] RBP: ffff88017f7cbcc8 R08: ffff88021f4293b0 R09:\n0000000000000000\n[  989.763991] R10: ffff880179c8c000 R11: 0000000000000003 R12:\nffff880174d48008\n[  989.764204] R13: 0000000000000003 R14: ffff880179c8c000 R15:\nffff88021db7a000\n[  989.764422] FS:  0000000000000000(0000) GS:ffff880247480000(0000)\nknlGS:ffff880247480000\n[  989.764685] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  989.764865] CR2: ffff8000007f6800 CR3: 0000000001ae0000 CR4:\n0000000000042660\n[  989.765081] Stack:\n[  989.765167]  00000000000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f48dfffc-8898-4d5b-ba30-d30ebf61391a",
      "id": "CVE-2022-49563",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - add param check for RSA\n\nReject requests with a source buffer that is bigger than the size of the\nkey. This is to prevent a possible integer underflow that might happen\nwhen copying the source scatterlist into a linear buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0be31d6-1114-4cf8-a0b9-0daf08948340",
      "id": "CVE-2022-49567",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix uninit-value in mpol_rebind_policy()\n\nmpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when\npol-\u003emode is MPOL_LOCAL.  Check pol-\u003emode before access\npol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).\n\nBUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]\nBUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\n mpol_rebind_policy mm/mempolicy.c:352 [inline]\n mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\n cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]\n cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278\n cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515\n cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]\n cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804\n __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520\n cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539\n cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852\n kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296\n call_write_iter include/linux/fs.h:2162 [inline]\n new_sync_write fs/read_write.c:503 [inline]\n vfs_write+0x1318/0x2030 fs/read_write.c:590\n ksys_write+0x28b/0x510 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0xdb/0x120 fs/read_write.c:652\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n slab_alloc mm/slub.c:3259 [inline]\n kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264\n mpol_new mm/mempolicy.c:293 [inline]\n do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853\n kernel_set_mempolicy mm/mempolicy.c:1504 [inline]\n __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]\n __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507\n __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nKMSAN: uninit-value in mpol_rebind_task (2)\nhttps://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc\n\nThis patch seems to fix below bug too.\nKMSAN: uninit-value in mpol_rebind_mm (2)\nhttps://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b\n\nThe uninit-value is pol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy().\nWhen syzkaller reproducer runs to the beginning of mpol_new(),\n\n\t    mpol_new() mm/mempolicy.c\n\t  do_mbind() mm/mempolicy.c\n\tkernel_mbind() mm/mempolicy.c\n\n`mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`\nis 0. Then\n\n\tmode = MPOL_LOCAL;\n\t...\n\tpolicy-\u003emode = mode;\n\tpolicy-\u003eflags = flags;\n\nwill be executed. So in mpol_set_nodemask(),\n\n\t    mpol_set_nodemask() mm/mempolicy.c\n\t  do_mbind()\n\tkernel_mbind()\n\npol-\u003emode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized,\nwhich will be accessed in mpol_rebind_policy().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d598eb84-6487-45d0-a601-f1c8e38bfc2d",
      "id": "CVE-2022-49725",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix call trace in setup_tx_descriptors\n\nAfter PF reset and ethtool -t there was call trace in dmesg\nsometimes leading to panic. When there was some time, around 5\nseconds, between reset and test there were no errors.\n\nProblem was that pf reset calls i40e_vsi_close in prep_for_reset\nand ethtool -t calls i40e_vsi_close in diag_test. If there was not\nenough time between those commands the second i40e_vsi_close starts\nbefore previous i40e_vsi_close was done which leads to crash.\n\nAdd check to diag_test if pf is in reset and don't start offline\ntests if it is true.\nAdd netif_info(\"testing failed\") into unhappy path of i40e_diag_test()",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5580bd28-40be-482e-9e51-48725f44be8f",
      "id": "CVE-2022-49748",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd: fix potential integer overflow on shift of a int\n\nThe left shift of int 32 bit integer constant 1 is evaluated using 32 bit\narithmetic and then passed as a 64 bit function argument. In the case where\ni is 32 or more this can lead to an overflow.  Avoid this by shifting\nusing the BIT_ULL macro instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cc6ee65-89a6-4009-a0ba-f7bcd94eb696",
      "id": "CVE-2022-49794",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()\n\nIf iio_trigger_register() returns error, it should call iio_trigger_free()\nto give up the reference that hold in iio_trigger_alloc(), so that it can\ncall iio_trig_release() to free memory when the refcount hit to 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6031794e-971d-4d09-8ad6-e466829a0bf9",
      "id": "CVE-2022-50061",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.\"",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6a18202-2840-4292-9bc3-b571ff00dae6",
      "id": "CVE-2020-26088",
      "description": "A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d3bd328-eda5-421e-9e25-b11f90b26106",
      "id": "CVE-2022-50087",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails\n\nWhen scpi probe fails, at any point, we need to ensure that the scpi_info\nis not set and will remain NULL until the probe succeeds. If it is not\ntaken care, then it could result use-after-free as the value is exported\nvia get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()\nbut freed when the probe fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb53a9d0-6a31-4954-8269-9483e95f4159",
      "id": "CVE-2022-50112",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aab85155-6dfb-4c58-8537-51640b00a6ed",
      "id": "CVE-2022-50234",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/af_unix: defer registered files gc to io_uring release\n\nInstead of putting io_uring's registered files in unix_gc() we want it\nto be done by io_uring itself. The trick here is to consider io_uring\nregistered files for cycle detection but not actually putting them down.\nBecause io_uring can't register other ring instances, this will remove\nall refs to the ring file triggering the -\u003erelease path and clean up\nwith io_ring_ctx_free().\n\n[axboe: add kerneldoc comment to skb, fold in skb leak fix]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7573e5a2-1ccb-4849-9a4c-80c4aba3db06",
      "id": "CVE-2022-50248",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix double free on tx path.\n\nWe see kernel crashes and lockups and KASAN errors related to ax210\nfirmware crashes.  One of the KASAN dumps pointed at the tx path,\nand it appears there is indeed a way to double-free an skb.\n\nIf iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the\nmethod will be freed.  But, in case where we build TSO skb buffer,\nthe skb may also be freed in error case.  So, return 0 in that particular\nerror case and do cleanup manually.\n\nBUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90\niwlwifi 0000:06:00.0: 0x00000000 | tsf hi\nRead of size 8 at addr ffff88813cfa4ba0 by task btserver/9650\n\nCPU: 4 PID: 9650 Comm: btserver Tainted: G        W         5.19.8+ #5\niwlwifi 0000:06:00.0: 0x00000000 | time gp1\nHardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x55/0x6d\n print_report.cold.12+0xf2/0x684\niwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2\n ? __list_del_entry_valid+0x12/0x90\n kasan_report+0x8b/0x180\niwlwifi 0000:06:00.0: 0x00000001 | uCode revision type\n ? __list_del_entry_valid+0x12/0x90\n __list_del_entry_valid+0x12/0x90\niwlwifi 0000:06:00.0: 0x00000048 | uCode version major\n tcp_update_skb_after_send+0x5d/0x170\n __tcp_transmit_skb+0xb61/0x15c0\niwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor\n ? __tcp_select_window+0x490/0x490\niwlwifi 0000:06:00.0: 0x00000420 | hw version\n ? trace_kmalloc_node+0x29/0xd0\n ? __kmalloc_node_track_caller+0x12a/0x260\n ? memset+0x1f/0x40\n ? __build_skb_around+0x125/0x150\n ? __alloc_skb+0x1d4/0x220\n ? skb_zerocopy_clone+0x55/0x230\niwlwifi 0000:06:00.0: 0x00489002 | board version\n ? kmalloc_reserve+0x80/0x80\n ? rcu_read_lock_bh_held+0x60/0xb0\n tcp_write_xmit+0x3f1/0x24d0\niwlwifi 0000:06:00.0: 0x034E001C | hcmd\n ? __check_object_size+0x180/0x350\niwlwifi 0000:06:00.0: 0x24020000 | isr0\n tcp_sendmsg_locked+0x8a9/0x1520\niwlwifi 0000:06:00.0: 0x01400000 | isr1\n ? tcp_sendpage+0x50/0x50\niwlwifi 0000:06:00.0: 0x48F0000A | isr2\n ? lock_release+0xb9/0x400\n ? tcp_sendmsg+0x14/0x40\niwlwifi 0000:06:00.0: 0x00C3080C | isr3\n ? lock_downgrade+0x390/0x390\n ? do_raw_spin_lock+0x114/0x1d0\niwlwifi 0000:06:00.0: 0x00200000 | isr4\n ? rwlock_bug.part.2+0x50/0x50\niwlwifi 0000:06:00.0: 0x034A001C | last cmd Id\n ? rwlock_bug.part.2+0x50/0x50\n ? lockdep_hardirqs_on_prepare+0xe/0x200\niwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event\n ? __local_bh_enable_ip+0x87/0xe0\n ? inet_send_prepare+0x220/0x220\niwlwifi 0000:06:00.0: 0x000000C4 | l2p_control\n tcp_sendmsg+0x22/0x40\n sock_sendmsg+0x5f/0x70\niwlwifi 0000:06:00.0: 0x00010034 | l2p_duration\n __sys_sendto+0x19d/0x250\niwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid\n ? __ia32_sys_getpeername+0x40/0x40\niwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match\n ? rcu_read_lock_held_common+0x12/0x50\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_bh_held+0xb0/0xb0\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? lock_release+0xb9/0x400\n ? lock_downgrade+0x390/0x390\n ? ktime_get+0x64/0x130\n ? ktime_get+0x8d/0x130\n ? rcu_read_lock_held_common+0x12/0x50\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_held_common+0x12/0x50\n ? rcu_read_lock_sched_held+0x5a/0xd0\n ? rcu_read_lock_bh_held+0xb0/0xb0\n ? rcu_read_lock_bh_held+0xb0/0xb0\n __x64_sys_sendto+0x6f/0x80\n do_syscall_64+0x34/0xb0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f1d126e4531\nCode: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89\nRSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531\nRDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014\nRBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "34350668-1afa-479f-aee9-9036d4e9bf3c",
      "id": "CVE-2022-50301",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/omap: Fix buffer overflow in debugfs\n\nThere are two issues here:\n\n1) The \"len\" variable needs to be checked before the very first write.\n   Otherwise if omap2_iommu_dump_ctx() with \"bytes\" less than 32 it is a\n   buffer overflow.\n2) The snprintf() function returns the number of bytes that *would* have\n   been copied if there were enough space.  But we want to know the\n   number of bytes which were *actually* copied so use scnprintf()\n   instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d25b79a8-0783-4e80-9551-06153ae20875",
      "id": "CVE-2022-50312",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: serial: jsm: fix some leaks in probe\n\nThis error path needs to unwind instead of just returning directly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf57d95d-3e1f-4ef2-baa7-050014de2e9d",
      "id": "CVE-2022-50321",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()\n\nThe brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb\nin case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.\nCompile tested only.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ea0b734-dad4-4e64-9b78-a3258b6247f4",
      "id": "CVE-2022-50373",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix race in lowcomms\n\nThis patch fixes a race between queue_work() in\n_dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can\ntake the final reference of a dlm_msg and so msg-\u003eidx can contain\ngarbage which is signaled by the following warning:\n\n[  676.237050] ------------[ cut here ]------------\n[  676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50\n[  676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr\n[  676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546\n[  676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014\n[  676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50\n[  676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 \u003c0f\u003e 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48\n[  676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282\n[  676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006\n[  676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e\n[  676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001\n[  676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005\n[  676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480\n[  676.254257] FS:  0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000\n[  676.255239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0\n[  676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  676.258397] PKRU: 55555554\n[  676.258729] Call Trace:\n[  676.259063]  \u003cTASK\u003e\n[  676.259354]  dlm_midcomms_commit_mhandle+0xcc/0x110\n[  676.259964]  queue_bast+0x8b/0xb0\n[  676.260423]  grant_pending_locks+0x166/0x1b0\n[  676.261007]  _unlock_lock+0x75/0x90\n[  676.261469]  unlock_lock.isra.57+0x62/0xa0\n[  676.262009]  dlm_unlock+0x21e/0x330\n[  676.262457]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  676.263183]  torture_unlock+0x5a/0x90 [dlm_locktorture]\n[  676.263815]  ? preempt_count_sub+0xba/0x100\n[  676.264361]  ? complete+0x1d/0x60\n[  676.264777]  lock_torture_writer+0xb8/0x150 [dlm_locktorture]\n[  676.265555]  kthread+0x10a/0x130\n[  676.266007]  ? kthread_complete_and_exit+0x20/0x20\n[  676.266616]  ret_from_fork+0x22/0x30\n[  676.267097]  \u003c/TASK\u003e\n[  676.267381] irq event stamp: 9579855\n[  676.267824] hardirqs last  enabled at (9579863): [\u003cffffffffbb14e6f8\u003e] __up_console_sem+0x58/0x60\n[  676.268896] hardirqs last disabled at (9579872): [\u003cffffffffbb14e6dd\u003e] __up_console_sem+0x3d/0x60\n[  676.270008] softirqs last  enabled at (9579798): [\u003cffffffffbc200349\u003e] __do_softirq+0x349/0x4c7\n[  676.271438] softirqs last disabled at (9579897): [\u003cffffffffbb0d54c0\u003e] irq_exit_rcu+0xb0/0xf0\n[  676.272796] ---[ end trace 0000000000000000 ]---\n\nI reproduced this warning with dlm_locktorture test which is currently\nnot upstream. However this patch fix the issue by make a additional\nrefcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg().\nIn case of the race the kref_put() in dlm_lowcomms_commit_msg() will be\nthe final put.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af89f4ac-43f5-4300-a0b0-e5957906abb1",
      "id": "CVE-2022-50378",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/meson: reorder driver deinit sequence to fix use-after-free bug\n\nUnloading the driver triggers the following KASAN warning:\n\n[  +0.006275] =============================================================\n[  +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0\n[  +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695\n\n[  +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G         C O      5.19.0-rc6-lrmbkasan+ #1\n[  +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT)\n[  +0.000008] Call trace:\n[  +0.000007]  dump_backtrace+0x1ec/0x280\n[  +0.000013]  show_stack+0x24/0x80\n[  +0.000008]  dump_stack_lvl+0x98/0xd4\n[  +0.000011]  print_address_description.constprop.0+0x80/0x520\n[  +0.000011]  print_report+0x128/0x260\n[  +0.000007]  kasan_report+0xb8/0xfc\n[  +0.000008]  __asan_report_load8_noabort+0x3c/0x50\n[  +0.000010]  __list_del_entry_valid+0xe0/0x1a0\n[  +0.000009]  drm_atomic_private_obj_fini+0x30/0x200 [drm]\n[  +0.000172]  drm_bridge_detach+0x94/0x260 [drm]\n[  +0.000145]  drm_encoder_cleanup+0xa4/0x290 [drm]\n[  +0.000144]  drm_mode_config_cleanup+0x118/0x740 [drm]\n[  +0.000143]  drm_mode_config_init_release+0x1c/0x2c [drm]\n[  +0.000144]  drm_managed_release+0x170/0x414 [drm]\n[  +0.000142]  drm_dev_put.part.0+0xc0/0x124 [drm]\n[  +0.000143]  drm_dev_put+0x20/0x30 [drm]\n[  +0.000142]  meson_drv_unbind+0x1d8/0x2ac [meson_drm]\n[  +0.000028]  take_down_aggregate_device+0xb0/0x160\n[  +0.000016]  component_del+0x18c/0x360\n[  +0.000009]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]\n[  +0.000015]  platform_remove+0x64/0xb0\n[  +0.000009]  device_remove+0xb8/0x154\n[  +0.000009]  device_release_driver_internal+0x398/0x5b0\n[  +0.000009]  driver_detach+0xac/0x1b0\n[  +0.000009]  bus_remove_driver+0x158/0x29c\n[  +0.000009]  driver_unregister+0x70/0xb0\n[  +0.000008]  platform_driver_unregister+0x20/0x2c\n[  +0.000008]  meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]\n[  +0.000012]  __do_sys_delete_module+0x288/0x400\n[  +0.000011]  __arm64_sys_delete_module+0x5c/0x80\n[  +0.000009]  invoke_syscall+0x74/0x260\n[  +0.000009]  el0_svc_common.constprop.0+0xcc/0x260\n[  +0.000009]  do_el0_svc+0x50/0x70\n[  +0.000007]  el0_svc+0x68/0x1a0\n[  +0.000012]  el0t_64_sync_handler+0x11c/0x150\n[  +0.000008]  el0t_64_sync+0x18c/0x190\n\n[  +0.000018] Allocated by task 0:\n[  +0.000007] (stack is not available)\n\n[  +0.000011] Freed by task 2695:\n[  +0.000008]  kasan_save_stack+0x2c/0x5c\n[  +0.000011]  kasan_set_track+0x2c/0x40\n[  +0.000008]  kasan_set_free_info+0x28/0x50\n[  +0.000009]  ____kasan_slab_free+0x128/0x1d4\n[  +0.000008]  __kasan_slab_free+0x18/0x24\n[  +0.000007]  slab_free_freelist_hook+0x108/0x230\n[  +0.000011]  kfree+0x110/0x35c\n[  +0.000008]  release_nodes+0xf0/0x16c\n[  +0.000009]  devres_release_group+0x180/0x270\n[  +0.000008]  component_unbind+0x128/0x1e0\n[  +0.000010]  component_unbind_all+0x1b8/0x264\n[  +0.000009]  meson_drv_unbind+0x1a0/0x2ac [meson_drm]\n[  +0.000025]  take_down_aggregate_device+0xb0/0x160\n[  +0.000009]  component_del+0x18c/0x360\n[  +0.000009]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]\n[  +0.000012]  platform_remove+0x64/0xb0\n[  +0.000008]  device_remove+0xb8/0x154\n[  +0.000009]  device_release_driver_internal+0x398/0x5b0\n[  +0.000009]  driver_detach+0xac/0x1b0\n[  +0.000009]  bus_remove_driver+0x158/0x29c\n[  +0.000008]  driver_unregister+0x70/0xb0\n[  +0.000008]  platform_driver_unregister+0x20/0x2c\n[  +0.000008]  meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]\n[  +0.000011]  __do_sys_delete_module+0x288/0x400\n[  +0.000010]  __arm64_sys_delete_module+0x5c/0x80\n[  +0.000008]  invoke_syscall+0x74/0x260\n[  +0.000008]  el0_svc_common.constprop.0+0xcc/0x260\n[  +0.000008]  do_el0_svc+0x50/0x70\n[  +0.000007]  el0_svc+0x68/0x1a0\n[  +0.000009]  el0t_64_sync_handler+0x11c/0x150\n[  +0.000009]  el0t_64_sync+0x18c/0x190\n\n[  +0.000014] The buggy address belongs to the object at ffff000020c39000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f91459d-a7d5-4344-86d3-d159eaaa4a38",
      "id": "CVE-2022-50384",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vme_user: Fix possible UAF in tsi148_dma_list_add\n\nSmatch report warning as follows:\n\ndrivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:\n  '\u0026entry-\u003elist' not removed from list\n\nIn tsi148_dma_list_add(), the error path \"goto err_dma\" will not\nremove entry-\u003elist from list-\u003eentries, but entry will be freed,\nthen list traversal may cause UAF.\n\nFix by removeing it from list-\u003eentries before free().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6ae5879-7529-4989-a225-afef819f644f",
      "id": "CVE-2022-50410",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Protect against send buffer overflow in NFSv2 READ\n\nSince before the git era, NFSD has conserved the number of pages\nheld by each nfsd thread by combining the RPC receive and send\nbuffers into a single array of pages. This works because there are\nno cases where an operation needs a large RPC Call message and a\nlarge RPC Reply at the same time.\n\nOnce an RPC Call has been received, svc_process() updates\nsvc_rqst::rq_res to describe the part of rq_pages that can be\nused for constructing the Reply. This means that the send buffer\n(rq_res) shrinks when the received RPC record containing the RPC\nCall is large.\n\nA client can force this shrinkage on TCP by sending a correctly-\nformed RPC Call header contained in an RPC record that is\nexcessively large. The full maximum payload size cannot be\nconstructed in that case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b76b4aa1-d53d-4a40-8db7-0ab24a39f571",
      "id": "CVE-2023-2194",
      "description": "An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace \"data-\u003eblock[0]\" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4d28bfb-85c1-4832-b23a-146de872b479",
      "id": "CVE-2023-4133",
      "description": "A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00b1bfed-7186-43ea-a6a8-3d4283f84958",
      "id": "CVE-2023-42755",
      "description": "A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "600f7191-51e1-4d10-abf7-e4c69a2123a6",
      "id": "CVE-2023-4459",
      "description": "A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "72de5a08-e1d1-4adb-bbd0-34d8fc0e095c",
      "id": "CVE-2023-46862",
      "description": "An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f1408475-9a7b-40ee-9a81-cc8cf3389bd1",
      "id": "CVE-2023-52470",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: check the alloc_workqueue return value in radeon_crtc_init()\n\ncheck the alloc_workqueue return value in radeon_crtc_init()\nto avoid null-ptr-deref.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01fce7a6-359d-4a52-ba37-7c54e63284e0",
      "id": "CVE-2023-52477",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: hub: Guard against accesses to uninitialized BOS descriptors\n\nMany functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h\naccess fields inside udev-\u003ebos without checking if it was allocated and\ninitialized. If usb_get_bos_descriptor() fails for whatever\nreason, udev-\u003ebos will be NULL and those accesses will result in a\ncrash:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000018\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 \u003cHASH:1f9e 1\u003e\nHardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:hub_port_reset+0x193/0x788\nCode: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 \u003c48\u003e 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9\nRSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310\nRDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840\nRBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000\nR13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0\nCall Trace:\nhub_event+0x73f/0x156e\n? hub_activate+0x5b7/0x68f\nprocess_one_work+0x1a2/0x487\nworker_thread+0x11a/0x288\nkthread+0x13a/0x152\n? process_one_work+0x487/0x487\n? kthread_associate_blkcg+0x70/0x70\nret_from_fork+0x1f/0x30\n\nFall back to a default behavior if the BOS descriptor isn't accessible\nand skip all the functionalities that depend on it: LPM support checks,\nSuper Speed capabilitiy checks, U1/U2 states setup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8bb8c3e-bc8f-47b9-bc60-e67be6fdf96b",
      "id": "CVE-2023-52484",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range\n\nWhen running an SVA case, the following soft lockup is triggered:\n--------------------------------------------------------------------\nwatchdog: BUG: soft lockup - CPU#244 stuck for 26s!\npstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50\nlr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50\nsp : ffff8000d83ef290\nx29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000\nx26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000\nx23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0\nx20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0\nx14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000\nx11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc\nx8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa\nx5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a\nx2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001\nCall trace:\n arm_smmu_cmdq_issue_cmdlist+0x178/0xa50\n __arm_smmu_tlb_inv_range+0x118/0x254\n arm_smmu_tlb_inv_range_asid+0x6c/0x130\n arm_smmu_mm_invalidate_range+0xa0/0xa4\n __mmu_notifier_invalidate_range_end+0x88/0x120\n unmap_vmas+0x194/0x1e0\n unmap_region+0xb4/0x144\n do_mas_align_munmap+0x290/0x490\n do_mas_munmap+0xbc/0x124\n __vm_munmap+0xa8/0x19c\n __arm64_sys_munmap+0x28/0x50\n invoke_syscall+0x78/0x11c\n el0_svc_common.constprop.0+0x58/0x1c0\n do_el0_svc+0x34/0x60\n el0_svc+0x2c/0xd4\n el0t_64_sync_handler+0x114/0x140\n el0t_64_sync+0x1a4/0x1a8\n--------------------------------------------------------------------\n\nNote that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamed\nto \"arm_smmu_mm_arch_invalidate_secondary_tlbs\", yet the problem remains.\n\nThe commit 06ff87bae8d3 (\"arm64: mm: remove unused functions and variable\nprotoypes\") fixed a similar lockup on the CPU MMU side. Yet, it can occur\nto SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is called\ntypically next to MMU tlb flush function, e.g.\n\ttlb_flush_mmu_tlbonly {\n\t\ttlb_flush {\n\t\t\t__flush_tlb_range {\n\t\t\t\t// check MAX_TLBI_OPS\n\t\t\t}\n\t\t}\n\t\tmmu_notifier_arch_invalidate_secondary_tlbs {\n\t\t\tarm_smmu_mm_arch_invalidate_secondary_tlbs {\n\t\t\t\t// does not check MAX_TLBI_OPS\n\t\t\t}\n\t\t}\n\t}\n\nClone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an\nSVA case SMMU uses the CPU page table, so it makes sense to align with the\ntlbflush code. Then, replace per-page TLBI commands with a single per-asid\nTLBI command, if the request size hits this threshold.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e86202c8-ea27-4aca-be65-d7dd69a687b0",
      "id": "CVE-2023-52511",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: sun6i: reduce DMA RX transfer width to single byte\n\nThrough empirical testing it has been determined that sometimes RX SPI\ntransfers with DMA enabled return corrupted data. This is down to single\nor even multiple bytes lost during DMA transfer from SPI peripheral to\nmemory. It seems the RX FIFO within the SPI peripheral can become\nconfused when performing bus read accesses wider than a single byte to it\nduring an active SPI transfer.\n\nThis patch reduces the width of individual DMA read accesses to the\nRX FIFO to a single byte to mitigate that issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2a33140-3c59-4203-824e-93acf27b20f8",
      "id": "CVE-2023-52531",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: Fix a memory corruption issue\n\nA few lines above, space is kzalloc()'ed for:\n\tsizeof(struct iwl_nvm_data) +\n\tsizeof(struct ieee80211_channel) +\n\tsizeof(struct ieee80211_rate)\n\n'mvm-\u003envm_data' is a 'struct iwl_nvm_data', so it is fine.\n\nAt the end of this structure, there is the 'channels' flex array.\nEach element is of type 'struct ieee80211_channel'.\nSo only 1 element is allocated in this array.\n\nWhen doing:\n  mvm-\u003envm_data-\u003ebands[0].channels = mvm-\u003envm_data-\u003echannels;\nWe point at the first element of the 'channels' flex array.\nSo this is fine.\n\nHowever, when doing:\n  mvm-\u003envm_data-\u003ebands[0].bitrates =\n\t\t\t(void *)((u8 *)mvm-\u003envm_data-\u003echannels + 1);\nbecause of the \"(u8 *)\" cast, we add only 1 to the address of the beginning\nof the flex array.\n\nIt is likely that we want point at the 'struct ieee80211_rate' allocated\njust after.\n\nRemove the spurious casting so that the pointer arithmetic works as\nexpected.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4e6a66ee-31d0-46cd-a807-dc10b489eafd",
      "id": "CVE-2020-11668",
      "description": "In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fdaf7a23-cb61-4fa7-8a47-40759db35289",
      "id": "CVE-2023-52628",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nftables: exthdr: fix 4-byte stack OOB write\n\nIf priv-\u003elen is a multiple of 4, then dst[len / 4] can write past\nthe destination array which leads to stack corruption.\n\nThis construct is necessary to clean the remainder of the register\nin case -\u003elen is NOT a multiple of the register size, so make it\nconditional just like nft_payload.c does.\n\nThe bug was added in 4.1 cycle and then copied/inherited when\ntcp/sctp and ip option support was added.\n\nBug reported by Zero Day Initiative project (ZDI-CAN-21950,\nZDI-CAN-21951, ZDI-CAN-21961).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9dcd331d-59bb-49a2-a1ad-2e5c5a4a82a4",
      "id": "CVE-2023-52637",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)\n\nLock jsk-\u003esk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...)\nmodifies jsk-\u003efilters while receiving packets.\n\nFollowing trace was seen on affected system:\n ==================================================================\n BUG: KASAN: slab-use-after-free in j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n Read of size 4 at addr ffff888012144014 by task j1939/350\n\n CPU: 0 PID: 350 Comm: j1939 Tainted: G        W  OE      6.5.0-rc5 #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n Call Trace:\n  print_report+0xd3/0x620\n  ? kasan_complete_mode_report_info+0x7d/0x200\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  kasan_report+0xc2/0x100\n  ? j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  __asan_load4+0x84/0xb0\n  j1939_sk_recv_match_one+0x1af/0x2d0 [can_j1939]\n  j1939_sk_recv+0x20b/0x320 [can_j1939]\n  ? __kasan_check_write+0x18/0x20\n  ? __pfx_j1939_sk_recv+0x10/0x10 [can_j1939]\n  ? j1939_simple_recv+0x69/0x280 [can_j1939]\n  ? j1939_ac_recv+0x5e/0x310 [can_j1939]\n  j1939_can_recv+0x43f/0x580 [can_j1939]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  ? raw_rcv+0x42/0x3c0 [can_raw]\n  ? __pfx_j1939_can_recv+0x10/0x10 [can_j1939]\n  can_rcv_filter+0x11f/0x350 [can]\n  can_receive+0x12f/0x190 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  can_rcv+0xdd/0x130 [can]\n  ? __pfx_can_rcv+0x10/0x10 [can]\n  __netif_receive_skb_one_core+0x13d/0x150\n  ? __pfx___netif_receive_skb_one_core+0x10/0x10\n  ? __kasan_check_write+0x18/0x20\n  ? _raw_spin_lock_irq+0x8c/0xe0\n  __netif_receive_skb+0x23/0xb0\n  process_backlog+0x107/0x260\n  __napi_poll+0x69/0x310\n  net_rx_action+0x2a1/0x580\n  ? __pfx_net_rx_action+0x10/0x10\n  ? __pfx__raw_spin_lock+0x10/0x10\n  ? handle_irq_event+0x7d/0xa0\n  __do_softirq+0xf3/0x3f8\n  do_softirq+0x53/0x80\n  \u003c/IRQ\u003e\n  \u003cTASK\u003e\n  __local_bh_enable_ip+0x6e/0x70\n  netif_rx+0x16b/0x180\n  can_send+0x32b/0x520 [can]\n  ? __pfx_can_send+0x10/0x10 [can]\n  ? __check_object_size+0x299/0x410\n  raw_sendmsg+0x572/0x6d0 [can_raw]\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  ? apparmor_socket_sendmsg+0x2f/0x40\n  ? __pfx_raw_sendmsg+0x10/0x10 [can_raw]\n  sock_sendmsg+0xef/0x100\n  sock_write_iter+0x162/0x220\n  ? __pfx_sock_write_iter+0x10/0x10\n  ? __rtnl_unlock+0x47/0x80\n  ? security_file_permission+0x54/0x320\n  vfs_write+0x6ba/0x750\n  ? __pfx_vfs_write+0x10/0x10\n  ? __fget_light+0x1ca/0x1f0\n  ? __rcu_read_unlock+0x5b/0x280\n  ksys_write+0x143/0x170\n  ? __pfx_ksys_write+0x10/0x10\n  ? __kasan_check_read+0x15/0x20\n  ? fpregs_assert_state_consistent+0x62/0x70\n  __x64_sys_write+0x47/0x60\n  do_syscall_64+0x60/0x90\n  ? do_syscall_64+0x6d/0x90\n  ? irqentry_exit+0x3f/0x50\n  ? exc_page_fault+0x79/0xf0\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n Allocated by task 348:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_alloc_info+0x1f/0x30\n  __kasan_kmalloc+0xb5/0xc0\n  __kmalloc_node_track_caller+0x67/0x160\n  j1939_sk_setsockopt+0x284/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n Freed by task 349:\n  kasan_save_stack+0x2a/0x50\n  kasan_set_track+0x29/0x40\n  kasan_save_free_info+0x2f/0x50\n  __kasan_slab_free+0x12e/0x1c0\n  __kmem_cache_free+0x1b9/0x380\n  kfree+0x7a/0x120\n  j1939_sk_setsockopt+0x3b2/0x450 [can_j1939]\n  __sys_setsockopt+0x15c/0x2f0\n  __x64_sys_setsockopt+0x6b/0x80\n  do_syscall_64+0x60/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94b9476d-4efe-4ddb-91a4-8a4ac34bfe23",
      "id": "CVE-2023-52642",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: bpf attach/detach requires write permission\n\nNote that bpf attach/detach also requires CAP_NET_ADMIN.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5514270a-fca9-46fa-bc7b-67804894967b",
      "id": "CVE-2023-52750",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer\n\nPrior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly\nbyte-swap NOP when compiling for big-endian, and the resulting series of\nbytes happened to match the encoding of FNMADD S21, S30, S0, S0.\n\nThis went unnoticed until commit:\n\n  34f66c4c4d5518c1 (\"arm64: Use a positive cpucap for FP/SIMD\")\n\nPrior to that commit, the kernel would always enable the use of FPSIMD\nearly in boot when __cpu_setup() initialized CPACR_EL1, and so usage of\nFNMADD within the kernel was not detected, but could result in the\ncorruption of user or kernel FPSIMD state.\n\nAfter that commit, the instructions happen to trap during boot prior to\nFPSIMD being detected and enabled, e.g.\n\n| Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD\n| CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1\n| Hardware name: linux,dummy-virt (DT)\n| pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : __pi_strcmp+0x1c/0x150\n| lr : populate_properties+0xe4/0x254\n| sp : ffffd014173d3ad0\n| x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27: 0000000000000000\n| x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008\n| x23: fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044\n| x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005\n| x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000\n| x14: 0000000000000000 x13: 0000000000001bcc x12: 0000000000000000\n| x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000\n| x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000\n| x5 : 0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a\n| x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8\n| Kernel panic - not syncing: Unhandled exception\n| CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1\n| Hardware name: linux,dummy-virt (DT)\n| Call trace:\n|  dump_backtrace+0xec/0x108\n|  show_stack+0x18/0x2c\n|  dump_stack_lvl+0x50/0x68\n|  dump_stack+0x18/0x24\n|  panic+0x13c/0x340\n|  el1t_64_irq_handler+0x0/0x1c\n|  el1_abort+0x0/0x5c\n|  el1h_64_sync+0x64/0x68\n|  __pi_strcmp+0x1c/0x150\n|  unflatten_dt_nodes+0x1e8/0x2d8\n|  __unflatten_device_tree+0x5c/0x15c\n|  unflatten_device_tree+0x38/0x50\n|  setup_arch+0x164/0x1e0\n|  start_kernel+0x64/0x38c\n|  __primary_switched+0xbc/0xc4\n\nRestrict CONFIG_CPU_BIG_ENDIAN to a known good assembler, which is\neither GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked\ncommit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46af1a82-31b4-41cf-8802-60a8279b7c19",
      "id": "CVE-2023-52763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.\n\nThe `i3c_master_bus_init` function may attach the I2C devices before the\nI3C bus initialization. In this flow, the DAT `alloc_entry`` will be used\nbefore the DAT `init`. Additionally, if the `i3c_master_bus_init` fails,\nthe DAT `cleanup` will execute before the device is detached, which will\nexecue DAT `free_entry` function. The above scenario can cause the driver\nto use DAT_data when it is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a504aad7-9bad-4198-a8ea-b91afa132cf4",
      "id": "CVE-2023-52865",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data\n\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6b3b4f6-587e-44f6-9ce4-5e099f5e4424",
      "id": "CVE-2023-52876",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data\n\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "624a1d7c-666d-4f9d-8885-6489a36381fc",
      "id": "CVE-2023-53039",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: ipc: Fix potential use-after-free in work function\n\nWhen a reset notify IPC message is received, the ISR schedules a work\nfunction and passes the ISHTP device to it via a global pointer\nishtp_dev. If ish_probe() fails, the devm-managed device resources\nincluding ishtp_dev are freed, but the work is not cancelled, causing a\nuse-after-free when the work function tries to access ishtp_dev. Use\ndevm_work_autocancel() instead, so that the work is automatically\ncancelled if probe fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45871d79-8247-4cd9-a883-cb26ea0f61dc",
      "id": "CVE-2023-53103",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails\n\nsyzbot reported a warning[1] where the bond device itself is a slave and\nwe try to enslave a non-ethernet device as the first slave which fails\nbut then in the error path when ether_setup() restores the bond device\nit also clears all flags. In my previous fix[2] I restored the\nIFF_MASTER flag, but I didn't consider the case that the bond device\nitself might also be a slave with IFF_SLAVE set, so we need to restore\nthat flag as well. Use the bond_ether_setup helper which does the right\nthing and restores the bond's flags properly.\n\nSteps to reproduce using a nlmon dev:\n $ ip l add nlmon0 type nlmon\n $ ip l add bond1 type bond\n $ ip l add bond2 type bond\n $ ip l set bond1 master bond2\n $ ip l set dev nlmon0 master bond1\n $ ip -d l sh dev bond1\n 22: bond1: \u003cBROADCAST,MULTICAST,MASTER\u003e mtu 1500 qdisc noqueue master bond2 state DOWN mode DEFAULT group default qlen 1000\n (now bond1's IFF_SLAVE flag is gone and we'll hit a warning[3] if we\n  try to delete it)\n\n[1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef\n[2] commit 7d5cd2ce5292 (\"bonding: correctly handle bonding type change on enslave failure\")\n[3] example warning:\n [   27.008664] bond1: (slave nlmon0): The slave device specified does not support setting the MAC address\n [   27.008692] bond1: (slave nlmon0): Error -95 calling set_mac_address\n [   32.464639] bond1 (unregistering): Released all slaves\n [   32.464685] ------------[ cut here ]------------\n [   32.464686] WARNING: CPU: 1 PID: 2004 at net/core/dev.c:10829 unregister_netdevice_many+0x72a/0x780\n [   32.464694] Modules linked in: br_netfilter bridge bonding virtio_net\n [   32.464699] CPU: 1 PID: 2004 Comm: ip Kdump: loaded Not tainted 5.18.0-rc3+ #47\n [   32.464703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014\n [   32.464704] RIP: 0010:unregister_netdevice_many+0x72a/0x780\n [   32.464707] Code: 99 fd ff ff ba 90 1a 00 00 48 c7 c6 f4 02 66 96 48 c7 c7 20 4d 35 96 c6 05 fa c7 2b 02 01 e8 be 6f 4a 00 0f 0b e9 73 fd ff ff \u003c0f\u003e 0b e9 5f fd ff ff 80 3d e3 c7 2b 02 00 0f 85 3b fd ff ff ba 59\n [   32.464710] RSP: 0018:ffffa006422d7820 EFLAGS: 00010206\n [   32.464712] RAX: ffff8f6e077140a0 RBX: ffffa006422d7888 RCX: 0000000000000000\n [   32.464714] RDX: ffff8f6e12edbe58 RSI: 0000000000000296 RDI: ffffffff96d4a520\n [   32.464716] RBP: ffff8f6e07714000 R08: ffffffff96d63600 R09: ffffa006422d7728\n [   32.464717] R10: 0000000000000ec0 R11: ffffffff9698c988 R12: ffff8f6e12edb140\n [   32.464719] R13: dead000000000122 R14: dead000000000100 R15: ffff8f6e12edb140\n [   32.464723] FS:  00007f297c2f1740(0000) GS:ffff8f6e5d900000(0000) knlGS:0000000000000000\n [   32.464725] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [   32.464726] CR2: 00007f297bf1c800 CR3: 00000000115e8000 CR4: 0000000000350ee0\n [   32.464730] Call Trace:\n [   32.464763]  \u003cTASK\u003e\n [   32.464767]  rtnl_dellink+0x13e/0x380\n [   32.464776]  ? cred_has_capability.isra.0+0x68/0x100\n [   32.464780]  ? __rtnl_unlock+0x33/0x60\n [   32.464783]  ? bpf_lsm_capset+0x10/0x10\n [   32.464786]  ? security_capable+0x36/0x50\n [   32.464790]  rtnetlink_rcv_msg+0x14e/0x3b0\n [   32.464792]  ? _copy_to_iter+0xb1/0x790\n [   32.464796]  ? post_alloc_hook+0xa0/0x160\n [   32.464799]  ? rtnl_calcit.isra.0+0x110/0x110\n [   32.464802]  netlink_rcv_skb+0x50/0xf0\n [   32.464806]  netlink_unicast+0x216/0x340\n [   32.464809]  netlink_sendmsg+0x23f/0x480\n [   32.464812]  sock_sendmsg+0x5e/0x60\n [   32.464815]  ____sys_sendmsg+0x22c/0x270\n [   32.464818]  ? import_iovec+0x17/0x20\n [   32.464821]  ? sendmsg_copy_msghdr+0x59/0x90\n [   32.464823]  ? do_set_pte+0xa0/0xe0\n [   32.464828]  ___sys_sendmsg+0x81/0xc0\n [   32.464832]  ? mod_objcg_state+0xc6/0x300\n [   32.464835]  ? refill_obj_stock+0xa9/0x160\n [   32.464838]  ? memcg_slab_free_hook+0x1a5/0x1f0\n [   32.464842]  __sys_sendm\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba742e44-c137-461f-812f-465de619fd13",
      "id": "CVE-2023-53111",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Fix use-after-free issues\n\ndo_req_filebacked() calls blk_mq_complete_request() synchronously or\nasynchronously when using asynchronous I/O unless memory allocation fails.\nHence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor\n'rq' after do_req_filebacked() finished unless we are sure that the request\nhas not yet been completed. This patch fixes the following kernel crash:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000054\nCall trace:\n css_put.42938+0x1c/0x1ac\n loop_process_work+0xc8c/0xfd4\n loop_rootcg_workfn+0x24/0x34\n process_one_work+0x244/0x558\n worker_thread+0x400/0x8fc\n kthread+0x16c/0x1e0\n ret_from_fork+0x10/0x20",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55c68a71-940a-4297-9ffa-a11c3831d3fa",
      "id": "CVE-2023-53173",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: pcn_uart: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be2ab792-85da-41d6-9e00-7bf27997d6e4",
      "id": "CVE-2024-56757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\n\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "772e3106-9b8b-4f1e-bb02-bc96d6812b6b",
      "id": "CVE-2023-53244",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish\n\nWhen the driver calls tw68_risc_buffer() to prepare the buffer, the\nfunction call dma_alloc_coherent may fail, resulting in a empty buffer\nbuf-\u003ecpu. Later when we free the buffer or access the buffer, null ptr\nderef is triggered.\n\nThis bug is similar to the following one:\nhttps://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.\n\nWe believe the bug can be also dynamically triggered from user side.\nSimilarly, we fix this by checking the return value of tw68_risc_buffer()\nand the value of buf-\u003ecpu before buffer free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d2e5b2b4-0910-4349-a3fe-4a36a8b95f6c",
      "id": "CVE-2023-53309",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Fix integer overflow in radeon_cs_parser_init\n\nThe type of size is unsigned, if size is 0x40000000, there will be an\ninteger overflow, size will be zero after size *= sizeof(uint32_t),\nwill cause uninitialized memory to be referenced later",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc066368-1d27-480f-8046-f5c38646dc3e",
      "id": "CVE-2024-0340",
      "description": "A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9552ae0-7e00-4df4-b766-b9874b6550a3",
      "id": "CVE-2024-26756",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Don't register sync_thread for reshape directly\n\nCurrently, if reshape is interrupted, then reassemble the array will\nregister sync_thread directly from pers-\u003erun(), in this case\n'MD_RECOVERY_RUNNING' is set directly, however, there is no guarantee\nthat md_do_sync() will be executed, hence stop_sync_thread() will hang\nbecause 'MD_RECOVERY_RUNNING' can't be cleared.\n\nLast patch make sure that md_do_sync() will set MD_RECOVERY_DONE,\nhowever, following hang can still be triggered by dm-raid test\nshell/lvconvert-raid-reshape.sh occasionally:\n\n[root@fedora ~]# cat /proc/1982/stack\n[\u003c0\u003e] stop_sync_thread+0x1ab/0x270 [md_mod]\n[\u003c0\u003e] md_frozen_sync_thread+0x5c/0xa0 [md_mod]\n[\u003c0\u003e] raid_presuspend+0x1e/0x70 [dm_raid]\n[\u003c0\u003e] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]\n[\u003c0\u003e] __dm_destroy+0x2a5/0x310 [dm_mod]\n[\u003c0\u003e] dm_destroy+0x16/0x30 [dm_mod]\n[\u003c0\u003e] dev_remove+0x165/0x290 [dm_mod]\n[\u003c0\u003e] ctl_ioctl+0x4bb/0x7b0 [dm_mod]\n[\u003c0\u003e] dm_ctl_ioctl+0x11/0x20 [dm_mod]\n[\u003c0\u003e] vfs_ioctl+0x21/0x60\n[\u003c0\u003e] __x64_sys_ioctl+0xb9/0xe0\n[\u003c0\u003e] do_syscall_64+0xc6/0x230\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74\n\nMeanwhile mddev-\u003erecovery is:\nMD_RECOVERY_RUNNING |\nMD_RECOVERY_INTR |\nMD_RECOVERY_RESHAPE |\nMD_RECOVERY_FROZEN\n\nFix this problem by remove the code to register sync_thread directly\nfrom raid10 and raid5. And let md_check_recovery() to register\nsync_thread.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae9f43a9-5891-48b0-b808-5442c50968ac",
      "id": "CVE-2024-27054",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: fix double module refcount decrement\n\nOnce the discipline is associated with the device, deleting the device\ntakes care of decrementing the module's refcount.  Doing it manually on\nthis error path causes refcount to artificially decrease on each error\nwhile it should just stay the same.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f465ba76-ab4c-43c1-a513-e33f341c7c79",
      "id": "CVE-2024-35803",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/efistub: Call mixed mode boot services on the firmware's stack\n\nNormally, the EFI stub calls into the EFI boot services using the stack\nthat was live when the stub was entered. According to the UEFI spec,\nthis stack needs to be at least 128k in size - this might seem large but\nall asynchronous processing and event handling in EFI runs from the same\nstack and so quite a lot of space may be used in practice.\n\nIn mixed mode, the situation is a bit different: the bootloader calls\nthe 32-bit EFI stub entry point, which calls the decompressor's 32-bit\nentry point, where the boot stack is set up, using a fixed allocation\nof 16k. This stack is still in use when the EFI stub is started in\n64-bit mode, and so all calls back into the EFI firmware will be using\nthe decompressor's limited boot stack.\n\nDue to the placement of the boot stack right after the boot heap, any\nstack overruns have gone unnoticed. However, commit\n\n  5c4feadb0011983b (\"x86/decompressor: Move global symbol references to C code\")\n\nmoved the definition of the boot heap into C code, and now the boot\nstack is placed right at the base of BSS, where any overruns will\ncorrupt the end of the .data section.\n\nWhile it would be possible to work around this by increasing the size of\nthe boot stack, doing so would affect all x86 systems, and mixed mode\nsystems are a tiny (and shrinking) fraction of the x86 installed base.\n\nSo instead, record the firmware stack pointer value when entering from\nthe 32-bit firmware, and switch to this stack every time a EFI boot\nservice call is made.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac72060d-450f-44b5-b1fb-88f567ed2215",
      "id": "CVE-2024-35976",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING\n\nsyzbot reported an illegal copy in xsk_setsockopt() [1]\n\nMake sure to validate setsockopt() @optlen parameter.\n\n[1]\n\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\nRead of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549\n\nCPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\nRIP: 0033:0x7fb40587de69\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69\nRDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006\nRBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08\n \u003c/TASK\u003e\n\nAllocated by task 7549:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3966 [inline]\n  __kmalloc+0x233/0x4a0 mm/slub.c:3979\n  kmalloc include/linux/slab.h:632 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nThe buggy address belongs to the object at ffff888028c6cde0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 1 bytes to the right of\n allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2)\n\nThe buggy address belongs to the physical page:\npage:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c\nanon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)\npage_type: 0xffffffff()\nraw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001\nraw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\npage_owner tracks the page as allocated\npage last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223\n  set_page_owner include/linux/page_owner.h:31 [inline]\n  post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533\n  prep_new_page mm/page_alloc.c:\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd50b1e9-8ca3-42ef-96d1-ad5bd574124c",
      "id": "CVE-2025-21700",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: Disallow replacing of child qdisc from one parent to another\n\nLion Ackermann was able to create a UAF which can be abused for privilege\nescalation with the following script\n\nStep 1. create root qdisc\ntc qdisc add dev lo root handle 1:0 drr\n\nstep2. a class for packet aggregation do demonstrate uaf\ntc class add dev lo classid 1:1 drr\n\nstep3. a class for nesting\ntc class add dev lo classid 1:2 drr\n\nstep4. a class to graft qdisc to\ntc class add dev lo classid 1:3 drr\n\nstep5.\ntc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024\n\nstep6.\ntc qdisc add dev lo parent 1:2 handle 3:0 drr\n\nstep7.\ntc class add dev lo classid 3:1 drr\n\nstep 8.\ntc qdisc add dev lo parent 3:1 handle 4:0 pfifo\n\nstep 9. Display the class/qdisc layout\n\ntc class ls dev lo\n class drr 1:1 root leaf 2: quantum 64Kb\n class drr 1:2 root leaf 3: quantum 64Kb\n class drr 3:1 root leaf 4: quantum 64Kb\n\ntc qdisc ls\n qdisc drr 1: dev lo root refcnt 2\n qdisc plug 2: dev lo parent 1:1\n qdisc pfifo 4: dev lo parent 3:1 limit 1000p\n qdisc drr 3: dev lo parent 1:2\n\nstep10. trigger the bug \u003c=== prevented by this patch\ntc qdisc replace dev lo parent 1:3 handle 4:0\n\nstep 11. Redisplay again the qdiscs/classes\n\ntc class ls dev lo\n class drr 1:1 root leaf 2: quantum 64Kb\n class drr 1:2 root leaf 3: quantum 64Kb\n class drr 1:3 root leaf 4: quantum 64Kb\n class drr 3:1 root leaf 4: quantum 64Kb\n\ntc qdisc ls\n qdisc drr 1: dev lo root refcnt 2\n qdisc plug 2: dev lo parent 1:1\n qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p\n qdisc drr 3: dev lo parent 1:2\n\nObserve that a) parent for 4:0 does not change despite the replace request.\nThere can only be one parent.  b) refcount has gone up by two for 4:0 and\nc) both class 1:3 and 3:1 are pointing to it.\n\nStep 12.  send one packet to plug\necho \"\" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001))\nstep13.  send one packet to the grafted fifo\necho \"\" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003))\n\nstep14. lets trigger the uaf\ntc class delete dev lo classid 1:3\ntc class delete dev lo classid 1:1\n\nThe semantics of \"replace\" is for a del/add _on the same node_ and not\na delete from one node(3:1) and add to another node (1:3) as in step10.\nWhile we could \"fix\" with a more complex approach there could be\nconsequences to expectations so the patch takes the preventive approach of\n\"disallow such config\".\n\nJoint work with Lion Ackermann \u003cnnamrec@gmail.com\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f5fc56d-f680-46be-8d3c-fda9559c72ca",
      "id": "CVE-2024-38637",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: lights: check return of get_channel_from_mode\n\nIf channel for the given node is not found we return null from\nget_channel_from_mode. Make sure we validate the return pointer\nbefore using it in two of the missing places.\n\nThis was originally reported in [0]:\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[0] https://lore.kernel.org/all/20240301190425.120605-1-m.lobanov@rosalinux.ru",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e14e7023-e68c-4cd4-b453-f21f766d90c1",
      "id": "CVE-2024-42081",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/xe_devcoredump: Check NULL before assignments\n\nAssign 'xe_devcoredump_snapshot *' and 'xe_device *' only if\n'coredump' is not NULL.\n\nv2\n- Fix commit messages.\n\nv3\n- Define variables before code.(Ashutosh/Jose)\n\nv4\n- Drop return check for coredump_to_xe. (Jose/Rodrigo)\n\nv5\n- Modify misleading commit message. (Matt)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "edfc3473-5644-4bfe-b57a-92f61bbf19d2",
      "id": "CVE-2024-42135",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost_task: Handle SIGKILL by flushing work and exiting\n\nInstead of lingering until the device is closed, this has us handle\nSIGKILL by:\n\n1. marking the worker as killed so we no longer try to use it with\n   new virtqueues and new flush operations.\n2. setting the virtqueue to worker mapping so no new works are queued.\n3. running all the exiting works.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3fa6420e-2bdd-42f3-863f-5d57732a7f7d",
      "id": "CVE-2024-42319",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()\n\nWhen mtk-cmdq unbinds, a WARN_ON message with condition\npm_runtime_get_sync() \u003c 0 occurs.\n\nAccording to the call tracei below:\n  cmdq_mbox_shutdown\n  mbox_free_channel\n  mbox_controller_unregister\n  __devm_mbox_controller_unregister\n  ...\n\nThe root cause can be deduced to be calling pm_runtime_get_sync() after\ncalling pm_runtime_disable() as observed below:\n1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe()\n   to bind the cmdq device to the mbox_controller, so\n   devm_mbox_controller_unregister() will automatically unregister\n   the device bound to the mailbox controller when the device-managed\n   resource is removed. That means devm_mbox_controller_unregister()\n   and cmdq_mbox_shoutdown() will be called after cmdq_remove().\n2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after\n   devm_mbox_controller_register(), so that devm_pm_runtime_disable()\n   will be called after cmdq_remove(), but before\n   devm_mbox_controller_unregister().\n\nTo fix this problem, cmdq_probe() needs to move\ndevm_mbox_controller_register() after devm_pm_runtime_enable() to make\ndevm_pm_runtime_disable() be called after\ndevm_mbox_controller_unregister().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aad9f631-183b-46ad-8d0f-c0c08854a848",
      "id": "CVE-2024-43886",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check in resource_log_pipe_topology_update\n\n[WHY]\nWhen switching from \"Extend\" to \"Second Display Only\" we sometimes\ncall resource_get_otg_master_for_stream on a stream for the eDP,\nwhich is disconnected. This leads to a null pointer dereference.\n\n[HOW]\nAdded a null check in dc_resource.c/resource_log_pipe_topology_update.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0766e37-36b8-4bfa-b9df-e53db7506506",
      "id": "CVE-2024-43904",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing\n\nThis commit adds null checks for the 'stream' and 'plane' variables in\nthe dcn30_apply_idle_power_optimizations function. These variables were\npreviously assumed to be null at line 922, but they were used later in\nthe code without checking if they were null. This could potentially lead\nto a null pointer dereference, which would cause a crash.\n\nThe null checks ensure that 'stream' and 'plane' are not null before\nthey are used, preventing potential crashes.\n\nFixes the below static smatch checker:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:938 dcn30_apply_idle_power_optimizations() error: we previously assumed 'stream' could be null (see line 922)\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:940 dcn30_apply_idle_power_optimizations() error: we previously assumed 'plane' could be null (see line 922)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e491fac-d1ed-40ee-8c3d-a2f4317937d2",
      "id": "CVE-2024-46849",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: meson: axg-card: fix 'use-after-free'\n\nBuffer 'card-\u003edai_link' is reallocated in 'meson_card_reallocate_links()',\nso move 'pad' pointer initialization after this function when memory is\nalready reallocated.\n\nKasan bug report:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in axg_card_add_link+0x76c/0x9bc\nRead of size 8 at addr ffff000000e8b260 by task modprobe/356\n\nCPU: 0 PID: 356 Comm: modprobe Tainted: G O 6.9.12-sdkernel #1\nCall trace:\n dump_backtrace+0x94/0xec\n show_stack+0x18/0x24\n dump_stack_lvl+0x78/0x90\n print_report+0xfc/0x5c0\n kasan_report+0xb8/0xfc\n __asan_load8+0x9c/0xb8\n axg_card_add_link+0x76c/0x9bc [snd_soc_meson_axg_sound_card]\n meson_card_probe+0x344/0x3b8 [snd_soc_meson_card_utils]\n platform_probe+0x8c/0xf4\n really_probe+0x110/0x39c\n __driver_probe_device+0xb8/0x18c\n driver_probe_device+0x108/0x1d8\n __driver_attach+0xd0/0x25c\n bus_for_each_dev+0xe0/0x154\n driver_attach+0x34/0x44\n bus_add_driver+0x134/0x294\n driver_register+0xa8/0x1e8\n __platform_driver_register+0x44/0x54\n axg_card_pdrv_init+0x20/0x1000 [snd_soc_meson_axg_sound_card]\n do_one_initcall+0xdc/0x25c\n do_init_module+0x10c/0x334\n load_module+0x24c4/0x26cc\n init_module_from_file+0xd4/0x128\n __arm64_sys_finit_module+0x1f4/0x41c\n invoke_syscall+0x60/0x188\n el0_svc_common.constprop.0+0x78/0x13c\n do_el0_svc+0x30/0x40\n el0_svc+0x38/0x78\n el0t_64_sync_handler+0x100/0x12c\n el0t_64_sync+0x190/0x194",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "60899bfc-f7c4-409d-b553-091b8aa8aa47",
      "id": "CVE-2024-47698",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error\n\nEnsure index in rtl2832_pid_filter does not exceed 31 to prevent\nout-of-bounds access.\n\ndev-\u003efilters is a 32-bit value, so set_bit and clear_bit functions should\nonly operate on indices from 0 to 31. If index is 32, it will attempt to\naccess a non-existent 33rd bit, leading to out-of-bounds access.\nChange the boundary check from index \u003e 32 to index \u003e= 32 to resolve this\nissue.\n\n[hverkuil: added fixes tag, rtl2830_pid_filter -\u003e rtl2832_pid_filter in logmsg]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b1e6acaa-f530-4406-bad4-7d155c291b2f",
      "id": "CVE-2024-47739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: use integer wrap around to prevent deadlock on seq_nr overflow\n\nWhen submitting more than 2^32 padata objects to padata_do_serial, the\ncurrent sorting implementation incorrectly sorts padata objects with\noverflowed seq_nr, causing them to be placed before existing objects in\nthe reorder list. This leads to a deadlock in the serialization process\nas padata_find_next cannot match padata-\u003eseq_nr and pd-\u003eprocessed\nbecause the padata instance with overflowed seq_nr will be selected\nnext.\n\nTo fix this, we use an unsigned integer wrap around to correctly sort\npadata objects in scenarios with integer overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "95d36251-9f46-4ae6-a085-432a199495c9",
      "id": "CVE-2024-49859",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check atomic_file in f2fs ioctl interfaces\n\nSome f2fs ioctl interfaces like f2fs_ioc_set_pin_file(),\nf2fs_move_file_range(), and f2fs_defragment_range() missed to\ncheck atomic_write status, which may cause potential race issue,\nfix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6f8c51b-e79c-4d86-a621-27b5c9b22466",
      "id": "CVE-2024-49888",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a sdiv overflow issue\n\nZac Ecob reported a problem where a bpf program may cause kernel crash due\nto the following error:\n  Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\n\nThe failure is due to the below signed divide:\n  LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.\nLLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,\nbut it is impossible since for 64-bit system, the maximum positive\nnumber is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will\ncause a kernel exception. On arm64, the result for LLONG_MIN/-1 is\nLLONG_MIN.\n\nFurther investigation found all the following sdiv/smod cases may trigger\nan exception when bpf program is running on x86_64 platform:\n  - LLONG_MIN/-1 for 64bit operation\n  - INT_MIN/-1 for 32bit operation\n  - LLONG_MIN%-1 for 64bit operation\n  - INT_MIN%-1 for 32bit operation\nwhere -1 can be an immediate or in a register.\n\nOn arm64, there are no exceptions:\n  - LLONG_MIN/-1 = LLONG_MIN\n  - INT_MIN/-1 = INT_MIN\n  - LLONG_MIN%-1 = 0\n  - INT_MIN%-1 = 0\nwhere -1 can be an immediate or in a register.\n\nInsn patching is needed to handle the above cases and the patched codes\nproduced results aligned with above arm64 result. The below are pseudo\ncodes to handle sdiv/smod exceptions including both divisor -1 and divisor 0\nand the divisor is stored in a register.\n\nsdiv:\n      tmp = rX\n      tmp += 1 /* [-1, 0] -\u003e [0, 1]\n      if tmp \u003e(unsigned) 1 goto L2\n      if tmp == 0 goto L1\n      rY = 0\n  L1:\n      rY = -rY;\n      goto L3\n  L2:\n      rY /= rX\n  L3:\n\nsmod:\n      tmp = rX\n      tmp += 1 /* [-1, 0] -\u003e [0, 1]\n      if tmp \u003e(unsigned) 1 goto L1\n      if tmp == 1 (is64 ? goto L2 : goto L3)\n      rY = 0;\n      goto L2\n  L1:\n      rY %= rX\n  L2:\n      goto L4  // only when !is64\n  L3:\n      wY = wY  // only when !is64\n  L4:\n\n  [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c069801c-faff-4440-b332-3992e833c408",
      "id": "CVE-2024-49940",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session-\u003etunnel is non-NULL. However, session-\u003etunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession-\u003etunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession-\u003etunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session-\u003etunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session-\u003etunnel set. Add a check for\nthis case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2eaac6aa-6cef-4d2c-8ae5-03efc3c5fa26",
      "id": "CVE-2024-49968",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: filesystems without casefold feature cannot be mounted with siphash\n\nWhen mounting the ext4 filesystem, if the default hash version is set to\nDX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4af86005-63b3-47ea-a8a7-c3ab28ad6a88",
      "id": "CVE-2024-50148",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: fix wild-memory-access in proto_unregister\n\nThere's issue as follows:\n  KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f]\n  CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G        W\n  RIP: 0010:proto_unregister+0xee/0x400\n  Call Trace:\n   \u003cTASK\u003e\n   __do_sys_delete_module+0x318/0x580\n   do_syscall_64+0xc1/0x1d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nAs bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init()\nwill cleanup all resource. Then when remove bnep module will call\nbnep_sock_cleanup() to cleanup sock's resource.\nTo solve above issue just return bnep_sock_init()'s return value in\nbnep_exit().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f4b645e-aeaf-46cd-bbee-4dbefe56569e",
      "id": "CVE-2024-50150",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmode should keep reference to parent\n\nThe altmode device release refers to its parent device, but without keeping\na reference to it.\n\nWhen registering the altmode, get a reference to the parent and put it in\nthe release function.\n\nBefore this fix, when using CONFIG_DEBUG_KOBJECT_RELEASE, we see issues\nlike this:\n\n[   43.572860] kobject: 'port0.0' (ffff8880057ba008): kobject_release, parent 0000000000000000 (delayed 3000)\n[   43.573532] kobject: 'port0.1' (ffff8880057bd008): kobject_release, parent 0000000000000000 (delayed 1000)\n[   43.574407] kobject: 'port0' (ffff8880057b9008): kobject_release, parent 0000000000000000 (delayed 3000)\n[   43.575059] kobject: 'port1.0' (ffff8880057ca008): kobject_release, parent 0000000000000000 (delayed 4000)\n[   43.575908] kobject: 'port1.1' (ffff8880057c9008): kobject_release, parent 0000000000000000 (delayed 4000)\n[   43.576908] kobject: 'typec' (ffff8880062dbc00): kobject_release, parent 0000000000000000 (delayed 4000)\n[   43.577769] kobject: 'port1' (ffff8880057bf008): kobject_release, parent 0000000000000000 (delayed 3000)\n[   46.612867] ==================================================================\n[   46.613402] BUG: KASAN: slab-use-after-free in typec_altmode_release+0x38/0x129\n[   46.614003] Read of size 8 at addr ffff8880057b9118 by task kworker/2:1/48\n[   46.614538]\n[   46.614668] CPU: 2 UID: 0 PID: 48 Comm: kworker/2:1 Not tainted 6.12.0-rc1-00138-gedbae730ad31 #535\n[   46.615391] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[   46.616042] Workqueue: events kobject_delayed_cleanup\n[   46.616446] Call Trace:\n[   46.616648]  \u003cTASK\u003e\n[   46.616820]  dump_stack_lvl+0x5b/0x7c\n[   46.617112]  ? typec_altmode_release+0x38/0x129\n[   46.617470]  print_report+0x14c/0x49e\n[   46.617769]  ? rcu_read_unlock_sched+0x56/0x69\n[   46.618117]  ? __virt_addr_valid+0x19a/0x1ab\n[   46.618456]  ? kmem_cache_debug_flags+0xc/0x1d\n[   46.618807]  ? typec_altmode_release+0x38/0x129\n[   46.619161]  kasan_report+0x8d/0xb4\n[   46.619447]  ? typec_altmode_release+0x38/0x129\n[   46.619809]  ? process_scheduled_works+0x3cb/0x85f\n[   46.620185]  typec_altmode_release+0x38/0x129\n[   46.620537]  ? process_scheduled_works+0x3cb/0x85f\n[   46.620907]  device_release+0xaf/0xf2\n[   46.621206]  kobject_delayed_cleanup+0x13b/0x17a\n[   46.621584]  process_scheduled_works+0x4f6/0x85f\n[   46.621955]  ? __pfx_process_scheduled_works+0x10/0x10\n[   46.622353]  ? hlock_class+0x31/0x9a\n[   46.622647]  ? lock_acquired+0x361/0x3c3\n[   46.622956]  ? move_linked_works+0x46/0x7d\n[   46.623277]  worker_thread+0x1ce/0x291\n[   46.623582]  ? __kthread_parkme+0xc8/0xdf\n[   46.623900]  ? __pfx_worker_thread+0x10/0x10\n[   46.624236]  kthread+0x17e/0x190\n[   46.624501]  ? kthread+0xfb/0x190\n[   46.624756]  ? __pfx_kthread+0x10/0x10\n[   46.625015]  ret_from_fork+0x20/0x40\n[   46.625268]  ? __pfx_kthread+0x10/0x10\n[   46.625532]  ret_from_fork_asm+0x1a/0x30\n[   46.625805]  \u003c/TASK\u003e\n[   46.625953]\n[   46.626056] Allocated by task 678:\n[   46.626287]  kasan_save_stack+0x24/0x44\n[   46.626555]  kasan_save_track+0x14/0x2d\n[   46.626811]  __kasan_kmalloc+0x3f/0x4d\n[   46.627049]  __kmalloc_noprof+0x1bf/0x1f0\n[   46.627362]  typec_register_port+0x23/0x491\n[   46.627698]  cros_typec_probe+0x634/0xbb6\n[   46.628026]  platform_probe+0x47/0x8c\n[   46.628311]  really_probe+0x20a/0x47d\n[   46.628605]  device_driver_attach+0x39/0x72\n[   46.628940]  bind_store+0x87/0xd7\n[   46.629213]  kernfs_fop_write_iter+0x1aa/0x218\n[   46.629574]  vfs_write+0x1d6/0x29b\n[   46.629856]  ksys_write+0xcd/0x13b\n[   46.630128]  do_syscall_64+0xd4/0x139\n[   46.630420]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   46.630820]\n[   46.630946] Freed by task 48:\n[   46.631182]  kasan_save_stack+0x24/0x44\n[   46.631493]  kasan_save_track+0x14/0x2d\n[   46.631799]  kasan_save_free_info+0x3f/0x4d\n[   46.632144]  __kasan_slab_free+0x37/0x45\n[   46.632474]\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f86a9ecd-babf-4280-b3e9-c87cd739fff2",
      "id": "CVE-2024-50154",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().\n\nMartin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().\n\n  \"\"\"\n  We are seeing a use-after-free from a bpf prog attached to\n  trace_tcp_retransmit_synack. The program passes the req-\u003esk to the\n  bpf_sk_storage_get_tracing kernel helper which does check for null\n  before using it.\n  \"\"\"\n\nThe commit 83fccfc3940c (\"inet: fix potential deadlock in\nreqsk_queue_unlink()\") added timer_pending() in reqsk_queue_unlink() not\nto call del_timer_sync() from reqsk_timer_handler(), but it introduced a\nsmall race window.\n\nBefore the timer is called, expire_timers() calls detach_timer(timer, true)\nto clear timer-\u003eentry.pprev and marks it as not pending.\n\nIf reqsk_queue_unlink() checks timer_pending() just after expire_timers()\ncalls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will\ncontinue running and send multiple SYN+ACKs until it expires.\n\nThe reported UAF could happen if req-\u003esk is close()d earlier than the timer\nexpiration, which is 63s by default.\n\nThe scenario would be\n\n  1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(),\n     but del_timer_sync() is missed\n\n  2. reqsk timer is executed and scheduled again\n\n  3. req-\u003esk is accept()ed and reqsk_put() decrements rsk_refcnt, but\n     reqsk timer still has another one, and inet_csk_accept() does not\n     clear req-\u003esk for non-TFO sockets\n\n  4. sk is close()d\n\n  5. reqsk timer is executed again, and BPF touches req-\u003esk\n\nLet's not use timer_pending() by passing the caller context to\n__inet_csk_reqsk_queue_drop().\n\nNote that reqsk timer is pinned, so the issue does not happen in most\nuse cases. [1]\n\n[0]\nBUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0\n\nUse-after-free read at 0x00000000a891fb3a (in kfence-#1):\nbpf_sk_storage_get_tracing+0x2e/0x1b0\nbpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda\nbpf_trace_run2+0x4c/0xc0\ntcp_rtx_synack+0xf9/0x100\nreqsk_timer_handler+0xda/0x3d0\nrun_timer_softirq+0x292/0x8a0\nirq_exit_rcu+0xf5/0x320\nsysvec_apic_timer_interrupt+0x6d/0x80\nasm_sysvec_apic_timer_interrupt+0x16/0x20\nintel_idle_irq+0x5a/0xa0\ncpuidle_enter_state+0x94/0x273\ncpu_startup_entry+0x15e/0x260\nstart_secondary+0x8a/0x90\nsecondary_startup_64_no_verify+0xfa/0xfb\n\nkfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6\n\nallocated by task 0 on cpu 9 at 260507.901592s:\nsk_prot_alloc+0x35/0x140\nsk_clone_lock+0x1f/0x3f0\ninet_csk_clone_lock+0x15/0x160\ntcp_create_openreq_child+0x1f/0x410\ntcp_v6_syn_recv_sock+0x1da/0x700\ntcp_check_req+0x1fb/0x510\ntcp_v6_rcv+0x98b/0x1420\nipv6_list_rcv+0x2258/0x26e0\nnapi_complete_done+0x5b1/0x2990\nmlx5e_napi_poll+0x2ae/0x8d0\nnet_rx_action+0x13e/0x590\nirq_exit_rcu+0xf5/0x320\ncommon_interrupt+0x80/0x90\nasm_common_interrupt+0x22/0x40\ncpuidle_enter_state+0xfb/0x273\ncpu_startup_entry+0x15e/0x260\nstart_secondary+0x8a/0x90\nsecondary_startup_64_no_verify+0xfa/0xfb\n\nfreed by task 0 on cpu 9 at 260507.927527s:\nrcu_core_si+0x4ff/0xf10\nirq_exit_rcu+0xf5/0x320\nsysvec_apic_timer_interrupt+0x6d/0x80\nasm_sysvec_apic_timer_interrupt+0x16/0x20\ncpuidle_enter_state+0xfb/0x273\ncpu_startup_entry+0x15e/0x260\nstart_secondary+0x8a/0x90\nsecondary_startup_64_no_verify+0xfa/0xfb",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "85f8927f-47a3-48aa-91e5-49535363fe88",
      "id": "CVE-2024-53146",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent a potential integer overflow\n\nIf the tag length is \u003e= U32_MAX - 3 then the \"length + 4\" addition\ncan result in an integer overflow. Address this by splitting the\ndecoding into several steps so that decode_cb_compound4res() does\nnot have to perform arithmetic on the unsafe length value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e514a15-65a9-4c73-9f22-58bb90cc2977",
      "id": "CVE-2024-53241",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/xen: don't do PV iret hypercall through hypercall page\n\nInstead of jumping to the Xen hypercall page for doing the iret\nhypercall, directly code the required sequence in xen-asm.S.\n\nThis is done in preparation of no longer using hypercall page at all,\nas it has shown to cause problems with speculation mitigations.\n\nThis is part of XSA-466 / CVE-2024-53241.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c86a298a-0b90-4f10-97cf-e5a2c79b3e3f",
      "id": "CVE-2024-56583",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix warning in migrate_enable for boosted tasks\n\nWhen running the following command:\n\nwhile true; do\n    stress-ng --cyclic 30 --timeout 30s --minimize --quiet\ndone\n\na warning is eventually triggered:\n\nWARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794\nsetup_new_dl_entity+0x13e/0x180\n...\nCall Trace:\n \u003cTASK\u003e\n ? show_trace_log_lvl+0x1c4/0x2df\n ? enqueue_dl_entity+0x631/0x6e0\n ? setup_new_dl_entity+0x13e/0x180\n ? __warn+0x7e/0xd0\n ? report_bug+0x11a/0x1a0\n ? handle_bug+0x3c/0x70\n ? exc_invalid_op+0x14/0x70\n ? asm_exc_invalid_op+0x16/0x20\n enqueue_dl_entity+0x631/0x6e0\n enqueue_task_dl+0x7d/0x120\n __do_set_cpus_allowed+0xe3/0x280\n __set_cpus_allowed_ptr_locked+0x140/0x1d0\n __set_cpus_allowed_ptr+0x54/0xa0\n migrate_enable+0x7e/0x150\n rt_spin_unlock+0x1c/0x90\n group_send_sig_info+0xf7/0x1a0\n ? kill_pid_info+0x1f/0x1d0\n kill_pid_info+0x78/0x1d0\n kill_proc_info+0x5b/0x110\n __x64_sys_kill+0x93/0xc0\n do_syscall_64+0x5c/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n RIP: 0033:0x7f0dab31f92b\n\nThis warning occurs because set_cpus_allowed dequeues and enqueues tasks\nwith the ENQUEUE_RESTORE flag set. If the task is boosted, the warning\nis triggered. A boosted task already had its parameters set by\nrt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary,\nhence the WARN_ON call.\n\nCheck if we are requeueing a boosted task and avoid calling\nsetup_new_dl_entity if that's the case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "346ad889-043a-4d75-afc7-c26c571dd530",
      "id": "CVE-2024-56643",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndccp: Fix memory leak in dccp_feat_change_recv\n\nIf dccp_feat_push_confirm() fails after new value for SP feature was accepted\nwithout reconciliation ('entry == NULL' branch), memory allocated for that value\nwith dccp_feat_clone_sp_val() is never freed.\n\nHere is the kmemleak stack for this:\n\nunreferenced object 0xffff88801d4ab488 (size 8):\n  comm \"syz-executor310\", pid 1127, jiffies 4295085598 (age 41.666s)\n  hex dump (first 8 bytes):\n    01 b4 4a 1d 80 88 ff ff                          ..J.....\n  backtrace:\n    [\u003c00000000db7cabfe\u003e] kmemdup+0x23/0x50 mm/util.c:128\n    [\u003c0000000019b38405\u003e] kmemdup include/linux/string.h:465 [inline]\n    [\u003c0000000019b38405\u003e] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline]\n    [\u003c0000000019b38405\u003e] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline]\n    [\u003c0000000019b38405\u003e] dccp_feat_change_recv net/dccp/feat.c:1145 [inline]\n    [\u003c0000000019b38405\u003e] dccp_feat_parse_options+0x1196/0x2180 net/dccp/feat.c:1416\n    [\u003c00000000b1f6d94a\u003e] dccp_parse_options+0xa2a/0x1260 net/dccp/options.c:125\n    [\u003c0000000030d7b621\u003e] dccp_rcv_state_process+0x197/0x13d0 net/dccp/input.c:650\n    [\u003c000000001f74c72e\u003e] dccp_v4_do_rcv+0xf9/0x1a0 net/dccp/ipv4.c:688\n    [\u003c00000000a6c24128\u003e] sk_backlog_rcv include/net/sock.h:1041 [inline]\n    [\u003c00000000a6c24128\u003e] __release_sock+0x139/0x3b0 net/core/sock.c:2570\n    [\u003c00000000cf1f3a53\u003e] release_sock+0x54/0x1b0 net/core/sock.c:3111\n    [\u003c000000008422fa23\u003e] inet_wait_for_connect net/ipv4/af_inet.c:603 [inline]\n    [\u003c000000008422fa23\u003e] __inet_stream_connect+0x5d0/0xf70 net/ipv4/af_inet.c:696\n    [\u003c0000000015b6f64d\u003e] inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:735\n    [\u003c0000000010122488\u003e] __sys_connect_file+0x15c/0x1a0 net/socket.c:1865\n    [\u003c00000000b4b70023\u003e] __sys_connect+0x165/0x1a0 net/socket.c:1882\n    [\u003c00000000f4cb3815\u003e] __do_sys_connect net/socket.c:1892 [inline]\n    [\u003c00000000f4cb3815\u003e] __se_sys_connect net/socket.c:1889 [inline]\n    [\u003c00000000f4cb3815\u003e] __x64_sys_connect+0x6e/0xb0 net/socket.c:1889\n    [\u003c00000000e7b1e839\u003e] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n    [\u003c0000000055e91434\u003e] entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nClean up the allocated memory in case of dccp_feat_push_confirm() failure\nand bail out with an error reset code.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bbee13d1-8bad-478d-891f-1be676cca6da",
      "id": "CVE-2025-21859",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: f_midi: f_midi_complete to call queue_work\n\nWhen using USB MIDI, a lock is attempted to be acquired twice through a\nre-entrant call to f_midi_transmit, causing a deadlock.\n\nFix it by using queue_work() to schedule the inner f_midi_transmit() via\na high priority work queue from the completion handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e411a6ca-1641-4b1d-a5bb-2002057628db",
      "id": "CVE-2025-38371",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Disable interrupts before resetting the GPU\n\nCurrently, an interrupt can be triggered during a GPU reset, which can\nlead to GPU hangs and NULL pointer dereference in an interrupt context\nas shown in the following trace:\n\n [  314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0\n [  314.043822] Mem abort info:\n [  314.046606]   ESR = 0x0000000096000005\n [  314.050347]   EC = 0x25: DABT (current EL), IL = 32 bits\n [  314.055651]   SET = 0, FnV = 0\n [  314.058695]   EA = 0, S1PTW = 0\n [  314.061826]   FSC = 0x05: level 1 translation fault\n [  314.066694] Data abort info:\n [  314.069564]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n [  314.075039]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n [  314.080080]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n [  314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000\n [  314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n [  314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n [  314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight\n [  314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1  Debian 1:6.12.25-1+rpt1\n [  314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n [  314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n [  314.152165] pc : v3d_irq+0xec/0x2e0 [v3d]\n [  314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d]\n [  314.160198] sp : ffffffc080003ea0\n [  314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000\n [  314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0\n [  314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000\n [  314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000\n [  314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000\n [  314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001\n [  314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874\n [  314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180\n [  314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb\n [  314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000\n [  314.234807] Call trace:\n [  314.237243]  v3d_irq+0xec/0x2e0 [v3d]\n [  314.240906]  __handle_irq_event_percpu+0x58/0x218\n [  314.245609]  handle_irq_event+0x54/0xb8\n [  314.249439]  handle_fasteoi_irq+0xac/0x240\n [  314.253527]  handle_irq_desc+0x48/0x68\n [  314.257269]  generic_handle_domain_irq+0x24/0x38\n [  314.261879]  gic_handle_irq+0x48/0xd8\n [  314.265533]  call_on_irq_stack+0x24/0x58\n [  314.269448]  do_interrupt_handler+0x88/0x98\n [  314.273624]  el1_interrupt+0x34/0x68\n [  314.277193]  el1h_64_irq_handler+0x18/0x28\n [  314.281281]  el1h_64_irq+0x64/0x68\n [  314.284673]  default_idle_call+0x3c/0x168\n [  314.288675]  do_idle+0x1fc/0x230\n [  314.291895]  cpu_startup_entry+0x3c/0x50\n [  314.295810]  rest_init+0xe4/0xf0\n [  314.299030]  start_kernel+0x5e8/0x790\n [  314.302684]  __primary_switched+0x80/0x90\n [  314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017)\n [  314.312775] ---[ end trace 0000000000000000 ]---\n [  314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt\n [  314.324249] SMP: stopping secondary CPUs\n [  314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000\n [  314.334076] PHYS_OFFSET: 0x0\n [  314.336946] CPU features: 0x08,00002013,c0200000,0200421b\n [  314.342337] Memory Limit: none\n [  314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---\n\nBefore resetting the G\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97cd2248-d769-445e-b41d-db8c41685e76",
      "id": "CVE-2025-21909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject cooked mode if it is set along with other flags\n\nIt is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE\nflags simultaneously on the same monitor interface from the userspace. This\ncauses a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit\nset because the monitor interface is in the cooked state and it takes\nprecedence over all other states. When the interface is then being deleted\nthe kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing\nthat bit.\n\nFix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with\nother flags.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40c2c998-0b02-4deb-a582-10e6f2a1ced4",
      "id": "CVE-2025-37842",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-qspi: use devm function instead of driver remove\n\nDriver use devm APIs to manage clk/irq/resources and register the spi\ncontroller, but the legacy remove function will be called first during\ndevice detach and trigger kernel panic. Drop the remove function and use\ndevm_add_action_or_reset() for driver cleanup to ensure the release\nsequence.\n\nTrigger kernel panic on i.MX8MQ by\necho 30bb0000.spi \u003e/sys/bus/platform/drivers/fsl-quadspi/unbind",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fdfa0c36-0386-4975-ae54-3fca3bb6718b",
      "id": "CVE-2025-37940",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Add cond_resched() to ftrace_graph_set_hash()\n\nWhen the kernel contains a large number of functions that can be traced,\nthe loop in ftrace_graph_set_hash() may take a lot of time to execute.\nThis may trigger the softlockup watchdog.\n\nAdd cond_resched() within the loop to allow the kernel to remain\nresponsive even when processing a large number of functions.\n\nThis matches the cond_resched() that is used in other locations of the\ncode that iterates over all functions that can be traced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a68c963f-e9ab-42c7-863a-e9d77de6ea3c",
      "id": "CVE-2025-38321",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can't move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \"Dentry still in use\" error, so add an error\nmessage that makes it clear this is what happened:\n\n[  495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[  495.281595] ------------[ cut here ]------------\n[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]\n[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we're already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a9ad670-6ba3-4b74-81d1-dd9a3f4c06d2",
      "id": "CVE-2025-38359",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Fix in_atomic() handling in do_secure_storage_access()\n\nKernel user spaces accesses to not exported pages in atomic context\nincorrectly try to resolve the page fault.\nWith debug options enabled call traces like this can be seen:\n\nBUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39\npreempt_count: 1, expected: 0\nRCU nest depth: 0, expected: 0\nINFO: lockdep is turned off.\nPreemption disabled at:\n[\u003c00000383ea47cfa2\u003e] copy_page_from_iter_atomic+0xa2/0x8a0\nCPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39\nTainted: G        W           6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT\nTainted: [W]=WARN\nHardware name: IBM 3931 A01 703 (LPAR)\nCall Trace:\n [\u003c00000383e990d282\u003e] dump_stack_lvl+0xa2/0xe8\n [\u003c00000383e99bf152\u003e] __might_resched+0x292/0x2d0\n [\u003c00000383eaa7c374\u003e] down_read+0x34/0x2d0\n [\u003c00000383e99432f8\u003e] do_secure_storage_access+0x108/0x360\n [\u003c00000383eaa724b0\u003e] __do_pgm_check+0x130/0x220\n [\u003c00000383eaa842e4\u003e] pgm_check_handler+0x114/0x160\n [\u003c00000383ea47d028\u003e] copy_page_from_iter_atomic+0x128/0x8a0\n([\u003c00000383ea47d016\u003e] copy_page_from_iter_atomic+0x116/0x8a0)\n [\u003c00000383e9c45eae\u003e] generic_perform_write+0x16e/0x310\n [\u003c00000383e9eb87f4\u003e] ext4_buffered_write_iter+0x84/0x160\n [\u003c00000383e9da0de4\u003e] vfs_write+0x1c4/0x460\n [\u003c00000383e9da123c\u003e] ksys_write+0x7c/0x100\n [\u003c00000383eaa7284e\u003e] __do_syscall+0x15e/0x280\n [\u003c00000383eaa8417e\u003e] system_call+0x6e/0x90\nINFO: lockdep is turned off.\n\nIt is not allowed to take the mmap_lock while in atomic context. Therefore\nhandle such a secure storage access fault as if the accessed page is not\nmapped: the uaccess function will return -EFAULT, and the caller has to\ndeal with this. Usually this means that the access is retried in process\ncontext, which allows to resolve the page fault (or in this case export the\npage).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e979541b-1156-41cb-8cfb-643ca1b90115",
      "id": "CVE-2025-38635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: davinci: Add NULL check in davinci_lpsc_clk_register()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\ndavinci_lpsc_clk_register() does not check for this case, which results\nin a NULL pointer dereference.\n\nAdd NULL check after devm_kasprintf() to prevent this issue and ensuring\nno resources are left allocated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2e354eb-1f26-46a5-be76-dd3bbe602850",
      "id": "CVE-2020-10711",
      "description": "A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c9d34ad-dc44-478e-b472-37ba2c7f319b",
      "id": "CVE-2020-36780",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: sprd: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in sprd_i2c_master_xfer() and sprd_i2c_remove().\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "594fbeab-d5b0-4f78-9776-e6cebfabfdbf",
      "id": "CVE-2020-36789",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context\n\nIf a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but\nnot always, the case), the 'WARN_ON(in_irq)' in\nnet/core/skbuff.c#skb_release_head_state() might be triggered, under network\ncongestion circumstances, together with the potential risk of a NULL pointer\ndereference.\n\nThe root cause of this issue is the call to kfree_skb() instead of\ndev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().\n\nThis patch prevents the skb to be freed within the call to netif_rx() by\nincrementing its reference count with skb_get(). The skb is finally freed by\none of the in-irq-context safe functions: dev_consume_skb_any() or\ndev_kfree_skb_any(). The \"any\" version is used because some drivers might call\ncan_get_echo_skb() in a normal context.\n\nThe reason for this issue to occur is that initially, in the core network\nstack, loopback skb were not supposed to be received in hardware IRQ context.\nThe CAN stack is an exeption.\n\nThis bug was previously reported back in 2017 in [1] but the proposed patch\nnever got accepted.\n\nWhile [1] directly modifies net/core/dev.c, we try to propose here a\nsmoother modification local to CAN network stack (the assumption\nbehind is that only CAN devices are affected by this issue).\n\n[1] http://lore.kernel.org/r/57a3ffb6-3309-3ad5-5a34-e93c3fe3614d@cetitec.com",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec3f2805-5025-404f-a941-002c4c1ddf3f",
      "id": "CVE-2021-20239",
      "description": "A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c69fc966-160b-4c52-8e4b-a85917f2c5e8",
      "id": "CVE-2021-27364",
      "description": "An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0325c772-74d8-408e-98b8-75a2e78a2e96",
      "id": "CVE-2021-3178",
      "description": "fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "754b69c8-6952-4fa2-82ba-95efdd33146c",
      "id": "CVE-2021-3656",
      "description": "A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the \"virt_ext\" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bee5561f-5d88-418c-9ce9-797824d9838a",
      "id": "CVE-2021-3772",
      "description": "A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd20593f-051d-43c9-a3fc-e4a09931c38f",
      "id": "CVE-2021-38207",
      "description": "drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "286b983f-3878-4ecc-bc41-1292d0c2ddc7",
      "id": "CVE-2021-45095",
      "description": "pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a634f543-0173-4f23-8794-462629fd1eaf",
      "id": "CVE-2021-46906",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: fix info leak in hid_submit_ctrl\n\nIn hid_submit_ctrl(), the way of calculating the report length doesn't\ntake into account that report-\u003esize can be zero. When running the\nsyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to\ncalculate transfer_buffer_length as 16384. When this urb is passed to\nthe usb core layer, KMSAN reports an info leak of 16384 bytes.\n\nTo fix this, first modify hid_report_len() to account for the zero\nreport size case by using DIV_ROUND_UP for the division. Then, call it\nfrom hid_submit_ctrl().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c962f59-30df-431e-9b7a-199b96d90217",
      "id": "CVE-2021-46953",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure\n\nWhen failing the driver probe because of invalid firmware properties,\nthe GTDT driver unmaps the interrupt that it mapped earlier.\n\nHowever, it never checks whether the mapping of the interrupt actially\nsucceeded. Even more, should the firmware report an illegal interrupt\nnumber that overlaps with the GIC SGI range, this can result in an\nIPI being unmapped, and subsequent fireworks (as reported by Dann\nFrazier).\n\nRework the driver to have a slightly saner behaviour and actually\ncheck whether the interrupt has been mapped before unmapping things.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "20c3854e-1ede-49e1-8a48-f43b5ecc5a50",
      "id": "CVE-2021-47005",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Fix NULL pointer dereference for -\u003eget_features()\n\nget_features ops of pci_epc_ops may return NULL, causing NULL pointer\ndereference in pci_epf_test_alloc_space function. Let us add a check for\npci_epc_feature pointer in pci_epf_test_bind before we access it to avoid\nany such NULL pointer dereference and return -ENOTSUPP in case\npci_epc_feature is not found.\n\nWhen the patch is not applied and EPC features is not implemented in the\nplatform driver, we see the following dump due to kernel NULL pointer\ndereference.\n\nCall trace:\n pci_epf_test_bind+0xf4/0x388\n pci_epf_bind+0x3c/0x80\n pci_epc_epf_link+0xa8/0xcc\n configfs_symlink+0x1a4/0x48c\n vfs_symlink+0x104/0x184\n do_symlinkat+0x80/0xd4\n __arm64_sys_symlinkat+0x1c/0x24\n el0_svc_common.constprop.3+0xb8/0x170\n el0_svc_handler+0x70/0x88\n el0_svc+0x8/0x640\nCode: d2800581 b9403ab9 f9404ebb 8b394f60 (f9400400)\n---[ end trace a438e3c5a24f9df0 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a0c855f-dd21-4f6e-97ad-9ef7ab1110cd",
      "id": "CVE-2021-47063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: bridge/panel: Cleanup connector on bridge detach\n\nIf we don't call drm_connector_cleanup() manually in\npanel_bridge_detach(), the connector will be cleaned up with the other\nDRM objects in the call to drm_mode_config_cleanup(). However, since our\ndrm_connector is devm-allocated, by the time drm_mode_config_cleanup()\nwill be called, our connector will be long gone. Therefore, the\nconnector must be cleaned up when the bridge is detached to avoid\nuse-after-free conditions.\n\nv2: Cleanup connector only if it was created\n\nv3: Add FIXME\n\nv4: (Use connector-\u003edev) directly in if() block",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0023204e-c615-444f-8f00-a8600bcf0ae6",
      "id": "CVE-2021-47119",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix memory leak in ext4_fill_super\n\nBuffer head references must be released before calling kill_bdev();\notherwise the buffer head (and its page referenced by b_data) will not\nbe freed by kill_bdev, and subsequently that bh will be leaked.\n\nIf blocksizes differ, sb_set_blocksize() will kill current buffers and\npage cache by using kill_bdev(). And then super block will be reread\nagain but using correct blocksize this time. sb_set_blocksize() didn't\nfully free superblock page and buffer head, and being busy, they were\nnot freed and instead leaked.\n\nThis can easily be reproduced by calling an infinite loop of:\n\n  systemctl start \u003cext4_on_lvm\u003e.mount, and\n  systemctl stop \u003cext4_on_lvm\u003e.mount\n\n... since systemd creates a cgroup for each slice which it mounts, and\nthe bh leak get amplified by a dying memory cgroup that also never\ngets freed, and memory consumption is much more easily noticed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dadfd42d-f01b-478e-8cfa-bde1b0b733bf",
      "id": "CVE-2021-47137",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lantiq: fix memory corruption in RX ring\n\nIn a situation where memory allocation or dma mapping fails, an\ninvalid address is programmed into the descriptor. This can lead\nto memory corruption. If the memory allocation fails, DMA should\nreuse the previous skb and mapping and drop the packet. This patch\nalso increments rx drop counter.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d1c8e7d-3a63-4488-9b64-e8fbdd984c45",
      "id": "CVE-2021-47319",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: Fix memory leak among suspend/resume procedure\n\nThe vblk-\u003evqs should be freed before we call init_vqs()\nin virtblk_restore().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df584b12-34c3-4c50-a1e1-ddb67748fff9",
      "id": "CVE-2021-47331",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: common: usb-conn-gpio: fix NULL pointer dereference of charger\n\nWhen power on system with OTG cable, IDDIG's interrupt arises before\nthe charger registration, it will cause a NULL pointer dereference,\nfix the issue by registering the power supply before requesting\nIDDIG/VBUS irq.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1152ed92-ee56-4c3c-9ab2-aa8eb9dd4e46",
      "id": "CVE-2021-47466",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm, slub: fix potential memoryleak in kmem_cache_open()\n\nIn error path, the random_seq of slub cache might be leaked.  Fix this\nby using __kmem_cache_release() to release all the relevant resources.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1fb0196-3403-45ec-aa89-22ec75807072",
      "id": "CVE-2021-47479",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix use-after-free in rtl8712_dl_fw\n\nSyzbot reported use-after-free in rtl8712_dl_fw(). The problem was in\nrace condition between r871xu_dev_remove() -\u003endo_open() callback.\n\nIt's easy to see from crash log, that driver accesses released firmware\nin -\u003endo_open() callback. It may happen, since driver was releasing\nfirmware _before_ unregistering netdev. Fix it by moving\nunregister_netdev() before cleaning up resources.\n\nCall Trace:\n...\n rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]\n rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170\n rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]\n rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394\n netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380\n __dev_open+0x2bc/0x4d0 net/core/dev.c:1484\n\nFreed by task 1306:\n...\n release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053\n r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599\n usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86c8bb26-4bbf-4596-aa39-a2442b28bd4d",
      "id": "CVE-2022-28893",
      "description": "The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "420f7d52-00c4-4c0c-b325-281193641c1d",
      "id": "CVE-2022-3078",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17ca7c09-4e0d-4b0e-8b07-be017746b900",
      "id": "CVE-2022-40133",
      "description": "A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "191d63af-976d-42f8-b29e-dfb427e1673f",
      "id": "CVE-2022-41222",
      "description": "mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9bb6b7b-6c42-4649-8434-7dd514c52d2a",
      "id": "CVE-2022-48708",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: single: fix potential NULL dereference\n\nAdded checking of pointer \"function\" in pcs_set_mux().\npinmux_generic_get_function() can return NULL and the pointer\n\"function\" was dereferenced without checking against NULL.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c7df5ed-e18d-43b9-950c-e2ac41d07c7a",
      "id": "CVE-2022-48853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: fix info leak with DMA_FROM_DEVICE\n\nThe problem I'm addressing was discovered by the LTP test covering\ncve-2018-1000204.\n\nA short description of what happens follows:\n1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO\n   interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV\n   and a corresponding dxferp. The peculiar thing about this is that TUR\n   is not reading from the device.\n2) In sg_start_req() the invocation of blk_rq_map_user() effectively\n   bounces the user-space buffer. As if the device was to transfer into\n   it. Since commit a45b599ad808 (\"scsi: sg: allocate with __GFP_ZERO in\n   sg_build_indirect()\") we make sure this first bounce buffer is\n   allocated with GFP_ZERO.\n3) For the rest of the story we keep ignoring that we have a TUR, so the\n   device won't touch the buffer we prepare as if the we had a\n   DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device\n   and the  buffer allocated by SG is mapped by the function\n   virtqueue_add_split() which uses DMA_FROM_DEVICE for the \"in\" sgs (here\n   scatter-gather and not scsi generics). This mapping involves bouncing\n   via the swiotlb (we need swiotlb to do virtio in protected guest like\n   s390 Secure Execution, or AMD SEV).\n4) When the SCSI TUR is done, we first copy back the content of the second\n   (that is swiotlb) bounce buffer (which most likely contains some\n   previous IO data), to the first bounce buffer, which contains all\n   zeros.  Then we copy back the content of the first bounce buffer to\n   the user-space buffer.\n5) The test case detects that the buffer, which it zero-initialized,\n  ain't all zeros and fails.\n\nOne can argue that this is an swiotlb problem, because without swiotlb\nwe leak all zeros, and the swiotlb should be transparent in a sense that\nit does not affect the outcome (if all other participants are well\nbehaved).\n\nCopying the content of the original buffer into the swiotlb buffer is\nthe only way I can think of to make swiotlb transparent in such\nscenarios. So let's do just that if in doubt, but allow the driver\nto tell us that the whole mapped buffer is going to be overwritten,\nin which case we can preserve the old behavior and avoid the performance\nimpact of the extra bounce.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7067f107-d777-44ae-92d0-73adb71ba299",
      "id": "CVE-2022-48991",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore.  Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1367d833-233a-431a-84d6-908e1b8dbbad",
      "id": "CVE-2022-49055",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check for potential null return of kmalloc_array()\n\nAs the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference.\nTherefore, it is better to check the return value of kmalloc_array() to avoid this confusion.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fadd8175-24ec-42c6-b456-3025932ed07d",
      "id": "CVE-2022-49104",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vchiq_core: handle NULL result of find_service_by_handle\n\nIn case of an invalid handle the function find_servive_by_handle\nreturns NULL. So take care of this and avoid a NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07a05fb8-0562-4c3e-91b4-919c2bbd3c71",
      "id": "CVE-2022-49119",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()\n\nIn pm8001_chip_fw_flash_update_build(), if\npm8001_chip_fw_flash_update_build() fails, the struct fw_control_ex\nallocated must be freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7aa7076-9820-418e-8c73-689fd01ca7fe",
      "id": "CVE-2022-49276",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix memory leak in jffs2_scan_medium\n\nIf an error is returned in jffs2_scan_eraseblock() and some memory\nhas been added to the jffs2_summary *s, we can observe the following\nkmemleak report:\n\n--------------------------------------------\nunreferenced object 0xffff88812b889c40 (size 64):\n  comm \"mount\", pid 692, jiffies 4294838325 (age 34.288s)\n  hex dump (first 32 bytes):\n    40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00  @H........1...P.\n    00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08  ................\n  backtrace:\n    [\u003cffffffffae93a3a3\u003e] __kmalloc+0x613/0x910\n    [\u003cffffffffaf423b9c\u003e] jffs2_sum_add_dirent_mem+0x5c/0xa0\n    [\u003cffffffffb0f3afa8\u003e] jffs2_scan_medium.cold+0x36e5/0x4794\n    [\u003cffffffffb0f3dbe1\u003e] jffs2_do_mount_fs.cold+0xa7/0x2267\n    [\u003cffffffffaf40acf3\u003e] jffs2_do_fill_super+0x383/0xc30\n    [\u003cffffffffaf40c00a\u003e] jffs2_fill_super+0x2ea/0x4c0\n    [\u003cffffffffb0315d64\u003e] mtd_get_sb+0x254/0x400\n    [\u003cffffffffb0315f5f\u003e] mtd_get_sb_by_nr+0x4f/0xd0\n    [\u003cffffffffb0316478\u003e] get_tree_mtd+0x498/0x840\n    [\u003cffffffffaf40bd15\u003e] jffs2_get_tree+0x25/0x30\n    [\u003cffffffffae9f358d\u003e] vfs_get_tree+0x8d/0x2e0\n    [\u003cffffffffaea7a98f\u003e] path_mount+0x50f/0x1e50\n    [\u003cffffffffaea7c3d7\u003e] do_mount+0x107/0x130\n    [\u003cffffffffaea7c5c5\u003e] __se_sys_mount+0x1c5/0x2f0\n    [\u003cffffffffaea7c917\u003e] __x64_sys_mount+0xc7/0x160\n    [\u003cffffffffb10142f5\u003e] do_syscall_64+0x45/0x70\nunreferenced object 0xffff888114b54840 (size 32):\n  comm \"mount\", pid 692, jiffies 4294838325 (age 34.288s)\n  hex dump (first 32 bytes):\n    c0 75 b5 14 81 88 ff ff 02 e0 02 00 00 00 02 00  .u..............\n    00 00 84 00 00 00 44 00 00 00 6b 6b 6b 6b 6b a5  ......D...kkkkk.\n  backtrace:\n    [\u003cffffffffae93be24\u003e] kmem_cache_alloc_trace+0x584/0x880\n    [\u003cffffffffaf423b04\u003e] jffs2_sum_add_inode_mem+0x54/0x90\n    [\u003cffffffffb0f3bd44\u003e] jffs2_scan_medium.cold+0x4481/0x4794\n    [...]\nunreferenced object 0xffff888114b57280 (size 32):\n  comm \"mount\", pid 692, jiffies 4294838393 (age 34.357s)\n  hex dump (first 32 bytes):\n    10 d5 6c 11 81 88 ff ff 08 e0 05 00 00 00 01 00  ..l.............\n    00 00 38 02 00 00 28 00 00 00 6b 6b 6b 6b 6b a5  ..8...(...kkkkk.\n  backtrace:\n    [\u003cffffffffae93be24\u003e] kmem_cache_alloc_trace+0x584/0x880\n    [\u003cffffffffaf423c34\u003e] jffs2_sum_add_xattr_mem+0x54/0x90\n    [\u003cffffffffb0f3a24f\u003e] jffs2_scan_medium.cold+0x298c/0x4794\n    [...]\nunreferenced object 0xffff8881116cd510 (size 16):\n  comm \"mount\", pid 692, jiffies 4294838395 (age 34.355s)\n  hex dump (first 16 bytes):\n    00 00 00 00 00 00 00 00 09 e0 60 02 00 00 6b a5  ..........`...k.\n  backtrace:\n    [\u003cffffffffae93be24\u003e] kmem_cache_alloc_trace+0x584/0x880\n    [\u003cffffffffaf423cc4\u003e] jffs2_sum_add_xref_mem+0x54/0x90\n    [\u003cffffffffb0f3b2e3\u003e] jffs2_scan_medium.cold+0x3a20/0x4794\n    [...]\n--------------------------------------------\n\nTherefore, we should call jffs2_sum_reset_collected(s) on exit to\nrelease the memory added in s. In addition, a new tag \"out_buf\" is\nadded to prevent the NULL pointer reference caused by s being NULL.\n(thanks to Zhang Yi for this analysis)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ee523d40-2c50-4c22-ad4d-9cc020e4356b",
      "id": "CVE-2022-49291",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent hw_params and hw_free calls\n\nCurrently we have neither proper check nor protection against the\nconcurrent calls of PCM hw_params and hw_free ioctls, which may result\nin a UAF.  Since the existing PCM stream lock can't be used for\nprotecting the whole ioctl operations, we need a new mutex to protect\nthose racy calls.\n\nThis patch introduced a new mutex, runtime-\u003ebuffer_mutex, and applies\nit to both hw_params and hw_free ioctl code paths.  Along with it, the\nboth functions are slightly modified (the mmap_count check is moved\ninto the state-check block) for code simplicity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "404f210b-a389-4123-bc3a-3a0878b8f989",
      "id": "CVE-2022-49374",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: check attribute length for bearer name\n\nsyzbot reported uninit-value:\n=====================================================\nBUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline]\nBUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725\n string_nocheck lib/vsprintf.c:644 [inline]\n string+0x4f9/0x6f0 lib/vsprintf.c:725\n vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806\n vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158\n vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256\n vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283\n vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50\n _printk+0x18d/0x1cf kernel/printk/printk.c:2293\n tipc_enable_bearer net/tipc/bearer.c:371 [inline]\n __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033\n tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042\n genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]\n\n- Do sanity check the attribute length for TIPC_NLA_BEARER_NAME.\n- Do not use 'illegal name' in printing message.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9234895-fd0c-4c09-90a2-617e3a0af775",
      "id": "CVE-2022-49472",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: micrel: Allow probing without .driver_data\n\nCurrently, if the .probe element is present in the phy_driver structure\nand the .driver_data is not, a NULL pointer dereference happens.\n\nAllow passing .probe without .driver_data by inserting NULL checks\nfor priv-\u003etype.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1a7b40b-f2a0-4206-a011-5f3ff1ce1375",
      "id": "CVE-2022-49540",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix race in schedule and flush work\n\nWhile booting secondary CPUs, cpus_read_[lock/unlock] is not keeping\nonline cpumask stable. The transient online mask results in below\ncalltrace.\n\n[    0.324121] CPU1: Booted secondary processor 0x0000000001 [0x410fd083]\n[    0.346652] Detected PIPT I-cache on CPU2\n[    0.347212] CPU2: Booted secondary processor 0x0000000002 [0x410fd083]\n[    0.377255] Detected PIPT I-cache on CPU3\n[    0.377823] CPU3: Booted secondary processor 0x0000000003 [0x410fd083]\n[    0.379040] ------------[ cut here ]------------\n[    0.383662] WARNING: CPU: 0 PID: 10 at kernel/workqueue.c:3084 __flush_work+0x12c/0x138\n[    0.384850] Modules linked in:\n[    0.385403] CPU: 0 PID: 10 Comm: rcu_tasks_rude_ Not tainted 5.17.0-rc3-v8+ #13\n[    0.386473] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n[    0.387289] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    0.388308] pc : __flush_work+0x12c/0x138\n[    0.388970] lr : __flush_work+0x80/0x138\n[    0.389620] sp : ffffffc00aaf3c60\n[    0.390139] x29: ffffffc00aaf3d20 x28: ffffffc009c16af0 x27: ffffff80f761df48\n[    0.391316] x26: 0000000000000004 x25: 0000000000000003 x24: 0000000000000100\n[    0.392493] x23: ffffffffffffffff x22: ffffffc009c16b10 x21: ffffffc009c16b28\n[    0.393668] x20: ffffffc009e53861 x19: ffffff80f77fbf40 x18: 00000000d744fcc9\n[    0.394842] x17: 000000000000000b x16: 00000000000001c2 x15: ffffffc009e57550\n[    0.396016] x14: 0000000000000000 x13: ffffffffffffffff x12: 0000000100000000\n[    0.397190] x11: 0000000000000462 x10: ffffff8040258008 x9 : 0000000100000000\n[    0.398364] x8 : 0000000000000000 x7 : ffffffc0093c8bf4 x6 : 0000000000000000\n[    0.399538] x5 : 0000000000000000 x4 : ffffffc00a976e40 x3 : ffffffc00810444c\n[    0.400711] x2 : 0000000000000004 x1 : 0000000000000000 x0 : 0000000000000000\n[    0.401886] Call trace:\n[    0.402309]  __flush_work+0x12c/0x138\n[    0.402941]  schedule_on_each_cpu+0x228/0x278\n[    0.403693]  rcu_tasks_rude_wait_gp+0x130/0x144\n[    0.404502]  rcu_tasks_kthread+0x220/0x254\n[    0.405264]  kthread+0x174/0x1ac\n[    0.405837]  ret_from_fork+0x10/0x20\n[    0.406456] irq event stamp: 102\n[    0.406966] hardirqs last  enabled at (101): [\u003cffffffc0093c8468\u003e] _raw_spin_unlock_irq+0x78/0xb4\n[    0.408304] hardirqs last disabled at (102): [\u003cffffffc0093b8270\u003e] el1_dbg+0x24/0x5c\n[    0.409410] softirqs last  enabled at (54): [\u003cffffffc0081b80c8\u003e] local_bh_enable+0xc/0x2c\n[    0.410645] softirqs last disabled at (50): [\u003cffffffc0081b809c\u003e] local_bh_disable+0xc/0x2c\n[    0.411890] ---[ end trace 0000000000000000 ]---\n[    0.413000] smp: Brought up 1 node, 4 CPUs\n[    0.413762] SMP: Total of 4 processors activated.\n[    0.414566] CPU features: detected: 32-bit EL0 Support\n[    0.415414] CPU features: detected: 32-bit EL1 Support\n[    0.416278] CPU features: detected: CRC32 instructions\n[    0.447021] Callback from call_rcu_tasks_rude() invoked.\n[    0.506693] Callback from call_rcu_tasks() invoked.\n\nThis commit therefore fixes this issue by applying a single-CPU\noptimization to the RCU Tasks Rude grace-period process.  The key point\nhere is that the purpose of this RCU flavor is to force a schedule on\neach online CPU since some past event.  But the rcu_tasks_rude_wait_gp()\nfunction runs in the context of the RCU Tasks Rude's grace-period kthread,\nso there must already have been a context switch on the current CPU since\nthe call to either synchronize_rcu_tasks_rude() or call_rcu_tasks_rude().\nSo if there is only a single CPU online, RCU Tasks Rude's grace-period\nkthread does not need to anything at all.\n\nIt turns out that the rcu_tasks_rude_wait_gp() function's call to\nschedule_on_each_cpu() causes problems during early boot.  During that\ntime, there is only one online CPU, namely the boot CPU.  Therefore,\napplying this single-CPU optimization fixes early-boot instances of\nthis problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "977dadc0-14d3-4d1b-af89-1aa50ddf5c34",
      "id": "CVE-2022-49605",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: Reinstate IGC_REMOVED logic and implement it properly\n\nThe initially merged version of the igc driver code (via commit\n146740f9abc4, \"igc: Add support for PF\") contained the following\nIGC_REMOVED checks in the igc_rd32/wr32() MMIO accessors:\n\n\tu32 igc_rd32(struct igc_hw *hw, u32 reg)\n\t{\n\t\tu8 __iomem *hw_addr = READ_ONCE(hw-\u003ehw_addr);\n\t\tu32 value = 0;\n\n\t\tif (IGC_REMOVED(hw_addr))\n\t\t\treturn ~value;\n\n\t\tvalue = readl(\u0026hw_addr[reg]);\n\n\t\t/* reads should not return all F's */\n\t\tif (!(~value) \u0026\u0026 (!reg || !(~readl(hw_addr))))\n\t\t\thw-\u003ehw_addr = NULL;\n\n\t\treturn value;\n\t}\n\nAnd:\n\n\t#define wr32(reg, val) \\\n\tdo { \\\n\t\tu8 __iomem *hw_addr = READ_ONCE((hw)-\u003ehw_addr); \\\n\t\tif (!IGC_REMOVED(hw_addr)) \\\n\t\t\twritel((val), \u0026hw_addr[(reg)]); \\\n\t} while (0)\n\nE.g. igb has similar checks in its MMIO accessors, and has a similar\nmacro E1000_REMOVED, which is implemented as follows:\n\n\t#define E1000_REMOVED(h) unlikely(!(h))\n\nThese checks serve to detect and take note of an 0xffffffff MMIO read\nreturn from the device, which can be caused by a PCIe link flap or some\nother kind of PCI bus error, and to avoid performing MMIO reads and\nwrites from that point onwards.\n\nHowever, the IGC_REMOVED macro was not originally implemented:\n\n\t#ifndef IGC_REMOVED\n\t#define IGC_REMOVED(a) (0)\n\t#endif /* IGC_REMOVED */\n\nThis led to the IGC_REMOVED logic to be removed entirely in a\nsubsequent commit (commit 3c215fb18e70, \"igc: remove IGC_REMOVED\nfunction\"), with the rationale that such checks matter only for\nvirtualization and that igc does not support virtualization -- but a\nPCIe device can become detached even without virtualization being in\nuse, and without proper checks, a PCIe bus error affecting an igc\nadapter will lead to various NULL pointer dereferences, as the first\naccess after the error will set hw-\u003ehw_addr to NULL, and subsequent\naccesses will blindly dereference this now-NULL pointer.\n\nThis patch reinstates the IGC_REMOVED checks in igc_rd32/wr32(), and\nimplements IGC_REMOVED the way it is done for igb, by checking for the\nunlikely() case of hw_addr being NULL.  This change prevents the oopses\nseen when a PCIe link flap occurs on an igc adapter.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "911a2dba-5f2a-4d74-a968-5bd6f5879419",
      "id": "CVE-2022-49674",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix accesses beyond end of raid member array\n\nOn dm-raid table load (using raid_ctr), dm-raid allocates an array\nrs-\u003edevs[rs-\u003eraid_disks] for the raid device members. rs-\u003eraid_disks\nis defined by the number of raid metadata and image tupples passed\ninto the target's constructor.\n\nIn the case of RAID layout changes being requested, that number can be\ndifferent from the current number of members for existing raid sets as\ndefined in their superblocks. Example RAID layout changes include:\n- raid1 legs being added/removed\n- raid4/5/6/10 number of stripes changed (stripe reshaping)\n- takeover to higher raid level (e.g. raid5 -\u003e raid6)\n\nWhen accessing array members, rs-\u003eraid_disks must be used in control\nloops instead of the potentially larger value in rs-\u003emd.raid_disks.\nOtherwise it will cause memory access beyond the end of the rs-\u003edevs\narray.\n\nFix this by changing code that is prone to out-of-bounds access.\nAlso fix validate_raid_redundancy() to validate all devices that are\nadded. Also, use braces to help clean up raid_iterate_devices().\n\nThe out-of-bounds memory accesses was discovered using KASAN.\n\nThis commit was verified to pass all LVM2 RAID tests (with KASAN\nenabled).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3b583ab5-616a-431d-bb2d-d4eb1ebd4274",
      "id": "CVE-2022-49761",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: always report error in run_one_delayed_ref()\n\nCurrently we have a btrfs_debug() for run_one_delayed_ref() failure, but\nif end users hit such problem, there will be no chance that\nbtrfs_debug() is enabled.  This can lead to very little useful info for\ndebugging.\n\nThis patch will:\n\n- Add extra info for error reporting\n  Including:\n  * logical bytenr\n  * num_bytes\n  * type\n  * action\n  * ref_mod\n\n- Replace the btrfs_debug() with btrfs_err()\n\n- Move the error reporting into run_one_delayed_ref()\n  This is to avoid use-after-free, the @node can be freed in the caller.\n\nThis error should only be triggered at most once.\n\nAs if run_one_delayed_ref() failed, we trigger the error message, then\ncausing the call chain to error out:\n\nbtrfs_run_delayed_refs()\n`- btrfs_run_delayed_refs()\n   `- btrfs_run_delayed_refs_for_head()\n      `- run_one_delayed_ref()\n\nAnd we will abort the current transaction in btrfs_run_delayed_refs().\nIf we have to run delayed refs for the abort transaction,\nrun_one_delayed_ref() will just cleanup the refs and do nothing, thus no\nnew error messages would be output.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "854031b7-6037-417d-a05a-97c9861d005e",
      "id": "CVE-2022-49772",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()\n\nsnd_usbmidi_output_open() has a check of the NULL port with\nsnd_BUG_ON().  snd_BUG_ON() was used as this shouldn't have happened,\nbut in reality, the NULL port may be seen when the device gives an\ninvalid endpoint setup at the descriptor, hence the driver skips the\nallocation.  That is, the check itself is valid and snd_BUG_ON()\nshould be dropped from there.  Otherwise it's confusing as if it were\na real bug, as recently syzbot stumbled on it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ec9a1dc1-d168-4c0e-90c7-0fde19aab184",
      "id": "CVE-2022-49789",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: zfcp: Fix double free of FSF request when qdio send fails\n\nWe used to use the wrong type of integer in 'zfcp_fsf_req_send()' to cache\nthe FSF request ID when sending a new FSF request. This is used in case the\nsending fails and we need to remove the request from our internal hash\ntable again (so we don't keep an invalid reference and use it when we free\nthe request again).\n\nIn 'zfcp_fsf_req_send()' we used to cache the ID as 'int' (signed and 32\nbit wide), but the rest of the zfcp code (and the firmware specification)\nhandles the ID as 'unsigned long'/'u64' (unsigned and 64 bit wide [s390x\nELF ABI]).  For one this has the obvious problem that when the ID grows\npast 32 bit (this can happen reasonably fast) it is truncated to 32 bit\nwhen storing it in the cache variable and so doesn't match the original ID\nanymore.  The second less obvious problem is that even when the original ID\nhas not yet grown past 32 bit, as soon as the 32nd bit is set in the\noriginal ID (0x80000000 = 2'147'483'648) we will have a mismatch when we\ncast it back to 'unsigned long'. As the cached variable is of a signed\ntype, the compiler will choose a sign-extending instruction to load the 32\nbit variable into a 64 bit register (e.g.: 'lgf %r11,188(%r15)'). So once\nwe pass the cached variable into 'zfcp_reqlist_find_rm()' to remove the\nrequest again all the leading zeros will be flipped to ones to extend the\nsign and won't match the original ID anymore (this has been observed in\npractice).\n\nIf we can't successfully remove the request from the hash table again after\n'zfcp_qdio_send()' fails (this happens regularly when zfcp cannot notify\nthe adapter about new work because the adapter is already gone during\ne.g. a ChpID toggle) we will end up with a double free.  We unconditionally\nfree the request in the calling function when 'zfcp_fsf_req_send()' fails,\nbut because the request is still in the hash table we end up with a stale\nmemory reference, and once the zfcp adapter is either reset during recovery\nor shutdown we end up freeing the same memory twice.\n\nThe resulting stack traces vary depending on the kernel and have no direct\ncorrelation to the place where the bug occurs. Here are three examples that\nhave been seen in practice:\n\n  list_del corruption. next-\u003eprev should be 00000001b9d13800, but was 00000000dead4ead. (next=00000001bd131a00)\n  ------------[ cut here ]------------\n  kernel BUG at lib/list_debug.c:62!\n  monitor event: 0040 ilc:2 [#1] PREEMPT SMP\n  Modules linked in: ...\n  CPU: 9 PID: 1617 Comm: zfcperp0.0.1740 Kdump: loaded\n  Hardware name: ...\n  Krnl PSW : 0704d00180000000 00000003cbeea1f8 (__list_del_entry_valid+0x98/0x140)\n             R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3\n  Krnl GPRS: 00000000916d12f1 0000000080000000 000000000000006d 00000003cb665cd6\n             0000000000000001 0000000000000000 0000000000000000 00000000d28d21e8\n             00000000d3844000 00000380099efd28 00000001bd131a00 00000001b9d13800\n             00000000d3290100 0000000000000000 00000003cbeea1f4 00000380099efc70\n  Krnl Code: 00000003cbeea1e8: c020004f68a7        larl    %r2,00000003cc8d7336\n             00000003cbeea1ee: c0e50027fd65        brasl   %r14,00000003cc3e9cb8\n            #00000003cbeea1f4: af000000            mc      0,0\n            \u003e00000003cbeea1f8: c02000920440        larl    %r2,00000003cd12aa78\n             00000003cbeea1fe: c0e500289c25        brasl   %r14,00000003cc3fda48\n             00000003cbeea204: b9040043            lgr     %r4,%r3\n             00000003cbeea208: b9040051            lgr     %r5,%r1\n             00000003cbeea20c: b9040032            lgr     %r3,%r2\n  Call Trace:\n   [\u003c00000003cbeea1f8\u003e] __list_del_entry_valid+0x98/0x140\n  ([\u003c00000003cbeea1f4\u003e] __list_del_entry_valid+0x94/0x140)\n   [\u003c000003ff7ff502fe\u003e] zfcp_fsf_req_dismiss_all+0xde/0x150 [zfcp]\n   [\u003c000003ff7ff49cd0\u003e] zfcp_erp_strategy_do_action+0x160/0x280 [zfcp]\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d3e2d33-c721-43c7-aa91-8d8d0aead0fb",
      "id": "CVE-2022-49915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible memory leak in mISDN_register_device()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nadd put_device() to give up the reference, so that the name can be\nfreed in kobject_cleanup() when the refcount is 0.\n\nSet device class before put_device() to avoid null release() function\nWARN message in device_release().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e3d0416-389c-46b1-ae0e-44c7b007b578",
      "id": "CVE-2022-50010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: i740fb: Check the argument of i740_calc_vclk()\n\nSince the user can control the arguments of the ioctl() from the user\nspace, under special arguments that may result in a divide-by-zero bug.\n\nIf the user provides an improper 'pixclock' value that makes the argumet\nof i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a\ndivide-by-zero bug in:\n    drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX)));\n\nThe following log can reveal it:\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nRIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline]\nRIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline]\nRIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742\nCall Trace:\n fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034\n do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110\n fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189\n\nFix this by checking the argument of i740_calc_vclk() first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "954daa49-314a-492c-85ba-a0bd17ff8f2b",
      "id": "CVE-2022-50215",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Allow waiting for commands to complete on removed device\n\nWhen a SCSI device is removed while in active use, currently sg will\nimmediately return -ENODEV on any attempt to wait for active commands that\nwere sent before the removal.  This is problematic for commands that use\nSG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel\nwhen userspace frees or reuses it after getting ENODEV, leading to\ncorrupted userspace memory (in the case of READ-type commands) or corrupted\ndata being sent to the device (in the case of WRITE-type commands).  This\nhas been seen in practice when logging out of a iscsi_tcp session, where\nthe iSCSI driver may still be processing commands after the device has been\nmarked for removal.\n\nChange the policy to allow userspace to wait for active sg commands even\nwhen the device is being removed.  Return -ENODEV only when there are no\nmore responses to read.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c188024-ce9d-4a15-816b-cfd0b11dfbc1",
      "id": "CVE-2022-50218",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: isl29028: Fix the warning in isl29028_remove()\n\nThe driver use the non-managed form of the register function in\nisl29028_remove(). To keep the release order as mirroring the ordering\nin probe, the driver should use non-managed form in probe, too.\n\nThe following log reveals it:\n\n[   32.374955] isl29028 0-0010: remove\n[   32.376861] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI\n[   32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[   32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0\n[   32.385461] Call Trace:\n[   32.385807]  sysfs_unmerge_group+0x59/0x110\n[   32.386110]  dpm_sysfs_remove+0x58/0xc0\n[   32.386391]  device_del+0x296/0xe50\n[   32.386959]  cdev_device_del+0x1d/0xd0\n[   32.387231]  devm_iio_device_unreg+0x27/0xb0\n[   32.387542]  devres_release_group+0x319/0x3d0\n[   32.388162]  i2c_device_remove+0x93/0x1f0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1cc0921b-dbc8-48a5-987a-f8765e9bb0c8",
      "id": "CVE-2022-50264",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: socfpga: Fix memory leak in socfpga_gate_init()\n\nFree @socfpga_clk and @ops on the error path to avoid memory leak issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1e7f7463-778b-4887-9bfa-c0c24fff4670",
      "id": "CVE-2022-50304",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: fix possible resource leak in init_mtd()\n\nI got the error report while inject fault in init_mtd():\n\nsysfs: cannot create duplicate filename '/devices/virtual/bdi/mtd-0'\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x67/0x83\n sysfs_warn_dup+0x60/0x70\n sysfs_create_dir_ns+0x109/0x120\n kobject_add_internal+0xce/0x2f0\n kobject_add+0x98/0x110\n device_add+0x179/0xc00\n device_create_groups_vargs+0xf4/0x100\n device_create+0x7b/0xb0\n bdi_register_va.part.13+0x58/0x2d0\n bdi_register+0x9b/0xb0\n init_mtd+0x62/0x171 [mtd]\n do_one_initcall+0x6c/0x3c0\n do_init_module+0x58/0x222\n load_module+0x268e/0x27d0\n __do_sys_finit_module+0xd5/0x140\n do_syscall_64+0x37/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n \u003c/TASK\u003e\nkobject_add_internal failed for mtd-0 with -EEXIST, don't try to register\n\tthings with the same name in the same directory.\nError registering mtd class or bdi: -17\n\nIf init_mtdchar() fails in init_mtd(), mtd_bdi will not be unregistered,\nas a result, we can't load the mtd module again, to fix this by calling\nbdi_unregister(mtd_bdi) after out_procfs label.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "09d953be-d672-411f-ac07-a8b9bc0f1e45",
      "id": "CVE-2022-50333",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: jfs: fix shift-out-of-bounds in dbDiscardAG\n\nThis should be applied to most URSAN bugs found recently by syzbot,\nby guarding the dbMount. As syzbot feeding rubbish into the bmap\ndescriptor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0895857a-571a-45d7-9363-a25dd36928f6",
      "id": "CVE-2022-50364",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: mux: reg: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref in resource_size(), if platform_get_resource()\nreturns NULL, move calling resource_size() after devm_ioremap_resource() that\nwill check 'res' to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f434aaf1-e9ad-428a-ac94-361ad677573b",
      "id": "CVE-2022-50376",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()\n\nWhen insert and remove the orangefs module, there are memory leaked\nas below:\n\nunreferenced object 0xffff88816b0cc000 (size 2048):\n  comm \"insmod\", pid 783, jiffies 4294813439 (age 65.512s)\n  hex dump (first 32 bytes):\n    6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00  none............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000031ab7788\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c000000005b405fee\u003e] orangefs_debugfs_init.cold+0xaf/0x17f\n    [\u003c00000000e5a0085b\u003e] 0xffffffffa02780f9\n    [\u003c000000004232d9f7\u003e] do_one_initcall+0x87/0x2a0\n    [\u003c0000000054f22384\u003e] do_init_module+0xdf/0x320\n    [\u003c000000003263bdea\u003e] load_module+0x2f98/0x3330\n    [\u003c0000000052cd4153\u003e] __do_sys_finit_module+0x113/0x1b0\n    [\u003c00000000250ae02b\u003e] do_syscall_64+0x35/0x80\n    [\u003c00000000f11c03c7\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nUse the golbal variable as the buffer rather than dynamic allocate to\nslove the problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3710528-1104-4128-b920-fb3f71c4485c",
      "id": "CVE-2023-0468",
      "description": "A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "300889c4-a018-46f5-a9a7-bfa2bad83e56",
      "id": "CVE-2022-49432",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xics: fix refcount leak in icp_opal_init()\n\nThe of_find_compatible_node() function returns a node pointer with\nrefcount incremented, use of_node_put() on it when done.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9430420-d0c9-42cb-b1c3-032f84765789",
      "id": "CVE-2023-3812",
      "description": "An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6dbf0b8a-e9d8-409a-8acf-8100c50ab545",
      "id": "CVE-2023-52646",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naio: fix mremap after fork null-deref\n\nCommit e4a0d3e720e7 (\"aio: Make it possible to remap aio ring\") introduced\na null-deref if mremap is called on an old aio mapping after fork as\nmm-\u003eioctx_table will be set to NULL.\n\n[jmoyer@redhat.com: fix 80 column issue]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "729b7337-d2b8-424a-9221-71138c71cf16",
      "id": "CVE-2023-52699",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysv: don't call sb_bread() with pointers_lock held\n\nsyzbot is reporting sleep in atomic context in SysV filesystem [1], for\nsb_bread() is called with rw_spinlock held.\n\nA \"write_lock(\u0026pointers_lock) =\u003e read_lock(\u0026pointers_lock) deadlock\" bug\nand a \"sb_bread() with write_lock(\u0026pointers_lock)\" bug were introduced by\n\"Replace BKL for chain locking with sysvfs-private rwlock\" in Linux 2.5.12.\n\nThen, \"[PATCH] err1-40: sysvfs locking fix\" in Linux 2.6.8 fixed the\nformer bug by moving pointers_lock lock to the callers, but instead\nintroduced a \"sb_bread() with read_lock(\u0026pointers_lock)\" bug (which made\nthis problem easier to hit).\n\nAl Viro suggested that why not to do like get_branch()/get_block()/\nfind_shared() in Minix filesystem does. And doing like that is almost a\nrevert of \"[PATCH] err1-40: sysvfs locking fix\" except that get_branch()\n from with find_shared() is called without write_lock(\u0026pointers_lock).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b804dfcf-321f-4268-9767-6d8d355ab222",
      "id": "CVE-2023-52753",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid NULL dereference of timing generator\n\n[Why \u0026 How]\nCheck whether assigned timing generator is NULL or not before\naccessing its funcs to prevent NULL dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "267141dc-cad1-4a90-be17-ab2194f12869",
      "id": "CVE-2023-52757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential deadlock when releasing mids\n\nAll release_mid() callers seem to hold a reference of @mid so there is\nno need to call kref_put(\u0026mid-\u003erefcount, __release_mid) under\n@server-\u003emid_lock spinlock.  If they don't, then an use-after-free bug\nwould have occurred anyways.\n\nBy getting rid of such spinlock also fixes a potential deadlock as\nshown below\n\nCPU 0                                CPU 1\n------------------------------------------------------------------\ncifs_demultiplex_thread()            cifs_debug_data_proc_show()\n release_mid()\n  spin_lock(\u0026server-\u003emid_lock);\n                                     spin_lock(\u0026cifs_tcp_ses_lock)\n\t\t\t\t      spin_lock(\u0026server-\u003emid_lock)\n  __release_mid()\n   smb2_find_smb_tcon()\n    spin_lock(\u0026cifs_tcp_ses_lock) *deadlock*",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "225a4472-8c2d-425a-944e-cb51f55c1444",
      "id": "CVE-2023-52796",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: add ipvlan_route_v6_outbound() helper\n\nInspired by syzbot reports using a stack of multiple ipvlan devices.\n\nReduce stack size needed in ipvlan_process_v6_outbound() by moving\nthe flowi6 struct used for the route lookup in an non inlined\nhelper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,\nimmediately reclaimed.\n\nAlso make sure ipvlan_process_v4_outbound() is not inlined.\n\nWe might also have to lower MAX_NEST_DEV, because only syzbot uses\nsetups with more than four stacked devices.\n\nBUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)\nstack guard page: 0000 [#1] SMP KASAN\nCPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\nRIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188\nCode: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 \u003c41\u003e 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89\nRSP: 0018:ffffc9000e804000 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2\nRDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568\nRBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c\nR13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000\nFS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003c#DF\u003e\n\u003c/#DF\u003e\n\u003cTASK\u003e\n[\u003cffffffff81f281d1\u003e] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n[\u003cffffffff817e5bf2\u003e] instrument_atomic_read include/linux/instrumented.h:72 [inline]\n[\u003cffffffff817e5bf2\u003e] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n[\u003cffffffff817e5bf2\u003e] cpumask_test_cpu include/linux/cpumask.h:506 [inline]\n[\u003cffffffff817e5bf2\u003e] cpu_online include/linux/cpumask.h:1092 [inline]\n[\u003cffffffff817e5bf2\u003e] trace_lock_acquire include/trace/events/lock.h:24 [inline]\n[\u003cffffffff817e5bf2\u003e] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632\n[\u003cffffffff8563221e\u003e] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306\n[\u003cffffffff8561464d\u003e] rcu_read_lock include/linux/rcupdate.h:747 [inline]\n[\u003cffffffff8561464d\u003e] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221\n[\u003cffffffff85618120\u003e] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606\n[\u003cffffffff856f65b5\u003e] pol_lookup_func include/net/ip6_fib.h:584 [inline]\n[\u003cffffffff856f65b5\u003e] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116\n[\u003cffffffff85618009\u003e] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638\n[\u003cffffffff8561821a\u003e] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651\n[\u003cffffffff838bd5a3\u003e] ip6_route_output include/net/ip6_route.h:100 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677\n[\u003cffffffff838c2909\u003e] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229\n[\u003cffffffff84d03900\u003e] netdev_start_xmit include/linux/netdevice.h:4966 [inline]\n[\u003cffffffff84d03900\u003e] xmit_one net/core/dev.c:3644 [inline]\n[\u003cffffffff84d03900\u003e] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660\n[\u003cffffffff84d080e2\u003e] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324\n[\u003cffffffff855ce4cd\u003e] dev_queue_xmit include/linux/netdevice.h:3067 [inline]\n[\u003cffffffff855ce4cd\u003e] neigh_hh_output include/net/neighbour.h:529 [inline]\n[\u003cf\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af7475f5-c004-4331-8dd9-6e079d959258",
      "id": "CVE-2023-52853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhid: cp2112: Fix duplicate workqueue initialization\n\nPreviously the cp2112 driver called INIT_DELAYED_WORK within\ncp2112_gpio_irq_startup, resulting in duplicate initilizations of the\nworkqueue on subsequent IRQ startups following an initial request. This\nresulted in a warning in set_work_data in workqueue.c, as well as a rare\nNULL dereference within process_one_work in workqueue.c.\n\nInitialize the workqueue within _probe instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5caa0e42-5e93-4858-b487-f2ec291bf0a0",
      "id": "CVE-2023-52996",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: prevent potential spectre v1 gadget in fib_metrics_match()\n\nif (!type)\n        continue;\n    if (type \u003e RTAX_MAX)\n        return false;\n    ...\n    fi_val = fi-\u003efib_metrics-\u003emetrics[type - 1];\n\n@type being used as an array index, we need to prevent\ncpu speculation or risk leaking kernel memory content.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b676a16-c948-4fa5-99ea-06fadd099b68",
      "id": "CVE-2023-52997",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: prevent potential spectre v1 gadget in ip_metrics_convert()\n\nif (!type)\n\t\tcontinue;\n\tif (type \u003e RTAX_MAX)\n\t\treturn -EINVAL;\n\t...\n\tmetrics[type - 1] = val;\n\n@type being used as an array index, we need to prevent\ncpu speculation or risk leaking kernel memory content.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "585a6707-54f3-4a32-a38c-998914833324",
      "id": "CVE-2023-53116",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: avoid potential UAF in nvmet_req_complete()\n\nAn nvme target -\u003equeue_response() operation implementation may free the\nrequest passed as argument. Such implementation potentially could result\nin a use after free of the request pointer when percpu_ref_put() is\ncalled in nvmet_req_complete().\n\nAvoid such problem by using a local variable to save the sq pointer\nbefore calling __nvmet_req_complete(), thus avoiding dereferencing the\nreq pointer after that function call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5fffbc88-8b7a-4000-bdb7-f7ffa17c383e",
      "id": "CVE-2023-53121",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: tcp_make_synack() can be called from process context\n\ntcp_rtx_synack() now could be called in process context as explained in\n0a375c822497 (\"tcp: tcp_rtx_synack() can be called from process\ncontext\").\n\ntcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU\nvariables with preemption enabled. This causes the following BUG:\n\n    BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464\n    caller is tcp_make_synack+0x841/0xac0\n    Call Trace:\n     \u003cTASK\u003e\n     dump_stack_lvl+0x10d/0x1a0\n     check_preemption_disabled+0x104/0x110\n     tcp_make_synack+0x841/0xac0\n     tcp_v6_send_synack+0x5c/0x450\n     tcp_rtx_synack+0xeb/0x1f0\n     inet_rtx_syn_ack+0x34/0x60\n     tcp_check_req+0x3af/0x9e0\n     tcp_rcv_state_process+0x59b/0x2030\n     tcp_v6_do_rcv+0x5f5/0x700\n     release_sock+0x3a/0xf0\n     tcp_sendmsg+0x33/0x40\n     ____sys_sendmsg+0x2f2/0x490\n     __sys_sendmsg+0x184/0x230\n     do_syscall_64+0x3d/0x90\n\nAvoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use\nTCP_INC_STATS() which is safe to be called from context switch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48f87824-d8dc-4f1a-9e61-55a6fd0ce3ce",
      "id": "CVE-2025-37824",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix NULL pointer dereference in tipc_mon_reinit_self()\n\nsyzbot reported:\n\ntipc: Node number set to 1055423674\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nWorkqueue: events tipc_net_finalize_work\nRIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719\n...\nRSP: 0018:ffffc9000356fb68 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba\nRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010\nRBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007\nR13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010\nFS:  0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140\n process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3319 [inline]\n worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\n kthread+0x3c2/0x780 kernel/kthread.c:464\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n...\nRIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719\n...\nRSP: 0018:ffffc9000356fb68 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba\nRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010\nRBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007\nR13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010\nFS:  0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nThere is a racing condition between workqueue created when enabling\nbearer and another thread created when disabling bearer right after\nthat as follow:\n\nenabling_bearer                          | disabling_bearer\n---------------                          | ----------------\ntipc_disc_timeout()                      |\n{                                        | bearer_disable()\n ...                                     | {\n schedule_work(\u0026tn-\u003ework);               |  tipc_mon_delete()\n ...                                     |  {\n}                                        |   ...\n                                         |   write_lock_bh(\u0026mon-\u003elock);\n                                         |   mon-\u003eself = NULL;\n                                         |   write_unlock_bh(\u0026mon-\u003elock);\n                                         |   ...\n                                         |  }\ntipc_net_finalize_work()                 | }\n{                                        |\n ...                                     |\n tipc_net_finalize()                     |\n {                                       |\n  ...                                    |\n  tipc_mon_reinit_self()                 |\n  {                                      |\n   ...                                   |\n   write_lock_bh(\u0026mon-\u003elock);            |\n   mon-\u003eself-\u003eaddr = tipc_own_addr(net); |\n   write_unlock_bh(\u0026mon-\u003elock);          |\n   ...             \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a6a3297-2687-4a07-8470-2cadad261508",
      "id": "CVE-2023-53219",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: netup_unidvb: fix use-after-free at del_timer()\n\nWhen Universal DVB card is detaching, netup_unidvb_dma_fini()\nuses del_timer() to stop dma-\u003etimeout timer. But when timer\nhandler netup_unidvb_dma_timeout() is running, del_timer()\ncould not stop it. As a result, the use-after-free bug could\nhappen. The process is shown below:\n\n    (cleanup routine)          |        (timer routine)\n                               | mod_timer(\u0026dev-\u003etx_sim_timer, ..)\nnetup_unidvb_finidev()         | (wait a time)\n  netup_unidvb_dma_fini()      | netup_unidvb_dma_timeout()\n    del_timer(\u0026dma-\u003etimeout);  |\n                               |   ndev-\u003epci_dev-\u003edev //USE\n\nFix by changing del_timer() to del_timer_sync().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c7c1f00-65d3-4f90-834a-c059eeb0e426",
      "id": "CVE-2023-53223",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dsi: Add missing check for alloc_ordered_workqueue\n\nAdd check for the return value of alloc_ordered_workqueue as it may return\nNULL pointer and cause NULL pointer dereference.\n\nPatchwork: https://patchwork.freedesktop.org/patch/517646/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cbb25359-ce38-4740-9470-0602ed85ca2c",
      "id": "CVE-2023-53390",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: dd: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d81a4f3b-8c41-4fc0-9cdb-f0efe25e2a29",
      "id": "CVE-2023-53419",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Protect rcu_print_task_exp_stall() -\u003eexp_tasks access\n\nFor kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can\nresult in a NULL-pointer dereference:\n\n           CPU1                                           CPU2\nrcu_preempt_deferred_qs_irqrestore                rcu_print_task_exp_stall\n  if (special.b.blocked)                            READ_ONCE(rnp-\u003eexp_tasks) != NULL\n    raw_spin_lock_rcu_node\n    np = rcu_next_node_entry(t, rnp)\n    if (\u0026t-\u003ercu_node_entry == rnp-\u003eexp_tasks)\n      WRITE_ONCE(rnp-\u003eexp_tasks, np)\n      ....\n      raw_spin_unlock_irqrestore_rcu_node\n                                                    raw_spin_lock_irqsave_rcu_node\n                                                    t = list_entry(rnp-\u003eexp_tasks-\u003eprev,\n                                                        struct task_struct, rcu_node_entry)\n                                                    (if rnp-\u003eexp_tasks is NULL, this\n                                                       will dereference a NULL pointer)\n\nThe problem is that CPU2 accesses the rcu_node structure's-\u003eexp_tasks\nfield without holding the rcu_node structure's -\u003elock and CPU2 did\nnot observe CPU1's change to rcu_node structure's -\u003eexp_tasks in time.\nTherefore, if CPU1 sets rcu_node structure's-\u003eexp_tasks pointer to NULL,\nthen CPU2 might dereference that NULL pointer.\n\nThis commit therefore holds the rcu_node structure's -\u003elock while\naccessing that structure's-\u003eexp_tasks field.\n\n[ paulmck: Apply Frederic Weisbecker feedback. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aaf07bb7-cce7-46a0-afc1-591ca2a8a79e",
      "id": "CVE-2023-53438",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/MCE: Always save CS register on AMD Zen IF Poison errors\n\nThe Instruction Fetch (IF) units on current AMD Zen-based systems do not\nguarantee a synchronous #MC is delivered for poison consumption errors.\nTherefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the\nmicroarchitecture does guarantee that the exception is delivered within\nthe same context. In other words, the exact rIP is not known, but the\ncontext is known to not have changed.\n\nThere is no architecturally-defined method to determine this behavior.\n\nThe Code Segment (CS) register is always valid on such IF unit poison\nerrors regardless of the value of MCG_STATUS[EIPV|RIPV].\n\nAdd a quirk to save the CS register for poison consumption from the IF\nunit banks.\n\nThis is needed to properly determine the context of the error.\nOtherwise, the severity grading function will assume the context is\nIN_KERNEL due to the m-\u003ecs value being 0 (the initialized value). This\nleads to unnecessary kernel panics on data poison errors due to the\nkernel believing the poison consumption occurred in kernel context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e67f0881-44c1-47f3-a4dc-eec20e1d6a90",
      "id": "CVE-2024-22705",
      "description": "An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f4ba8b5c-bdc2-4ccd-9c46-682bb680d081",
      "id": "CVE-2024-26645",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Ensure visibility when inserting an element into tracing_map\n\nRunning the following two commands in parallel on a multi-processor\nAArch64 machine can sporadically produce an unexpected warning about\nduplicate histogram entries:\n\n $ while true; do\n     echo hist:key=id.syscall:val=hitcount \u003e \\\n       /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/trigger\n     cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/hist\n     sleep 0.001\n   done\n $ stress-ng --sysbadaddr $(nproc)\n\nThe warning looks as follows:\n\n[ 2911.172474] ------------[ cut here ]------------\n[ 2911.173111] Duplicates detected: 1\n[ 2911.173574] WARNING: CPU: 2 PID: 12247 at kernel/trace/tracing_map.c:983 tracing_map_sort_entries+0x3e0/0x408\n[ 2911.174702] Modules linked in: iscsi_ibft(E) iscsi_boot_sysfs(E) rfkill(E) af_packet(E) nls_iso8859_1(E) nls_cp437(E) vfat(E) fat(E) ena(E) tiny_power_button(E) qemu_fw_cfg(E) button(E) fuse(E) efi_pstore(E) ip_tables(E) x_tables(E) xfs(E) libcrc32c(E) aes_ce_blk(E) aes_ce_cipher(E) crct10dif_ce(E) polyval_ce(E) polyval_generic(E) ghash_ce(E) gf128mul(E) sm4_ce_gcm(E) sm4_ce_ccm(E) sm4_ce(E) sm4_ce_cipher(E) sm4(E) sm3_ce(E) sm3(E) sha3_ce(E) sha512_ce(E) sha512_arm64(E) sha2_ce(E) sha256_arm64(E) nvme(E) sha1_ce(E) nvme_core(E) nvme_auth(E) t10_pi(E) sg(E) scsi_mod(E) scsi_common(E) efivarfs(E)\n[ 2911.174738] Unloaded tainted modules: cppc_cpufreq(E):1\n[ 2911.180985] CPU: 2 PID: 12247 Comm: cat Kdump: loaded Tainted: G            E      6.7.0-default #2 1b58bbb22c97e4399dc09f92d309344f69c44a01\n[ 2911.182398] Hardware name: Amazon EC2 c7g.8xlarge/, BIOS 1.0 11/1/2018\n[ 2911.183208] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 2911.184038] pc : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.184667] lr : tracing_map_sort_entries+0x3e0/0x408\n[ 2911.185310] sp : ffff8000a1513900\n[ 2911.185750] x29: ffff8000a1513900 x28: ffff0003f272fe80 x27: 0000000000000001\n[ 2911.186600] x26: ffff0003f272fe80 x25: 0000000000000030 x24: 0000000000000008\n[ 2911.187458] x23: ffff0003c5788000 x22: ffff0003c16710c8 x21: ffff80008017f180\n[ 2911.188310] x20: ffff80008017f000 x19: ffff80008017f180 x18: ffffffffffffffff\n[ 2911.189160] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000a15134b8\n[ 2911.190015] x14: 0000000000000000 x13: 205d373432323154 x12: 5b5d313131333731\n[ 2911.190844] x11: 00000000fffeffff x10: 00000000fffeffff x9 : ffffd1b78274a13c\n[ 2911.191716] x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 000000000057ffa8\n[ 2911.192554] x5 : ffff0012f6c24ec0 x4 : 0000000000000000 x3 : ffff2e5b72b5d000\n[ 2911.193404] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0003ff254480\n[ 2911.194259] Call trace:\n[ 2911.194626]  tracing_map_sort_entries+0x3e0/0x408\n[ 2911.195220]  hist_show+0x124/0x800\n[ 2911.195692]  seq_read_iter+0x1d4/0x4e8\n[ 2911.196193]  seq_read+0xe8/0x138\n[ 2911.196638]  vfs_read+0xc8/0x300\n[ 2911.197078]  ksys_read+0x70/0x108\n[ 2911.197534]  __arm64_sys_read+0x24/0x38\n[ 2911.198046]  invoke_syscall+0x78/0x108\n[ 2911.198553]  el0_svc_common.constprop.0+0xd0/0xf8\n[ 2911.199157]  do_el0_svc+0x28/0x40\n[ 2911.199613]  el0_svc+0x40/0x178\n[ 2911.200048]  el0t_64_sync_handler+0x13c/0x158\n[ 2911.200621]  el0t_64_sync+0x1a8/0x1b0\n[ 2911.201115] ---[ end trace 0000000000000000 ]---\n\nThe problem appears to be caused by CPU reordering of writes issued from\n__tracing_map_insert().\n\nThe check for the presence of an element with a given key in this\nfunction is:\n\n val = READ_ONCE(entry-\u003eval);\n if (val \u0026\u0026 keys_match(key, val-\u003ekey, map-\u003ekey_size)) ...\n\nThe write of a new entry is:\n\n elt = get_free_elt(map);\n memcpy(elt-\u003ekey, key, map-\u003ekey_size);\n entry-\u003eval = elt;\n\nThe \"memcpy(elt-\u003ekey, key, map-\u003ekey_size);\" and \"entry-\u003eval = elt;\"\nstores may become visible in the reversed order on another CPU. This\nsecond CPU might then incorrectly determine that a new key doesn't match\nan already present val-\u003ekey and subse\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d568ec62-c1ce-490a-8344-d75c928059bf",
      "id": "CVE-2024-26689",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: prevent use-after-free in encode_cap_msg()\n\nIn fs/ceph/caps.c, in encode_cap_msg(), \"use after free\" error was\ncaught by KASAN at this line - 'ceph_buffer_get(arg-\u003exattr_buf);'. This\nimplies before the refcount could be increment here, it was freed.\n\nIn same file, in \"handle_cap_grant()\" refcount is decremented by this\nline - 'ceph_buffer_put(ci-\u003ei_xattrs.blob);'. It appears that a race\noccurred and resource was freed by the latter line before the former\nline could increment it.\n\nencode_cap_msg() is called by __send_cap() and __send_cap() is called by\nceph_check_caps() after calling __prep_cap(). __prep_cap() is where\narg-\u003exattr_buf is assigned to ci-\u003ei_xattrs.blob. This is the spot where\nthe refcount must be increased to prevent \"use after free\" error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "413c46b3-f0fc-43f8-aafb-5f886e89c6fd",
      "id": "CVE-2024-26779",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix race condition on enabling fast-xmit\n\nfast-xmit must only be enabled after the sta has been uploaded to the driver,\notherwise it could end up passing the not-yet-uploaded sta via drv_tx calls\nto the driver, leading to potential crashes because of uninitialized drv_priv\ndata.\nAdd a missing sta-\u003euploaded check and re-check fast xmit after inserting a sta.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b42ce36-3d5d-41c9-8209-da8f72cd4cd2",
      "id": "CVE-2024-26865",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: Fix use-after-free of net in reqsk_timer_handler().\n\nsyzkaller reported a warning of netns tracker [0] followed by KASAN\nsplat [1] and another ref tracker warning [1].\n\nsyzkaller could not find a repro, but in the log, the only suspicious\nsequence was as follows:\n\n  18:26:22 executing program 1:\n  r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)\n  ...\n  connect$inet6(r0, \u0026(0x7f0000000080)={0xa, 0x4001, 0x0, @loopback}, 0x1c) (async)\n\nThe notable thing here is 0x4001 in connect(), which is RDS_TCP_PORT.\n\nSo, the scenario would be:\n\n  1. unshare(CLONE_NEWNET) creates a per netns tcp listener in\n      rds_tcp_listen_init().\n  2. syz-executor connect()s to it and creates a reqsk.\n  3. syz-executor exit()s immediately.\n  4. netns is dismantled.  [0]\n  5. reqsk timer is fired, and UAF happens while freeing reqsk.  [1]\n  6. listener is freed after RCU grace period.  [2]\n\nBasically, reqsk assumes that the listener guarantees netns safety\nuntil all reqsk timers are expired by holding the listener's refcount.\nHowever, this was not the case for kernel sockets.\n\nCommit 740ea3c4a0b2 (\"tcp: Clean up kernel listener's reqsk in\ninet_twsk_purge()\") fixed this issue only for per-netns ehash.\n\nLet's apply the same fix for the global ehash.\n\n[0]:\nref_tracker: net notrefcnt@0000000065449cc3 has 1/1 users at\n     sk_alloc (./include/net/net_namespace.h:337 net/core/sock.c:2146)\n     inet6_create (net/ipv6/af_inet6.c:192 net/ipv6/af_inet6.c:119)\n     __sock_create (net/socket.c:1572)\n     rds_tcp_listen_init (net/rds/tcp_listen.c:279)\n     rds_tcp_init_net (net/rds/tcp.c:577)\n     ops_init (net/core/net_namespace.c:137)\n     setup_net (net/core/net_namespace.c:340)\n     copy_net_ns (net/core/net_namespace.c:497)\n     create_new_namespaces (kernel/nsproxy.c:110)\n     unshare_nsproxy_namespaces (kernel/nsproxy.c:228 (discriminator 4))\n     ksys_unshare (kernel/fork.c:3429)\n     __x64_sys_unshare (kernel/fork.c:3496)\n     do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\n     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)\n...\nWARNING: CPU: 0 PID: 27 at lib/ref_tracker.c:179 ref_tracker_dir_exit (lib/ref_tracker.c:179)\n\n[1]:\nBUG: KASAN: slab-use-after-free in inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966)\nRead of size 8 at addr ffff88801b370400 by task swapper/0/0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1))\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\n kasan_report (mm/kasan/report.c:603)\n inet_csk_reqsk_queue_drop (./include/net/inet_hashtables.h:180 net/ipv4/inet_connection_sock.c:952 net/ipv4/inet_connection_sock.c:966)\n reqsk_timer_handler (net/ipv4/inet_connection_sock.c:979 net/ipv4/inet_connection_sock.c:1092)\n call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701)\n __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2038)\n run_timer_softirq (kernel/time/timer.c:2053)\n __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)\n irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632 kernel/softirq.c:644)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1076 (discriminator 14))\n \u003c/IRQ\u003e\n\nAllocated by task 258 on cpu 0 at 83.612050s:\n kasan_save_stack (mm/kasan/common.c:48)\n kasan_save_track (mm/kasan/common.c:68)\n __kasan_slab_alloc (mm/kasan/common.c:343)\n kmem_cache_alloc (mm/slub.c:3813 mm/slub.c:3860 mm/slub.c:3867)\n copy_net_ns (./include/linux/slab.h:701 net/core/net_namespace.c:421 net/core/net_namespace.c:480)\n create_new_namespaces (kernel/nsproxy.c:110)\n unshare_nsproxy_name\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40c85598-14d5-4733-83c1-e45ddd4ba79a",
      "id": "CVE-2024-26866",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: lpspi: Avoid potential use-after-free in probe()\n\nfsl_lpspi_probe() is allocating/disposing memory manually with\nspi_alloc_host()/spi_alloc_target(), but uses\ndevm_spi_register_controller(). In case of error after the latter call the\nmemory will be explicitly freed in the probe function by\nspi_controller_put() call, but used afterwards by \"devm\" management outside\nprobe() (spi_unregister_controller() \u003c- devm_spi_unregister() below).\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000070\n...\nCall trace:\n kernfs_find_ns\n kernfs_find_and_get_ns\n sysfs_remove_group\n sysfs_remove_groups\n device_remove_attrs\n device_del\n spi_unregister_controller\n devm_spi_unregister\n release_nodes\n devres_release_all\n really_probe\n driver_probe_device\n __device_attach_driver\n bus_for_each_drv\n __device_attach\n device_initial_probe\n bus_probe_device\n deferred_probe_work_func\n process_one_work\n worker_thread\n kthread\n ret_from_fork",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2e56421-779f-433a-8634-863546ac0d4a",
      "id": "CVE-2024-27011",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix memleak in map from abort path\n\nThe delete set command does not rely on the transaction object for\nelement removal, therefore, a combination of delete element + delete set\nfrom the abort path could result in restoring twice the refcount of the\nmapping.\n\nCheck for inactive element in the next generation for the delete element\ncommand in the abort path, skip restoring state if next generation bit\nhas been already cleared. This is similar to the activate logic using\nthe set walk iterator.\n\n[ 6170.286929] ------------[ cut here ]------------\n[ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.287071] Modules linked in: [...]\n[ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365\n[ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 \u003c0f\u003e 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f\n[ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202\n[ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000\n[ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750\n[ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55\n[ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10\n[ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100\n[ 6170.287940] FS:  0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000\n[ 6170.287948] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0\n[ 6170.287962] Call Trace:\n[ 6170.287967]  \u003cTASK\u003e\n[ 6170.287973]  ? __warn+0x9f/0x1a0\n[ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.288092]  ? report_bug+0x1b1/0x1e0\n[ 6170.287986]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.288092]  ? report_bug+0x1b1/0x1e0\n[ 6170.288104]  ? handle_bug+0x3c/0x70\n[ 6170.288112]  ? exc_invalid_op+0x17/0x40\n[ 6170.288120]  ? asm_exc_invalid_op+0x1a/0x20\n[ 6170.288132]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]\n[ 6170.288243]  ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables]\n[ 6170.288366]  ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables]\n[ 6170.288483]  nf_tables_trans_destroy_work+0x588/0x590 [nf_tables]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3a5314bf-8623-4b20-b1af-d118e5237d49",
      "id": "CVE-2024-27013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: limit printing rate when illegal packet received by tun dev\n\nvhost_worker will call tun call backs to receive packets. If too many\nillegal packets arrives, tun_do_read will keep dumping packet contents.\nWhen console is enabled, it will costs much more cpu time to dump\npacket and soft lockup will be detected.\n\nnet_ratelimit mechanism can be used to limit the dumping rate.\n\nPID: 33036    TASK: ffff949da6f20000  CPU: 23   COMMAND: \"vhost-32980\"\n #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253\n #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3\n #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e\n #3 [fffffe00003fced0] do_nmi at ffffffff8922660d\n #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663\n    [exception RIP: io_serial_in+20]\n    RIP: ffffffff89792594  RSP: ffffa655314979e8  RFLAGS: 00000002\n    RAX: ffffffff89792500  RBX: ffffffff8af428a0  RCX: 0000000000000000\n    RDX: 00000000000003fd  RSI: 0000000000000005  RDI: ffffffff8af428a0\n    RBP: 0000000000002710   R8: 0000000000000004   R9: 000000000000000f\n    R10: 0000000000000000  R11: ffffffff8acbf64f  R12: 0000000000000020\n    R13: ffffffff8acbf698  R14: 0000000000000058  R15: 0000000000000000\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n #5 [ffffa655314979e8] io_serial_in at ffffffff89792594\n #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470\n #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6\n #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605\n #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558\n #10 [ffffa65531497ac8] console_unlock at ffffffff89316124\n #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07\n #12 [ffffa65531497b68] printk at ffffffff89318306\n #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765\n #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun]\n #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun]\n #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net]\n #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost]\n #18 [ffffa65531497f10] kthread at ffffffff892d2e72\n #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0286cb88-43de-4c79-8705-f68dbd7fa9d8",
      "id": "CVE-2024-27396",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gtp: Fix Use-After-Free in gtp_dellink\n\nSince call_rcu, which is called in the hlist_for_each_entry_rcu traversal\nof gtp_dellink, is not part of the RCU read critical section, it\nis possible that the RCU grace period will pass during the traversal and\nthe key will be free.\n\nTo prevent this, it should be changed to hlist_for_each_entry_safe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f5be8434-9e15-4593-a9e3-bfd1ecf81956",
      "id": "CVE-2024-35794",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-raid: really frozen sync_thread during suspend\n\n1) commit f52f5c71f3d4 (\"md: fix stopping sync thread\") remove\n   MD_RECOVERY_FROZEN from __md_stop_writes() and doesn't realize that\n   dm-raid relies on __md_stop_writes() to frozen sync_thread\n   indirectly. Fix this problem by adding MD_RECOVERY_FROZEN in\n   md_stop_writes(), and since stop_sync_thread() is only used for\n   dm-raid in this case, also move stop_sync_thread() to\n   md_stop_writes().\n2) The flag MD_RECOVERY_FROZEN doesn't mean that sync thread is frozen,\n   it only prevent new sync_thread to start, and it can't stop the\n   running sync thread; In order to frozen sync_thread, after seting the\n   flag, stop_sync_thread() should be used.\n3) The flag MD_RECOVERY_FROZEN doesn't mean that writes are stopped, use\n   it as condition for md_stop_writes() in raid_postsuspend() doesn't\n   look correct. Consider that reentrant stop_sync_thread() do nothing,\n   always call md_stop_writes() in raid_postsuspend().\n4) raid_message can set/clear the flag MD_RECOVERY_FROZEN at anytime,\n   and if MD_RECOVERY_FROZEN is cleared while the array is suspended,\n   new sync_thread can start unexpected. Fix this by disallow\n   raid_message() to change sync_thread status during suspend.\n\nNote that after commit f52f5c71f3d4 (\"md: fix stopping sync thread\"), the\ntest shell/lvconvert-raid-reshape.sh start to hang in stop_sync_thread(),\nand with previous fixes, the test won't hang there anymore, however, the\ntest will still fail and complain that ext4 is corrupted. And with this\npatch, the test won't hang due to stop_sync_thread() or fail due to ext4\nis corrupted anymore. However, there is still a deadlock related to\ndm-raid456 that will be fixed in following patches.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2bf17a7b-5fb2-498a-852a-0e953c2c39eb",
      "id": "CVE-2024-36953",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()\n\nvgic_v2_parse_attr() is responsible for finding the vCPU that matches\nthe user-provided CPUID, which (of course) may not be valid. If the ID\nis invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled\ngracefully.\n\nSimilar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id()\nactually returns something and fail the ioctl if not.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cf5ea37-036c-4354-ac9d-5a382b97b21c",
      "id": "CVE-2024-36964",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/9p: only translate RWX permissions for plain 9P2000\n\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26588b37-8ef4-4ce1-b7d6-d7c28d3d3538",
      "id": "CVE-2024-38544",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix seg fault in rxe_comp_queue_pkt\n\nIn rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the\nresp_pkts queue and then a decision is made whether to run the completer\ntask inline or schedule it. Finally the skb is dereferenced to bump a 'hw'\nperformance counter. This is wrong because if the completer task is\nalready running in a separate thread it may have already processed the skb\nand freed it which can cause a seg fault.  This has been observed\ninfrequently in testing at high scale.\n\nThis patch fixes this by changing the order of enqueuing the packet until\nafter the counter is accessed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d414920f-ff17-440f-a5eb-dcb7809e17e0",
      "id": "CVE-2024-44961",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Forward soft recovery errors to userspace\n\nAs we discussed before[1], soft recovery should be\nforwarded to userspace, or we can get into a really\nbad state where apps will keep submitting hanging\ncommand buffers cascading us to a hard reset.\n\n1: https://lore.kernel.org/all/bf23d5ed-9a6b-43e7-84ee-8cbfd0d60f18@froggi.es/\n(cherry picked from commit 434967aadbbbe3ad9103cc29e9a327de20fdba01)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17b744d0-4dc8-4c4d-94eb-04577dec8901",
      "id": "CVE-2024-38553",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: remove .ndo_poll_controller to avoid deadlocks\n\nThere is a deadlock issue found in sungem driver, please refer to the\ncommit ac0a230f719b (\"eth: sungem: remove .ndo_poll_controller to avoid\ndeadlocks\"). The root cause of the issue is that netpoll is in atomic\ncontext and disable_irq() is called by .ndo_poll_controller interface\nof sungem driver, however, disable_irq() might sleep. After analyzing\nthe implementation of fec_poll_controller(), the fec driver should have\nthe same issue. Due to the fec driver uses NAPI for TX completions, the\n.ndo_poll_controller is unnecessary to be implemented in the fec driver,\nso fec_poll_controller() can be safely removed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55201eed-cba3-41ec-82ae-363d5e658c39",
      "id": "CVE-2024-38619",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb-storage: alauda: Check whether the media is initialized\n\nThe member \"uzonesize\" of struct alauda_info will remain 0\nif alauda_init_media() fails, potentially causing divide errors\nin alauda_read_data() and alauda_write_lba().\n- Add a member \"media_initialized\" to struct alauda_info.\n- Change a condition in alauda_check_media() to ensure the\n  first initialization.\n- Add an error check for the return value of alauda_init_media().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3afe7e14-7223-4294-baf0-36006640b065",
      "id": "CVE-2024-38780",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sw-sync: don't enable IRQ from sync_print_obj()\n\nSince commit a6aa8fca4d79 (\"dma-buf/sw-sync: Reduce irqsave/irqrestore from\nknown context\") by error replaced spin_unlock_irqrestore() with\nspin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite\nsync_print_obj() is called from sync_debugfs_show(), lockdep complains\ninconsistent lock state warning.\n\nUse plain spin_{lock,unlock}() for sync_print_obj(), for\nsync_debugfs_show() is already using spin_{lock,unlock}_irq().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "541bb8d6-9433-44a4-8bd6-ecb36b93e9b4",
      "id": "CVE-2024-40942",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: mesh: Fix leak of mesh_preq_queue objects\n\nThe hwmp code use objects of type mesh_preq_queue, added to a list in\nieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath\ngets deleted, ex mesh interface is removed, the entries in that list will\nnever get cleaned. Fix this by flushing all corresponding items of the\npreq_queue in mesh_path_flush_pending().\n\nThis should take care of KASAN reports like this:\n\nunreferenced object 0xffff00000668d800 (size 128):\n  comm \"kworker/u8:4\", pid 67, jiffies 4295419552 (age 1836.444s)\n  hex dump (first 32 bytes):\n    00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff  ..........h.....\n    8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00  ....\u003e...........\n  backtrace:\n    [\u003c000000007302a0b6\u003e] __kmem_cache_alloc_node+0x1e0/0x35c\n    [\u003c00000000049bd418\u003e] kmalloc_trace+0x34/0x80\n    [\u003c0000000000d792bb\u003e] mesh_queue_preq+0x44/0x2a8\n    [\u003c00000000c99c3696\u003e] mesh_nexthop_resolve+0x198/0x19c\n    [\u003c00000000926bf598\u003e] ieee80211_xmit+0x1d0/0x1f4\n    [\u003c00000000fc8c2284\u003e] __ieee80211_subif_start_xmit+0x30c/0x764\n    [\u003c000000005926ee38\u003e] ieee80211_subif_start_xmit+0x9c/0x7a4\n    [\u003c000000004c86e916\u003e] dev_hard_start_xmit+0x174/0x440\n    [\u003c0000000023495647\u003e] __dev_queue_xmit+0xe24/0x111c\n    [\u003c00000000cfe9ca78\u003e] batadv_send_skb_packet+0x180/0x1e4\n    [\u003c000000007bacc5d5\u003e] batadv_v_elp_periodic_work+0x2f4/0x508\n    [\u003c00000000adc3cd94\u003e] process_one_work+0x4b8/0xa1c\n    [\u003c00000000b36425d1\u003e] worker_thread+0x9c/0x634\n    [\u003c0000000005852dd5\u003e] kthread+0x1bc/0x1c4\n    [\u003c000000005fccd770\u003e] ret_from_fork+0x10/0x20\nunreferenced object 0xffff000009051f00 (size 128):\n  comm \"kworker/u8:4\", pid 67, jiffies 4295419553 (age 1836.440s)\n  hex dump (first 32 bytes):\n    90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff  ..........h.....\n    36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff  6'.......Xy.....\n  backtrace:\n    [\u003c000000007302a0b6\u003e] __kmem_cache_alloc_node+0x1e0/0x35c\n    [\u003c00000000049bd418\u003e] kmalloc_trace+0x34/0x80\n    [\u003c0000000000d792bb\u003e] mesh_queue_preq+0x44/0x2a8\n    [\u003c00000000c99c3696\u003e] mesh_nexthop_resolve+0x198/0x19c\n    [\u003c00000000926bf598\u003e] ieee80211_xmit+0x1d0/0x1f4\n    [\u003c00000000fc8c2284\u003e] __ieee80211_subif_start_xmit+0x30c/0x764\n    [\u003c000000005926ee38\u003e] ieee80211_subif_start_xmit+0x9c/0x7a4\n    [\u003c000000004c86e916\u003e] dev_hard_start_xmit+0x174/0x440\n    [\u003c0000000023495647\u003e] __dev_queue_xmit+0xe24/0x111c\n    [\u003c00000000cfe9ca78\u003e] batadv_send_skb_packet+0x180/0x1e4\n    [\u003c000000007bacc5d5\u003e] batadv_v_elp_periodic_work+0x2f4/0x508\n    [\u003c00000000adc3cd94\u003e] process_one_work+0x4b8/0xa1c\n    [\u003c00000000b36425d1\u003e] worker_thread+0x9c/0x634\n    [\u003c0000000005852dd5\u003e] kthread+0x1bc/0x1c4\n    [\u003c000000005fccd770\u003e] ret_from_fork+0x10/0x20",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8991f288-8dc1-4962-978a-0e58762814fd",
      "id": "CVE-2024-41044",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: reject claimed-as-LCP but actually malformed packets\n\nSince 'ppp_async_encode()' assumes valid LCP packets (with code\nfrom 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that\nLCP packet has an actual body beyond PPP_LCP header bytes, and\nreject claimed-as-LCP but actually malformed data otherwise.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dade46fc-b40d-4172-97ce-1e81e1966ac8",
      "id": "CVE-2024-46760",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: usb: schedule rx work after everything is set up\n\nRight now it's possible to hit NULL pointer dereference in\nrtw_rx_fill_rx_status on hw object and/or its fields because\ninitialization routine can start getting USB replies before\nrtw_dev is fully setup.\n\nThe stack trace looks like this:\n\nrtw_rx_fill_rx_status\nrtw8821c_query_rx_desc\nrtw_usb_rx_handler\n...\nqueue_work\nrtw_usb_read_port_complete\n...\nusb_submit_urb\nrtw_usb_rx_resubmit\nrtw_usb_init_rx\nrtw_usb_probe\n\nSo while we do the async stuff rtw_usb_probe continues and calls\nrtw_register_hw, which does all kinds of initialization (e.g.\nvia ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.\n\nFix this by moving the first usb_submit_urb after everything\nis set up.\n\nFor me, this bug manifested as:\n[    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped\n[    8.910904] rtw_8821cu 1-1:1.2: hw-\u003econf.chandef.chan NULL in rtw_rx_fill_rx_status\nbecause I'm using Larry's backport of rtw88 driver with the NULL\nchecks in rtw_rx_fill_rx_status.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b8b86fd-1656-4fff-98d8-ebc87c1f8540",
      "id": "CVE-2024-41068",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Fix sclp_init() cleanup on failure\n\nIf sclp_init() fails it only partially cleans up: if there are multiple\nfailing calls to sclp_init() sclp_state_change_event will be added several\ntimes to sclp_reg_list, which results in the following warning:\n\n------------[ cut here ]------------\nlist_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10.\nWARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3\nKrnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8)\n           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3\n...\nCall Trace:\n [\u003c000003ffe0d6076a\u003e] __list_add_valid_or_report+0xe2/0xf8\n([\u003c000003ffe0d60766\u003e] __list_add_valid_or_report+0xde/0xf8)\n [\u003c000003ffe0a8d37e\u003e] sclp_init+0x40e/0x450\n [\u003c000003ffe00009f2\u003e] do_one_initcall+0x42/0x1e0\n [\u003c000003ffe15b77a6\u003e] do_initcalls+0x126/0x150\n [\u003c000003ffe15b7a0a\u003e] kernel_init_freeable+0x1ba/0x1f8\n [\u003c000003ffe0d6650e\u003e] kernel_init+0x2e/0x180\n [\u003c000003ffe000301c\u003e] __ret_from_fork+0x3c/0x60\n [\u003c000003ffe0d759ca\u003e] ret_from_fork+0xa/0x30\n\nFix this by removing sclp_state_change_event from sclp_reg_list when\nsclp_init() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2bcf76f0-e331-4b6e-8fdb-0d8a85133fb0",
      "id": "CVE-2024-41090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\nsent downstack. Even before the skb is transmitted, the\ntap_get_user_xdp()--\u003eskb_set_network_header() may assume the size is more\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\naccess beyond the actual length, or confuse the underlayer with incorrect\nor inconsistent header length in the skb metadata.\n\nIn the alternative path, tap_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tap_get_user() does.\n\nCVE: CVE-2024-41090",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3e7be75-3355-45a2-8db9-70d58cfef304",
      "id": "CVE-2024-42097",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: emux: improve patch ioctl data validation\n\nIn load_data(), make the validation of and skipping over the main info\nblock match that in load_guspatch().\n\nIn load_guspatch(), add checking that the specified patch length matches\nthe actually supplied data, like load_data() already did.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56ea8060-4298-42cf-9679-54a2b57ad9eb",
      "id": "CVE-2024-42151",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable\n\nTest case dummy_st_ops/dummy_init_ret_value passes NULL as the first\nparameter of the test_1() function. Mark this parameter as nullable to\nmake verifier aware of such possibility.\nOtherwise, NULL check in the test_1() code:\n\n      SEC(\"struct_ops/test_1\")\n      int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)\n      {\n            if (!state)\n                    return ...;\n\n            ... access state ...\n      }\n\nMight be removed by verifier, thus triggering NULL pointer dereference\nunder certain conditions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a835dc0e-9f86-4695-98ce-912a38b7022c",
      "id": "CVE-2024-42288",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix for possible memory corruption\n\nInit Control Block is dereferenced incorrectly.  Correctly dereference ICB",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c822edca-3b65-449f-a717-76d2a4653ece",
      "id": "CVE-2024-43911",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL dereference at band check in starting tx ba session\n\nIn MLD connection, link_data/link_conf are dynamically allocated. They\ndon't point to vif-\u003ebss_conf. So, there will be no chanreq assigned to\nvif-\u003ebss_conf and then the chan will be NULL. Tweak the code to check\nht_supported/vht_supported/has_he/has_eht on sta deflink.\n\nCrash log (with rtw89 version under MLO development):\n[ 9890.526087] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 9890.526102] #PF: supervisor read access in kernel mode\n[ 9890.526105] #PF: error_code(0x0000) - not-present page\n[ 9890.526109] PGD 0 P4D 0\n[ 9890.526114] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 9890.526119] CPU: 2 PID: 6367 Comm: kworker/u16:2 Kdump: loaded Tainted: G           OE      6.9.0 #1\n[ 9890.526123] Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB3WW (2.73 ) 11/28/2018\n[ 9890.526126] Workqueue: phy2 rtw89_core_ba_work [rtw89_core]\n[ 9890.526203] RIP: 0010:ieee80211_start_tx_ba_session (net/mac80211/agg-tx.c:618 (discriminator 1)) mac80211\n[ 9890.526279] Code: f7 e8 d5 93 3e ea 48 83 c4 28 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 49 8b 84 24 e0 f1 ff ff 48 8b 80 90 1b 00 00 \u003c83\u003e 38 03 0f 84 37 fe ff ff bb ea ff ff ff eb cc 49 8b 84 24 10 f3\nAll code\n========\n   0:\tf7 e8                \timul   %eax\n   2:\td5                   \t(bad)\n   3:\t93                   \txchg   %eax,%ebx\n   4:\t3e ea                \tds (bad)\n   6:\t48 83 c4 28          \tadd    $0x28,%rsp\n   a:\t89 d8                \tmov    %ebx,%eax\n   c:\t5b                   \tpop    %rbx\n   d:\t41 5c                \tpop    %r12\n   f:\t41 5d                \tpop    %r13\n  11:\t41 5e                \tpop    %r14\n  13:\t41 5f                \tpop    %r15\n  15:\t5d                   \tpop    %rbp\n  16:\tc3                   \tretq\n  17:\tcc                   \tint3\n  18:\tcc                   \tint3\n  19:\tcc                   \tint3\n  1a:\tcc                   \tint3\n  1b:\t49 8b 84 24 e0 f1 ff \tmov    -0xe20(%r12),%rax\n  22:\tff\n  23:\t48 8b 80 90 1b 00 00 \tmov    0x1b90(%rax),%rax\n  2a:*\t83 38 03             \tcmpl   $0x3,(%rax)\t\t\u003c-- trapping instruction\n  2d:\t0f 84 37 fe ff ff    \tje     0xfffffffffffffe6a\n  33:\tbb ea ff ff ff       \tmov    $0xffffffea,%ebx\n  38:\teb cc                \tjmp    0x6\n  3a:\t49                   \trex.WB\n  3b:\t8b                   \t.byte 0x8b\n  3c:\t84 24 10             \ttest   %ah,(%rax,%rdx,1)\n  3f:\tf3                   \trepz\n\nCode starting with the faulting instruction\n===========================================\n   0:\t83 38 03             \tcmpl   $0x3,(%rax)\n   3:\t0f 84 37 fe ff ff    \tje     0xfffffffffffffe40\n   9:\tbb ea ff ff ff       \tmov    $0xffffffea,%ebx\n   e:\teb cc                \tjmp    0xffffffffffffffdc\n  10:\t49                   \trex.WB\n  11:\t8b                   \t.byte 0x8b\n  12:\t84 24 10             \ttest   %ah,(%rax,%rdx,1)\n  15:\tf3                   \trepz\n[ 9890.526285] RSP: 0018:ffffb8db09013d68 EFLAGS: 00010246\n[ 9890.526291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9308e0d656c8\n[ 9890.526295] RDX: 0000000000000000 RSI: ffffffffab99460b RDI: ffffffffab9a7685\n[ 9890.526300] RBP: ffffb8db09013db8 R08: 0000000000000000 R09: 0000000000000873\n[ 9890.526304] R10: ffff9308e0d64800 R11: 0000000000000002 R12: ffff9308e5ff6e70\n[ 9890.526308] R13: ffff930952500e20 R14: ffff9309192a8c00 R15: 0000000000000000\n[ 9890.526313] FS:  0000000000000000(0000) GS:ffff930b4e700000(0000) knlGS:0000000000000000\n[ 9890.526316] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9890.526318] CR2: 0000000000000000 CR3: 0000000391c58005 CR4: 00000000001706f0\n[ 9890.526321] Call Trace:\n[ 9890.526324]  \u003cTASK\u003e\n[ 9890.526327] ? show_regs (arch/x86/kernel/dumpstack.c:479)\n[ 9890.526335] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)\n[ 9890.526340] ? page_fault_oops (arch/x86/mm/fault.c:713)\n[ 9890.526347] ? search_module_extables (kernel/module/main.c:3256 (discriminator\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6b9864c-d23b-44bd-88a2-ec6f258019d1",
      "id": "CVE-2024-46814",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check msg_id before processing transcation\n\n[WHY \u0026 HOW]\nHDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid\narray index, and it needs checking before used.\n\nThis fixes 4 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3aa4700d-3a3e-480c-84c5-93b2a1f7d763",
      "id": "CVE-2024-46823",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit/overflow: Fix UB in overflow_allocation_test\n\nThe 'device_name' array doesn't exist out of the\n'overflow_allocation_test' function scope. However, it is being used as\na driver name when calling 'kunit_driver_create' from\n'kunit_device_register'. It produces the kernel panic with KASAN\nenabled.\n\nSince this variable is used in one place only, remove it and pass the\ndevice name into kunit_device_register directly as an ascii string.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6fd3bc48-a3f2-401e-888f-7d765e34eb1e",
      "id": "CVE-2024-50090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix overflow in oa batch buffer\n\nBy default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch\nbuffer, this is not a problem if batch buffer is only used once but\noa reuses the batch buffer for the same metric and at each call\nit appends a MI_BATCH_BUFFER_END, printing the warning below and then\noverflowing.\n\n[  381.072016] ------------[ cut here ]------------\n[  381.072019] xe 0000:00:02.0: [drm] Assertion `bb-\u003elen * 4 + bb_prefetch(q-\u003egt) \u003c= size` failed!\n               platform: LUNARLAKE subplatform: 1\n               graphics: Xe2_LPG / Xe2_HPG 20.04 step B0\n               media: Xe2_LPM / Xe2_HPM 20.00 step B0\n               tile: 0 VRAM 0 B\n               GT: 0 type 1\n\nSo here checking if batch buffer already have MI_BATCH_BUFFER_END if\nnot append it.\n\nv2:\n- simply fix, suggestion from Ashutosh\n\n(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "934758ff-dd66-4fa7-9c2f-3cf41ab873f5",
      "id": "CVE-2024-50112",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/lam: Disable ADDRESS_MASKING in most cases\n\nLinear Address Masking (LAM) has a weakness related to transient\nexecution as described in the SLAM paper[1]. Unless Linear Address\nSpace Separation (LASS) is enabled this weakness may be exploitable.\n\nUntil kernel adds support for LASS[2], only allow LAM for COMPILE_TEST,\nor when speculation mitigations have been disabled at compile time,\notherwise keep LAM disabled.\n\nThere are no processors in market that support LAM yet, so currently\nnobody is affected by this issue.\n\n[1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf\n[2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/\n\n[ dhansen: update SPECULATION_MITIGATIONS -\u003e CPU_MITIGATIONS ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e2b9e78-6ae9-4ec1-bace-39fdd7770092",
      "id": "CVE-2024-53161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/bluefield: Fix potential integer overflow\n\nThe 64-bit argument for the \"get DIMM info\" SMC call consists of mem_ctrl_idx\nleft-shifted 16 bits and OR-ed with DIMM index.  With mem_ctrl_idx defined as\n32-bits wide the left-shift operation truncates the upper 16 bits of\ninformation during the calculation of the SMC argument.\n\nThe mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any\npotential integer overflow, i.e. loss of data from upper 16 bits.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "485c923b-7311-4fdf-be02-a9fe7d1cf6d3",
      "id": "CVE-2024-56567",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nad7780: fix division by zero in ad7780_write_raw()\n\nIn the ad7780_write_raw() , val2 can be zero, which might lead to a\ndivision by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw()\nis based on iio_info's write_raw. While val is explicitly declared that\ncan be zero (in read mode), val2 is not specified to be non-zero.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0467a28b-42cd-4558-8d6d-42b52af16c08",
      "id": "CVE-2024-56619",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()\n\nSyzbot reported that when searching for records in a directory where the\ninode's i_size is corrupted and has a large value, memory access outside\nthe folio/page range may occur, or a use-after-free bug may be detected if\nKASAN is enabled.\n\nThis is because nilfs_last_byte(), which is called by nilfs_find_entry()\nand others to calculate the number of valid bytes of directory data in a\npage from i_size and the page index, loses the upper 32 bits of the 64-bit\nsize information due to an inappropriate type of local variable to which\nthe i_size value is assigned.\n\nThis caused a large byte offset value due to underflow in the end address\ncalculation in the calling nilfs_find_entry(), resulting in memory access\nthat exceeds the folio/page size.\n\nFix this issue by changing the type of the local variable causing the bit\nloss from \"unsigned int\" to \"u64\".  The return value of nilfs_last_byte()\nis also of type \"unsigned int\", but it is truncated so as not to exceed\nPAGE_SIZE and no bit loss occurs, so no change is required.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "54ead5f4-f7da-421d-9775-0161353ebd6e",
      "id": "CVE-2024-56641",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: initialize close_work early to avoid warning\n\nWe encountered a warning that close_work was canceled before\ninitialization.\n\n  WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0\n  Workqueue: events smc_lgr_terminate_work [smc]\n  RIP: 0010:__flush_work+0x19e/0x1b0\n  Call Trace:\n   ? __wake_up_common+0x7a/0x190\n   ? work_busy+0x80/0x80\n   __cancel_work_timer+0xe3/0x160\n   smc_close_cancel_work+0x1a/0x70 [smc]\n   smc_close_active_abort+0x207/0x360 [smc]\n   __smc_lgr_terminate.part.38+0xc8/0x180 [smc]\n   process_one_work+0x19e/0x340\n   worker_thread+0x30/0x370\n   ? process_one_work+0x340/0x340\n   kthread+0x117/0x130\n   ? __kthread_cancel_work+0x50/0x50\n   ret_from_fork+0x22/0x30\n\nThis is because when smc_close_cancel_work is triggered, e.g. the RDMA\ndriver is rmmod and the LGR is terminated, the conn-\u003eclose_work is\nflushed before initialization, resulting in WARN_ON(!work-\u003efunc).\n\n__smc_lgr_terminate             | smc_connect_{rdma|ism}\n-------------------------------------------------------------\n                                | smc_conn_create\n\t\t\t\t| \\- smc_lgr_register_conn\nfor conn in lgr-\u003econns_all      |\n\\- smc_conn_kill                |\n   \\- smc_close_active_abort    |\n      \\- smc_close_cancel_work  |\n         \\- cancel_work_sync    |\n            \\- __flush_work     |\n\t         (close_work)   |\n\t                        | smc_close_init\n\t                        | \\- INIT_WORK(\u0026close_work)\n\nSo fix this by initializing close_work before establishing the\nconnection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d120412-39ab-403e-afe4-04fa351f3538",
      "id": "CVE-2024-56691",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device\n\nWhile design wise the idea of converting the driver to use\nthe hierarchy of the IRQ chips is correct, the implementation\nhas (inherited) flaws. This was unveiled when platform_get_irq()\nhad started WARN() on IRQ 0 that is supposed to be a Linux\nIRQ number (also known as vIRQ).\n\nRework the driver to respect IRQ domain when creating each MFD\ndevice separately, as the domain is not the same for all of them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1049d80e-26ed-4b0c-978f-21c0c14f27b3",
      "id": "CVE-2024-56763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent bad count for tracing_cpumask_write\n\nIf a large count is provided, it will trigger a warning in bitmap_parse_user.\nAlso check zero for it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dde80e2c-784d-445b-a26d-bfba38ab82f8",
      "id": "CVE-2024-57892",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix slab-use-after-free due to dangling pointer dqi_priv\n\nWhen mounting ocfs2 and then remounting it as read-only, a\nslab-use-after-free occurs after the user uses a syscall to\nquota_getnextquota.  Specifically, sb_dqinfo(sb, type)-\u003edqi_priv is the\ndangling pointer.\n\nDuring the remounting process, the pointer dqi_priv is freed but is never\nset as null leaving it to be accessed.  Additionally, the read-only option\nfor remounting sets the DQUOT_SUSPENDED flag instead of setting the\nDQUOT_USAGE_ENABLED flags.  Moreover, later in the process of getting the\nnext quota, the function ocfs2_get_next_id is called and only checks the\nquota usage flags and not the quota suspended flags.\n\nTo fix this, I set dqi_priv to null when it is freed after remounting with\nread-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id.\n\n[akpm@linux-foundation.org: coding-style cleanups]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a504f474-25c2-420c-ae7d-8a0448a6ca1a",
      "id": "CVE-2024-57946",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: don't keep queue frozen during system suspend\n\nCommit 4ce6e2db00de (\"virtio-blk: Ensure no requests in virtqueues before\ndeleting vqs.\") replaces queue quiesce with queue freeze in virtio-blk's\nPM callbacks. And the motivation is to drain inflight IOs before suspending.\n\nblock layer's queue freeze looks very handy, but it is also easy to cause\ndeadlock, such as, any attempt to call into bio_queue_enter() may run into\ndeadlock if the queue is frozen in current context. There are all kinds\nof -\u003esuspend() called in suspend context, so keeping queue frozen in the\nwhole suspend context isn't one good idea. And Marek reported lockdep\nwarning[1] caused by virtio-blk's freeze queue in virtblk_freeze().\n\n[1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/\n\nGiven the motivation is to drain in-flight IOs, it can be done by calling\nfreeze \u0026 unfreeze, meantime restore to previous behavior by keeping queue\nquiesced during suspend.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2da1fce-d56b-43ca-ab88-85cf0349defd",
      "id": "CVE-2025-21786",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Put the pwq after detaching the rescuer from the pool\n\nThe commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and\nremove detach_completion\") adds code to reap the normal workers but\nmistakenly does not handle the rescuer and also removes the code waiting\nfor the rescuer in put_unbound_pool(), which caused a use-after-free bug\nreported by Cheung Wall.\n\nTo avoid the use-after-free bug, the pool’s reference must be held until\nthe detachment is complete. Therefore, move the code that puts the pwq\nafter detaching the rescuer from the pool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c767a477-45ff-469b-b2ba-a19803df650e",
      "id": "CVE-2025-21820",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: xilinx_uartps: split sysrq handling\n\nlockdep detects the following circular locking dependency:\n\nCPU 0                      CPU 1\n========================== ============================\ncdns_uart_isr()            printk()\n  uart_port_lock(port)       console_lock()\n\t\t\t     cdns_uart_console_write()\n                               if (!port-\u003esysrq)\n                                 uart_port_lock(port)\n  uart_handle_break()\n    port-\u003esysrq = ...\n  uart_handle_sysrq_char()\n    printk()\n      console_lock()\n\nThe fixed commit attempts to avoid this situation by only taking the\nport lock in cdns_uart_console_write if port-\u003esysrq unset. However, if\n(as shown above) cdns_uart_console_write runs before port-\u003esysrq is set,\nthen it will try to take the port lock anyway. This may result in a\ndeadlock.\n\nFix this by splitting sysrq handling into two parts. We use the prepare\nhelper under the port lock and defer handling until we release the lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a9d7c32-77c5-41b6-9746-f2d62a199153",
      "id": "CVE-2025-38219",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: prevent kernel warning due to negative i_nlink from corrupted image\n\nWARNING: CPU: 1 PID: 9426 at fs/inode.c:417 drop_nlink+0xac/0xd0\nhome/cc/linux/fs/inode.c:417\nModules linked in:\nCPU: 1 UID: 0 PID: 9426 Comm: syz-executor568 Not tainted\n6.14.0-12627-g94d471a4f428 #2 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417\nCode: 48 8b 5d 28 be 08 00 00 00 48 8d bb 70 07 00 00 e8 f9 67 e6 ff\nf0 48 ff 83 70 07 00 00 5b 5d e9 9a 12 82 ff e8 95 12 82 ff 90\n\u0026lt;0f\u0026gt; 0b 90 c7 45 48 ff ff ff ff 5b 5d e9 83 12 82 ff e8 fe 5f e6\nff\nRSP: 0018:ffffc900026b7c28 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8239710f\nRDX: ffff888041345a00 RSI: ffffffff8239717b RDI: 0000000000000005\nRBP: ffff888054509ad0 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: ffffffff9ab36f08 R12: ffff88804bb40000\nR13: ffff8880545091e0 R14: 0000000000008000 R15: ffff8880545091e0\nFS:  000055555d0c5880(0000) GS:ffff8880eb3e3000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f915c55b178 CR3: 0000000050d20000 CR4: 0000000000352ef0\nCall Trace:\n \u003ctask\u003e\n f2fs_i_links_write home/cc/linux/fs/f2fs/f2fs.h:3194 [inline]\n f2fs_drop_nlink+0xd1/0x3c0 home/cc/linux/fs/f2fs/dir.c:845\n f2fs_delete_entry+0x542/0x1450 home/cc/linux/fs/f2fs/dir.c:909\n f2fs_unlink+0x45c/0x890 home/cc/linux/fs/f2fs/namei.c:581\n vfs_unlink+0x2fb/0x9b0 home/cc/linux/fs/namei.c:4544\n do_unlinkat+0x4c5/0x6a0 home/cc/linux/fs/namei.c:4608\n __do_sys_unlink home/cc/linux/fs/namei.c:4654 [inline]\n __se_sys_unlink home/cc/linux/fs/namei.c:4652 [inline]\n __x64_sys_unlink+0xc5/0x110 home/cc/linux/fs/namei.c:4652\n do_syscall_x64 home/cc/linux/arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc7/0x250 home/cc/linux/arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fb3d092324b\nCode: 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66\n2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 57 00 00 00 0f 05\n\u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01\n48\nRSP: 002b:00007ffdc232d938 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb3d092324b\nRDX: 00007ffdc232d960 RSI: 00007ffdc232d960 RDI: 00007ffdc232d9f0\nRBP: 00007ffdc232d9f0 R08: 0000000000000001 R09: 00007ffdc232d7c0\nR10: 00000000fffffffd R11: 0000000000000206 R12: 00007ffdc232eaf0\nR13: 000055555d0cebb0 R14: 00007ffdc232d958 R15: 0000000000000001\n \u003c/task\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10027739-3056-4bd8-b982-be453649e3c9",
      "id": "CVE-2025-21838",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: core: flush gadget workqueue after device removal\n\ndevice_del() can lead to new work being scheduled in gadget-\u003ework\nworkqueue. This is observed, for example, with the dwc3 driver with the\nfollowing call stack:\n  device_del()\n    gadget_unbind_driver()\n      usb_gadget_disconnect_locked()\n        dwc3_gadget_pullup()\n\t  dwc3_gadget_soft_disconnect()\n\t    usb_gadget_set_state()\n\t      schedule_work(\u0026gadget-\u003ework)\n\nMove flush_work() after device_del() to ensure the workqueue is cleaned\nup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f8fd1c59-ee8e-48f0-b9eb-a98da964e3f1",
      "id": "CVE-2025-37808",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: null - Use spin lock instead of mutex\n\nAs the null algorithm may be freed in softirq context through\naf_alg, use spin locks instead of mutexes to protect the default\nnull algorithm.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43534604-d5e1-4844-af4e-c205fd7d5a5e",
      "id": "CVE-2025-38024",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug\n\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcf/0x610 mm/kasan/report.c:489\n kasan_report+0xb5/0xe0 mm/kasan/report.c:602\n rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195\n rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132\n __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232\n rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109\n create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052\n ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095\n ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679\n vfs_write fs/read_write.c:677 [inline]\n vfs_write+0x26a/0xcc0 fs/read_write.c:659\n ksys_write+0x1b8/0x200 fs/read_write.c:731\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nIn the function rxe_create_cq, when rxe_cq_from_init fails, the function\nrxe_cleanup will be called to handle the allocated resources. In fact,\nsome memory resources have already been freed in the function\nrxe_cq_from_init. Thus, this problem will occur.\n\nThe solution is to let rxe_cleanup do all the work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bd735ae-c929-4ba7-a625-8fb5dde04835",
      "id": "CVE-2025-38117",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Protect mgmt_pending list with its own lock\n\nThis uses a mutex to protect from concurrent access of mgmt_pending\nlist which can cause crashes like:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91\nRead of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318\n\nCPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack+0x30/0x40 lib/dump_stack.c:94\n dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120\n print_address_description+0xa8/0x254 mm/kasan/report.c:408\n print_report+0x68/0x84 mm/kasan/report.c:521\n kasan_report+0xb0/0x110 mm/kasan/report.c:634\n __asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379\n hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91\n mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223\n pending_find net/bluetooth/mgmt.c:947 [inline]\n remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445\n hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712\n hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg net/socket.c:727 [inline]\n sock_write_iter+0x25c/0x378 net/socket.c:1131\n new_sync_write fs/read_write.c:591 [inline]\n vfs_write+0x62c/0x97c fs/read_write.c:684\n ksys_write+0x120/0x210 fs/read_write.c:736\n __do_sys_write fs/read_write.c:747 [inline]\n __se_sys_write fs/read_write.c:744 [inline]\n __arm64_sys_write+0x7c/0x90 fs/read_write.c:744\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n\nAllocated by task 7037:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4327 [inline]\n __kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339\n kmalloc_noprof include/linux/slab.h:909 [inline]\n sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198\n sk_alloc+0x44/0x3ac net/core/sock.c:2254\n bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148\n hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202\n bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132\n __sock_create+0x43c/0x91c net/socket.c:1541\n sock_create net/socket.c:1599 [inline]\n __sys_socket_create net/socket.c:1636 [inline]\n __sys_socket+0xd4/0x1c0 net/socket.c:1683\n __do_sys_socket net/socket.c:1697 [inline]\n __se_sys_socket net/socket.c:1695 [inline]\n __arm64_sys_socket+0x7c/0x94 net/socket.c:1695\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n\nFreed by task 6607:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x68/0x88 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5cf37abf-cd6d-49a5-9801-d0705e0f5fa4",
      "id": "CVE-2025-38129",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: Fix use-after-free in page_pool_recycle_in_ring\n\nsyzbot reported a uaf in page_pool_recycle_in_ring:\n\nBUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862\nRead of size 8 at addr ffff8880286045a0 by task syz.0.284/6943\n\nCPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862\n __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline]\n _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210\n spin_unlock_bh include/linux/spinlock.h:396 [inline]\n ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline]\n page_pool_recycle_in_ring net/core/page_pool.c:707 [inline]\n page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826\n page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline]\n page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline]\n napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036\n skb_pp_recycle net/core/skbuff.c:1047 [inline]\n skb_free_head net/core/skbuff.c:1094 [inline]\n skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125\n skb_release_all net/core/skbuff.c:1190 [inline]\n __kfree_skb net/core/skbuff.c:1204 [inline]\n sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242\n kfree_skb_reason include/linux/skbuff.h:1263 [inline]\n __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline]\n\nroot cause is:\n\npage_pool_recycle_in_ring\n  ptr_ring_produce\n    spin_lock(\u0026r-\u003eproducer_lock);\n    WRITE_ONCE(r-\u003equeue[r-\u003eproducer++], ptr)\n      //recycle last page to pool\n\t\t\t\tpage_pool_release\n\t\t\t\t  page_pool_scrub\n\t\t\t\t    page_pool_empty_ring\n\t\t\t\t      ptr_ring_consume\n\t\t\t\t      page_pool_return_page  //release all page\n\t\t\t\t  __page_pool_destroy\n\t\t\t\t     free_percpu(pool-\u003erecycle_stats);\n\t\t\t\t     free(pool) //free\n\n     spin_unlock(\u0026r-\u003eproducer_lock); //pool-\u003ering uaf read\n  recycle_stat_inc(pool, ring);\n\npage_pool can be free while page pool recycle the last page in ring.\nAdd producer-lock barrier to page_pool_release to prevent the page\npool from being free before all pages have been recycled.\n\nrecycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not\nenabled, which will trigger Wempty-body build warning. Add definition\nfor pool stat macro to fix warning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e6c1d34-9f93-444e-ad54-4e82860f50d0",
      "id": "CVE-2025-38161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix error flow upon firmware failure for RQ destruction\n\nUpon RQ destruction if the firmware command fails which is the\nlast resource to be destroyed some SW resources were already cleaned\nregardless of the failure.\n\nNow properly rollback the object to its original state upon such failure.\n\nIn order to avoid a use-after free in case someone tries to destroy the\nobject again, which results in the following kernel trace:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148\nModules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE)\nCPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G           OE     -------  ---  6.12.0-54.el10.aarch64 #1\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : refcount_warn_saturate+0xf4/0x148\nlr : refcount_warn_saturate+0xf4/0x148\nsp : ffff80008b81b7e0\nx29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001\nx26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00\nx23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21: 0000000000000000\nx20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006\nx17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f\nx14: 0000000000000000 x13: 2e656572662d7265 x12: ffff80008283ef78\nx11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90\nx8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff\nx5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 : ffff800179993000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600\nCall trace:\n refcount_warn_saturate+0xf4/0x148\n mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib]\n mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib]\n mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib]\n ib_destroy_wq_user+0x30/0xc0 [ib_core]\n uverbs_free_wq+0x28/0x58 [ib_uverbs]\n destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs]\n uverbs_destroy_uobject+0x48/0x240 [ib_uverbs]\n __uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs]\n uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs]\n ib_uverbs_close+0x2c/0x100 [ib_uverbs]\n __fput+0xd8/0x2f0\n __fput_sync+0x50/0x70\n __arm64_sys_close+0x40/0x90\n invoke_syscall.constprop.0+0x74/0xd0\n do_el0_svc+0x48/0xe8\n el0_svc+0x44/0x1d0\n el0t_64_sync_handler+0x120/0x130\n el0t_64_sync+0x1a4/0x1a8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb728d95-610c-4c92-a7e7-1d626627c694",
      "id": "CVE-2025-38180",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix /proc/net/atm/lec handling\n\n/proc/net/atm/lec must ensure safety against dev_lec[] changes.\n\nIt appears it had dev_put() calls without prior dev_hold(),\nleading to imbalance and UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ba497d0-bc40-4a97-9859-245c22c9be1e",
      "id": "CVE-2025-38591",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n    exit;\n\nWith pointer field sk being at offset 168 in __sk_buff. This access is\ndetected as a narrower read in bpf_skb_is_valid_access because it\ndoesn't match offsetof(struct __sk_buff, sk). It is therefore allowed\nand later proceeds to bpf_convert_ctx_access. Note that for the\n\"is_narrower_load\" case in the convert_ctx_accesses(), the insn-\u003eoff\nis aligned, so the cnt may not be 0 because it matches the\noffsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,\nthe target_size stays 0 and the verifier errors with a kernel warning:\n\n    verifier bug: error during ctx access conversion(1)\n\nThis patch fixes that to return a proper \"invalid bpf_context access\noff=X size=Y\" error on the load instruction.\n\nThe same issue affects multiple other fields in context structures that\nallow narrow access. Some other non-affected fields (for sk_msg,\nsk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for\nconsistency.\n\nNote this syzkaller crash was reported in the \"Closes\" link below, which\nused to be about a different bug, fixed in\ncommit fce7bd8e385a (\"bpf/verifier: Handle BPF_LOAD_ACQ instructions\nin insn_def_regno()\"). Because syzbot somehow confused the two bugs,\nthe new crash and repro didn't get reported to the mailing list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b7d3e95-3582-454f-81bf-d7a37744efc0",
      "id": "CVE-2025-39676",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla4xxx: Prevent a potential error pointer dereference\n\nThe qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,\nbut qla4xxx_ep_connect() returns error pointers.  Propagating the error\npointers will lead to an Oops in the caller, so change the error pointers\nto NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0117a495-d71d-4bd7-8ef4-e7efefc6d798",
      "id": "CVE-2020-12826",
      "description": "A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49692642-fa2d-4267-a54a-9220792ba604",
      "id": "CVE-2020-9383",
      "description": "An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "385639a9-0f5d-4422-8328-ae50461b6e1a",
      "id": "CVE-2021-29264",
      "description": "An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37e8075c-9cef-43ee-af13-da1af8170877",
      "id": "CVE-2021-46283",
      "description": "nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bdc5130c-b99e-4c59-a3b7-c99328e632f1",
      "id": "CVE-2021-46974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix masking negation logic upon negative dst register\n\nThe negation logic for the case where the off_reg is sitting in the\ndst register is not correct given then we cannot just invert the add\nto a sub or vice versa. As a fix, perform the final bitwise and-op\nunconditionally into AX from the off_reg, then move the pointer from\nthe src to dst and finally use AX as the source for the original\npointer arithmetic operation such that the inversion yields a correct\nresult. The single non-AX mov in between is possible given constant\nblinding is retaining it as it's not an immediate based operation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2cfa09ca-2081-4dc3-9af1-1e8ba64b703d",
      "id": "CVE-2021-47184",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix NULL ptr dereference on VSI filter sync\n\nRemove the reason of null pointer dereference in sync VSI filters.\nAdded new I40E_VSI_RELEASING flag to signalize deleting and releasing\nof VSI resources to sync this thread with sync filters subtask.\nWithout this patch it is possible to start update the VSI filter list\nafter VSI is removed, that's causing a kernel oops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d679215-c9b7-4e6d-8c0e-a827ed31b3c7",
      "id": "CVE-2021-47205",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: sunxi-ng: Unregister clocks/resets when unbinding\n\nCurrently, unbinding a CCU driver unmaps the device's MMIO region, while\nleaving its clocks/resets and their providers registered. This can cause\na page fault later when some clock operation tries to perform MMIO. Fix\nthis by separating the CCU initialization from the memory allocation,\nand then using a devres callback to unregister the clocks and resets.\n\nThis also fixes a memory leak of the `struct ccu_reset`, and uses the\ncorrect owner (the specific platform driver) for the clocks and resets.\n\nEarly OF clock providers are never unregistered, and limited error\nhandling is possible, so they are mostly unchanged. The error reporting\nis made more consistent by moving the message inside of_sunxi_ccu_probe.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7451ec3-c44d-440d-a6e3-ce5fe6ebd3cd",
      "id": "CVE-2021-47217",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails\n\nCheck for a valid hv_vp_index array prior to derefencing hv_vp_index when\nsetting Hyper-V's TSC change callback.  If Hyper-V setup failed in\nhyperv_init(), the kernel will still report that it's running under\nHyper-V, but will have silently disabled nearly all functionality.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000010\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] SMP\n  CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc2+ #75\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:set_hv_tscchange_cb+0x15/0xa0\n  Code: \u003c8b\u003e 04 82 8b 15 12 17 85 01 48 c1 e0 20 48 0d ee 00 01 00 f6 c6 08\n  ...\n  Call Trace:\n   kvm_arch_init+0x17c/0x280\n   kvm_init+0x31/0x330\n   vmx_init+0xba/0x13a\n   do_one_initcall+0x41/0x1c0\n   kernel_init_freeable+0x1f2/0x23b\n   kernel_init+0x16/0x120\n   ret_from_fork+0x22/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ada165c6-6836-493c-8cea-44b1b921bc0a",
      "id": "CVE-2021-47269",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: ep0: fix NULL pointer exception\n\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\nbe referring a non-existing ep and trigger a NULL pointer exception. In\ncertain configurations we might use fewer eps and the index might wrongly\nindicate a larger ep index than existing.\n\nBy adding this validation from the patch we can actually report a wrong\nindex back to the caller.\n\nIn our usecase we are using a composite device on an older kernel, but\nupstream might use this fix also. Unfortunately, I cannot describe the\nhardware for others to reproduce the issue as it is a proprietary\nimplementation.\n\n[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\n[   82.966891] Mem abort info:\n[   82.969663]   ESR = 0x96000006\n[   82.972703]   Exception class = DABT (current EL), IL = 32 bits\n[   82.978603]   SET = 0, FnV = 0\n[   82.981642]   EA = 0, S1PTW = 0\n[   82.984765] Data abort info:\n[   82.987631]   ISV = 0, ISS = 0x00000006\n[   82.991449]   CM = 0, WnR = 0\n[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\n[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\n[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\n[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\n[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\n[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\n[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\n[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\n\n...\n\n[   83.141788] Call trace:\n[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c\n[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94\n[   83.181546] ---[ end trace aac6b5267d84c32f ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3220cdee-7017-4140-9fd4-c0b347b51ab2",
      "id": "CVE-2021-47301",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix use-after-free error during reset\n\nCleans the next descriptor to watch (next_to_watch) when cleaning the\nTX ring.\n\nFailure to do so can cause invalid memory accesses. If igb_poll() runs\nwhile the controller is reset this can lead to the driver try to free\na skb that was already freed.\n\n(The crash is harder to reproduce with the igb driver, but the same\npotential problem exists as the code is identical to igc)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0eaef7cd-d0cb-44d6-96e7-542223424922",
      "id": "CVE-2021-47339",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-core: explicitly clear ioctl input data\n\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\nimplementation can lead to uninitialized kernel stack data getting used\nas input for driver ioctl handlers.\n\nThe reported bug is now fixed, but it's possible that other related\nbugs are still present or get added in the future. As the drivers need\nto check user input already, the possible impact is fairly low, but it\nmight still cause an information leak.\n\nTo be on the safe side, always clear the entire ioctl buffer before\ncalling the conversion handler functions that are meant to initialize\nthem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4eae1e8f-4fd8-4948-a451-4a6e07410468",
      "id": "CVE-2021-47468",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: Fix sleeping function called from invalid context\n\nThe driver can call card-\u003eisac.release() function from an atomic\ncontext.\n\nFix this by calling this function after releasing the lock.\n\nThe following log reveals it:\n\n[   44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018\n[   44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe\n[   44.169574 ] INFO: lockdep is turned off.\n[   44.169899 ] irq event stamp: 0\n[   44.170160 ] hardirqs last  enabled at (0): [\u003c0000000000000000\u003e] 0x0\n[   44.170627 ] hardirqs last disabled at (0): [\u003cffffffff814209ed\u003e] copy_process+0x132d/0x3e00\n[   44.171240 ] softirqs last  enabled at (0): [\u003cffffffff81420a1a\u003e] copy_process+0x135a/0x3e00\n[   44.171852 ] softirqs last disabled at (0): [\u003c0000000000000000\u003e] 0x0\n[   44.172318 ] Preemption disabled at:\n[   44.172320 ] [\u003cffffffffa009b0a9\u003e] nj_release+0x69/0x500 [netjet]\n[   44.174441 ] Call Trace:\n[   44.174630 ]  dump_stack_lvl+0xa8/0xd1\n[   44.174912 ]  dump_stack+0x15/0x17\n[   44.175166 ]  ___might_sleep+0x3a2/0x510\n[   44.175459 ]  ? nj_release+0x69/0x500 [netjet]\n[   44.175791 ]  __might_sleep+0x82/0xe0\n[   44.176063 ]  ? start_flush_work+0x20/0x7b0\n[   44.176375 ]  start_flush_work+0x33/0x7b0\n[   44.176672 ]  ? trace_irq_enable_rcuidle+0x85/0x170\n[   44.177034 ]  ? kasan_quarantine_put+0xaa/0x1f0\n[   44.177372 ]  ? kasan_quarantine_put+0xaa/0x1f0\n[   44.177711 ]  __flush_work+0x11a/0x1a0\n[   44.177991 ]  ? flush_work+0x20/0x20\n[   44.178257 ]  ? lock_release+0x13c/0x8f0\n[   44.178550 ]  ? __kasan_check_write+0x14/0x20\n[   44.178872 ]  ? do_raw_spin_lock+0x148/0x360\n[   44.179187 ]  ? read_lock_is_recursive+0x20/0x20\n[   44.179530 ]  ? __kasan_check_read+0x11/0x20\n[   44.179846 ]  ? do_raw_spin_unlock+0x55/0x900\n[   44.180168 ]  ? ____kasan_slab_free+0x116/0x140\n[   44.180505 ]  ? _raw_spin_unlock_irqrestore+0x41/0x60\n[   44.180878 ]  ? skb_queue_purge+0x1a3/0x1c0\n[   44.181189 ]  ? kfree+0x13e/0x290\n[   44.181438 ]  flush_work+0x17/0x20\n[   44.181695 ]  mISDN_freedchannel+0xe8/0x100\n[   44.182006 ]  isac_release+0x210/0x260 [mISDNipac]\n[   44.182366 ]  nj_release+0xf6/0x500 [netjet]\n[   44.182685 ]  nj_remove+0x48/0x70 [netjet]\n[   44.182989 ]  pci_device_remove+0xa9/0x250",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb76ec77-85cb-4e3d-aac1-6da3b7be756f",
      "id": "CVE-2021-47495",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: sanity check for maxpacket\n\nmaxpacket of 0 makes no sense and oopses as we need to divide\nby it. Give up.\n\nV2: fixed typo in log and stylistic issues",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c51137c-f8b4-441f-b135-39b755980f64",
      "id": "CVE-2022-3564",
      "description": "A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f5e23c0-397f-4f37-8e06-1fa633b992e1",
      "id": "CVE-2022-49059",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: add flush_workqueue to prevent uaf\n\nOur detector found a concurrent use-after-free bug when detaching an\nNCI device. The main reason for this bug is the unexpected scheduling\nbetween the used delayed mechanism (timer and workqueue).\n\nThe race can be demonstrated below:\n\nThread-1                           Thread-2\n                                 | nci_dev_up()\n                                 |   nci_open_device()\n                                 |     __nci_request(nci_reset_req)\n                                 |       nci_send_cmd\n                                 |         queue_work(cmd_work)\nnci_unregister_device()          |\n  nci_close_device()             | ...\n    del_timer_sync(cmd_timer)[1] |\n...                              | Worker\nnci_free_device()                | nci_cmd_work()\n  kfree(ndev)[3]                 |   mod_timer(cmd_timer)[2]\n\nIn short, the cleanup routine thought that the cmd_timer has already\nbeen detached by [1] but the mod_timer can re-attach the timer [2], even\nit is already released [3], resulting in UAF.\n\nThis UAF is easy to trigger, crash trace by POC is like below\n\n[   66.703713] ==================================================================\n[   66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490\n[   66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33\n[   66.703974]\n[   66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5\n[   66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work\n[   66.703974] Call Trace:\n[   66.703974]  \u003cTASK\u003e\n[   66.703974]  dump_stack_lvl+0x57/0x7d\n[   66.703974]  print_report.cold+0x5e/0x5db\n[   66.703974]  ? enqueue_timer+0x448/0x490\n[   66.703974]  kasan_report+0xbe/0x1c0\n[   66.703974]  ? enqueue_timer+0x448/0x490\n[   66.703974]  enqueue_timer+0x448/0x490\n[   66.703974]  __mod_timer+0x5e6/0xb80\n[   66.703974]  ? mark_held_locks+0x9e/0xe0\n[   66.703974]  ? try_to_del_timer_sync+0xf0/0xf0\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x17b/0x410\n[   66.703974]  ? queue_work_on+0x61/0x80\n[   66.703974]  ? lockdep_hardirqs_on+0xbf/0x130\n[   66.703974]  process_one_work+0x8bb/0x1510\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x410/0x410\n[   66.703974]  ? pwq_dec_nr_in_flight+0x230/0x230\n[   66.703974]  ? rwlock_bug.part.0+0x90/0x90\n[   66.703974]  ? _raw_spin_lock_irq+0x41/0x50\n[   66.703974]  worker_thread+0x575/0x1190\n[   66.703974]  ? process_one_work+0x1510/0x1510\n[   66.703974]  kthread+0x2a0/0x340\n[   66.703974]  ? kthread_complete_and_exit+0x20/0x20\n[   66.703974]  ret_from_fork+0x22/0x30\n[   66.703974]  \u003c/TASK\u003e\n[   66.703974]\n[   66.703974] Allocated by task 267:\n[   66.703974]  kasan_save_stack+0x1e/0x40\n[   66.703974]  __kasan_kmalloc+0x81/0xa0\n[   66.703974]  nci_allocate_device+0xd3/0x390\n[   66.703974]  nfcmrvl_nci_register_dev+0x183/0x2c0\n[   66.703974]  nfcmrvl_nci_uart_open+0xf2/0x1dd\n[   66.703974]  nci_uart_tty_ioctl+0x2c3/0x4a0\n[   66.703974]  tty_ioctl+0x764/0x1310\n[   66.703974]  __x64_sys_ioctl+0x122/0x190\n[   66.703974]  do_syscall_64+0x3b/0x90\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   66.703974]\n[   66.703974] Freed by task 406:\n[   66.703974]  kasan_save_stack+0x1e/0x40\n[   66.703974]  kasan_set_track+0x21/0x30\n[   66.703974]  kasan_set_free_info+0x20/0x30\n[   66.703974]  __kasan_slab_free+0x108/0x170\n[   66.703974]  kfree+0xb0/0x330\n[   66.703974]  nfcmrvl_nci_unregister_dev+0x90/0xd0\n[   66.703974]  nci_uart_tty_close+0xdf/0x180\n[   66.703974]  tty_ldisc_kill+0x73/0x110\n[   66.703974]  tty_ldisc_hangup+0x281/0x5b0\n[   66.703974]  __tty_hangup.part.0+0x431/0x890\n[   66.703974]  tty_release+0x3a8/0xc80\n[   66.703974]  __fput+0x1f0/0x8c0\n[   66.703974]  task_work_run+0xc9/0x170\n[   66.703974]  exit_to_user_mode_prepare+0x194/0x1a0\n[   66.703974]  syscall_exit_to_user_mode+0x19/0x50\n[   66.703974]  do_syscall_64+0x48/0x90\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0x\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07595354-68c6-4b51-8450-2c3fcdea10aa",
      "id": "CVE-2022-49120",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix task leak in pm8001_send_abort_all()\n\nIn pm8001_send_abort_all(), make sure to free the allocated sas task\nif pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9e014d00-5a7f-4f78-9365-ad53730c6443",
      "id": "CVE-2022-49154",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: fix panic on out-of-bounds guest IRQ\n\nAs guest_irq is coming from KVM_IRQFD API call, it may trigger\ncrash in svm_update_pi_irte() due to out-of-bounds:\n\ncrash\u003e bt\nPID: 22218  TASK: ffff951a6ad74980  CPU: 73  COMMAND: \"vcpu8\"\n #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397\n #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d\n #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d\n #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d\n #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9\n #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51\n #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace\n    [exception RIP: svm_update_pi_irte+227]\n    RIP: ffffffffc0761b53  RSP: ffffb1ba6707fd08  RFLAGS: 00010086\n    RAX: ffffb1ba6707fd78  RBX: ffffb1ba66d91000  RCX: 0000000000000001\n    RDX: 00003c803f63f1c0  RSI: 000000000000019a  RDI: ffffb1ba66db2ab8\n    RBP: 000000000000019a   R8: 0000000000000040   R9: ffff94ca41b82200\n    R10: ffffffffffffffcf  R11: 0000000000000001  R12: 0000000000000001\n    R13: 0000000000000001  R14: ffffffffffffffcf  R15: 000000000000005f\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm]\n #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm]\n #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm]\n    RIP: 00007f143c36488b  RSP: 00007f143a4e04b8  RFLAGS: 00000246\n    RAX: ffffffffffffffda  RBX: 00007f05780041d0  RCX: 00007f143c36488b\n    RDX: 00007f05780041d0  RSI: 000000004008ae6a  RDI: 0000000000000020\n    RBP: 00000000000004e8   R8: 0000000000000008   R9: 00007f05780041e0\n    R10: 00007f0578004560  R11: 0000000000000246  R12: 00000000000004e0\n    R13: 000000000000001a  R14: 00007f1424001c60  R15: 00007f0578003bc0\n    ORIG_RAX: 0000000000000010  CS: 0033  SS: 002b\n\nVmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on\nout-of-bounds guest IRQ), so we can just copy source from that to fix\nthis.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a2f5e58-5b66-4b71-8573-cae10c37557f",
      "id": "CVE-2022-49156",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix scheduling while atomic\n\nThe driver makes a call into midlayer (fc_remote_port_delete) which can put\nthe thread to sleep. The thread that originates the call is in interrupt\ncontext. The combination of the two trigger a crash. Schedule the call in\nnon-interrupt context where it is more safe.\n\nkernel: BUG: scheduling while atomic: swapper/7/0/0x00010000\nkernel: Call Trace:\nkernel:  \u003cIRQ\u003e\nkernel:  dump_stack+0x66/0x81\nkernel:  __schedule_bug.cold.90+0x5/0x1d\nkernel:  __schedule+0x7af/0x960\nkernel:  schedule+0x28/0x80\nkernel:  schedule_timeout+0x26d/0x3b0\nkernel:  wait_for_completion+0xb4/0x140\nkernel:  ? wake_up_q+0x70/0x70\nkernel:  __wait_rcu_gp+0x12c/0x160\nkernel:  ? sdev_evt_alloc+0xc0/0x180 [scsi_mod]\nkernel:  synchronize_sched+0x6c/0x80\nkernel:  ? call_rcu_bh+0x20/0x20\nkernel:  ? __bpf_trace_rcu_invoke_callback+0x10/0x10\nkernel:  sdev_evt_alloc+0xfd/0x180 [scsi_mod]\nkernel:  starget_for_each_device+0x85/0xb0 [scsi_mod]\nkernel:  ? scsi_init_io+0x360/0x3d0 [scsi_mod]\nkernel:  scsi_init_io+0x388/0x3d0 [scsi_mod]\nkernel:  device_for_each_child+0x54/0x90\nkernel:  fc_remote_port_delete+0x70/0xe0 [scsi_transport_fc]\nkernel:  qla2x00_schedule_rport_del+0x62/0xf0 [qla2xxx]\nkernel:  qla2x00_mark_device_lost+0x9c/0xd0 [qla2xxx]\nkernel:  qla24xx_handle_plogi_done_event+0x55f/0x570 [qla2xxx]\nkernel:  qla2x00_async_login_sp_done+0xd2/0x100 [qla2xxx]\nkernel:  qla24xx_logio_entry+0x13a/0x3c0 [qla2xxx]\nkernel:  qla24xx_process_response_queue+0x306/0x400 [qla2xxx]\nkernel:  qla24xx_msix_rsp_q+0x3f/0xb0 [qla2xxx]\nkernel:  __handle_irq_event_percpu+0x40/0x180\nkernel:  handle_irq_event_percpu+0x30/0x80\nkernel:  handle_irq_event+0x36/0x60",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "df615c5a-1edc-4a77-896d-b701b6a95751",
      "id": "CVE-2022-49281",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix handlecache and multiuser\n\nIn multiuser each individual user has their own tcon structure for the\nshare and thus their own handle for a cached directory.\nWhen we umount such a share we much make sure to release the pinned down dentry\nfor each such tcon and not just the master tcon.\n\nOtherwise we will get nasty warnings on umount that dentries are still in use:\n[ 3459.590047] BUG: Dentry 00000000115c6f41{i=12000000019d95,n=/}  still in use\\\n (2) [unmount of cifs cifs]\n...\n[ 3459.590492] Call Trace:\n[ 3459.590500]  d_walk+0x61/0x2a0\n[ 3459.590518]  ? shrink_lock_dentry.part.0+0xe0/0xe0\n[ 3459.590526]  shrink_dcache_for_umount+0x49/0x110\n[ 3459.590535]  generic_shutdown_super+0x1a/0x110\n[ 3459.590542]  kill_anon_super+0x14/0x30\n[ 3459.590549]  cifs_kill_sb+0xf5/0x104 [cifs]\n[ 3459.590773]  deactivate_locked_super+0x36/0xa0\n[ 3459.590782]  cleanup_mnt+0x131/0x190\n[ 3459.590789]  task_work_run+0x5c/0x90\n[ 3459.590798]  exit_to_user_mode_loop+0x151/0x160\n[ 3459.590809]  exit_to_user_mode_prepare+0x83/0xd0\n[ 3459.590818]  syscall_exit_to_user_mode+0x12/0x30\n[ 3459.590828]  do_syscall_64+0x48/0x90\n[ 3459.590833]  entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77181356-79e8-400e-80b4-1f178a73120a",
      "id": "CVE-2022-49303",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle\n\nThere is a deadlock in rtw_joinbss_event_prehandle(), which is shown below:\n\n   (Thread 1)                |      (Thread 2)\n                             | _set_timer()\nrtw_joinbss_event_prehandle()|  mod_timer()\n spin_lock_bh() //(1)        |  (wait a time)\n ...                         | rtw_join_timeout_handler()\n                             |  _rtw_join_timeout_handler()\n del_timer_sync()            |   spin_lock_bh() //(2)\n (wait timer to stop)        |   ...\n\nWe hold pmlmepriv-\u003elock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need pmlmepriv-\u003elock in position (2) of thread 2.\nAs a result, rtw_joinbss_event_prehandle() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_bh(), which could let timer handler to obtain\nthe needed lock. What`s more, we change spin_lock_bh() to\nspin_lock_irq() in _rtw_join_timeout_handler() in order to\nprevent deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c0cadda-5d31-4bb8-86ea-c0121375dffc",
      "id": "CVE-2022-49342",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register\n\nof_get_child_by_name() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e5816491-77b1-4b5f-a242-82ee2d66a469",
      "id": "CVE-2022-49388",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_create_volume: Fix use-after-free when volume creation failed\n\nThere is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s\nerror handling path:\n\n  ubi_eba_replace_table(vol, eba_tbl)\n    vol-\u003eeba_tbl = tbl\nout_mapping:\n  ubi_eba_destroy_table(eba_tbl)   // Free 'eba_tbl'\nout_unlock:\n  put_device(\u0026vol-\u003edev)\n    vol_release\n      kfree(tbl-\u003eentries)\t  // UAF\n\nFix it by removing redundant 'eba_tbl' releasing.\nFetch a reproducer in [Link].",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "781178e0-80d5-4dea-bd4a-c2c5d8d75524",
      "id": "CVE-2022-49753",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix double increment of client_count in dma_chan_get()\n\nThe first time dma_chan_get() is called for a channel the channel\nclient_count is incorrectly incremented twice for public channels,\nfirst in balance_ref_count(), and again prior to returning. This\nresults in an incorrect client count which will lead to the\nchannel resources not being freed when they should be. A simple\n test of repeated module load and unload of async_tx on a Dell\n Power Edge R7425 also shows this resulting in a kref underflow\n warning.\n\n[  124.329662] async_tx: api initialized (async)\n[  129.000627] async_tx: api initialized (async)\n[  130.047839] ------------[ cut here ]------------\n[  130.052472] refcount_t: underflow; use-after-free.\n[  130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28\nrefcount_warn_saturate+0xba/0x110\n[  130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr\nintel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm\nmgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si\nsyscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops\nk10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat\nfat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul\nlibahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas\ni40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash\ndm_log dm_mod [last unloaded: async_tx]\n[  130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not\ntainted 5.14.0-185.el9.x86_64 #1\n[  130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS\n1.18.0 01/17/2022\n[  130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110\n[  130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d\n26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a\nbd 55 00 \u003c0f\u003e 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff\n48 c7\n[  130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286\n[  130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000\n[  130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0\n[  130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff\n[  130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970\n[  130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  130.198739] FS:  00007f646435c740(0000) GS:ffff9daf9de00000(0000)\nknlGS:0000000000000000\n[  130.206832] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0\n[  130.219729] Call Trace:\n[  130.222192]  \u003cTASK\u003e\n[  130.224305]  dma_chan_put+0x10d/0x110\n[  130.227988]  dmaengine_put+0x7a/0xa0\n[  130.231575]  __do_sys_delete_module.constprop.0+0x178/0x280\n[  130.237157]  ? syscall_trace_enter.constprop.0+0x145/0x1d0\n[  130.242652]  do_syscall_64+0x5c/0x90\n[  130.246240]  ? exc_page_fault+0x62/0x150\n[  130.250178]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  130.255243] RIP: 0033:0x7f6463a3f5ab\n[  130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48\n83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00\n00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89\n01 48\n[  130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX:\n00000000000000b0\n[  130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab\n[  130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8\n[  130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000\n[  130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8\n[  130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8\n[  130.320875]  \u003c/TASK\u003e\n[  130.323081] ---[ end trace eff7156d56b5cf25 ]---\n\ncat /sys/class/dma/dma0chan*/in_use would get the wrong result.\n2\n2\n2\n\nTest-by: Jie Hai \u003chaijie1@huawei.com\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8bf1aad-5c43-4c51-a06c-13fb3c5c7c96",
      "id": "CVE-2022-49398",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback\n\nThe list_for_each_entry_safe() macro saves the current item (n) and\nthe item after (n+1), so that n can be safely removed without\ncorrupting the list.  However, when traversing the list and removing\nitems using gadget giveback, the DWC3 lock is briefly released,\nallowing other routines to execute.  There is a situation where, while\nitems are being removed from the cancelled_list using\ndwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable\nroutine is running in parallel (due to UDC unbind).  As the cleanup\nroutine removes n, and the pullup disable removes n+1, once the\ncleanup retakes the DWC3 lock, it references a request who was already\nremoved/handled.  With list debug enabled, this leads to a panic.\nEnsure all instances of the macro are replaced where gadget giveback\nis used.\n\nExample call stack:\n\nThread#1:\n__dwc3_gadget_ep_set_halt() - CLEAR HALT\n  -\u003e dwc3_gadget_ep_cleanup_cancelled_requests()\n    -\u003elist_for_each_entry_safe()\n    -\u003edwc3_gadget_giveback(n)\n      -\u003edwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list]\n      -\u003espin_unlock\n      -\u003eThread#2 executes\n      ...\n    -\u003edwc3_gadget_giveback(n+1)\n      -\u003eAlready removed!\n\nThread#2:\ndwc3_gadget_pullup()\n  -\u003ewaiting for dwc3 spin_lock\n  ...\n  -\u003eThread#1 released lock\n  -\u003edwc3_stop_active_transfers()\n    -\u003edwc3_remove_requests()\n      -\u003efetches n+1 item from cancelled_list (n removed by Thread#1)\n      -\u003edwc3_gadget_giveback()\n        -\u003edwc3_gadget_del_and_unmap_request()- n+1 deleted[cancelled_list]\n        -\u003espin_unlock",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "108c266f-1fc0-4bc2-9329-3a43e711f9a9",
      "id": "CVE-2022-49589",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigmp: Fix data-races around sysctl_igmp_qrv.\n\nWhile reading sysctl_igmp_qrv, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.\n\nThis test can be packed into a helper, so such changes will be in the\nfollow-up series after net is merged into net-next.\n\n  qrv ?: READ_ONCE(net-\u003eipv4.sysctl_igmp_qrv);",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e6dc5744-61e3-40e3-8586-5eab0050b14f",
      "id": "CVE-2022-49618",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux()\n\npdesc could be null but still dereference pdesc-\u003ename and it will lead to\na null pointer access. So we move a null check before dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f534e805-6a96-4dfa-96d4-957167324327",
      "id": "CVE-2022-49661",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_open/close(): fix memory leak\n\nThe gs_usb driver appears to suffer from a malady common to many USB\nCAN adapter drivers in that it performs usb_alloc_coherent() to\nallocate a number of USB request blocks (URBs) for RX, and then later\nrelies on usb_kill_anchored_urbs() to free them, but this doesn't\nactually free them. As a result, this may be leaking DMA memory that's\nbeen used by the driver.\n\nThis commit is an adaptation of the techniques found in the esd_usb2\ndriver where a similar design pattern led to a memory leak. It\nexplicitly frees the RX URBs and their DMA memory via a call to\nusb_free_coherent(). Since the RX URBs were allocated in the\ngs_can_open(), we remove them in gs_can_close() rather than in the\ndisconnect function as was done in esd_usb2.\n\nFor more information, see the 928150fad41b (\"can: esd_usb2: fix memory\nleak\").",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "926a43f0-4dde-4c71-9040-aab6f4aa48ba",
      "id": "CVE-2022-49739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Always check inode size of inline inodes\n\nCheck if the inode size of stuffed (inline) inodes is within the allowed\nrange when reading inodes from disk (gfs2_dinode_in()).  This prevents\nus from on-disk corruption.\n\nThe two checks in stuffed_readpage() and gfs2_unstuffer_page() that just\ntruncate inline data to the maximum allowed size don't actually make\nsense, and they can be removed now as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d9a84c9-e163-4945-8cd9-870999989e60",
      "id": "CVE-2022-49769",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Check sb_bsize_shift after reading superblock\n\nFuzzers like to scribble over sb_bsize_shift but in reality it's very\nunlikely that this field would be corrupted on its own. Nevertheless it\nshould be checked to avoid the possibility of messy mount errors due to\nbad calculations. It's always a fixed value based on the block size so\nwe can just check that it's the expected value.\n\nTested with:\n\n    mkfs.gfs2 -O -p lock_nolock /dev/vdb\n    for i in 0 -1 64 65 32 33; do\n        gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb\n        mount /dev/vdb /mnt/test \u0026\u0026 umount /mnt/test\n    done\n\nBefore this patch we get a withdraw after\n\n[   76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block\n[   76.413681]   bh = 19 (type: exp=5, found=4)\n[   76.413681]   function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492\n\nand with UBSAN configured we also get complaints like\n\n[   76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19\n[   76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int'\n\nAfter the patch, these complaints don't appear, mount fails immediately\nand we get an explanation in dmesg.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cde41675-071f-4814-b3de-9f6739525b85",
      "id": "CVE-2022-49790",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - invert valid length check when fetching device IDs\n\nsyzbot is reporting uninitialized value at iforce_init_device() [1], for\ncommit 6ac0aec6b0a6 (\"Input: iforce - allow callers supply data buffer\nwhen fetching device IDs\") is checking that valid length is shorter than\nbytes to read. Since iforce_get_id_packet() stores valid length when\nreturning 0, the caller needs to check that valid length is longer than or\nequals to bytes to read.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "463fe662-0ea0-443f-8e88-bcd708a7c0df",
      "id": "CVE-2022-49840",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()\n\nWe got a syzkaller problem because of aarch64 alignment fault\nif KFENCE enabled. When the size from user bpf program is an odd\nnumber, like 399, 407, etc, it will cause the struct skb_shared_info's\nunaligned access. As seen below:\n\n  BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032\n\n  Use-after-free read at 0xffff6254fffac077 (in kfence-#213):\n   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]\n   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]\n   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]\n   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]\n   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032\n   skb_clone+0xf4/0x214 net/core/skbuff.c:1481\n   ____bpf_clone_redirect net/core/filter.c:2433 [inline]\n   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420\n   bpf_prog_d3839dd9068ceb51+0x80/0x330\n   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]\n   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53\n   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594\n   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]\n   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]\n   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381\n\n  kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512\n\n  allocated by task 15074 on cpu 0 at 1342.585390s:\n   kmalloc include/linux/slab.h:568 [inline]\n   kzalloc include/linux/slab.h:675 [inline]\n   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191\n   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512\n   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]\n   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]\n   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381\n   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381\n\nTo fix the problem, we adjust @size so that (@size + @hearoom) is a\nmultiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info\nis aligned to a cache line.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed9bb3d4-c5e9-49c2-9c10-61393dbc851c",
      "id": "CVE-2022-49880",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix warning in 'ext4_da_release_space'\n\nSyzkaller report issue as follows:\nEXT4-fs (loop0): Free/Dirty block details\nEXT4-fs (loop0): free_blocks=0\nEXT4-fs (loop0): dirty_blocks=0\nEXT4-fs (loop0): Block reservation details\nEXT4-fs (loop0): i_reserved_data_blocks=0\nEXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524\nModules linked in:\nCPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\nWorkqueue: writeback wb_workfn (flush-7:0)\nRIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528\nRSP: 0018:ffffc900015f6c90 EFLAGS: 00010296\nRAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00\nRDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000\nRBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5\nR10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000\nR13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740\nFS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461\n mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589\n ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852\n do_writepages+0x3c3/0x680 mm/page-writeback.c:2469\n __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587\n writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870\n wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044\n wb_do_writeback fs/fs-writeback.c:2187 [inline]\n wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227\n process_one_work+0x877/0xdb0 kernel/workqueue.c:2289\n worker_thread+0xb14/0x1330 kernel/workqueue.c:2436\n kthread+0x266/0x300 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n \u003c/TASK\u003e\n\nAbove issue may happens as follows:\next4_da_write_begin\n  ext4_create_inline_data\n    ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);\n    ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);\n__ext4_ioctl\n  ext4_ext_migrate -\u003e will lead to eh-\u003eeh_entries not zero, and set extent flag\next4_da_write_begin\n  ext4_da_convert_inline_data_to_extent\n    ext4_da_write_inline_data_begin\n      ext4_da_map_blocks\n        ext4_insert_delayed_block\n\t  if (!ext4_es_scan_clu(inode, \u0026ext4_es_is_delonly, lblk))\n\t    if (!ext4_es_scan_clu(inode, \u0026ext4_es_is_mapped, lblk))\n\t      ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -\u003e will return 1\n\t       allocated = true;\n          ext4_es_insert_delayed_block(inode, lblk, allocated);\next4_writepages\n  mpage_map_and_submit_extent(handle, \u0026mpd, \u0026give_up_on_write); -\u003e return -ENOSPC\n  mpage_release_unused_pages(\u0026mpd, give_up_on_write); -\u003e give_up_on_write == 1\n    ext4_es_remove_extent\n      ext4_da_release_space(inode, reserved);\n        if (unlikely(to_free \u003e ei-\u003ei_reserved_data_blocks))\n\t  -\u003e to_free == 1  but ei-\u003ei_reserved_data_blocks == 0\n\t  -\u003e then trigger warning as above\n\nTo solve above issue, forbid inode do migrate which has inline data.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0d34b41-6bce-4bca-ad6f-0232ba1f44e9",
      "id": "CVE-2022-49956",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix use after free bugs\n\n_Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl()\nfunctions don't do anything except free the \"pcmd\" pointer.  It\nresults in a use after free.  Delete them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fccb85ce-576b-4b96-9d10-cf207814ae99",
      "id": "CVE-2022-50007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix refcount leak in __xfrm_policy_check()\n\nThe issue happens on an error path in __xfrm_policy_check(). When the\nfetching process of the object `pols[1]` fails, the function simply\nreturns 0, forgetting to decrement the reference count of `pols[0]`,\nwhich is incremented earlier by either xfrm_sk_policy_lookup() or\nxfrm_policy_lookup(). This may result in memory leaks.\n\nFix it by decreasing the reference count of `pols[0]` in that path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5351153d-f81a-45a3-8d2b-5c0fc9e4b503",
      "id": "CVE-2022-50159",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: check previous kernel's ima-kexec-buffer against memory bounds\n\nPresently ima_get_kexec_buffer() doesn't check if the previous kernel's\nima-kexec-buffer lies outside the addressable memory range. This can result\nin a kernel panic if the new kernel is booted with 'mem=X' arg and the\nima-kexec-buffer was allocated beyond that range by the previous kernel.\nThe panic is usually of the form below:\n\n$ sudo kexec --initrd initrd vmlinux --append='mem=16G'\n\n\u003csnip\u003e\n BUG: Unable to handle kernel data access on read at 0xc000c01fff7f0000\n Faulting instruction address: 0xc000000000837974\n Oops: Kernel access of bad area, sig: 11 [#1]\n\u003csnip\u003e\n NIP [c000000000837974] ima_restore_measurement_list+0x94/0x6c0\n LR [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160\n Call Trace:\n [c00000000371fa80] [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160\n [c00000000371fb00] [c0000000020512c4] ima_init+0x80/0x108\n [c00000000371fb70] [c0000000020514dc] init_ima+0x4c/0x120\n [c00000000371fbf0] [c000000000012240] do_one_initcall+0x60/0x2c0\n [c00000000371fcc0] [c000000002004ad0] kernel_init_freeable+0x344/0x3ec\n [c00000000371fda0] [c0000000000128a4] kernel_init+0x34/0x1b0\n [c00000000371fe10] [c00000000000ce64] ret_from_kernel_thread+0x5c/0x64\n Instruction dump:\n f92100b8 f92100c0 90e10090 910100a0 4182050c 282a0017 3bc00000 40810330\n 7c0802a6 fb610198 7c9b2378 f80101d0 \u003ca1240000\u003e 2c090001 40820614 e9240010\n ---[ end trace 0000000000000000 ]---\n\nFix this issue by checking returned PFN range of previous kernel's\nima-kexec-buffer with page_is_ram() to ensure correct memory bounds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d0968ca-848e-4ef5-a67c-c7235feaa584",
      "id": "CVE-2022-50176",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mcde: Fix refcount leak in mcde_dsi_bind\n\nEvery iteration of for_each_available_child_of_node() decrements\nthe reference counter of the previous node. There is no decrement\nwhen break out from the loop and results in refcount leak.\nAdd missing of_node_put() to fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bef4e7ec-b3ea-4981-bcda-d6a48fec04a9",
      "id": "CVE-2022-50226",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak\n\nFor some sev ioctl interfaces, input may be passed that is less than or\nequal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP\nfirmware returns. In this case, kmalloc will allocate memory that is the\nsize of the input rather than the size of the data. Since PSP firmware\ndoesn't fully overwrite the buffer, the sev ioctl interfaces with the\nissue may return uninitialized slab memory.\n\nCurrently, all of the ioctl interfaces in the ccp driver are safe, but\nto prevent future problems, change all ioctl interfaces that allocate\nmemory with kmalloc to use kzalloc and memset the data buffer to zero\nin sev_ioctl_do_platform_status.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a6e24ba-73dc-47e2-9e84-bcb8c20911d0",
      "id": "CVE-2023-52640",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix oob in ntfs_listxattr\n\nThe length of name cannot exceed the space occupied by ea.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f91a38a-bad9-46c4-8696-2bce5abb4dbd",
      "id": "CVE-2022-50268",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: moxart: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ac5446a-1ea9-4ce6-8eec-0e04e44f1f8e",
      "id": "CVE-2022-50280",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npnode: terminate at peers of source\n\nThe propagate_mnt() function handles mount propagation when creating\nmounts and propagates the source mount tree @source_mnt to all\napplicable nodes of the destination propagation mount tree headed by\n@dest_mnt.\n\nUnfortunately it contains a bug where it fails to terminate at peers of\n@source_mnt when looking up copies of the source mount that become\nmasters for copies of the source mount tree mounted on top of slaves in\nthe destination propagation tree causing a NULL dereference.\n\nOnce the mechanics of the bug are understood it's easy to trigger.\nBecause of unprivileged user namespaces it is available to unprivileged\nusers.\n\nWhile fixing this bug we've gotten confused multiple times due to\nunclear terminology or missing concepts. So let's start this with some\nclarifications:\n\n* The terms \"master\" or \"peer\" denote a shared mount. A shared mount\n  belongs to a peer group.\n\n* A peer group is a set of shared mounts that propagate to each other.\n  They are identified by a peer group id. The peer group id is available\n  in @shared_mnt-\u003emnt_group_id.\n  Shared mounts within the same peer group have the same peer group id.\n  The peers in a peer group can be reached via @shared_mnt-\u003emnt_share.\n\n* The terms \"slave mount\" or \"dependent mount\" denote a mount that\n  receives propagation from a peer in a peer group. IOW, shared mounts\n  may have slave mounts and slave mounts have shared mounts as their\n  master. Slave mounts of a given peer in a peer group are listed on\n  that peers slave list available at @shared_mnt-\u003emnt_slave_list.\n\n* The term \"master mount\" denotes a mount in a peer group. IOW, it\n  denotes a shared mount or a peer mount in a peer group. The term\n  \"master mount\" - or \"master\" for short - is mostly used when talking\n  in the context of slave mounts that receive propagation from a master\n  mount. A master mount of a slave identifies the closest peer group a\n  slave mount receives propagation from. The master mount of a slave can\n  be identified via @slave_mount-\u003emnt_master. Different slaves may point\n  to different masters in the same peer group.\n\n* Multiple peers in a peer group can have non-empty -\u003emnt_slave_lists.\n  Non-empty -\u003emnt_slave_lists of peers don't intersect. Consequently, to\n  ensure all slave mounts of a peer group are visited the\n  -\u003emnt_slave_lists of all peers in a peer group have to be walked.\n\n* Slave mounts point to a peer in the closest peer group they receive\n  propagation from via @slave_mnt-\u003emnt_master (see above). Together with\n  these peers they form a propagation group (see below). The closest\n  peer group can thus be identified through the peer group id\n  @slave_mnt-\u003emnt_master-\u003emnt_group_id of the peer/master that a slave\n  mount receives propagation from.\n\n* A shared-slave mount is a slave mount to a peer group pg1 while also\n  a peer in another peer group pg2. IOW, a peer group may receive\n  propagation from another peer group.\n\n  If a peer group pg1 is a slave to another peer group pg2 then all\n  peers in peer group pg1 point to the same peer in peer group pg2 via\n  -\u003emnt_master. IOW, all peers in peer group pg1 appear on the same\n  -\u003emnt_slave_list. IOW, they cannot be slaves to different peer groups.\n\n* A pure slave mount is a slave mount that is a slave to a peer group\n  but is not a peer in another peer group.\n\n* A propagation group denotes the set of mounts consisting of a single\n  peer group pg1 and all slave mounts and shared-slave mounts that point\n  to a peer in that peer group via -\u003emnt_master. IOW, all slave mounts\n  such that @slave_mnt-\u003emnt_master-\u003emnt_group_id is equal to\n  @shared_mnt-\u003emnt_group_id.\n\n  The concept of a propagation group makes it easier to talk about a\n  single propagation level in a propagation tree.\n\n  For example, in propagate_mnt() the immediate peers of @dest_mnt and\n  all slaves of @dest_mnt's peer group form a propagation group pr\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a32eeeec-e499-43d4-8b77-dc594cbe41f8",
      "id": "CVE-2022-50285",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm,hugetlb: take hugetlb_lock before decrementing h-\u003eresv_huge_pages\n\nThe h-\u003e*_huge_pages counters are protected by the hugetlb_lock, but\nalloc_huge_page has a corner case where it can decrement the counter\noutside of the lock.\n\nThis could lead to a corrupted value of h-\u003eresv_huge_pages, which we have\nobserved on our systems.\n\nTake the hugetlb_lock before decrementing h-\u003eresv_huge_pages to avoid a\npotential race.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14122ebc-1e1b-4e49-82ba-1423d021379e",
      "id": "CVE-2022-50401",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure\n\nOn error situation `clp-\u003ecl_cb_conn.cb_xprt` should not be given\na reference to the xprt otherwise both client cleanup and the\nerror handling path of the caller call to put it. Better to\ndelay handing over the reference to a later branch.\n\n[   72.530665] refcount_t: underflow; use-after-free.\n[   72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120\n[   72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc]\n[   72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G           OE     5.15.82-dan #1\n[   72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014\n[   72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd]\n[   72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120\n[   72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 \u003c0f\u003e 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48\n[   72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286\n[   72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000\n[   72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0\n[   72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff\n[   72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180\n[   72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0\n[   72.552089] FS:  0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000\n[   72.553175] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0\n[   72.554874] Call Trace:\n[   72.555278]  \u003cTASK\u003e\n[   72.555614]  svc_xprt_put+0xaf/0xe0 [sunrpc]\n[   72.556276]  nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd]\n[   72.557087]  ? update_load_avg+0x82/0x610\n[   72.557652]  ? cpuacct_charge+0x60/0x70\n[   72.558212]  ? dequeue_entity+0xdb/0x3e0\n[   72.558765]  ? queued_spin_unlock+0x9/0x20\n[   72.559358]  nfsd4_run_cb_work+0xfc/0x270 [nfsd]\n[   72.560031]  process_one_work+0x1df/0x390\n[   72.560600]  worker_thread+0x37/0x3b0\n[   72.561644]  ? process_one_work+0x390/0x390\n[   72.562247]  kthread+0x12f/0x150\n[   72.562710]  ? set_kthread_struct+0x50/0x50\n[   72.563309]  ret_from_fork+0x22/0x30\n[   72.563818]  \u003c/TASK\u003e\n[   72.564189] ---[ end trace 031117b1c72ec616 ]---\n[   72.566019] list_add corruption. next-\u003eprev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018).\n[   72.567647] ------------[ cut here ]------------",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0671e6a-5401-47f7-9f8a-858526d8b09e",
      "id": "CVE-2022-50409",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory\n\nFixes the below NULL pointer dereference:\n\n  [...]\n  [   14.471200] Call Trace:\n  [   14.471562]  \u003cTASK\u003e\n  [   14.471882]  lock_acquire+0x245/0x2e0\n  [   14.472416]  ? remove_wait_queue+0x12/0x50\n  [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50\n  [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50\n  [   14.474318]  ? remove_wait_queue+0x12/0x50\n  [   14.474907]  remove_wait_queue+0x12/0x50\n  [   14.475480]  sk_stream_wait_memory+0x20d/0x340\n  [   14.476127]  ? do_wait_intr_irq+0x80/0x80\n  [   14.476704]  do_tcp_sendpages+0x287/0x600\n  [   14.477283]  tcp_bpf_push+0xab/0x260\n  [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500\n  [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0\n  [   14.479096]  tcp_bpf_send_verdict+0x105/0x470\n  [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0\n  [   14.480311]  sock_sendmsg+0x2d/0x40\n  [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0\n  [   14.481390]  ? copy_msghdr_from_user+0x62/0x80\n  [   14.482048]  ___sys_sendmsg+0x78/0xb0\n  [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150\n  [   14.483215]  ? __do_fault+0x2a/0x1a0\n  [   14.483738]  ? do_fault+0x15e/0x5d0\n  [   14.484246]  ? __handle_mm_fault+0x56b/0x1040\n  [   14.484874]  ? lock_is_held_type+0xdf/0x130\n  [   14.485474]  ? find_held_lock+0x2d/0x90\n  [   14.486046]  ? __sys_sendmsg+0x41/0x70\n  [   14.486587]  __sys_sendmsg+0x41/0x70\n  [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350\n  [   14.487822]  do_syscall_64+0x34/0x80\n  [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  [...]\n\nThe test scenario has the following flow:\n\nthread1                               thread2\n-----------                           ---------------\n tcp_bpf_sendmsg\n  tcp_bpf_send_verdict\n   tcp_bpf_sendmsg_redir              sock_close\n    tcp_bpf_push_locked                 __sock_release\n     tcp_bpf_push                         //inet_release\n      do_tcp_sendpages                    sock-\u003eops-\u003erelease\n       sk_stream_wait_memory          \t   // tcp_close\n          sk_wait_event                      sk-\u003esk_prot-\u003eclose\n           release_sock(__sk);\n            ***\n                                                lock_sock(sk);\n                                                  __tcp_close\n                                                    sock_orphan(sk)\n                                                      sk-\u003esk_wq  = NULL\n                                                release_sock\n            ****\n           lock_sock(__sk);\n          remove_wait_queue(sk_sleep(sk), \u0026wait);\n             sk_sleep(sk)\n             //NULL pointer dereference\n             \u0026rcu_dereference_raw(sk-\u003esk_wq)-\u003ewait\n\nWhile waiting for memory in thread1, the socket is released with its wait\nqueue because thread2 has closed it. This caused by tcp_bpf_send_verdict\ndidn't increase the f_count of psock-\u003esk_redir-\u003esk_socket-\u003efile in thread1.\n\nWe should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory\nbefore accessing the wait queue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b6ea7ca6-cd7d-4bf1-ba32-6ef11554d97b",
      "id": "CVE-2023-23002",
      "description": "In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b26c1dd5-7c4d-4e53-aed4-6bd93c92a7d7",
      "id": "CVE-2023-2513",
      "description": "A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "73ffff2c-e759-491e-84f2-c8f5ae7358f7",
      "id": "CVE-2023-30456",
      "description": "An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c663f067-8b20-4387-8073-4a24e9572e42",
      "id": "CVE-2023-35001",
      "description": "Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b2bb104-c748-45c0-89ea-8d5198487d7c",
      "id": "CVE-2023-37454",
      "description": "An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a8396ca-5f68-4acc-a03d-088e5816c50f",
      "id": "CVE-2023-52443",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: avoid crash when parsed profile name is empty\n\nWhen processing a packed profile in unpack_profile() described like\n\n \"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}\"\n\na string \":samba-dcerpcd\" is unpacked as a fully-qualified name and then\npassed to aa_splitn_fqname().\n\naa_splitn_fqname() treats \":samba-dcerpcd\" as only containing a namespace.\nThus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later\naa_alloc_profile() crashes as the new profile name is NULL now.\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\nRIP: 0010:strlen+0x1e/0xa0\nCall Trace:\n \u003cTASK\u003e\n ? strlen+0x1e/0xa0\n aa_policy_init+0x1bb/0x230\n aa_alloc_profile+0xb1/0x480\n unpack_profile+0x3bc/0x4960\n aa_unpack+0x309/0x15e0\n aa_replace_profiles+0x213/0x33c0\n policy_update+0x261/0x370\n profile_replace+0x20e/0x2a0\n vfs_write+0x2af/0xe00\n ksys_write+0x126/0x250\n do_syscall_64+0x46/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n \u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---\nRIP: 0010:strlen+0x1e/0xa0\n\nIt seems such behaviour of aa_splitn_fqname() is expected and checked in\nother places where it is called (e.g. aa_remove_profiles). Well, there\nis an explicit comment \"a ns name without a following profile is allowed\"\ninside.\n\nAFAICS, nothing can prevent unpacked \"name\" to be in form like\n\":samba-dcerpcd\" - it is passed from userspace.\n\nDeny the whole profile set replacement in such case and inform user with\nEPROTO and an explaining message.\n\nFound by Linux Verification Center (linuxtesting.org).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49d3cf88-9fb1-4eb1-a320-e3952225dd52",
      "id": "CVE-2023-52595",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00: restart beacon queue when hardware reset\n\nWhen a hardware reset is triggered, all registers are reset, so all\nqueues are forced to stop in hardware interface. However, mac80211\nwill not automatically stop the queue. If we don't manually stop the\nbeacon queue, the queue will be deadlocked and unable to start again.\nThis patch fixes the issue where Apple devices cannot connect to the\nAP after calling ieee80211_restart_hw().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c29504f9-bbe8-42e2-a742-52ed54de7f1e",
      "id": "CVE-2023-52602",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix slab-out-of-bounds Read in dtSearch\n\nCurrently while searching for current page in the sorted entry table\nof the page there is a out of bound access. Added a bound check to fix\nthe error.\n\nDave:\nSet return code to -EIO",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d0cbab76-b620-4e18-9bc0-82373484cf43",
      "id": "CVE-2023-52622",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid online resizing failures due to oversized flex bg\n\nWhen we online resize an ext4 filesystem with a oversized flexbg_size,\n\n     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M\n     mount $dev $dir\n     resize2fs $dev 16G\n\nthe following WARN_ON is triggered:\n==================================================================\nWARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550\nModules linked in: sg(E)\nCPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314\nRIP: 0010:__alloc_pages+0x411/0x550\nCall Trace:\n \u003cTASK\u003e\n __kmalloc_large_node+0xa2/0x200\n __kmalloc+0x16e/0x290\n ext4_resize_fs+0x481/0xd80\n __ext4_ioctl+0x1616/0x1d90\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0xf0/0x150\n do_syscall_64+0x3b/0x90\n==================================================================\n\nThis is because flexbg_size is too large and the size of the new_group_data\narray to be allocated exceeds MAX_ORDER. Currently, the minimum value of\nMAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding\nmaximum number of groups that can be allocated is:\n\n (PAGE_SIZE \u003c\u003c MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845\n\nAnd the value that is down-aligned to the power of 2 is 16384. Therefore,\nthis value is defined as MAX_RESIZE_BG, and the number of groups added\neach time does not exceed this value during resizing, and is added multiple\ntimes to complete the online resizing. The difference is that the metadata\nin a flex_bg may be more dispersed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "913a8b09-a7a0-458d-b763-872340028cd0",
      "id": "CVE-2023-52656",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: drop any code related to SCM_RIGHTS\n\nThis is dead code after we dropped support for passing io_uring fds\nover SCM_RIGHTS, get rid of it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c91de462-eb1f-40af-8a0c-d33bc9787051",
      "id": "CVE-2023-52761",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: VMAP_STACK overflow detection thread-safe\n\ncommit 31da94c25aea (\"riscv: add VMAP_STACK overflow detection\") added\nsupport for CONFIG_VMAP_STACK. If overflow is detected, CPU switches to\n`shadow_stack` temporarily before switching finally to per-cpu\n`overflow_stack`.\n\nIf two CPUs/harts are racing and end up in over flowing kernel stack, one\nor both will end up corrupting each other state because `shadow_stack` is\nnot per-cpu. This patch optimizes per-cpu overflow stack switch by\ndirectly picking per-cpu `overflow_stack` and gets rid of `shadow_stack`.\n\nFollowing are the changes in this patch\n\n - Defines an asm macro to obtain per-cpu symbols in destination\n   register.\n - In entry.S, when overflow is detected, per-cpu overflow stack is\n   located using per-cpu asm macro. Computing per-cpu symbol requires\n   a temporary register. x31 is saved away into CSR_SCRATCH\n   (CSR_SCRATCH is anyways zero since we're in kernel).\n\nPlease see Links for additional relevant disccussion and alternative\nsolution.\n\nTested by `echo EXHAUST_STACK \u003e /sys/kernel/debug/provoke-crash/DIRECT`\nKernel crash log below\n\n Insufficient stack space to handle exception!/debug/provoke-crash/DIRECT\n Task stack:     [0xff20000010a98000..0xff20000010a9c000]\n Overflow stack: [0xff600001f7d98370..0xff600001f7d99370]\n CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34\n Hardware name: riscv-virtio,qemu (DT)\n epc : __memset+0x60/0xfc\n  ra : recursive_loop+0x48/0xc6 [lkdtm]\n epc : ffffffff808de0e4 ra : ffffffff0163a752 sp : ff20000010a97e80\n  gp : ffffffff815c0330 tp : ff600000820ea280 t0 : ff20000010a97e88\n  t1 : 000000000000002e t2 : 3233206874706564 s0 : ff20000010a982b0\n  s1 : 0000000000000012 a0 : ff20000010a97e88 a1 : 0000000000000000\n  a2 : 0000000000000400 a3 : ff20000010a98288 a4 : 0000000000000000\n  a5 : 0000000000000000 a6 : fffffffffffe43f0 a7 : 00007fffffffffff\n  s2 : ff20000010a97e88 s3 : ffffffff01644680 s4 : ff20000010a9be90\n  s5 : ff600000842ba6c0 s6 : 00aaaaaac29e42b0 s7 : 00fffffff0aa3684\n  s8 : 00aaaaaac2978040 s9 : 0000000000000065 s10: 00ffffff8a7cad10\n  s11: 00ffffff8a76a4e0 t3 : ffffffff815dbaf4 t4 : ffffffff815dbaf4\n  t5 : ffffffff815dbab8 t6 : ff20000010a9bb48\n status: 0000000200000120 badaddr: ff20000010a97e88 cause: 000000000000000f\n Kernel panic - not syncing: Kernel stack overflow\n CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34\n Hardware name: riscv-virtio,qemu (DT)\n Call Trace:\n [\u003cffffffff80006754\u003e] dump_backtrace+0x30/0x38\n [\u003cffffffff808de798\u003e] show_stack+0x40/0x4c\n [\u003cffffffff808ea2a8\u003e] dump_stack_lvl+0x44/0x5c\n [\u003cffffffff808ea2d8\u003e] dump_stack+0x18/0x20\n [\u003cffffffff808dec06\u003e] panic+0x126/0x2fe\n [\u003cffffffff800065ea\u003e] walk_stackframe+0x0/0xf0\n [\u003cffffffff0163a752\u003e] recursive_loop+0x48/0xc6 [lkdtm]\n SMP: stopping secondary CPUs\n ---[ end Kernel panic - not syncing: Kernel stack overflow ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5c517514-447e-49c2-bf10-53bd512e9214",
      "id": "CVE-2023-52781",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: config: fix iteration issue in 'usb_get_bos_descriptor()'\n\nThe BOS descriptor defines a root descriptor and is the base descriptor for\naccessing a family of related descriptors.\n\nFunction 'usb_get_bos_descriptor()' encounters an iteration issue when\nskipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in\nthe same descriptor being read repeatedly.\n\nTo address this issue, a 'goto' statement is introduced to ensure that the\npointer and the amount read is updated correctly. This ensures that the\nfunction iterates to the next descriptor instead of reading the same\ndescriptor repeatedly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0236883f-7d46-4eb7-a125-1ad153342f56",
      "id": "CVE-2023-52817",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL\n\nIn certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:\n\n1. Navigate to the directory: /sys/kernel/debug/dri/0\n2. Execute command: cat amdgpu_regs_smc\n3. Exception Log::\n[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[4005007.702562] #PF: supervisor instruction fetch in kernel mode\n[4005007.702567] #PF: error_code(0x0010) - not-present page\n[4005007.702570] PGD 0 P4D 0\n[4005007.702576] Oops: 0010 [#1] SMP NOPTI\n[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G           OE     5.15.0-43-generic #46-Ubunt       u\n[4005007.702590] RIP: 0010:0x0\n[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.\n[4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206\n[4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68\n[4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000\n[4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980\n[4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000\n[4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000\n[4005007.702622] FS:  00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000\n[4005007.702626] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0\n[4005007.702633] Call Trace:\n[4005007.702636]  \u003cTASK\u003e\n[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]\n[4005007.703002]  full_proxy_read+0x5c/0x80\n[4005007.703011]  vfs_read+0x9f/0x1a0\n[4005007.703019]  ksys_read+0x67/0xe0\n[4005007.703023]  __x64_sys_read+0x19/0x20\n[4005007.703028]  do_syscall_64+0x5c/0xc0\n[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670\n[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0\n[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20\n[4005007.703052]  ? irqentry_exit+0x19/0x30\n[4005007.703057]  ? exc_page_fault+0x89/0x160\n[4005007.703062]  ? asm_exc_page_fault+0x8/0x30\n[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[4005007.703075] RIP: 0033:0x7f5e07672992\n[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f        1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e       c 28 48 89 54 24\n[4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992\n[4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003\n[4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010\n[4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000\n[4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000\n[4005007.703105]  \u003c/TASK\u003e\n[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_       iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t       tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm       i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo       mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v       2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core        drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca\n[4005007.703184] CR2: 0000000000000000\n[4005007.703188] ---[ en\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "71c996ab-4c25-4242-a004-d843a777ffa5",
      "id": "CVE-2023-52864",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: wmi: Fix opening of char device\n\nSince commit fa1f68db6ca7 (\"drivers: misc: pass miscdevice pointer via\nfile private data\"), the miscdevice stores a pointer to itself inside\nfilp-\u003eprivate_data, which means that private_data will not be NULL when\nwmi_char_open() is called. This might cause memory corruption should\nwmi_char_open() be unable to find its driver, something which can\nhappen when the associated WMI device is deleted in wmi_free_devices().\n\nFix the problem by using the miscdevice pointer to retrieve the WMI\ndevice data associated with a char device using container_of(). This\nalso avoids wmi_char_open() picking a wrong WMI device bound to a\ndriver with the same name as the original driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eec66290-96ae-4d76-8e55-16ddd4b45403",
      "id": "CVE-2023-52976",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: fix potential NULL deref in efi_mem_reserve_persistent\n\nWhen iterating on a linked list, a result of memremap is dereferenced\nwithout checking it for NULL.\n\nThis patch adds a check that falls back on allocating a new page in\ncase memremap doesn't succeed.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n[ardb: return -ENOMEM instead of breaking out of the loop]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a6e3087a-a6e0-4473-ad59-46d61c8d378a",
      "id": "CVE-2023-53141",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()\n\nila_xlat_nl_cmd_get_mapping() generates an empty skb,\ntriggerring a recent sanity check [1].\n\nInstead, return an error code, so that user space\ncan get it.\n\n[1]\nskb_assert_len\nWARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 skb_assert_len include/linux/skbuff.h:2527 [inline]\nWARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156\nModules linked in:\nCPU: 0 PID: 5923 Comm: syz-executor269 Not tainted 6.2.0-syzkaller-18300-g2ebd1fbb946d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : skb_assert_len include/linux/skbuff.h:2527 [inline]\npc : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156\nlr : skb_assert_len include/linux/skbuff.h:2527 [inline]\nlr : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156\nsp : ffff80001e0d6c40\nx29: ffff80001e0d6e60 x28: dfff800000000000 x27: ffff0000c86328c0\nx26: dfff800000000000 x25: ffff0000c8632990 x24: ffff0000c8632a00\nx23: 0000000000000000 x22: 1fffe000190c6542 x21: ffff0000c8632a10\nx20: ffff0000c8632a00 x19: ffff80001856e000 x18: ffff80001e0d5fc0\nx17: 0000000000000000 x16: ffff80001235d16c x15: 0000000000000000\nx14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001\nx11: ff80800008353a30 x10: 0000000000000000 x9 : 21567eaf25bfb600\nx8 : 21567eaf25bfb600 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : ffff80001e0d6558 x4 : ffff800015c74760 x3 : ffff800008596744\nx2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000000e\nCall trace:\nskb_assert_len include/linux/skbuff.h:2527 [inline]\n__dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156\ndev_queue_xmit include/linux/netdevice.h:3033 [inline]\n__netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline]\n__netlink_deliver_tap+0x45c/0x6f8 net/netlink/af_netlink.c:325\nnetlink_deliver_tap+0xf4/0x174 net/netlink/af_netlink.c:338\n__netlink_sendskb net/netlink/af_netlink.c:1283 [inline]\nnetlink_sendskb+0x6c/0x154 net/netlink/af_netlink.c:1292\nnetlink_unicast+0x334/0x8d4 net/netlink/af_netlink.c:1380\nnlmsg_unicast include/net/netlink.h:1099 [inline]\ngenlmsg_unicast include/net/genetlink.h:433 [inline]\ngenlmsg_reply include/net/genetlink.h:443 [inline]\nila_xlat_nl_cmd_get_mapping+0x620/0x7d0 net/ipv6/ila/ila_xlat.c:493\ngenl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]\ngenl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]\ngenl_rcv_msg+0x938/0xc1c net/netlink/genetlink.c:1065\nnetlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2574\ngenl_rcv+0x38/0x50 net/netlink/genetlink.c:1076\nnetlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]\nnetlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365\nnetlink_sendmsg+0x800/0xae0 net/netlink/af_netlink.c:1942\nsock_sendmsg_nosec net/socket.c:714 [inline]\nsock_sendmsg net/socket.c:734 [inline]\n____sys_sendmsg+0x558/0x844 net/socket.c:2479\n___sys_sendmsg net/socket.c:2533 [inline]\n__sys_sendmsg+0x26c/0x33c net/socket.c:2562\n__do_sys_sendmsg net/socket.c:2571 [inline]\n__se_sys_sendmsg net/socket.c:2569 [inline]\n__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2569\n__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\ninvoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52\nel0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142\ndo_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193\nel0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637\nel0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655\nel0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591\nirq event stamp: 136484\nhardirqs last enabled at (136483): [\u003cffff800008350244\u003e] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345\nhardirqs last disabled at (136484): [\u003cffff800012358d60\u003e] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405\nsoftirqs last enabled at (136418): [\u003cffff800008020ea8\u003e] softirq_ha\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ce92a35-381d-4ea0-9aaa-8406a3d9160e",
      "id": "CVE-2023-53174",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix possible memory leak if device_add() fails\n\nIf device_add() returns error, the name allocated by dev_set_name() needs\nbe freed. As the comment of device_add() says, put_device() should be used\nto decrease the reference count in the error path. So fix this by calling\nput_device(), then the name can be freed in kobject_cleanp().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f675dfc-9b26-46c2-be08-3b14ef9e70cf",
      "id": "CVE-2023-53224",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: Fix function prototype mismatch for ext4_feat_ktype\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed.\n\next4_feat_ktype was setting the \"release\" handler to \"kfree\", which\ndoesn't have a matching function prototype. Add a simple wrapper\nwith the correct prototype.\n\nThis was found as a result of Clang's new -Wcast-function-type-strict\nflag, which is more sensitive than the simpler -Wcast-function-type,\nwhich only checks for type width mismatches.\n\nNote that this code is only reached when ext4 is a loadable module and\nit is being unloaded:\n\n CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)\n ...\n RIP: 0010:kobject_put+0xbb/0x1b0\n ...\n Call Trace:\n  \u003cTASK\u003e\n  ext4_exit_sysfs+0x14/0x60 [ext4]\n  cleanup_module+0x67/0xedb [ext4]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dd6465b-a088-4ddb-9464-3ec30681bc86",
      "id": "CVE-2023-53247",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand\n\nWhile trying to get the subpage blocksize tests running, I hit the\nfollowing panic on generic/476\n\n  assertion failed: PagePrivate(page) \u0026\u0026 page-\u003eprivate, in fs/btrfs/subpage.c:229\n  kernel BUG at fs/btrfs/subpage.c:229!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 1 PID: 1453 Comm: fsstress Not tainted 6.4.0-rc7+ #12\n  Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20230301gitf80f052277c8-26.fc38 03/01/2023\n  pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : btrfs_subpage_assert+0xbc/0xf0\n  lr : btrfs_subpage_assert+0xbc/0xf0\n  Call trace:\n   btrfs_subpage_assert+0xbc/0xf0\n   btrfs_subpage_clear_checked+0x38/0xc0\n   btrfs_page_clear_checked+0x48/0x98\n   btrfs_truncate_block+0x5d0/0x6a8\n   btrfs_cont_expand+0x5c/0x528\n   btrfs_write_check.isra.0+0xf8/0x150\n   btrfs_buffered_write+0xb4/0x760\n   btrfs_do_write_iter+0x2f8/0x4b0\n   btrfs_file_write_iter+0x1c/0x30\n   do_iter_readv_writev+0xc8/0x158\n   do_iter_write+0x9c/0x210\n   vfs_iter_write+0x24/0x40\n   iter_file_splice_write+0x224/0x390\n   direct_splice_actor+0x38/0x68\n   splice_direct_to_actor+0x12c/0x260\n   do_splice_direct+0x90/0xe8\n   generic_copy_file_range+0x50/0x90\n   vfs_copy_file_range+0x29c/0x470\n   __arm64_sys_copy_file_range+0xcc/0x498\n   invoke_syscall.constprop.0+0x80/0xd8\n   do_el0_svc+0x6c/0x168\n   el0_svc+0x50/0x1b0\n   el0t_64_sync_handler+0x114/0x120\n   el0t_64_sync+0x194/0x198\n\nThis happens because during btrfs_cont_expand we'll get a page, set it\nas mapped, and if it's not Uptodate we'll read it.  However between the\nread and re-locking the page we could have called release_folio() on the\npage, but left the page in the file mapping.  release_folio() can clear\nthe page private, and thus further down we blow up when we go to modify\nthe subpage bits.\n\nFix this by putting the set_page_extent_mapped() after the read.  This\nis safe because read_folio() will call set_page_extent_mapped() before\nit does the read, and then if we clear page private but leave it on the\nmapping we're completely safe re-setting set_page_extent_mapped().  With\nthis patch I can now run generic/476 without panicing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10dbc78a-cb25-4c29-bad9-dd7c9d444d86",
      "id": "CVE-2023-53277",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwl3945: Add missing check for create_singlethread_workqueue\n\nAdd the check for the return value of the create_singlethread_workqueue\nin order to avoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a7e5dea-2c22-420d-bb4d-07668294a12d",
      "id": "CVE-2023-53330",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncaif: fix memory leak in cfctrl_linkup_request()\n\nWhen linktype is unknown or kzalloc failed in cfctrl_linkup_request(),\npkt is not released. Add release process to error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27723a55-a189-44c5-95cb-0e9bf63bd76f",
      "id": "CVE-2024-23850",
      "description": "In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f74b13bf-7a45-4d84-bb04-7313fbad860c",
      "id": "CVE-2022-28390",
      "description": "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bd05269-6b24-4c80-ac7c-8da02fef485a",
      "id": "CVE-2024-35806",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: fsl: qbman: Always disable interrupts when taking cgr_lock\n\nsmp_call_function_single disables IRQs when executing the callback. To\nprevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere.\nThis is already done by qman_update_cgr and qman_delete_cgr; fix the\nother lockers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de1d4815-9d31-47b5-9e92-127bccf77b03",
      "id": "CVE-2024-26697",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33bd1a28-7633-486e-9d74-87cfcc54996f",
      "id": "CVE-2024-26748",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix memory double free when handle zero packet\n\n829  if (request-\u003ecomplete) {\n830          spin_unlock(\u0026priv_dev-\u003elock);\n831          usb_gadget_giveback_request(\u0026priv_ep-\u003eendpoint,\n832                                    request);\n833          spin_lock(\u0026priv_dev-\u003elock);\n834  }\n835\n836  if (request-\u003ebuf == priv_dev-\u003ezlp_buf)\n837      cdns3_gadget_ep_free_request(\u0026priv_ep-\u003eendpoint, request);\n\nDriver append an additional zero packet request when queue a packet, which\nlength mod max packet size is 0. When transfer complete, run to line 831,\nusb_gadget_giveback_request() will free this requestion. 836 condition is\ntrue, so cdns3_gadget_ep_free_request() free this request again.\n\nLog:\n\n[ 1920.140696][  T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.140696][  T150]\n[ 1920.151837][  T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36):\n[ 1920.159082][  T150]  cdns3_gadget_giveback+0x134/0x2c0 [cdns3]\n[ 1920.164988][  T150]  cdns3_transfer_completed+0x438/0x5f8 [cdns3]\n\nAdd check at line 829, skip call usb_gadget_giveback_request() if it is\nadditional zero length packet request. Needn't call\nusb_gadget_giveback_request() because it is allocated in this driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0caad2bd-fb9f-4f4a-98e5-3d4a9fd073c9",
      "id": "CVE-2024-26767",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fixed integer types and null check locations\n\n[why]:\nissues fixed:\n- comparison with wider integer type in loop condition which can cause\ninfinite loops\n- pointer dereference before null check",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e678807-b08c-43de-9471-ece2c60d2815",
      "id": "CVE-2024-26872",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Do not register event handler until srpt device is fully setup\n\nUpon rare occasions, KASAN reports a use-after-free Write\nin srpt_refresh_port().\n\nThis seems to be because an event handler is registered before the\nsrpt device is fully setup and a race condition upon error may leave a\npartially setup event handler in place.\n\nInstead, only register the event handler after srpt device initialization\nis complete.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cfd1969-b94a-4687-830e-a9194d296baf",
      "id": "CVE-2024-26958",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix UAF in direct writes\n\nIn production we have been hitting the following warning consistently\n\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0\nWorkqueue: nfsiod nfs_direct_write_schedule_work [nfs]\nRIP: 0010:refcount_warn_saturate+0x9c/0xe0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? __warn+0x9f/0x130\n ? refcount_warn_saturate+0x9c/0xe0\n ? report_bug+0xcc/0x150\n ? handle_bug+0x3d/0x70\n ? exc_invalid_op+0x16/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? refcount_warn_saturate+0x9c/0xe0\n nfs_direct_write_schedule_work+0x237/0x250 [nfs]\n process_one_work+0x12f/0x4a0\n worker_thread+0x14e/0x3b0\n ? ZSTD_getCParams_internal+0x220/0x220\n kthread+0xdc/0x120\n ? __btf_name_valid+0xa0/0xa0\n ret_from_fork+0x1f/0x30\n\nThis is because we're completing the nfs_direct_request twice in a row.\n\nThe source of this is when we have our commit requests to submit, we\nprocess them and send them off, and then in the completion path for the\ncommit requests we have\n\nif (nfs_commit_end(cinfo.mds))\n\tnfs_direct_write_complete(dreq);\n\nHowever since we're submitting asynchronous requests we sometimes have\none that completes before we submit the next one, so we end up calling\ncomplete on the nfs_direct_request twice.\n\nThe only other place we use nfs_generic_commit_list() is in\n__nfs_commit_inode, which wraps this call in a\n\nnfs_commit_begin();\nnfs_commit_end();\n\nWhich is a common pattern for this style of completion handling, one\nthat is also repeated in the direct code with get_dreq()/put_dreq()\ncalls around where we process events as well as in the completion paths.\n\nFix this by using the same pattern for the commit requests.\n\nBefore with my 200 node rocksdb stress running this warning would pop\nevery 10ish minutes.  With my patch the stress test has been running for\nseveral hours without popping.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d1bcc285-6383-4d0d-b95d-b5e664ca2f55",
      "id": "CVE-2024-27020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()\n\nnft_unregister_expr() can concurrent with __nft_expr_type_get(),\nand there is not any protection when iterate over nf_tables_expressions\nlist in __nft_expr_type_get(). Therefore, there is potential data-race\nof nf_tables_expressions list entry.\n\nUse list_for_each_entry_rcu() to iterate over nf_tables_expressions\nlist in __nft_expr_type_get(), and use rcu_read_lock() in the caller\nnft_expr_type_get() to protect the entire type query process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9734a38e-473a-4961-95d7-418f4022dbad",
      "id": "CVE-2024-35925",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: prevent division by zero in blk_rq_stat_sum()\n\nThe expression dst-\u003enr_samples + src-\u003enr_samples may\nhave zero value on overflow. It is necessary to add\na check to avoid division by zero.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4a97451-7a2e-4129-8d90-49da71ff6b17",
      "id": "CVE-2024-36014",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/arm/malidp: fix a possible null pointer dereference\n\nIn malidp_mw_connector_reset, new memory is allocated with kzalloc, but\nno check is performed. In order to prevent null pointer dereferencing,\nensure that mw_state is checked before calling\n__drm_atomic_helper_connector_reset.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "706c0935-29eb-4e01-8b8a-f65a5828e1e1",
      "id": "CVE-2024-36922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq-\u003eread_ptr under lock\n\nIf we read txq-\u003eread_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq-\u003eread_ptr under lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "024f8142-b16c-4c78-9c95-492d78dc9824",
      "id": "CVE-2024-37078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\n\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\n\n kernel BUG at mm/page-writeback.c:3070!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n ...\n RIP: 0010:__folio_start_writeback+0xbaa/0x10e0\n Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\n  e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 \u003c0f\u003e\n  0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n ...\n Call Trace:\n  \u003cTASK\u003e\n  nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\n  nilfs_segctor_construct+0x181/0x6b0 [nilfs2]\n  nilfs_segctor_thread+0x548/0x11c0 [nilfs2]\n  kthread+0x2f0/0x390\n  ret_from_fork+0x4b/0x80\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device's page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\n\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2ac3f655-478b-4123-804c-4845963e9fce",
      "id": "CVE-2024-38578",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: Fix buffer size for tag 66 packet\n\nThe 'TAG 66 Packet Format' description is missing the cipher code and\nchecksum fields that are packed into the message packet. As a result,\nthe buffer allocated for the packet is 3 bytes too small and\nwrite_tag_66_packet() will write up to 3 bytes past the end of the\nbuffer.\n\nFix this by increasing the size of the allocation so the whole packet\nwill always fit in the buffer.\n\nThis fixes the below kasan slab-out-of-bounds bug:\n\n  BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0\n  Write of size 1 at addr ffff88800afbb2a5 by task touch/181\n\n  CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4c/0x70\n   print_report+0xc5/0x610\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   ? kasan_complete_mode_report_info+0x44/0x210\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   kasan_report+0xc2/0x110\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   __asan_store1+0x62/0x80\n   ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10\n   ? __alloc_pages+0x2e2/0x540\n   ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]\n   ? dentry_open+0x8f/0xd0\n   ecryptfs_write_metadata+0x30a/0x550\n   ? __pfx_ecryptfs_write_metadata+0x10/0x10\n   ? ecryptfs_get_lower_file+0x6b/0x190\n   ecryptfs_initialize_file+0x77/0x150\n   ecryptfs_create+0x1c2/0x2f0\n   path_openat+0x17cf/0x1ba0\n   ? __pfx_path_openat+0x10/0x10\n   do_filp_open+0x15e/0x290\n   ? __pfx_do_filp_open+0x10/0x10\n   ? __kasan_check_write+0x18/0x30\n   ? _raw_spin_lock+0x86/0xf0\n   ? __pfx__raw_spin_lock+0x10/0x10\n   ? __kasan_check_write+0x18/0x30\n   ? alloc_fd+0xf4/0x330\n   do_sys_openat2+0x122/0x160\n   ? __pfx_do_sys_openat2+0x10/0x10\n   __x64_sys_openat+0xef/0x170\n   ? __pfx___x64_sys_openat+0x10/0x10\n   do_syscall_64+0x60/0xd0\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n  RIP: 0033:0x7f00a703fd67\n  Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f\n  RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\n  RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67\n  RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c\n  RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000\n  R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941\n  R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040\n   \u003c/TASK\u003e\n\n  Allocated by task 181:\n   kasan_save_stack+0x2f/0x60\n   kasan_set_track+0x29/0x40\n   kasan_save_alloc_info+0x25/0x40\n   __kasan_kmalloc+0xc5/0xd0\n   __kmalloc+0x66/0x160\n   ecryptfs_generate_key_packet_set+0x6d2/0xde0\n   ecryptfs_write_metadata+0x30a/0x550\n   ecryptfs_initialize_file+0x77/0x150\n   ecryptfs_create+0x1c2/0x2f0\n   path_openat+0x17cf/0x1ba0\n   do_filp_open+0x15e/0x290\n   do_sys_openat2+0x122/0x160\n   __x64_sys_openat+0xef/0x170\n   do_syscall_64+0x60/0xd0\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d3118506-9305-41cf-ba00-0df1a2e4da9a",
      "id": "CVE-2024-38630",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger\n\nWhen the cpu5wdt module is removing, the origin code uses del_timer() to\nde-activate the timer. If the timer handler is running, del_timer() could\nnot stop it and will return directly. If the port region is released by\nrelease_region() and then the timer handler cpu5wdt_trigger() calls outb()\nto write into the region that is released, the use-after-free bug will\nhappen.\n\nChange del_timer() to timer_shutdown_sync() in order that the timer handler\ncould be finished before the port region is released.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "614959be-39a8-42bc-8c2a-753625dfacd7",
      "id": "CVE-2024-46753",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: handle errors from btrfs_dec_ref() properly\n\nIn walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is\nincorrect, we have proper error handling here, return the error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e413e4c0-c011-4556-af7e-f8f341174418",
      "id": "CVE-2024-46755",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\n\nmwifiex_get_priv_by_id() returns the priv pointer corresponding to\nthe bss_num and bss_type, but without checking if the priv is actually\ncurrently in use.\nUnused priv pointers do not have a wiphy attached to them which can\nlead to NULL pointer dereferences further down the callstack.  Fix\nthis by returning only used priv pointers which have priv-\u003ebss_mode\nset to something else than NL80211_IFTYPE_UNSPECIFIED.\n\nSaid NULL pointer dereference happened when an Accesspoint was started\nwith wpa_supplicant -i mlan0 with this config:\n\nnetwork={\n        ssid=\"somessid\"\n        mode=2\n        frequency=2412\n        key_mgmt=WPA-PSK WPA-PSK-SHA256\n        proto=RSN\n        group=CCMP\n        pairwise=CCMP\n        psk=\"12345678\"\n}\n\nWhen waiting for the AP to be established, interrupting wpa_supplicant\nwith \u003cctrl-c\u003e and starting it again this happens:\n\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140\n| Mem abort info:\n|   ESR = 0x0000000096000004\n|   EC = 0x25: DABT (current EL), IL = 32 bits\n|   SET = 0, FnV = 0\n|   EA = 0, S1PTW = 0\n|   FSC = 0x04: level 0 translation fault\n| Data abort info:\n|   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n|   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n|   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000\n| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000\n| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio\n+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs\n+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6\n| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18\n| Hardware name: somemachine (DT)\n| Workqueue: events sdio_irq_work\n| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]\n| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]\n| sp : ffff8000818b3a70\n| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004\n| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9\n| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000\n| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000\n| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517\n| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1\n| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157\n| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124\n| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000\n| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000\n| Call trace:\n|  mwifiex_get_cfp+0xd8/0x15c [mwifiex]\n|  mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]\n|  mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]\n|  mwifiex_process_sta_event+0x298/0xf0c [mwifiex]\n|  mwifiex_process_event+0x110/0x238 [mwifiex]\n|  mwifiex_main_process+0x428/0xa44 [mwifiex]\n|  mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]\n|  process_sdio_pending_irqs+0x64/0x1b8\n|  sdio_irq_work+0x4c/0x7c\n|  process_one_work+0x148/0x2a0\n|  worker_thread+0x2fc/0x40c\n|  kthread+0x110/0x114\n|  ret_from_fork+0x10/0x20\n| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)\n| ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac4343c9-8cd2-439f-9f66-1d905f9b1fb2",
      "id": "CVE-2024-41062",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n           CPU0                       CPU1\n           ----                       ----\n           sock_close                 hci_rx_work\n\t   l2cap_sock_release         hci_acldata_packet\n\t   l2cap_sock_kill            l2cap_recv_frame\n\t   sk_free                    l2cap_conless_channel\n\t                              l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "534da04d-7bd0-4d18-acd1-fdc1d9a13093",
      "id": "CVE-2024-43912",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: disallow setting special AP channel widths\n\nSetting the AP channel width is meant for use with the normal\n20/40/... MHz channel width progression, and switching around\nin S1G or narrow channels isn't supported. Disallow that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea809652-ccc0-42a3-9421-b3aacbc2a7a3",
      "id": "CVE-2024-44960",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: core: Check for unset descriptor\n\nMake sure the descriptor has been set before looking at maxpacket.\nThis fixes a null pointer panic in this case.\n\nThis may happen if the gadget doesn't properly set up the endpoint\nfor the current speed, or the gadget descriptors are malformed and\nthe descriptor for the speed/endpoint are not found.\n\nNo current gadget driver is known to have this problem, but this\nmay cause a hard-to-find bug during development of new gadgets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2dbfa5d-35e5-47cf-9435-47b81d192437",
      "id": "CVE-2024-45021",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg_write_event_control(): fix a user-triggerable oops\n\nwe are *not* guaranteed that anything past the terminating NUL\nis mapped (let alone initialized with anything sane).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e947d3a1-895f-46c3-8ee5-af4c37ff1c3f",
      "id": "CVE-2024-46763",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: Fix null-ptr-deref in GRO.\n\nWe observed a null-ptr-deref in fou_gro_receive() while shutting down\na host.  [0]\n\nThe NULL pointer is sk-\u003esk_user_data, and the offset 8 is of protocol\nin struct fou.\n\nWhen fou_release() is called due to netns dismantle or explicit tunnel\nteardown, udp_tunnel_sock_release() sets NULL to sk-\u003esk_user_data.\nThen, the tunnel socket is destroyed after a single RCU grace period.\n\nSo, in-flight udp4_gro_receive() could find the socket and execute the\nFOU GRO handler, where sk-\u003esk_user_data could be NULL.\n\nLet's use rcu_dereference_sk_user_data() in fou_from_sock() and add NULL\nchecks in FOU GRO handlers.\n\n[0]:\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\nPGD 80000001032f4067 P4D 80000001032f4067 PUD 103240067 PMD 0\nSMP PTI\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.216-204.855.amzn2.x86_64 #1\nHardware name: Amazon EC2 c5.large/, BIOS 1.0 10/16/2017\nRIP: 0010:fou_gro_receive (net/ipv4/fou.c:233) [fou]\nCode: 41 5f c3 cc cc cc cc e8 e7 2e 69 f4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 49 89 f8 41 54 48 89 f7 48 89 d6 49 8b 80 88 02 00 00 \u003c0f\u003e b6 48 08 0f b7 42 4a 66 25 fd fd 80 cc 02 66 89 42 4a 0f b6 42\nRSP: 0018:ffffa330c0003d08 EFLAGS: 00010297\nRAX: 0000000000000000 RBX: ffff93d9e3a6b900 RCX: 0000000000000010\nRDX: ffff93d9e3a6b900 RSI: ffff93d9e3a6b900 RDI: ffff93dac2e24d08\nRBP: ffff93d9e3a6b900 R08: ffff93dacbce6400 R09: 0000000000000002\nR10: 0000000000000000 R11: ffffffffb5f369b0 R12: ffff93dacbce6400\nR13: ffff93dac2e24d08 R14: 0000000000000000 R15: ffffffffb4edd1c0\nFS:  0000000000000000(0000) GS:ffff93daee800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000008 CR3: 0000000102140001 CR4: 00000000007706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? show_trace_log_lvl (arch/x86/kernel/dumpstack.c:259)\n ? __die_body.cold (arch/x86/kernel/dumpstack.c:478 arch/x86/kernel/dumpstack.c:420)\n ? no_context (arch/x86/mm/fault.c:752)\n ? exc_page_fault (arch/x86/include/asm/irqflags.h:49 arch/x86/include/asm/irqflags.h:89 arch/x86/mm/fault.c:1435 arch/x86/mm/fault.c:1483)\n ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:571)\n ? fou_gro_receive (net/ipv4/fou.c:233) [fou]\n udp_gro_receive (include/linux/netdevice.h:2552 net/ipv4/udp_offload.c:559)\n udp4_gro_receive (net/ipv4/udp_offload.c:604)\n inet_gro_receive (net/ipv4/af_inet.c:1549 (discriminator 7))\n dev_gro_receive (net/core/dev.c:6035 (discriminator 4))\n napi_gro_receive (net/core/dev.c:6170)\n ena_clean_rx_irq (drivers/amazon/net/ena/ena_netdev.c:1558) [ena]\n ena_io_poll (drivers/amazon/net/ena/ena_netdev.c:1742) [ena]\n napi_poll (net/core/dev.c:6847)\n net_rx_action (net/core/dev.c:6917)\n __do_softirq (arch/x86/include/asm/jump_label.h:25 include/linux/jump_label.h:200 include/trace/events/irq.h:142 kernel/softirq.c:299)\n asm_call_irq_on_stack (arch/x86/entry/entry_64.S:809)\n\u003c/IRQ\u003e\n do_softirq_own_stack (arch/x86/include/asm/irq_stack.h:27 arch/x86/include/asm/irq_stack.h:77 arch/x86/kernel/irq_64.c:77)\n irq_exit_rcu (kernel/softirq.c:393 kernel/softirq.c:423 kernel/softirq.c:435)\n common_interrupt (arch/x86/kernel/irq.c:239)\n asm_common_interrupt (arch/x86/include/asm/idtentry.h:626)\nRIP: 0010:acpi_idle_do_entry (arch/x86/include/asm/irqflags.h:49 arch/x86/include/asm/irqflags.h:89 drivers/acpi/processor_idle.c:114 drivers/acpi/processor_idle.c:575)\nCode: 8b 15 d1 3c c4 02 ed c3 cc cc cc cc 65 48 8b 04 25 40 ef 01 00 48 8b 00 a8 08 75 eb 0f 1f 44 00 00 0f 00 2d d5 09 55 00 fb f4 \u003cfa\u003e c3 cc cc cc cc e9 be fc ff ff 66 66 2e 0f 1f 84 00 00 00 00 00\nRSP: 0018:ffffffffb5603e58 EFLAGS: 00000246\nRAX: 0000000000004000 RBX: ffff93dac0929c00 RCX: ffff93daee833900\nRDX: ffff93daee800000 RSI: ffff93d\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "891f2603-1ee5-42e1-a048-ad48f9340c64",
      "id": "CVE-2024-46842",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status.  The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code.  During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout.  If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b57fda7-1ef5-4109-9e3e-931e0897befb",
      "id": "CVE-2024-47679",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfs: fix race between evice_inodes() and find_inode()\u0026iput()\n\nHi, all\n\nRecently I noticed a bug[1] in btrfs, after digged it into\nand I believe it'a race in vfs.\n\nLet's assume there's a inode (ie ino 261) with i_count 1 is\ncalled by iput(), and there's a concurrent thread calling\ngeneric_shutdown_super().\n\ncpu0:                              cpu1:\niput() // i_count is 1\n  -\u003espin_lock(inode)\n  -\u003edec i_count to 0\n  -\u003eiput_final()                    generic_shutdown_super()\n    -\u003e__inode_add_lru()               -\u003eevict_inodes()\n      // cause some reason[2]           -\u003eif (atomic_read(inode-\u003ei_count)) continue;\n      // return before                  // inode 261 passed the above check\n      // list_lru_add_obj()             // and then schedule out\n   -\u003espin_unlock()\n// note here: the inode 261\n// was still at sb list and hash list,\n// and I_FREEING|I_WILL_FREE was not been set\n\nbtrfs_iget()\n  // after some function calls\n  -\u003efind_inode()\n    // found the above inode 261\n    -\u003espin_lock(inode)\n   // check I_FREEING|I_WILL_FREE\n   // and passed\n      -\u003e__iget()\n    -\u003espin_unlock(inode)                // schedule back\n                                        -\u003espin_lock(inode)\n                                        // check (I_NEW|I_FREEING|I_WILL_FREE) flags,\n                                        // passed and set I_FREEING\niput()                                  -\u003espin_unlock(inode)\n  -\u003espin_lock(inode)\t\t\t  -\u003eevict()\n  // dec i_count to 0\n  -\u003eiput_final()\n    -\u003espin_unlock()\n    -\u003eevict()\n\nNow, we have two threads simultaneously evicting\nthe same inode, which may trigger the BUG(inode-\u003ei_state \u0026 I_CLEAR)\nstatement both within clear_inode() and iput().\n\nTo fix the bug, recheck the inode-\u003ei_count after holding i_lock.\nBecause in the most scenarios, the first check is valid, and\nthe overhead of spin_lock() can be reduced.\n\nIf there is any misunderstanding, please let me know, thanks.\n\n[1]: https://lore.kernel.org/linux-btrfs/000000000000eabe1d0619c48986@google.com/\n[2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable()\nreturn false when I reproduced the bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37a78b55-4fe4-4488-a0a7-dcff2b12aa08",
      "id": "CVE-2024-47713",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()\n\nSince '__dev_queue_xmit()' should be called with interrupts enabled,\nthe following backtrace:\n\nieee80211_do_stop()\n ...\n spin_lock_irqsave(\u0026local-\u003equeue_stop_reason_lock, flags)\n ...\n ieee80211_free_txskb()\n  ieee80211_report_used_skb()\n   ieee80211_report_ack_skb()\n    cfg80211_mgmt_tx_status_ext()\n     nl80211_frame_tx_status()\n      genlmsg_multicast_netns()\n       genlmsg_multicast_netns_filtered()\n        nlmsg_multicast_filtered()\n\t netlink_broadcast_filtered()\n\t  do_one_broadcast()\n\t   netlink_broadcast_deliver()\n\t    __netlink_sendskb()\n\t     netlink_deliver_tap()\n\t      __netlink_deliver_tap_skb()\n\t       dev_queue_xmit()\n\t        __dev_queue_xmit() ; with IRQS disabled\n ...\n spin_unlock_irqrestore(\u0026local-\u003equeue_stop_reason_lock, flags)\n\nissues the warning (as reported by syzbot reproducer):\n\nWARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120\n\nFix this by implementing a two-phase skb reclamation in\n'ieee80211_do_stop()', where actual work is performed\noutside of a section with interrupts disabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9512daad-4f46-4e62-9b28-8d0a220e1e03",
      "id": "CVE-2024-47737",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: call cache_put if xdr_reserve_space returns NULL\n\nIf not enough buffer space available, but idmap_lookup has triggered\nlookup_fn which calls cache_get and returns successfully. Then we\nmissed to call cache_put here which pairs with cache_get.\n\nReviwed-by: Jeff Layton \u003cjlayton@kernel.org\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e24d8ea-440d-4545-ad65-031f1e678d12",
      "id": "CVE-2024-49879",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: omapdrm: Add missing check for alloc_ordered_workqueue\n\nAs it may return NULL pointer and cause NULL pointer dereference. Add check\nfor the return value of alloc_ordered_workqueue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "171ed44c-580f-40c9-8519-73ae67836a51",
      "id": "CVE-2024-50048",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Fix a NULL pointer dereference issue in fbcon_putcs\n\nsyzbot has found a NULL pointer dereference bug in fbcon.\nHere is the simplified C reproducer:\n\nstruct param {\n\tuint8_t type;\n\tstruct tiocl_selection ts;\n};\n\nint main()\n{\n\tstruct fb_con2fbmap con2fb;\n\tstruct param param;\n\n\tint fd = open(\"/dev/fb1\", 0, 0);\n\n\tcon2fb.console = 0x19;\n\tcon2fb.framebuffer = 0;\n\tioctl(fd, FBIOPUT_CON2FBMAP, \u0026con2fb);\n\n\tparam.type = 2;\n\tparam.ts.xs = 0; param.ts.ys = 0;\n\tparam.ts.xe = 0; param.ts.ye = 0;\n\tparam.ts.sel_mode = 0;\n\n\tint fd1 = open(\"/dev/tty1\", O_RDWR, 0);\n\tioctl(fd1, TIOCLINUX, \u0026param);\n\n\tcon2fb.console = 1;\n\tcon2fb.framebuffer = 0;\n\tioctl(fd, FBIOPUT_CON2FBMAP, \u0026con2fb);\n\n\treturn 0;\n}\n\nAfter calling ioctl(fd1, TIOCLINUX, \u0026param), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, \u0026con2fb)\ncauses the kernel to follow a different execution path:\n\n set_con2fb_map\n  -\u003e con2fb_init_display\n   -\u003e fbcon_set_disp\n    -\u003e redraw_screen\n     -\u003e hide_cursor\n      -\u003e clear_selection\n       -\u003e highlight\n        -\u003e invert_screen\n         -\u003e do_update_region\n          -\u003e fbcon_putcs\n           -\u003e ops-\u003eputcs\n\nSince ops-\u003eputcs is a NULL pointer, this leads to a kernel panic.\nTo prevent this, we need to call set_blitting_type() within set_con2fb_map()\nto properly initialize ops-\u003eputcs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a9f2f64-c350-4954-89ac-20a62a268cf2",
      "id": "CVE-2024-50062",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Avoid null pointer deref during path establishment\n\nFor RTRS path establishment, RTRS client initiates and completes con_num\nof connections. After establishing all its connections, the information\nis exchanged between the client and server through the info_req message.\nDuring this exchange, it is essential that all connections have been\nestablished, and the state of the RTRS srv path is CONNECTED.\n\nSo add these sanity checks, to make sure we detect and abort process in\nerror scenarios to avoid null pointer deref.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a63d98c7-60d6-4677-9334-2149e13c068e",
      "id": "CVE-2024-53061",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: s5p-jpeg: prevent buffer overflows\n\nThe current logic allows word to be less than 2. If this happens,\nthere will be buffer overflows, as reported by smatch. Add extra\nchecks to prevent it.\n\nWhile here, remove an unused word = 0 assignment.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7394c51-94de-472c-bfec-3bc3684d5664",
      "id": "CVE-2024-53155",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix uninitialized value in ocfs2_file_read_iter()\n\nSyzbot has reported the following KMSAN splat:\n\nBUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80\n ocfs2_file_read_iter+0x9a4/0xf80\n __io_read+0x8d4/0x20f0\n io_read+0x3e/0xf0\n io_issue_sqe+0x42b/0x22c0\n io_wq_submit_work+0xaf9/0xdc0\n io_worker_handle_work+0xd13/0x2110\n io_wq_worker+0x447/0x1410\n ret_from_fork+0x6f/0x90\n ret_from_fork_asm+0x1a/0x30\n\nUninit was created at:\n __alloc_pages_noprof+0x9a7/0xe00\n alloc_pages_mpol_noprof+0x299/0x990\n alloc_pages_noprof+0x1bf/0x1e0\n allocate_slab+0x33a/0x1250\n ___slab_alloc+0x12ef/0x35e0\n kmem_cache_alloc_bulk_noprof+0x486/0x1330\n __io_alloc_req_refill+0x84/0x560\n io_submit_sqes+0x172f/0x2f30\n __se_sys_io_uring_enter+0x406/0x41c0\n __x64_sys_io_uring_enter+0x11f/0x1a0\n x64_sys_call+0x2b54/0x3ba0\n do_syscall_64+0xcd/0x1e0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSince an instance of 'struct kiocb' may be passed from the block layer\nwith 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'\nand use it from where 'ocfs2_dio_end_io()' might take care, i.e. in\n'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "120abefe-e129-4fb7-9f82-f6b6ebba6bf5",
      "id": "CVE-2024-53198",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: Fix the issue of resource not being properly released in xenbus_dev_probe()\n\nThis patch fixes an issue in the function xenbus_dev_probe(). In the\nxenbus_dev_probe() function, within the if (err) branch at line 313, the\nprogram incorrectly returns err directly without releasing the resources\nallocated by err = drv-\u003eprobe(dev, id). As the return value is non-zero,\nthe upper layers assume the processing logic has failed. However, the probe\noperation was performed earlier without a corresponding remove operation.\nSince the probe actually allocates resources, failing to perform the remove\noperation could lead to problems.\n\nTo fix this issue, we followed the resource release logic of the\nxenbus_dev_remove() function by adding a new block fail_remove before the\nfail_put block. After entering the branch if (err) at line 313, the\nfunction will use a goto statement to jump to the fail_remove block,\nensuring that the previously acquired resources are correctly released,\nthus preventing the reference count leak.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "caf96b22-27ad-4af6-b7fd-d6022345c9ff",
      "id": "CVE-2024-57893",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Fix races at processing SysEx messages\n\nOSS sequencer handles the SysEx messages split in 6 bytes packets, and\nALSA sequencer OSS layer tries to combine those.  It stores the data\nin the internal buffer and this access is racy as of now, which may\nlead to the out-of-bounds access.\n\nAs a temporary band-aid fix, introduce a mutex for serializing the\nprocess of the SysEx message packets.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd87b67f-82bc-4125-ba7c-2e2b98782faf",
      "id": "CVE-2024-57922",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add check for granularity in dml ceil/floor helpers\n\n[Why]\nWrapper functions for dcn_bw_ceil2() and dcn_bw_floor2()\nshould check for granularity is non zero to avoid assert and\ndivide-by-zero error in dcn_bw_ functions.\n\n[How]\nAdd check for granularity 0.\n\n(cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d13e0a5-57b3-4a32-a6f8-a9ebf69e5d19",
      "id": "CVE-2024-58239",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we will end up merging them:\n - process_rx_list copies the non-DATA record\n - we start the loop and process the first available record since it's\n   of the same type\n - we break out of the loop since the record was not DATA\n\nJust check the record type and jump to the end in case process_rx_list\ndid some work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bdfb5174-a62e-4cb3-a7d5-5c884f9fe0ba",
      "id": "CVE-2025-21635",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current-\u003ensproxy\n\nAs mentioned in a previous commit of this series, using the 'net'\nstructure via 'current' is not recommended for different reasons:\n\n- Inconsistency: getting info from the reader's/writer's netns vs only\n  from the opener's netns.\n\n- current-\u003ensproxy can be NULL in some cases, resulting in an 'Oops'\n  (null-ptr-deref), e.g. when the current task is exiting, as spotted by\n  syzbot [1] using acct(2).\n\nThe per-netns structure can be obtained from the table-\u003edata using\ncontainer_of(), then the 'net' one can be retrieved from the listen\nsocket (if available).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "435dff5e-1acf-4dd9-923a-1d0fb28e0b89",
      "id": "CVE-2025-21712",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime\n\nAfter commit ec6bb299c7c3 (\"md/md-bitmap: add 'sync_size' into struct\nmd_bitmap_stats\"), following panic is reported:\n\nOops: general protection fault, probably for non-canonical address\nRIP: 0010:bitmap_get_stats+0x2b/0xa0\nCall Trace:\n \u003cTASK\u003e\n md_seq_show+0x2d2/0x5b0\n seq_read_iter+0x2b9/0x470\n seq_read+0x12f/0x180\n proc_reg_read+0x57/0xb0\n vfs_read+0xf6/0x380\n ksys_read+0x6c/0xf0\n do_syscall_64+0x82/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that bitmap_get_stats() can be called at anytime if mddev\nis still there, even if bitmap is destroyed, or not fully initialized.\nDeferenceing bitmap in this case can crash the kernel. Meanwhile, the\nabove commit start to deferencing bitmap-\u003estorage, make the problem\neasier to trigger.\n\nFix the problem by protecting bitmap_get_stats() with bitmap_info.mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bf49337-6d3a-495f-a63d-f6300eea34e9",
      "id": "CVE-2025-21791",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvrf: use RCU protection in l3mdev_l3_out()\n\nl3mdev_l3_out() can be called without RCU being held:\n\nraw_sendmsg()\n ip_push_pending_frames()\n  ip_send_skb()\n   ip_local_out()\n    __ip_local_out()\n     l3mdev_ip_out()\n\nAdd rcu_read_lock() / rcu_read_unlock() pair to avoid\na potential UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2bfea9a0-9897-4c51-8e39-a0987cad8956",
      "id": "CVE-2025-21814",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptp: Ensure info-\u003eenable callback is always set\n\nThe ioctl and sysfs handlers unconditionally call the -\u003eenable callback.\nNot all drivers implement that callback, leading to NULL dereferences.\nExample of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c.\n\nInstead use a dummy callback if no better was specified by the driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "139f32f7-ea90-4749-83fb-372be016ab3b",
      "id": "CVE-2025-22004",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix use after free in lec_send()\n\nThe -\u003esend() operation frees skb so save the length before calling\n-\u003esend() to avoid a use after free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "685e3ba3-049a-42c6-8464-b2bd0e1bdf7c",
      "id": "CVE-2025-37738",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: ignore xattrs past end\n\nOnce inside 'ext4_xattr_inode_dec_ref_all' we should\nignore xattrs entries past the 'end' entry.\n\nThis fixes the following KASAN reported issue:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\nRead of size 4 at addr ffff888012c120c4 by task repro/2065\n\nCPU: 1 UID: 0 PID: 2065 Comm: repro Not tainted 6.13.0-rc2+ #11\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x1fd/0x300\n ? tcp_gro_dev_warn+0x260/0x260\n ? _printk+0xc0/0x100\n ? read_lock_is_recursive+0x10/0x10\n ? irq_work_queue+0x72/0xf0\n ? __virt_addr_valid+0x17b/0x4b0\n print_address_description+0x78/0x390\n print_report+0x107/0x1f0\n ? __virt_addr_valid+0x17b/0x4b0\n ? __virt_addr_valid+0x3ff/0x4b0\n ? __phys_addr+0xb5/0x160\n ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\n kasan_report+0xcc/0x100\n ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\n ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\n ? ext4_xattr_delete_inode+0xd30/0xd30\n ? __ext4_journal_ensure_credits+0x5f0/0x5f0\n ? __ext4_journal_ensure_credits+0x2b/0x5f0\n ? inode_update_timestamps+0x410/0x410\n ext4_xattr_delete_inode+0xb64/0xd30\n ? ext4_truncate+0xb70/0xdc0\n ? ext4_expand_extra_isize_ea+0x1d20/0x1d20\n ? __ext4_mark_inode_dirty+0x670/0x670\n ? ext4_journal_check_start+0x16f/0x240\n ? ext4_inode_is_fast_symlink+0x2f2/0x3a0\n ext4_evict_inode+0xc8c/0xff0\n ? ext4_inode_is_fast_symlink+0x3a0/0x3a0\n ? do_raw_spin_unlock+0x53/0x8a0\n ? ext4_inode_is_fast_symlink+0x3a0/0x3a0\n evict+0x4ac/0x950\n ? proc_nr_inodes+0x310/0x310\n ? trace_ext4_drop_inode+0xa2/0x220\n ? _raw_spin_unlock+0x1a/0x30\n ? iput+0x4cb/0x7e0\n do_unlinkat+0x495/0x7c0\n ? try_break_deleg+0x120/0x120\n ? 0xffffffff81000000\n ? __check_object_size+0x15a/0x210\n ? strncpy_from_user+0x13e/0x250\n ? getname_flags+0x1dc/0x530\n __x64_sys_unlinkat+0xc8/0xf0\n do_syscall_64+0x65/0x110\n entry_SYSCALL_64_after_hwframe+0x67/0x6f\nRIP: 0033:0x434ffd\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8\nRSP: 002b:00007ffc50fa7b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000107\nRAX: ffffffffffffffda RBX: 00007ffc50fa7e18 RCX: 0000000000434ffd\nRDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005\nRBP: 00007ffc50fa7be0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007ffc50fa7e08 R14: 00000000004bbf30 R15: 0000000000000001\n \u003c/TASK\u003e\n\nThe buggy address belongs to the object at ffff888012c12000\n which belongs to the cache filp of size 360\nThe buggy address is located 196 bytes inside of\n freed 360-byte region [ffff888012c12000, ffff888012c12168)\n\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c12\nhead: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nflags: 0x40(head|node=0|zone=0)\npage_type: f5(slab)\nraw: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004\nraw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000\nhead: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004\nhead: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000\nhead: 0000000000000001 ffffea00004b0481 ffffffffffffffff 0000000000000000\nhead: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888012c11f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888012c12000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003e ffff888012c12080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                           ^\n ffff888012c12100: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\n ffff888012c12180: fc fc fc fc fc fc fc fc fc\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "75b0713d-8570-48a6-9c39-f37cc70697bc",
      "id": "CVE-2025-37756",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: explicitly disallow disconnect\n\nsyzbot discovered that it can disconnect a TLS socket and then\nrun into all sort of unexpected corner cases. I have a vague\nrecollection of Eric pointing this out to us a long time ago.\nSupporting disconnect is really hard, for one thing if offload\nis enabled we'd need to wait for all packets to be _acked_.\nDisconnect is not commonly used, disallow it.\n\nThe immediate problem syzbot run into is the warning in the strp,\nbut that's just the easiest bug to trigger:\n\n  WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486\n  RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486\n  Call Trace:\n   \u003cTASK\u003e\n   tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363\n   tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043\n   inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678\n   sock_recvmsg_nosec net/socket.c:1023 [inline]\n   sock_recvmsg+0x109/0x280 net/socket.c:1045\n   __sys_recvfrom+0x202/0x380 net/socket.c:2237",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3944713d-fa6e-4b38-ac1c-726e3379cd89",
      "id": "CVE-2025-37789",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix nested key length validation in the set() action\n\nIt's not safe to access nla_len(ovs_key) if the data is smaller than\nthe netlink header.  Check that the attribute is OK first.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a1ef7fa9-c80f-49e9-bf26-1209adb2cde4",
      "id": "CVE-2025-38112",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix TOCTOU issue in sk_is_readable()\n\nsk-\u003esk_prot-\u003esock_is_readable is a valid function pointer when sk resides\nin a sockmap. After the last sk_psock_put() (which usually happens when\nsocket is removed from sockmap), sk-\u003esk_prot gets restored and\nsk-\u003esk_prot-\u003esock_is_readable becomes NULL.\n\nThis makes sk_is_readable() racy, if the value of sk-\u003esk_prot is reloaded\nafter the initial check. Which in turn may lead to a null pointer\ndereference.\n\nEnsure the function pointer does not turn NULL after the check.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "204c155b-3ee6-4651-97ba-37790e42d176",
      "id": "CVE-2025-38145",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\naspeed_lpc_enable_snoop() does not check for this case, which results in a\nNULL pointer dereference.\n\nAdd NULL check after devm_kasprintf() to prevent this issue.\n\n[arj: Fix Fixes: tag to use subject from 3772e5da4454]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46cdd407-bf95-43d2-b6fc-2bd13688eb94",
      "id": "CVE-2020-27675",
      "description": "An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e950821a-4818-4554-a5c9-32d355ae7b41",
      "id": "CVE-2020-29373",
      "description": "An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "576f3888-201d-40ce-88c9-a942b0e66b97",
      "id": "CVE-2021-26930",
      "description": "An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dbc16b3f-3ebe-4422-a9d8-7fb900118a95",
      "id": "CVE-2021-26932",
      "description": "An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "937f8efe-936b-4369-b064-c595d6e046bd",
      "id": "CVE-2021-4023",
      "description": "A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to execute io-uring requests to possibly crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "875d5c55-8f44-47b7-94ba-fc6df447964c",
      "id": "CVE-2021-42008",
      "description": "The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c66aad9-f574-4d35-9c46-75e8f2530f81",
      "id": "CVE-2021-47173",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/uss720: fix memory leak in uss720_probe\n\nuss720_probe forgets to decrease the refcount of usbdev in uss720_probe.\nFix this by decreasing the refcount of usbdev by usb_put_dev.\n\nBUG: memory leak\nunreferenced object 0xffff888101113800 (size 2048):\n  comm \"kworker/0:1\", pid 7, jiffies 4294956777 (age 28.870s)\n  hex dump (first 32 bytes):\n    ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00  ....1...........\n    00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00  ................\n  backtrace:\n    [\u003cffffffff82b8e822\u003e] kmalloc include/linux/slab.h:554 [inline]\n    [\u003cffffffff82b8e822\u003e] kzalloc include/linux/slab.h:684 [inline]\n    [\u003cffffffff82b8e822\u003e] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582\n    [\u003cffffffff82b98441\u003e] hub_port_connect drivers/usb/core/hub.c:5129 [inline]\n    [\u003cffffffff82b98441\u003e] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]\n    [\u003cffffffff82b98441\u003e] port_event drivers/usb/core/hub.c:5509 [inline]\n    [\u003cffffffff82b98441\u003e] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591\n    [\u003cffffffff81259229\u003e] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275\n    [\u003cffffffff81259b19\u003e] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421\n    [\u003cffffffff81261228\u003e] kthread+0x178/0x1b0 kernel/kthread.c:292\n    [\u003cffffffff8100227f\u003e] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b879967-c6a6-457f-8a22-370895ac031a",
      "id": "CVE-2021-47188",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Improve SCSI abort handling\n\nThe following has been observed on a test setup:\n\nWARNING: CPU: 4 PID: 250 at drivers/scsi/ufs/ufshcd.c:2737 ufshcd_queuecommand+0x468/0x65c\nCall trace:\n ufshcd_queuecommand+0x468/0x65c\n scsi_send_eh_cmnd+0x224/0x6a0\n scsi_eh_test_devices+0x248/0x418\n scsi_eh_ready_devs+0xc34/0xe58\n scsi_error_handler+0x204/0x80c\n kthread+0x150/0x1b4\n ret_from_fork+0x10/0x30\n\nThat warning is triggered by the following statement:\n\n\tWARN_ON(lrbp-\u003ecmd);\n\nFix this warning by clearing lrbp-\u003ecmd from the abort handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "214e3f75-5500-4e44-8cf2-64bbfa40952f",
      "id": "CVE-2021-47243",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_cake: Fix out of bounds when parsing TCP options and header\n\nThe TCP option parser in cake qdisc (cake_get_tcpopt and\ncake_tcph_may_drop) could read one byte out of bounds. When the length\nis 1, the execution flow gets into the loop, reads one byte of the\nopcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads\none more byte, which exceeds the length of 1.\n\nThis fix is inspired by commit 9609dad263f8 (\"ipv4: tcp_input: fix stack\nout of bounds when parsing TCP options.\").\n\nv2 changes:\n\nAdded doff validation in cake_get_tcphdr to avoid parsing garbage as TCP\nheader. Although it wasn't strictly an out-of-bounds access (memory was\nallocated), garbage values could be read where CAKE expected the TCP\nheader if doff was smaller than 5.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d24a5e9-fe56-4f67-addb-c59c927d6bb8",
      "id": "CVE-2021-47255",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: LAPIC: Restore guard to prevent illegal APIC register access\n\nPer the SDM, \"any access that touches bytes 4 through 15 of an APIC\nregister may cause undefined behavior and must not be executed.\"\nWorse, such an access in kvm_lapic_reg_read can result in a leak of\nkernel stack contents. Prior to commit 01402cf81051 (\"kvm: LAPIC:\nwrite down valid APIC registers\"), such an access was explicitly\ndisallowed. Restore the guard that was removed in that commit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f085d3c-70d1-4dbc-bba0-e3b97fe9dfbb",
      "id": "CVE-2021-47282",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: bcm2835: Fix out-of-bounds access with more than 4 slaves\n\nCommit 571e31fa60b3 (\"spi: bcm2835: Cache CS register value for\n-\u003eprepare_message()\") limited the number of slaves to 3 at compile-time.\nThe limitation was necessitated by a statically-sized array prepare_cs[]\nin the driver private data which contains a per-slave register value.\n\nThe commit sought to enforce the limitation at run-time by setting the\ncontroller's num_chipselect to 3:  Slaves with a higher chipselect are\nrejected by spi_add_device().\n\nHowever the commit neglected that num_chipselect only limits the number\nof *native* chipselects.  If GPIO chipselects are specified in the\ndevice tree for more than 3 slaves, num_chipselect is silently raised by\nof_spi_get_gpio_numbers() and the result are out-of-bounds accesses to\nthe statically-sized array prepare_cs[].\n\nAs a bandaid fix which is backportable to stable, raise the number of\nallowed slaves to 24 (which \"ought to be enough for anybody\"), enforce\nthe limitation on slave -\u003esetup and revert num_chipselect to 3 (which is\nthe number of native chipselects supported by the controller).\nAn upcoming for-next commit will allow an arbitrary number of slaves.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "837adbf5-7389-4726-9b6e-22352a7face5",
      "id": "CVE-2021-47314",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: fsl_ifc: fix leak of private memory on probe failure\n\nOn probe error the driver should free the memory allocated for private\nstructure.  Fix this by using resource-managed allocation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "633c6f17-1842-4632-bb1a-d8ff053deef1",
      "id": "CVE-2021-47434",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Fix command ring pointer corruption while aborting a command\n\nThe command ring pointer is located at [6:63] bits of the command\nring control register (CRCR). All the control bits like command stop,\nabort are located at [0:3] bits. While aborting a command, we read the\nCRCR and set the abort bit and write to the CRCR. The read will always\ngive command ring pointer as all zeros. So we essentially write only\nthe control bits. Since we split the 64 bit write into two 32 bit writes,\nthere is a possibility of xHC command ring stopped before the upper\ndword (all zeros) is written. If that happens, xHC updates the upper\ndword of its internal command ring pointer with all zeros. Next time,\nwhen the command ring is restarted, we see xHC memory access failures.\nFix this issue by only writing to the lower dword of CRCR where all\ncontrol bits are located.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "660a8fc2-32f5-442e-b071-7e4cf4828e01",
      "id": "CVE-2021-47443",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: fix possible memory leak in digital_tg_listen_mdaa()\n\n'params' is allocated in digital_tg_listen_mdaa(), but not free when\ndigital_send_cmd() failed, which will cause memory leak. Fix it by\nfreeing 'params' if digital_send_cmd() return failed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf649cf8-fceb-4640-ba73-c691f7285ccc",
      "id": "CVE-2021-47549",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl\n\nWhen the `rmmod sata_fsl.ko` command is executed in the PPC64 GNU/Linux,\na bug is reported:\n ==================================================================\n BUG: Unable to handle kernel data access on read at 0x80000800805b502c\n Oops: Kernel access of bad area, sig: 11 [#1]\n NIP [c0000000000388a4] .ioread32+0x4/0x20\n LR [80000000000c6034] .sata_fsl_port_stop+0x44/0xe0 [sata_fsl]\n Call Trace:\n  .free_irq+0x1c/0x4e0 (unreliable)\n  .ata_host_stop+0x74/0xd0 [libata]\n  .release_nodes+0x330/0x3f0\n  .device_release_driver_internal+0x178/0x2c0\n  .driver_detach+0x64/0xd0\n  .bus_remove_driver+0x70/0xf0\n  .driver_unregister+0x38/0x80\n  .platform_driver_unregister+0x14/0x30\n  .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl]\n  .__se_sys_delete_module+0x1ec/0x2d0\n  .system_call_exception+0xfc/0x1f0\n  system_call_common+0xf8/0x200\n ==================================================================\n\nThe triggering of the BUG is shown in the following stack:\n\ndriver_detach\n  device_release_driver_internal\n    __device_release_driver\n      drv-\u003eremove(dev) --\u003e platform_drv_remove/platform_remove\n        drv-\u003eremove(dev) --\u003e sata_fsl_remove\n          iounmap(host_priv-\u003ehcr_base);\t\t\t\u003c---- unmap\n          kfree(host_priv);                             \u003c---- free\n      devres_release_all\n        release_nodes\n          dr-\u003enode.release(dev, dr-\u003edata) --\u003e ata_host_stop\n            ap-\u003eops-\u003eport_stop(ap) --\u003e sata_fsl_port_stop\n                ioread32(hcr_base + HCONTROL)           \u003c---- UAF\n            host-\u003eops-\u003ehost_stop(host)\n\nThe iounmap(host_priv-\u003ehcr_base) and kfree(host_priv) functions should\nnot be executed in drv-\u003eremove. These functions should be executed in\nhost_stop after port_stop. Therefore, we move these functions to the\nnew function sata_fsl_host_stop and bind the new function to host_stop.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5aca983f-0659-442e-9da1-835aec063b50",
      "id": "CVE-2021-47610",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix null ptr access msm_ioctl_gem_submit()\n\nFix the below null pointer dereference in msm_ioctl_gem_submit():\n\n 26545.260705:   Call trace:\n 26545.263223:    kref_put+0x1c/0x60\n 26545.266452:    msm_ioctl_gem_submit+0x254/0x744\n 26545.270937:    drm_ioctl_kernel+0xa8/0x124\n 26545.274976:    drm_ioctl+0x21c/0x33c\n 26545.278478:    drm_compat_ioctl+0xdc/0xf0\n 26545.282428:    __arm64_compat_sys_ioctl+0xc8/0x100\n 26545.287169:    el0_svc_common+0xf8/0x250\n 26545.291025:    do_el0_svc_compat+0x28/0x54\n 26545.295066:    el0_svc_compat+0x10/0x1c\n 26545.298838:    el0_sync_compat_handler+0xa8/0xcc\n 26545.303403:    el0_sync_compat+0x188/0x1c0\n 26545.307445:   Code: d503201f d503201f 52800028 4b0803e8 (b8680008)\n 26545.318799:   Kernel panic - not syncing: Oops: Fatal exception",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3362a94-ea9c-47d0-82c5-61b763a51e53",
      "id": "CVE-2021-47631",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: davinci: da850-evm: Avoid NULL pointer dereference\n\nWith newer versions of GCC, there is a panic in da850_evm_config_emac()\nwhen booting multi_v5_defconfig in QEMU under the palmetto-bmc machine:\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000020\npgd = (ptrval)\n[00000020] *pgd=00000000\nInternal error: Oops: 5 [#1] PREEMPT ARM\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1\nHardware name: Generic DT based system\nPC is at da850_evm_config_emac+0x1c/0x120\nLR is at do_one_initcall+0x50/0x1e0\n\nThe emac_pdata pointer in soc_info is NULL because davinci_soc_info only\ngets populated on davinci machines but da850_evm_config_emac() is called\non all machines via device_initcall().\n\nMove the rmii_en assignment below the machine check so that it is only\ndereferenced when running on a supported SoC.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9fb63638-534d-4837-b48b-5949f72e35d2",
      "id": "CVE-2022-0850",
      "description": "A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f453d753-389c-4202-a95f-a5a9a029a317",
      "id": "CVE-2022-36946",
      "description": "nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb-\u003elen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eb9cc91b-1bc8-48a2-a8dd-679bccb1b39e",
      "id": "CVE-2022-1198",
      "description": "A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8aeb6e43-f5b6-4878-b726-37b1038fe519",
      "id": "CVE-2022-26365",
      "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8952d247-1d79-4770-9c60-eb8cecdf4af9",
      "id": "CVE-2022-3105",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "550f41d7-02a8-4411-8adc-2c283bc7a990",
      "id": "CVE-2022-3113",
      "description": "An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "863b1aae-ae60-4e9a-8027-179efe354498",
      "id": "CVE-2022-3239",
      "description": "A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12ccc3ce-20b1-4e0f-9532-a360d034cd57",
      "id": "CVE-2022-48626",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmoxart: fix potential use-after-free on remove path\n\nIt was reported that the mmc host structure could be accessed after it\nwas freed in moxart_remove(), so fix this by saving the base register of\nthe device and using it instead of the pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "071678f8-2ffb-4435-81a5-656fd9c6cbb3",
      "id": "CVE-2022-48772",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: lgdt3306a: Add a check against null-pointer-def\n\nThe driver should check whether the client provides the platform_data.\n\nThe following log reveals it:\n\n[   29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40\n[   29.610730] Read of size 40 at addr 0000000000000000 by task bash/414\n[   29.612820] Call Trace:\n[   29.613030]  \u003cTASK\u003e\n[   29.613201]  dump_stack_lvl+0x56/0x6f\n[   29.613496]  ? kmemdup+0x30/0x40\n[   29.613754]  print_report.cold+0x494/0x6b7\n[   29.614082]  ? kmemdup+0x30/0x40\n[   29.614340]  kasan_report+0x8a/0x190\n[   29.614628]  ? kmemdup+0x30/0x40\n[   29.614888]  kasan_check_range+0x14d/0x1d0\n[   29.615213]  memcpy+0x20/0x60\n[   29.615454]  kmemdup+0x30/0x40\n[   29.615700]  lgdt3306a_probe+0x52/0x310\n[   29.616339]  i2c_device_probe+0x951/0xa90",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f7bf34b-bb00-4a6a-8e84-d23a9f1701c8",
      "id": "CVE-2022-48794",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: at86rf230: Stop leaking skb's\n\nUpon error the ieee802154_xmit_complete() helper is not called. Only\nieee802154_wake_queue() is called manually. In the Tx case we then leak\nthe skb structure.\n\nFree the skb structure upon error before returning when appropriate.\n\nAs the 'is_tx = 0' cannot be moved in the complete handler because of a\npossible race between the delay in switching to STATE_RX_AACK_ON and a\nnew interrupt, we introduce an intermediate 'was_tx' boolean just for\nthis purpose.\n\nThere is no Fixes tag applying here, many changes have been made on this\narea and the issue kind of always existed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57511c71-402d-40cb-b20d-7583ed26bea9",
      "id": "CVE-2022-48938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nCDC-NCM: avoid overflow in sanity checking\n\nA broken device may give an extreme offset like 0xFFF0\nand a reasonable length for a fragment. In the sanity\ncheck as formulated now, this will create an integer\noverflow, defeating the sanity check. Both offset\nand offset + len need to be checked in such a manner\nthat no overflow can occur.\nAnd those quantities should be unsigned.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08a049f8-7b4f-42e3-8dfa-42f7f7f99307",
      "id": "CVE-2022-49029",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails\n\nSmatch report warning as follows:\n\ndrivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn:\n  '\u0026data-\u003elist' not removed from list\n\nIf ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will\nbe freed, but data-\u003elist will not be removed from driver_data.bmc_data,\nthen list traversal may cause UAF.\n\nFix by removeing it from driver_data.bmc_data before free().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "338a49e1-baeb-40a9-9c5d-32808c5fb54b",
      "id": "CVE-2022-49440",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Keep MSR[RI] set when calling RTAS\n\nRTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big\nendian mode (MSR[SF,LE] unset).\n\nThe change in MSR is done in enter_rtas() in a relatively complex way,\nsince the MSR value could be hardcoded.\n\nFurthermore, a panic has been reported when hitting the watchdog interrupt\nwhile running in RTAS, this leads to the following stack trace:\n\n  watchdog: CPU 24 Hard LOCKUP\n  watchdog: CPU 24 TB:997512652051031, last heartbeat TB:997504470175378 (15980ms ago)\n  ...\n  Supported: No, Unreleased kernel\n  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c\n  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000\n  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)\n  MSR:  8000000002981000 \u003cSF,VEC,VSX,ME\u003e  CR: 48800002  XER: 20040020\n  CFAR: 000000000000011c IRQMASK: 1\n  GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc\n  GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010\n  GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000\n  GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034\n  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008\n  GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f\n  GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40\n  GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000\n  NIP [000000001fb41050] 0x1fb41050\n  LR [000000001fb4104c] 0x1fb4104c\n  Call Trace:\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  Oops: Unrecoverable System Reset, sig: 6 [#1]\n  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\n  ...\n  Supported: No, Unreleased kernel\n  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c\n  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000\n  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)\n  MSR:  8000000002981000 \u003cSF,VEC,VSX,ME\u003e  CR: 48800002  XER: 20040020\n  CFAR: 000000000000011c IRQMASK: 1\n  GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc\n  GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010\n  GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000\n  GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034\n  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008\n  GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f\n  GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40\n  GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000\n  NIP [000000001fb41050] 0x1fb41050\n  LR [000000001fb4104c] 0x1fb4104c\n  Call Trace:\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  ---[ end trace 3ddec07f638c34a2 ]---\n\nThis happens because MSR[RI] is unset when entering RTAS but there is no\nvalid reason to not set it here.\n\nRTAS is expected to be called with MSR[RI] as specified in PAPR+ section\n\"7.2.1 Machine State\":\n\n  R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect\n  its own critical regions from recursion by setting the MSR[RI] bit to\n  0 when in the critical regions.\n\nFixing this by reviewing the way MSR is compute before calling RTAS. Now a\nhardcoded value meaning real \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "613b0d90-3438-4a9a-b146-96d0390363b7",
      "id": "CVE-2022-49441",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix deadlock caused by calling printk() under tty_port-\u003elock\n\npty_write() invokes kmalloc() which may invoke a normal printk() to print\nfailure message.  This can cause a deadlock in the scenario reported by\nsyz-bot below:\n\n       CPU0              CPU1                    CPU2\n       ----              ----                    ----\n                         lock(console_owner);\n                                                 lock(\u0026port_lock_key);\n  lock(\u0026port-\u003elock);\n                         lock(\u0026port_lock_key);\n                                                 lock(\u0026port-\u003elock);\n  lock(console_owner);\n\nAs commit dbdda842fe96 (\"printk: Add console owner and waiter logic to\nload balance console writes\") said, such deadlock can be prevented by\nusing printk_deferred() in kmalloc() (which is invoked in the section\nguarded by the port-\u003elock).  But there are too many printk() on the\nkmalloc() path, and kmalloc() can be called from anywhere, so changing\nprintk() to printk_deferred() is too complicated and inelegant.\n\nTherefore, this patch chooses to specify __GFP_NOWARN to kmalloc(), so\nthat printk() will not be called, and this deadlock problem can be\navoided.\n\nSyzbot reported the following lockdep error:\n\n======================================================\nWARNING: possible circular locking dependency detected\n5.4.143-00237-g08ccc19a-dirty #10 Not tainted\n------------------------------------------------------\nsyz-executor.4/29420 is trying to acquire lock:\nffffffff8aedb2a0 (console_owner){....}-{0:0}, at: console_trylock_spinning kernel/printk/printk.c:1752 [inline]\nffffffff8aedb2a0 (console_owner){....}-{0:0}, at: vprintk_emit+0x2ca/0x470 kernel/printk/printk.c:2023\n\nbut task is already holding lock:\nffff8880119c9158 (\u0026port-\u003elock){-.-.}-{2:2}, at: pty_write+0xf4/0x1f0 drivers/tty/pty.c:120\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #2 (\u0026port-\u003elock){-.-.}-{2:2}:\n       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n       _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159\n       tty_port_tty_get drivers/tty/tty_port.c:288 [inline]          \t\t\u003c-- lock(\u0026port-\u003elock);\n       tty_port_default_wakeup+0x1d/0xb0 drivers/tty/tty_port.c:47\n       serial8250_tx_chars+0x530/0xa80 drivers/tty/serial/8250/8250_port.c:1767\n       serial8250_handle_irq.part.0+0x31f/0x3d0 drivers/tty/serial/8250/8250_port.c:1854\n       serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1827 [inline] \t\u003c-- lock(\u0026port_lock_key);\n       serial8250_default_handle_irq+0xb2/0x220 drivers/tty/serial/8250/8250_port.c:1870\n       serial8250_interrupt+0xfd/0x200 drivers/tty/serial/8250/8250_core.c:126\n       __handle_irq_event_percpu+0x109/0xa50 kernel/irq/handle.c:156\n       [...]\n\n-\u003e #1 (\u0026port_lock_key){-.-.}-{2:2}:\n       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n       _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159\n       serial8250_console_write+0x184/0xa40 drivers/tty/serial/8250/8250_port.c:3198\n\t\t\t\t\t\t\t\t\t\t\u003c-- lock(\u0026port_lock_key);\n       call_console_drivers kernel/printk/printk.c:1819 [inline]\n       console_unlock+0x8cb/0xd00 kernel/printk/printk.c:2504\n       vprintk_emit+0x1b5/0x470 kernel/printk/printk.c:2024\t\t\t\u003c-- lock(console_owner);\n       vprintk_func+0x8d/0x250 kernel/printk/printk_safe.c:394\n       printk+0xba/0xed kernel/printk/printk.c:2084\n       register_console+0x8b3/0xc10 kernel/printk/printk.c:2829\n       univ8250_console_init+0x3a/0x46 drivers/tty/serial/8250/8250_core.c:681\n       console_init+0x49d/0x6d3 kernel/printk/printk.c:2915\n       start_kernel+0x5e9/0x879 init/main.c:713\n       secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241\n\n-\u003e #0 (console_owner){....}-{0:0}:\n       [...]\n       lock_acquire+0x127/0x340 kernel/locking/lockdep.c:4734\n       console_trylock_spinning kernel/printk/printk.c:1773 \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf10cf62-510a-481b-8188-10065bc45048",
      "id": "CVE-2022-49078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlz4: fix LZ4_decompress_safe_partial read out of bound\n\nWhen partialDecoding, it is EOF if we've either filled the output buffer\nor can't proceed with reading an offset for following match.\n\nIn some extreme corner cases when compressed data is suitably corrupted,\nUAF will occur.  As reported by KASAN [1], LZ4_decompress_safe_partial\nmay lead to read out of bound problem during decoding.  lz4 upstream has\nfixed it [2] and this issue has been disscussed here [3] before.\n\ncurrent decompression routine was ported from lz4 v1.8.3, bumping\nlib/lz4 to v1.9.+ is certainly a huge work to be done later, so, we'd\nbetter fix it first.\n\n[1] https://lore.kernel.org/all/000000000000830d1205cf7f0477@google.com/\n[2] https://github.com/lz4/lz4/commit/c5d6f8a8be3927c0bec91bcc58667a6cfad244ad#\n[3] https://lore.kernel.org/all/CC666AE8-4CA4-4951-B6FB-A2EFDE3AC03B@fb.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "753964b9-ed31-4f7b-8bc5-c07d2ad3fcf4",
      "id": "CVE-2022-49105",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: wfx: fix an error handling in wfx_init_common()\n\nOne error handler of wfx_init_common() return without calling\nieee80211_free_hw(hw), which may result in memory leak. And I add\none err label to unify the error handler, which is useful for the\nsubsequent changes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b90eee3e-78bd-4158-b6df-41f8f4becd7c",
      "id": "CVE-2022-49149",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix call timer start racing with call destruction\n\nThe rxrpc_call struct has a timer used to handle various timed events\nrelating to a call.  This timer can get started from the packet input\nroutines that are run in softirq mode with just the RCU read lock held.\nUnfortunately, because only the RCU read lock is held - and neither ref or\nother lock is taken - the call can start getting destroyed at the same time\na packet comes in addressed to that call.  This causes the timer - which\nwas already stopped - to get restarted.  Later, the timer dispatch code may\nthen oops if the timer got deallocated first.\n\nFix this by trying to take a ref on the rxrpc_call struct and, if\nsuccessful, passing that ref along to the timer.  If the timer was already\nrunning, the ref is discarded.\n\nThe timer completion routine can then pass the ref along to the call's work\nitem when it queues it.  If the timer or work item where already\nqueued/running, the extra ref is discarded.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7c908625-e0a1-4fc4-865b-70f0347f3f08",
      "id": "CVE-2022-49243",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe\n\nThis node pointer is returned by of_parse_phandle() with refcount\nincremented in this function.\nCalling of_node_put() to avoid the refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96f90f8c-55f0-41d8-b593-3b26d09970b7",
      "id": "CVE-2022-49350",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdio: unexport __init-annotated mdio_bus_init()\n\nEXPORT_SYMBOL and __init is a bad combination because the .init.text\nsection is freed up after the initialization. Hence, modules cannot\nuse symbols annotated __init. The access to a freed symbol may end up\nwith kernel panic.\n\nmodpost used to detect it, but it has been broken for a decade.\n\nRecently, I fixed modpost so it started to warn it again, then this\nshowed up in linux-next builds.\n\nThere are two ways to fix it:\n\n  - Remove __init\n  - Remove EXPORT_SYMBOL\n\nI chose the latter for this case because the only in-tree call-site,\ndrivers/net/phy/phy_device.c is never compiled as modular.\n(CONFIG_PHYLIB is boolean)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32583781-b26e-474e-b4cb-b852702bc213",
      "id": "CVE-2022-49407",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix plock invalid read\n\nThis patch fixes an invalid read showed by KASAN. A unlock will allocate a\n\"struct plock_op\" and a followed send_op() will append it to a global\nsend_list data structure. In some cases a followed dev_read() moves it\nto recv_list and dev_write() will cast it to \"struct plock_xop\" and access\nfields which are only available in those structures. At this point an\ninvalid read happens by accessing those fields.\n\nTo fix this issue the \"callback\" field is moved to \"struct plock_op\" to\nindicate that a cast to \"plock_xop\" is allowed and does the additional\n\"plock_xop\" handling if set.\n\nExample of the KASAN output which showed the invalid read:\n\n[ 2064.296453] ==================================================================\n[ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm]\n[ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484\n[ 2064.308168]\n[ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9\n[ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n[ 2064.311618] Call Trace:\n[ 2064.312218]  dump_stack_lvl+0x56/0x7b\n[ 2064.313150]  print_address_description.constprop.8+0x21/0x150\n[ 2064.314578]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.315610]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.316595]  kasan_report.cold.14+0x7f/0x11b\n[ 2064.317674]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.318687]  dev_write+0x52b/0x5a0 [dlm]\n[ 2064.319629]  ? dev_read+0x4a0/0x4a0 [dlm]\n[ 2064.320713]  ? bpf_lsm_kernfs_init_security+0x10/0x10\n[ 2064.321926]  vfs_write+0x17e/0x930\n[ 2064.322769]  ? __fget_light+0x1aa/0x220\n[ 2064.323753]  ksys_write+0xf1/0x1c0\n[ 2064.324548]  ? __ia32_sys_read+0xb0/0xb0\n[ 2064.325464]  do_syscall_64+0x3a/0x80\n[ 2064.326387]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.327606] RIP: 0033:0x7f807e4ba96f\n[ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48\n[ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n[ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f\n[ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010\n[ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001\n[ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80\n[ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001\n[ 2064.342857]\n[ 2064.343226] Allocated by task 12438:\n[ 2064.344057]  kasan_save_stack+0x1c/0x40\n[ 2064.345079]  __kasan_kmalloc+0x84/0xa0\n[ 2064.345933]  kmem_cache_alloc_trace+0x13b/0x220\n[ 2064.346953]  dlm_posix_unlock+0xec/0x720 [dlm]\n[ 2064.348811]  do_lock_file_wait.part.32+0xca/0x1d0\n[ 2064.351070]  fcntl_setlk+0x281/0xbc0\n[ 2064.352879]  do_fcntl+0x5e4/0xfe0\n[ 2064.354657]  __x64_sys_fcntl+0x11f/0x170\n[ 2064.356550]  do_syscall_64+0x3a/0x80\n[ 2064.358259]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.360745]\n[ 2064.361511] Last potentially related work creation:\n[ 2064.363957]  kasan_save_stack+0x1c/0x40\n[ 2064.365811]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.368100]  call_rcu+0x11b/0xf70\n[ 2064.369785]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.372404]  receive_from_sock+0x290/0x770 [dlm]\n[ 2064.374607]  process_recv_sockets+0x32/0x40 [dlm]\n[ 2064.377290]  process_one_work+0x9a8/0x16e0\n[ 2064.379357]  worker_thread+0x87/0xbf0\n[ 2064.381188]  kthread+0x3ac/0x490\n[ 2064.383460]  ret_from_fork+0x22/0x30\n[ 2064.385588]\n[ 2064.386518] Second to last potentially related work creation:\n[ 2064.389219]  kasan_save_stack+0x1c/0x40\n[ 2064.391043]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.393303]  call_rcu+0x11b/0xf70\n[ 2064.394885]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.397694]  receive_from_sock+0x290/0x770 \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69b0df5c-0557-4470-9191-55b46ec042e4",
      "id": "CVE-2022-49491",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/rockchip: vop: fix possible null-ptr-deref in vop_bind()\n\nIt will cause null-ptr-deref in resource_size(), if platform_get_resource()\nreturns NULL, move calling resource_size() after devm_ioremap_resource() that\nwill check 'res' to avoid null-ptr-deref.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "660c1418-b10d-4ee2-8c6f-02d303d1f1dc",
      "id": "CVE-2022-49512",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: denali: Use managed device resources\n\nAll of the resources used by this driver has managed interfaces, so use\nthem. Otherwise we will get the following splat:\n\n[    4.472703] denali-nand-pci 0000:00:05.0: timeout while waiting for irq 0x1000\n[    4.474071] denali-nand-pci: probe of 0000:00:05.0 failed with error -5\n[    4.473538] nand: No NAND device found\n[    4.474068] BUG: unable to handle page fault for address: ffffc90005000410\n[    4.475169] #PF: supervisor write access in kernel mode\n[    4.475579] #PF: error_code(0x0002) - not-present page\n[    4.478362] RIP: 0010:iowrite32+0x9/0x50\n[    4.486068] Call Trace:\n[    4.486269]  \u003cIRQ\u003e\n[    4.486443]  denali_isr+0x15b/0x300 [denali]\n[    4.486788]  ? denali_direct_write+0x50/0x50 [denali]\n[    4.487189]  __handle_irq_event_percpu+0x161/0x3b0\n[    4.487571]  handle_irq_event+0x7d/0x1b0\n[    4.487884]  handle_fasteoi_irq+0x2b0/0x770\n[    4.488219]  __common_interrupt+0xc8/0x1b0\n[    4.488549]  common_interrupt+0x9a/0xc0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78392ca2-2be3-47d3-aa39-0e88c266a254",
      "id": "CVE-2022-49514",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe\n\nCall of_node_put(platform_node) to avoid refcount leak in\nthe error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f00fd43f-0524-4044-acce-2a4560758601",
      "id": "CVE-2022-49554",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nzsmalloc: fix races between asynchronous zspage free and page migration\n\nThe asynchronous zspage free worker tries to lock a zspage's entire page\nlist without defending against page migration.  Since pages which haven't\nyet been locked can concurrently migrate off the zspage page list while\nlock_zspage() churns away, lock_zspage() can suffer from a few different\nlethal races.\n\nIt can lock a page which no longer belongs to the zspage and unsafely\ndereference page_private(), it can unsafely dereference a torn pointer to\nthe next page (since there's a data race), and it can observe a spurious\nNULL pointer to the next page and thus not lock all of the zspage's pages\n(since a single page migration will reconstruct the entire page list, and\ncreate_page_chain() unconditionally zeroes out each list pointer in the\nprocess).\n\nFix the races by using migrate_read_lock() in lock_zspage() to synchronize\nwith page migration.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac291eb8-622c-4e04-a75d-f73fa58835d1",
      "id": "CVE-2022-49564",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - add param check for DH\n\nReject requests with a source buffer that is bigger than the size of the\nkey. This is to prevent a possible integer underflow that might happen\nwhen copying the source scatterlist into a linear buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cbf20e2-141a-4717-812a-7b5a91e6b485",
      "id": "CVE-2022-49566",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix memory leak in RSA\n\nWhen an RSA key represented in form 2 (as defined in PKCS #1 V2.1) is\nused, some components of the private key persist even after the TFM is\nreleased.\nReplace the explicit calls to free the buffers in qat_rsa_exit_tfm()\nwith a call to qat_rsa_clear_ctx() which frees all buffers referenced in\nthe TFM context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fcdc030e-9d4b-4d5c-91c3-1d5af5f09943",
      "id": "CVE-2022-49708",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug_on ext4_mb_use_inode_pa\n\nHulk Robot reported a BUG_ON:\n==================================================================\nkernel BUG at fs/ext4/mballoc.c:3211!\n[...]\nRIP: 0010:ext4_mb_mark_diskspace_used.cold+0x85/0x136f\n[...]\nCall Trace:\n ext4_mb_new_blocks+0x9df/0x5d30\n ext4_ext_map_blocks+0x1803/0x4d80\n ext4_map_blocks+0x3a4/0x1a10\n ext4_writepages+0x126d/0x2c30\n do_writepages+0x7f/0x1b0\n __filemap_fdatawrite_range+0x285/0x3b0\n file_write_and_wait_range+0xb1/0x140\n ext4_sync_file+0x1aa/0xca0\n vfs_fsync_range+0xfb/0x260\n do_fsync+0x48/0xa0\n[...]\n==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\ndo_fsync\n vfs_fsync_range\n  ext4_sync_file\n   file_write_and_wait_range\n    __filemap_fdatawrite_range\n     do_writepages\n      ext4_writepages\n       mpage_map_and_submit_extent\n        mpage_map_one_extent\n         ext4_map_blocks\n          ext4_mb_new_blocks\n           ext4_mb_normalize_request\n            \u003e\u003e\u003e start + size \u003c= ac-\u003eac_o_ex.fe_logical\n           ext4_mb_regular_allocator\n            ext4_mb_simple_scan_group\n             ext4_mb_use_best_found\n              ext4_mb_new_preallocation\n               ext4_mb_new_inode_pa\n                ext4_mb_use_inode_pa\n                 \u003e\u003e\u003e set ac-\u003eac_b_ex.fe_len \u003c= 0\n           ext4_mb_mark_diskspace_used\n            \u003e\u003e\u003e BUG_ON(ac-\u003eac_b_ex.fe_len \u003c= 0);\n\nwe can easily reproduce this problem with the following commands:\n\t`fallocate -l100M disk`\n\t`mkfs.ext4 -b 1024 -g 256 disk`\n\t`mount disk /mnt`\n\t`fsstress -d /mnt -l 0 -n 1000 -p 1`\n\nThe size must be smaller than or equal to EXT4_BLOCKS_PER_GROUP.\nTherefore, \"start + size \u003c= ac-\u003eac_o_ex.fe_logical\" may occur\nwhen the size is truncated. So start should be the start position of\nthe group where ac_o_ex.fe_logical is located after alignment.\nIn addition, when the value of fe_logical or EXT4_BLOCKS_PER_GROUP\nis very large, the value calculated by start_off is more accurate.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "467e118c-c46d-453b-a6f0-b6afece89a0b",
      "id": "CVE-2022-49809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix skb leak in x25_lapb_receive_frame()\n\nx25_lapb_receive_frame() using skb_copy() to get a private copy of\nskb, the new skb should be freed in the undersized/fragmented skb\nerror handling path. Otherwise there is a memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "17c1f037-171c-4d0f-bfa9-a084980b7ba2",
      "id": "CVE-2022-49900",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: piix4: Fix adapter not be removed in piix4_remove()\n\nIn piix4_probe(), the piix4 adapter will be registered in:\n\n   piix4_probe()\n     piix4_add_adapters_sb800() / piix4_add_adapter()\n       i2c_add_adapter()\n\nBased on the probed device type, piix4_add_adapters_sb800() or single\npiix4_add_adapter() will be called.\nFor the former case, piix4_adapter_count is set as the number of adapters,\nwhile for antoher case it is not set and kept default *zero*.\n\nWhen piix4 is removed, piix4_remove() removes the adapters added in\npiix4_probe(), basing on the piix4_adapter_count value.\nBecause the count is zero for the single adapter case, the adapter won't\nbe removed and makes the sources allocated for adapter leaked, such as\nthe i2c client and device.\n\nThese sources can still be accessed by i2c or bus and cause problems.\nAn easily reproduced case is that if a new adapter is registered, i2c\nwill get the leaked adapter and try to call smbus_algorithm, which was\nalready freed:\n\nTriggered by: rmmod i2c_piix4 \u0026\u0026 modprobe max31730\n\n BUG: unable to handle page fault for address: ffffffffc053d860\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: 0000 [#1] PREEMPT SMP KASAN\n CPU: 0 PID: 3752 Comm: modprobe Tainted: G\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core\n RSP: 0018:ffff888107477710 EFLAGS: 00000246\n ...\n \u003cTASK\u003e\n  i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core\n  __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core\n  bus_for_each_dev (drivers/base/bus.c:301)\n  i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core\n  i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core\n  do_one_initcall (init/main.c:1296)\n  do_init_module (kernel/module/main.c:2455)\n  ...\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nFix this problem by correctly set piix4_adapter_count as 1 for the\nsingle adapter so it can be normally removed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56c047d9-e8f8-4806-8e76-c463705c3057",
      "id": "CVE-2022-50179",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath9k: fix use-after-free in ath9k_hif_usb_rx_cb\n\nSyzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The\nproblem was in incorrect htc_handle-\u003edrv_priv initialization.\n\nProbable call trace which can trigger use-after-free:\n\nath9k_htc_probe_device()\n  /* htc_handle-\u003edrv_priv = priv; */\n  ath9k_htc_wait_for_target()      \u003c--- Failed\n  ieee80211_free_hw()\t\t   \u003c--- priv pointer is freed\n\n\u003cIRQ\u003e\n...\nath9k_hif_usb_rx_cb()\n  ath9k_hif_usb_rx_stream()\n   RX_STAT_INC()\t\t\u003c--- htc_handle-\u003edrv_priv access\n\nIn order to not add fancy protection for drv_priv we can move\nhtc_handle-\u003edrv_priv initialization at the end of the\nath9k_htc_probe_device() and add helper macro to make\nall *_STAT_* macros NULL safe, since syzbot has reported related NULL\nderef in that macros [1]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06071abc-a936-4582-ae7c-a413488c9c5d",
      "id": "CVE-2022-50214",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: Clear the connection field properly\n\ncoresight devices track their connections (output connections) and\nhold a reference to the fwnode. When a device goes away, we walk through\nthe devices on the coresight bus and make sure that the references\nare dropped. This happens both ways:\n a) For all output connections from the device, drop the reference to\n    the target device via coresight_release_platform_data()\n\nb) Iterate over all the devices on the coresight bus and drop the\n   reference to fwnode if *this* device is the target of the output\n   connection, via coresight_remove_conns()-\u003ecoresight_remove_match().\n\nHowever, the coresight_remove_match() doesn't clear the fwnode field,\nafter dropping the reference, this causes use-after-free and\nadditional refcount drops on the fwnode.\n\ne.g., if we have two devices, A and B, with a connection, A -\u003e B.\nIf we remove B first, B would clear the reference on B, from A\nvia coresight_remove_match(). But when A is removed, it still has\na connection with fwnode still pointing to B. Thus it tries to  drops\nthe reference in coresight_release_platform_data(), raising the bells\nlike :\n\n[   91.990153] ------------[ cut here ]------------\n[   91.990163] refcount_t: addition on 0; use-after-free.\n[   91.990212] WARNING: CPU: 0 PID: 461 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x144\n[   91.990260] Modules linked in: coresight_funnel coresight_replicator coresight_etm4x(-)\n crct10dif_ce coresight ip_tables x_tables ipv6 [last unloaded: coresight_cpu_debug]\n[   91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G        W       T 5.19.0-rc2+ #53\n[   91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb  1 2019\n[   91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   91.990454] pc : refcount_warn_saturate+0xa0/0x144\n[   91.990476] lr : refcount_warn_saturate+0xa0/0x144\n[   91.990496] sp : ffff80000c843640\n[   91.990509] x29: ffff80000c843640 x28: ffff800009957c28 x27: ffff80000c8439a8\n[   91.990560] x26: ffff00097eff1990 x25: ffff8000092b6ad8 x24: ffff00097eff19a8\n[   91.990610] x23: ffff80000c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2\n[   91.990659] x20: 0000000000000000 x19: ffff00097eff1a10 x18: ffff80000ab99c40\n[   91.990708] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80000abf6fa0\n[   91.990756] x14: 000000000000001d x13: 0a2e656572662d72 x12: 657466612d657375\n[   91.990805] x11: 203b30206e6f206e x10: 6f69746964646120 x9 : ffff8000081aba28\n[   91.990854] x8 : 206e6f206e6f6974 x7 : 69646461203a745f x6 : 746e756f63666572\n[   91.990903] x5 : ffff00097648ec58 x4 : 0000000000000000 x3 : 0000000000000027\n[   91.990952] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00080260ba00\n[   91.991000] Call trace:\n[   91.991012]  refcount_warn_saturate+0xa0/0x144\n[   91.991034]  kobject_get+0xac/0xb0\n[   91.991055]  of_node_get+0x2c/0x40\n[   91.991076]  of_fwnode_get+0x40/0x60\n[   91.991094]  fwnode_handle_get+0x3c/0x60\n[   91.991116]  fwnode_get_nth_parent+0xf4/0x110\n[   91.991137]  fwnode_full_name_string+0x48/0xc0\n[   91.991158]  device_node_string+0x41c/0x530\n[   91.991178]  pointer+0x320/0x3ec\n[   91.991198]  vsnprintf+0x23c/0x750\n[   91.991217]  vprintk_store+0x104/0x4b0\n[   91.991238]  vprintk_emit+0x8c/0x360\n[   91.991257]  vprintk_default+0x44/0x50\n[   91.991276]  vprintk+0xcc/0xf0\n[   91.991295]  _printk+0x68/0x90\n[   91.991315]  of_node_release+0x13c/0x14c\n[   91.991334]  kobject_put+0x98/0x114\n[   91.991354]  of_node_put+0x24/0x34\n[   91.991372]  of_fwnode_put+0x40/0x5c\n[   91.991390]  fwnode_handle_put+0x38/0x50\n[   91.991411]  coresight_release_platform_data+0x74/0xb0 [coresight]\n[   91.991472]  coresight_unregister+0x64/0xcc [coresight]\n[   91.991525]  etm4_remove_dev+0x64/0x78 [coresight_etm4x]\n[   91.991563]  etm4_remove_amba+0x1c/0x2c [coresight_etm4x]\n[   91.991598]  amba_remove+0x3c/0x19c\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "555eb601-106f-43be-8d98-1805a9a04a99",
      "id": "CVE-2023-53286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Return the firmware result upon destroying QP/RQ\n\nPreviously when destroying a QP/RQ, the result of the firmware\ndestruction function was ignored and upper layers weren't informed\nabout the failure.\nWhich in turn could lead to various problems since when upper layer\nisn't aware of the failure it continues its operation thinking that the\nrelated QP/RQ was successfully destroyed while it actually wasn't,\nwhich could lead to the below kernel WARN.\n\nCurrently, we return the correct firmware destruction status to upper\nlayers which in case of the RQ would be mlx5_ib_destroy_wq() which\nwas already capable of handling RQ destruction failure or in case of\na QP to destroy_qp_common(), which now would actually warn upon qp\ndestruction failure.\n\nWARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]\nModules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse\nCPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]\nCode: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 \u003c0f\u003e 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f\nRSP: 0018:ffff8881533e3e78 EFLAGS: 00010287\nRAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000\nRDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0\nRBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009\nR10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780\nR13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000\nFS:  00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ib_uverbs_close+0x1a/0x90 [ib_uverbs]\n __fput+0x82/0x230\n task_work_run+0x59/0x90\n exit_to_user_mode_prepare+0x138/0x140\n syscall_exit_to_user_mode+0x1d/0x50\n ? __x64_sys_close+0xe/0x40\n do_syscall_64+0x4a/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f8be3ae0abb\nCode: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44\nRSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003\nRAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb\nRDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005\nRBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8\nR13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f1b2f79-53d5-418e-af6c-2833a5aa2dcf",
      "id": "CVE-2022-50236",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: Fix crash on isr after kexec()\n\nIf the system is rebooted via isr(), the IRQ handler might\nbe triggered before the domain is initialized. Resulting on\nan invalid memory access error.\n\nFix:\n[    0.500930] Unable to handle kernel read from unreadable memory at virtual address 0000000000000070\n[    0.501166] Call trace:\n[    0.501174]  report_iommu_fault+0x28/0xfc\n[    0.501180]  mtk_iommu_isr+0x10c/0x1c0\n\n[ joro: Fixed spelling in commit message ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d54e673a-67c3-4314-abdd-dfc984a5779f",
      "id": "CVE-2022-50275",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Add the missed acpi_put_table() to fix memory leak\n\nWhen the radeon driver reads the bios information from ACPI\ntable in radeon_acpi_vfct_bios(), it misses to call acpi_put_table()\nto release the ACPI memory after the init, so add acpi_put_table()\nproperly to fix the memory leak.\n\nv2: fix text formatting (Alex)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba446dca-a391-424c-a9cf-d6041db1aa5e",
      "id": "CVE-2022-50315",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n\nUBSAN complains about array-index-out-of-bounds:\n[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41\n[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'\n[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu\n[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010\n[ 1.980718] kernel: Call Trace:\n[ 1.980721] kernel: \u003cTASK\u003e\n[ 1.980723] kernel: show_stack+0x52/0x58\n[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f\n[ 1.980734] kernel: dump_stack+0x10/0x12\n[ 1.980736] kernel: ubsan_epilogue+0x9/0x45\n[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]\n[ 1.980748] kernel: ata_qc_issue+0x135/0x240\n[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580\n[ 1.980754] kernel: ? vprintk_default+0x1d/0x20\n[ 1.980759] kernel: ata_exec_internal+0x67/0xa0\n[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0\n[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90\n[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310\n[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0\n[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30\n[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]\n[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]\n[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]\n[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0\n[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560\n[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40\n[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]\n[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600\n[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0\n[ 1.980813] kernel: scsi_error_handler+0xa1/0x180\n[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0\n[ 1.980820] kernel: kthread+0x12a/0x150\n[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50\n[ 1.980826] kernel: ret_from_fork+0x22/0x30\n[ 1.980831] kernel: \u003c/TASK\u003e\n\nThis happens because sata_pmp_init_links() initialize link-\u003epmp up to\nSATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.\n\nI can't find the maximum Enclosure Management ports specified in AHCI\nspec v1.3.1, but \"12.2.1 LED message type\" states that \"Port Multiplier\nInformation\" can utilize 4 bits, which implies it can support up to 16\nports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the\nissue.\n\nBugLink: https://bugs.launchpad.net/bugs/1970074",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "074df870-8101-482e-82c9-497e5f1b969f",
      "id": "CVE-2023-0266",
      "description": "A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "69983dd7-127e-4fdd-96dc-e47a383917f8",
      "id": "CVE-2023-52507",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: assert requested protocol is valid\n\nThe protocol is used in a bit mask to determine if the protocol is\nsupported. Assert the provided protocol is less than the maximum\ndefined so it doesn't potentially perform a shift-out-of-bounds and\nprovide a clearer error for undefined protocols vs unsupported ones.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9be5b46-513e-4b39-9487-2d4288c1f235",
      "id": "CVE-2023-52517",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain\n\nPreviously the transfer complete IRQ immediately drained to RX FIFO to\nread any data remaining in FIFO to the RX buffer. This behaviour is\ncorrect when dealing with SPI in interrupt mode. However in DMA mode the\ntransfer complete interrupt still fires as soon as all bytes to be\ntransferred have been stored in the FIFO. At that point data in the FIFO\nstill needs to be picked up by the DMA engine. Thus the drain procedure\nand DMA engine end up racing to read from RX FIFO, corrupting any data\nread. Additionally the RX buffer pointer is never adjusted according to\nDMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA\nmode is a bug.\nFix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode.\nAlso wait for completion of RX DMA when in DMA mode before returning to\nensure all data has been copied to the supplied memory buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb8729d4-f296-407d-9e2e-06ac1b1ff77f",
      "id": "CVE-2023-53326",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc: Don't try to copy PPR for task with NULL pt_regs\n\npowerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which\nfrom my (arguably very short) checking is not commonly done for other\narchs. This is fine, except when PF_IO_WORKER's have been created and\nthe task does something that causes a coredump to be generated. Then we\nget this crash:\n\n  Kernel attempted to read user page (160) - exploit attempt? (uid: 1000)\n  BUG: Kernel NULL pointer dereference on read at 0x00000160\n  Faulting instruction address: 0xc0000000000c3a60\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries\n  Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod\n  CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88\n  Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries\n  NIP:  c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0\n  REGS: c0000000041833b0 TRAP: 0300   Not tainted  (6.3.0-rc2+)\n  MSR:  800000000280b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 88082828  XER: 200400f8\n  ...\n  NIP memcpy_power7+0x200/0x7d0\n  LR  ppr_get+0x64/0xb0\n  Call Trace:\n    ppr_get+0x40/0xb0 (unreliable)\n    __regset_get+0x180/0x1f0\n    regset_get_alloc+0x64/0x90\n    elf_core_dump+0xb98/0x1b60\n    do_coredump+0x1c34/0x24a0\n    get_signal+0x71c/0x1410\n    do_notify_resume+0x140/0x6f0\n    interrupt_exit_user_prepare_main+0x29c/0x320\n    interrupt_exit_user_prepare+0x6c/0xa0\n    interrupt_return_srr_user+0x8/0x138\n\nBecause ppr_get() is trying to copy from a PF_IO_WORKER with a NULL\npt_regs.\n\nCheck for a valid pt_regs in both ppc_get/ppr_set, and return an error\nif not set. The actual error value doesn't seem to be important here, so\njust pick -EINVAL.\n\n[mpe: Trim oops in change log, add Fixes \u0026 Cc stable]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "21a88c6c-1e93-4959-aa7e-b2e4141af379",
      "id": "CVE-2023-52583",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix deadlock or deadcode of misusing dget()\n\nThe lock order is incorrect between denty and its parent, we should\nalways make sure that the parent get the lock first.\n\nBut since this deadcode is never used and the parent dir will always\nbe set from the callers, let's just remove it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84eb7ae3-fb3c-4ccc-ad4b-8f433967b41f",
      "id": "CVE-2023-52610",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix skb leak and crash on ooo frags\n\nact_ct adds skb-\u003eusers before defragmentation. If frags arrive in order,\nthe last frag's reference is reset in:\n\n  inet_frag_reasm_prepare\n    skb_morph\n\nwhich is not straightforward.\n\nHowever when frags arrive out of order, nobody unref the last frag, and\nall frags are leaked. The situation is even worse, as initiating packet\ncapture can lead to a crash[0] when skb has been cloned and shared at the\nsame time.\n\nFix the issue by removing skb_get() before defragmentation. act_ct\nreturns TC_ACT_CONSUMED when defrag failed or in progress.\n\n[0]:\n[  843.804823] ------------[ cut here ]------------\n[  843.809659] kernel BUG at net/core/skbuff.c:2091!\n[  843.814516] invalid opcode: 0000 [#1] PREEMPT SMP\n[  843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2\n[  843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022\n[  843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300\n[  843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b \u003c0f\u003e 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89\n[  843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202\n[  843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820\n[  843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00\n[  843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000\n[  843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880\n[  843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900\n[  843.871680] FS:  0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000\n[  843.876242] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0\n[  843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  843.894229] PKRU: 55555554\n[  843.898539] Call Trace:\n[  843.902772]  \u003cIRQ\u003e\n[  843.906922]  ? __die_body+0x1e/0x60\n[  843.911032]  ? die+0x3c/0x60\n[  843.915037]  ? do_trap+0xe2/0x110\n[  843.918911]  ? pskb_expand_head+0x2ac/0x300\n[  843.922687]  ? do_error_trap+0x65/0x80\n[  843.926342]  ? pskb_expand_head+0x2ac/0x300\n[  843.929905]  ? exc_invalid_op+0x50/0x60\n[  843.933398]  ? pskb_expand_head+0x2ac/0x300\n[  843.936835]  ? asm_exc_invalid_op+0x1a/0x20\n[  843.940226]  ? pskb_expand_head+0x2ac/0x300\n[  843.943580]  inet_frag_reasm_prepare+0xd1/0x240\n[  843.946904]  ip_defrag+0x5d4/0x870\n[  843.950132]  nf_ct_handle_fragments+0xec/0x130 [nf_conntrack]\n[  843.953334]  tcf_ct_act+0x252/0xd90 [act_ct]\n[  843.956473]  ? tcf_mirred_act+0x516/0x5a0 [act_mirred]\n[  843.959657]  tcf_action_exec+0xa1/0x160\n[  843.962823]  fl_classify+0x1db/0x1f0 [cls_flower]\n[  843.966010]  ? skb_clone+0x53/0xc0\n[  843.969173]  tcf_classify+0x24d/0x420\n[  843.972333]  tc_run+0x8f/0xf0\n[  843.975465]  __netif_receive_skb_core+0x67a/0x1080\n[  843.978634]  ? dev_gro_receive+0x249/0x730\n[  843.981759]  __netif_receive_skb_list_core+0x12d/0x260\n[  843.984869]  netif_receive_skb_list_internal+0x1cb/0x2f0\n[  843.987957]  ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core]\n[  843.991170]  napi_complete_done+0x72/0x1a0\n[  843.994305]  mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core]\n[  843.997501]  __napi_poll+0x25/0x1b0\n[  844.000627]  net_rx_action+0x256/0x330\n[  844.003705]  __do_softirq+0xb3/0x29b\n[  844.006718]  irq_exit_rcu+0x9e/0xc0\n[  844.009672]  common_interrupt+0x86/0xa0\n[  844.012537]  \u003c/IRQ\u003e\n[  844.015285]  \u003cTASK\u003e\n[  844.017937]  asm_common_interrupt+0x26/0x40\n[  844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20\n[  844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8bb85e7c-8b3f-4bd0-a9f9-c7cc15fe5065",
      "id": "CVE-2023-52789",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: Add check for kstrdup() in vcc_probe()\n\nAdd check for the return value of kstrdup() and return the error, if it\nfails in order to avoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0913b8d5-b6f8-4e7a-ac05-de870fe9a6da",
      "id": "CVE-2023-52888",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Only free buffer VA that is not NULL\n\nIn the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly\ncalled only when the buffer to free exists, there are some instances\nthat didn't do the check and triggered warnings in practice.\n\nWe believe those checks were forgotten unintentionally. Add the checks\nback to fix the warnings.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48c39b76-11e5-45f4-86ab-0fb7fb742b75",
      "id": "CVE-2023-52894",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()\n\nIn Google internal bug 265639009 we've received an (as yet) unreproducible\ncrash report from an aarch64 GKI 5.10.149-android13 running device.\n\nAFAICT the source code is at:\n  https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10\n\nThe call stack is:\n  ncm_close() -\u003e ncm_notify() -\u003e ncm_do_notify()\nwith the crash at:\n  ncm_do_notify+0x98/0x270\nCode: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)\n\nWhich I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):\n\n  // halfword (16-bit) store presumably to event-\u003ewLength (at offset 6 of struct usb_cdc_notification)\n  0B 0D 00 79    strh w11, [x8, #6]\n\n  // word (32-bit) store presumably to req-\u003eLength (at offset 8 of struct usb_request)\n  6C 0A 00 B9    str  w12, [x19, #8]\n\n  // x10 (NULL) was read here from offset 0 of valid pointer x9\n  // IMHO we're reading 'cdev-\u003egadget' and getting NULL\n  // gadget is indeed at offset 0 of struct usb_composite_dev\n  2A 01 40 F9    ldr  x10, [x9]\n\n  // loading req-\u003ebuf pointer, which is at offset 0 of struct usb_request\n  69 02 40 F9    ldr  x9, [x19]\n\n  // x10 is null, crash, appears to be attempt to read cdev-\u003egadget-\u003emax_speed\n  4B 5D 40 B9    ldr  w11, [x10, #0x5c]\n\nwhich seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:\n\n  event-\u003ewLength = cpu_to_le16(8);\n  req-\u003elength = NCM_STATUS_BYTECOUNT;\n\n  /* SPEED_CHANGE data is up/down speeds in bits/sec */\n  data = req-\u003ebuf + sizeof *event;\n  data[0] = cpu_to_le32(ncm_bitrate(cdev-\u003egadget));\n\nMy analysis of registers and NULL ptr deref crash offset\n  (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)\nheavily suggests that the crash is due to 'cdev-\u003egadget' being NULL when executing:\n  data[0] = cpu_to_le32(ncm_bitrate(cdev-\u003egadget));\nwhich calls:\n  ncm_bitrate(NULL)\nwhich then calls:\n  gadget_is_superspeed(NULL)\nwhich reads\n  ((struct usb_gadget *)NULL)-\u003emax_speed\nand hits a panic.\n\nAFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.\n(remember there's a GKI KABI reservation of 16 bytes in struct work_struct)\n\nIt's not at all clear to me how this is all supposed to work...\nbut returning 0 seems much better than panic-ing...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d75900d-80cd-41e1-91a1-dad707e64f3a",
      "id": "CVE-2023-53019",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdio: validate parameter addr in mdiobus_get_phy()\n\nThe caller may pass any value as addr, what may result in an out-of-bounds\naccess to array mdio_map. One existing case is stmmac_init_phy() that\nmay pass -1 as addr. Therefore validate addr before using it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b939e88-d376-4066-8a20-269160519345",
      "id": "CVE-2023-53209",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: Fix possible NULL dereference\n\nIn a call to mac80211_hwsim_select_tx_link() the sta pointer might\nbe NULL, thus need to check that it is not NULL before accessing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7809c0f8-b0d4-4bf7-99c5-05e0f37aee82",
      "id": "CVE-2023-53346",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/fail_function: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ea01bf0-41c7-42f4-8f8a-6cbe4d9944c9",
      "id": "CVE-2024-26642",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: disallow anonymous set with timeout flag\n\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "550a6216-d25c-4ee2-88a3-1864040d1ce3",
      "id": "CVE-2024-26993",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: sysfs: Fix reference leak in sysfs_break_active_protection()\n\nThe sysfs_break_active_protection() routine has an obvious reference\nleak in its error path.  If the call to kernfs_find_and_get() fails then\nkn will be NULL, so the companion sysfs_unbreak_active_protection()\nroutine won't get called (and would only cause an access violation by\ntrying to dereference kn-\u003eparent if it was called).  As a result, the\nreference to kobj acquired at the start of the function will never be\nreleased.\n\nFix the leak by adding an explicit kobject_put() call when kn is NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e59fd16d-3f5a-425d-add7-ccea8a5525ba",
      "id": "CVE-2024-27073",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ttpci: fix two memleaks in budget_av_attach\n\nWhen saa7146_register_device and saa7146_vv_init fails, budget_av_attach\nshould free the resources it allocates, like the error-handling of\nttpci_budget_init does. Besides, there are two fixme comment refers to\nsuch deallocations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a09425e7-cc97-4889-90c9-485419878427",
      "id": "CVE-2024-42069",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a740fc2f-8fe0-4f33-bec9-ad258d30e250",
      "id": "CVE-2024-35929",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()\n\nFor the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and\nCONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE()\nin the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions:\n\n        CPU2                                               CPU11\nkthread\nrcu_nocb_cb_kthread                                       ksys_write\nrcu_do_batch                                              vfs_write\nrcu_torture_timer_cb                                      proc_sys_write\n__kmem_cache_free                                         proc_sys_call_handler\nkmemleak_free                                             drop_caches_sysctl_handler\ndelete_object_full                                        drop_slab\n__delete_object                                           shrink_slab\nput_object                                                lazy_rcu_shrink_scan\ncall_rcu                                                  rcu_nocb_flush_bypass\n__call_rcu_commn                                            rcu_nocb_bypass_lock\n                                                            raw_spin_trylock(\u0026rdp-\u003enocb_bypass_lock) fail\n                                                            atomic_inc(\u0026rdp-\u003enocb_lock_contended);\nrcu_nocb_wait_contended                                     WARN_ON_ONCE(smp_processor_id() != rdp-\u003ecpu);\n WARN_ON_ONCE(atomic_read(\u0026rdp-\u003enocb_lock_contended))                                          |\n                            |_ _ _ _ _ _ _ _ _ _same rdp and rdp-\u003ecpu != 11_ _ _ _ _ _ _ _ _ __|\n\nReproduce this bug with \"echo 3 \u003e /proc/sys/vm/drop_caches\".\n\nThis commit therefore uses rcu_nocb_try_flush_bypass() instead of\nrcu_nocb_flush_bypass() in lazy_rcu_shrink_scan().  If the nocb_bypass\nqueue is being flushed, then rcu_nocb_try_flush_bypass will return\ndirectly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "31f96452-2ba3-4066-ae60-9421458405be",
      "id": "CVE-2024-35966",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix not validating setsockopt user input\n\nsyzbot reported rfcomm_sock_setsockopt_old() is copying data without\nchecking user input length.\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old\nnet/bluetooth/rfcomm/sock.c:632 [inline]\nBUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70\nnet/bluetooth/rfcomm/sock.c:673\nRead of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4fa9c1e-d762-4e4a-a531-b0508362f585",
      "id": "CVE-2024-36909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d0cadb1-6126-48dc-9795-a30589915610",
      "id": "CVE-2024-36924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()\n\nlpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the\nhbalock.  Thus, lpfc_worker_wake_up() should not be called while holding the\nhbalock to avoid potential deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "736e7e0a-7898-43b4-82e6-d6b78332c443",
      "id": "CVE-2024-38613",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nm68k: Fix spinlock race in kernel thread creation\n\nContext switching does take care to retain the correct lock owner across\nthe switch from 'prev' to 'next' tasks.  This does rely on interrupts\nremaining disabled for the entire duration of the switch.\n\nThis condition is guaranteed for normal process creation and context\nswitching between already running processes, because both 'prev' and\n'next' already have interrupts disabled in their saved copies of the\nstatus register.\n\nThe situation is different for newly created kernel threads.  The status\nregister is set to PS_S in copy_thread(), which does leave the IPL at 0.\nUpon restoring the 'next' thread's status register in switch_to() aka\nresume(), interrupts then become enabled prematurely.  resume() then\nreturns via ret_from_kernel_thread() and schedule_tail() where run queue\nlock is released (see finish_task_switch() and finish_lock_switch()).\n\nA timer interrupt calling scheduler_tick() before the lock is released\nin finish_task_switch() will find the lock already taken, with the\ncurrent task as lock owner.  This causes a spinlock recursion warning as\nreported by Guenter Roeck.\n\nAs far as I can ascertain, this race has been opened in commit\n533e6903bea0 (\"m68k: split ret_from_fork(), simplify kernel_thread()\")\nbut I haven't done a detailed study of kernel history so it may well\npredate that commit.\n\nInterrupts cannot be disabled in the saved status register copy for\nkernel threads (init will complain about interrupts disabled when\nfinally starting user space).  Disable interrupts temporarily when\nswitching the tasks' register sets in resume().\n\nNote that a simple oriw 0x700,%sr after restoring sr is not enough here\n- this leaves enough of a race for the 'spinlock recursion' warning to\nstill be observed.\n\nTested on ARAnyM and qemu (Quadra 800 emulation).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7720a64-ce28-45f8-8f1a-c6de4af1e04d",
      "id": "CVE-2024-41035",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor\n\nSyzbot has identified a bug in usbcore (see the Closes: tag below)\ncaused by our assumption that the reserved bits in an endpoint\ndescriptor's bEndpointAddress field will always be 0.  As a result of\nthe bug, the endpoint_is_duplicate() routine in config.c (and possibly\nother routines as well) may believe that two descriptors are for\ndistinct endpoints, even though they have the same direction and\nendpoint number.  This can lead to confusion, including the bug\nidentified by syzbot (two descriptors with matching endpoint numbers\nand directions, where one was interrupt and the other was bulk).\n\nTo fix the bug, we will clear the reserved bits in bEndpointAddress\nwhen we parse the descriptor.  (Note that both the USB-2.0 and USB-3.1\nspecs say these bits are \"Reserved, reset to zero\".)  This requires us\nto make a copy of the descriptor earlier in usb_parse_endpoint() and\nuse the copy instead of the original when checking for duplicates.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65d85d1c-ef67-4ba1-ba49-c35e8a308914",
      "id": "CVE-2024-42080",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/restrack: Fix potential invalid address access\n\nstruct rdma_restrack_entry's kern_name was set to KBUILD_MODNAME\nin ib_create_cq(), while if the module exited but forgot del this\nrdma_restrack_entry, it would cause a invalid address access in\nrdma_restrack_clean() when print the owner of this rdma_restrack_entry.\n\nThese code is used to help find one forgotten PD release in one of the\nULPs. But it is not needed anymore, so delete them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86584c57-7ba2-41a1-9333-84de56ca2cc7",
      "id": "CVE-2024-42115",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: Fix potential illegal address access in jffs2_free_inode\n\nDuring the stress testing of the jffs2 file system,the following\nabnormal printouts were found:\n[ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948\n[ 2430.649622] Mem abort info:\n[ 2430.649829]   ESR = 0x96000004\n[ 2430.650115]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 2430.650564]   SET = 0, FnV = 0\n[ 2430.650795]   EA = 0, S1PTW = 0\n[ 2430.651032]   FSC = 0x04: level 0 translation fault\n[ 2430.651446] Data abort info:\n[ 2430.651683]   ISV = 0, ISS = 0x00000004\n[ 2430.652001]   CM = 0, WnR = 0\n[ 2430.652558] [0069696969696948] address between user and kernel address ranges\n[ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP\n[ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33\n[ 2430.655008] Hardware name: linux,dummy-virt (DT)\n[ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 2430.656142] pc : kfree+0x78/0x348\n[ 2430.656630] lr : jffs2_free_inode+0x24/0x48\n[ 2430.657051] sp : ffff800009eebd10\n[ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000\n[ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000\n[ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14\n[ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000\n[ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000\n[ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19\n[ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14\n[ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302\n[ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342\n[ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000\n[ 2430.664217] Call trace:\n[ 2430.664528]  kfree+0x78/0x348\n[ 2430.664855]  jffs2_free_inode+0x24/0x48\n[ 2430.665233]  i_callback+0x24/0x50\n[ 2430.665528]  rcu_do_batch+0x1ac/0x448\n[ 2430.665892]  rcu_core+0x28c/0x3c8\n[ 2430.666151]  rcu_core_si+0x18/0x28\n[ 2430.666473]  __do_softirq+0x138/0x3cc\n[ 2430.666781]  irq_exit+0xf0/0x110\n[ 2430.667065]  handle_domain_irq+0x6c/0x98\n[ 2430.667447]  gic_handle_irq+0xac/0xe8\n[ 2430.667739]  call_on_irq_stack+0x28/0x54\nThe parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of\nthe jffs_inode_info structure. It was found that all variables in the jffs_inode_info\nstructure were 5a5a5a5a, except for the first member sem. It is suspected that these\nvariables are not initialized because they were set to 5a5a5a5a during memory testing,\nwhich is meant to detect uninitialized memory.The sem variable is initialized in the\nfunction jffs2_i_init_once, while other members are initialized in\nthe function jffs2_init_inode_info.\n\nThe function jffs2_init_inode_info is called after iget_locked,\nbut in the iget_locked function, the destroy_inode process is triggered,\nwhich releases the inode and consequently, the target member of the inode\nis not initialized.In concurrent high pressure scenarios, iget_locked\nmay enter the destroy_inode branch as described in the code.\n\nSince the destroy_inode functionality of jffs2 only releases the target,\nthe fix method is to set target to NULL in jffs2_i_init_once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e3cb69dc-9167-4551-883e-8b4c07dcfc43",
      "id": "CVE-2024-42136",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncdrom: rearrange last_media_change check to avoid unintentional overflow\n\nWhen running syzkaller with the newly reintroduced signed integer wrap\nsanitizer we encounter this splat:\n\n[  366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33\n[  366.021089] -9223372036854775808 - 346321 cannot be represented in type '__s64' (aka 'long long')\n[  366.025894] program syz-executor.4 is using a deprecated SCSI ioctl, please convert it to SG_IO\n[  366.027502] CPU: 5 PID: 28472 Comm: syz-executor.7 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1\n[  366.027512] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  366.027518] Call Trace:\n[  366.027523]  \u003cTASK\u003e\n[  366.027533]  dump_stack_lvl+0x93/0xd0\n[  366.027899]  handle_overflow+0x171/0x1b0\n[  366.038787] ata1.00: invalid multi_count 32 ignored\n[  366.043924]  cdrom_ioctl+0x2c3f/0x2d10\n[  366.063932]  ? __pm_runtime_resume+0xe6/0x130\n[  366.071923]  sr_block_ioctl+0x15d/0x1d0\n[  366.074624]  ? __pfx_sr_block_ioctl+0x10/0x10\n[  366.077642]  blkdev_ioctl+0x419/0x500\n[  366.080231]  ? __pfx_blkdev_ioctl+0x10/0x10\n...\n\nHistorically, the signed integer overflow sanitizer did not work in the\nkernel due to its interaction with `-fwrapv` but this has since been\nchanged [1] in the newest version of Clang. It was re-enabled in the\nkernel with Commit 557f8c582a9ba8ab (\"ubsan: Reintroduce signed overflow\nsanitizer\").\n\nLet's rearrange the check to not perform any arithmetic, thus not\ntripping the sanitizer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cae214f7-ca78-4664-a6ff-4129a84e2145",
      "id": "CVE-2024-42159",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Sanitise num_phys\n\nInformation is stored in mr_sas_port-\u003ephy_mask, values larger then size of\nthis field shouldn't be allowed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9953bec-58b3-4928-8ba6-68df2c23ad52",
      "id": "CVE-2024-44938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix shift-out-of-bounds in dbDiscardAG\n\nWhen searching for the next smaller log2 block, BLKSTOL2() returned 0,\ncausing shift exponent -1 to be negative.\n\nThis patch fixes the issue by exiting the loop directly when negative\nshift is found.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93adab01-1ecd-40f5-a952-896bb732deb8",
      "id": "CVE-2024-46731",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix the Out-of-bounds read warning\n\nusing index i - 1U may beyond element index\nfor mc_data[] when i = 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2f9d612c-2ea4-4445-9d5e-a55692885841",
      "id": "CVE-2024-46771",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: Remove proc entry when dev is unregistered.\n\nsyzkaller reported a warning in bcm_connect() below. [0]\n\nThe repro calls connect() to vxcan1, removes vxcan1, and calls\nconnect() with ifindex == 0.\n\nCalling connect() for a BCM socket allocates a proc entry.\nThen, bcm_sk(sk)-\u003ebound is set to 1 to prevent further connect().\n\nHowever, removing the bound device resets bcm_sk(sk)-\u003ebound to 0\nin bcm_notify().\n\nThe 2nd connect() tries to allocate a proc entry with the same\nname and sets NULL to bcm_sk(sk)-\u003ebcm_proc_read, leaking the\noriginal proc entry.\n\nSince the proc entry is available only for connect()ed sockets,\nlet's clean up the entry when the bound netdev is unregistered.\n\n[0]:\nproc_dir_entry 'can-bcm/2456' already registered\nWARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 proc_register+0x645/0x8f0 fs/proc/generic.c:375\nModules linked in:\nCPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc2dd4\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:proc_register+0x645/0x8f0 fs/proc/generic.c:375\nCode: 00 00 00 00 00 48 85 ed 0f 85 97 02 00 00 4d 85 f6 0f 85 9f 02 00 00 48 c7 c7 9b cb cf 87 48 89 de 4c 89 fa e8 1c 6f eb fe 90 \u003c0f\u003e 0b 90 90 48 c7 c7 98 37 99 89 e8 cb 7e 22 05 bb 00 00 00 10 48\nRSP: 0018:ffa0000000cd7c30 EFLAGS: 00010246\nRAX: 9e129be1950f0200 RBX: ff1100011b51582c RCX: ff1100011857cd80\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002\nRBP: 0000000000000000 R08: ffd400000000000f R09: ff1100013e78cac0\nR10: ffac800000cd7980 R11: ff1100013e12b1f0 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: ff1100011a99a2ec\nFS:  00007fbd7086f740(0000) GS:ff1100013fd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200071c0 CR3: 0000000118556004 CR4: 0000000000771ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n proc_create_net_single+0x144/0x210 fs/proc/proc_net.c:220\n bcm_connect+0x472/0x840 net/can/bcm.c:1673\n __sys_connect_file net/socket.c:2049 [inline]\n __sys_connect+0x5d2/0x690 net/socket.c:2066\n __do_sys_connect net/socket.c:2076 [inline]\n __se_sys_connect net/socket.c:2073 [inline]\n __x64_sys_connect+0x8f/0x100 net/socket.c:2073\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1c0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\nRIP: 0033:0x7fbd708b0e5d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48\nRSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbd708b0e5d\nRDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000040\nR10: 0000000000000040 R11: 0000000000000246 R12: 00007fff8cd34098\nR13: 0000000000401280 R14: 0000000000406de8 R15: 00007fbd70ab9000\n \u003c/TASK\u003e\nremove_proc_entry: removing non-empty directory 'net/can-bcm', leaking at least '2456'",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d24daf44-373d-4fbb-9281-cf180cb7ff4c",
      "id": "CVE-2023-1118",
      "description": "A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4c81b7d2-79e1-4165-bfc8-253bd28aaaea",
      "id": "CVE-2024-46818",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check gpio_id before used as array index\n\n[WHY \u0026 HOW]\nGPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore\nshould be checked in advance.\n\nThis fixes 5 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b5e5230-9a28-48d1-9e26-2ac838fbf36c",
      "id": "CVE-2024-46827",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix firmware crash due to invalid peer nss\n\nCurrently, if the access point receives an association\nrequest containing an Extended HE Capabilities Information\nElement with an invalid MCS-NSS, it triggers a firmware\ncrash.\n\nThis issue arises when EHT-PHY capabilities shows support\nfor a bandwidth and MCS-NSS set for that particular\nbandwidth is filled by zeros and due to this, driver obtains\npeer_nss as 0 and sending this value to firmware causes\ncrash.\n\nAddress this issue by implementing a validation step for\nthe peer_nss value before passing it to the firmware. If\nthe value is greater than zero, proceed with forwarding\nit to the firmware. However, if the value is invalid,\nreject the association request to prevent potential\nfirmware crashes.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10d3f7d2-3169-457f-89bf-64a6caf4c269",
      "id": "CVE-2024-47662",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Remove register from DCN35 DMCUB diagnostic collection\n\n[Why]\nThese registers should not be read from driver and triggering the\nsecurity violation when DMCUB work times out and diagnostics are\ncollected blocks Z8 entry.\n\n[How]\nRemove the register read from DCN35.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4b08811-f550-49a6-bfa9-df246a03be67",
      "id": "CVE-2024-49883",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: aovid use-after-free in ext4_ext_insert_extent()\n\nAs Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is\nreallocated in ext4_ext_create_new_leaf(), we'll use the stale path and\ncause UAF. Below is a sample trace with dummy values:\n\next4_ext_insert_extent\n  path = *ppath = 2000\n  ext4_ext_create_new_leaf(ppath)\n    ext4_find_extent(ppath)\n      path = *ppath = 2000\n      if (depth \u003e path[0].p_maxdepth)\n            kfree(path = 2000);\n            *ppath = path = NULL;\n      path = kcalloc() = 3000\n      *ppath = 3000;\n      return path;\n  /* here path is still 2000, UAF! */\n  eh = path[depth].p_hdr\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330\nRead of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179\nCPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866\nCall Trace:\n \u003cTASK\u003e\n ext4_ext_insert_extent+0x26d4/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n[...]\n\nAllocated by task 179:\n ext4_find_extent+0x81c/0x1f70\n ext4_ext_map_blocks+0x146/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n\nFreed by task 179:\n kfree+0xcb/0x240\n ext4_find_extent+0x7c0/0x1f70\n ext4_ext_insert_extent+0xa26/0x3330\n ext4_ext_map_blocks+0xe22/0x2d40\n ext4_map_blocks+0x71e/0x1700\n ext4_do_writepages+0x1290/0x2800\n ext4_writepages+0x26d/0x4e0\n do_writepages+0x175/0x700\n[...]\n==================================================================\n\nSo use *ppath to update the path to avoid the above problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7b3f157b-d258-4659-a836-ece2e9d5e811",
      "id": "CVE-2024-49915",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn32_init_hw` function. The issue could occur when `dc-\u003eclk_mgr` is\nnull.\n\nThe fix adds a check to ensure `dc-\u003eclk_mgr` is not null before\naccessing its functions. This prevents a potential null pointer\ndereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc-\u003eclk_mgr' could be null (see line 782)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ed3d059-6616-498c-b732-6d8b5f62ef57",
      "id": "CVE-2024-49985",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume\n\nIn case there is any sort of clock controller attached to this I2C bus\ncontroller, for example Versaclock or even an AIC32x4 I2C codec, then\nan I2C transfer triggered from the clock controller clk_ops .prepare\ncallback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.\n\nThis is because the clock controller first grabs the prepare_lock mutex\nand then performs the prepare operation, including its I2C access. The\nI2C access resumes this I2C bus controller via .runtime_resume callback,\nwhich calls clk_prepare_enable(), which attempts to grab the prepare_lock\nmutex again and deadlocks.\n\nSince the clock are already prepared since probe() and unprepared in\nremove(), use simple clk_enable()/clk_disable() calls to enable and\ndisable the clock on runtime suspend and resume, to avoid hitting the\nprepare_lock mutex.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b1a3135-e721-4cd7-9e69-aa648a5e56c5",
      "id": "CVE-2024-49991",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer\n\nPass pointer reference to amdgpu_bo_unref to clear the correct pointer,\notherwise amdgpu_bo_unref clear the local variable, the original pointer\nnot set to NULL, this could cause use-after-free bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93d14ad4-85a6-4369-b8b0-9421333f6939",
      "id": "CVE-2024-50035",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: fix ppp_async_encode() illegal access\n\nsyzbot reported an issue in ppp_async_encode() [1]\n\nIn this case, pppoe_sendmsg() is called with a zero size.\nThen ppp_async_encode() is called with an empty skb.\n\nBUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n  ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n  ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n  ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634\n  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline]\n  ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304\n  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n  __release_sock+0x1da/0x330 net/core/sock.c:3072\n  release_sock+0x6b/0x250 net/core/sock.c:3626\n  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4092 [inline]\n  slab_alloc_node mm/slub.c:4135 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1322 [inline]\n  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57f47b2e-41d7-4d10-a08c-587915097e18",
      "id": "CVE-2024-50171",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: fix potential memory leak in bcm_sysport_xmit()\n\nThe bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb\nin case of dma_map_single() fails, add dev_kfree_skb() to fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7477151-2a27-4f8f-823e-81508ab49b5b",
      "id": "CVE-2024-50245",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix possible deadlock in mi_read\n\nMutex lock with another subclass used in ni_lock_dir().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7c58502-b719-4f96-90ea-92d7fabedee0",
      "id": "CVE-2024-50278",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix potential out-of-bounds access on the first resume\n\nOut-of-bounds access occurs if the fast device is expanded unexpectedly\nbefore the first-time resume of the cache table. This happens because\nexpanding the fast device requires reloading the cache table for\ncache_create to allocate new in-core data structures that fit the new\nsize, and the check in cache_preresume is not performed during the\nfirst resume, leading to the issue.\n\nReproduce steps:\n\n1. prepare component devices:\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\n\n2. load a cache table of 512 cache blocks, and deliberately expand the\n   fast device before resuming the cache, making the in-core data\n   structures inadequate.\n\ndmsetup create cache --notable\ndmsetup reload cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\ndmsetup reload cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup resume cdata\ndmsetup resume cache\n\n3. suspend the cache to write out the in-core dirty bitset and hint\n   array, leading to out-of-bounds access to the dirty bitset at offset\n   0x40:\n\ndmsetup suspend cache\n\nKASAN reports:\n\n  BUG: KASAN: vmalloc-out-of-bounds in is_dirty_callback+0x2b/0x80\n  Read of size 8 at addr ffffc90000085040 by task dmsetup/90\n\n  (...snip...)\n  The buggy address belongs to the virtual mapping at\n   [ffffc90000085000, ffffc90000087000) created by:\n   cache_ctr+0x176a/0x35f0\n\n  (...snip...)\n  Memory state around the buggy address:\n   ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  \u003effffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8\n                                             ^\n   ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n   ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\nFix by checking the size change on the first resume.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f0e6862-0611-4465-be4b-c47d0038b867",
      "id": "CVE-2025-23157",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: add check to avoid out of bound access\n\nThere is a possibility that init_codecs is invoked multiple times during\nmanipulated payload from video firmware. In such case, if codecs_count\ncan get incremented to value more than MAX_CODEC_NUM, there can be OOB\naccess. Reset the count so that it always starts from beginning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3731a637-afba-489f-9a36-917f34622062",
      "id": "CVE-2024-53131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix null-ptr-deref in block_touch_buffer tracepoint\n\nPatch series \"nilfs2: fix null-ptr-deref bugs on block tracepoints\".\n\nThis series fixes null pointer dereference bugs that occur when using\nnilfs2 and two block-related tracepoints.\n\n\nThis patch (of 2):\n\nIt has been reported that when using \"block:block_touch_buffer\"\ntracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a\nNULL pointer dereference, or a general protection fault when KASAN is\nenabled.\n\nThis happens because since the tracepoint was added in touch_buffer(), it\nreferences the dev_t member bh-\u003eb_bdev-\u003ebd_dev regardless of whether the\nbuffer head has a pointer to a block_device structure.  In the current\nimplementation, the block_device structure is set after the function\nreturns to the caller.\n\nHere, touch_buffer() is used to mark the folio/page that owns the buffer\nhead as accessed, but the common search helper for folio/page used by the\ncaller function was optimized to mark the folio/page as accessed when it\nwas reimplemented a long time ago, eliminating the need to call\ntouch_buffer() here in the first place.\n\nSo this solves the issue by eliminating the touch_buffer() call itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c827a3d4-8fc4-4e73-bb0e-fcdc197ce58a",
      "id": "CVE-2024-56594",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: set the right AMDGPU sg segment limitation\n\nThe driver needs to set the correct max_segment_size;\notherwise debug_dma_map_sg() will complain about the\nover-mapping of the AMDGPU sg length as following:\n\nWARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370\n[  364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd\n[  364.049532]  ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii\n[  364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G           OE      6.10.0-custom #492\n[  364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021\n[  364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370\n[  364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff \u003c0f\u003e 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05\n[  364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286\n[  364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027\n[  364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680\n[  364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930\n[  364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000\n[  364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800\n[  364.049599] FS:  00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000\n[  364.049601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0\n[  364.049605] Call Trace:\n[  364.049607]  \u003cTASK\u003e\n[  364.049609]  ? show_regs+0x6d/0x80\n[  364.049614]  ? __warn+0x8c/0x140\n[  364.049618]  ? debug_dma_map_sg+0x2dc/0x370\n[  364.049621]  ? report_bug+0x193/0x1a0\n[  364.049627]  ? handle_bug+0x46/0x80\n[  364.049631]  ? exc_invalid_op+0x1d/0x80\n[  364.049635]  ? asm_exc_invalid_op+0x1f/0x30\n[  364.049642]  ? debug_dma_map_sg+0x2dc/0x370\n[  364.049647]  __dma_map_sg_attrs+0x90/0xe0\n[  364.049651]  dma_map_sgtable+0x25/0x40\n[  364.049654]  amdgpu_bo_move+0x59a/0x850 [amdgpu]\n[  364.049935]  ? srso_return_thunk+0x5/0x5f\n[  364.049939]  ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu]\n[  364.050095]  ttm_bo_handle_move_mem+0xc3/0x180 [ttm]\n[  364.050103]  ttm_bo_validate+0xc1/0x160 [ttm]\n[  364.050108]  ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu]\n[  364.050263]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu]\n[  364.050473]  kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu]\n[  364.050680]  kfd_ioctl+0x3c2/0x530 [amdgpu]\n[  364.050866]  ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu]\n[  364.05105\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d8a7a594-4dc8-4c6b-a1bb-a6f2a856bdda",
      "id": "CVE-2024-56629",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix when get product name maybe null pointer\n\nDue to incorrect dev-\u003eproduct reporting by certain devices, null\npointer dereferences occur when dev-\u003eproduct is empty, leading to\npotential system crashes.\n\nThis issue was found on EXCELSIOR DL37-D05 device with\nLoongson-LS3A6000-7A2000-DL37 motherboard.\n\nKernel logs:\n[   56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci\n[   56.671638] usb 4-3: string descriptor 0 read error: -22\n[   56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07\n[   56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3\n[   56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0\n[   56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80\n[   56.697732] Oops[#1]:\n[   56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G           OE      6.6.0-loong64-desktop #25.00.2000.015\n[   56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024\n[   56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0\n[   56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000\n[   56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000\n[   56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005\n[   56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000\n[   56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028\n[   56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000\n[   56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000\n[   56.697753]    ra: ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom]\n[   56.697802]   ERA: 90000000066e35c8 strstr+0x28/0x120\n[   56.697806]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n[   56.697816]  PRMD: 0000000c (PPLV0 +PIE +PWE)\n[   56.697821]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n[   56.697827]  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n[   56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n[   56.697835]  BADV: 0000000000000000\n[   56.697836]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)\n[   56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit\n[   56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3)\n[   56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000\n[   56.697896]         0000000000000000 00000011fffffffd 0000000000000000 0000000000000000\n[   56.697901]         0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0\n[   56.697906]         90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c\n[   56.697911]         90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440\n[   56.697916]         ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0\n[   56.697921]         0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c\n[   56.697926]         ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000\n[   56.697931]         90000001000bb8d0 \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d619b730-9705-4f4b-bf1e-2a26d5d3bf3e",
      "id": "CVE-2024-57975",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when run_delalloc_nocow() failed\n\n[BUG]\nWith CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash\nwith the following VM_BUG_ON_FOLIO():\n\n  BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28\n  BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28\n  page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664\n  aops:btrfs_aops [btrfs] ino:101 dentry name(?):\"f1774\"\n  flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)\n  page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n  ------------[ cut here ]------------\n  kernel BUG at mm/page-writeback.c:2992!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G           OE      6.12.0-rc7-custom+ #87\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : folio_clear_dirty_for_io+0x128/0x258\n  lr : folio_clear_dirty_for_io+0x128/0x258\n  Call trace:\n   folio_clear_dirty_for_io+0x128/0x258\n   btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]\n   __process_folios_contig+0x154/0x268 [btrfs]\n   extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]\n   run_delalloc_nocow+0x5f8/0x760 [btrfs]\n   btrfs_run_delalloc_range+0xa8/0x220 [btrfs]\n   writepage_delalloc+0x230/0x4c8 [btrfs]\n   extent_writepage+0xb8/0x358 [btrfs]\n   extent_write_cache_pages+0x21c/0x4e8 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x178/0x3a8 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThe first two lines of extra debug messages show the problem is caused\nby the error handling of run_delalloc_nocow().\n\nE.g. we have the following dirtied range (4K blocksize 4K page size):\n\n    0                 16K                  32K\n    |//////////////////////////////////////|\n    |  Pre-allocated  |\n\nAnd the range [0, 16K) has a preallocated extent.\n\n- Enter run_delalloc_nocow() for range [0, 16K)\n  Which found range [0, 16K) is preallocated, can do the proper NOCOW\n  write.\n\n- Enter fallback_to_fow() for range [16K, 32K)\n  Since the range [16K, 32K) is not backed by preallocated extent, we\n  have to go COW.\n\n- cow_file_range() failed for range [16K, 32K)\n  So cow_file_range() will do the clean up by clearing folio dirty,\n  unlock the folios.\n\n  Now the folios in range [16K, 32K) is unlocked.\n\n- Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()\n  Which is called with PAGE_START_WRITEBACK to start page writeback.\n  But folios can only be marked writeback when it's properly locked,\n  thus this triggered the VM_BUG_ON_FOLIO().\n\nFurthermore there is another hidden but common bug that\nrun_delalloc_nocow() is not clearing the folio dirty flags in its error\nhandling path.\nThis is the common bug shared between run_delalloc_nocow() and\ncow_file_range().\n\n[FIX]\n- Clear folio dirty for range [@start, @cur_offset)\n  Introduce a helper, cleanup_dirty_folios(), which\n  will find and lock the folio in the range, clear the dirty flag and\n  start/end the writeback, with the extra handling for the\n  @locked_folio.\n\n- Introduce a helper to clear folio dirty, start and end writeback\n\n- Introduce a helper to record the last failed COW range end\n  This is to trace which range we should skip, to avoid double\n  unlocking.\n\n- Skip the failed COW range for the e\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "783247fd-022a-411d-a696-7f2fc1182f1f",
      "id": "CVE-2024-58017",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX\n\nShifting 1 \u003c\u003c 31 on a 32-bit int causes signed integer overflow, which\nleads to undefined behavior. To prevent this, cast 1 to u32 before\nperforming the shift, ensuring well-defined behavior.\n\nThis change explicitly avoids any potential overflow by ensuring that\nthe shift occurs on an unsigned 32-bit integer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aee21caa-1ca7-4464-b169-e4a9bb4ade59",
      "id": "CVE-2024-58051",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: Add check devm_kasprintf() returned value\n\ndevm_kasprintf() can return a NULL pointer on failure but this\nreturned value is not checked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "61bd27ae-f3fe-41e0-915e-a7f7c7b259cd",
      "id": "CVE-2025-37983",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqibfs: fix _another_ leak\n\nfailure to allocate inode =\u003e leaked dentry...\n\nthis one had been there since the initial merge; to be fair,\nif we are that far OOM, the odds of failing at that particular\nallocation are low...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f6ff0052-fb39-4c20-b36b-c7171a70b1ff",
      "id": "CVE-2024-58072",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: remove unused check_buddy_priv\n\nCommit 2461c7d60f9f (\"rtlwifi: Update header file\") introduced a global\nlist of private data structures.\n\nLater on, commit 26634c4b1868 (\"rtlwifi Modify existing bits to match\nvendor version 2013.02.07\") started adding the private data to that list at\nprobe time and added a hook, check_buddy_priv to find the private data from\na similar device.\n\nHowever, that function was never used.\n\nBesides, though there is a lock for that list, it is never used. And when\nthe probe fails, the private data is never removed from the list. This\nwould cause a second probe to access freed memory.\n\nRemove the unused hook, structures and members, which will prevent the\npotential race condition on the list and its corruption during a second\nprobe when probe fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "30acaa1b-c3bf-479b-ad8b-b11fb0bdb53c",
      "id": "CVE-2025-21806",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: let net.core.dev_weight always be non-zero\n\nThe following problem was encountered during stability test:\n\n(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \\\n\treturned 1, exceeding its budget of 0.\n------------[ cut here ]------------\nlist_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \\\n\tnext=ffff88905f746e40.\nWARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \\\n\t__list_add_valid_or_report+0xf3/0x130\nCPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+\nRIP: 0010:__list_add_valid_or_report+0xf3/0x130\nCall Trace:\n? __warn+0xcd/0x250\n? __list_add_valid_or_report+0xf3/0x130\nenqueue_to_backlog+0x923/0x1070\nnetif_rx_internal+0x92/0x2b0\n__netif_rx+0x15/0x170\nloopback_xmit+0x2ef/0x450\ndev_hard_start_xmit+0x103/0x490\n__dev_queue_xmit+0xeac/0x1950\nip_finish_output2+0x6cc/0x1620\nip_output+0x161/0x270\nip_push_pending_frames+0x155/0x1a0\nraw_sendmsg+0xe13/0x1550\n__sys_sendto+0x3bf/0x4e0\n__x64_sys_sendto+0xdc/0x1b0\ndo_syscall_64+0x5b/0x170\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe reproduction command is as follows:\n  sysctl -w net.core.dev_weight=0\n  ping 127.0.0.1\n\nThis is because when the napi's weight is set to 0, process_backlog() may\nreturn 0 and clear the NAPI_STATE_SCHED bit of napi-\u003estate, causing this\nnapi to be re-polled in net_rx_action() until __do_softirq() times out.\nSince the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can\nbe retriggered in enqueue_to_backlog(), causing this issue.\n\nMaking the napi's weight always non-zero solves this problem.\n\nTriggering this issue requires system-wide admin (setting is\nnot namespaced).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10312b6d-2432-479e-bcb6-9cf542abec35",
      "id": "CVE-2025-21920",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: enforce underlying device type\n\nCurrently, VLAN devices can be created on top of non-ethernet devices.\n\nBesides the fact that it doesn't make much sense, this also causes a\nbug which leaks the address of a kernel function to usermode.\n\nWhen creating a VLAN device, we initialize GARP (garp_init_applicant)\nand MRP (mrp_init_applicant) for the underlying device.\n\nAs part of the initialization process, we add the multicast address of\neach applicant to the underlying device, by calling dev_mc_add.\n\n__dev_mc_add uses dev-\u003eaddr_len to determine the length of the new\nmulticast address.\n\nThis causes an out-of-bounds read if dev-\u003eaddr_len is greater than 6,\nsince the multicast addresses provided by GARP and MRP are only 6\nbytes long.\n\nThis behaviour can be reproduced using the following commands:\n\nip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo\nip l set up dev gretest\nip link add link gretest name vlantest type vlan id 100\n\nThen, the following command will display the address of garp_pdu_rcv:\n\nip maddr show | grep 01:80:c2:00:00:21\n\nFix the bug by enforcing the type of the underlying device during VLAN\ndevice initialization.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "506691d5-8832-48d7-be45-e859c2dfe955",
      "id": "CVE-2025-21926",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: fix ownership in __udp_gso_segment\n\nIn __udp_gso_segment the skb destructor is removed before segmenting the\nskb but the socket reference is kept as-is. This is an issue if the\noriginal skb is later orphaned as we can hit the following bug:\n\n  kernel BUG at ./include/linux/skbuff.h:3312!  (skb_orphan)\n  RIP: 0010:ip_rcv_core+0x8b2/0xca0\n  Call Trace:\n   ip_rcv+0xab/0x6e0\n   __netif_receive_skb_one_core+0x168/0x1b0\n   process_backlog+0x384/0x1100\n   __napi_poll.constprop.0+0xa1/0x370\n   net_rx_action+0x925/0xe50\n\nThe above can happen following a sequence of events when using\nOpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an\nOVS_ACTION_ATTR_OUTPUT action:\n\n1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb\n   goes through queue_gso_packets and then __udp_gso_segment, where its\n   destructor is removed.\n2. The segments' data are copied and sent to userspace.\n3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the\n   same original skb is sent to its path.\n4. If it later hits skb_orphan, we hit the bug.\n\nFix this by also removing the reference to the socket in\n__udp_gso_segment.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bcd197b3-e831-4c33-9182-c34203c1bc84",
      "id": "CVE-2025-21971",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b3081e79-e3d6-4901-89d4-d9924e460729",
      "id": "CVE-2022-48851",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can't dereference it to\nsave the skb-\u003elen.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77422386-36a6-4b0e-a22a-b594165ec3d4",
      "id": "CVE-2025-23161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type\n\nThe access to the PCI config space via pci_ops::read and pci_ops::write is\na low-level hardware access. The functions can be accessed with disabled\ninterrupts even on PREEMPT_RT. The pci_lock is a raw_spinlock_t for this\npurpose.\n\nA spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be\nacquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in\nthe same context as the pci_lock.\n\nMake vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with\ninterrupts disabled.\n\nThis was reported as:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n  Call Trace:\n   rt_spin_lock+0x4e/0x130\n   vmd_pci_read+0x8d/0x100 [vmd]\n   pci_user_read_config_byte+0x6f/0xe0\n   pci_read_config+0xfe/0x290\n   sysfs_kf_bin_read+0x68/0x90\n\n[bigeasy: reword commit message]\nTested-off-by: Luis Claudio R. Goncalves \u003clgoncalv@redhat.com\u003e\n[kwilczynski: commit log]\n[bhelgaas: add back report info from\nhttps://lore.kernel.org/lkml/20241218115951.83062-1-ryotkkr98@gmail.com/]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c824a25-74e5-49e9-bba3-33fc235311ee",
      "id": "CVE-2025-37785",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix OOB read when checking dotdot dir\n\nMounting a corrupted filesystem with directory which contains '.' dir\nentry with rec_len == block size results in out-of-bounds read (later\non, when the corrupted directory is removed).\n\next4_empty_dir() assumes every ext4 directory contains at least '.'\nand '..' as directory entries in the first data block. It first loads\nthe '.' dir entry, performs sanity checks by calling ext4_check_dir_entry()\nand then uses its rec_len member to compute the location of '..' dir\nentry (in ext4_next_entry). It assumes the '..' dir entry fits into the\nsame data block.\n\nIf the rec_len of '.' is precisely one block (4KB), it slips through the\nsanity checks (it is considered the last directory entry in the data\nblock) and leaves \"struct ext4_dir_entry_2 *de\" point exactly past the\nmemory slot allocated to the data block. The following call to\next4_check_dir_entry() on new value of de then dereferences this pointer\nwhich results in out-of-bounds mem access.\n\nFix this by extending __ext4_check_dir_entry() to check for '.' dir\nentries that reach the end of data block. Make sure to ignore the phony\ndir entries for checksum (by checking name_len for non-zero).\n\nNote: This is reported by KASAN as use-after-free in case another\nstructure was recently freed from the slot past the bound, but it is\nreally an OOB read.\n\nThis issue was found by syzkaller tool.\n\nCall Trace:\n[   38.594108] BUG: KASAN: slab-use-after-free in __ext4_check_dir_entry+0x67e/0x710\n[   38.594649] Read of size 2 at addr ffff88802b41a004 by task syz-executor/5375\n[   38.595158]\n[   38.595288] CPU: 0 UID: 0 PID: 5375 Comm: syz-executor Not tainted 6.14.0-rc7 #1\n[   38.595298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   38.595304] Call Trace:\n[   38.595308]  \u003cTASK\u003e\n[   38.595311]  dump_stack_lvl+0xa7/0xd0\n[   38.595325]  print_address_description.constprop.0+0x2c/0x3f0\n[   38.595339]  ? __ext4_check_dir_entry+0x67e/0x710\n[   38.595349]  print_report+0xaa/0x250\n[   38.595359]  ? __ext4_check_dir_entry+0x67e/0x710\n[   38.595368]  ? kasan_addr_to_slab+0x9/0x90\n[   38.595378]  kasan_report+0xab/0xe0\n[   38.595389]  ? __ext4_check_dir_entry+0x67e/0x710\n[   38.595400]  __ext4_check_dir_entry+0x67e/0x710\n[   38.595410]  ext4_empty_dir+0x465/0x990\n[   38.595421]  ? __pfx_ext4_empty_dir+0x10/0x10\n[   38.595432]  ext4_rmdir.part.0+0x29a/0xd10\n[   38.595441]  ? __dquot_initialize+0x2a7/0xbf0\n[   38.595455]  ? __pfx_ext4_rmdir.part.0+0x10/0x10\n[   38.595464]  ? __pfx___dquot_initialize+0x10/0x10\n[   38.595478]  ? down_write+0xdb/0x140\n[   38.595487]  ? __pfx_down_write+0x10/0x10\n[   38.595497]  ext4_rmdir+0xee/0x140\n[   38.595506]  vfs_rmdir+0x209/0x670\n[   38.595517]  ? lookup_one_qstr_excl+0x3b/0x190\n[   38.595529]  do_rmdir+0x363/0x3c0\n[   38.595537]  ? __pfx_do_rmdir+0x10/0x10\n[   38.595544]  ? strncpy_from_user+0x1ff/0x2e0\n[   38.595561]  __x64_sys_unlinkat+0xf0/0x130\n[   38.595570]  do_syscall_64+0x5b/0x180\n[   38.595583]  entry_SYSCALL_64_after_hwframe+0x76/0x7e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76fcdda4-8d8f-4691-8ea6-72fbdb70e15d",
      "id": "CVE-2025-37797",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a UAF vulnerability in class handling\n\nThis patch fixes a Use-After-Free vulnerability in the HFSC qdisc class\nhandling. The issue occurs due to a time-of-check/time-of-use condition\nin hfsc_change_class() when working with certain child qdiscs like netem\nor codel.\n\nThe vulnerability works as follows:\n1. hfsc_change_class() checks if a class has packets (q.qlen != 0)\n2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g.,\n   codel, netem) might drop packets and empty the queue\n3. The code continues assuming the queue is still non-empty, adding\n   the class to vttree\n4. This breaks HFSC scheduler assumptions that only non-empty classes\n   are in vttree\n5. Later, when the class is destroyed, this can lead to a Use-After-Free\n\nThe fix adds a second queue length check after qdisc_peek_len() to verify\nthe queue wasn't emptied.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7bcb5146-d1c9-4c40-b942-e43b61dea19c",
      "id": "CVE-2025-37798",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncodel: remove sch-\u003eq.qlen check before qdisc_tree_reduce_backlog()\n\nAfter making all -\u003eqlen_notify() callbacks idempotent, now it is safe to\nremove the check of qlen!=0 from both fq_codel_dequeue() and\ncodel_qdisc_dequeue().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0849d90-0bf8-4d6e-bdef-4b4e77665cb9",
      "id": "CVE-2025-37802",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"\n\nwait_event_timeout() will set the state of the current\ntask to TASK_UNINTERRUPTIBLE, before doing the condition check. This\nmeans that ksmbd_durable_scavenger_alive() will try to acquire the mutex\nwhile already in a sleeping state. The scheduler warns us by giving\nthe following warning:\n\ndo not call blocking ops when !TASK_RUNNING; state=2 set at\n [\u003c0000000061515a6f\u003e] prepare_to_wait_event+0x9f/0x6c0\nWARNING: CPU: 2 PID: 4147 at kernel/sched/core.c:10099 __might_sleep+0x12f/0x160\n\nmutex lock is not needed in ksmbd_durable_scavenger_alive().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4761441-8681-4e84-a1bd-66472c7d8f64",
      "id": "CVE-2025-37823",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too\n\nSimilarly to the previous patch, we need to safe guard hfsc_dequeue()\ntoo. But for this one, we don't have a reliable reproducer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4475de70-1ca5-4258-8817-ed5a3825266c",
      "id": "CVE-2025-38084",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: unshare page tables during VMA split, not before\n\nCurrently, __split_vma() triggers hugetlb page table unsharing through\nvm_ops-\u003emay_split().  This happens before the VMA lock and rmap locks are\ntaken - which is too early, it allows racing VMA-locked page faults in our\nprocess and racing rmap walks from other processes to cause page tables to\nbe shared again before we actually perform the split.\n\nFix it by explicitly calling into the hugetlb unshare logic from\n__split_vma() in the same place where THP splitting also happens.  At that\npoint, both the VMA and the rmap(s) are write-locked.\n\nAn annoying detail is that we can now call into the helper\nhugetlb_unshare_pmds() from two different locking contexts:\n\n1. from hugetlb_split(), holding:\n    - mmap lock (exclusively)\n    - VMA lock\n    - file rmap lock (exclusively)\n2. hugetlb_unshare_all_pmds(), which I think is designed to be able to\n   call us with only the mmap lock held (in shared mode), but currently\n   only runs while holding mmap lock (exclusively) and VMA lock\n\nBackporting note:\nThis commit fixes a racy protection that was introduced in commit\nb30c14cd6102 (\"hugetlb: unshare some PMDs when splitting VMAs\"); that\ncommit claimed to fix an issue introduced in 5.13, but it should actually\nalso go all the way back.\n\n[jannh@google.com: v2]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fdfe25ac-26b3-42c6-a2f5-fb197aaa37eb",
      "id": "CVE-2025-38249",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()\n\nIn snd_usb_get_audioformat_uac3(), the length value returned from\nsnd_usb_ctl_msg() is used directly for memory allocation without\nvalidation. This length is controlled by the USB device.\n\nThe allocated buffer is cast to a uac3_cluster_header_descriptor\nand its fields are accessed without verifying that the buffer\nis large enough. If the device returns a smaller than expected\nlength, this leads to an out-of-bounds read.\n\nAdd a length check to ensure the buffer is large enough for\nuac3_cluster_header_descriptor.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6f05f4a2-9d44-406f-a515-809520ac7519",
      "id": "CVE-2025-38272",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: b53: do not enable EEE on bcm63xx\n\nBCM63xx internal switches do not support EEE, but provide multiple RGMII\nports where external PHYs may be connected. If one of these PHYs are EEE\ncapable, we may try to enable EEE for the MACs, which then hangs the\nsystem on access of the (non-existent) EEE registers.\n\nFix this by checking if the switch actually supports EEE before\nattempting to configure it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "65a56a4a-da26-4a4e-93af-495efe66b00b",
      "id": "CVE-2025-38352",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()\n\nIf an exiting non-autoreaping task has already passed exit_notify() and\ncalls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent\nor debugger right after unlock_task_sighand().\n\nIf a concurrent posix_cpu_timer_del() runs at that moment, it won't be\nable to detect timer-\u003eit.cpu.firing != 0: cpu_timer_task_rcu() and/or\nlock_task_sighand() will fail.\n\nAdd the tsk-\u003eexit_state check into run_posix_cpu_timers() to fix this.\n\nThis fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because\nexit_task_work() is called before exit_notify(). But the check still\nmakes sense, task_work_add(\u0026tsk-\u003eposix_cputimers_work.work) will fail\nanyway in this case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90bfc727-cbb2-4c91-9224-3cebd2597b0e",
      "id": "CVE-2025-38644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject TDLS operations when station is not associated\n\nsyzbot triggered a WARN in ieee80211_tdls_oper() by sending\nNL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,\nbefore association completed and without prior TDLS setup.\n\nThis left internal state like sdata-\u003eu.mgd.tdls_peer uninitialized,\nleading to a WARN_ON() in code paths that assumed it was valid.\n\nReject the operation early if not in station mode or not associated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "23c754e8-45ce-45cf-9881-23552f9237c3",
      "id": "CVE-2021-38198",
      "description": "arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9406b0b1-e079-4e65-b349-539b22a2fd53",
      "id": "CVE-2024-38545",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix UAF for cq async event\n\nThe refcount of CQ is not protected by locks. When CQ asynchronous\nevents and CQ destruction are concurrent, CQ may have been released,\nwhich will cause UAF.\n\nUse the xa_lock() to protect the CQ refcount.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e175d930-f3c8-4bd4-a416-72ced06d38ff",
      "id": "CVE-2021-47110",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Disable kvmclock on all CPUs on shutdown\n\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\n\nNote, writing '0' to kvmclock MSR doesn't clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don't need to switch to some other clocksource.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a30fdbc-d062-490c-a875-fa15300afb82",
      "id": "CVE-2021-47141",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Add NULL pointer checks when freeing irqs.\n\nWhen freeing notification blocks, we index priv-\u003emsix_vectors.\nIf we failed to allocate priv-\u003emsix_vectors (see abort_with_msix_vectors)\nthis could lead to a NULL pointer dereference if the driver is unloaded.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dce94df2-82c0-4879-9dcd-72059f0d8071",
      "id": "CVE-2021-47372",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix use after free on rmmod\n\nplat_dev-\u003edev-\u003eplatform_data is released by platform_device_unregister(),\nuse of pclk and hclk is a use-after-free. Since device unregister won't\nneed a clk device we adjust the function call sequence to fix this issue.\n\n[   31.261225] BUG: KASAN: use-after-free in macb_remove+0x77/0xc6 [macb_pci]\n[   31.275563] Freed by task 306:\n[   30.276782]  platform_device_release+0x25/0x80",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e3831c9-cd00-4385-bb74-91e981b8bb6d",
      "id": "CVE-2021-47572",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: fix null pointer dereference when IPv6 is not enabled\n\nWhen we try to add an IPv6 nexthop and IPv6 is not enabled\n(!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path\nof nh_create_ipv6() due to calling ipv6_stub-\u003efib6_nh_release. The bug\nhas been present since the beginning of IPv6 nexthop gateway support.\nCommit 1aefd3de7bc6 (\"ipv6: Add fib6_nh_init and release to stubs\") tells\nus that only fib6_nh_init has a dummy stub because fib6_nh_release should\nnot be called if fib6_nh_init returns an error, but the commit below added\na call to ipv6_stub-\u003efib6_nh_release in its error path. To fix it return\nthe dummy stub's -EAFNOSUPPORT error directly without calling\nipv6_stub-\u003efib6_nh_release in nh_create_ipv6()'s error path.\n\n[1]\n Output is a bit truncated, but it clearly shows the error.\n BUG: kernel NULL pointer dereference, address: 000000000000000000\n #PF: supervisor instruction fetch in kernel modede\n #PF: error_code(0x0010) - not-present pagege\n PGD 0 P4D 0\n Oops: 0010 [#1] PREEMPT SMP NOPTI\n CPU: 4 PID: 638 Comm: ip Kdump: loaded Not tainted 5.16.0-rc1+ #446\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014\n RIP: 0010:0x0\n Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.\n RSP: 0018:ffff888109f5b8f0 EFLAGS: 00010286^Ac\n RAX: 0000000000000000 RBX: ffff888109f5ba28 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8881008a2860\n RBP: ffff888109f5b9d8 R08: 0000000000000000 R09: 0000000000000000\n R10: ffff888109f5b978 R11: ffff888109f5b948 R12: 00000000ffffff9f\n R13: ffff8881008a2a80 R14: ffff8881008a2860 R15: ffff8881008a2840\n FS:  00007f98de70f100(0000) GS:ffff88822bf00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffffffffffd6 CR3: 0000000100efc000 CR4: 00000000000006e0\n Call Trace:\n  \u003cTASK\u003e\n  nh_create_ipv6+0xed/0x10c\n  rtm_new_nexthop+0x6d7/0x13f3\n  ? check_preemption_disabled+0x3d/0xf2\n  ? lock_is_held_type+0xbe/0xfd\n  rtnetlink_rcv_msg+0x23f/0x26a\n  ? check_preemption_disabled+0x3d/0xf2\n  ? rtnl_calcit.isra.0+0x147/0x147\n  netlink_rcv_skb+0x61/0xb2\n  netlink_unicast+0x100/0x187\n  netlink_sendmsg+0x37f/0x3a0\n  ? netlink_unicast+0x187/0x187\n  sock_sendmsg_nosec+0x67/0x9b\n  ____sys_sendmsg+0x19d/0x1f9\n  ? copy_msghdr_from_user+0x4c/0x5e\n  ? rcu_read_lock_any_held+0x2a/0x78\n  ___sys_sendmsg+0x6c/0x8c\n  ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n  ? lockdep_hardirqs_on+0xd9/0x102\n  ? sockfd_lookup_light+0x69/0x99\n  __sys_sendmsg+0x50/0x6e\n  do_syscall_64+0xcb/0xf2\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f98dea28914\n Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 48 8d 05 e9 5d 0c 00 8b 00 85 c0 75 13 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 41 89 d4 55 48 89 f5 53\n RSP: 002b:00007fff859f5e68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e2e\n RAX: ffffffffffffffda RBX: 00000000619cb810 RCX: 00007f98dea28914\n RDX: 0000000000000000 RSI: 00007fff859f5ed0 RDI: 0000000000000003\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000008\n R10: fffffffffffffce6 R11: 0000000000000246 R12: 0000000000000001\n R13: 000055c0097ae520 R14: 000055c0097957fd R15: 00007fff859f63a0\n \u003c/TASK\u003e\n Modules linked in: bridge stp llc bonding virtio_net",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d09ad8f0-5a92-4ad9-97d2-675ff9391950",
      "id": "CVE-2022-49162",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: sm712fb: Fix crash in smtcfb_write()\n\nWhen the sm712fb driver writes three bytes to the framebuffer, the\ndriver will crash:\n\n    BUG: unable to handle page fault for address: ffffc90001ffffff\n    RIP: 0010:smtcfb_write+0x454/0x5b0\n    Call Trace:\n     vfs_write+0x291/0xd60\n     ? do_sys_openat2+0x27d/0x350\n     ? __fget_light+0x54/0x340\n     ksys_write+0xce/0x190\n     do_syscall_64+0x43/0x90\n     entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFix it by removing the open-coded endianness fixup-code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c4366cbf-d1e3-4149-868b-1e5cdb127f35",
      "id": "CVE-2021-47633",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111\n\nThe bug was found during fuzzing. Stacktrace locates it in\nath5k_eeprom_convert_pcal_info_5111.\nWhen none of the curve is selected in the loop, idx can go\nup to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound.\npd = \u0026chinfo[pier].pd_curves[idx];\n\nThere are many OOB writes using pd later in the code. So I\nadded a sanity check for idx. Checks for other loops involving\nAR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not\nused outside the loops.\n\nThe patch is NOT tested with real device.\n\nThe following is the fuzzing report\n\nBUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\nWrite of size 1 at addr ffff8880174a4d60 by task modprobe/214\n\nCPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1\nCall Trace:\n dump_stack+0x76/0xa0\n print_address_description.constprop.0+0x16/0x200\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n __kasan_report.cold+0x37/0x7c\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n kasan_report+0xe/0x20\n ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n ? apic_timer_interrupt+0xa/0x20\n ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]\n ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k]\n ath5k_eeprom_init+0x2513/0x6290 [ath5k]\n ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]\n ? usleep_range+0xb8/0x100\n ? apic_timer_interrupt+0xa/0x20\n ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k]\n ath5k_hw_init+0xb60/0x1970 [ath5k]\n ath5k_init_ah+0x6fe/0x2530 [ath5k]\n ? kasprintf+0xa6/0xe0\n ? ath5k_stop+0x140/0x140 [ath5k]\n ? _dev_notice+0xf6/0xf6\n ? apic_timer_interrupt+0xa/0x20\n ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k]\n ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]\n ? mutex_lock+0x89/0xd0\n ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]\n local_pci_probe+0xd3/0x160\n pci_device_probe+0x23f/0x3e0\n ? pci_device_remove+0x280/0x280\n ? pci_device_remove+0x280/0x280\n really_probe+0x209/0x5d0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27137a78-d2c8-45f4-a9ef-db7b4fcef27a",
      "id": "CVE-2021-47653",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: davinci: vpif: fix use-after-free on driver unbind\n\nThe driver allocates and registers two platform device structures during\nprobe, but the devices were never deregistered on driver unbind.\n\nThis results in a use-after-free on driver unbind as the device\nstructures were allocated using devres and would be freed by driver\ncore when remove() returns.\n\nFix this by adding the missing deregistration calls to the remove()\ncallback and failing probe on registration errors.\n\nNote that the platform device structures must be freed using a proper\nrelease callback to avoid leaking associated resources like device\nnames.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fdb6248f-baeb-4e41-8bc5-66727bbca9d0",
      "id": "CVE-2022-1204",
      "description": "A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a43074d8-ccbb-4955-9884-b725bfff827c",
      "id": "CVE-2022-48715",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bnx2fc: Make bnx2fc_recv_frame() mp safe\n\nRunning tests with a debug kernel shows that bnx2fc_recv_frame() is\nmodifying the per_cpu lport stats counters in a non-mpsafe way.  Just boot\na debug kernel and run the bnx2fc driver with the hardware enabled.\n\n[ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code: bnx2fc_\n[ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc]\n[ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted: G    B\n[ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013\n[ 1391.699183] Call Trace:\n[ 1391.699188]  dump_stack_lvl+0x57/0x7d\n[ 1391.699198]  check_preemption_disabled+0xc8/0xd0\n[ 1391.699205]  bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc]\n[ 1391.699215]  ? do_raw_spin_trylock+0xb5/0x180\n[ 1391.699221]  ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc]\n[ 1391.699229]  ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc]\n[ 1391.699240]  bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc]\n[ 1391.699250]  ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc]\n[ 1391.699258]  kthread+0x364/0x420\n[ 1391.699263]  ? _raw_spin_unlock_irq+0x24/0x50\n[ 1391.699268]  ? set_kthread_struct+0x100/0x100\n[ 1391.699273]  ret_from_fork+0x22/0x30\n\nRestore the old get_cpu/put_cpu code with some modifications to reduce the\nsize of the critical section.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2060e035-ab60-4ba6-80a0-8948c10e702b",
      "id": "CVE-2022-48811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: don't release napi in __ibmvnic_open()\n\nIf __ibmvnic_open() encounters an error such as when setting link state,\nit calls release_resources() which frees the napi structures needlessly.\nInstead, have __ibmvnic_open() only clean up the work it did so far (i.e.\ndisable napi and irqs) and leave the rest to the callers.\n\nIf caller of __ibmvnic_open() is ibmvnic_open(), it should release the\nresources immediately. If the caller is do_reset() or do_hard_reset(),\nthey will release the resources on the next reset.\n\nThis fixes following crash that occurred when running the drmgr command\nseveral times to add/remove a vnic interface:\n\n\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[6] irq\n\t[102056] ibmvnic 30000003 env3: Disabling rx_scrq[7] irq\n\t[102056] ibmvnic 30000003 env3: Replenished 8 pools\n\tKernel attempted to read user page (10) - exploit attempt? (uid: 0)\n\tBUG: Kernel NULL pointer dereference on read at 0x00000010\n\tFaulting instruction address: 0xc000000000a3c840\n\tOops: Kernel access of bad area, sig: 11 [#1]\n\tLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\n\t...\n\tCPU: 9 PID: 102056 Comm: kworker/9:2 Kdump: loaded Not tainted 5.16.0-rc5-autotest-g6441998e2e37 #1\n\tWorkqueue: events_long __ibmvnic_reset [ibmvnic]\n\tNIP:  c000000000a3c840 LR: c0080000029b5378 CTR: c000000000a3c820\n\tREGS: c0000000548e37e0 TRAP: 0300   Not tainted  (5.16.0-rc5-autotest-g6441998e2e37)\n\tMSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 28248484  XER: 00000004\n\tCFAR: c0080000029bdd24 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0\n\tGPR00: c0080000029b55d0 c0000000548e3a80 c0000000028f0200 0000000000000000\n\t...\n\tNIP [c000000000a3c840] napi_enable+0x20/0xc0\n\tLR [c0080000029b5378] __ibmvnic_open+0xf0/0x430 [ibmvnic]\n\tCall Trace:\n\t[c0000000548e3a80] [0000000000000006] 0x6 (unreliable)\n\t[c0000000548e3ab0] [c0080000029b55d0] __ibmvnic_open+0x348/0x430 [ibmvnic]\n\t[c0000000548e3b40] [c0080000029bcc28] __ibmvnic_reset+0x500/0xdf0 [ibmvnic]\n\t[c0000000548e3c60] [c000000000176228] process_one_work+0x288/0x570\n\t[c0000000548e3d00] [c000000000176588] worker_thread+0x78/0x660\n\t[c0000000548e3da0] [c0000000001822f0] kthread+0x1c0/0x1d0\n\t[c0000000548e3e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\n\tInstruction dump:\n\t7d2948f8 792307e0 4e800020 60000000 3c4c01eb 384239e0 f821ffd1 39430010\n\t38a0fff6 e92d1100 f9210028 39200000 \u003ce9030010\u003e f9010020 60420000 e9210020\n\t---[ end trace 5f8033b08fd27706 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "446b3bfc-7c08-4276-afa0-8a164a54f2ed",
      "id": "CVE-2022-49232",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()\n\nIn amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode()\nis assigned to mode and is passed to drm_mode_probed_add() directly after\nthat. drm_mode_probed_add() passes \u0026mode-\u003ehead to list_add_tail(), and\nthere is a dereference of it in list_add_tail() without recoveries, which\ncould lead to NULL pointer dereference on failure of\namdgpu_dm_create_common_mode().\n\nFix this by adding a NULL check of mode.\n\nThis bug was found by a static analyzer.\n\nBuilds with 'make allyesconfig' show no new warnings,\nand our static analyzer no longer warns about this code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a44618f8-3aab-489b-bba5-d6dd9cb5f1b2",
      "id": "CVE-2022-49308",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nextcon: Modify extcon device to be created after driver data is set\n\nCurrently, someone can invoke the sysfs such as state_show()\nintermittently before dev_set_drvdata() is done.\nAnd it can be a cause of kernel Oops because of edev is Null at that time.\nSo modified the driver registration to after setting drviver data.\n\n- Oops's backtrace.\n\nBacktrace:\n[\u003cc067865c\u003e] (state_show) from [\u003cc05222e8\u003e] (dev_attr_show)\n[\u003cc05222c0\u003e] (dev_attr_show) from [\u003cc02c66e0\u003e] (sysfs_kf_seq_show)\n[\u003cc02c6648\u003e] (sysfs_kf_seq_show) from [\u003cc02c496c\u003e] (kernfs_seq_show)\n[\u003cc02c4938\u003e] (kernfs_seq_show) from [\u003cc025e2a0\u003e] (seq_read)\n[\u003cc025e11c\u003e] (seq_read) from [\u003cc02c50a0\u003e] (kernfs_fop_read)\n[\u003cc02c5064\u003e] (kernfs_fop_read) from [\u003cc0231cac\u003e] (__vfs_read)\n[\u003cc0231c5c\u003e] (__vfs_read) from [\u003cc0231ee0\u003e] (vfs_read)\n[\u003cc0231e34\u003e] (vfs_read) from [\u003cc0232464\u003e] (ksys_read)\n[\u003cc02323f0\u003e] (ksys_read) from [\u003cc02324fc\u003e] (sys_read)\n[\u003cc02324e4\u003e] (sys_read) from [\u003cc00091d0\u003e] (__sys_trace_return)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bee5598-1b12-4f28-8398-dbc40749f50d",
      "id": "CVE-2022-49313",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: usb: host: Fix deadlock in oxu_bus_suspend()\n\nThere is a deadlock in oxu_bus_suspend(), which is shown below:\n\n   (Thread 1)              |      (Thread 2)\n                           | timer_action()\noxu_bus_suspend()          |  mod_timer()\n spin_lock_irq() //(1)     |  (wait a time)\n ...                       | oxu_watchdog()\n del_timer_sync()          |  spin_lock_irq() //(2)\n (wait timer to stop)      |  ...\n\nWe hold oxu-\u003elock in position (1) of thread 1, and use\ndel_timer_sync() to wait timer to stop, but timer handler\nalso need oxu-\u003elock in position (2) of thread 2. As a result,\noxu_bus_suspend() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_irq(), which could let timer handler to obtain\nthe needed lock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b28064b5-4474-4360-b39d-047dc1c1a497",
      "id": "CVE-2022-49449",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()\n\nIt will cause null-ptr-deref when using 'res', if platform_get_resource()\nreturns NULL, so move using 'res' after devm_ioremap_resource() that\nwill check it to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dff48b81-bc1e-4fa4-9a09-e30ce06bad13",
      "id": "CVE-2022-49529",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: fix the null pointer while the smu is disabled\n\nIt needs to check if the pp_funcs is initialized while release the\ncontext, otherwise it will trigger null pointer panic while the software\nsmu is not enabled.\n\n[ 1109.404555] BUG: kernel NULL pointer dereference, address: 0000000000000078\n[ 1109.404609] #PF: supervisor read access in kernel mode\n[ 1109.404638] #PF: error_code(0x0000) - not-present page\n[ 1109.404657] PGD 0 P4D 0\n[ 1109.404672] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 1109.404701] CPU: 7 PID: 9150 Comm: amdgpu_test Tainted: G           OEL    5.16.0-custom #1\n[ 1109.404732] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n[ 1109.404765] RIP: 0010:amdgpu_dpm_force_performance_level+0x1d/0x170 [amdgpu]\n[ 1109.405109] Code: 5d c3 44 8b a3 f0 80 00 00 eb e5 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 4c 8b b7 f0 7d 00 00 \u003c49\u003e 83 7e 78 00 0f 84 f2 00 00 00 80 bf 87 80 00 00 00 48 89 fb 0f\n[ 1109.405176] RSP: 0018:ffffaf3083ad7c20 EFLAGS: 00010282\n[ 1109.405203] RAX: 0000000000000000 RBX: ffff9796b1c14600 RCX: 0000000002862007\n[ 1109.405229] RDX: ffff97968591c8c0 RSI: 0000000000000001 RDI: ffff9796a3700000\n[ 1109.405260] RBP: ffffaf3083ad7c50 R08: ffffffff9897de00 R09: ffff979688d9db60\n[ 1109.405286] R10: 0000000000000000 R11: ffff979688d9db90 R12: 0000000000000001\n[ 1109.405316] R13: ffff9796a3700000 R14: 0000000000000000 R15: ffff9796a3708fc0\n[ 1109.405345] FS:  00007ff055cff180(0000) GS:ffff9796bfdc0000(0000) knlGS:0000000000000000\n[ 1109.405378] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1109.405400] CR2: 0000000000000078 CR3: 000000000a394000 CR4: 00000000000506e0\n[ 1109.405434] Call Trace:\n[ 1109.405445]  \u003cTASK\u003e\n[ 1109.405456]  ? delete_object_full+0x1d/0x20\n[ 1109.405480]  amdgpu_ctx_set_stable_pstate+0x7c/0xa0 [amdgpu]\n[ 1109.405698]  amdgpu_ctx_fini.part.0+0xcb/0x100 [amdgpu]\n[ 1109.405911]  amdgpu_ctx_do_release+0x71/0x80 [amdgpu]\n[ 1109.406121]  amdgpu_ctx_ioctl+0x52d/0x550 [amdgpu]\n[ 1109.406327]  ? _raw_spin_unlock+0x1a/0x30\n[ 1109.406354]  ? drm_gem_handle_delete+0x81/0xb0 [drm]\n[ 1109.406400]  ? amdgpu_ctx_get_entity+0x2c0/0x2c0 [amdgpu]\n[ 1109.406609]  drm_ioctl_kernel+0xb6/0x140 [drm]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0551ea13-a1f5-491f-8079-8d405dc813e7",
      "id": "CVE-2022-49573",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix a data-race around sysctl_tcp_early_retrans.\n\nWhile reading sysctl_tcp_early_retrans, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "43dd4a79-f7e2-4e38-ab07-64fd4d631200",
      "id": "CVE-2022-49799",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix wild-memory-access in register_synth_event()\n\nIn register_synth_event(), if set_synth_event_print_fmt() failed, then\nboth trace_remove_event_call() and unregister_trace_event() will be\ncalled, which means the trace_event_call will call\n__unregister_trace_event() twice. As the result, the second unregister\nwill causes the wild-memory-access.\n\nregister_synth_event\n    set_synth_event_print_fmt failed\n    trace_remove_event_call\n        event_remove\n            if call-\u003eevent.funcs then\n            __unregister_trace_event (first call)\n    unregister_trace_event\n        __unregister_trace_event (second call)\n\nFix the bug by avoiding to call the second __unregister_trace_event() by\nchecking if the first one is called.\n\ngeneral protection fault, probably for non-canonical address\n\t0xfbd59c0000000024: 0000 [#1] SMP KASAN PTI\nKASAN: maybe wild-memory-access in range\n[0xdead000000000120-0xdead000000000127]\nCPU: 0 PID: 3807 Comm: modprobe Not tainted\n6.1.0-rc1-00186-g76f33a7eedb4 #299\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:unregister_trace_event+0x6e/0x280\nCode: 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 0e 02 00 00 48\nb8 00 00 00 00 00 fc ff df 4c 8b 63 08 4c 89 e2 48 c1 ea 03 \u003c80\u003e 3c 02\n00 0f 85 e2 01 00 00 49 89 2c 24 48 85 ed 74 28 e8 7a 9b\nRSP: 0018:ffff88810413f370 EFLAGS: 00010a06\nRAX: dffffc0000000000 RBX: ffff888105d050b0 RCX: 0000000000000000\nRDX: 1bd5a00000000024 RSI: ffff888119e276e0 RDI: ffffffff835a8b20\nRBP: dead000000000100 R08: 0000000000000000 R09: fffffbfff0913481\nR10: ffffffff8489a407 R11: fffffbfff0913480 R12: dead000000000122\nR13: ffff888105d050b8 R14: 0000000000000000 R15: ffff888105d05028\nFS:  00007f7823e8d540(0000) GS:ffff888119e00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7823e7ebec CR3: 000000010a058002 CR4: 0000000000330ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __create_synth_event+0x1e37/0x1eb0\n create_or_delete_synth_event+0x110/0x250\n synth_event_run_command+0x2f/0x110\n test_gen_synth_cmd+0x170/0x2eb [synth_event_gen_test]\n synth_event_gen_test_init+0x76/0x9bc [synth_event_gen_test]\n do_one_initcall+0xdb/0x480\n do_init_module+0x1cf/0x680\n load_module+0x6a50/0x70a0\n __do_sys_finit_module+0x12f/0x1c0\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a012c88-f135-4c6b-94b8-59d089a7c656",
      "id": "CVE-2022-49917",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix WARNING in ip_vs_app_net_cleanup()\n\nDuring the initialization of ip_vs_app_net_init(), if file ip_vs_app\nfails to be created, the initialization is successful by default.\nTherefore, the ip_vs_app file doesn't be found during the remove in\nip_vs_app_net_cleanup(). It will cause WRNING.\n\nThe following is the stack information:\nname 'ip_vs_app'\nWARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460\nModules linked in:\nWorkqueue: netns cleanup_net\nRIP: 0010:remove_proc_entry+0x389/0x460\nCall Trace:\n\u003cTASK\u003e\nops_exit_list+0x125/0x170\ncleanup_net+0x4ea/0xb00\nprocess_one_work+0x9bf/0x1710\nworker_thread+0x665/0x1080\nkthread+0x2e4/0x3a0\nret_from_fork+0x1f/0x30\n\u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cc00617-116c-4975-8260-7ed2eb8e56f4",
      "id": "CVE-2022-50021",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: block range must be validated before use in ext4_mb_clear_bb()\n\nBlock range to free is validated in ext4_free_blocks() using\next4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().\nHowever in some situations on bigalloc file system the range might be\nadjusted after the validation in ext4_free_blocks() which can lead to\ntroubles on corrupted file systems such as one found by syzkaller that\nresulted in the following BUG\n\nkernel BUG at fs/ext4/ext4.h:3319!\nPREEMPT SMP NOPTI\nCPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014\nRIP: 0010:ext4_free_blocks+0x95e/0xa90\nCall Trace:\n \u003cTASK\u003e\n ? lock_timer_base+0x61/0x80\n ? __es_remove_extent+0x5a/0x760\n ? __mod_timer+0x256/0x380\n ? ext4_ind_truncate_ensure_credits+0x90/0x220\n ext4_clear_blocks+0x107/0x1b0\n ext4_free_data+0x15b/0x170\n ext4_ind_truncate+0x214/0x2c0\n ? _raw_spin_unlock+0x15/0x30\n ? ext4_discard_preallocations+0x15a/0x410\n ? ext4_journal_check_start+0xe/0x90\n ? __ext4_journal_start_sb+0x2f/0x110\n ext4_truncate+0x1b5/0x460\n ? __ext4_journal_start_sb+0x2f/0x110\n ext4_evict_inode+0x2b4/0x6f0\n evict+0xd0/0x1d0\n ext4_enable_quotas+0x11f/0x1f0\n ext4_orphan_cleanup+0x3de/0x430\n ? proc_create_seq_private+0x43/0x50\n ext4_fill_super+0x295f/0x3ae0\n ? snprintf+0x39/0x40\n ? sget_fc+0x19c/0x330\n ? ext4_reconfigure+0x850/0x850\n get_tree_bdev+0x16d/0x260\n vfs_get_tree+0x25/0xb0\n path_mount+0x431/0xa70\n __x64_sys_mount+0xe2/0x120\n do_syscall_64+0x5b/0x80\n ? do_user_addr_fault+0x1e2/0x670\n ? exc_page_fault+0x70/0x170\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7fdf4e512ace\n\nFix it by making sure that the block range is properly validated before\nused every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c9cda958-f3f0-4c94-8453-b74cfff1be77",
      "id": "CVE-2022-50258",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()\n\nThis patch fixes a stack-out-of-bounds read in brcmfmac that occurs\nwhen 'buf' that is not null-terminated is passed as an argument of\nstrsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware\nversion string by memcpy() in brcmf_fil_iovar_data_get().\nThe patch ensures buf is null-terminated.\n\nFound by a modified version of syzkaller.\n\n[   47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3\n[   47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available\n[   47.601565][ T1897] ==================================================================\n[   47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0\n[   47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897\n[   47.604336][ T1897]\n[   47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #131\n[   47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n[   47.606907][ T1897] Workqueue: usb_hub_wq hub_event\n[   47.607453][ T1897] Call Trace:\n[   47.607801][ T1897]  dump_stack_lvl+0x8e/0xd1\n[   47.608295][ T1897]  print_address_description.constprop.0.cold+0xf/0x334\n[   47.609009][ T1897]  ? strsep+0x1b2/0x1f0\n[   47.609434][ T1897]  ? strsep+0x1b2/0x1f0\n[   47.609863][ T1897]  kasan_report.cold+0x83/0xdf\n[   47.610366][ T1897]  ? strsep+0x1b2/0x1f0\n[   47.610882][ T1897]  strsep+0x1b2/0x1f0\n[   47.611300][ T1897]  ? brcmf_fil_iovar_data_get+0x3a/0xf0\n[   47.611883][ T1897]  brcmf_c_preinit_dcmds+0x995/0xc40\n[   47.612434][ T1897]  ? brcmf_c_set_joinpref_default+0x100/0x100\n[   47.613078][ T1897]  ? rcu_read_lock_sched_held+0xa1/0xd0\n[   47.613662][ T1897]  ? rcu_read_lock_bh_held+0xb0/0xb0\n[   47.614208][ T1897]  ? lock_acquire+0x19d/0x4e0\n[   47.614704][ T1897]  ? find_held_lock+0x2d/0x110\n[   47.615236][ T1897]  ? brcmf_usb_deq+0x1a7/0x260\n[   47.615741][ T1897]  ? brcmf_usb_rx_fill_all+0x5a/0xf0\n[   47.616288][ T1897]  brcmf_attach+0x246/0xd40\n[   47.616758][ T1897]  ? wiphy_new_nm+0x1703/0x1dd0\n[   47.617280][ T1897]  ? kmemdup+0x43/0x50\n[   47.617720][ T1897]  brcmf_usb_probe+0x12de/0x1690\n[   47.618244][ T1897]  ? brcmf_usbdev_qinit.constprop.0+0x470/0x470\n[   47.618901][ T1897]  usb_probe_interface+0x2aa/0x760\n[   47.619429][ T1897]  ? usb_probe_device+0x250/0x250\n[   47.619950][ T1897]  really_probe+0x205/0xb70\n[   47.620435][ T1897]  ? driver_allows_async_probing+0x130/0x130\n[   47.621048][ T1897]  __driver_probe_device+0x311/0x4b0\n[   47.621595][ T1897]  ? driver_allows_async_probing+0x130/0x130\n[   47.622209][ T1897]  driver_probe_device+0x4e/0x150\n[   47.622739][ T1897]  __device_attach_driver+0x1cc/0x2a0\n[   47.623287][ T1897]  bus_for_each_drv+0x156/0x1d0\n[   47.623796][ T1897]  ? bus_rescan_devices+0x30/0x30\n[   47.624309][ T1897]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0\n[   47.624907][ T1897]  ? trace_hardirqs_on+0x46/0x160\n[   47.625437][ T1897]  __device_attach+0x23f/0x3a0\n[   47.625924][ T1897]  ? device_bind_driver+0xd0/0xd0\n[   47.626433][ T1897]  ? kobject_uevent_env+0x287/0x14b0\n[   47.627057][ T1897]  bus_probe_device+0x1da/0x290\n[   47.627557][ T1897]  device_add+0xb7b/0x1eb0\n[   47.628027][ T1897]  ? wait_for_completion+0x290/0x290\n[   47.628593][ T1897]  ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0\n[   47.629249][ T1897]  usb_set_configuration+0xf59/0x16f0\n[   47.629829][ T1897]  usb_generic_driver_probe+0x82/0xa0\n[   47.630385][ T1897]  usb_probe_device+0xbb/0x250\n[   47.630927][ T1897]  ? usb_suspend+0x590/0x590\n[   47.631397][ T1897]  really_probe+0x205/0xb70\n[   47.631855][ T1897]  ? driver_allows_async_probing+0x130/0x130\n[   47.632469][ T1897]  __driver_probe_device+0x311/0x4b0\n[   47.633002][ \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d234a0e2-f187-4fc2-ac22-b112cf58902f",
      "id": "CVE-2023-52811",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Remove BUG_ON in the case of an empty event pool\n\nIn practice the driver should never send more commands than are allocated\nto a queue's event pool. In the unlikely event that this happens, the code\nasserts a BUG_ON, and in the case that the kernel is not configured to\ncrash on panic returns a junk event pointer from the empty event list\ncausing things to spiral from there. This BUG_ON is a historical artifact\nof the ibmvfc driver first being upstreamed, and it is well known now that\nthe use of BUG_ON is bad practice except in the most unrecoverable\nscenario. There is nothing about this scenario that prevents the driver\nfrom recovering and carrying on.\n\nRemove the BUG_ON in question from ibmvfc_get_event() and return a NULL\npointer in the case of an empty event pool. Update all call sites to\nibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate\nfailure or recovery action.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b7a3513-3143-4135-80a6-19455565cdef",
      "id": "CVE-2023-22997",
      "description": "In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "26094ca6-7260-4347-ba6f-b5968bf1e64e",
      "id": "CVE-2023-32269",
      "description": "An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d506aed1-30cc-4fde-baab-30322c608182",
      "id": "CVE-2023-52594",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()\n\nFix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug\noccurs when txs-\u003ecnt, data from a URB provided by a USB device, is\nbigger than the size of the array txs-\u003etxstatus, which is\nHTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug\nhandling code after the check. Make the function return if that is the\ncase.\n\nFound by a modified version of syzkaller.\n\nUBSAN: array-index-out-of-bounds in htc_drv_txrx.c\nindex 13 is out of range for type '__wmi_event_txstatus [12]'\nCall Trace:\n ath9k_htc_txstatus\n ath9k_wmi_event_tasklet\n tasklet_action_common\n __do_softirq\n irq_exit_rxu\n sysvec_apic_timer_interrupt",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e33f88d-c71f-4863-8565-84e9affaed4b",
      "id": "CVE-2023-52655",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: aqc111: check packet for fixup for true limit\n\nIf a device sends a packet that is inbetween 0\nand sizeof(u64) the value passed to skb_trim()\nas length will wrap around ending up as some very\nlarge value.\n\nThe driver will then proceed to parse the header\nlocated at that position, which will either oops or\nprocess some random value.\n\nThe fix is to check against sizeof(u64) rather than\n0, which the driver currently does. The issue exists\nsince the introduction of the driver.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7163a021-a217-4585-b055-36dafabb8396",
      "id": "CVE-2024-38620",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Remove HCI_AMP support\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev-\u003edev_type altogether.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "498310bf-46e7-4c42-8773-6f7d5a72d7dd",
      "id": "CVE-2023-52806",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Fix possible null-ptr-deref when assigning a stream\n\nWhile AudioDSP drivers assign streams exclusively of HOST or LINK type,\nnothing blocks a user to attempt to assign a COUPLED stream. As\nsupplied substream instance may be a stub, what is the case when\ncode-loading, such scenario ends with null-ptr-deref.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbb744ba-bc37-4948-9bb8-296cf9d95c4a",
      "id": "CVE-2023-53108",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: Fix size of interrupt data\n\niucv_irq_data needs to be 4 bytes larger.\nThese bytes are not used by the iucv module, but written by\nthe z/VM hypervisor in case a CPU is deconfigured.\n\nReported as:\nBUG dma-kmalloc-64 (Not tainted): kmalloc Redzone overwritten\n-----------------------------------------------------------------------------\n0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc\nAllocated in iucv_cpu_prepare+0x44/0xd0 age=167839 cpu=2 pid=1\n__kmem_cache_alloc_node+0x166/0x450\nkmalloc_node_trace+0x3a/0x70\niucv_cpu_prepare+0x44/0xd0\ncpuhp_invoke_callback+0x156/0x2f0\ncpuhp_issue_call+0xf0/0x298\n__cpuhp_setup_state_cpuslocked+0x136/0x338\n__cpuhp_setup_state+0xf4/0x288\niucv_init+0xf4/0x280\ndo_one_initcall+0x78/0x390\ndo_initcalls+0x11a/0x140\nkernel_init_freeable+0x25e/0x2a0\nkernel_init+0x2e/0x170\n__ret_from_fork+0x3c/0x58\nret_from_fork+0xa/0x40\nFreed in iucv_init+0x92/0x280 age=167839 cpu=2 pid=1\n__kmem_cache_free+0x308/0x358\niucv_init+0x92/0x280\ndo_one_initcall+0x78/0x390\ndo_initcalls+0x11a/0x140\nkernel_init_freeable+0x25e/0x2a0\nkernel_init+0x2e/0x170\n__ret_from_fork+0x3c/0x58\nret_from_fork+0xa/0x40\nSlab 0x0000037200010000 objects=32 used=30 fp=0x0000000000400640 flags=0x1ffff00000010200(slab|head|node=0|zone=0|\nObject 0x0000000000400540 @offset=1344 fp=0x0000000000000000\nRedzone  0000000000400500: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400510: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400520: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400530: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nObject   0000000000400540: 00 01 00 03 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject   0000000000400550: f3 86 81 f2 f4 82 f8 82 f0 f0 f0 f0 f0 f0 f0 f2  ................\nObject   0000000000400560: 00 00 00 00 80 00 00 00 cc cc cc cc cc cc cc cc  ................\nObject   0000000000400570: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400580: cc cc cc cc cc cc cc cc                          ........\nPadding  00000000004005d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ\nPadding  00000000004005e4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ\nPadding  00000000004005f4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ\nCPU: 6 PID: 121030 Comm: 116-pai-crypto. Not tainted 6.3.0-20230221.rc0.git4.99b8246b2d71.300.fc37.s390x+debug #1\nHardware name: IBM 3931 A01 704 (z/VM 7.3.0)\nCall Trace:\n[\u003c000000032aa034ec\u003e] dump_stack_lvl+0xac/0x100\n[\u003c0000000329f5a6cc\u003e] check_bytes_and_report+0x104/0x140\n[\u003c0000000329f5aa78\u003e] check_object+0x370/0x3c0\n[\u003c0000000329f5ede6\u003e] free_debug_processing+0x15e/0x348\n[\u003c0000000329f5f06a\u003e] free_to_partial_list+0x9a/0x2f0\n[\u003c0000000329f5f4a4\u003e] __slab_free+0x1e4/0x3a8\n[\u003c0000000329f61768\u003e] __kmem_cache_free+0x308/0x358\n[\u003c000000032a91465c\u003e] iucv_cpu_dead+0x6c/0x88\n[\u003c0000000329c2fc66\u003e] cpuhp_invoke_callback+0x156/0x2f0\n[\u003c000000032aa062da\u003e] _cpu_down.constprop.0+0x22a/0x5e0\n[\u003c0000000329c3243e\u003e] cpu_device_down+0x4e/0x78\n[\u003c000000032a61dee0\u003e] device_offline+0xc8/0x118\n[\u003c000000032a61e048\u003e] online_store+0x60/0xe0\n[\u003c000000032a08b6b0\u003e] kernfs_fop_write_iter+0x150/0x1e8\n[\u003c0000000329fab65c\u003e] vfs_write+0x174/0x360\n[\u003c0000000329fab9fc\u003e] ksys_write+0x74/0x100\n[\u003c000000032aa03a5a\u003e] __do_syscall+0x1da/0x208\n[\u003c000000032aa177b2\u003e] system_call+0x82/0xb0\nINFO: lockdep is turned off.\nFIX dma-kmalloc-64: Restoring kmalloc Redzone 0x0000000000400564-0x0000000000400567=0xcc\nFIX dma-kmalloc-64: Object at 0x0000000000400540 not freed",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd893bb3-c5e4-4071-9baf-bcc0061855cd",
      "id": "CVE-2023-53152",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix calltrace warning in amddrm_buddy_fini\n\nThe following call trace is observed when removing the amdgpu driver, which\nis caused by that BOs allocated for psp are not freed until removing.\n\n[61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy]\n[61811.450577] Call Trace:\n[61811.450577]  \u003cTASK\u003e\n[61811.450579]  amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu]\n[61811.450728]  amdgpu_ttm_fini+0x207/0x290 [amdgpu]\n[61811.450870]  amdgpu_bo_fini+0x27/0xa0 [amdgpu]\n[61811.451012]  gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu]\n[61811.451166]  amdgpu_device_fini_sw+0x117/0x520 [amdgpu]\n[61811.451306]  amdgpu_driver_release_kms+0x16/0x30 [amdgpu]\n[61811.451447]  devm_drm_dev_init_release+0x4d/0x80 [drm]\n[61811.451466]  devm_action_release+0x15/0x20\n[61811.451469]  release_nodes+0x40/0xb0\n[61811.451471]  devres_release_all+0x9b/0xd0\n[61811.451473]  __device_release_driver+0x1bb/0x2a0\n[61811.451476]  driver_detach+0xf3/0x140\n[61811.451479]  bus_remove_driver+0x6c/0xf0\n[61811.451481]  driver_unregister+0x31/0x60\n[61811.451483]  pci_unregister_driver+0x40/0x90\n[61811.451486]  amdgpu_exit+0x15/0x447 [amdgpu]\n\nFor smu v13_0_2, if the GPU supports xgmi, refer to\n\ncommit f5c7e7797060 (\"drm/amdgpu: Adjust removal control flow for smu v13_0_2\"),\n\nit will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing,\nwhich makes all devices in hive list have hw reset but no resume except the\nbasic ip blocks, then other ip blocks will not call .hw_fini according to\nip_block.status.hw.\n\nSince psp_free_shared_bufs just includes some software operations, so move\nit to psp_sw_fini.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b89ecf7-1044-44c2-8c91-0318cb660d08",
      "id": "CVE-2023-53375",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free error logs of tracing instances\n\nWhen a tracing instance is removed, the error messages that hold errors\nthat occurred in the instance needs to be freed. The following reports a\nmemory leak:\n\n # cd /sys/kernel/tracing\n # mkdir instances/foo\n # echo 'hist:keys=x' \u003e instances/foo/events/sched/sched_switch/trigger\n # cat instances/foo/error_log\n [  117.404795] hist:sched:sched_switch: error: Couldn't find field\n   Command: hist:keys=x\n                      ^\n # rmdir instances/foo\n\nThen check for memory leaks:\n\n # echo scan \u003e /sys/kernel/debug/kmemleak\n # cat /sys/kernel/debug/kmemleak\nunreferenced object 0xffff88810d8ec700 (size 192):\n  comm \"bash\", pid 869, jiffies 4294950577 (age 215.752s)\n  hex dump (first 32 bytes):\n    60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff  `.ha....`.ha....\n    a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00  .0......\u0026.......\n  backtrace:\n    [\u003c00000000dae26536\u003e] kmalloc_trace+0x2a/0xa0\n    [\u003c00000000b2938940\u003e] tracing_log_err+0x277/0x2e0\n    [\u003c000000004a0e1b07\u003e] parse_atom+0x966/0xb40\n    [\u003c0000000023b24337\u003e] parse_expr+0x5f3/0xdb0\n    [\u003c00000000594ad074\u003e] event_hist_trigger_parse+0x27f8/0x3560\n    [\u003c00000000293a9645\u003e] trigger_process_regex+0x135/0x1a0\n    [\u003c000000005c22b4f2\u003e] event_trigger_write+0x87/0xf0\n    [\u003c000000002cadc509\u003e] vfs_write+0x162/0x670\n    [\u003c0000000059c3b9be\u003e] ksys_write+0xca/0x170\n    [\u003c00000000f1cddc00\u003e] do_syscall_64+0x3e/0xc0\n    [\u003c00000000868ac68c\u003e] entry_SYSCALL_64_after_hwframe+0x72/0xdc\nunreferenced object 0xffff888170c35a00 (size 32):\n  comm \"bash\", pid 869, jiffies 4294950577 (age 215.752s)\n  hex dump (first 32 bytes):\n    0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74  .  Command: hist\n    3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00  :keys=x.........\n  backtrace:\n    [\u003c000000006a747de5\u003e] __kmalloc+0x4d/0x160\n    [\u003c000000000039df5f\u003e] tracing_log_err+0x29b/0x2e0\n    [\u003c000000004a0e1b07\u003e] parse_atom+0x966/0xb40\n    [\u003c0000000023b24337\u003e] parse_expr+0x5f3/0xdb0\n    [\u003c00000000594ad074\u003e] event_hist_trigger_parse+0x27f8/0x3560\n    [\u003c00000000293a9645\u003e] trigger_process_regex+0x135/0x1a0\n    [\u003c000000005c22b4f2\u003e] event_trigger_write+0x87/0xf0\n    [\u003c000000002cadc509\u003e] vfs_write+0x162/0x670\n    [\u003c0000000059c3b9be\u003e] ksys_write+0xca/0x170\n    [\u003c00000000f1cddc00\u003e] do_syscall_64+0x3e/0xc0\n    [\u003c00000000868ac68c\u003e] entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nThe problem is that the error log needs to be freed when the instance is\nremoved.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47027c56-10eb-47bf-ac91-127cb9d79dab",
      "id": "CVE-2023-53384",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: avoid possible NULL skb pointer dereference\n\nIn 'mwifiex_handle_uap_rx_forward()', always check the value\nreturned by 'skb_copy()' to avoid potential NULL pointer\ndereference in 'mwifiex_uap_queue_bridged_pkt()', and drop\noriginal skb in case of copying failure.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10c02a26-1039-43a7-a56f-4bad1e97f512",
      "id": "CVE-2024-23851",
      "description": "copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel-\u003edata_size check. This is related to ctl_ioctl.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "84ac3437-3b19-408a-b983-727004dec1f0",
      "id": "CVE-2024-26586",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix stack corruption\n\nWhen tc filters are first added to a net device, the corresponding local\nport gets bound to an ACL group in the device. The group contains a list\nof ACLs. In turn, each ACL points to a different TCAM region where the\nfilters are stored. During forwarding, the ACLs are sequentially\nevaluated until a match is found.\n\nOne reason to place filters in different regions is when they are added\nwith decreasing priorities and in an alternating order so that two\nconsecutive filters can never fit in the same region because of their\nkey usage.\n\nIn Spectrum-2 and newer ASICs the firmware started to report that the\nmaximum number of ACLs in a group is more than 16, but the layout of the\nregister that configures ACL groups (PAGT) was not updated to account\nfor that. It is therefore possible to hit stack corruption [1] in the\nrare case where more than 16 ACLs in a group are required.\n\nFix by limiting the maximum ACL group size to the minimum between what\nthe firmware reports and the maximum ACLs that fit in the PAGT register.\n\nAdd a test case to make sure the machine does not crash when this\ncondition is hit.\n\n[1]\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120\n[...]\n dump_stack_lvl+0x36/0x50\n panic+0x305/0x330\n __stack_chk_fail+0x15/0x20\n mlxsw_sp_acl_tcam_group_update+0x116/0x120\n mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110\n mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "24fc8f32-555c-44d7-8095-c3d9d47c134c",
      "id": "CVE-2024-46803",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check debug trap enable before write dbg_ev_file\n\nIn interrupt context, write dbg_ev_file will be run by work queue. It\nwill cause write dbg_ev_file execution after debug_trap_disable, which\nwill cause NULL pointer access.\nv2: cancel work \"debug_event_workarea\" before set dbg_ev_file as NULL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cee6960-3106-48fd-8029-ff915064cd97",
      "id": "CVE-2024-26646",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: intel: hfi: Add syscore callbacks for system-wide PM\n\nThe kernel allocates a memory buffer and provides its location to the\nhardware, which uses it to update the HFI table. This allocation occurs\nduring boot and remains constant throughout runtime.\n\nWhen resuming from hibernation, the restore kernel allocates a second\nmemory buffer and reprograms the HFI hardware with the new location as\npart of a normal boot. The location of the second memory buffer may\ndiffer from the one allocated by the image kernel.\n\nWhen the restore kernel transfers control to the image kernel, its HFI\nbuffer becomes invalid, potentially leading to memory corruption if the\nhardware writes to it (the hardware continues to use the buffer from the\nrestore kernel).\n\nIt is also possible that the hardware \"forgets\" the address of the memory\nbuffer when resuming from \"deep\" suspend. Memory corruption may also occur\nin such a scenario.\n\nTo prevent the described memory corruption, disable HFI when preparing to\nsuspend or hibernate. Enable it when resuming.\n\nAdd syscore callbacks to handle the package of the boot CPU (packages of\nnon-boot CPUs are handled via CPU offline). Syscore ops always run on the\nboot CPU. Additionally, HFI only needs to be disabled during \"deep\" suspend\nand hibernation. Syscore ops only run in these cases.\n\n[ rjw: Comment adjustment, subject and changelog edits ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55442560-facb-4af9-9e07-f8d6cf194944",
      "id": "CVE-2024-26863",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhsr: Fix uninit-value access in hsr_get_node()\n\nKMSAN reported the following uninit-value access issue [1]:\n\n=====================================================\nBUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246\n fill_frame_info net/hsr/hsr_forward.c:577 [inline]\n hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615\n hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3087 [inline]\n packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n alloc_skb include/linux/skbuff.h:1286 [inline]\n alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n packet_alloc_skb net/packet/af_packet.c:2936 [inline]\n packet_snd net/packet/af_packet.c:3030 [inline]\n packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n __sys_sendto+0x735/0xa10 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nCPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\n=====================================================\n\nIf the packet type ID field in the Ethernet header is either ETH_P_PRP or\nETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr()\nreads an invalid value as a sequence number. This causes the above issue.\n\nThis patch fixes the issue by returning NULL if the Ethernet header is not\nfollowed by an HSR tag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bedaba8-97a9-42da-877a-56b1881368a5",
      "id": "CVE-2024-26921",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: inet_defrag: prevent sk release while still in use\n\nip_local_out() and other functions can pass skb-\u003esk as function argument.\n\nIf the skb is a fragment and reassembly happens before such function call\nreturns, the sk must not be released.\n\nThis affects skb fragments reassembled via netfilter or similar\nmodules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.\n\nEric Dumazet made an initial analysis of this bug.  Quoting Eric:\n  Calling ip_defrag() in output path is also implying skb_orphan(),\n  which is buggy because output path relies on sk not disappearing.\n\n  A relevant old patch about the issue was :\n  8282f27449bf (\"inet: frag: Always orphan skbs inside ip_defrag()\")\n\n  [..]\n\n  net/ipv4/ip_output.c depends on skb-\u003esk being set, and probably to an\n  inet socket, not an arbitrary one.\n\n  If we orphan the packet in ipvlan, then downstream things like FQ\n  packet scheduler will not work properly.\n\n  We need to change ip_defrag() to only use skb_orphan() when really\n  needed, ie whenever frag_list is going to be used.\n\nEric suggested to stash sk in fragment queue and made an initial patch.\nHowever there is a problem with this:\n\nIf skb is refragmented again right after, ip_do_fragment() will copy\nhead-\u003esk to the new fragments, and sets up destructor to sock_wfree.\nIOW, we have no choice but to fix up sk_wmem accouting to reflect the\nfully reassembled skb, else wmem will underflow.\n\nThis change moves the orphan down into the core, to last possible moment.\nAs ip_defrag_offset is aliased with sk_buff-\u003esk member, we must move the\noffset into the FRAG_CB, else skb-\u003esk gets clobbered.\n\nThis allows to delay the orphaning long enough to learn if the skb has\nto be queued or if the skb is completing the reasm queue.\n\nIn the former case, things work as before, skb is orphaned.  This is\nsafe because skb gets queued/stolen and won't continue past reasm engine.\n\nIn the latter case, we will steal the skb-\u003esk reference, reattach it to\nthe head skb, and fix up wmem accouting when inet_frag inflates truesize.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74ad3039-756a-4bb7-90d2-96954284d646",
      "id": "CVE-2024-39497",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)\n\nLack of check for copy-on-write (COW) mapping in drm_gem_shmem_mmap\nallows users to call mmap with PROT_WRITE and MAP_PRIVATE flag\ncausing a kernel panic due to BUG_ON in vmf_insert_pfn_prot:\nBUG_ON((vma-\u003evm_flags \u0026 VM_PFNMAP) \u0026\u0026 is_cow_mapping(vma-\u003evm_flags));\n\nReturn -EINVAL early if COW mapping is detected.\n\nThis bug affects all drm drivers using default shmem helpers.\nIt can be reproduced by this simple example:\nvoid *ptr = mmap(0, size, PROT_WRITE, MAP_PRIVATE, fd, mmap_offset);\nptr[0] = 0;",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bdc42749-980e-4792-ab3a-99d2b7eb28e4",
      "id": "CVE-2024-41048",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nskmsg: Skip zero length skb in sk_msg_recvmsg\n\nWhen running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch\nplatform, the following kernel panic occurs:\n\n  [...]\n  Oops[#1]:\n  CPU: 22 PID: 2824 Comm: test_progs Tainted: G           OE  6.10.0-rc2+ #18\n  Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018\n     ... ...\n     ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560\n    ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0\n   CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n   PRMD: 0000000c (PPLV0 +PIE +PWE)\n   EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\n   ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)\n  ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)\n   BADV: 0000000000000040\n   PRID: 0014c011 (Loongson-64bit, Loongson-3C5000)\n  Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack\n  Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...)\n  Stack : ...\n  Call Trace:\n  [\u003c9000000004162774\u003e] copy_page_to_iter+0x74/0x1c0\n  [\u003c90000000048bf6c0\u003e] sk_msg_recvmsg+0x120/0x560\n  [\u003c90000000049f2b90\u003e] tcp_bpf_recvmsg_parser+0x170/0x4e0\n  [\u003c90000000049aae34\u003e] inet_recvmsg+0x54/0x100\n  [\u003c900000000481ad5c\u003e] sock_recvmsg+0x7c/0xe0\n  [\u003c900000000481e1a8\u003e] __sys_recvfrom+0x108/0x1c0\n  [\u003c900000000481e27c\u003e] sys_recvfrom+0x1c/0x40\n  [\u003c9000000004c076ec\u003e] do_syscall+0x8c/0xc0\n  [\u003c9000000003731da4\u003e] handle_syscall+0xc4/0x160\n  Code: ...\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception\n  Kernel relocated by 0x3510000\n   .text @ 0x9000000003710000\n   .data @ 0x9000000004d70000\n   .bss  @ 0x9000000006469400\n  ---[ end Kernel panic - not syncing: Fatal exception ]---\n  [...]\n\nThis crash happens every time when running sockmap_skb_verdict_shutdown\nsubtest in sockmap_basic.\n\nThis crash is because a NULL pointer is passed to page_address() in the\nsk_msg_recvmsg(). Due to the different implementations depending on the\narchitecture, page_address(NULL) will trigger a panic on Loongarch\nplatform but not on x86 platform. So this bug was hidden on x86 platform\nfor a while, but now it is exposed on Loongarch platform. The root cause\nis that a zero length skb (skb-\u003elen == 0) was put on the queue.\n\nThis zero length skb is a TCP FIN packet, which was sent by shutdown(),\ninvoked in test_sockmap_skb_verdict_shutdown():\n\n\tshutdown(p1, SHUT_WR);\n\nIn this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no\npage is put to this sge (see sg_set_page in sg_set_page), but this empty\nsge is queued into ingress_msg list.\n\nAnd in sk_msg_recvmsg(), this empty sge is used, and a NULL page is got by\nsg_page(sge). Pass this NULL page to copy_page_to_iter(), which passes it\nto kmap_local_page() and to page_address(), then kernel panics.\n\nTo solve this, we should skip this zero length skb. So in sk_msg_recvmsg(),\nif copy is zero, that means it's a zero length skb, skip invoking\ncopy_page_to_iter(). We are using the EFAULT return triggered by\ncopy_page_to_iter to check for is_fin in tcp_bpf.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "77c7ff4d-9dcc-46c2-8df2-8e54d5c1fd8c",
      "id": "CVE-2024-47747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition\n\nIn the ether3_probe function, a timer is initialized with a callback\nfunction ether3_ledoff, bound to \u0026prev(dev)-\u003etimer. Once the timer is\nstarted, there is a risk of a race condition if the module or device\nis removed, triggering the ether3_remove function to perform cleanup.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                      |  ether3_ledoff\nether3_remove         |\n  free_netdev(dev);   |\n  put_devic           |\n  kfree(dev);         |\n |  ether3_outw(priv(dev)-\u003eregs.config2 |= CFG2_CTRLO, REG_CONFIG2);\n                      | // use dev\n\nFix it by ensuring that the timer is canceled before proceeding with\nthe cleanup in ether3_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fcbaea43-a2e9-4667-9a30-a03461e769ee",
      "id": "CVE-2024-50010",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: don't WARN for racy path_noexec check\n\nBoth i_mode and noexec checks wrapped in WARN_ON stem from an artifact\nof the previous implementation. They used to legitimately check for the\ncondition, but that got moved up in two commits:\n633fb6ac3980 (\"exec: move S_ISREG() check earlier\")\n0fd338b2d2cd (\"exec: move path_noexec() check earlier\")\n\nInstead of being removed said checks are WARN_ON'ed instead, which\nhas some debug value.\n\nHowever, the spurious path_noexec check is racy, resulting in\nunwarranted warnings should someone race with setting the noexec flag.\n\nOne can note there is more to perm-checking whether execve is allowed\nand none of the conditions are guaranteed to still hold after they were\ntested for.\n\nAdditionally this does not validate whether the code path did any perm\nchecking to begin with -- it will pass if the inode happens to be\nregular.\n\nKeep the redundant path_noexec() check even though it's mindless\nnonsense checking for guarantee that isn't given so drop the WARN.\n\nReword the commentary and do small tidy ups while here.\n\n[brauner: keep redundant path_noexec() check]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d96843e-6c16-460a-9360-615350f223b3",
      "id": "CVE-2024-50045",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: fix panic with metadata_dst skb\n\nFix a kernel panic in the br_netfilter module when sending untagged\ntraffic via a VxLAN device.\nThis happens during the check for fragmentation in br_nf_dev_queue_xmit.\n\nIt is dependent on:\n1) the br_netfilter module being loaded;\n2) net.bridge.bridge-nf-call-iptables set to 1;\n3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port;\n4) untagged frames with size higher than the VxLAN MTU forwarded/flooded\n\nWhen forwarding the untagged packet to the VxLAN bridge port, before\nthe netfilter hooks are called, br_handle_egress_vlan_tunnel is called and\nchanges the skb_dst to the tunnel dst. The tunnel_dst is a metadata type\nof dst, i.e., skb_valid_dst(skb) is false, and metadata-\u003edst.dev is NULL.\n\nThen in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check\nfor frames that needs to be fragmented: frames with higher MTU than the\nVxLAN device end up calling br_nf_ip_fragment, which in turns call\nip_skb_dst_mtu.\n\nThe ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst\nwith valid dst-\u003edev, thus the crash.\n\nThis case was never supported in the first place, so drop the packet\ninstead.\n\nPING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data.\n[  176.291791] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000110\n[  176.292101] Mem abort info:\n[  176.292184]   ESR = 0x0000000096000004\n[  176.292322]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  176.292530]   SET = 0, FnV = 0\n[  176.292709]   EA = 0, S1PTW = 0\n[  176.292862]   FSC = 0x04: level 0 translation fault\n[  176.293013] Data abort info:\n[  176.293104]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[  176.293488]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[  176.293787]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[  176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000\n[  176.294166] [0000000000000110] pgd=0000000000000000,\np4d=0000000000000000\n[  176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[  176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth\nbr_netfilter bridge stp llc ipv6 crct10dif_ce\n[  176.295923] CPU: 0 PID: 188 Comm: ping Not tainted\n6.8.0-rc3-g5b3fbd61b9d1 #2\n[  176.296314] Hardware name: linux,dummy-virt (DT)\n[  176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS\nBTYPE=--)\n[  176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter]\n[  176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter]\n[  176.297636] sp : ffff800080003630\n[  176.297743] x29: ffff800080003630 x28: 0000000000000008 x27:\nffff6828c49ad9f8\n[  176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24:\n00000000000003e8\n[  176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21:\nffff6828c3b16d28\n[  176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18:\n0000000000000014\n[  176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15:\n0000000095744632\n[  176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12:\nffffb7e137926a70\n[  176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 :\n0000000000000000\n[  176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 :\nf20e0100bebafeca\n[  176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 :\n0000000000000000\n[  176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 :\nffff6828c7f918f0\n[  176.300889] Call trace:\n[  176.301123]  br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter]\n[  176.301411]  br_nf_post_routing+0x2a8/0x3e4 [br_netfilter]\n[  176.301703]  nf_hook_slow+0x48/0x124\n[  176.302060]  br_forward_finish+0xc8/0xe8 [bridge]\n[  176.302371]  br_nf_hook_thresh+0x124/0x134 [br_netfilter]\n[  176.302605]  br_nf_forward_finish+0x118/0x22c [br_netfilter]\n[  176.302824]  br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter]\n[  176.303136]  br_nf_forward+0x2b8/0x4e0 [br_netfilter]\n[  176.303359]  nf_hook_slow+0x48/0x124\n[  176.303\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d3eceee-b817-4a97-958a-049b70afda07",
      "id": "CVE-2024-53173",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.0: Fix a use-after-free problem in the asynchronous open()\n\nYang Erkun reports that when two threads are opening files at the same\ntime, and are forced to abort before a reply is seen, then the call to\nnfs_release_seqid() in nfs4_opendata_free() can result in a\nuse-after-free of the pointer to the defunct rpc task of the other\nthread.\nThe fix is to ensure that if the RPC call is aborted before the call to\nnfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()\nin nfs4_open_release() before the rpc_task is freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5494e674-3e71-428c-8c3e-2261dfa136c2",
      "id": "CVE-2024-53184",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: ubd: Do not use drvdata in release\n\nThe drvdata is not available in release. Let's just use container_of()\nto get the ubd instance. Otherwise, removing a ubd device will result\nin a crash:\n\nRIP: 0033:blk_mq_free_tag_set+0x1f/0xba\nRSP: 00000000e2083bf0  EFLAGS: 00010246\nRAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00\nRDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348\nRBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7\nR10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000\nR13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1\nWorkqueue: events mc_work_proc\nStack:\n 00000000 604f7ef0 62c5d000 62405d20\n e2083c30 6002c776 6002c755 600e47ff\n e2083c60 6025ffe3 04208060 603d36e0\nCall Trace:\n [\u003c6002c776\u003e] ubd_device_release+0x21/0x55\n [\u003c6002c755\u003e] ? ubd_device_release+0x0/0x55\n [\u003c600e47ff\u003e] ? kfree+0x0/0x100\n [\u003c6025ffe3\u003e] device_release+0x70/0xba\n [\u003c60381d6a\u003e] kobject_put+0xb5/0xe2\n [\u003c6026027b\u003e] put_device+0x19/0x1c\n [\u003c6026a036\u003e] platform_device_put+0x26/0x29\n [\u003c6026ac5a\u003e] platform_device_unregister+0x2c/0x2e\n [\u003c6002c52e\u003e] ubd_remove+0xb8/0xd6\n [\u003c6002bb74\u003e] ? mconsole_reply+0x0/0x50\n [\u003c6002b926\u003e] mconsole_remove+0x160/0x1cc\n [\u003c6002bbbc\u003e] ? mconsole_reply+0x48/0x50\n [\u003c6003379c\u003e] ? um_set_signals+0x3b/0x43\n [\u003c60061c55\u003e] ? update_min_vruntime+0x14/0x70\n [\u003c6006251f\u003e] ? dequeue_task_fair+0x164/0x235\n [\u003c600620aa\u003e] ? update_cfs_group+0x0/0x40\n [\u003c603a0e77\u003e] ? __schedule+0x0/0x3ed\n [\u003c60033761\u003e] ? um_set_signals+0x0/0x43\n [\u003c6002af6a\u003e] mc_work_proc+0x77/0x91\n [\u003c600520b4\u003e] process_scheduled_works+0x1af/0x2c3\n [\u003c6004ede3\u003e] ? assign_work+0x0/0x58\n [\u003c600527a1\u003e] worker_thread+0x2f7/0x37a\n [\u003c6004ee3b\u003e] ? set_pf_worker+0x0/0x64\n [\u003c6005765d\u003e] ? arch_local_irq_save+0x0/0x2d\n [\u003c60058e07\u003e] ? kthread_exit+0x0/0x3a\n [\u003c600524aa\u003e] ? worker_thread+0x0/0x37a\n [\u003c60058f9f\u003e] kthread+0x130/0x135\n [\u003c6002068e\u003e] new_thread_handler+0x85/0xb6",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bae79cf-b7a2-4763-a814-b4114844d20c",
      "id": "CVE-2022-3635",
      "description": "A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d579f2c-0418-448a-9b92-c50a06c4d88e",
      "id": "CVE-2024-53194",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix use-after-free of slot-\u003ebus on hot remove\n\nDennis reports a boot crash on recent Lenovo laptops with a USB4 dock.\n\nSince commit 0fc70886569c (\"thunderbolt: Reset USB4 v2 host router\") and\ncommit 59a54c5f3dbd (\"thunderbolt: Reset topology created by the boot\nfirmware\"), USB4 v2 and v1 Host Routers are reset on probe of the\nthunderbolt driver.\n\nThe reset clears the Presence Detect State and Data Link Layer Link Active\nbits at the USB4 Host Router's Root Port and thus causes hot removal of the\ndock.\n\nThe crash occurs when pciehp is unbound from one of the dock's Downstream\nPorts:  pciehp creates a pci_slot on bind and destroys it on unbind.  The\npci_slot contains a pointer to the pci_bus below the Downstream Port, but\na reference on that pci_bus is never acquired.  The pci_bus is destroyed\nbefore the pci_slot, so a use-after-free ensues when pci_slot_release()\naccesses slot-\u003ebus.\n\nIn principle this should not happen because pci_stop_bus_device() unbinds\npciehp (and therefore destroys the pci_slot) before the pci_bus is\ndestroyed by pci_remove_bus_device().\n\nHowever the stacktrace provided by Dennis shows that pciehp is unbound from\npci_remove_bus_device() instead of pci_stop_bus_device().  To understand\nthe significance of this, one needs to know that the PCI core uses a two\nstep process to remove a portion of the hierarchy:  It first unbinds all\ndrivers in the sub-hierarchy in pci_stop_bus_device() and then actually\nremoves the devices in pci_remove_bus_device().  There is no precaution to\nprevent driver binding in-between pci_stop_bus_device() and\npci_remove_bus_device().\n\nIn Dennis' case, it seems removal of the hierarchy by pciehp races with\ndriver binding by pci_bus_add_devices().  pciehp is bound to the\nDownstream Port after pci_stop_bus_device() has run, so it is unbound by\npci_remove_bus_device() instead of pci_stop_bus_device().  Because the\npci_bus has already been destroyed at that point, accesses to it result in\na use-after-free.\n\nOne might conclude that driver binding needs to be prevented after\npci_stop_bus_device() has run.  However it seems risky that pci_slot points\nto pci_bus without holding a reference.  Solely relying on correct ordering\nof driver unbind versus pci_bus destruction is certainly not defensive\nprogramming.\n\nIf pci_slot has a need to access data in pci_bus, it ought to acquire a\nreference.  Amend pci_create_slot() accordingly.  Dennis reports that the\ncrash is not reproducible with this change.\n\nAbridged stacktrace:\n\n  pcieport 0000:00:07.0: PME: Signaling with IRQ 156\n  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+\n  pci_bus 0000:20: dev 00, created physical slot 12\n  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present\n  ...\n  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0\n  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1\n  RIP: 0010:dev_driver_string+0x12/0x40\n  pci_destroy_slot\n  pciehp_remove\n  pcie_port_remove_service\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  device_unregister\n  remove_iter\n  device_for_each_child\n  pcie_portdrv_remove\n  pci_device_remove\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  pci_remove_bus_device (recursive invocation)\n  pci_remove_bus_device\n  pciehp_unconfigure_device\n  pciehp_disable_slot\n  pciehp_handle_presence_or_link_change\n  pciehp_ist",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb521e92-9f9f-4348-84d4-2d1dd2fce08b",
      "id": "CVE-2024-56593",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()\n\nThis patch fixes a NULL pointer dereference bug in brcmfmac that occurs\nwhen a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs\nare sent from the pkt queue.\n\nThe problem is the number of entries in the pre-allocated sgtable, it is\nnents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) \u003e\u003e 4 + 1.\nGiven the default [rt]xglom_size=32 it's actually 35 which is too small.\nWorst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB\nis added for each original SKB if tailroom isn't enough to hold tail_pad.\nAt least one sg entry is needed for each SKB. So, eventually the \"skb_queue_walk loop\"\nin brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return\nNULL and this causes the oops.\n\nThe patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle\nthe worst-case.\nBtw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464\nadditional bytes of memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f152d8fc-70cb-4d21-87a9-557b107378f1",
      "id": "CVE-2020-14351",
      "description": "A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "271a0dbc-7462-4750-9b5f-d5717db45b27",
      "id": "CVE-2024-56777",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check\n\nThe return value of drm_atomic_get_crtc_state() needs to be\nchecked. To avoid use of error pointer 'crtc_state' in case\nof the failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38e149de-101b-4350-82f0-382868e78b91",
      "id": "CVE-2024-57849",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cpum_sf: Handle CPU hotplug remove during sampling\n\nCPU hotplug remove handling triggers the following function\ncall sequence:\n\n   CPUHP_AP_PERF_S390_SF_ONLINE  --\u003e s390_pmu_sf_offline_cpu()\n   ...\n   CPUHP_AP_PERF_ONLINE          --\u003e perf_event_exit_cpu()\n\nThe s390 CPUMF sampling CPU hotplug handler invokes:\n\n s390_pmu_sf_offline_cpu()\n +--\u003e  cpusf_pmu_setup()\n       +--\u003e setup_pmc_cpu()\n            +--\u003e deallocate_buffers()\n\nThis function de-allocates all sampling data buffers (SDBs) allocated\nfor that CPU at event initialization. It also clears the\nPMU_F_RESERVED bit. The CPU is gone and can not be sampled.\n\nWith the event still being active on the removed CPU, the CPU event\nhotplug support in kernel performance subsystem triggers the\nfollowing function calls on the removed CPU:\n\n  perf_event_exit_cpu()\n  +--\u003e perf_event_exit_cpu_context()\n       +--\u003e __perf_event_exit_context()\n\t    +--\u003e __perf_remove_from_context()\n\t         +--\u003e event_sched_out()\n\t              +--\u003e cpumsf_pmu_del()\n\t                   +--\u003e cpumsf_pmu_stop()\n                                +--\u003e hw_perf_event_update()\n\nto stop and remove the event. During removal of the event, the\nsampling device driver tries to read out the remaining samples from\nthe sample data buffers (SDBs). But they have already been freed\n(and may have been re-assigned). This may lead to a use after free\nsituation in which case the samples are most likely invalid. In the\nbest case the memory has not been reassigned and still contains\nvalid data.\n\nRemedy this situation and check if the CPU is still in reserved\nstate (bit PMU_F_RESERVED set). In this case the SDBs have not been\nreleased an contain valid data. This is always the case when\nthe event is removed (and no CPU hotplug off occured).\nIf the PMU_F_RESERVED bit is not set, the SDB buffers are gone.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "33c8b5e1-506b-4d51-bd28-47ebc48d2946",
      "id": "CVE-2025-38430",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: nfsd4_spo_must_allow() must check this is a v4 compound request\n\nIf the request being processed is not a v4 compound request, then\nexamining the cstate can have undefined results.\n\nThis patch adds a check that the rpc procedure being executed\n(rq_procinfo) is the NFSPROC4_COMPOUND procedure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b0accf39-38ad-47a6-b9a5-bac858405fb1",
      "id": "CVE-2024-57986",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Fix assumption that Resolution Multipliers must be in Logical Collections\n\nA report in 2019 by the syzbot fuzzer was found to be connected to two\nerrors in the HID core associated with Resolution Multipliers.  One of\nthe errors was fixed by commit ea427a222d8b (\"HID: core: Fix deadloop\nin hid_apply_multiplier.\"), but the other has not been fixed.\n\nThis error arises because hid_apply_multipler() assumes that every\nResolution Multiplier control is contained in a Logical Collection,\ni.e., there's no way the routine can ever set multiplier_collection to\nNULL.  This is in spite of the fact that the function starts with a\nbig comment saying:\n\n\t * \"The Resolution Multiplier control must be contained in the same\n\t * Logical Collection as the control(s) to which it is to be applied.\n\t   ...\n\t *  If no Logical Collection is\n\t * defined, the Resolution Multiplier is associated with all\n\t * controls in the report.\"\n\t * HID Usage Table, v1.12, Section 4.3.1, p30\n\t *\n\t * Thus, search from the current collection upwards until we find a\n\t * logical collection...\n\nThe comment and the code overlook the possibility that none of the\ncollections found may be a Logical Collection.\n\nThe fix is to set the multiplier_collection pointer to NULL if the\ncollection found isn't a Logical Collection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f22d7043-9237-4633-bb6f-86a177385fb1",
      "id": "CVE-2024-58058",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: skip dumping tnc tree when zroot is null\n\nClearing slab cache will free all znode in memory and make\nc-\u003ezroot.znode = NULL, then dumping tnc tree will access\nc-\u003ezroot.znode which cause null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3ddad970-9240-4f91-a2f5-3bed30f14465",
      "id": "CVE-2025-22086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow\n\nWhen cur_qp isn't NULL, in order to avoid fetching the QP from\nthe radix tree again we check if the next cqe QP is identical to\nthe one we already have.\n\nThe bug however is that we are checking if the QP is identical by\nchecking the QP number inside the CQE against the QP number inside the\nmlx5_ib_qp, but that's wrong since the QP number from the CQE is from\nFW so it should be matched against mlx5_core_qp which is our FW QP\nnumber.\n\nOtherwise we could use the wrong QP when handling a CQE which could\ncause the kernel trace below.\n\nThis issue is mainly noticeable over QPs 0 \u0026 1, since for now they are\nthe only QPs in our driver whereas the QP number inside mlx5_ib_qp\ndoesn't match the QP number inside mlx5_core_qp.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000012\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 0 UID: 0 PID: 7927 Comm: kworker/u62:1 Not tainted 6.14.0-rc3+ #189\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]\n RIP: 0010:mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib]\n Code: 03 00 00 8d 58 ff 21 cb 66 39 d3 74 39 48 c7 c7 3c 89 6e a0 0f b7 db e8 b7 d2 b3 e0 49 8b 86 60 03 00 00 48 c7 c7 4a 89 6e a0 \u003c0f\u003e b7 5c 98 02 e8 9f d2 b3 e0 41 0f b7 86 78 03 00 00 83 e8 01 21\n RSP: 0018:ffff88810511bd60 EFLAGS: 00010046\n RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffff88885fa1b3c0 RDI: ffffffffa06e894a\n RBP: 00000000000000b0 R08: 0000000000000000 R09: ffff88810511bc10\n R10: 0000000000000001 R11: 0000000000000001 R12: ffff88810d593000\n R13: ffff88810e579108 R14: ffff888105146000 R15: 00000000000000b0\n FS:  0000000000000000(0000) GS:ffff88885fa00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000012 CR3: 00000001077e6001 CR4: 0000000000370eb0\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x20/0x60\n  ? page_fault_oops+0x150/0x3e0\n  ? exc_page_fault+0x74/0x130\n  ? asm_exc_page_fault+0x22/0x30\n  ? mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib]\n  __ib_process_cq+0x5a/0x150 [ib_core]\n  ib_cq_poll_work+0x31/0x90 [ib_core]\n  process_one_work+0x169/0x320\n  worker_thread+0x288/0x3a0\n  ? work_busy+0xb0/0xb0\n  kthread+0xd7/0x1f0\n  ? kthreads_online_cpu+0x130/0x130\n  ? kthreads_online_cpu+0x130/0x130\n  ret_from_fork+0x2d/0x50\n  ? kthreads_online_cpu+0x130/0x130\n  ret_from_fork_asm+0x11/0x20\n  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e6aca2f-612b-47ba-a3e9-f928dc192c7e",
      "id": "CVE-2025-38064",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region '(null)', reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7e764f9-2224-4071-bfdf-87484e349db3",
      "id": "CVE-2025-38192",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: clear the dst when changing skb protocol\n\nA not-so-careful NAT46 BPF program can crash the kernel\nif it indiscriminately flips ingress packets from v4 to v6:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n    ip6_rcv_core (net/ipv6/ip6_input.c:190:20)\n    ipv6_rcv (net/ipv6/ip6_input.c:306:8)\n    process_backlog (net/core/dev.c:6186:4)\n    napi_poll (net/core/dev.c:6906:9)\n    net_rx_action (net/core/dev.c:7028:13)\n    do_softirq (kernel/softirq.c:462:3)\n    netif_rx (net/core/dev.c:5326:3)\n    dev_loopback_xmit (net/core/dev.c:4015:2)\n    ip_mc_finish_output (net/ipv4/ip_output.c:363:8)\n    NF_HOOK (./include/linux/netfilter.h:314:9)\n    ip_mc_output (net/ipv4/ip_output.c:400:5)\n    dst_output (./include/net/dst.h:459:9)\n    ip_local_out (net/ipv4/ip_output.c:130:9)\n    ip_send_skb (net/ipv4/ip_output.c:1496:8)\n    udp_send_skb (net/ipv4/udp.c:1040:8)\n    udp_sendmsg (net/ipv4/udp.c:1328:10)\n\nThe output interface has a 4-\u003e6 program attached at ingress.\nWe try to loop the multicast skb back to the sending socket.\nIngress BPF runs as part of netif_rx(), pushes a valid v6 hdr\nand changes skb-\u003eprotocol to v6. We enter ip6_rcv_core which\ntries to use skb_dst(). But the dst is still an IPv4 one left\nafter IPv4 mcast output.\n\nClear the dst in all BPF helpers which change the protocol.\nTry to preserve metadata dsts, those may carry non-routing\nmetadata.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8314d5d4-a485-475d-a00d-0cdf613150e7",
      "id": "CVE-2025-38347",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on ino and xnid\n\nsyzbot reported a f2fs bug as below:\n\nINFO: task syz-executor140:5308 blocked for more than 143 seconds.\n      Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:syz-executor140 state:D stack:24016 pid:5308  tgid:5308  ppid:5306   task_flags:0x400140 flags:0x00000006\nCall Trace:\n \u003cTASK\u003e\n context_switch kernel/sched/core.c:5378 [inline]\n __schedule+0x190e/0x4c90 kernel/sched/core.c:6765\n __schedule_loop kernel/sched/core.c:6842 [inline]\n schedule+0x14b/0x320 kernel/sched/core.c:6857\n io_schedule+0x8d/0x110 kernel/sched/core.c:7690\n folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317\n __folio_lock mm/filemap.c:1664 [inline]\n folio_lock include/linux/pagemap.h:1163 [inline]\n __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917\n pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87\n find_get_page_flags include/linux/pagemap.h:842 [inline]\n f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776\n __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463\n read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306\n lookup_all_xattrs fs/f2fs/xattr.c:355 [inline]\n f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533\n __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179\n f2fs_acl_create fs/f2fs/acl.c:375 [inline]\n f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418\n f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539\n f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666\n f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765\n f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808\n f2fs_add_link fs/f2fs/f2fs.h:3616 [inline]\n f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766\n vfs_mknod+0x36d/0x3b0 fs/namei.c:4191\n unix_bind_bsd net/unix/af_unix.c:1286 [inline]\n unix_bind+0x563/0xe30 net/unix/af_unix.c:1379\n __sys_bind_socket net/socket.c:1817 [inline]\n __sys_bind+0x1e4/0x290 net/socket.c:1848\n __do_sys_bind net/socket.c:1853 [inline]\n __se_sys_bind net/socket.c:1851 [inline]\n __x64_sys_bind+0x7a/0x90 net/socket.c:1851\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLet's dump and check metadata of corrupted inode, it shows its xattr_nid\nis the same to its i_ino.\n\ndump.f2fs -i 3 chaseyu.img.raw\ni_xattr_nid                             [0x       3 : 3]\n\nSo that, during mknod in the corrupted directory, it tries to get and\nlock inode page twice, result in deadlock.\n\n- f2fs_mknod\n - f2fs_add_inline_entry\n  - f2fs_get_inode_page --- lock dir's inode page\n   - f2fs_init_acl\n    - f2fs_acl_create(dir,..)\n     - __f2fs_get_acl\n      - f2fs_getxattr\n       - lookup_all_xattrs\n        - __get_node_page --- try to lock dir's inode page\n\nIn order to fix this, let's add sanity check on ino and xnid.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c95e8db-7b6a-4b98-9a41-90a19e14cd94",
      "id": "CVE-2020-14390",
      "description": "A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0cff8269-7b34-43ef-bd18-abb8df17f509",
      "id": "CVE-2021-20320",
      "description": "A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "78e4482c-0ea6-4d02-ace9-10502de68ba0",
      "id": "CVE-2021-29154",
      "description": "BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97c34a8d-d807-404c-9abc-89dc6237b8a7",
      "id": "CVE-2021-42327",
      "description": "dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b77f018-f07d-417e-ab34-d5152f98d96e",
      "id": "CVE-2021-4460",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix UBSAN shift-out-of-bounds warning\n\nIf get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up\ndoing a shift operation where the number of bits shifted equals\nnumber of bits in the operand. This behaviour is undefined.\n\nSet num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the\ncount is \u003e= number of bits in the operand.\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8c34ca74-0079-4a33-ad9d-edab64acbb21",
      "id": "CVE-2021-46944",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging/intel-ipu3: Fix memory leak in imu_fmt\n\nWe are losing the reference to an allocated memory if try. Change the\norder of the check to avoid that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74ca2f2c-0c3d-483f-af49-553f9d0d4d5f",
      "id": "CVE-2021-47055",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: require write permissions for locking and badblock ioctls\n\nMEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require\nwrite permission. Depending on the hardware MEMLOCK might even be\nwrite-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK\nis always write-once.\n\nMEMSETBADBLOCK modifies the bad block table.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c91c7867-1f64-412f-8e05-299c4ef21853",
      "id": "CVE-2021-47219",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\n\nThe following issue was observed running syzkaller:\n\nBUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]\nBUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\nRead of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815\n\nCPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xe4/0x14a lib/dump_stack.c:118\n print_address_description+0x73/0x280 mm/kasan/report.c:253\n kasan_report_error mm/kasan/report.c:352 [inline]\n kasan_report+0x272/0x370 mm/kasan/report.c:410\n memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n memcpy include/linux/string.h:377 [inline]\n sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\n fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021\n resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772\n schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429\n scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835\n scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896\n scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034\n __blk_run_queue_uncond block/blk-core.c:464 [inline]\n __blk_run_queue+0x1a4/0x380 block/blk-core.c:484\n blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78\n sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847\n sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716\n sg_write+0x64/0xa0 drivers/scsi/sg.c:622\n __vfs_write+0xed/0x690 fs/read_write.c:485\nkill_bdev:block_device:00000000e138492c\n vfs_write+0x184/0x4c0 fs/read_write.c:549\n ksys_write+0x107/0x240 fs/read_write.c:599\n do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nWe get 'alen' from command its type is int. If userspace passes a large\nlength we will get a negative 'alen'.\n\nSwitch n, alen, and rlen to u32.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76b209d1-416e-4a89-9315-1d6609ef131b",
      "id": "CVE-2021-47275",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: avoid oversized read request in cache missing code path\n\nIn the cache missing code path of cached device, if a proper location\nfrom the internal B+ tree is matched for a cache miss range, function\ncached_dev_cache_miss() will be called in cache_lookup_fn() in the\nfollowing code block,\n[code block 1]\n  526         unsigned int sectors = KEY_INODE(k) == s-\u003eiop.inode\n  527                 ? min_t(uint64_t, INT_MAX,\n  528                         KEY_START(k) - bio-\u003ebi_iter.bi_sector)\n  529                 : INT_MAX;\n  530         int ret = s-\u003ed-\u003ecache_miss(b, s, bio, sectors);\n\nHere s-\u003ed-\u003ecache_miss() is the call backfunction pointer initialized as\ncached_dev_cache_miss(), the last parameter 'sectors' is an important\nhint to calculate the size of read request to backing device of the\nmissing cache data.\n\nCurrent calculation in above code block may generate oversized value of\n'sectors', which consequently may trigger 2 different potential kernel\npanics by BUG() or BUG_ON() as listed below,\n\n1) BUG_ON() inside bch_btree_insert_key(),\n[code block 2]\n   886         BUG_ON(b-\u003eops-\u003eis_extents \u0026\u0026 !KEY_SIZE(k));\n2) BUG() inside biovec_slab(),\n[code block 3]\n   51         default:\n   52                 BUG();\n   53                 return NULL;\n\nAll the above panics are original from cached_dev_cache_miss() by the\noversized parameter 'sectors'.\n\nInside cached_dev_cache_miss(), parameter 'sectors' is used to calculate\nthe size of data read from backing device for the cache missing. This\nsize is stored in s-\u003einsert_bio_sectors by the following lines of code,\n[code block 4]\n  909    s-\u003einsert_bio_sectors = min(sectors, bio_sectors(bio) + reada);\n\nThen the actual key inserting to the internal B+ tree is generated and\nstored in s-\u003eiop.replace_key by the following lines of code,\n[code block 5]\n  911   s-\u003eiop.replace_key = KEY(s-\u003eiop.inode,\n  912                    bio-\u003ebi_iter.bi_sector + s-\u003einsert_bio_sectors,\n  913                    s-\u003einsert_bio_sectors);\nThe oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from\nthe above code block.\n\nAnd the bio sending to backing device for the missing data is allocated\nwith hint from s-\u003einsert_bio_sectors by the following lines of code,\n[code block 6]\n  926    cache_bio = bio_alloc_bioset(GFP_NOWAIT,\n  927                 DIV_ROUND_UP(s-\u003einsert_bio_sectors, PAGE_SECTORS),\n  928                 \u0026dc-\u003edisk.bio_split);\nThe oversized parameter 'sectors' may trigger panic 2) by BUG() from the\nagove code block.\n\nNow let me explain how the panics happen with the oversized 'sectors'.\nIn code block 5, replace_key is generated by macro KEY(). From the\ndefinition of macro KEY(),\n[code block 7]\n  71 #define KEY(inode, offset, size)                                  \\\n  72 ((struct bkey) {                                                  \\\n  73      .high = (1ULL \u003c\u003c 63) | ((__u64) (size) \u003c\u003c 20) | (inode),     \\\n  74      .low = (offset)                                              \\\n  75 })\n\nHere 'size' is 16bits width embedded in 64bits member 'high' of struct\nbkey. But in code block 1, if \"KEY_START(k) - bio-\u003ebi_iter.bi_sector\" is\nvery probably to be larger than (1\u003c\u003c16) - 1, which makes the bkey size\ncalculation in code block 5 is overflowed. In one bug report the value\nof parameter 'sectors' is 131072 (= 1 \u003c\u003c 17), the overflowed 'sectors'\nresults the overflowed s-\u003einsert_bio_sectors in code block 4, then makes\nsize field of s-\u003eiop.replace_key to be 0 in code block 5. Then the 0-\nsized s-\u003eiop.replace_key is inserted into the internal B+ tree as cache\nmissing check key (a special key to detect and avoid a racing between\nnormal write request and cache missing read request) as,\n[code block 8]\n  915   ret = bch_btree_insert_check_key(b, \u0026s-\u003eop, \u0026s-\u003eiop.replace_key);\n\nThen the 0-sized s-\u003eiop.replace_key as 3rd parameter triggers the bkey\nsize check BUG_ON() in code block 2, and causes the kernel panic 1).\n\nAnother ke\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "45a44296-9a2b-4fc5-ba18-a1b156b3dfdb",
      "id": "CVE-2021-47294",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Decrease sock refcount when sock timers expire\n\nCommit 63346650c1a9 (\"netrom: switch to sock timer API\") switched to use\nsock timer API. It replaces mod_timer() by sk_reset_timer(), and\ndel_timer() by sk_stop_timer().\n\nFunction sk_reset_timer() will increase the refcount of sock if it is\ncalled on an inactive timer, hence, in case the timer expires, we need to\ndecrease the refcount ourselves in the handler, otherwise, the sock\nrefcount will be unbalanced and the sock will never be freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a10b7c5-a27b-4120-9c55-8c2d77c23461",
      "id": "CVE-2021-47440",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: encx24j600: check error in devm_regmap_init_encx24j600\n\ndevm_regmap_init may return error which caused by like out of memory,\nthis will results in null pointer dereference later when reading\nor writing register:\n\ngeneral protection fault in encx24j600_spi_probe\nKASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]\nCPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540\nCode: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00\nRSP: 0018:ffffc900010476b8 EFLAGS: 00010207\nRAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000\nRDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094\nRBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a\nR10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001\nR13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08\nFS:  00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459\n spi_probe drivers/spi/spi.c:397\n really_probe drivers/base/dd.c:517\n __driver_probe_device drivers/base/dd.c:751\n driver_probe_device drivers/base/dd.c:782\n __device_attach_driver drivers/base/dd.c:899\n bus_for_each_drv drivers/base/bus.c:427\n __device_attach drivers/base/dd.c:971\n bus_probe_device drivers/base/bus.c:487\n device_add drivers/base/core.c:3364\n __spi_add_device drivers/spi/spi.c:599\n spi_add_device drivers/spi/spi.c:641\n spi_new_device drivers/spi/spi.c:717\n new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e]\n dev_attr_store drivers/base/core.c:2074\n sysfs_kf_write fs/sysfs/file.c:139\n kernfs_fop_write_iter fs/kernfs/file.c:300\n new_sync_write fs/read_write.c:508 (discriminator 4)\n vfs_write fs/read_write.c:594\n ksys_write fs/read_write.c:648\n do_syscall_64 arch/x86/entry/common.c:50\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113\n\nAdd error check in devm_regmap_init_encx24j600 to avoid this situation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6dd30600-aa0b-4f5b-8fdd-c41298120d12",
      "id": "CVE-2022-49324",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: cpc: Fix refcount leak in mips_cpc_default_phys_base\n\nAdd the missing of_node_put() to release the refcount incremented\nby of_find_compatible_node().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea476dbe-922c-4bab-9992-f3fcb4b1eeb0",
      "id": "CVE-2021-47476",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: ni_usb6501: fix NULL-deref in command paths\n\nThe driver uses endpoint-sized USB transfer buffers but had no sanity\nchecks on the sizes. This can lead to zero-size-pointer dereferences or\noverflowed transfer buffers in ni6501_port_command() and\nni6501_counter_command() if a (malicious) device has smaller max-packet\nsizes than expected (or when doing descriptor fuzz testing).\n\nAdd the missing sanity checks to probe().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "152f4be2-cb21-44e9-80f9-be41070b64b9",
      "id": "CVE-2022-1199",
      "description": "A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7e5cf0e-fe15-4a73-8136-543a3ca4d078",
      "id": "CVE-2022-34495",
      "description": "rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6779ae5b-c931-4b1a-bd07-30def5b87945",
      "id": "CVE-2022-42329",
      "description": "Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63a5daf2-2875-4d97-aa07-f4ece15597b5",
      "id": "CVE-2022-45919",
      "description": "An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cc87e79c-c595-444a-9c16-9060c834582d",
      "id": "CVE-2022-48674",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix pcluster use-after-free on UP platforms\n\nDuring stress testing with CONFIG_SMP disabled, KASAN reports as below:\n\n==================================================================\nBUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30\nRead of size 8 at addr ffff8881094223f8 by task stress/7789\n\nCPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n..\n __mutex_lock+0xe5/0xc30\n..\n z_erofs_do_read_page+0x8ce/0x1560\n..\n z_erofs_readahead+0x31c/0x580\n..\nFreed by task 7787\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x20/0x30\n kasan_set_free_info+0x20/0x40\n __kasan_slab_free+0x10c/0x190\n kmem_cache_free+0xed/0x380\n rcu_core+0x3d5/0xc90\n __do_softirq+0x12d/0x389\n\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x97/0xb0\n call_rcu+0x3d/0x3f0\n erofs_shrink_workstation+0x11f/0x210\n erofs_shrink_scan+0xdc/0x170\n shrink_slab.constprop.0+0x296/0x530\n drop_slab+0x1c/0x70\n drop_caches_sysctl_handler+0x70/0x80\n proc_sys_call_handler+0x20a/0x2f0\n vfs_write+0x555/0x6c0\n ksys_write+0xbe/0x160\n do_syscall_64+0x3b/0x90\n\nThe root cause is that erofs_workgroup_unfreeze() doesn't reset to\norig_val thus it causes a race that the pcluster reuses unexpectedly\nbefore freeing.\n\nSince UP platforms are quite rare now, such path becomes unnecessary.\nLet's drop such specific-designed path directly instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46455947-cac8-4dae-9bc3-3c5dce83a6a2",
      "id": "CVE-2022-48834",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: Fix bug in pipe direction for control transfers\n\nThe syzbot fuzzer reported a minor bug in the usbtmc driver:\n\nusb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType 0\nWARNING: CPU: 0 PID: 3813 at drivers/usb/core/urb.c:412\nusb_submit_urb+0x13a5/0x1970 drivers/usb/core/urb.c:410\nModules linked in:\nCPU: 0 PID: 3813 Comm: syz-executor122 Not tainted\n5.17.0-rc5-syzkaller-00306-g2293be58d6a1 #0\n...\nCall Trace:\n \u003cTASK\u003e\n usb_start_wait_urb+0x113/0x530 drivers/usb/core/message.c:58\n usb_internal_control_msg drivers/usb/core/message.c:102 [inline]\n usb_control_msg+0x2a5/0x4b0 drivers/usb/core/message.c:153\n usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1947 [inline]\n\nThe problem is that usbtmc_ioctl_request() uses usb_rcvctrlpipe() for\nall of its transfers, whether they are in or out.  It's easy to fix.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c65788c7-7eaf-40f0-ba75-26c5b28a1c7b",
      "id": "CVE-2022-48839",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix slab-out-of-bounds access in packet_recvmsg()\n\nsyzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH\nand mmap operations, tpacket_rcv() is queueing skbs with\ngarbage in skb-\u003ecb[], triggering a too big copy [1]\n\nPresumably, users of af_packet using mmap() already gets correct\nmetadata from the mapped buffer, we can simply make sure\nto clear 12 bytes that might be copied to user space later.\n\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]\nBUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\nWrite of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631\n\nCPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\n memcpy+0x39/0x60 mm/kasan/shadow.c:66\n memcpy include/linux/fortify-string.h:225 [inline]\n packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\n sock_recvmsg_nosec net/socket.c:948 [inline]\n sock_recvmsg net/socket.c:966 [inline]\n sock_recvmsg net/socket.c:962 [inline]\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7fdfd5954c29\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29\nRDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60\nR13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54\n \u003c/TASK\u003e\n\naddr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:\n ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246\n\nthis frame has 1 object:\n [32, 160) 'addr'\n\nMemory state around the buggy address:\n ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00\n ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\n\u003effffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3\n                                                                ^\n ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1\n ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00\n==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e0581fca-9f5d-40f6-a9dd-952fd995b80d",
      "id": "CVE-2022-48934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()\n\nida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)\ninclusive.\nSo NFP_MAX_MAC_INDEX (0xff) is a valid id.\n\nIn order for the error handling path to work correctly, the 'invalid'\nvalue for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,\ninclusive.\n\nSo set it to -1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9378362-1a64-459f-8ce1-a6d18202a341",
      "id": "CVE-2022-48981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/shmem-helper: Remove errant put in error path\n\ndrm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM\nobject getting prematurely freed leading to a later use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5110aa2c-c60f-45a7-a0f2-b002231de492",
      "id": "CVE-2022-49087",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix a race in rxrpc_exit_net()\n\nCurrent code can lead to the following race:\n\nCPU0                                                 CPU1\n\nrxrpc_exit_net()\n                                                     rxrpc_peer_keepalive_worker()\n                                                       if (rxnet-\u003elive)\n\n  rxnet-\u003elive = false;\n  del_timer_sync(\u0026rxnet-\u003epeer_keepalive_timer);\n\n                                                             timer_reduce(\u0026rxnet-\u003epeer_keepalive_timer, jiffies + delay);\n\n  cancel_work_sync(\u0026rxnet-\u003epeer_keepalive_work);\n\nrxrpc_exit_net() exits while peer_keepalive_timer is still armed,\nleading to use-after-free.\n\nsyzbot report was:\n\nODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0\nWARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505\nModules linked in:\nCPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: netns cleanup_net\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505\nCode: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 \u003c0f\u003e 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3\nRSP: 0018:ffffc9000353fb00 EFLAGS: 00010082\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000\nRDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0\nR13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000\nFS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __debug_check_no_obj_freed lib/debugobjects.c:992 [inline]\n debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023\n kfree+0xd6/0x310 mm/slab.c:3809\n ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176\n ops_free_list net/core/net_namespace.c:174 [inline]\n cleanup_net+0x591/0xb00 net/core/net_namespace.c:598\n process_one_work+0x996/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e9/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd293c8b-3b06-4b3d-b303-2cb83ba54fa1",
      "id": "CVE-2022-49089",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition\n\nThe documentation of the function rvt_error_qp says both r_lock and s_lock\nneed to be held when calling that function.  It also asserts using lockdep\nthat both of those locks are held.  However, the commit I referenced in\nFixes accidentally makes the call to rvt_error_qp in rvt_ruc_loopback no\nlonger covered by r_lock.  This results in the lockdep assertion failing\nand also possibly in a race condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af5875b8-7dbb-4fa2-bb14-b73216f7fa6d",
      "id": "CVE-2022-49335",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/cs: make commands with 0 chunks illegal behaviour.\n\nSubmitting a cs with 0 chunks, causes an oops later, found trying\nto execute the wrong userspace driver.\n\nMESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo\n\n[172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8\n[172536.665188] #PF: supervisor read access in kernel mode\n[172536.665189] #PF: error_code(0x0000) - not-present page\n[172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0\n[172536.665195] Oops: 0000 [#1] SMP NOPTI\n[172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P           O      5.10.81 #1-NixOS\n[172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015\n[172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu]\n[172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 \u003c48\u003e 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10\n[172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246\n[172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68\n[172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38\n[172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40\n[172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28\n[172536.665283] FS:  00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000\n[172536.665284] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0\n[172536.665287] Call Trace:\n[172536.665322]  ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu]\n[172536.665332]  drm_ioctl_kernel+0xaa/0xf0 [drm]\n[172536.665338]  drm_ioctl+0x201/0x3b0 [drm]\n[172536.665369]  ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu]\n[172536.665372]  ? selinux_file_ioctl+0x135/0x230\n[172536.665399]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]\n[172536.665403]  __x64_sys_ioctl+0x83/0xb0\n[172536.665406]  do_syscall_64+0x33/0x40\n[172536.665409]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea9e6b9b-2926-4805-ae07-872083e8d071",
      "id": "CVE-2022-49094",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix slab-out-of-bounds bug in decrypt_internal\n\nThe memory size of tls_ctx-\u003erx.iv for AES128-CCM is 12 setting in\ntls_set_sw_offload(). The return value of crypto_aead_ivsize()\nfor \"ccm(aes)\" is 16. So memcpy() require 16 bytes from 12 bytes\nmemory space will trigger slab-out-of-bounds bug as following:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in decrypt_internal+0x385/0xc40 [tls]\nRead of size 16 at addr ffff888114e84e60 by task tls/10911\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x5e/0x5db\n ? decrypt_internal+0x385/0xc40 [tls]\n kasan_report+0xab/0x120\n ? decrypt_internal+0x385/0xc40 [tls]\n kasan_check_range+0xf9/0x1e0\n memcpy+0x20/0x60\n decrypt_internal+0x385/0xc40 [tls]\n ? tls_get_rec+0x2e0/0x2e0 [tls]\n ? process_rx_list+0x1a5/0x420 [tls]\n ? tls_setup_from_iter.constprop.0+0x2e0/0x2e0 [tls]\n decrypt_skb_update+0x9d/0x400 [tls]\n tls_sw_recvmsg+0x3c8/0xb50 [tls]\n\nAllocated by task 10911:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x81/0xa0\n tls_set_sw_offload+0x2eb/0xa20 [tls]\n tls_setsockopt+0x68c/0x700 [tls]\n __sys_setsockopt+0xfe/0x1b0\n\nReplace the crypto_aead_ivsize() with prot-\u003eiv_size + prot-\u003esalt_size\nwhen memcpy() iv value in TLS_1_3_VERSION scenario.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f73ac84-6377-4ff5-bc4e-c0c2d1246b5f",
      "id": "CVE-2022-49155",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()\n\n[   12.323788] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/1020\n[   12.332297] caller is qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx]\n[   12.338417] CPU: 7 PID: 1020 Comm: systemd-udevd Tainted: G          I      --------- ---  5.14.0-29.el9.x86_64 #1\n[   12.348827] Hardware name: Dell Inc. PowerEdge R610/0F0XJ6, BIOS 6.6.0 05/22/2018\n[   12.356356] Call Trace:\n[   12.358821]  dump_stack_lvl+0x34/0x44\n[   12.362514]  check_preemption_disabled+0xd9/0xe0\n[   12.367164]  qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx]\n[   12.372481]  qla2x00_probe_one+0xa3a/0x1b80 [qla2xxx]\n[   12.377617]  ? _raw_spin_lock_irqsave+0x19/0x40\n[   12.384284]  local_pci_probe+0x42/0x80\n[   12.390162]  ? pci_match_device+0xd7/0x110\n[   12.396366]  pci_device_probe+0xfd/0x1b0\n[   12.402372]  really_probe+0x1e7/0x3e0\n[   12.408114]  __driver_probe_device+0xfe/0x180\n[   12.414544]  driver_probe_device+0x1e/0x90\n[   12.420685]  __driver_attach+0xc0/0x1c0\n[   12.426536]  ? __device_attach_driver+0xe0/0xe0\n[   12.433061]  ? __device_attach_driver+0xe0/0xe0\n[   12.439538]  bus_for_each_dev+0x78/0xc0\n[   12.445294]  bus_add_driver+0x12b/0x1e0\n[   12.451021]  driver_register+0x8f/0xe0\n[   12.456631]  ? 0xffffffffc07bc000\n[   12.461773]  qla2x00_module_init+0x1be/0x229 [qla2xxx]\n[   12.468776]  do_one_initcall+0x44/0x200\n[   12.474401]  ? load_module+0xad3/0xba0\n[   12.479908]  ? kmem_cache_alloc_trace+0x45/0x410\n[   12.486268]  do_init_module+0x5c/0x280\n[   12.491730]  __do_sys_init_module+0x12e/0x1b0\n[   12.497785]  do_syscall_64+0x3b/0x90\n[   12.503029]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   12.509764] RIP: 0033:0x7f554f73ab2e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b7f51e1-ea2a-4379-a768-9e092ee7b0ba",
      "id": "CVE-2022-49212",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init\n\nThe reference counting issue happens in several error handling paths\non a refcounted object \"nc-\u003edmac\". In these paths, the function simply\nreturns the error code, forgetting to balance the reference count of\n\"nc-\u003edmac\", increased earlier by dma_request_channel(), which may\ncause refcount leaks.\n\nFix it by decrementing the refcount of specific object in those error\npaths.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f405783c-bcfd-4d11-af8b-f2d971f85f9c",
      "id": "CVE-2022-49301",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix uninit-value in usb_read8() and friends\n\nWhen r8712_usbctrl_vendorreq() returns negative, 'data' in\nusb_read{8,16,32} will not be initialized.\n\nBUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]\nBUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725\n string_nocheck lib/vsprintf.c:643 [inline]\n string+0x4ec/0x6f0 lib/vsprintf.c:725\n vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806\n va_format lib/vsprintf.c:1704 [inline]\n pointer+0x18e6/0x1f70 lib/vsprintf.c:2443\n vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810\n vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158\n vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256\n dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604\n dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615\n __dev_printk+0x3be/0x440 drivers/base/core.c:4627\n _dev_info+0x1ea/0x22f drivers/base/core.c:4673\n r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401\n usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396\n really_probe+0x6c7/0x1350 drivers/base/dd.c:621\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238\n usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293\n really_probe+0x6c7/0x1350 drivers/base/dd.c:621\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566\n hub_port_connect drivers/usb/core/hub.c:5363 [inline]\n hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]\n port_event drivers/usb/core/hub.c:5665 [inline]\n hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747\n process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289\n worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436\n kthread+0x3c7/0x500 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30\n\nLocal variable data created at:\n usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33\n r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29\n\nKMSAN: uninit-value in r871xu_drv_init\nhttps://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "614011cb-4cc5-4a34-96da-24645ebe0a73",
      "id": "CVE-2022-49318",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove WARN_ON in f2fs_is_valid_blkaddr\n\nSyzbot triggers two WARNs in f2fs_is_valid_blkaddr and\n__is_bitmap_valid. For example, in f2fs_is_valid_blkaddr,\nif type is DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ,\nit invokes WARN_ON if blkaddr is not in the right range.\nThe call trace is as follows:\n\n f2fs_get_node_info+0x45f/0x1070\n read_node_page+0x577/0x1190\n __get_node_page.part.0+0x9e/0x10e0\n __get_node_page\n f2fs_get_node_page+0x109/0x180\n do_read_inode\n f2fs_iget+0x2a5/0x58b0\n f2fs_fill_super+0x3b39/0x7ca0\n\nFix these two WARNs by replacing WARN_ON with dump_stack.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6a05e4eb-7775-4d2b-a03d-bcdd35b26284",
      "id": "CVE-2022-49322",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix sleeping function called from invalid context on RT kernel\n\nWhen setting bootparams=\"trace_event=initcall:initcall_start tp_printk=1\" in the\ncmdline, the output_printk() was called, and the spin_lock_irqsave() was called in the\natomic and irq disable interrupt context suitation. On the PREEMPT_RT kernel,\nthese locks are replaced with sleepable rt-spinlock, so the stack calltrace will\nbe triggered.\nFix it by raw_spin_lock_irqsave when PREEMPT_RT and \"trace_event=initcall:initcall_start\ntp_printk=1\" enabled.\n\n BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0\n preempt_count: 2, expected: 0\n RCU nest depth: 0, expected: 0\n Preemption disabled at:\n [\u003cffffffff8992303e\u003e] try_to_wake_up+0x7e/0xba0\n CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.1-rt17+ #19 34c5812404187a875f32bee7977f7367f9679ea7\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x60/0x8c\n  dump_stack+0x10/0x12\n  __might_resched.cold+0x11d/0x155\n  rt_spin_lock+0x40/0x70\n  trace_event_buffer_commit+0x2fa/0x4c0\n  ? map_vsyscall+0x93/0x93\n  trace_event_raw_event_initcall_start+0xbe/0x110\n  ? perf_trace_initcall_finish+0x210/0x210\n  ? probe_sched_wakeup+0x34/0x40\n  ? ttwu_do_wakeup+0xda/0x310\n  ? trace_hardirqs_on+0x35/0x170\n  ? map_vsyscall+0x93/0x93\n  do_one_initcall+0x217/0x3c0\n  ? trace_event_raw_event_initcall_level+0x170/0x170\n  ? push_cpu_stop+0x400/0x400\n  ? cblist_init_generic+0x241/0x290\n  kernel_init_freeable+0x1ac/0x347\n  ? _raw_spin_unlock_irq+0x65/0x80\n  ? rest_init+0xf0/0xf0\n  kernel_init+0x1e/0x150\n  ret_from_fork+0x22/0x30\n  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c56735cc-3fbf-42ef-8620-e495f12de1a2",
      "id": "CVE-2022-49361",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check for inline inode\n\nYanming reported a kernel bug in Bugzilla kernel [1], which can be\nreproduced. The bug message is:\n\nThe kernel message is shown below:\n\nkernel BUG at fs/inode.c:611!\nCall Trace:\n evict+0x282/0x4e0\n __dentry_kill+0x2b2/0x4d0\n dput+0x2dd/0x720\n do_renameat2+0x596/0x970\n __x64_sys_rename+0x78/0x90\n do_syscall_64+0x3b/0x90\n\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=215895\n\nThe bug is due to fuzzed inode has both inline_data and encrypted flags.\nDuring f2fs_evict_inode(), as the inode was deleted by rename(), it\nwill cause inline data conversion due to conflicting flags. The page\ncache will be polluted and the panic will be triggered in clear_inode().\n\nTry fixing the bug by doing more sanity checks for inline data inode in\nsanity_check_inode().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd0ef8a5-6d95-4201-88db-3595a3396390",
      "id": "CVE-2022-49395",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix out-of-bounds read in LDT setup\n\nsyscall_stub_data() expects the data_count parameter to be the number of\nlongs, not bytes.\n\n ==================================================================\n BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0\n Read of size 128 at addr 000000006411f6f0 by task swapper/1\n\n CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18\n Call Trace:\n  show_stack.cold+0x166/0x2a7\n  __dump_stack+0x3a/0x43\n  dump_stack_lvl+0x1f/0x27\n  print_report.cold+0xdb/0xf81\n  kasan_report+0x119/0x1f0\n  kasan_check_range+0x3a3/0x440\n  memcpy+0x52/0x140\n  syscall_stub_data+0x70/0xe0\n  write_ldt_entry+0xac/0x190\n  init_new_ldt+0x515/0x960\n  init_new_context+0x2c4/0x4d0\n  mm_init.constprop.0+0x5ed/0x760\n  mm_alloc+0x118/0x170\n  0x60033f48\n  do_one_initcall+0x1d7/0x860\n  0x60003e7b\n  kernel_init+0x6e/0x3d4\n  new_thread_handler+0x1e7/0x2c0\n\n The buggy address belongs to stack of task swapper/1\n  and is located at offset 64 in frame:\n  init_new_ldt+0x0/0x960\n\n This frame has 2 objects:\n  [32, 40) 'addr'\n  [64, 80) 'desc'\n ==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "111a4d46-2ce6-49a9-96c3-744898801870",
      "id": "CVE-2022-49412",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: Avoid merging queues with different parents\n\nIt can happen that the parent of a bfqq changes between the moment we\ndecide two queues are worth to merge (and set bic-\u003estable_merge_bfqq)\nand the moment bfq_setup_merge() is called. This can happen e.g. because\nthe process submitted IO for a different cgroup and thus bfqq got\nreparented. It can even happen that the bfqq we are merging with has\nparent cgroup that is already offline and going to be destroyed in which\ncase the merge can lead to use-after-free issues such as:\n\nBUG: KASAN: use-after-free in __bfq_deactivate_entity+0x9cb/0xa50\nRead of size 8 at addr ffff88800693c0c0 by task runc:[2:INIT]/10544\n\nCPU: 0 PID: 10544 Comm: runc:[2:INIT] Tainted: G            E     5.15.2-0.g5fb85fd-default #1 openSUSE Tumbleweed (unreleased) f1f3b891c72369aebecd2e43e4641a6358867c70\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x46/0x5a\n print_address_description.constprop.0+0x1f/0x140\n ? __bfq_deactivate_entity+0x9cb/0xa50\n kasan_report.cold+0x7f/0x11b\n ? __bfq_deactivate_entity+0x9cb/0xa50\n __bfq_deactivate_entity+0x9cb/0xa50\n ? update_curr+0x32f/0x5d0\n bfq_deactivate_entity+0xa0/0x1d0\n bfq_del_bfqq_busy+0x28a/0x420\n ? resched_curr+0x116/0x1d0\n ? bfq_requeue_bfqq+0x70/0x70\n ? check_preempt_wakeup+0x52b/0xbc0\n __bfq_bfqq_expire+0x1a2/0x270\n bfq_bfqq_expire+0xd16/0x2160\n ? try_to_wake_up+0x4ee/0x1260\n ? bfq_end_wr_async_queues+0xe0/0xe0\n ? _raw_write_unlock_bh+0x60/0x60\n ? _raw_spin_lock_irq+0x81/0xe0\n bfq_idle_slice_timer+0x109/0x280\n ? bfq_dispatch_request+0x4870/0x4870\n __hrtimer_run_queues+0x37d/0x700\n ? enqueue_hrtimer+0x1b0/0x1b0\n ? kvm_clock_get_cycles+0xd/0x10\n ? ktime_get_update_offsets_now+0x6f/0x280\n hrtimer_interrupt+0x2c8/0x740\n\nFix the problem by checking that the parent of the two bfqqs we are\nmerging in bfq_setup_merge() is the same.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd32bf6d-8534-4419-8591-70269f0c9644",
      "id": "CVE-2022-49431",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Add missing of_node_put in iommu_init_early_dart\n\nThe device_node pointer is returned by of_find_compatible_node\nwith refcount incremented. We should use of_node_put() to avoid\nthe refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0096d5da-0cd0-493e-a41f-a4c12ade22cc",
      "id": "CVE-2022-49460",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: rk3399_dmc: Disable edev on remove()\n\nOtherwise we hit an unablanced enable-count when unbinding the DFI\ndevice:\n\n[ 1279.659119] ------------[ cut here ]------------\n[ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c\n...\n[ 1279.659352] Hardware name: Google Kevin (DT)\n[ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--)\n[ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c\n[ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28\n...\n[ 1279.659571] Call trace:\n[ 1279.659582]  devfreq_event_remove_edev+0x84/0x8c\n[ 1279.659590]  devm_devfreq_event_release+0x1c/0x28\n[ 1279.659602]  release_nodes+0x1cc/0x244\n[ 1279.659611]  devres_release_all+0x44/0x60\n[ 1279.659621]  device_release_driver_internal+0x11c/0x1ac\n[ 1279.659629]  device_driver_detach+0x20/0x2c\n[ 1279.659641]  unbind_store+0x7c/0xb0\n[ 1279.659650]  drv_attr_store+0x2c/0x40\n[ 1279.659663]  sysfs_kf_write+0x44/0x58\n[ 1279.659672]  kernfs_fop_write_iter+0xf4/0x190\n[ 1279.659684]  vfs_write+0x2b0/0x2e4\n[ 1279.659693]  ksys_write+0x80/0xec\n[ 1279.659701]  __arm64_sys_write+0x24/0x30\n[ 1279.659714]  el0_svc_common+0xf0/0x1d8\n[ 1279.659724]  do_el0_svc_compat+0x28/0x3c\n[ 1279.659738]  el0_svc_compat+0x10/0x1c\n[ 1279.659746]  el0_sync_compat_handler+0xa8/0xcc\n[ 1279.659758]  el0_sync_compat+0x188/0x1c0\n[ 1279.659768] ---[ end trace cec200e5094155b4 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bfc4f266-5717-419e-b2aa-b5a38d97c3e2",
      "id": "CVE-2022-49924",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fdp: Fix potential memory leak in fdp_nci_send()\n\nfdp_nci_send() will call fdp_nci_i2c_write that will not free skb in\nthe function. As a result, when fdp_nci_i2c_write() finished, the skb\nwill memleak. fdp_nci_send() should free skb after fdp_nci_i2c_write()\nfinished.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1564dcb8-f291-4c6f-9d54-c354791739f9",
      "id": "CVE-2022-49493",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rt5645: Fix errorenous cleanup order\n\nThere is a logic error when removing rt5645 device as the function\nrt5645_i2c_remove() first cancel the \u0026rt5645-\u003ejack_detect_work and\ndelete the \u0026rt5645-\u003ebtn_check_timer latter. However, since the timer\nhandler rt5645_btn_check_callback() will re-queue the jack_detect_work,\nthis cleanup order is buggy.\n\nThat is, once the del_timer_sync in rt5645_i2c_remove is concurrently\nrun with the rt5645_btn_check_callback, the canceled jack_detect_work\nwill be rescheduled again, leading to possible use-after-free.\n\nThis patch fix the issue by placing the del_timer_sync function before\nthe cancel_delayed_work_sync.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "53847256-8cbb-4ad5-99a6-cdeb86cfe183",
      "id": "CVE-2022-49513",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: governor: Use kobject release() method to free dbs_data\n\nThe struct dbs_data embeds a struct gov_attr_set and\nthe struct gov_attr_set embeds a kobject. Since every kobject must have\na release() method and we can't use kfree() to free it directly,\nso introduce cpufreq_dbs_data_release() to release the dbs_data via\nthe kobject::release() method. This fixes the calltrace like below:\n\n  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x34\n  WARNING: CPU: 12 PID: 810 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100\n  Modules linked in:\n  CPU: 12 PID: 810 Comm: sh Not tainted 5.16.0-next-20220120-yocto-standard+ #536\n  Hardware name: Marvell OcteonTX CN96XX board (DT)\n  pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : debug_print_object+0xb8/0x100\n  lr : debug_print_object+0xb8/0x100\n  sp : ffff80001dfcf9a0\n  x29: ffff80001dfcf9a0 x28: 0000000000000001 x27: ffff0001464f0000\n  x26: 0000000000000000 x25: ffff8000090e3f00 x24: ffff80000af60210\n  x23: ffff8000094dfb78 x22: ffff8000090e3f00 x21: ffff0001080b7118\n  x20: ffff80000aeb2430 x19: ffff800009e8f5e0 x18: 0000000000000000\n  x17: 0000000000000002 x16: 00004d62e58be040 x15: 013590470523aff8\n  x14: ffff8000090e1828 x13: 0000000001359047 x12: 00000000f5257d14\n  x11: 0000000000040591 x10: 0000000066c1ffea x9 : ffff8000080d15e0\n  x8 : ffff80000a1765a8 x7 : 0000000000000000 x6 : 0000000000000001\n  x5 : ffff800009e8c000 x4 : ffff800009e8c760 x3 : 0000000000000000\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0001474ed040\n  Call trace:\n   debug_print_object+0xb8/0x100\n   __debug_check_no_obj_freed+0x1d0/0x25c\n   debug_check_no_obj_freed+0x24/0xa0\n   kfree+0x11c/0x440\n   cpufreq_dbs_governor_exit+0xa8/0xac\n   cpufreq_exit_governor+0x44/0x90\n   cpufreq_set_policy+0x29c/0x570\n   store_scaling_governor+0x110/0x154\n   store+0xb0/0xe0\n   sysfs_kf_write+0x58/0x84\n   kernfs_fop_write_iter+0x12c/0x1c0\n   new_sync_write+0xf0/0x18c\n   vfs_write+0x1cc/0x220\n   ksys_write+0x74/0x100\n   __arm64_sys_write+0x28/0x3c\n   invoke_syscall.constprop.0+0x58/0xf0\n   do_el0_svc+0x70/0x170\n   el0_svc+0x54/0x190\n   el0t_64_sync_handler+0xa4/0x130\n   el0t_64_sync+0x1a0/0x1a4\n  irq event stamp: 189006\n  hardirqs last  enabled at (189005): [\u003cffff8000080849d0\u003e] finish_task_switch.isra.0+0xe0/0x2c0\n  hardirqs last disabled at (189006): [\u003cffff8000090667a4\u003e] el1_dbg+0x24/0xa0\n  softirqs last  enabled at (188966): [\u003cffff8000080106d0\u003e] __do_softirq+0x4b0/0x6a0\n  softirqs last disabled at (188957): [\u003cffff80000804a618\u003e] __irq_exit_rcu+0x108/0x1a4\n\n[ rjw: Because can be freed by the gov_attr_set_put() in\n  cpufreq_dbs_governor_exit() now, it is also necessary to put the\n  invocation of the governor -\u003eexit() callback into the new\n  cpufreq_dbs_data_release() function. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ad295cb-b57c-44f4-90e0-98f35be552dc",
      "id": "CVE-2022-49527",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: avoid null dereference in deinit\n\nIf venus_probe fails at pm_runtime_put_sync the error handling first\ncalls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets\ncore-\u003eops to NULL, hfi_core_deinit cannot call the core_deinit function\nanymore.\n\nAvoid this null pointer derefence by skipping the call when necessary.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6d980494-e40f-4b58-a49f-86b210e2d973",
      "id": "CVE-2022-49610",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Prevent RSB underflow before vmenter\n\nOn VMX, there are some balanced returns between the time the guest's\nSPEC_CTRL value is written, and the vmenter.\n\nBalanced returns (matched by a preceding call) are usually ok, but it's\nat least theoretically possible an NMI with a deep call stack could\nempty the RSB before one of the returns.\n\nFor maximum paranoia, don't allow *any* returns (balanced or otherwise)\nbetween the SPEC_CTRL write and the vmenter.\n\n  [ bp: Fix 32-bit build. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8c40a10-0d56-4669-afe3-da4922175493",
      "id": "CVE-2022-49707",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add reserved GDT blocks check\n\nWe capture a NULL pointer issue when resizing a corrupt ext4 image which\nis freshly clear resize_inode feature (not run e2fsck). It could be\nsimply reproduced by following steps. The problem is because of the\nresize_inode feature was cleared, and it will convert the filesystem to\nmeta_bg mode in ext4_resize_fs(), but the es-\u003es_reserved_gdt_blocks was\nnot reduced to zero, so could we mistakenly call reserve_backup_gdb()\nand passing an uninitialized resize_inode to it when adding new group\ndescriptors.\n\n mkfs.ext4 /dev/sda 3G\n tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck\n mount /dev/sda /mnt\n resize2fs /dev/sda 8G\n\n ========\n BUG: kernel NULL pointer dereference, address: 0000000000000028\n CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748\n ...\n RIP: 0010:ext4_flex_group_add+0xe08/0x2570\n ...\n Call Trace:\n  \u003cTASK\u003e\n  ext4_resize_fs+0xbec/0x1660\n  __ext4_ioctl+0x1749/0x24e0\n  ext4_ioctl+0x12/0x20\n  __x64_sys_ioctl+0xa6/0x110\n  do_syscall_64+0x3b/0x90\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f2dd739617b\n ========\n\nThe fix is simple, add a check in ext4_resize_begin() to make sure that\nthe es-\u003es_reserved_gdt_blocks is zero when the resize_inode feature is\ndisabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7d96186-ecc3-4ab5-abd4-d80ae0db3f3b",
      "id": "CVE-2022-49835",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: fix potential memleak in 'add_widget_node'\n\nAs 'kobject_add' may allocated memory for 'kobject-\u003ename' when return error.\nAnd in this function, if call 'kobject_add' failed didn't free kobject.\nSo call 'kobject_put' to recycling resources.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "41f5fc40-49ce-42cf-bbc2-e48f0bef8472",
      "id": "CVE-2022-49923",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nxp-nci: Fix potential memory leak in nxp_nci_send()\n\nnxp_nci_send() will call nxp_nci_i2c_write(), and only free skb when\nnxp_nci_i2c_write() failed. However, even if the nxp_nci_i2c_write()\nrun succeeds, the skb will not be freed in nxp_nci_i2c_write(). As the\nresult, the skb will memleak. nxp_nci_send() should also free the skb\nwhen nxp_nci_i2c_write() succeeds.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db0b7aab-f4a6-47fc-b50f-c34d2ce8e88d",
      "id": "CVE-2022-50019",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: Fix refcount leak bug in ucc_uart.c\n\nIn soc_info(), of_find_node_by_type() will return a node pointer\nwith refcount incremented. We should use of_node_put() when it is\nnot used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a410e8d-d2f3-453c-854d-ff9960e88ba3",
      "id": "CVE-2022-50419",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sysfs: Fix attempting to call device_add multiple times\n\ndevice_add shall not be called multiple times as stated in its\ndocumentation:\n\n 'Do not call this routine or device_register() more than once for\n any device structure'\n\nSyzkaller reports a bug as follows [1]:\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:33!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN\n[...]\nCall Trace:\n \u003cTASK\u003e\n __list_add include/linux/list.h:69 [inline]\n list_add_tail include/linux/list.h:102 [inline]\n kobj_kset_join lib/kobject.c:164 [inline]\n kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214\n kobject_add_varg lib/kobject.c:358 [inline]\n kobject_add+0x150/0x1c0 lib/kobject.c:410\n device_add+0x368/0x1e90 drivers/base/core.c:3452\n hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53\n hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799\n hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110\n hci_event_func net/bluetooth/hci_event.c:7440 [inline]\n hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495\n hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007\n process_one_work+0x991/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e45d5a1-6b5f-4c7e-b2b5-c78bf76cd8aa",
      "id": "CVE-2023-1990",
      "description": "A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fec8117c-d74d-4608-ab02-c9389b3d97dc",
      "id": "CVE-2023-38409",
      "description": "An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32e6e7dd-19c6-404a-898d-d953aaa36ab7",
      "id": "CVE-2023-52513",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix connection failure handling\n\nIn case immediate MPA request processing fails, the newly\ncreated endpoint unlinks the listening endpoint and is\nready to be dropped. This special case was not handled\ncorrectly by the code handling the later TCP socket close,\ncausing a NULL dereference crash in siw_cm_work_handler()\nwhen dereferencing a NULL listener. We now also cancel\nthe useless MPA timeout, if immediate MPA request\nprocessing fails.\n\nThis patch furthermore simplifies MPA processing in general:\nScheduling a useless TCP socket read in sk_data_ready() upcall\nis now surpressed, if the socket is already moved out of\nTCP_ESTABLISHED state.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7c6ad59-2dbf-4df2-b528-d28995ffef9e",
      "id": "CVE-2023-52596",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Fix out of bounds access for empty sysctl registers\n\nWhen registering tables to the sysctl subsystem there is a check to see\nif header is a permanently empty directory (used for mounts). This check\nevaluates the first element of the ctl_table. This results in an out of\nbounds evaluation when registering empty directories.\n\nThe function register_sysctl_mount_point now passes a ctl_table of size\n1 instead of size 0. It now relies solely on the type to identify\na permanently empty register.\n\nMake sure that the ctl_table has at least one element before testing for\npermanent emptiness.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b95e845-c7d6-44b5-8701-d5623b63896f",
      "id": "CVE-2023-52707",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/psi: Fix use-after-free in ep_remove_wait_queue()\n\nIf a non-root cgroup gets removed when there is a thread that registered\ntrigger and is polling on a pressure file within the cgroup, the polling\nwaitqueue gets freed in the following path:\n\n do_rmdir\n   cgroup_rmdir\n     kernfs_drain_open_files\n       cgroup_file_release\n         cgroup_pressure_release\n           psi_trigger_destroy\n\nHowever, the polling thread still has a reference to the pressure file and\nwill access the freed waitqueue when the file is closed or upon exit:\n\n fput\n   ep_eventpoll_release\n     ep_free\n       ep_remove_wait_queue\n         remove_wait_queue\n\nThis results in use-after-free as pasted below.\n\nThe fundamental problem here is that cgroup_file_release() (and\nconsequently waitqueue's lifetime) is not tied to the file's real lifetime.\nUsing wake_up_pollfree() here might be less than ideal, but it is in line\nwith the comment at commit 42288cb44c4b (\"wait: add wake_up_pollfree()\")\nsince the waitqueue's lifetime is not tied to file's one and can be\nconsidered as another special case. While this would be fixable by somehow\nmaking cgroup_file_release() be tied to the fput(), it would require\nsizable refactoring at cgroups or higher layer which might be more\njustifiable if we identify more cases like this.\n\n  BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x60/0xc0\n  Write of size 4 at addr ffff88810e625328 by task a.out/4404\n\n\tCPU: 19 PID: 4404 Comm: a.out Not tainted 6.2.0-rc6 #38\n\tHardware name: Amazon EC2 c5a.8xlarge/, BIOS 1.0 10/16/2017\n\tCall Trace:\n\t\u003cTASK\u003e\n\tdump_stack_lvl+0x73/0xa0\n\tprint_report+0x16c/0x4e0\n\tkasan_report+0xc3/0xf0\n\tkasan_check_range+0x2d2/0x310\n\t_raw_spin_lock_irqsave+0x60/0xc0\n\tremove_wait_queue+0x1a/0xa0\n\tep_free+0x12c/0x170\n\tep_eventpoll_release+0x26/0x30\n\t__fput+0x202/0x400\n\ttask_work_run+0x11d/0x170\n\tdo_exit+0x495/0x1130\n\tdo_group_exit+0x100/0x100\n\tget_signal+0xd67/0xde0\n\tarch_do_signal_or_restart+0x2a/0x2b0\n\texit_to_user_mode_prepare+0x94/0x100\n\tsyscall_exit_to_user_mode+0x20/0x40\n\tdo_syscall_64+0x52/0x90\n\tentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\t\u003c/TASK\u003e\n\n Allocated by task 4404:\n\n\tkasan_set_track+0x3d/0x60\n\t__kasan_kmalloc+0x85/0x90\n\tpsi_trigger_create+0x113/0x3e0\n\tpressure_write+0x146/0x2e0\n\tcgroup_file_write+0x11c/0x250\n\tkernfs_fop_write_iter+0x186/0x220\n\tvfs_write+0x3d8/0x5c0\n\tksys_write+0x90/0x110\n\tdo_syscall_64+0x43/0x90\n\tentry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n Freed by task 4407:\n\n\tkasan_set_track+0x3d/0x60\n\tkasan_save_free_info+0x27/0x40\n\t____kasan_slab_free+0x11d/0x170\n\tslab_free_freelist_hook+0x87/0x150\n\t__kmem_cache_free+0xcb/0x180\n\tpsi_trigger_destroy+0x2e8/0x310\n\tcgroup_file_release+0x4f/0xb0\n\tkernfs_drain_open_files+0x165/0x1f0\n\tkernfs_drain+0x162/0x1a0\n\t__kernfs_remove+0x1fb/0x310\n\tkernfs_remove_by_name_ns+0x95/0xe0\n\tcgroup_addrm_files+0x67f/0x700\n\tcgroup_destroy_locked+0x283/0x3c0\n\tcgroup_rmdir+0x29/0x100\n\tkernfs_iop_rmdir+0xd1/0x140\n\tvfs_rmdir+0xfe/0x240\n\tdo_rmdir+0x13d/0x280\n\t__x64_sys_rmdir+0x2c/0x30\n\tdo_syscall_64+0x43/0x90\n\tentry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cbab4542-334b-4061-af2f-3a48ae50304e",
      "id": "CVE-2023-52803",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\n\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\nworkqueue,which takes care about pipefs superblock locking.\nIn some special scenarios, when kernel frees the pipefs sb of the\ncurrent client and immediately alloctes a new pipefs sb,\nrpc_remove_pipedir function would misjudge the existence of pipefs\nsb which is not the one it used to hold. As a result,\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\n\nTo fix this issue, rpc_remove_pipedir should check whether the\ncurrent pipefs sb is consistent with the original pipefs sb.\n\nThis error can be catched by KASAN:\n=========================================================\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\n[  250.500549] Workqueue: events rpc_free_client_work\n[  250.501001] Call Trace:\n[  250.502880]  kasan_report+0xb6/0xf0\n[  250.503209]  ? dget_parent+0x195/0x200\n[  250.503561]  dget_parent+0x195/0x200\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\n[  250.505195]  rpc_free_client_work+0xe4/0x230\n[  250.505598]  process_one_work+0x8ee/0x13b0\n...\n[   22.039056] Allocated by task 244:\n[   22.039390]  kasan_save_stack+0x22/0x50\n[   22.039758]  kasan_set_track+0x25/0x30\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\n[   22.040889]  __d_alloc+0x31/0x8e0\n[   22.041207]  d_alloc+0x44/0x1f0\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\n[   22.042459]  rpc_create_client_dir+0x34/0x150\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\n[   22.043284]  rpc_client_register+0x136/0x4e0\n[   22.043689]  rpc_new_client+0x911/0x1020\n[   22.044057]  rpc_create_xprt+0xcb/0x370\n[   22.044417]  rpc_create+0x36b/0x6c0\n...\n[   22.049524] Freed by task 0:\n[   22.049803]  kasan_save_stack+0x22/0x50\n[   22.050165]  kasan_set_track+0x25/0x30\n[   22.050520]  kasan_save_free_info+0x2b/0x50\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\n[   22.051306]  kmem_cache_free+0xa5/0x390\n[   22.051667]  rcu_core+0x62c/0x1930\n[   22.051995]  __do_softirq+0x165/0x52a\n[   22.052347]\n[   22.052503] Last potentially related work creation:\n[   22.052952]  kasan_save_stack+0x22/0x50\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\n[   22.054209]  dentry_free+0xb2/0x140\n[   22.054540]  __dentry_kill+0x3be/0x540\n[   22.054900]  shrink_dentry_list+0x199/0x510\n[   22.055293]  shrink_dcache_parent+0x190/0x240\n[   22.055703]  do_one_tree+0x11/0x40\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\n[   22.056461]  generic_shutdown_super+0x70/0x590\n[   22.056879]  kill_anon_super+0x3a/0x60\n[   22.057234]  rpc_kill_sb+0x121/0x200",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ba3a2d4-4aef-477b-a137-1f39abb3c8d6",
      "id": "CVE-2023-52810",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: Add check for negative db_l2nbperpage\n\nl2nbperpage is log2(number of blks per page), and the minimum legal\nvalue should be 0, not negative.\n\nIn the case of l2nbperpage being negative, an error will occur\nwhen subsequently used as shift exponent.\n\nSyzbot reported this bug:\n\nUBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12\nshift exponent -16777216 is negative",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2955cc2e-fe4d-4b85-b9c9-309b4cedcc54",
      "id": "CVE-2023-52819",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga\n\nFor pptable structs that use flexible array sizes, use flexible arrays.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d86c8787-5bdc-4d0e-8a5a-11b8aab163bb",
      "id": "CVE-2023-53041",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Perform lockless command completion in abort path\n\nWhile adding and removing the controller, the following call trace was\nobserved:\n\nWARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50\nCPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1\nRIP: 0010:dma_free_attrs+0x33/0x50\n\nCall Trace:\n   qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx]\n   qla2x00_abort_srb+0x8e/0x250 [qla2xxx]\n   ? ql_dbg+0x70/0x100 [qla2xxx]\n   __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx]\n   qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx]\n   qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx]\n   qla2x00_remove_one+0x364/0x400 [qla2xxx]\n   pci_device_remove+0x36/0xa0\n   __device_release_driver+0x17a/0x230\n   device_release_driver+0x24/0x30\n   pci_stop_bus_device+0x68/0x90\n   pci_stop_and_remove_bus_device_locked+0x16/0x30\n   remove_store+0x75/0x90\n   kernfs_fop_write_iter+0x11c/0x1b0\n   new_sync_write+0x11f/0x1b0\n   vfs_write+0x1eb/0x280\n   ksys_write+0x5f/0xe0\n   do_syscall_64+0x5c/0x80\n   ? do_user_addr_fault+0x1d8/0x680\n   ? do_syscall_64+0x69/0x80\n   ? exc_page_fault+0x62/0x140\n   ? asm_exc_page_fault+0x8/0x30\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe command was completed in the abort path during driver unload with a\nlock held, causing the warning in abort path. Hence complete the command\nwithout any lock held.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56f9d2b3-125a-4554-903f-f09eab77e0a2",
      "id": "CVE-2023-53324",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/mdp5: Don't leak some plane state\n\nApparently no one noticed that mdp5 plane states leak like a sieve\never since we introduced plane_state-\u003ecommit refcount a few years ago\nin 21a01abbe32a (\"drm/atomic: Fix freeing connector/plane state too\nearly by tracking commits, v3.\")\n\nFix it by using the right helpers.\n\nPatchwork: https://patchwork.freedesktop.org/patch/551236/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ac0316e7-7400-40f1-af90-fc0ce0c5889e",
      "id": "CVE-2023-53078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()\n\nIf alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not\nfreed, which will cause following memleak:\n\nunreferenced object 0xffff88810b2c6980 (size 32):\n  comm \"kworker/u16:2\", pid 635322, jiffies 4355801099 (age 1216426.076s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff  @9$.............\n  backtrace:\n    [\u003c0000000098f3a26d\u003e] alua_activate+0xb0/0x320\n    [\u003c000000003b529641\u003e] scsi_dh_activate+0xb2/0x140\n    [\u003c000000007b296db3\u003e] activate_path_work+0xc6/0xe0 [dm_multipath]\n    [\u003c000000007adc9ace\u003e] process_one_work+0x3c5/0x730\n    [\u003c00000000c457a985\u003e] worker_thread+0x93/0x650\n    [\u003c00000000cb80e628\u003e] kthread+0x1ba/0x210\n    [\u003c00000000a1e61077\u003e] ret_from_fork+0x22/0x30\n\nFix the problem by freeing 'qdata' in error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "602eb657-8694-4b7f-bae0-9d6a6fbda1be",
      "id": "CVE-2023-53098",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: gpio-ir-recv: add remove function\n\nIn case runtime PM is enabled, do runtime PM clean up to remove\ncpu latency qos request, otherwise driver removal may have below\nkernel dump:\n\n[   19.463299] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000048\n[   19.472161] Mem abort info:\n[   19.474985]   ESR = 0x0000000096000004\n[   19.478754]   EC = 0x25: DABT (current EL), IL = 32 bits\n[   19.484081]   SET = 0, FnV = 0\n[   19.487149]   EA = 0, S1PTW = 0\n[   19.490361]   FSC = 0x04: level 0 translation fault\n[   19.495256] Data abort info:\n[   19.498149]   ISV = 0, ISS = 0x00000004\n[   19.501997]   CM = 0, WnR = 0\n[   19.504977] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000049f81000\n[   19.511432] [0000000000000048] pgd=0000000000000000,\np4d=0000000000000000\n[   19.518245] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[   19.524520] Modules linked in: gpio_ir_recv(+) rc_core [last\nunloaded: rc_core]\n[   19.531845] CPU: 0 PID: 445 Comm: insmod Not tainted\n6.2.0-rc1-00028-g2c397a46d47c #72\n[   19.531854] Hardware name: FSL i.MX8MM EVK board (DT)\n[   19.531859] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS\nBTYPE=--)\n[   19.551777] pc : cpu_latency_qos_remove_request+0x20/0x110\n[   19.557277] lr : gpio_ir_recv_runtime_suspend+0x18/0x30\n[gpio_ir_recv]\n[   19.557294] sp : ffff800008ce3740\n[   19.557297] x29: ffff800008ce3740 x28: 0000000000000000 x27:\nffff800008ce3d50\n[   19.574270] x26: ffffc7e3e9cea100 x25: 00000000000f4240 x24:\nffffc7e3f9ef0e30\n[   19.574284] x23: 0000000000000000 x22: ffff0061803820f4 x21:\n0000000000000008\n[   19.574296] x20: ffffc7e3fa75df30 x19: 0000000000000020 x18:\nffffffffffffffff\n[   19.588570] x17: 0000000000000000 x16: ffffc7e3f9efab70 x15:\nffffffffffffffff\n[   19.595712] x14: ffff800008ce37b8 x13: ffff800008ce37aa x12:\n0000000000000001\n[   19.602853] x11: 0000000000000001 x10: ffffcbe3ec0dff87 x9 :\n0000000000000008\n[   19.609991] x8 : 0101010101010101 x7 : 0000000000000000 x6 :\n000000000f0bfe9f\n[   19.624261] x5 : 00ffffffffffffff x4 : 0025ab8e00000000 x3 :\nffff006180382010\n[   19.631405] x2 : ffffc7e3e9ce8030 x1 : ffffc7e3fc3eb810 x0 :\n0000000000000020\n[   19.638548] Call trace:\n[   19.640995]  cpu_latency_qos_remove_request+0x20/0x110\n[   19.646142]  gpio_ir_recv_runtime_suspend+0x18/0x30 [gpio_ir_recv]\n[   19.652339]  pm_generic_runtime_suspend+0x2c/0x44\n[   19.657055]  __rpm_callback+0x48/0x1dc\n[   19.660807]  rpm_callback+0x6c/0x80\n[   19.664301]  rpm_suspend+0x10c/0x640\n[   19.667880]  rpm_idle+0x250/0x2d0\n[   19.671198]  update_autosuspend+0x38/0xe0\n[   19.675213]  pm_runtime_set_autosuspend_delay+0x40/0x60\n[   19.680442]  gpio_ir_recv_probe+0x1b4/0x21c [gpio_ir_recv]\n[   19.685941]  platform_probe+0x68/0xc0\n[   19.689610]  really_probe+0xc0/0x3dc\n[   19.693189]  __driver_probe_device+0x7c/0x190\n[   19.697550]  driver_probe_device+0x3c/0x110\n[   19.701739]  __driver_attach+0xf4/0x200\n[   19.705578]  bus_for_each_dev+0x70/0xd0\n[   19.709417]  driver_attach+0x24/0x30\n[   19.712998]  bus_add_driver+0x17c/0x240\n[   19.716834]  driver_register+0x78/0x130\n[   19.720676]  __platform_driver_register+0x28/0x34\n[   19.725386]  gpio_ir_recv_driver_init+0x20/0x1000 [gpio_ir_recv]\n[   19.731404]  do_one_initcall+0x44/0x2ac\n[   19.735243]  do_init_module+0x48/0x1d0\n[   19.739003]  load_module+0x19fc/0x2034\n[   19.742759]  __do_sys_finit_module+0xac/0x12c\n[   19.747124]  __arm64_sys_finit_module+0x20/0x30\n[   19.751664]  invoke_syscall+0x48/0x114\n[   19.755420]  el0_svc_common.constprop.0+0xcc/0xec\n[   19.760132]  do_el0_svc+0x38/0xb0\n[   19.763456]  el0_svc+0x2c/0x84\n[   19.766516]  el0t_64_sync_handler+0xf4/0x120\n[   19.770789]  el0t_64_sync+0x190/0x194\n[   19.774460] Code: 910003fd a90153f3 aa0003f3 91204021 (f9401400)\n[   19.780556] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ca6c4479-0496-40b8-9299-d4bacc2c90e9",
      "id": "CVE-2023-53133",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()\n\nWhen the buffer length of the recvmsg system call is 0, we got the\nflollowing soft lockup problem:\n\nwatchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149]\nCPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:remove_wait_queue+0xb/0xc0\nCode: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 \u003c41\u003e 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20\nRSP: 0018:ffff88811b5978b8 EFLAGS: 00000246\nRAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768\nRDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040\nRBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7\nR10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800\nR13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0\nFS:  00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n tcp_msg_wait_data+0x279/0x2f0\n tcp_bpf_recvmsg_parser+0x3c6/0x490\n inet_recvmsg+0x280/0x290\n sock_recvmsg+0xfc/0x120\n ____sys_recvmsg+0x160/0x3d0\n ___sys_recvmsg+0xf0/0x180\n __sys_recvmsg+0xea/0x1a0\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nThe logic in tcp_bpf_recvmsg_parser is as follows:\n\nmsg_bytes_ready:\n\tcopied = sk_msg_recvmsg(sk, psock, msg, len, flags);\n\tif (!copied) {\n\t\twait data;\n\t\tgoto msg_bytes_ready;\n\t}\n\nIn this case, \"copied\" always is 0, the infinite loop occurs.\n\nAccording to the Linux system call man page, 0 should be returned in this\ncase. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly\nreturn. Also modify several other functions with the same problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d8d2a9b-f89e-4850-8c00-7df54dda03d2",
      "id": "CVE-2023-53199",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails\n\nSyzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().\nWhile processing skbs in ath9k_hif_usb_rx_stream(), the already allocated\nskbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we\nhave an incorrect pkt_len or pkt_tag, the input skb is considered invalid\nand dropped. All the associated packets already in skb_pool should be\ndropped and freed. Added a comment describing this issue.\n\nThe patch also makes remain_skb NULL after being processed so that it\ncannot be referenced after potential free. The initialization of hif_dev\nfields which are associated with remain_skb (rx_remain_len,\nrx_transfer_len and rx_pad_len) is moved after a new remain_skb is\nallocated.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "613e7cb4-9808-42cc-8389-467ffa691fb3",
      "id": "CVE-2023-53238",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()\n\nThe size of array 'priv-\u003eports[]' is INNO_PHY_PORT_NUM.\n\nIn the for loop, 'i' is used as the index for array 'priv-\u003eports[]'\nwith a check (i \u003e INNO_PHY_PORT_NUM) which indicates that\nINNO_PHY_PORT_NUM is allowed value for 'i' in the same loop.\n\nThis \u003e comparison needs to be changed to \u003e=, otherwise it potentially leads\nto an out of bounds write on the next iteration through the loop",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1212f784-6741-48b3-a057-2de0afd4ccaa",
      "id": "CVE-2023-53290",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/bpf: Fix fout leak in hbm's run_bpf_prog\n\nFix fout being fopen'ed but then not subsequently fclose'd. In the affected\nbranch, fout is otherwise going out of scope.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4290c4b-fabb-4bfd-9eb5-f7243c25a7c3",
      "id": "CVE-2024-27408",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\n\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "767192b6-7e6e-41e3-9425-ab6daabeca2c",
      "id": "CVE-2023-53387",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix device management cmd timeout flow\n\nIn the UFS error handling flow, the host will send a device management cmd\n(NOP OUT) to the device for link recovery. If this cmd times out and\nclearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and\nreturn. hba-\u003edev_cmd.complete struct is not set to NULL.\n\nWhen this happens, if cmd has been completed by device, then we will call\ncomplete() in __ufshcd_transfer_req_compl(). Because the complete struct is\nallocated on the stack, the following crash will occur:\n\n  ipanic_die+0x24/0x38 [mrdump]\n  die+0x344/0x748\n  arm64_notify_die+0x44/0x104\n  do_debug_exception+0x104/0x1e0\n  el1_dbg+0x38/0x54\n  el1_sync_handler+0x40/0x88\n  el1_sync+0x8c/0x140\n  queued_spin_lock_slowpath+0x2e4/0x3c0\n  __ufshcd_transfer_req_compl+0x3b0/0x1164\n  ufshcd_trc_handler+0x15c/0x308\n  ufshcd_host_reset_and_restore+0x54/0x260\n  ufshcd_reset_and_restore+0x28c/0x57c\n  ufshcd_err_handler+0xeb8/0x1b6c\n  process_one_work+0x288/0x964\n  worker_thread+0x4bc/0xc7c\n  kthread+0x15c/0x264\n  ret_from_fork+0x10/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a559a02d-2f0e-4811-bd9c-c29822cb8c1c",
      "id": "CVE-2024-26591",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix re-attachment branch in bpf_tracing_prog_attach\n\nThe following case can cause a crash due to missing attach_btf:\n\n1) load rawtp program\n2) load fentry program with rawtp as target_fd\n3) create tracing link for fentry program with target_fd = 0\n4) repeat 3\n\nIn the end we have:\n\n- prog-\u003eaux-\u003edst_trampoline == NULL\n- tgt_prog == NULL (because we did not provide target_fd to link_create)\n- prog-\u003eaux-\u003eattach_btf == NULL (the program was loaded with attach_prog_fd=X)\n- the program was loaded for tgt_prog but we have no way to find out which one\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000058\n    Call Trace:\n     \u003cTASK\u003e\n     ? __die+0x20/0x70\n     ? page_fault_oops+0x15b/0x430\n     ? fixup_exception+0x22/0x330\n     ? exc_page_fault+0x6f/0x170\n     ? asm_exc_page_fault+0x22/0x30\n     ? bpf_tracing_prog_attach+0x279/0x560\n     ? btf_obj_id+0x5/0x10\n     bpf_tracing_prog_attach+0x439/0x560\n     __sys_bpf+0x1cf4/0x2de0\n     __x64_sys_bpf+0x1c/0x30\n     do_syscall_64+0x41/0xf0\n     entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nReturn -EINVAL in this situation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "684e6d44-14a4-4847-87ff-4d039204e0f9",
      "id": "CVE-2024-26598",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache\n\nThere is a potential UAF scenario in the case of an LPI translation\ncache hit racing with an operation that invalidates the cache, such\nas a DISCARD ITS command. The root of the problem is that\nvgic_its_check_cache() does not elevate the refcount on the vgic_irq\nbefore dropping the lock that serializes refcount changes.\n\nHave vgic_its_check_cache() raise the refcount on the returned vgic_irq\nand add the corresponding decrement after queueing the interrupt.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ad5d32ff-4266-45ec-a197-d48c5a302831",
      "id": "CVE-2024-26602",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/membarrier: reduce the ability to hammer on sys_membarrier\n\nOn some systems, sys_membarrier can be very expensive, causing overall\nslowdowns for everything.  So put a lock on the path in order to\nserialize the accesses to prevent the ability for this to be called at\ntoo high of a frequency and saturate the machine.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "92a6558f-8f60-455e-8684-1e0897a5502c",
      "id": "CVE-2024-27024",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: fix WARNING in rds_conn_connect_if_down\n\nIf connection isn't established yet, get_mr() will fail, trigger connection after\nget_mr().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cb44ed9a-d5ea-4ba4-b3b1-9ed1e3b1db9d",
      "id": "CVE-2024-40905",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible race in __fib6_drop_pcpu_from()\n\nsyzbot found a race in __fib6_drop_pcpu_from() [1]\n\nIf compiler reads more than once (*ppcpu_rt),\nsecond read could read NULL, if another cpu clears\nthe value in rt6_get_pcpu_route().\n\nAdd a READ_ONCE() to prevent this race.\n\nAlso add rcu_read_lock()/rcu_read_unlock() because\nwe rely on RCU protection while dereferencing pcpu_rt.\n\n[1]\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]\nCPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nWorkqueue: netns cleanup_net\n RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984\nCode: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 \u003c80\u003e 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48\nRSP: 0018:ffffc900040df070 EFLAGS: 00010206\nRAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16\nRDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091\nRBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007\nR10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8\nR13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001\nFS:  0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline]\n  fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline]\n  fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038\n  fib6_del_route net/ipv6/ip6_fib.c:1998 [inline]\n  fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043\n  fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205\n  fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127\n  fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175\n  fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255\n  __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271\n  rt6_sync_down_dev net/ipv6/route.c:4906 [inline]\n  rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911\n  addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855\n  addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778\n  notifier_call_chain+0xb9/0x410 kernel/notifier.c:93\n  call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992\n  call_netdevice_notifiers_extack net/core/dev.c:2030 [inline]\n  call_netdevice_notifiers net/core/dev.c:2044 [inline]\n  dev_close_many+0x333/0x6a0 net/core/dev.c:1585\n  unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193\n  unregister_netdevice_many net/core/dev.c:11276 [inline]\n  default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759\n  ops_exit_list+0x128/0x180 net/core/net_namespace.c:178\n  cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640\n  process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n  process_scheduled_works kernel/workqueue.c:3312 [inline]\n  worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393\n  kthread+0x2c1/0x3a0 kernel/kthread.c:389\n  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2b9ff89-ae97-4e4b-bed7-d1fbd88f9733",
      "id": "CVE-2024-35805",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm snapshot: fix lockup in dm_exception_table_exit\n\nThere was reported lockup when we exit a snapshot with many exceptions.\nFix this by adding \"cond_resched\" to the loop that frees the exceptions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13f64e85-bb7e-4062-9b2b-9160b8040b3c",
      "id": "CVE-2024-35828",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()\n\nIn the for statement of lbs_allocate_cmd_buffer(), if the allocation of\ncmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to\nbe freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7303160-7e21-4d16-a4f5-99a9a59ab725",
      "id": "CVE-2024-35855",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update\n\nThe rule activity update delayed work periodically traverses the list of\nconfigured rules and queries their activity from the device.\n\nAs part of this task it accesses the entry pointed by 'ventry-\u003eentry',\nbut this entry can be changed concurrently by the rehash delayed work,\nleading to a use-after-free [1].\n\nFix by closing the race and perform the activity query under the\n'vregion-\u003elock' mutex.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\nRead of size 8 at addr ffff8881054ed808 by task kworker/0:18/181\n\nCPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\n mlxsw_sp_acl_rule_activity_update_work+0x219/0x400\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf84f853-81f4-4e70-b7c9-9d5f5ba68ffd",
      "id": "CVE-2024-35862",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_network_name_deleted()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b45b715-c509-4ca2-a98b-8287061b2bd5",
      "id": "CVE-2024-35949",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: make sure that WRITTEN is set on all metadata blocks\n\nWe previously would call btrfs_check_leaf() if we had the check\nintegrity code enabled, which meant that we could only run the extended\nleaf checks if we had WRITTEN set on the header flags.\n\nThis leaves a gap in our checking, because we could end up with\ncorruption on disk where WRITTEN isn't set on the leaf, and then the\nextended leaf checks don't get run which we rely on to validate all of\nthe item pointers to make sure we don't access memory outside of the\nextent buffer.\n\nHowever, since 732fab95abe2 (\"btrfs: check-integrity: remove\nCONFIG_BTRFS_FS_CHECK_INTEGRITY option\") we no longer call\nbtrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only\never call it on blocks that are being written out, and thus have WRITTEN\nset, or that are being read in, which should have WRITTEN set.\n\nAdd checks to make sure we have WRITTEN set appropriately, and then make\nsure __btrfs_check_leaf() always does the item checking.  This will\nprotect us from file systems that have been corrupted and no longer have\nWRITTEN set on some of the blocks.\n\nThis was hit on a crafted image tweaking the WRITTEN bit and reported by\nKASAN as out-of-bound access in the eb accessors. The example is a dir\nitem at the end of an eb.\n\n  [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2\n  [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f]\n  [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1\n  [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0\n  [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206\n  [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0\n  [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748\n  [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9\n  [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a\n  [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8\n  [2.621] FS:  00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000\n  [2.621] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0\n  [2.621] Call Trace:\n  [2.621]  \u003cTASK\u003e\n  [2.621]  ? show_regs+0x74/0x80\n  [2.621]  ? die_addr+0x46/0xc0\n  [2.621]  ? exc_general_protection+0x161/0x2a0\n  [2.621]  ? asm_exc_general_protection+0x26/0x30\n  [2.621]  ? btrfs_get_16+0x33a/0x6d0\n  [2.621]  ? btrfs_get_16+0x34b/0x6d0\n  [2.621]  ? btrfs_get_16+0x33a/0x6d0\n  [2.621]  ? __pfx_btrfs_get_16+0x10/0x10\n  [2.621]  ? __pfx_mutex_unlock+0x10/0x10\n  [2.621]  btrfs_match_dir_item_name+0x101/0x1a0\n  [2.621]  btrfs_lookup_dir_item+0x1f3/0x280\n  [2.621]  ? __pfx_btrfs_lookup_dir_item+0x10/0x10\n  [2.621]  btrfs_get_tree+0xd25/0x1910\n\n[ copy more details from report ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "66d245b4-04fb-43bd-a6b7-18bc25f5fd66",
      "id": "CVE-2024-36952",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Move NPIV's transport unregistration to after resource clean up\n\nThere are cases after NPIV deletion where the fabric switch still believes\nthe NPIV is logged into the fabric.  This occurs when a vport is\nunregistered before the Remove All DA_ID CT and LOGO ELS are sent to the\nfabric.\n\nCurrently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including\nthe fabric D_ID, removes the last ndlp reference and frees the ndlp rport\nobject.  This sometimes causes the race condition where the final DA_ID and\nLOGO are skipped from being sent to the fabric switch.\n\nFix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID\nand LOGO are sent.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "67721ca3-8e63-4f73-b5db-5974808e68c2",
      "id": "CVE-2024-38596",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix data races in unix_release_sock/unix_stream_sendmsg\n\nA data-race condition has been identified in af_unix. In one data path,\nthe write function unix_release_sock() atomically writes to\nsk-\u003esk_shutdown using WRITE_ONCE. However, on the reader side,\nunix_stream_sendmsg() does not read it atomically. Consequently, this\nissue is causing the following KCSAN splat to occur:\n\n\tBUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg\n\n\twrite (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28:\n\tunix_release_sock (net/unix/af_unix.c:640)\n\tunix_release (net/unix/af_unix.c:1050)\n\tsock_close (net/socket.c:659 net/socket.c:1421)\n\t__fput (fs/file_table.c:422)\n\t__fput_sync (fs/file_table.c:508)\n\t__se_sys_close (fs/open.c:1559 fs/open.c:1541)\n\t__x64_sys_close (fs/open.c:1541)\n\tx64_sys_call (arch/x86/entry/syscall_64.c:33)\n\tdo_syscall_64 (arch/x86/entry/common.c:?)\n\tentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n\tread to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14:\n\tunix_stream_sendmsg (net/unix/af_unix.c:2273)\n\t__sock_sendmsg (net/socket.c:730 net/socket.c:745)\n\t____sys_sendmsg (net/socket.c:2584)\n\t__sys_sendmmsg (net/socket.c:2638 net/socket.c:2724)\n\t__x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750)\n\tx64_sys_call (arch/x86/entry/syscall_64.c:33)\n\tdo_syscall_64 (arch/x86/entry/common.c:?)\n\tentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n\tvalue changed: 0x01 -\u003e 0x03\n\nThe line numbers are related to commit dd5a440a31fa (\"Linux 6.9-rc7\").\n\nCommit e1d09c2c2f57 (\"af_unix: Fix data races around sk-\u003esk_shutdown.\")\naddressed a comparable issue in the past regarding sk-\u003esk_shutdown.\nHowever, it overlooked resolving this particular data path.\nThis patch only offending unix_stream_sendmsg() function, since the\nother reads seem to be protected by unix_state_lock() as discussed in",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "38c29956-eaf0-453b-a49e-17bd421f1559",
      "id": "CVE-2024-40976",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/lima: mask irqs in timeout path before hard reset\n\nThere is a race condition in which a rendering job might take just long\nenough to trigger the drm sched job timeout handler but also still\ncomplete before the hard reset is done by the timeout handler.\nThis runs into race conditions not expected by the timeout handler.\nIn some very specific cases it currently may result in a refcount\nimbalance on lima_pm_idle, with a stack dump such as:\n\n[10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/lima_devfreq.c:205 lima_devfreq_record_idle+0xa0/0xb0\n...\n[10136.669459] pc : lima_devfreq_record_idle+0xa0/0xb0\n...\n[10136.669628] Call trace:\n[10136.669634]  lima_devfreq_record_idle+0xa0/0xb0\n[10136.669646]  lima_sched_pipe_task_done+0x5c/0xb0\n[10136.669656]  lima_gp_irq_handler+0xa8/0x120\n[10136.669666]  __handle_irq_event_percpu+0x48/0x160\n[10136.669679]  handle_irq_event+0x4c/0xc0\n\nWe can prevent that race condition entirely by masking the irqs at the\nbeginning of the timeout handler, at which point we give up on waiting\nfor that job entirely.\nThe irqs will be enabled again at the next hard reset which is already\ndone as a recovery by the timeout handler.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "253c997b-4593-4ac5-9452-8e2821ce3bcf",
      "id": "CVE-2024-40981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bypass empty buckets in batadv_purge_orig_ref()\n\nMany syzbot reports are pointing to soft lockups in\nbatadv_purge_orig_ref() [1]\n\nRoot cause is unknown, but we can avoid spending too much\ntime there and perhaps get more interesting reports.\n\n[1]\n\nwatchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621]\nModules linked in:\nirq event stamp: 6182794\n hardirqs last  enabled at (6182793): [\u003cffff8000801dae10\u003e] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386\n hardirqs last disabled at (6182794): [\u003cffff80008ad66a78\u003e] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]\n hardirqs last disabled at (6182794): [\u003cffff80008ad66a78\u003e] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551\n softirqs last  enabled at (6182792): [\u003cffff80008aab71c4\u003e] spin_unlock_bh include/linux/spinlock.h:396 [inline]\n softirqs last  enabled at (6182792): [\u003cffff80008aab71c4\u003e] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287\n softirqs last disabled at (6182790): [\u003cffff80008aab61dc\u003e] spin_lock_bh include/linux/spinlock.h:356 [inline]\n softirqs last disabled at (6182790): [\u003cffff80008aab61dc\u003e] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271\nCPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\nWorkqueue: bat_events batadv_purge_orig\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline]\n pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388\n lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386\nsp : ffff800099007970\nx29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000\nx26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001\nx23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4\nx20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0\nx17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001\nx14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003\nx11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000\nx8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000\nx5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000\nx2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000\nCall trace:\n  __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]\n  arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline]\n  __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386\n  __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]\n  _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210\n  spin_unlock_bh include/linux/spinlock.h:396 [inline]\n  batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287\n  batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860\nSending NMI from CPU 0 to CPUs 1:\nNMI backtrace for cpu 1\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51\n lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103\nsp : ffff800093a17d30\nx29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4\nx26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002\nx23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000\nx20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396\nx17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ca34dc9-fb80-4b78-a9b4-d8991b00e081",
      "id": "CVE-2024-41005",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: Fix race condition in netpoll_owner_active\n\nKCSAN detected a race condition in netpoll:\n\n\tBUG: KCSAN: data-race in net_rx_action / netpoll_send_skb\n\twrite (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10:\n\tnet_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822)\n\u003csnip\u003e\n\tread to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2:\n\tnetpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393)\n\tnetpoll_send_udp (net/core/netpoll.c:?)\n\u003csnip\u003e\n\tvalue changed: 0x0000000a -\u003e 0xffffffff\n\nThis happens because netpoll_owner_active() needs to check if the\ncurrent CPU is the owner of the lock, touching napi-\u003epoll_owner\nnon atomically. The -\u003epoll_owner field contains the current CPU holding\nthe lock.\n\nUse an atomic read to check if the poll owner is the current CPU.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "74c0bd5b-e040-425b-9d33-776523bafa1c",
      "id": "CVE-2024-41089",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes\n\nIn nv17_tv_get_hd_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). The same applies to drm_cvt_mode().\nAdd a check to avoid null pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "13a1b074-bc37-40de-915e-a3f93501435a",
      "id": "CVE-2024-42063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode\n\nsyzbot reported uninit memory usages during map_{lookup,delete}_elem.\n\n==========\nBUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]\nBUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796\n__dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]\ndev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796\n____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline]\nbpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38\n___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997\n__bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237\n==========\n\nThe reproducer should be in the interpreter mode.\n\nThe C reproducer is trying to run the following bpf prog:\n\n    0: (18) r0 = 0x0\n    2: (18) r1 = map[id:49]\n    4: (b7) r8 = 16777216\n    5: (7b) *(u64 *)(r10 -8) = r8\n    6: (bf) r2 = r10\n    7: (07) r2 += -229\n            ^^^^^^^^^^\n\n    8: (b7) r3 = 8\n    9: (b7) r4 = 0\n   10: (85) call dev_map_lookup_elem#1543472\n   11: (95) exit\n\nIt is due to the \"void *key\" (r2) passed to the helper. bpf allows uninit\nstack memory access for bpf prog with the right privileges. This patch\nuses kmsan_unpoison_memory() to mark the stack as initialized.\n\nThis should address different syzbot reports on the uninit \"void *key\"\nargument during map_{lookup,delete}_elem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "98fb933a-25e5-41bd-ba1f-368cb3808502",
      "id": "CVE-2022-3649",
      "description": "A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "46cbaee4-a2bb-48e5-9043-7be2765e1ab1",
      "id": "CVE-2024-42071",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: use dev_consume_skb_any outside of napi\n\nIf we're not in a NAPI softirq context, we need to be careful\nabout how we call napi_consume_skb(), specifically we need to\ncall it with budget==0 to signal to it that we're not in a\nsafe context.\n\nThis was found while running some configuration stress testing\nof traffic and a change queue config loop running, and this\ncurious note popped out:\n\n[ 4371.402645] BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/20545\n[ 4371.402897] caller is napi_skb_cache_put+0x16/0x80\n[ 4371.403120] CPU: 25 PID: 20545 Comm: ethtool Kdump: loaded Tainted: G           OE      6.10.0-rc3-netnext+ #8\n[ 4371.403302] Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 01/23/2021\n[ 4371.403460] Call Trace:\n[ 4371.403613]  \u003cTASK\u003e\n[ 4371.403758]  dump_stack_lvl+0x4f/0x70\n[ 4371.403904]  check_preemption_disabled+0xc1/0xe0\n[ 4371.404051]  napi_skb_cache_put+0x16/0x80\n[ 4371.404199]  ionic_tx_clean+0x18a/0x240 [ionic]\n[ 4371.404354]  ionic_tx_cq_service+0xc4/0x200 [ionic]\n[ 4371.404505]  ionic_tx_flush+0x15/0x70 [ionic]\n[ 4371.404653]  ? ionic_lif_qcq_deinit.isra.23+0x5b/0x70 [ionic]\n[ 4371.404805]  ionic_txrx_deinit+0x71/0x190 [ionic]\n[ 4371.404956]  ionic_reconfigure_queues+0x5f5/0xff0 [ionic]\n[ 4371.405111]  ionic_set_ringparam+0x2e8/0x3e0 [ionic]\n[ 4371.405265]  ethnl_set_rings+0x1f1/0x300\n[ 4371.405418]  ethnl_default_set_doit+0xbb/0x160\n[ 4371.405571]  genl_family_rcv_msg_doit+0xff/0x130\n\t[...]\n\nI found that ionic_tx_clean() calls napi_consume_skb() which calls\nnapi_skb_cache_put(), but before that last call is the note\n    /* Zero budget indicate non-NAPI context called us, like netpoll */\nand\n    DEBUG_NET_WARN_ON_ONCE(!in_softirq());\n\nThose are pretty big hints that we're doing it wrong.  We can pass a\ncontext hint down through the calls to let ionic_tx_clean() know what\nwe're doing so it can call napi_consume_skb() correctly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b93096cc-061e-48c2-982f-0fe2ff0b6970",
      "id": "CVE-2024-44948",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mtrr: Check if fixed MTRRs exist before saving them\n\nMTRRs have an obsolete fixed variant for fine grained caching control\nof the 640K-1MB region that uses separate MSRs. This fixed variant has\na separate capability bit in the MTRR capability MSR.\n\nSo far all x86 CPUs which support MTRR have this separate bit set, so it\nwent unnoticed that mtrr_save_state() does not check the capability bit\nbefore accessing the fixed MTRR MSRs.\n\nThough on a CPU that does not support the fixed MTRR capability this\nresults in a #GP.  The #GP itself is harmless because the RDMSR fault is\nhandled gracefully, but results in a WARN_ON().\n\nAdd the missing capability check to prevent this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ed1615b5-c69d-4873-9f01-5296759df3da",
      "id": "CVE-2024-46778",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check UnboundedRequestEnabled's value\n\nCalculateSwathAndDETConfiguration_params_st's UnboundedRequestEnabled\nis a pointer (i.e. dml_bool_t *UnboundedRequestEnabled), and thus\nif (p-\u003eUnboundedRequestEnabled) checks its address, not bool value.\n\nThis fixes 1 REVERSE_INULL issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0ceac6c9-1d65-456a-9d37-c11d9b7ede41",
      "id": "CVE-2024-47690",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: get rid of online repaire on corrupted directory\n\nsyzbot reports a f2fs bug as below:\n\nkernel BUG at fs/f2fs/inode.c:896!\nRIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896\nCall Trace:\n evict+0x532/0x950 fs/inode.c:704\n dispose_list fs/inode.c:747 [inline]\n evict_inodes+0x5f9/0x690 fs/inode.c:797\n generic_shutdown_super+0x9d/0x2d0 fs/super.c:627\n kill_block_super+0x44/0x90 fs/super.c:1696\n kill_f2fs_super+0x344/0x690 fs/f2fs/super.c:4898\n deactivate_locked_super+0xc4/0x130 fs/super.c:473\n cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373\n task_work_run+0x24f/0x310 kernel/task_work.c:228\n ptrace_notify+0x2d2/0x380 kernel/signal.c:2402\n ptrace_report_syscall include/linux/ptrace.h:415 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]\n syscall_exit_work+0xc6/0x190 kernel/entry/common.c:173\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]\n syscall_exit_to_user_mode+0x279/0x370 kernel/entry/common.c:218\n do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0010:f2fs_evict_inode+0x1598/0x15c0 fs/f2fs/inode.c:896\n\nOnline repaire on corrupted directory in f2fs_lookup() can generate\ndirty data/meta while racing w/ readonly remount, it may leave dirty\ninode after filesystem becomes readonly, however, checkpoint() will\nskips flushing dirty inode in a state of readonly mode, result in\nabove panic.\n\nLet's get rid of online repaire in f2fs_lookup(), and leave the work\nto fsck.f2fs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "589188d2-c861-4275-8195-7adc95ffd481",
      "id": "CVE-2024-49868",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\n\n[BUG]\nSyzbot reported a NULL pointer dereference with the following crash:\n\n  FAULT_INJECTION: forcing a failure.\n   start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\n   prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\n   relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\n  ...\n  BTRFS info (device loop0): balance: ended with status: -12\n  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\n  RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\n  Call Trace:\n   \u003cTASK\u003e\n   commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\n   btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\n   del_balance_item fs/btrfs/volumes.c:3678 [inline]\n   reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\n   btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\n   btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:907 [inline]\n   __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[CAUSE]\nThe allocation failure happens at the start_transaction() inside\nprepare_to_relocate(), and during the error handling we call\nunset_reloc_control(), which makes fs_info-\u003ebalance_ctl to be NULL.\n\nThen we continue the error path cleanup in btrfs_balance() by calling\nreset_balance_state() which will call del_balance_item() to fully delete\nthe balance item in the root tree.\n\nHowever during the small window between set_reloc_contrl() and\nunset_reloc_control(), we can have a subvolume tree update and created a\nreloc_root for that subvolume.\n\nThen we go into the final btrfs_commit_transaction() of\ndel_balance_item(), and into btrfs_update_reloc_root() inside\ncommit_fs_roots().\n\nThat function checks if fs_info-\u003ereloc_ctl is in the merge_reloc_tree\nstage, but since fs_info-\u003ereloc_ctl is NULL, it results a NULL pointer\ndereference.\n\n[FIX]\nJust add extra check on fs_info-\u003ereloc_ctl inside\nbtrfs_update_reloc_root(), before checking\nfs_info-\u003ereloc_ctl-\u003emerge_reloc_tree.\n\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\nreloc tree during merge stage, but since there is no reloc_ctl at all,\nwe do not need to bother that.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db1450e7-1b9b-4189-924a-d419a84d30aa",
      "id": "CVE-2024-49989",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix double free issue during amdgpu module unload\n\nFlexible endpoints use DIGs from available inflexible endpoints,\nso only the encoders of inflexible links need to be freed.\nOtherwise, a double free issue may occur when unloading the\namdgpu module.\n\n[  279.190523] RIP: 0010:__slab_free+0x152/0x2f0\n[  279.190577] Call Trace:\n[  279.190580]  \u003cTASK\u003e\n[  279.190582]  ? show_regs+0x69/0x80\n[  279.190590]  ? die+0x3b/0x90\n[  279.190595]  ? do_trap+0xc8/0xe0\n[  279.190601]  ? do_error_trap+0x73/0xa0\n[  279.190605]  ? __slab_free+0x152/0x2f0\n[  279.190609]  ? exc_invalid_op+0x56/0x70\n[  279.190616]  ? __slab_free+0x152/0x2f0\n[  279.190642]  ? asm_exc_invalid_op+0x1f/0x30\n[  279.190648]  ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[  279.191096]  ? __slab_free+0x152/0x2f0\n[  279.191102]  ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[  279.191469]  kfree+0x260/0x2b0\n[  279.191474]  dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[  279.191821]  link_destroy+0xd7/0x130 [amdgpu]\n[  279.192248]  dc_destruct+0x90/0x270 [amdgpu]\n[  279.192666]  dc_destroy+0x19/0x40 [amdgpu]\n[  279.193020]  amdgpu_dm_fini+0x16e/0x200 [amdgpu]\n[  279.193432]  dm_hw_fini+0x26/0x40 [amdgpu]\n[  279.193795]  amdgpu_device_fini_hw+0x24c/0x400 [amdgpu]\n[  279.194108]  amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu]\n[  279.194436]  amdgpu_pci_remove+0x40/0x80 [amdgpu]\n[  279.194632]  pci_device_remove+0x3a/0xa0\n[  279.194638]  device_remove+0x40/0x70\n[  279.194642]  device_release_driver_internal+0x1ad/0x210\n[  279.194647]  driver_detach+0x4e/0xa0\n[  279.194650]  bus_remove_driver+0x6f/0xf0\n[  279.194653]  driver_unregister+0x33/0x60\n[  279.194657]  pci_unregister_driver+0x44/0x90\n[  279.194662]  amdgpu_exit+0x19/0x1f0 [amdgpu]\n[  279.194939]  __do_sys_delete_module.isra.0+0x198/0x2f0\n[  279.194946]  __x64_sys_delete_module+0x16/0x20\n[  279.194950]  do_syscall_64+0x58/0x120\n[  279.194954]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[  279.194980]  \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7e782cf-a6da-4d6e-aa4d-1b2ae7865107",
      "id": "CVE-2024-50127",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix use-after-free in taprio_change()\n\nIn 'taprio_change()', 'admin' pointer may become dangling due to sched\nswitch / removal caused by 'advance_sched()', and critical section\nprotected by 'q-\u003ecurrent_entry_lock' is too small to prevent from such\na scenario (which causes use-after-free detected by KASAN). Fix this\nby prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update\n'admin' immediately before an attempt to schedule freeing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0808130-79d2-473c-9695-1d50bc47da09",
      "id": "CVE-2024-50177",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix a UBSAN warning in DML2.1\n\nWhen programming phantom pipe, since cursor_width is explicity set to 0,\nthis causes calculation logic to trigger overflow for an unsigned int\ntriggering the kernel's UBSAN check as below:\n\n[   40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34\n[   40.962849] shift exponent 4294967170 is too large for 32-bit type 'unsigned int'\n[   40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\n[   40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024\n[   40.962856] Call Trace:\n[   40.962857]  \u003cTASK\u003e\n[   40.962860]  dump_stack_lvl+0x48/0x70\n[   40.962870]  dump_stack+0x10/0x20\n[   40.962872]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360\n[   40.962878]  calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu]\n[   40.963099]  dml_core_mode_support+0x6b91/0x16bc0 [amdgpu]\n[   40.963327]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963331]  ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu]\n[   40.963534]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963536]  ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu]\n[   40.963730]  dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\n[   40.963906]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963909]  ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\n[   40.964078]  core_dcn4_mode_support+0x72/0xbf0 [amdgpu]\n[   40.964247]  dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu]\n[   40.964420]  dml2_build_mode_programming+0x23d/0x750 [amdgpu]\n[   40.964587]  dml21_validate+0x274/0x770 [amdgpu]\n[   40.964761]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.964763]  ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu]\n[   40.964942]  dml2_validate+0x504/0x750 [amdgpu]\n[   40.965117]  ? dml21_copy+0x95/0xb0 [amdgpu]\n[   40.965291]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.965295]  dcn401_validate_bandwidth+0x4e/0x70 [amdgpu]\n[   40.965491]  update_planes_and_stream_state+0x38d/0x5c0 [amdgpu]\n[   40.965672]  update_planes_and_stream_v3+0x52/0x1e0 [amdgpu]\n[   40.965845]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.965849]  dc_update_planes_and_stream+0x71/0xb0 [amdgpu]\n\nFix this by adding a guard for checking cursor width before triggering\nthe size calculation.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f730f93a-907e-4b4e-a770-bfd6ea52090a",
      "id": "CVE-2024-50217",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\n\nMounting btrfs from two images (which have the same one fsid and two\ndifferent dev_uuids) in certain executing order may trigger an UAF for\nvariable 'device-\u003ebdev_file' in __btrfs_free_extra_devids(). And\nfollowing are the details:\n\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\n   devices by ioctl(BTRFS_IOC_SCAN_DEV):\n\n             /  btrfs_device_1 → loop0\n   fs_device\n             \\  btrfs_device_2 → loop1\n2. mount /dev/loop0 /mnt\n   btrfs_open_devices\n    btrfs_device_1-\u003ebdev_file = btrfs_get_bdev_and_sb(loop0)\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\n   btrfs_fill_super\n    open_ctree\n     fail: btrfs_close_devices // -ENOMEM\n\t    btrfs_close_bdev(btrfs_device_1)\n             fput(btrfs_device_1-\u003ebdev_file)\n\t      // btrfs_device_1-\u003ebdev_file is freed\n\t    btrfs_close_bdev(btrfs_device_2)\n             fput(btrfs_device_2-\u003ebdev_file)\n\n3. mount /dev/loop1 /mnt\n   btrfs_open_devices\n    btrfs_get_bdev_and_sb(\u0026bdev_file)\n     // EIO, btrfs_device_1-\u003ebdev_file is not assigned,\n     // which points to a freed memory area\n    btrfs_device_2-\u003ebdev_file = btrfs_get_bdev_and_sb(loop1)\n   btrfs_fill_super\n    open_ctree\n     btrfs_free_extra_devids\n      if (btrfs_device_1-\u003ebdev_file)\n       fput(btrfs_device_1-\u003ebdev_file) // UAF !\n\nFix it by setting 'device-\u003ebdev_file' as 'NULL' after closing the\nbtrfs_device in btrfs_close_one_device().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8bf40373-4b29-43fa-b40e-ef92de9be244",
      "id": "CVE-2020-27170",
      "description": "An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0de22f0a-60bf-4b99-bc19-7a9c646bd208",
      "id": "CVE-2024-50230",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug due to missing clearing of checked flag\n\nSyzbot reported that in directory operations after nilfs2 detects\nfilesystem corruption and degrades to read-only,\n__block_write_begin_int(), which is called to prepare block writes, may\nfail the BUG_ON check for accesses exceeding the folio/page size,\ntriggering a kernel bug.\n\nThis was found to be because the \"checked\" flag of a page/folio was not\ncleared when it was discarded by nilfs2's own routine, which causes the\nsanity check of directory entries to be skipped when the directory\npage/folio is reloaded.  So, fix that.\n\nThis was necessary when the use of nilfs2's own page discard routine was\napplied to more than just metadata files.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "67be0257-091a-48fd-a055-76080fa69106",
      "id": "CVE-2024-50233",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()\n\nIn the ad9832_write_frequency() function, clk_get_rate() might return 0.\nThis can lead to a division by zero when calling ad9832_calc_freqreg().\nThe check if (fout \u003e (clk_get_rate(st-\u003emclk) / 2)) does not protect\nagainst the case when fout is 0. The ad9832_write_frequency() function\nis called from ad9832_write(), and fout is derived from a text buffer,\nwhich can contain any value.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6a495ab-d484-4af8-95b4-95bb1fc484e2",
      "id": "CVE-2024-53179",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses-\u003eauth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A                         task B\ncifs_mount()\n dfs_mount_share()\n  get_session()\n   cifs_mount_get_session()    cifs_send_recv()\n    cifs_get_smb_ses()          compound_send_recv()\n     cifs_setup_session()        smb2_setup_request()\n      kfree_sensitive()           smb2_calc_signature()\n                                   crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses-\u003eauth_key.response by\nchecking whether @ses-\u003eses_status is SES_GOOD or SES_EXITING with\n@ses-\u003eses_lock held.  After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call -\u003elogoff() only\nwhen @ses was known to be good (e.g. valid -\u003eauth_key.response), so\nit's safe to access signing key when @ses-\u003eses_status == SES_EXITING.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "602f673e-f64e-4d2d-8d55-7052b5379679",
      "id": "CVE-2024-53187",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: check for overflows in io_pin_pages\n\nWARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144\nCPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0\nCall Trace:\n \u003cTASK\u003e\n __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183\n io_rings_map io_uring/io_uring.c:2611 [inline]\n io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470\n io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692\n io_uring_setup io_uring/io_uring.c:3781 [inline]\n ...\n \u003c/TASK\u003e\n\nio_pin_pages()'s uaddr parameter came directly from the user and can be\ngarbage. Don't just add size to it as it can overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "aa8b6681-f634-4177-989c-e69323e4039a",
      "id": "CVE-2024-56591",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Use disable_delayed_work_sync\n\nThis makes use of disable_delayed_work_sync instead\ncancel_delayed_work_sync as it not only cancel the ongoing work but also\ndisables new submit which is disarable since the object holding the work\nis about to be freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91ca9fcc-78dc-4393-91f6-ae13c4634f6a",
      "id": "CVE-2024-56739",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: check if __rtc_read_time was successful in rtc_timer_do_work()\n\nIf the __rtc_read_time call fails,, the struct rtc_time tm; may contain\nuninitialized data, or an illegal date/time read from the RTC hardware.\n\nWhen calling rtc_tm_to_ktime later, the result may be a very large value\n(possibly KTIME_MAX). If there are periodic timers in rtc-\u003etimerqueue,\nthey will continually expire, may causing kernel softlockup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d0e5ded-2862-4d47-9e55-4c5a978c9390",
      "id": "CVE-2024-57939",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix sleeping in invalid context in die()\n\ndie() can be called in exception handler, and therefore cannot sleep.\nHowever, die() takes spinlock_t which can sleep with PREEMPT_RT enabled.\nThat causes the following warning:\n\nBUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex\npreempt_count: 110001, expected: 0\nRCU nest depth: 0, expected: 0\nCPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234\nHardware name: riscv-virtio,qemu (DT)\nCall Trace:\n    dump_backtrace+0x1c/0x24\n    show_stack+0x2c/0x38\n    dump_stack_lvl+0x5a/0x72\n    dump_stack+0x14/0x1c\n    __might_resched+0x130/0x13a\n    rt_spin_lock+0x2a/0x5c\n    die+0x24/0x112\n    do_trap_insn_illegal+0xa0/0xea\n    _new_vmalloc_restore_context_a0+0xcc/0xd8\nOops - illegal instruction [#1]\n\nSwitch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT\nenabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2600aa4-c8d5-4ecd-af79-89b3b1471d66",
      "id": "CVE-2024-57979",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npps: Fix a use-after-free\n\nOn a board running ntpd and gpsd, I'm seeing a consistent use-after-free\nin sys_exit() from gpsd when rebooting:\n\n    pps pps1: removed\n    ------------[ cut here ]------------\n    kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called.\n    WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150\n    CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1\n    Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT)\n    pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n    pc : kobject_put+0x120/0x150\n    lr : kobject_put+0x120/0x150\n    sp : ffffffc0803d3ae0\n    x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 0000000000000001\n    x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc9440\n    x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb600\n    x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 0000000000000000\n    x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e20\n    x14: 7369203a29343263 x13: 205d303434542020 x12: 0000000000000000\n    x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\n    x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000\n    x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n    x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000\n    Call trace:\n     kobject_put+0x120/0x150\n     cdev_put+0x20/0x3c\n     __fput+0x2c4/0x2d8\n     ____fput+0x1c/0x38\n     task_work_run+0x70/0xfc\n     do_exit+0x2a0/0x924\n     do_group_exit+0x34/0x90\n     get_signal+0x7fc/0x8c0\n     do_signal+0x128/0x13b4\n     do_notify_resume+0xdc/0x160\n     el0_svc+0xd4/0xf8\n     el0t_64_sync_handler+0x140/0x14c\n     el0t_64_sync+0x190/0x194\n    ---[ end trace 0000000000000000 ]---\n\n...followed by more symptoms of corruption, with similar stacks:\n\n    refcount_t: underflow; use-after-free.\n    kernel BUG at lib/list_debug.c:62!\n    Kernel panic - not syncing: Oops - BUG: Fatal exception\n\nThis happens because pps_device_destruct() frees the pps_device with the\nembedded cdev immediately after calling cdev_del(), but, as the comment\nabove cdev_del() notes, fops for previously opened cdevs are still\ncallable even after cdev_del() returns. I think this bug has always\nbeen there: I can't explain why it suddenly started happening every time\nI reboot this particular board.\n\nIn commit d953e0e837e6 (\"pps: Fix a use-after free bug when\nunregistering a source.\"), George Spelvin suggested removing the\nembedded cdev. That seems like the simplest way to fix this, so I've\nimplemented his suggestion, using __register_chrdev() with pps_idr\nbecoming the source of truth for which minor corresponds to which\ndevice.\n\nBut now that pps_idr defines userspace visibility instead of cdev_add(),\nwe need to be sure the pps-\u003edev refcount can't reach zero while\nuserspace can still find it again. So, the idr_remove() call moves to\npps_unregister_cdev(), and pps_idr now holds a reference to pps-\u003edev.\n\n    pps_core: source serial1 got cdev (251:1)\n    \u003c...\u003e\n    pps pps1: removed\n    pps_core: unregistering pps1\n    pps_core: deallocating pps1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7f72ec7d-d61e-45ee-a665-4594c6c6cca2",
      "id": "CVE-2025-21651",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: don't auto enable misc vector\n\nCurrently, there is a time window between misc irq enabled\nand service task inited. If an interrupte is reported at\nthis time, it will cause warning like below:\n\n[   16.324639] Call trace:\n[   16.324641]  __queue_delayed_work+0xb8/0xe0\n[   16.324643]  mod_delayed_work_on+0x78/0xd0\n[   16.324655]  hclge_errhand_task_schedule+0x58/0x90 [hclge]\n[   16.324662]  hclge_misc_irq_handle+0x168/0x240 [hclge]\n[   16.324666]  __handle_irq_event_percpu+0x64/0x1e0\n[   16.324667]  handle_irq_event+0x80/0x170\n[   16.324670]  handle_fasteoi_edge_irq+0x110/0x2bc\n[   16.324671]  __handle_domain_irq+0x84/0xfc\n[   16.324673]  gic_handle_irq+0x88/0x2c0\n[   16.324674]  el1_irq+0xb8/0x140\n[   16.324677]  arch_cpu_idle+0x18/0x40\n[   16.324679]  default_idle_call+0x5c/0x1bc\n[   16.324682]  cpuidle_idle_call+0x18c/0x1c4\n[   16.324684]  do_idle+0x174/0x17c\n[   16.324685]  cpu_startup_entry+0x30/0x6c\n[   16.324687]  secondary_start_kernel+0x1a4/0x280\n[   16.324688] ---[ end trace 6aa0bff672a964aa ]---\n\nSo don't auto enable misc vector when request irq..",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15448e03-7295-4e08-88a6-4c5774797557",
      "id": "CVE-2025-21728",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Send signals asynchronously if !preemptible\n\nBPF programs can execute in all kinds of contexts and when a program\nrunning in a non-preemptible context uses the bpf_send_signal() kfunc,\nit will cause issues because this kfunc can sleep.\nChange `irqs_disabled()` to `!preemptible()`.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "07734816-cceb-4a3c-b83a-98406324ea6e",
      "id": "CVE-2021-46991",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix use-after-free in i40e_client_subtask()\n\nCurrently the call to i40e_client_del_instance frees the object\npf-\u003ecinst, however pf-\u003ecinst-\u003elan_info is being accessed after\nthe free. Fix this by adding the missing return.\n\nAddresses-Coverity: (\"Read from pointer after free\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d8c3aad-6223-46b2-bead-002212b5f3ba",
      "id": "CVE-2025-21846",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nacct: perform last write from workqueue\n\nIn [1] it was reported that the acct(2) system call can be used to\ntrigger NULL deref in cases where it is set to write to a file that\ntriggers an internal lookup. This can e.g., happen when pointing acc(2)\nto /sys/power/resume. At the point the where the write to this file\nhappens the calling task has already exited and called exit_fs(). A\nlookup will thus trigger a NULL-deref when accessing current-\u003efs.\n\nReorganize the code so that the the final write happens from the\nworkqueue but with the caller's credentials. This preserves the\n(strange) permission model and has almost no regression risk.\n\nThis api should stop to exist though.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff97d708-b0aa-4b7f-9300-cc29b5b509c4",
      "id": "CVE-2025-22041",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_sessions_deregister()\n\nIn multichannel mode, UAF issue can occur in session_deregister\nwhen the second channel sets up a session through the connection of\nthe first channel. session that is freed through the global session\ntable can be accessed again through -\u003esessions of connection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4694d5c-247f-4f29-91c7-3b0b455adfd3",
      "id": "CVE-2025-22083",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint\n\nIf vhost_scsi_set_endpoint is called multiple times without a\nvhost_scsi_clear_endpoint between them, we can hit multiple bugs\nfound by Haoran Zhang:\n\n1. Use-after-free when no tpgs are found:\n\nThis fixes a use after free that occurs when vhost_scsi_set_endpoint is\ncalled more than once and calls after the first call do not find any\ntpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds\ntpgs to add to the vs_tpg array match=true, so we will do:\n\nvhost_vq_set_backend(vq, vs_tpg);\n...\n\nkfree(vs-\u003evs_tpg);\nvs-\u003evs_tpg = vs_tpg;\n\nIf vhost_scsi_set_endpoint is called again and no tpgs are found\nmatch=false so we skip the vhost_vq_set_backend call leaving the\npointer to the vs_tpg we then free via:\n\nkfree(vs-\u003evs_tpg);\nvs-\u003evs_tpg = vs_tpg;\n\nIf a scsi request is then sent we do:\n\nvhost_scsi_handle_vq -\u003e vhost_scsi_get_req -\u003e vhost_vq_get_backend\n\nwhich sees the vs_tpg we just did a kfree on.\n\n2. Tpg dir removal hang:\n\nThis patch fixes an issue where we cannot remove a LIO/target layer\ntpg (and structs above it like the target) dir due to the refcount\ndropping to -1.\n\nThe problem is that if vhost_scsi_set_endpoint detects a tpg is already\nin the vs-\u003evs_tpg array or if the tpg has been removed so\ntarget_depend_item fails, the undepend goto handler will do\ntarget_undepend_item on all tpgs in the vs_tpg array dropping their\nrefcount to 0. At this time vs_tpg contains both the tpgs we have added\nin the current vhost_scsi_set_endpoint call as well as tpgs we added in\nprevious calls which are also in vs-\u003evs_tpg.\n\nLater, when vhost_scsi_clear_endpoint runs it will do\ntarget_undepend_item on all the tpgs in the vs-\u003evs_tpg which will drop\ntheir refcount to -1. Userspace will then not be able to remove the tpg\nand will hang when it tries to do rmdir on the tpg dir.\n\n3. Tpg leak:\n\nThis fixes a bug where we can leak tpgs and cause them to be\nun-removable because the target name is overwritten when\nvhost_scsi_set_endpoint is called multiple times but with different\ntarget names.\n\nThe bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup\na vhost-scsi device to target/tpg mapping, then calls\nVHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we\nhaven't seen before (target1 has tpg1 but target2 has tpg2). When this\nhappens we don't teardown the old target tpg mapping and just overwrite\nthe target name and the vs-\u003evs_tpg array. Later when we do\nvhost_scsi_clear_endpoint, we are passed in either target1 or target2's\nname and we will only match that target's tpgs when we loop over the\nvs-\u003evs_tpg. We will then return from the function without doing\ntarget_undepend_item on the tpgs.\n\nBecause of all these bugs, it looks like being able to call\nvhost_scsi_set_endpoint multiple times was never supported. The major\nuser, QEMU, already has checks to prevent this use case. So to fix the\nissues, this patch prevents vhost_scsi_set_endpoint from being called\nif it's already successfully added tpgs. To add, remove or change the\ntpg config or target name, you must do a vhost_scsi_clear_endpoint\nfirst.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0809da15-b364-4c9a-aa7f-c866f25e5f0c",
      "id": "CVE-2025-37970",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo\n\nPrevent st_lsm6dsx_read_fifo from falling in an infinite loop in case\npattern_len is equal to zero and the device FIFO is not empty.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1fcd816f-cc6f-4a71-9549-a86c2dc50a46",
      "id": "CVE-2025-37998",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix unsafe attribute parsing in output_userspace()\n\nThis patch replaces the manual Netlink attribute iteration in\noutput_userspace() with nla_for_each_nested(), which ensures that only\nwell-formed attributes are processed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10bd4a71-4cb0-4963-a491-ed56bced6921",
      "id": "CVE-2025-38066",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: prevent BUG_ON by blocking retries on failed device resumes\n\nA cache device failing to resume due to mapping errors should not be\nretried, as the failure leaves a partially initialized policy object.\nRepeating the resume operation risks triggering BUG_ON when reloading\ncache mappings into the incomplete policy object.\n\nReproduce steps:\n\n1. create a cache metadata consisting of 512 or more cache blocks,\n   with some mappings stored in the first array block of the mapping\n   array. Here we use cache_restore v1.0 to build the metadata.\n\ncat \u003c\u003cEOF \u003e\u003e cmeta.xml\n\u003csuperblock uuid=\"\" block_size=\"128\" nr_cache_blocks=\"512\" \\\npolicy=\"smq\" hint_width=\"4\"\u003e\n  \u003cmappings\u003e\n    \u003cmapping cache_block=\"0\" origin_block=\"0\" dirty=\"false\"/\u003e\n  \u003c/mappings\u003e\n\u003c/superblock\u003e\nEOF\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ncache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2\ndmsetup remove cmeta\n\n2. wipe the second array block of the mapping array to simulate\n   data degradations.\n\nmapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \\\n2\u003e/dev/null | hexdump -e '1/8 \"%u\\n\"')\nablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \\\n2\u003e/dev/null | hexdump -e '1/8 \"%u\\n\"')\ndd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock\n\n3. try bringing up the cache device. The resume is expected to fail\n   due to the broken array block.\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndmsetup create cache --notable\ndmsetup load cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\ndmsetup resume cache\n\n4. try resuming the cache again. An unexpected BUG_ON is triggered\n   while loading cache mappings.\n\ndmsetup resume cache\n\nKernel logs:\n\n(snip)\n------------[ cut here ]------------\nkernel BUG at drivers/md/dm-cache-policy-smq.c:752!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3\nRIP: 0010:smq_load_mapping+0x3e5/0x570\n\nFix by disallowing resume operations for devices that failed the\ninitial attempt.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1aaf0b22-4b16-417c-9853-21b9bf4d7594",
      "id": "CVE-2021-47648",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpu: host1x: Fix a memory leak in 'host1x_remove()'\n\nAdd a missing 'host1x_channel_list_free()' call in the remove function,\nas already done in the error handling path of the probe function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a9bbd583-5052-4f71-8d4f-ceee54cb12c9",
      "id": "CVE-2025-38069",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops\n\nFix a kernel oops found while testing the stm32_pcie Endpoint driver\nwith handling of PERST# deassertion:\n\nDuring EP initialization, pci_epf_test_alloc_space() allocates all BARs,\nwhich are further freed if epc_set_bar() fails (for instance, due to no\nfree inbound window).\n\nHowever, when pci_epc_set_bar() fails, the error path:\n\n  pci_epc_set_bar() -\u003e\n    pci_epf_free_space()\n\ndoes not clear the previous assignment to epf_test-\u003ereg[bar].\n\nThen, if the host reboots, the PERST# deassertion restarts the BAR\nallocation sequence with the same allocation failure (no free inbound\nwindow), creating a double free situation since epf_test-\u003ereg[bar] was\ndeallocated and is still non-NULL.\n\nThus, make sure that pci_epf_alloc_space() and pci_epf_free_space()\ninvocations are symmetric, and as such, set epf_test-\u003ereg[bar] to NULL\nwhen memory is freed.\n\n[kwilczynski: commit log]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a61209fc-604f-4dfd-b676-a9d98ce8e78b",
      "id": "CVE-2025-38099",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken\n\nA SCO connection without the proper voice_setting can cause\nthe controller to lock up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91b70d8d-16f1-4671-92b0-ccdff84527a7",
      "id": "CVE-2025-38211",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/iwcm: Fix use-after-free of work objects after cm_id destruction\n\nThe commit 59c68ac31e15 (\"iw_cm: free cm_id resources on the last\nderef\") simplified cm_id resource management by freeing cm_id once all\nreferences to the cm_id were removed. The references are removed either\nupon completion of iw_cm event handlers or when the application destroys\nthe cm_id. This commit introduced the use-after-free condition where\ncm_id_private object could still be in use by event handler works during\nthe destruction of cm_id. The commit aee2424246f9 (\"RDMA/iwcm: Fix a\nuse-after-free related to destroying CM IDs\") addressed this use-after-\nfree by flushing all pending works at the cm_id destruction.\n\nHowever, still another use-after-free possibility remained. It happens\nwith the work objects allocated for each cm_id_priv within\nalloc_work_entries() during cm_id creation, and subsequently freed in\ndealloc_work_entries() once all references to the cm_id are removed.\nIf the cm_id's last reference is decremented in the event handler work,\nthe work object for the work itself gets removed, and causes the use-\nafter-free BUG below:\n\n  BUG: KASAN: slab-use-after-free in __pwq_activate_work+0x1ff/0x250\n  Read of size 8 at addr ffff88811f9cf800 by task kworker/u16:1/147091\n\n  CPU: 2 UID: 0 PID: 147091 Comm: kworker/u16:1 Not tainted 6.15.0-rc2+ #27 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n  Workqueue:  0x0 (iw_cm_wq)\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6a/0x90\n   print_report+0x174/0x554\n   ? __virt_addr_valid+0x208/0x430\n   ? __pwq_activate_work+0x1ff/0x250\n   kasan_report+0xae/0x170\n   ? __pwq_activate_work+0x1ff/0x250\n   __pwq_activate_work+0x1ff/0x250\n   pwq_dec_nr_in_flight+0x8c5/0xfb0\n   process_one_work+0xc11/0x1460\n   ? __pfx_process_one_work+0x10/0x10\n   ? assign_work+0x16c/0x240\n   worker_thread+0x5ef/0xfd0\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x3b0/0x770\n   ? __pfx_kthread+0x10/0x10\n   ? rcu_is_watching+0x11/0xb0\n   ? _raw_spin_unlock_irq+0x24/0x50\n   ? rcu_is_watching+0x11/0xb0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x30/0x70\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n\n  Allocated by task 147416:\n   kasan_save_stack+0x2c/0x50\n   kasan_save_track+0x10/0x30\n   __kasan_kmalloc+0xa6/0xb0\n   alloc_work_entries+0xa9/0x260 [iw_cm]\n   iw_cm_connect+0x23/0x4a0 [iw_cm]\n   rdma_connect_locked+0xbfd/0x1920 [rdma_cm]\n   nvme_rdma_cm_handler+0x8e5/0x1b60 [nvme_rdma]\n   cma_cm_event_handler+0xae/0x320 [rdma_cm]\n   cma_work_handler+0x106/0x1b0 [rdma_cm]\n   process_one_work+0x84f/0x1460\n   worker_thread+0x5ef/0xfd0\n   kthread+0x3b0/0x770\n   ret_from_fork+0x30/0x70\n   ret_from_fork_asm+0x1a/0x30\n\n  Freed by task 147091:\n   kasan_save_stack+0x2c/0x50\n   kasan_save_track+0x10/0x30\n   kasan_save_free_info+0x37/0x60\n   __kasan_slab_free+0x4b/0x70\n   kfree+0x13a/0x4b0\n   dealloc_work_entries+0x125/0x1f0 [iw_cm]\n   iwcm_deref_id+0x6f/0xa0 [iw_cm]\n   cm_work_handler+0x136/0x1ba0 [iw_cm]\n   process_one_work+0x84f/0x1460\n   worker_thread+0x5ef/0xfd0\n   kthread+0x3b0/0x770\n   ret_from_fork+0x30/0x70\n   ret_from_fork_asm+0x1a/0x30\n\n  Last potentially related work creation:\n   kasan_save_stack+0x2c/0x50\n   kasan_record_aux_stack+0xa3/0xb0\n   __queue_work+0x2ff/0x1390\n   queue_work_on+0x67/0xc0\n   cm_event_handler+0x46a/0x820 [iw_cm]\n   siw_cm_upcall+0x330/0x650 [siw]\n   siw_cm_work_handler+0x6b9/0x2b20 [siw]\n   process_one_work+0x84f/0x1460\n   worker_thread+0x5ef/0xfd0\n   kthread+0x3b0/0x770\n   ret_from_fork+0x30/0x70\n   ret_from_fork_asm+0x1a/0x30\n\nThis BUG is reproducible by repeating the blktests test case nvme/061\nfor the rdma transport and the siw driver.\n\nTo avoid the use-after-free of cm_id_private work objects, ensure that\nthe last reference to the cm_id is decremented not in the event handler\nworks, but in the cm_id destruction context. For that purpose, mo\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2aee209a-ba71-42f4-91bf-3263077967dd",
      "id": "CVE-2020-12771",
      "description": "An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8fdfe5f3-15e4-4028-9142-d57a7ff8d1d1",
      "id": "CVE-2025-38313",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: fix double-free on mc_dev\n\nThe blamed commit tried to simplify how the deallocations are done but,\nin the process, introduced a double-free on the mc_dev variable.\n\nIn case the MC device is a DPRC, a new mc_bus is allocated and the\nmc_dev variable is just a reference to one of its fields. In this\ncircumstance, on the error path only the mc_bus should be freed.\n\nThis commit introduces back the following checkpatch warning which is a\nfalse-positive.\n\nWARNING: kfree(NULL) is safe and this check is probably not required\n+       if (mc_bus)\n+               kfree(mc_bus);",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7cdfcde9-aac5-4ffc-85f0-4f3db28d6cb1",
      "id": "CVE-2025-38323",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: add lec_mutex\n\nsyzbot found its way in net/atm/lec.c, and found an error path\nin lecd_attach() could leave a dangling pointer in dev_lec[].\n\nAdd a mutex to protect dev_lecp[] uses from lecd_attach(),\nlec_vcc_attach() and lec_mcast_attach().\n\nFollowing patch will use this mutex for /proc/net/atm/lec.\n\nBUG: KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline]\nBUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008\nRead of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142\n\nCPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:408 [inline]\n  print_report+0xcd/0x680 mm/kasan/report.c:521\n  kasan_report+0xe0/0x110 mm/kasan/report.c:634\n  lecd_attach net/atm/lec.c:751 [inline]\n  lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008\n  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n  sock_do_ioctl+0x118/0x280 net/socket.c:1190\n  sock_ioctl+0x227/0x6b0 net/socket.c:1311\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nAllocated by task 6132:\n  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n  kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n  __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394\n  kasan_kmalloc include/linux/kasan.h:260 [inline]\n  __do_kmalloc_node mm/slub.c:4328 [inline]\n  __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015\n  alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711\n  lecd_attach net/atm/lec.c:737 [inline]\n  lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008\n  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n  sock_do_ioctl+0x118/0x280 net/socket.c:1190\n  sock_ioctl+0x227/0x6b0 net/socket.c:1311\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 6132:\n  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n  kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576\n  poison_slab_object mm/kasan/common.c:247 [inline]\n  __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264\n  kasan_slab_free include/linux/kasan.h:233 [inline]\n  slab_free_hook mm/slub.c:2381 [inline]\n  slab_free mm/slub.c:4643 [inline]\n  kfree+0x2b4/0x4d0 mm/slub.c:4842\n  free_netdev+0x6c5/0x910 net/core/dev.c:11892\n  lecd_attach net/atm/lec.c:744 [inline]\n  lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008\n  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n  sock_do_ioctl+0x118/0x280 net/socket.c:1190\n  sock_ioctl+0x227/0x6b0 net/socket.c:1311\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6637697a-897f-472e-8415-d63a8aa993c3",
      "id": "CVE-2021-47654",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/landlock: Fix path_list memory leak\n\nClang static analysis reports this error\n\nsandboxer.c:134:8: warning: Potential leak of memory\n  pointed to by 'path_list'\n        ret = 0;\n              ^\npath_list is allocated in parse_path() but never freed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "94b4dc43-9030-40d1-bbfc-ecbe093c7eb2",
      "id": "CVE-2025-38439",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Set DMA unmap len correctly for XDP_REDIRECT\n\nWhen transmitting an XDP_REDIRECT packet, call dma_unmap_len_set()\nwith the proper length instead of 0.  This bug triggers this warning\non a system with IOMMU enabled:\n\nWARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170\nRIP: 0010:__iommu_dma_unmap+0x159/0x170\nCode: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45\nb8 4c 89 45 c0 e9 77 ff ff ff \u003c0f\u003e 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00\nRSP: 0018:ff22d31181150c88 EFLAGS: 00010206\nRAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000\nR10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000\nR13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00\nFS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0\nPKRU: 55555554\nCall Trace:\n\u003cIRQ\u003e\n? show_regs+0x6d/0x80\n? __warn+0x89/0x160\n? __iommu_dma_unmap+0x159/0x170\n? report_bug+0x17e/0x1b0\n? handle_bug+0x46/0x90\n? exc_invalid_op+0x18/0x80\n? asm_exc_invalid_op+0x1b/0x20\n? __iommu_dma_unmap+0x159/0x170\n? __iommu_dma_unmap+0xb3/0x170\niommu_dma_unmap_page+0x4f/0x100\ndma_unmap_page_attrs+0x52/0x220\n? srso_alias_return_thunk+0x5/0xfbef5\n? xdp_return_frame+0x2e/0xd0\nbnxt_tx_int_xdp+0xdf/0x440 [bnxt_en]\n__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en]\nbnxt_poll+0xd3/0x1e0 [bnxt_en]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01eb923c-a333-42c7-ad8e-04f9183ee83c",
      "id": "CVE-2025-38716",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix general protection fault in hfs_find_init()\n\nThe hfs_find_init() method can trigger the crash\nif tree pointer is NULL:\n\n[   45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI\n[   45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]\n[   45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full)\n[   45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230\n[   45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc\n[   45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202\n[   45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09\n[   45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8\n[   45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000\n[   45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004\n[   45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000\n[   45.760293][ T9787] FS:  00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000\n[   45.761050][ T9787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0\n[   45.762286][ T9787] Call Trace:\n[   45.762570][ T9787]  \u003cTASK\u003e\n[   45.762824][ T9787]  hfs_ext_read_extent+0x190/0x9d0\n[   45.763269][ T9787]  ? submit_bio_noacct_nocheck+0x2dd/0xce0\n[   45.763766][ T9787]  ? __pfx_hfs_ext_read_extent+0x10/0x10\n[   45.764250][ T9787]  hfs_get_block+0x55f/0x830\n[   45.764646][ T9787]  block_read_full_folio+0x36d/0x850\n[   45.765105][ T9787]  ? __pfx_hfs_get_block+0x10/0x10\n[   45.765541][ T9787]  ? const_folio_flags+0x5b/0x100\n[   45.765972][ T9787]  ? __pfx_hfs_read_folio+0x10/0x10\n[   45.766415][ T9787]  filemap_read_folio+0xbe/0x290\n[   45.766840][ T9787]  ? __pfx_filemap_read_folio+0x10/0x10\n[   45.767325][ T9787]  ? __filemap_get_folio+0x32b/0xbf0\n[   45.767780][ T9787]  do_read_cache_folio+0x263/0x5c0\n[   45.768223][ T9787]  ? __pfx_hfs_read_folio+0x10/0x10\n[   45.768666][ T9787]  read_cache_page+0x5b/0x160\n[   45.769070][ T9787]  hfs_btree_open+0x491/0x1740\n[   45.769481][ T9787]  hfs_mdb_get+0x15e2/0x1fb0\n[   45.769877][ T9787]  ? __pfx_hfs_mdb_get+0x10/0x10\n[   45.770316][ T9787]  ? find_held_lock+0x2b/0x80\n[   45.770731][ T9787]  ? lockdep_init_map_type+0x5c/0x280\n[   45.771200][ T9787]  ? lockdep_init_map_type+0x5c/0x280\n[   45.771674][ T9787]  hfs_fill_super+0x38e/0x720\n[   45.772092][ T9787]  ? __pfx_hfs_fill_super+0x10/0x10\n[   45.772549][ T9787]  ? snprintf+0xbe/0x100\n[   45.772931][ T9787]  ? __pfx_snprintf+0x10/0x10\n[   45.773350][ T9787]  ? do_raw_spin_lock+0x129/0x2b0\n[   45.773796][ T9787]  ? find_held_lock+0x2b/0x80\n[   45.774215][ T9787]  ? set_blocksize+0x40a/0x510\n[   45.774636][ T9787]  ? sb_set_blocksize+0x176/0x1d0\n[   45.775087][ T9787]  ? setup_bdev_super+0x369/0x730\n[   45.775533][ T9787]  get_tree_bdev_flags+0x384/0x620\n[   45.775985][ T9787]  ? __pfx_hfs_fill_super+0x10/0x10\n[   45.776453][ T9787]  ? __pfx_get_tree_bdev_flags+0x10/0x10\n[   45.776950][ T9787]  ? bpf_lsm_capable+0x9/0x10\n[   45.777365][ T9787]  ? security_capable+0x80/0x260\n[   45.777803][ T9787]  vfs_get_tree+0x8e/0x340\n[   45.778203][ T9787]  path_mount+0x13de/0x2010\n[   45.778604][ T9787]  ? kmem_cache_free+0x2b0/0x4c0\n[   45.779052][ T9787]  ? __pfx_path_mount+0x10/0x10\n[   45.779480][ T9787]  ? getname_flags.part.0+0x1c5/0x550\n[   45.779954][ T9787]  ? putname+0x154/0x1a0\n[   45.780335][ T9787]  __x64_sys_mount+0x27b/0x300\n[   45.780758][ T9787]  ? __pfx___x64_sys_mount+0x10/0x10\n[   45.781232][ T9787] \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "25f5be8b-e875-4483-a9ea-419688b144a3",
      "id": "CVE-2020-10767",
      "description": "A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6bee9769-b34f-46f0-8658-9520c66cd88e",
      "id": "CVE-2020-12655",
      "description": "An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7c7d648-775c-4503-b60e-914f8d432bb3",
      "id": "CVE-2020-24587",
      "description": "The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "42347d80-6fb3-4dc0-870b-423cc8031c2e",
      "id": "CVE-2022-1015",
      "description": "A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ecdd5c13-691d-4849-a7da-ffccaf50e0e2",
      "id": "CVE-2020-27830",
      "description": "A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8186a888-4458-4de1-b4e6-be779c792b4c",
      "id": "CVE-2020-36158",
      "description": "mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dab399e8-a7f3-4231-bf3d-b5f76da0ca9c",
      "id": "CVE-2020-8649",
      "description": "There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e44d8d89-5e6a-42cb-af84-331166170bb3",
      "id": "CVE-2021-3348",
      "description": "nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7f1a16b-c594-4e8c-b2f0-984e43972a87",
      "id": "CVE-2021-3428",
      "description": "A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "64265494-ea6c-4c12-a186-7f7d0c0d4fb6",
      "id": "CVE-2022-2153",
      "description": "A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90dd7eaf-5de2-45fb-9087-bc9ae97990cf",
      "id": "CVE-2021-38204",
      "description": "drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f20bba53-100a-4c23-a611-bb25cd021752",
      "id": "CVE-2021-46941",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: core: Do core softreset when switch mode\n\n\nAccording to the programming guide, to switch mode for DRD controller,\nthe driver needs to do the following.\n\nTo switch from device to host:\n1. Reset controller with GCTL.CoreSoftReset\n2. Set GCTL.PrtCapDir(host mode)\n3. Reset the host with USBCMD.HCRESET\n4. Then follow up with the initializing host registers sequence\n\nTo switch from host to device:\n1. Reset controller with GCTL.CoreSoftReset\n2. Set GCTL.PrtCapDir(device mode)\n3. Reset the device with DCTL.CSftRst\n4. Then follow up with the initializing registers sequence\n\nCurrently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of\nswitching from host to device. John Stult reported a lockup issue seen\nwith HiKey960 platform without these steps[1]. Similar issue is observed\nwith Ferry's testing platform[2].\n\nSo, apply the required steps along with some fixes to Yu Chen's and John\nStultz's version. The main fixes to their versions are the missing wait\nfor clocks synchronization before clearing GCTL.CoreSoftReset and only\napply DCTL.CSftRst when switching from host to device.\n\n[1] https://lore.kernel.org/linux-usb/20210108015115.27920-1-john.stultz@linaro.org/\n[2] https://lore.kernel.org/linux-usb/0ba7a6ba-e6a7-9cd4-0695-64fc927e01f1@gmail.com/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82b0c11e-cb3d-4a44-b2db-2f6673359a6c",
      "id": "CVE-2021-46950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: properly indicate failure when ending a failed write request\n\nThis patch addresses a data corruption bug in raid1 arrays using bitmaps.\nWithout this fix, the bitmap bits for the failed I/O end up being cleared.\n\nSince we are in the failure leg of raid1_end_write_request, the request\neither needs to be retried (R1BIO_WriteError) or failed (R1BIO_Degraded).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89bfba67-47e8-4eb6-b5fd-c158a4b654f4",
      "id": "CVE-2021-46971",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix unconditional security_locked_down() call\n\nCurrently, the lockdown state is queried unconditionally, even though\nits result is used only if the PERF_SAMPLE_REGS_INTR bit is set in\nattr.sample_type. While that doesn't matter in case of the Lockdown LSM,\nit causes trouble with the SELinux's lockdown hook implementation.\n\nSELinux implements the locked_down hook with a check whether the current\ntask's type has the corresponding \"lockdown\" class permission\n(\"integrity\" or \"confidentiality\") allowed in the policy. This means\nthat calling the hook when the access control decision would be ignored\ngenerates a bogus permission check and audit record.\n\nFix this by checking sample_type first and only calling the hook when\nits result would be honored.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2255ad1e-8ac3-4e49-a88d-ddf45bb04cba",
      "id": "CVE-2021-46981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix NULL pointer in flush_workqueue\n\nOpen /dev/nbdX first, the config_refs will be 1 and\nthe pointers in nbd_device are still null. Disconnect\n/dev/nbdX, then reference a null recv_workq. The\nprotection by config_refs in nbd_genl_disconnect is useless.\n\n[  656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020\n[  656.368943] #PF: supervisor write access in kernel mode\n[  656.369844] #PF: error_code(0x0002) - not-present page\n[  656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0\n[  656.371693] Oops: 0002 [#1] SMP\n[  656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1\n[  656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014\n[  656.375904] RIP: 0010:mutex_lock+0x29/0x60\n[  656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 \u003cf0\u003e 48 0f b1 55 d\n[  656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246\n[  656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020\n[  656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318\n[  656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40\n[  656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00\n[  656.382166] FS:  00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000\n[  656.382806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0\n[  656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  656.384927] Call Trace:\n[  656.385111]  flush_workqueue+0x92/0x6c0\n[  656.385395]  nbd_disconnect_and_put+0x81/0xd0\n[  656.385716]  nbd_genl_disconnect+0x125/0x2a0\n[  656.386034]  genl_family_rcv_msg_doit.isra.0+0x102/0x1b0\n[  656.386422]  genl_rcv_msg+0xfc/0x2b0\n[  656.386685]  ? nbd_ioctl+0x490/0x490\n[  656.386954]  ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0\n[  656.387354]  netlink_rcv_skb+0x62/0x180\n[  656.387638]  genl_rcv+0x34/0x60\n[  656.387874]  netlink_unicast+0x26d/0x590\n[  656.388162]  netlink_sendmsg+0x398/0x6c0\n[  656.388451]  ? netlink_rcv_skb+0x180/0x180\n[  656.388750]  ____sys_sendmsg+0x1da/0x320\n[  656.389038]  ? ____sys_recvmsg+0x130/0x220\n[  656.389334]  ___sys_sendmsg+0x8e/0xf0\n[  656.389605]  ? ___sys_recvmsg+0xa2/0xf0\n[  656.389889]  ? handle_mm_fault+0x1671/0x21d0\n[  656.390201]  __sys_sendmsg+0x6d/0xe0\n[  656.390464]  __x64_sys_sendmsg+0x23/0x30\n[  656.390751]  do_syscall_64+0x45/0x70\n[  656.391017]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nTo fix it, just add if (nbd-\u003erecv_workq) to nbd_disconnect_and_put().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d023be4d-0c2c-4469-b128-de790b07c576",
      "id": "CVE-2021-47056",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init\n\nADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()\nbefore calling adf_iov_putmsg()-\u003emutex_lock(vf2pf_lock), however the\nvf2pf_lock is initialized in adf_dev_init(), which can fail and when it\nfail, the vf2pf_lock is either not initialized or destroyed, a subsequent\nuse of vf2pf_lock will cause issue.\nTo fix this issue, only set this flag if adf_dev_init() returns 0.\n\n[    7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0\n[    7.180345] Call Trace:\n[    7.182576]  mutex_lock+0xc9/0xd0\n[    7.183257]  adf_iov_putmsg+0x118/0x1a0 [intel_qat]\n[    7.183541]  adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]\n[    7.183834]  adf_dev_shutdown+0x172/0x2b0 [intel_qat]\n[    7.184127]  adf_probe+0x5e9/0x600 [qat_dh895xccvf]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "396d569c-5a83-42e5-8360-32a129a005da",
      "id": "CVE-2021-47101",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nasix: fix uninit-value in asix_mdio_read()\n\nasix_read_cmd() may read less than sizeof(smsr) bytes and in this case\nsmsr will be uninitialized.\n\nFail log:\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\nBUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\nBUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]\n asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497\n asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db0a4754-dbe8-4ed9-a926-09454265a98c",
      "id": "CVE-2021-47201",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: free q_vectors before queues in iavf_disable_vf\n\niavf_free_queues() clears adapter-\u003enum_active_queues, which\niavf_free_q_vectors() relies on, so swap the order of these two function\ncalls in iavf_disable_vf(). This resolves a panic encountered when the\ninterface is disabled and then later brought up again after PF\ncommunication is restored.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "458fff29-e012-4282-8386-ff4c2c91410e",
      "id": "CVE-2021-47280",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix use-after-free read in drm_getunique()\n\nThere is a time-of-check-to-time-of-use error in drm_getunique() due\nto retrieving file_priv-\u003emaster prior to locking the device's master\nmutex.\n\nAn example can be seen in the crash report of the use-after-free error\nfound by Syzbot:\nhttps://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803\n\nIn the report, the master pointer was used after being freed. This is\nbecause another process had acquired the device's master mutex in\ndrm_setmaster_ioctl(), then overwrote fpriv-\u003emaster in\ndrm_new_set_master(). The old value of fpriv-\u003emaster was subsequently\nfreed before the mutex was unlocked.\n\nTo fix this, we lock the device's master mutex before retrieving the\npointer from from fpriv-\u003emaster. This patch passes the Syzbot\nreproducer test.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6c491c58-fe1e-4816-a5ae-307edada2cc5",
      "id": "CVE-2021-47321",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix possible use-after-free by calling del_timer_sync()\n\nThis driver's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6ff56dbf-1080-498b-91a2-cc3de7f9f217",
      "id": "CVE-2021-47374",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: prevent an error message from causing runtime problems\n\nFor some drivers, that use the DMA API. This error message can be reached\nseveral millions of times per second, causing spam to the kernel's printk\nbuffer and bringing the CPU usage up to 100% (so, it should be rate\nlimited). However, since there is at least one driver that is in the\nmainline and suffers from the error condition, it is more useful to\nerr_printk() here instead of just rate limiting the error message (in hopes\nthat it will make it easier for other drivers that suffer from this issue\nto be spotted).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e087065-1a0c-49d8-91af-2c677f1122b8",
      "id": "CVE-2024-46833",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: void array out of bound when loop tnl_num\n\nWhen query reg inf of SSU, it loops tnl_num times. However, tnl_num comes\nfrom hardware and the length of array is a fixed value. To void array out\nof bound, make sure the loop time is not greater than the length of array",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a31dc81b-d171-4f17-904d-5bfb8c3a6444",
      "id": "CVE-2021-47384",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read tmp value sufficient for\n(tmp \u0026 0x08) \u0026\u0026 (!(tmp \u0026 0x80)) \u0026\u0026 ((tmp \u0026 0x7) == ((tmp \u003e\u003e 4) \u0026 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "64809d68-4803-4c9d-b52d-6d2f754b8908",
      "id": "CVE-2021-47438",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path\n\nPrior to this patch in case mlx5_core_destroy_cq() failed it returns\nwithout completing all destroy operations and that leads to memory leak.\nInstead, complete the destroy flow before return error.\n\nAlso move mlx5_debug_cq_remove() to the beginning of mlx5_core_destroy_cq()\nto be symmetrical with mlx5_core_create_cq().\n\nkmemleak complains on:\n\nunreferenced object 0xc000000038625100 (size 64):\n  comm \"ethtool\", pid 28301, jiffies 4298062946 (age 785.380s)\n  hex dump (first 32 bytes):\n    60 01 48 94 00 00 00 c0 b8 05 34 c3 00 00 00 c0  `.H.......4.....\n    02 00 00 00 00 00 00 00 00 db 7d c1 00 00 00 c0  ..........}.....\n  backtrace:\n    [\u003c000000009e8643cb\u003e] add_res_tree+0xd0/0x270 [mlx5_core]\n    [\u003c00000000e7cb8e6c\u003e] mlx5_debug_cq_add+0x5c/0xc0 [mlx5_core]\n    [\u003c000000002a12918f\u003e] mlx5_core_create_cq+0x1d0/0x2d0 [mlx5_core]\n    [\u003c00000000cef0a696\u003e] mlx5e_create_cq+0x210/0x3f0 [mlx5_core]\n    [\u003c000000009c642c26\u003e] mlx5e_open_cq+0xb4/0x130 [mlx5_core]\n    [\u003c0000000058dfa578\u003e] mlx5e_ptp_open+0x7f4/0xe10 [mlx5_core]\n    [\u003c0000000081839561\u003e] mlx5e_open_channels+0x9cc/0x13e0 [mlx5_core]\n    [\u003c0000000009cf05d4\u003e] mlx5e_switch_priv_channels+0xa4/0x230\n[mlx5_core]\n    [\u003c0000000042bbedd8\u003e] mlx5e_safe_switch_params+0x14c/0x300\n[mlx5_core]\n    [\u003c0000000004bc9db8\u003e] set_pflag_tx_port_ts+0x9c/0x160 [mlx5_core]\n    [\u003c00000000a0553443\u003e] mlx5e_set_priv_flags+0xd0/0x1b0 [mlx5_core]\n    [\u003c00000000a8f3d84b\u003e] ethnl_set_privflags+0x234/0x2d0\n    [\u003c00000000fd27f27c\u003e] genl_family_rcv_msg_doit+0x108/0x1d0\n    [\u003c00000000f495e2bb\u003e] genl_family_rcv_msg+0xe4/0x1f0\n    [\u003c00000000646c5c2c\u003e] genl_rcv_msg+0x78/0x120\n    [\u003c00000000d53e384e\u003e] netlink_rcv_skb+0x74/0x1a0",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "409a485c-e8c7-41f8-9fa1-993afc159a83",
      "id": "CVE-2021-47501",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix NULL pointer dereference in i40e_dbg_dump_desc\n\nWhen trying to dump VFs VSI RX/TX descriptors\nusing debugfs there was a crash\ndue to NULL pointer dereference in i40e_dbg_dump_desc.\nAdded a check to i40e_dbg_dump_desc that checks if\nVSI type is correct for dumping RX/TX descriptors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "db5bf07b-a716-483a-bfa1-1331953a0d7b",
      "id": "CVE-2021-47515",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: fix the iif in the IPv6 socket control block\n\nWhen an IPv4 packet is received, the ip_rcv_core(...) sets the receiving\ninterface index into the IPv4 socket control block (v5.16-rc4,\nnet/ipv4/ip_input.c line 510):\n\n    IPCB(skb)-\u003eiif = skb-\u003eskb_iif;\n\nIf that IPv4 packet is meant to be encapsulated in an outer IPv6+SRH\nheader, the seg6_do_srh_encap(...) performs the required encapsulation.\nIn this case, the seg6_do_srh_encap function clears the IPv6 socket control\nblock (v5.16-rc4 net/ipv6/seg6_iptunnel.c line 163):\n\n    memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));\n\nThe memset(...) was introduced in commit ef489749aae5 (\"ipv6: sr: clear\nIP6CB(skb) on SRH ip4ip6 encapsulation\") a long time ago (2019-01-29).\n\nSince the IPv6 socket control block and the IPv4 socket control block share\nthe same memory area (skb-\u003ecb), the receiving interface index info is lost\n(IP6CB(skb)-\u003eiif is set to zero).\n\nAs a side effect, that condition triggers a NULL pointer dereference if\ncommit 0857d6f8c759 (\"ipv6: When forwarding count rx stats on the orig\nnetdev\") is applied.\n\nTo fix that issue, we set the IP6CB(skb)-\u003eiif with the index of the\nreceiving interface once again.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d500d89d-9468-4875-9e3c-d0e156287a2c",
      "id": "CVE-2021-47634",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl\n\nHulk Robot reported a KASAN report about use-after-free:\n ==================================================================\n BUG: KASAN: use-after-free in __list_del_entry_valid+0x13d/0x160\n Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385\n [...]\n Call Trace:\n  klist_dec_and_del+0xa7/0x4a0\n  klist_put+0xc7/0x1a0\n  device_del+0x4d4/0xed0\n  cdev_device_del+0x1a/0x80\n  ubi_attach_mtd_dev+0x2951/0x34b0 [ubi]\n  ctrl_cdev_ioctl+0x286/0x2f0 [ubi]\n\n Allocated by task 1414:\n  device_add+0x60a/0x18b0\n  cdev_device_add+0x103/0x170\n  ubi_create_volume+0x1118/0x1a10 [ubi]\n  ubi_cdev_ioctl+0xb7f/0x1ba0 [ubi]\n\n Freed by task 1385:\n  cdev_device_del+0x1a/0x80\n  ubi_remove_volume+0x438/0x6c0 [ubi]\n  ubi_cdev_ioctl+0xbf4/0x1ba0 [ubi]\n [...]\n ==================================================================\n\nThe lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held\nby ubi_cdev_ioctl is ubi-\u003edevice_mutex. Therefore, the two locks can be\nconcurrent.\n\nctrl_cdev_ioctl contains two operations: ubi_attach and ubi_detach.\nubi_detach is bug-free because it uses reference counting to prevent\nconcurrency. However, uif_init and uif_close in ubi_attach may race with\nubi_cdev_ioctl.\n\nuif_init will race with ubi_cdev_ioctl as in the following stack.\n           cpu1                   cpu2                  cpu3\n_______________________|________________________|______________________\nctrl_cdev_ioctl\n ubi_attach_mtd_dev\n  uif_init\n                           ubi_cdev_ioctl\n                            ubi_create_volume\n                             cdev_device_add\n   ubi_add_volume\n   // sysfs exist\n   kill_volumes\n                                                    ubi_cdev_ioctl\n                                                     ubi_remove_volume\n                                                      cdev_device_del\n                                                       // first free\n    ubi_free_volume\n     cdev_del\n     // double free\n   cdev_device_del\n\nAnd uif_close will race with ubi_cdev_ioctl as in the following stack.\n           cpu1                   cpu2                  cpu3\n_______________________|________________________|______________________\nctrl_cdev_ioctl\n ubi_attach_mtd_dev\n  uif_init\n                           ubi_cdev_ioctl\n                            ubi_create_volume\n                             cdev_device_add\n  ubi_debugfs_init_dev\n  //error goto out_uif;\n  uif_close\n   kill_volumes\n                                                    ubi_cdev_ioctl\n                                                     ubi_remove_volume\n                                                      cdev_device_del\n                                                       // first free\n    ubi_free_volume\n    // double free\n\nThe cause of this problem is that commit 714fb87e8bc0 make device\n\"available\" before it becomes accessible via sysfs. Therefore, we\nroll back the modification. We will fix the race condition between\nubi device creation and udev by removing ubi_get_device in\nvol_attribute_show and dev_attribute_show.This avoids accessing\nuninitialized ubi_devices[ubi_num].\n\nubi_get_device is used to prevent devices from being deleted during\nsysfs execution. However, now kernfs ensures that devices will not\nbe deleted before all reference counting are released.\nThe key process is shown in the following stack.\n\ndevice_del\n  device_remove_attrs\n    device_remove_groups\n      sysfs_remove_groups\n        sysfs_remove_group\n          remove_files\n            kernfs_remove_by_name\n              kernfs_remove_by_name_ns\n                __kernfs_remove\n                  kernfs_drain",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f257cc6e-7ae2-47a9-96c4-61e79e4fc95f",
      "id": "CVE-2022-45869",
      "description": "A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bcd1afc-b772-461a-b64d-3e7a84b16e20",
      "id": "CVE-2024-50243",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix general protection fault in run_is_mapped_full\n\nFixed deleating of a non-resident attribute in ntfs_create_inode()\nrollback.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de0b2880-95f8-4c87-ad61-b9c7aa81cb44",
      "id": "CVE-2022-48896",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: fix pci device refcount leak\n\nAs the comment of pci_get_domain_bus_and_slot() says, it\nreturns a PCI device with refcount incremented, when finish\nusing it, the caller must decrement the reference count by\ncalling pci_dev_put().\n\nIn ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(),\npci_dev_put() is called to avoid leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d5ca550f-b305-4430-86a8-75c579cf6ecd",
      "id": "CVE-2022-48909",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix connection leak\n\nThere's a potential leak issue under following execution sequence :\n\nsmc_release  \t\t\t\tsmc_connect_work\nif (sk-\u003esk_state == SMC_INIT)\n\t\t\t\t\tsend_clc_confirim\n\ttcp_abort();\n\t\t\t\t\t...\n\t\t\t\t\tsk.sk_state = SMC_ACTIVE\nsmc_close_active\nswitch(sk-\u003esk_state) {\n...\ncase SMC_ACTIVE:\n\tsmc_close_final()\n\t// then wait peer closed\n\nUnfortunately, tcp_abort() may discard CLC CONFIRM messages that are\nstill in the tcp send buffer, in which case our connection token cannot\nbe delivered to the server side, which means that we cannot get a\npassive close message at all. Therefore, it is impossible for the to be\ndisconnected at all.\n\nThis patch tries a very simple way to avoid this issue, once the state\nhas changed to SMC_ACTIVE after tcp_abort(), we can actively abort the\nsmc connection, considering that the state is SMC_INIT before\ntcp_abort(), abandoning the complete disconnection process should not\ncause too much problem.\n\nIn fact, this problem may exist as long as the CLC CONFIRM message is\nnot received by the server. Whether a timer should be added after\nsmc_close_final() needs to be discussed in the future. But even so, this\npatch provides a faster release for connection in above case, it should\nalso be valuable.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7df257d2-a640-4010-8b12-53343375192b",
      "id": "CVE-2022-48969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: Fix NULL sring after live migration\n\nA NAPI is setup for each network sring to poll data to kernel\nThe sring with source host is destroyed before live migration and\nnew sring with target host is setup after live migration.\nThe NAPI for the old sring is not deleted until setup new sring\nwith target host after migration. With busy_poll/busy_read enabled,\nthe NAPI can be polled before got deleted when resume VM.\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000008\nIP: xennet_poll+0xae/0xd20\nPGD 0 P4D 0\nOops: 0000 [#1] SMP PTI\nCall Trace:\n finish_task_switch+0x71/0x230\n timerqueue_del+0x1d/0x40\n hrtimer_try_to_cancel+0xb5/0x110\n xennet_alloc_rx_buffers+0x2a0/0x2a0\n napi_busy_loop+0xdb/0x270\n sock_poll+0x87/0x90\n do_sys_poll+0x26f/0x580\n tracing_map_insert+0x1d4/0x2f0\n event_hist_trigger+0x14a/0x260\n\n finish_task_switch+0x71/0x230\n __schedule+0x256/0x890\n recalc_sigpending+0x1b/0x50\n xen_sched_clock+0x15/0x20\n __rb_reserve_next+0x12d/0x140\n ring_buffer_lock_reserve+0x123/0x3d0\n event_triggers_call+0x87/0xb0\n trace_event_buffer_commit+0x1c4/0x210\n xen_clocksource_get_cycles+0x15/0x20\n ktime_get_ts64+0x51/0xf0\n SyS_ppoll+0x160/0x1a0\n SyS_ppoll+0x160/0x1a0\n do_syscall_64+0x73/0x130\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\n...\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\nCR2: 0000000000000008\n---[ end trace f8601785b354351c ]---\n\nxen frontend should remove the NAPIs for the old srings before live\nmigration as the bond srings are destroyed\n\nThere is a tiny window between the srings are set to NULL and\nthe NAPIs are disabled, It is safe as the NAPI threads are still\nfrozen at that time",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa829f91-34d3-4544-9ddf-96de487329fb",
      "id": "CVE-2022-49006",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free buffers when a used dynamic event is removed\n\nAfter 65536 dynamic events have been added and removed, the \"type\" field\nof the event then uses the first type number that is available (not\ncurrently used by other events). A type number is the identifier of the\nbinary blobs in the tracing ring buffer (known as events) to map them to\nlogic that can parse the binary blob.\n\nThe issue is that if a dynamic event (like a kprobe event) is traced and\nis in the ring buffer, and then that event is removed (because it is\ndynamic, which means it can be created and destroyed), if another dynamic\nevent is created that has the same number that new event's logic on\nparsing the binary blob will be used.\n\nTo show how this can be an issue, the following can crash the kernel:\n\n # cd /sys/kernel/tracing\n # for i in `seq 65536`; do\n     echo 'p:kprobes/foo do_sys_openat2 $arg1:u32' \u003e kprobe_events\n # done\n\nFor every iteration of the above, the writing to the kprobe_events will\nremove the old event and create a new one (with the same format) and\nincrease the type number to the next available on until the type number\nreaches over 65535 which is the max number for the 16 bit type. After it\nreaches that number, the logic to allocate a new number simply looks for\nthe next available number. When an dynamic event is removed, that number\nis then available to be reused by the next dynamic event created. That is,\nonce the above reaches the max number, the number assigned to the event in\nthat loop will remain the same.\n\nNow that means deleting one dynamic event and created another will reuse\nthe previous events type number. This is where bad things can happen.\nAfter the above loop finishes, the kprobes/foo event which reads the\ndo_sys_openat2 function call's first parameter as an integer.\n\n # echo 1 \u003e kprobes/foo/enable\n # cat /etc/passwd \u003e /dev/null\n # cat trace\n             cat-2211    [005] ....  2007.849603: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n             cat-2211    [005] ....  2007.849620: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n             cat-2211    [005] ....  2007.849838: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n             cat-2211    [005] ....  2007.849880: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n # echo 0 \u003e kprobes/foo/enable\n\nNow if we delete the kprobe and create a new one that reads a string:\n\n # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' \u003e kprobe_events\n\nAnd now we can the trace:\n\n # cat trace\n        sendmail-1942    [002] .....   530.136320: foo: (do_sys_openat2+0x0/0x240) arg1=             cat-2046    [004] .....   530.930817: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n             cat-2046    [004] .....   530.930961: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n             cat-2046    [004] .....   530.934278: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n             cat-2046    [004] .....   530.934563: foo: (do_sys_openat2+0x0/0x240) arg1=\"���������������������������������������\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a89d380d-9928-4123-b409-41d2c3c3c18c",
      "id": "CVE-2022-49020",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: Fix a potential socket leak in p9_socket_open\n\nBoth p9_fd_create_tcp() and p9_fd_create_unix() will call\np9_socket_open(). If the creation of p9_trans_fd fails,\np9_fd_create_tcp() and p9_fd_create_unix() will return an\nerror directly instead of releasing the cscoket, which will\nresult in a socket leak.\n\nThis patch adds sock_release() to fix the leak issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a39aa16e-4f0c-43ba-80e9-4de6ce99bb34",
      "id": "CVE-2022-49151",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcba_usb: properly check endpoint type\n\nSyzbot reported warning in usb_submit_urb() which is caused by wrong\nendpoint type. We should check that in endpoint is actually present to\nprevent this warning.\n\nFound pipes are now saved to struct mcba_priv and code uses them\ndirectly instead of making pipes in place.\n\nFail log:\n\n| usb 5-1: BOGUS urb xfer, pipe 3 != type 1\n| WARNING: CPU: 1 PID: 49 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\n| Modules linked in:\n| CPU: 1 PID: 49 Comm: kworker/1:2 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0\n| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014\n| Workqueue: usb_hub_wq hub_event\n| RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\n| ...\n| Call Trace:\n|  \u003cTASK\u003e\n|  mcba_usb_start drivers/net/can/usb/mcba_usb.c:662 [inline]\n|  mcba_usb_probe+0x8a3/0xc50 drivers/net/can/usb/mcba_usb.c:858\n|  usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396\n|  call_driver_probe drivers/base/dd.c:517 [inline]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0895799d-da49-451b-8805-23cf0805bb36",
      "id": "CVE-2022-49247",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED\n\nIf the callback 'start_streaming' fails, then all\nqueued buffers in the driver should be returned with\nstate 'VB2_BUF_STATE_QUEUED'. Currently, they are\nreturned with 'VB2_BUF_STATE_ERROR' which is wrong.\nFix this. This also fixes the warning:\n\n[   65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common]\n[   65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6\n[   65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G        W         5.16.0-rc4-62408-g32447129cb30-dirty #14\n[   65.590293] Hardware name: Radxa ROCK Pi 4B (DT)\n[   65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common]\n[   65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common]\n[   65.592395] sp : ffff800012bc3ad0\n[   65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8\n[   65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612\n[   65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0\n[   65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff\n[   65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78\n[   65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce\n[   65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228\n[   65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78\n[   65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880\n[   65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0\n[   65.598940] Call trace:\n[   65.599155]  vb2_start_streaming+0xd4/0x160 [videobuf2_common]\n[   65.599672]  vb2_core_streamon+0x17c/0x1a8 [videobuf2_common]\n[   65.600179]  vb2_streamon+0x54/0x88 [videobuf2_v4l2]\n[   65.600619]  vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2]\n[   65.601103]  v4l_streamon+0x3c/0x50 [videodev]\n[   65.601521]  __video_do_ioctl+0x1a4/0x428 [videodev]\n[   65.601977]  video_usercopy+0x320/0x828 [videodev]\n[   65.602419]  video_ioctl2+0x3c/0x58 [videodev]\n[   65.602830]  v4l2_ioctl+0x60/0x90 [videodev]\n[   65.603227]  __arm64_sys_ioctl+0xa8/0xe0\n[   65.603576]  invoke_syscall+0x54/0x118\n[   65.603911]  el0_svc_common.constprop.3+0x84/0x100\n[   65.604332]  do_el0_svc+0x34/0xa0\n[   65.604625]  el0_svc+0x1c/0x50\n[   65.604897]  el0t_64_sync_handler+0x88/0xb0\n[   65.605264]  el0t_64_sync+0x16c/0x170\n[   65.605587] ---[ end trace 578e0ba07742170d ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0b604bdc-0a8e-45a7-a2aa-b9a99773a87f",
      "id": "CVE-2022-49327",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: avoid journal no-space deadlock by reserving 1 journal bucket\n\nThe journal no-space deadlock was reported time to time. Such deadlock\ncan happen in the following situation.\n\nWhen all journal buckets are fully filled by active jset with heavy\nwrite I/O load, the cache set registration (after a reboot) will load\nall active jsets and inserting them into the btree again (which is\ncalled journal replay). If a journaled bkey is inserted into a btree\nnode and results btree node split, new journal request might be\ntriggered. For example, the btree grows one more level after the node\nsplit, then the root node record in cache device super block will be\nupgrade by bch_journal_meta() from bch_btree_set_root(). But there is no\nspace in journal buckets, the journal replay has to wait for new journal\nbucket to be reclaimed after at least one journal bucket replayed. This\nis one example that how the journal no-space deadlock happens.\n\nThe solution to avoid the deadlock is to reserve 1 journal bucket in\nrun time, and only permit the reserved journal bucket to be used during\ncache set registration procedure for things like journal replay. Then\nthe journal space will never be fully filled, there is no chance for\njournal no-space deadlock to happen anymore.\n\nThis patch adds a new member \"bool do_reserve\" in struct journal, it is\ninititalized to 0 (false) when struct journal is allocated, and set to\n1 (true) by bch_journal_space_reserve() when all initialization done in\nrun_cache_set(). In the run time when journal_reclaim() tries to\nallocate a new journal bucket, free_journal_buckets() is called to check\nwhether there are enough free journal buckets to use. If there is only\n1 free journal bucket and journal-\u003edo_reserve is 1 (true), the last\nbucket is reserved and free_journal_buckets() will return 0 to indicate\nno free journal bucket. Then journal_reclaim() will give up, and try\nnext time to see whetheer there is free journal bucket to allocate. By\nthis method, there is always 1 jouranl bucket reserved in run time.\n\nDuring the cache set registration, journal-\u003edo_reserve is 0 (false), so\nthe reserved journal bucket can be used to avoid the no-space deadlock.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "08cc83ee-3f1d-4ea8-97b6-b34fa52851be",
      "id": "CVE-2022-49396",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: qcom-qmp: fix reset-controller leak on probe errors\n\nMake sure to release the lane reset controller in case of a late probe\nerror (e.g. probe deferral).\n\nNote that due to the reset controller being defined in devicetree in\n\"lane\" child nodes, devm_reset_control_get_exclusive() cannot be used\ndirectly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d35552b0-c489-4834-9ec7-79c8ece0f727",
      "id": "CVE-2022-49416",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix use-after-free in chanctx code\n\nIn ieee80211_vif_use_reserved_context(), when we have an\nold context and the new context's replace_state is set to\nIEEE80211_CHANCTX_REPLACE_NONE, we free the old context\nin ieee80211_vif_use_reserved_reassign(). Therefore, we\ncannot check the old_ctx anymore, so we should set it to\nNULL after this point.\n\nHowever, since the new_ctx replace state is clearly not\nIEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do\nanything else in this function and can just return to\navoid accessing the freed old_ctx.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "162c84a5-2a34-4daa-a016-41835354ca67",
      "id": "CVE-2022-49508",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: elan: Fix potential double free in elan_input_configured\n\n'input' is a managed resource allocated with devm_input_allocate_device(),\nso there is no need to call input_free_device() explicitly or\nthere will be a double free.\n\nAccording to the doc of devm_input_allocate_device():\n * Managed input devices do not need to be explicitly unregistered or\n * freed as it will be done automatically when owner device unbinds from\n * its driver (or binding fails).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "252b2497-e417-4123-a76e-47c470f94dbb",
      "id": "CVE-2022-49555",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Use del_timer_sync() before freeing\n\nWhile looking at a crash report on a timer list being corrupted, which\nusually happens when a timer is freed while still active. This is\ncommonly triggered by code calling del_timer() instead of\ndel_timer_sync() just before freeing.\n\nOne possible culprit is the hci_qca driver, which does exactly that.\n\nEric mentioned that wake_retrans_timer could be rearmed via the work\nqueue, so also move the destruction of the work queue before\ndel_timer_sync().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e51574b9-e652-41bd-8b6f-1de86a5d90e3",
      "id": "CVE-2022-49615",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error\n\nThe initial settings will be written before the codec probe function.\nBut, the rt711-\u003ecomponent doesn't be assigned yet.\nIf IO error happened during initial settings operations, it will cause the kernel panic.\nThis patch changed component-\u003edev to slave-\u003edev to fix this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b41e3480-5b93-44f4-b6fb-f50f2c3b21af",
      "id": "CVE-2022-49698",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: use get_random_u32 instead of prandom\n\nbh might occur while updating per-cpu rnd_state from user context,\nie. local_out path.\n\nBUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725\ncaller is nft_ng_random_eval+0x24/0x54 [nft_numgen]\nCall Trace:\n check_preemption_disabled+0xde/0xe0\n nft_ng_random_eval+0x24/0x54 [nft_numgen]\n\nUse the random driver instead, this also avoids need for local prandom\nstate. Moreover, prandom now uses the random driver since d4150779e60f\n(\"random32: use real rng for non-deterministic randomness\").\n\nBased on earlier patch from Pablo Neira.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a8134888-dac0-474b-ba82-c72b413d98a8",
      "id": "CVE-2022-50175",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tw686x: Fix memory leak in tw686x_video_init\n\nvideo_device_alloc() allocates memory for vdev,\nwhen video_register_device() fails, it doesn't release the memory and\nleads to memory leak, call video_device_release() to fix this.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e78fbeb-b0f7-4690-9e03-2bc8c1de11f9",
      "id": "CVE-2022-49757",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/highbank: Fix memory leak in highbank_mc_probe()\n\nWhen devres_open_group() fails, it returns -ENOMEM without freeing memory\nallocated by edac_mc_alloc().\n\nCall edac_mc_free() on the error handling path to avoid a memory leak.\n\n  [ bp: Massage commit message. ]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "046c2df3-64c9-4686-a48f-759a02cf7fc1",
      "id": "CVE-2022-49853",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macvlan: fix memory leaks of macvlan_common_newlink\n\nkmemleak reports memory leaks in macvlan_common_newlink, as follows:\n\n ip link add link eth0 name .. type macvlan mode source macaddr add\n \u003cMAC-ADDR\u003e\n\nkmemleak reports:\n\nunreferenced object 0xffff8880109bb140 (size 64):\n  comm \"ip\", pid 284, jiffies 4294986150 (age 430.108s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 b8 aa 5a 12 80 88 ff ff  ..........Z.....\n    80 1b fa 0d 80 88 ff ff 1e ff ac af c7 c1 6b 6b  ..............kk\n  backtrace:\n    [\u003cffffffff813e06a7\u003e] kmem_cache_alloc_trace+0x1c7/0x300\n    [\u003cffffffff81b66025\u003e] macvlan_hash_add_source+0x45/0xc0\n    [\u003cffffffff81b66a67\u003e] macvlan_changelink_sources+0xd7/0x170\n    [\u003cffffffff81b6775c\u003e] macvlan_common_newlink+0x38c/0x5a0\n    [\u003cffffffff81b6797e\u003e] macvlan_newlink+0xe/0x20\n    [\u003cffffffff81d97f8f\u003e] __rtnl_newlink+0x7af/0xa50\n    [\u003cffffffff81d98278\u003e] rtnl_newlink+0x48/0x70\n    ...\n\nIn the scenario where the macvlan mode is configured as 'source',\nmacvlan_changelink_sources() will be execured to reconfigure list of\nremote source mac addresses, at the same time, if register_netdevice()\nreturn an error, the resource generated by macvlan_changelink_sources()\nis not cleaned up.\n\nUsing this patch, in the case of an error, it will execute\nmacvlan_flush_sources() to ensure that the resource is cleaned up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c708161d-8705-407f-8bc7-33079342d8a6",
      "id": "CVE-2022-49950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix memory corruption on open\n\nThe probe session-duplication overflow check incremented the session\ncount also when there were no more available sessions so that memory\nbeyond the fixed-size slab-allocated session array could be corrupted in\nfastrpc_session_alloc() on open().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6464844c-cb94-46bc-be89-7abb0613c1eb",
      "id": "CVE-2022-49993",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Check for overflow while configuring loop\n\nThe userspace can configure a loop using an ioctl call, wherein\na configuration of type loop_config is passed (see lo_ioctl()'s\ncase on line 1550 of drivers/block/loop.c). This proceeds to call\nloop_configure() which in turn calls loop_set_status_from_info()\n(see line 1050 of loop.c), passing \u0026config-\u003einfo which is of type\nloop_info64*. This function then sets the appropriate values, like\nthe offset.\n\nloop_device has lo_offset of type loff_t (see line 52 of loop.c),\nwhich is typdef-chained to long long, whereas loop_info64 has\nlo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).\n\nThe function directly copies offset from info to the device as\nfollows (See line 980 of loop.c):\n\tlo-\u003elo_offset = info-\u003elo_offset;\n\nThis results in an overflow, which triggers a warning in iomap_iter()\ndue to a call to iomap_iter_done() which has:\n\tWARN_ON_ONCE(iter-\u003eiomap.offset \u003e iter-\u003epos);\n\nThus, check for negative value during loop_set_status_from_info().\n\nBug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49482203-8af4-49b4-9ec6-f9b2b2092c89",
      "id": "CVE-2022-50013",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()\n\nAs Dipanjan Das \u003cmail.dipanjan.das@gmail.com\u003e reported, syzkaller\nfound a f2fs bug as below:\n\nRIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295\nCall Trace:\n write_all_xattrs fs/f2fs/xattr.c:487 [inline]\n __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743\n f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790\n f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86\n __vfs_setxattr+0x115/0x180 fs/xattr.c:182\n __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216\n __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277\n vfs_setxattr+0x13f/0x330 fs/xattr.c:303\n setxattr+0x146/0x160 fs/xattr.c:611\n path_setxattr+0x1a7/0x1d0 fs/xattr.c:630\n __do_sys_lsetxattr fs/xattr.c:653 [inline]\n __se_sys_lsetxattr fs/xattr.c:649 [inline]\n __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nNAT entry and nat bitmap can be inconsistent, e.g. one nid is free\nin nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it\nmay trigger BUG_ON() in f2fs_new_node_page(), fix it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87e91b6d-5f72-4610-8e7e-431090a28094",
      "id": "CVE-2022-50047",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6060: prevent crash on an unused port\n\nIf the port isn't a CPU port nor a user port, 'cpu_dp'\nis a null pointer and a crash happened on dereferencing\nit in mv88e6060_setup_port():\n\n[    9.575872] Unable to handle kernel NULL pointer dereference at virtual address 00000014\n...\n[    9.942216]  mv88e6060_setup from dsa_register_switch+0x814/0xe84\n[    9.948616]  dsa_register_switch from mdio_probe+0x2c/0x54\n[    9.954433]  mdio_probe from really_probe.part.0+0x98/0x2a0\n[    9.960375]  really_probe.part.0 from driver_probe_device+0x30/0x10c\n[    9.967029]  driver_probe_device from __device_attach_driver+0xb8/0x13c\n[    9.973946]  __device_attach_driver from bus_for_each_drv+0x90/0xe0\n[    9.980509]  bus_for_each_drv from __device_attach+0x110/0x184\n[    9.986632]  __device_attach from bus_probe_device+0x8c/0x94\n[    9.992577]  bus_probe_device from deferred_probe_work_func+0x78/0xa8\n[    9.999311]  deferred_probe_work_func from process_one_work+0x290/0x73c\n[   10.006292]  process_one_work from worker_thread+0x30/0x4b8\n[   10.012155]  worker_thread from kthread+0xd4/0x10c\n[   10.017238]  kthread from ret_from_fork+0x14/0x3c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5e50a0a-7c98-4a26-aa77-d0e8b57d2a98",
      "id": "CVE-2022-50080",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: add overflow check in register_shm_helper()\n\nWith special lengths supplied by user space, register_shm_helper() has\nan integer overflow when calculating the number of pages covered by a\nsupplied user space memory region.\n\nThis causes internal_get_user_pages_fast() a helper function of\npin_user_pages_fast() to do a NULL pointer dereference:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n  Modules linked in:\n  CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11\n  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n  pc : internal_get_user_pages_fast+0x474/0xa80\n  Call trace:\n   internal_get_user_pages_fast+0x474/0xa80\n   pin_user_pages_fast+0x24/0x4c\n   register_shm_helper+0x194/0x330\n   tee_shm_register_user_buf+0x78/0x120\n   tee_ioctl+0xd0/0x11a0\n   __arm64_sys_ioctl+0xa8/0xec\n   invoke_syscall+0x48/0x114\n\nFix this by adding an an explicit call to access_ok() in\ntee_shm_register_user_buf() to catch an invalid user space address\nearly.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cdc4ac83-f298-49dd-9256-0b53d8e0299c",
      "id": "CVE-2022-50220",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Fix linkwatch use-after-free on disconnect\n\nusbnet uses the work usbnet_deferred_kevent() to perform tasks which may\nsleep.  On disconnect, completion of the work was originally awaited in\n-\u003endo_stop().  But in 2003, that was moved to -\u003edisconnect() by historic\ncommit \"[PATCH] USB: usbnet, prevent exotic rtnl deadlock\":\n\n  https://git.kernel.org/tglx/history/c/0f138bbfd83c\n\nThe change was made because back then, the kernel's workqueue\nimplementation did not allow waiting for a single work.  One had to wait\nfor completion of *all* work by calling flush_scheduled_work(), and that\ncould deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex\nheld in -\u003endo_stop().\n\nThe commit solved one problem but created another:  It causes a\nuse-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,\nax88179_178a.c, ch9200.c and smsc75xx.c:\n\n* If the drivers receive a link change interrupt immediately before\n  disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)\n  -\u003estatus() callback and schedule usbnet_deferred_kevent().\n* usbnet_deferred_kevent() invokes the driver's -\u003elink_reset() callback,\n  which calls netif_carrier_{on,off}().\n* That in turn schedules the work linkwatch_event().\n\nBecause usbnet_deferred_kevent() is awaited after unregister_netdev(),\nnetif_carrier_{on,off}() may operate on an unregistered netdev and\nlinkwatch_event() may run after free_netdev(), causing a use-after-free.\n\nIn 2010, usbnet was changed to only wait for a single instance of\nusbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf\n(\"drivers/net: don't use flush_scheduled_work()\").\n\nUnfortunately the commit neglected to move the wait back to\n-\u003endo_stop().  Rectify that omission at long last.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9b74b82f-2481-4f06-b759-f310b4205196",
      "id": "CVE-2022-50278",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPNP: fix name memory leak in pnp_alloc_dev()\n\nAfter commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nmove dev_set_name() after pnp_add_id() to avoid memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b525c7c8-9ccc-456e-b885-50b57f159006",
      "id": "CVE-2022-50288",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqlcnic: prevent -\u003edcb use-after-free on qlcnic_dcb_enable() failure\n\nadapter-\u003edcb would get silently freed inside qlcnic_dcb_enable() in\ncase qlcnic_dcb_attach() would return an error, which always happens\nunder OOM conditions. This would lead to use-after-free because both\nof the existing callers invoke qlcnic_dcb_get_info() on the obtained\npointer, which is potentially freed at that point.\n\nPropagate errors from qlcnic_dcb_enable(), and instead free the dcb\npointer at callsite using qlcnic_dcb_free(). This also removes the now\nunused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around\nkfree() also causing memory leaks for partially initialized dcb.\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE\nstatic analysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "829f2760-df54-45e5-b250-6b43d9e3bd05",
      "id": "CVE-2022-50334",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()\n\nSyzkaller reports a null-ptr-deref bug as follows:\n======================================================\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380\n[...]\nCall Trace:\n \u003cTASK\u003e\n vfs_parse_fs_param fs/fs_context.c:148 [inline]\n vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129\n vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191\n generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231\n do_new_mount fs/namespace.c:3036 [inline]\n path_mount+0x12de/0x1e20 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n \u003c/TASK\u003e\n======================================================\n\nAccording to commit \"vfs: parse: deal with zero length string value\",\nkernel will set the param-\u003estring to null pointer in vfs_parse_fs_string()\nif fs string has zero length.\n\nYet the problem is that, hugetlbfs_parse_param() will dereference the\nparam-\u003estring, without checking whether it is a null pointer.  To be more\nspecific, if hugetlbfs_parse_param() parses an illegal mount parameter,\nsuch as \"size=,\", kernel will constructs struct fs_parameter with null\npointer in vfs_parse_fs_string(), then passes this struct fs_parameter to\nhugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.\n\nThis patch solves it by adding sanity check on param-\u003estring\nin hugetlbfs_parse_param().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5d33321c-d174-4ae9-9484-c78598ee9ff9",
      "id": "CVE-2022-50380",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: /proc/pid/smaps_rollup: fix no vma's null-deref\n\nCommit 258f669e7e88 (\"mm: /proc/pid/smaps_rollup: convert to single value\nseq_file\") introduced a null-deref if there are no vma's in the task in\nshow_smaps_rollup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "27b97026-9ff8-4838-b8ce-5748ac00ee75",
      "id": "CVE-2022-50395",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nintegrity: Fix memory leakage in keyring allocation error path\n\nKey restriction is allocated in integrity_init_keyring(). However, if\nkeyring allocation failed, it is not freed, causing memory leaks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dda9a243-1fac-459d-8ca4-eea20f561329",
      "id": "CVE-2020-15437",
      "description": "The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p-\u003eserial_in pointer which uninitialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ca97ecb-d71c-4224-8010-ce2c236c749c",
      "id": "CVE-2023-2163",
      "description": "Incorrect verifier pruning in BPF in Linux Kernel \u003e=5.4 leads to unsafe\ncode paths being incorrectly marked as safe, resulting in arbitrary read/write in\nkernel memory, lateral privilege escalation, and container escape.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82d33cd5-83ba-4be1-9572-021d9805f198",
      "id": "CVE-2023-28466",
      "description": "do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "75833263-a4bc-4923-81e5-ecc5f8829190",
      "id": "CVE-2023-33951",
      "description": "A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15c0b306-f0e8-4748-a237-720510fbe1e6",
      "id": "CVE-2023-3863",
      "description": "A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c330279b-aa26-4f11-a56e-cf3c0ad91b93",
      "id": "CVE-2023-4208",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation.\n\nWhen u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.\n\nWe recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11b2e036-9b3a-47f3-ae31-4da68a64bf34",
      "id": "CVE-2023-52491",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run\n\nIn mtk_jpeg_probe, \u0026jpeg-\u003ejob_timeout_work is bound with\nmtk_jpeg_job_timeout_work.\n\nIn mtk_jpeg_dec_device_run, if error happens in\nmtk_jpeg_set_dec_dst, it will finally start the worker while\nmark the job as finished by invoking v4l2_m2m_job_finish.\n\nThere are two methods to trigger the bug. If we remove the\nmodule, it which will call mtk_jpeg_remove to make cleanup.\nThe possible sequence is as follows, which will cause a\nuse-after-free bug.\n\nCPU0                  CPU1\nmtk_jpeg_dec_...    |\n  start worker\t    |\n                    |mtk_jpeg_job_timeout_work\nmtk_jpeg_remove     |\n  v4l2_m2m_release  |\n    kfree(m2m_dev); |\n                    |\n                    | v4l2_m2m_get_curr_priv\n                    |   m2m_dev-\u003ecurr_ctx //use\n\nIf we close the file descriptor, which will call mtk_jpeg_release,\nit will have a similar sequence.\n\nFix this bug by starting timeout worker only if started jpegdec worker\nsuccessfully. Then v4l2_m2m_job_finish will only be called in\neither mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c51e546-9b3b-46d8-924d-fa164c662c03",
      "id": "CVE-2023-52574",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix null-ptr-deref when team device type is changed\n\nGet a null-ptr-deref bug as follows with reproducer [1].\n\nBUG: kernel NULL pointer dereference, address: 0000000000000228\n...\nRIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q]\n...\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x24/0x70\n ? page_fault_oops+0x82/0x150\n ? exc_page_fault+0x69/0x150\n ? asm_exc_page_fault+0x26/0x30\n ? vlan_dev_hard_header+0x35/0x140 [8021q]\n ? vlan_dev_hard_header+0x8e/0x140 [8021q]\n neigh_connected_output+0xb2/0x100\n ip6_finish_output2+0x1cb/0x520\n ? nf_hook_slow+0x43/0xc0\n ? ip6_mtu+0x46/0x80\n ip6_finish_output+0x2a/0xb0\n mld_sendpack+0x18f/0x250\n mld_ifc_work+0x39/0x160\n process_one_work+0x1e6/0x3f0\n worker_thread+0x4d/0x2f0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe5/0x120\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n\n[1]\n$ teamd -t team0 -d -c '{\"runner\": {\"name\": \"loadbalance\"}}'\n$ ip link add name t-dummy type dummy\n$ ip link add link t-dummy name t-dummy.100 type vlan id 100\n$ ip link add name t-nlmon type nlmon\n$ ip link set t-nlmon master team0\n$ ip link set t-nlmon nomaster\n$ ip link set t-dummy up\n$ ip link set team0 up\n$ ip link set t-dummy.100 down\n$ ip link set t-dummy.100 master team0\n\nWhen enslave a vlan device to team device and team device type is changed\nfrom non-ether to ether, header_ops of team device is changed to\nvlan_header_ops. That is incorrect and will trigger null-ptr-deref\nfor vlan-\u003ereal_dev in vlan_dev_hard_header() because team device is not\na vlan device.\n\nCache eth_header_ops in team_setup(), then assign cached header_ops to\nheader_ops of team net device when its type is changed from non-ether\nto ether to fix the bug.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "433b0684-c2c3-4886-90e1-bbccc8515428",
      "id": "CVE-2023-52488",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO\n\nThe SC16IS7XX IC supports a burst mode to access the FIFOs where the\ninitial register address is sent ($00), followed by all the FIFO data\nwithout having to resend the register address each time. In this mode, the\nIC doesn't increment the register address for each R/W byte.\n\nThe regmap_raw_read() and regmap_raw_write() are functions which can\nperform IO over multiple registers. They are currently used to read/write\nfrom/to the FIFO, and although they operate correctly in this burst mode on\nthe SPI bus, they would corrupt the regmap cache if it was not disabled\nmanually. The reason is that when the R/W size is more than 1 byte, these\nfunctions assume that the register address is incremented and handle the\ncache accordingly.\n\nConvert FIFO R/W functions to use the regmap _noinc_ versions in order to\nremove the manual cache control which was a workaround when using the\n_raw_ versions. FIFO registers are properly declared as volatile so\ncache will not be used/updated for FIFO accesses.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd1a3a6f-4bfa-4ba0-8ccb-57c77f2a5b76",
      "id": "CVE-2023-52606",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/lib: Validate size for vector operations\n\nSome of the fp/vmx code in sstep.c assume a certain maximum size for the\ninstructions being emulated. The size of those operations however is\ndetermined separately in analyse_instr().\n\nAdd a check to validate the assumption on the maximum size of the\noperations, so as to prevent any unintended kernel stack corruption.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fbe8dc8b-29e3-48b0-b981-97a477772f7a",
      "id": "CVE-2023-52747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Restore allocated resources on failed copyout\n\nFix a resource leak if an error occurs.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63f8beae-2ce9-4b9d-9fcb-d2f642f1ad89",
      "id": "CVE-2023-52916",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: aspeed: Fix memory overwrite if timing is 1600x900\n\nWhen capturing 1600x900, system could crash when system memory usage is\ntight.\n\nThe way to reproduce this issue:\n1. Use 1600x900 to display on host\n2. Mount ISO through 'Virtual media' on OpenBMC's web\n3. Run script as below on host to do sha continuously\n  #!/bin/bash\n  while [ [1] ];\n  do\n\tfind /media -type f -printf '\"%h/%f\"\\n' | xargs sha256sum\n  done\n4. Open KVM on OpenBMC's web\n\nThe size of macro block captured is 8x8. Therefore, we should make sure\nthe height of src-buf is 8 aligned to fix this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a5f2afbd-72b6-4a27-9e96-119c7d8a26a9",
      "id": "CVE-2023-53131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix a server shutdown leak\n\nFix a race where kthread_stop() may prevent the threadfn from ever getting\ncalled.  If that happens the svc_rqst will not be cleaned up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d145d8b-f98a-4dea-90c0-9601384db064",
      "id": "CVE-2023-53146",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()\n\nIn dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach dw2102_i2c_transfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 950e252cb469\n(\"[media] dw2102: limit messages to buffer size\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b38178b4-209b-4950-97d6-2b888c8f7e27",
      "id": "CVE-2023-53164",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe\n\nof_irq_find_parent() returns a node pointer with refcount incremented,\nWe should use of_node_put() on it when not needed anymore.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "79214d57-5785-4bab-af5e-7e247c7e104a",
      "id": "CVE-2023-53182",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid undefined behavior: applying zero offset to null pointer\n\nACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e\n\nBefore this change we see the following UBSAN stack trace in Fuchsia:\n\n  #0    0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 \u003cplatform-bus-x86.so\u003e+0x233302\n  #1.2  0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 \u003clibclang_rt.asan.so\u003e+0x3d77f\n  #1.1  0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 \u003clibclang_rt.asan.so\u003e+0x3d77f\n  #1    0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 \u003clibclang_rt.asan.so\u003e+0x3d77f\n  #2    0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 \u003clibclang_rt.asan.so\u003e+0x4196d\n  #3    0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 \u003clibclang_rt.asan.so\u003e+0x4150d\n  #4    0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 \u003cplatform-bus-x86.so\u003e+0x233302\n  #5    0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 \u003cplatform-bus-x86.so\u003e+0x262369\n  #6    0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 \u003cplatform-bus-x86.so\u003e+0x2b7fac\n  #7    0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 \u003cplatform-bus-x86.so\u003e+0x2c64d2\n  #8    0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 \u003cplatform-bus-x86.so\u003e+0x22a052\n  #9    0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 \u003cplatform-bus-x86.so\u003e+0x293dd8\n  #10   0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 \u003cplatform-bus-x86.so\u003e+0x2a9e98\n  #11   0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 \u003cplatform-bus-x86.so\u003e+0x2931ac\n  #12   0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 \u003cplatform-bus-x86.so\u003e+0x2fc40d\n  #13   0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 \u003cplatform-bus-x86.so\u003e+0xed603\n\nAdd a simple check that avoids incrementing a pointer by zero, but\notherwise behaves as before. Note that our findings are against ACPICA\n20221020, but the same code exists on master.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6b9aaf8-12c8-49bb-8c9a-1b65bb62e951",
      "id": "CVE-2023-53200",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix percpu counter block leak on error path when creating new netns\n\nHere is the stack where we allocate percpu counter block:\n\n  +-\u003c __alloc_percpu\n    +-\u003c xt_percpu_counter_alloc\n      +-\u003c find_check_entry # {arp,ip,ip6}_tables.c\n        +-\u003c translate_table\n\nAnd it can be leaked on this code path:\n\n  +-\u003e ip6t_register_table\n    +-\u003e translate_table # allocates percpu counter block\n    +-\u003e xt_register_table # fails\n\nthere is no freeing of the counter block on xt_register_table fail.\nNote: xt_percpu_counter_free should be called to free it like we do in\ndo_replace through cleanup_entry helper (or in __ip6t_unregister_table).\n\nProbability of hitting this error path is low AFAICS (xt_register_table\ncan only return ENOMEM here, as it is not replacing anything, as we are\ncreating new netns, and it is hard to imagine that all previous\nallocations succeeded and after that one in xt_register_table failed).\nBut it's worth fixing even the rare leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dfb1778d-8937-40af-a916-4045021b2bb2",
      "id": "CVE-2023-53288",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Fix memory leak in drm_client_modeset_probe\n\nWhen a new mode is set to modeset-\u003emode, the previous mode should be freed.\nThis fixes the following kmemleak report:\n\ndrm_mode_duplicate+0x45/0x220 [drm]\ndrm_client_modeset_probe+0x944/0xf50 [drm]\n__drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper]\ndrm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper]\ndrm_client_register+0x169/0x240 [drm]\nast_pci_probe+0x142/0x190 [ast]\nlocal_pci_probe+0xdc/0x180\nwork_for_cpu_fn+0x4e/0xa0\nprocess_one_work+0x8b7/0x1540\nworker_thread+0x70a/0xed0\nkthread+0x29f/0x340\nret_from_fork+0x1f/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3cf4bd10-c1e5-44f3-b92a-76e918efe139",
      "id": "CVE-2023-53333",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one\n\nEric Dumazet says:\n  nf_conntrack_dccp_packet() has an unique:\n\n  dh = skb_header_pointer(skb, dataoff, sizeof(_dh), \u0026_dh);\n\n  And nothing more is 'pulled' from the packet, depending on the content.\n  dh-\u003edccph_doff, and/or dh-\u003edccph_x ...)\n  So dccp_ack_seq() is happily reading stuff past the _dh buffer.\n\nBUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0\nRead of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371\n[..]\n\nFix this by increasing the stack buffer to also include room for\nthe extra sequence numbers and all the known dccp packet type headers,\nthen pull again after the initial validation of the basic header.\n\nWhile at it, mark packets invalid that lack 48bit sequence bit but\nwhere RFC says the type MUST use them.\n\nCompile tested only.\n\nv2: first skb_header_pointer() now needs to adjust the size to\n    only pull the generic header. (Eric)\n\nHeads-up: I intend to remove dccp conntrack support later this year.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b8a46300-58f5-413f-949a-966961e4239e",
      "id": "CVE-2023-53353",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()\n\nThe memory manager IDR is currently destroyed when user releases the\nfile descriptor.\nHowever, at this point the user context might be still held, and memory\nbuffers might be still in use.\nLater on, calls to release those buffers will fail due to not finding\ntheir handles in the IDR, leading to a memory leak.\nTo avoid this leak, split the IDR destruction from the memory manager\nfini, and postpone it to hpriv_release() when there is no user context\nand no buffers are used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f132892a-ecca-42d4-8f77-a4305ce50ad1",
      "id": "CVE-2023-53440",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix sysfs interface lifetime\n\nThe current nilfs2 sysfs support has issues with the timing of creation\nand deletion of sysfs entries, potentially leading to null pointer\ndereferences, use-after-free, and lockdep warnings.\n\nSome of the sysfs attributes for nilfs2 per-filesystem instance refer to\nmetadata file \"cpfile\", \"sufile\", or \"dat\", but\nnilfs_sysfs_create_device_group that creates those attributes is executed\nbefore the inodes for these metadata files are loaded, and\nnilfs_sysfs_delete_device_group which deletes these sysfs entries is\ncalled after releasing their metadata file inodes.\n\nTherefore, access to some of these sysfs attributes may occur outside of\nthe lifetime of these metadata files, resulting in inode NULL pointer\ndereferences or use-after-free.\n\nIn addition, the call to nilfs_sysfs_create_device_group() is made during\nthe locking period of the semaphore \"ns_sem\" of nilfs object, so the\nshrinker call caused by the memory allocation for the sysfs entries, may\nderive lock dependencies \"ns_sem\" -\u003e (shrinker) -\u003e \"locks acquired in\nnilfs_evict_inode()\".\n\nSince nilfs2 may acquire \"ns_sem\" deep in the call stack holding other\nlocks via its error handler __nilfs_error(), this causes lockdep to report\ncircular locking.  This is a false positive and no circular locking\nactually occurs as no inodes exist yet when\nnilfs_sysfs_create_device_group() is called.  Fortunately, the lockdep\nwarnings can be resolved by simply moving the call to\nnilfs_sysfs_create_device_group() out of \"ns_sem\".\n\nThis fixes these sysfs issues by revising where the device's sysfs\ninterface is created/deleted and keeping its lifetime within the lifetime\nof the metadata files above.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "487ebb34-7f35-4cb6-9eed-a0c06d0c9f1a",
      "id": "CVE-2024-26706",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix random data corruption from exception handler\n\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\n\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\n\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\n\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4115eb6-6fac-4ca7-b024-13f0c8062d93",
      "id": "CVE-2024-26726",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't drop extent_map for free space inode on write error\n\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\n\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n \u003cTASK\u003e\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\n\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\n\nSince we're deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\n\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e013d1ac-c009-4115-9feb-978151a86920",
      "id": "CVE-2023-53447",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: don't reset unchangable mount option in f2fs_remount()\n\nsyzbot reports a bug as below:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT SMP KASAN\nRIP: 0010:__lock_acquire+0x69/0x2000 kernel/locking/lockdep.c:4942\nCall Trace:\n lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5691\n __raw_write_lock include/linux/rwlock_api_smp.h:209 [inline]\n _raw_write_lock+0x2e/0x40 kernel/locking/spinlock.c:300\n __drop_extent_tree+0x3ac/0x660 fs/f2fs/extent_cache.c:1100\n f2fs_drop_extent_tree+0x17/0x30 fs/f2fs/extent_cache.c:1116\n f2fs_insert_range+0x2d5/0x3c0 fs/f2fs/file.c:1664\n f2fs_fallocate+0x4e4/0x6d0 fs/f2fs/file.c:1838\n vfs_fallocate+0x54b/0x6b0 fs/open.c:324\n ksys_fallocate fs/open.c:347 [inline]\n __do_sys_fallocate fs/open.c:355 [inline]\n __se_sys_fallocate fs/open.c:353 [inline]\n __x64_sys_fallocate+0xbd/0x100 fs/open.c:353\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe root cause is race condition as below:\n- since it tries to remount rw filesystem, so that do_remount won't\ncall sb_prepare_remount_readonly to block fallocate, there may be race\ncondition in between remount and fallocate.\n- in f2fs_remount(), default_options() will reset mount option to default\none, and then update it based on result of parse_options(), so there is\na hole which race condition can happen.\n\nThread A\t\t\tThread B\n- f2fs_fill_super\n - parse_options\n  - clear_opt(READ_EXTENT_CACHE)\n\n- f2fs_remount\n - default_options\n  - set_opt(READ_EXTENT_CACHE)\n\t\t\t\t- f2fs_fallocate\n\t\t\t\t - f2fs_insert_range\n\t\t\t\t  - f2fs_drop_extent_tree\n\t\t\t\t   - __drop_extent_tree\n\t\t\t\t    - __may_extent_tree\n\t\t\t\t     - test_opt(READ_EXTENT_CACHE) return true\n\t\t\t\t    - write_lock(\u0026et-\u003elock) access NULL pointer\n - parse_options\n  - clear_opt(READ_EXTENT_CACHE)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dd3d37e-c052-4938-a1cc-d67072a9098c",
      "id": "CVE-2024-26839",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix a memleak in init_credit_return\n\nWhen dma_alloc_coherent fails to allocate dd-\u003ecr_base[i].va,\ninit_credit_return should deallocate dd-\u003ecr_base and\ndd-\u003ecr_base[i] that allocated before. Or those resources\nwould be never freed and a memleak is triggered.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d32731a3-9f22-4b34-97d4-f1e3a9ce666f",
      "id": "CVE-2024-26934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Fix deadlock in usb_deauthorize_interface()\n\nAmong the attribute file callback routines in\ndrivers/usb/core/sysfs.c, the interface_authorized_store() function is\nthe only one which acquires a device lock on an ancestor device: It\ncalls usb_deauthorize_interface(), which locks the interface's parent\nUSB device.\n\nThe will lead to deadlock if another process already owns that lock\nand tries to remove the interface, whether through a configuration\nchange or because the device has been disconnected.  As part of the\nremoval procedure, device_del() waits for all ongoing sysfs attribute\ncallbacks to complete.  But usb_deauthorize_interface() can't complete\nuntil the device lock has been released, and the lock won't be\nreleased until the removal has finished.\n\nThe mechanism provided by sysfs to prevent this kind of deadlock is\nto use the sysfs_break_active_protection() function, which tells sysfs\nnot to wait for the attribute callback.\n\nReported-and-tested by: Yue Sun \u003csamsun1006219@gmail.com\u003e\nReported by: xingwei lee \u003cxrivendell7@gmail.com\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e56f789-b105-4baf-a4e9-054b8b4b1a0c",
      "id": "CVE-2024-26999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial/pmac_zilog: Remove flawed mitigation for rx irq flood\n\nThe mitigation was intended to stop the irq completely. That may be\nbetter than a hard lock-up but it turns out that you get a crash anyway\nif you're using pmac_zilog as a serial console:\n\nttyPZ0: pmz: rx irq flood !\nBUG: spinlock recursion on CPU#0, swapper/0\n\nThat's because the pr_err() call in pmz_receive_chars() results in\npmz_console_write() attempting to lock a spinlock already locked in\npmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal\nBUG splat. The spinlock in question is the one in struct uart_port.\n\nEven when it's not fatal, the serial port rx function ceases to work.\nAlso, the iteration limit doesn't play nicely with QEMU, as can be\nseen in the bug report linked below.\n\nA web search for other reports of the error message \"pmz: rx irq flood\"\ndidn't produce anything. So I don't think this code is needed any more.\nRemove it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "365c179e-8d29-4c04-ac26-a4d0d6c4e3e8",
      "id": "CVE-2024-27417",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix potential \"struct net\" leak in inet6_rtm_getaddr()\n\nIt seems that if userspace provides a correct IFA_TARGET_NETNSID value\nbut no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr()\nreturns -EINVAL with an elevated \"struct net\" refcount.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c3e03500-2d1e-499f-9151-e68ec0f120fe",
      "id": "CVE-2024-36902",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()\n\nsyzbot is able to trigger the following crash [1],\ncaused by unsafe ip6_dst_idev() use.\n\nIndeed ip6_dst_idev() can return NULL, and must always be checked.\n\n[1]\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]\n RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267\nCode: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 \u003c42\u003e 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c\nRSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700\nRDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760\nRBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd\nR10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000\nR13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00\nFS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317\n  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108\n  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]\n  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120\n  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250\n  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326\n  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455\n  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662\n  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099\n  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40626d74-6cbc-4654-82f1-38fe81a44598",
      "id": "CVE-2024-36978",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: sch_multiq: fix possible OOB write in multiq_tune()\n\nq-\u003ebands will be assigned to qopt-\u003ebands to execute subsequent code logic\nafter kmalloc. So the old q-\u003ebands should not be used in kmalloc.\nOtherwise, an out-of-bounds write will occur.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "503260ad-ac9d-43c2-ae3d-fb7017f2340e",
      "id": "CVE-2024-38579",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: bcm - Fix pointer arithmetic\n\nIn spu2_dump_omd() value of ptr is increased by ciph_key_len\ninstead of hash_iv_len which could lead to going beyond the\nbuffer boundaries.\nFix this bug by changing ciph_key_len to hash_iv_len.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49076694-32c0-41de-84cf-d29cc2e276f0",
      "id": "CVE-2024-38607",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh/via-macii: Fix \"BUG: sleeping function called from invalid context\"\n\nThe via-macii ADB driver calls request_irq() after disabling hard\ninterrupts. But disabling interrupts isn't necessary here because the\nVIA shift register interrupt was masked during VIA1 initialization.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b45db516-d9a9-4c6c-a078-e2156e1c4f20",
      "id": "CVE-2024-39487",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()\n\nIn function bond_option_arp_ip_targets_set(), if newval-\u003estring is an\nempty string, newval-\u003estring+1 will point to the byte after the\nstring, causing an out-of-bound read.\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418\nRead of size 1 at addr ffff8881119c4781 by task syz-executor665/8107\nCPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:364 [inline]\n print_report+0xc1/0x5e0 mm/kasan/report.c:475\n kasan_report+0xbe/0xf0 mm/kasan/report.c:588\n strlen+0x7d/0xa0 lib/string.c:418\n __fortify_strlen include/linux/fortify-string.h:210 [inline]\n in4_pton+0xa3/0x3f0 net/core/utils.c:130\n bond_option_arp_ip_targets_set+0xc2/0x910\ndrivers/net/bonding/bond_options.c:1201\n __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767\n __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792\n bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817\n bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156\n dev_attr_store+0x54/0x80 drivers/base/core.c:2366\n sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136\n kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334\n call_write_iter include/linux/fs.h:2020 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x96a/0xd80 fs/read_write.c:584\n ksys_write+0x122/0x250 fs/read_write.c:637\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n---[ end trace ]---\n\nFix it by adding a check of string length before using it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2fe03262-1663-44ac-8bb8-32061aa46380",
      "id": "CVE-2024-41011",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: don't allow mapping the MMIO HDP page with large pages\n\nWe don't get the right offset in that case.  The GPU has\nan unused 4K area of the register BAR space into which you can\nremap registers.  We remap the HDP flush registers into this\nspace to allow userspace (CPU or GPU) to flush the HDP when it\nupdates VRAM.  However, on systems with \u003e4K pages, we end up\nexposing PAGE_SIZE of MMIO space.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e44ef83d-a017-4bf2-9e59-e9ea699a157e",
      "id": "CVE-2024-41046",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: lantiq_etop: fix double free in detach\n\nThe number of the currently released descriptor is never incremented\nwhich results in the same skb being released multiple times.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "32c39f1c-70d6-4a45-b30f-e7eab36e8669",
      "id": "CVE-2024-42145",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/core: Implement a limit on UMAD receive List\n\nThe existing behavior of ib_umad, which maintains received MAD\npackets in an unbounded list, poses a risk of uncontrolled growth.\nAs user-space applications extract packets from this list, the rate\nof extraction may not match the rate of incoming packets, leading\nto potential list overflow.\n\nTo address this, we introduce a limit to the size of the list. After\nconsidering typical scenarios, such as OpenSM processing, which can\nhandle approximately 100k packets per second, and the 1-second retry\ntimeout for most packets, we set the list size limit to 200k. Packets\nreceived beyond this limit are dropped, assuming they are likely timed\nout by the time they are handled by user-space.\n\nNotably, packets queued on the receive list due to reasons like\ntimed-out sends are preserved even when the list is full.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8017673f-6243-4407-be3b-09b3e2ff91ef",
      "id": "CVE-2024-42281",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a segment issue when downgrading gso_size\n\nLinearize the skb when downgrading gso_size because it may trigger a\nBUG_ON() later when the skb is segmented as described in [1,2].",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1410bb82-212c-4590-a4bd-0517bd07c914",
      "id": "CVE-2024-42301",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndev/parport: fix the array out-of-bounds risk\n\nFixed array out-of-bounds issues caused by sprintf\nby replacing it with snprintf for safer data copying,\nensuring the destination buffer is not overflowed.\n\nBelow is the stack trace I encountered during the actual issue:\n\n[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:\nKernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]\n[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:\nQThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2\n[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp\n[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun\nPGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024\n[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:\n[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0\n[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20\n[ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c\n[ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc\n[ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38\n[ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51f6080f-aaff-484d-abc0-5617654d20de",
      "id": "CVE-2024-46714",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip wbscl_set_scaler_filter if filter is null\n\nCallers can pass null in filter (i.e. from returned from the function\nwbscl_get_filter_coeffs_16p) and a null check is added to ensure that is\nnot the case.\n\nThis fixes 4 NULL_RETURNS issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3498fb9a-f0fe-46d3-95db-245bfdc9dc8f",
      "id": "CVE-2024-46716",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor\n\nRemove list_del call in msgdma_chan_desc_cleanup, this should be the role\nof msgdma_free_descriptor. In consequence replace list_add_tail with\nlist_move_tail in msgdma_free_descriptor.\n\nThis fixes the path:\n   msgdma_free_chan_resources -\u003e msgdma_free_descriptors -\u003e\n   msgdma_free_desc_list -\u003e msgdma_free_descriptor\n\nwhich does not correctly free the descriptors as first nodes were not\nremoved from the list.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c45278aa-2fa8-470e-b117-5437ed11786a",
      "id": "CVE-2024-47143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: fix a possible deadlock on radix_lock\n\nradix_lock() shouldn't be held while holding dma_hash_entry[idx].lock\notherwise, there's a possible deadlock scenario when\ndma debug API is called holding rq_lock():\n\nCPU0                   CPU1                       CPU2\ndma_free_attrs()\ncheck_unmap()          add_dma_entry()            __schedule() //out\n                                                  (A) rq_lock()\nget_hash_bucket()\n(A) dma_entry_hash\n                                                  check_sync()\n                       (A) radix_lock()           (W) dma_entry_hash\ndma_entry_free()\n(W) radix_lock()\n                       // CPU2's one\n                       (W) rq_lock()\n\nCPU1 situation can happen when it extending radix tree and\nit tries to wake up kswapd via wake_all_kswapd().\n\nCPU2 situation can happen while perf_event_task_sched_out()\n(i.e. dma sync operation is called while deleting perf_event using\n etm and etr tmc which are Arm Coresight hwtracing driver backends).\n\nTo remove this possible situation, call dma_entry_free() after\nput_hash_bucket() in check_unmap().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "51de8cb2-2545-4b86-a134-a9d8fa97b3f5",
      "id": "CVE-2024-47707",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()\n\nBlamed commit accidentally removed a check for rt-\u003ert6i_idev being NULL,\nas spotted by syzbot:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 UID: 0 PID: 10998 Comm: syz-executor Not tainted 6.11.0-rc6-syzkaller-00208-g625403177711 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\n RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]\n RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914\nCode: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df \u003c80\u003e 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06\nRSP: 0018:ffffc900047374e0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0\nRBP: ffffc900047375d0 R08: 0000000000000003 R09: fffff520008e6e8c\nR10: dffffc0000000000 R11: fffff520008e6e8c R12: 1ffff1100fdf8f18\nR13: ffff88807efc7998 R14: 0000000000000000 R15: ffff88807efc7930\nFS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020002a80 CR3: 0000000022f62000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  addrconf_ifdown+0x15d/0x1bd0 net/ipv6/addrconf.c:3856\n addrconf_notify+0x3cb/0x1020\n  notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n  call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]\n  call_netdevice_notifiers net/core/dev.c:2046 [inline]\n  unregister_netdevice_many_notify+0xd81/0x1c40 net/core/dev.c:11352\n  unregister_netdevice_many net/core/dev.c:11414 [inline]\n  unregister_netdevice_queue+0x303/0x370 net/core/dev.c:11289\n  unregister_netdevice include/linux/netdevice.h:3129 [inline]\n  __tun_detach+0x6b9/0x1600 drivers/net/tun.c:685\n  tun_detach drivers/net/tun.c:701 [inline]\n  tun_chr_close+0x108/0x1b0 drivers/net/tun.c:3510\n  __fput+0x24a/0x8a0 fs/file_table.c:422\n  task_work_run+0x24f/0x310 kernel/task_work.c:228\n  exit_task_work include/linux/task_work.h:40 [inline]\n  do_exit+0xa2f/0x27f0 kernel/exit.c:882\n  do_group_exit+0x207/0x2c0 kernel/exit.c:1031\n  __do_sys_exit_group kernel/exit.c:1042 [inline]\n  __se_sys_exit_group kernel/exit.c:1040 [inline]\n  __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040\n  x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f1acc77def9\nCode: Unable to access opcode bytes at 0x7f1acc77decf.\nRSP: 002b:00007ffeb26fa738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1acc77def9\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043\nRBP: 00007f1acc7dd508 R08: 00007ffeb26f84d7 R09: 0000000000000003\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 0000000000000003 R14: 00000000ffffffff R15: 00007ffeb26fa8e0\n \u003c/TASK\u003e\nModules linked in:\n---[ end trace 0000000000000000 ]---\n RIP: 0010:rt6_uncached_list_flush_dev net/ipv6/route.c:177 [inline]\n RIP: 0010:rt6_disable_ip+0x33e/0x7e0 net/ipv6/route.c:4914\nCode: 41 80 3c 04 00 74 0a e8 90 d0 9b f7 48 8b 7c 24 08 48 8b 07 48 89 44 24 10 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df \u003c80\u003e 3c 08 00 74 08 4c 89 f7 e8 64 d0 9b f7 48 8b 44 24 18 49 39 06\nRSP: 0018:ffffc900047374e0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 1ffff1100fdf8f33 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88807efc78c0\nR\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "269c1eeb-6b41-4f0d-9006-f2614301b9ab",
      "id": "CVE-2024-49896",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream before comparing them\n\n[WHAT \u0026 HOW]\namdgpu_dm can pass a null stream to dc_is_stream_unchanged. It is\nnecessary to check for null before dereferencing them.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ee764bd-b87e-40fd-b3a4-5a936a9e5104",
      "id": "CVE-2024-53210",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()\n\nPassing MSG_PEEK flag to skb_recv_datagram() increments skb refcount\n(skb-\u003eusers) and iucv_sock_recvmsg() does not decrement skb refcount\nat exit.\nThis results in skb memory leak in skb_queue_purge() and WARN_ON in\niucv_sock_destruct() during socket close. To fix this decrease\nskb refcount by one if MSG_PEEK is set in order to prevent memory\nleak and WARN_ON.\n\nWARNING: CPU: 2 PID: 6292 at net/iucv/af_iucv.c:286 iucv_sock_destruct+0x144/0x1a0 [af_iucv]\nCPU: 2 PID: 6292 Comm: afiucv_test_msg Kdump: loaded Tainted: G        W          6.10.0-rc7 #1\nHardware name: IBM 3931 A01 704 (z/VM 7.3.0)\nCall Trace:\n        [\u003c001587c682c4aa98\u003e] iucv_sock_destruct+0x148/0x1a0 [af_iucv]\n        [\u003c001587c682c4a9d0\u003e] iucv_sock_destruct+0x80/0x1a0 [af_iucv]\n        [\u003c001587c704117a32\u003e] __sk_destruct+0x52/0x550\n        [\u003c001587c704104a54\u003e] __sock_release+0xa4/0x230\n        [\u003c001587c704104c0c\u003e] sock_close+0x2c/0x40\n        [\u003c001587c702c5f5a8\u003e] __fput+0x2e8/0x970\n        [\u003c001587c7024148c4\u003e] task_work_run+0x1c4/0x2c0\n        [\u003c001587c7023b0716\u003e] do_exit+0x996/0x1050\n        [\u003c001587c7023b13aa\u003e] do_group_exit+0x13a/0x360\n        [\u003c001587c7023b1626\u003e] __s390x_sys_exit_group+0x56/0x60\n        [\u003c001587c7022bccca\u003e] do_syscall+0x27a/0x380\n        [\u003c001587c7049a6a0c\u003e] __do_syscall+0x9c/0x160\n        [\u003c001587c7049ce8a8\u003e] system_call+0x70/0x98\n        Last Breaking-Event-Address:\n        [\u003c001587c682c4a9d4\u003e] iucv_sock_destruct+0x84/0x1a0 [af_iucv]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5a25684a-6e7e-47d8-aead-2dc196d899d3",
      "id": "CVE-2024-49945",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: Disable the ncsi work before freeing the associated structure\n\nThe work function can run after the ncsi device is freed, resulting\nin use-after-free bugs or kernel panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d974f62c-3548-4694-ac53-0a46a8190d6b",
      "id": "CVE-2024-43906",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/admgpu: fix dereferencing null pointer context\n\nWhen user space sets an invalid ta type, the pointer context will be empty.\nSo it need to check the pointer context before using it",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e686486b-3b63-4396-9dc1-db45602a4469",
      "id": "CVE-2024-50004",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35\n\n[WHY \u0026 HOW]\nMismatch in DCN35 DML2 cause bw validation failed to acquire unexpected DPP pipe to cause\ngrey screen and system hang. Remove EnhancedPrefetchScheduleAccelerationFinal value override\nto match HW spec.\n\n(cherry picked from commit 9dad21f910fcea2bdcff4af46159101d7f9cd8ba)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28400acd-6ffc-4f85-9a0b-25a0b6ae6c3a",
      "id": "CVE-2024-50134",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA\n\nReplace the fake VLA at end of the vbva_mouse_pointer_shape shape with\na real VLA to fix a \"memcpy: detected field-spanning write error\" warning:\n\n[   13.319813] memcpy: detected field-spanning write (size 16896) of single field \"p-\u003edata\" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4)\n[   13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo]\n[   13.320038] Call Trace:\n[   13.320173]  hgsmi_update_pointer_shape [vboxvideo]\n[   13.320184]  vbox_cursor_atomic_update [vboxvideo]\n\nNote as mentioned in the added comment it seems the original length\ncalculation for the allocated and send hgsmi buffer is 4 bytes too large.\nChanging this is not the goal of this patch, so this behavior is kept.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56cfd889-7d89-435c-a3eb-9777a756c0c4",
      "id": "CVE-2024-50286",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-use-after-free in ksmbd_smb2_session_create\n\nThere is a race condition between ksmbd_smb2_session_create and\nksmbd_expire_session. This patch add missing sessions_table_lock\nwhile adding/deleting session from global session table.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "81206548-d789-4eb2-a5d4-ab53438f2651",
      "id": "CVE-2024-53099",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check validity of link-\u003etype in bpf_link_show_fdinfo()\n\nIf a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing\nbpf_link_type_strs[link-\u003etype] may result in an out-of-bounds access.\n\nTo spot such missed invocations early in the future, checking the\nvalidity of link-\u003etype in bpf_link_show_fdinfo() and emitting a warning\nwhen such invocations are missed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f201093-3c88-47c7-9f1a-932e9077c583",
      "id": "CVE-2024-53177",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: prevent use-after-free due to open_cached_dir error paths\n\nIf open_cached_dir() encounters an error parsing the lease from the\nserver, the error handling may race with receiving a lease break,\nresulting in open_cached_dir() freeing the cfid while the queued work is\npending.\n\nUpdate open_cached_dir() to drop refs rather than directly freeing the\ncfid.\n\nHave cached_dir_lease_break(), cfids_laundromat_worker(), and\ninvalidate_all_cached_dirs() clear has_lease immediately while still\nholding cfids-\u003ecfid_list_lock, and then use this to also simplify the\nreference counting in cfids_laundromat_worker() and\ninvalidate_all_cached_dirs().\n\nFixes this KASAN splat (which manually injects an error and lease break\nin open_cached_dir()):\n\n==================================================================\nBUG: KASAN: slab-use-after-free in smb2_cached_lease_break+0x27/0xb0\nRead of size 8 at addr ffff88811cc24c10 by task kworker/3:1/65\n\nCPU: 3 UID: 0 PID: 65 Comm: kworker/3:1 Not tainted 6.12.0-rc6-g255cf264e6e5-dirty #87\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\nWorkqueue: cifsiod smb2_cached_lease_break\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x77/0xb0\n print_report+0xce/0x660\n kasan_report+0xd3/0x110\n smb2_cached_lease_break+0x27/0xb0\n process_one_work+0x50a/0xc50\n worker_thread+0x2ba/0x530\n kthread+0x17c/0x1c0\n ret_from_fork+0x34/0x60\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 2464:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n open_cached_dir+0xa7d/0x1fb0\n smb2_query_path_info+0x43c/0x6e0\n cifs_get_fattr+0x346/0xf10\n cifs_get_inode_info+0x157/0x210\n cifs_revalidate_dentry_attr+0x2d1/0x460\n cifs_getattr+0x173/0x470\n vfs_statx_path+0x10f/0x160\n vfs_statx+0xe9/0x150\n vfs_fstatat+0x5e/0xc0\n __do_sys_newfstatat+0x91/0xf0\n do_syscall_64+0x95/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 2464:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x51/0x70\n kfree+0x174/0x520\n open_cached_dir+0x97f/0x1fb0\n smb2_query_path_info+0x43c/0x6e0\n cifs_get_fattr+0x346/0xf10\n cifs_get_inode_info+0x157/0x210\n cifs_revalidate_dentry_attr+0x2d1/0x460\n cifs_getattr+0x173/0x470\n vfs_statx_path+0x10f/0x160\n vfs_statx+0xe9/0x150\n vfs_fstatat+0x5e/0xc0\n __do_sys_newfstatat+0x91/0xf0\n do_syscall_64+0x95/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nLast potentially related work creation:\n kasan_save_stack+0x33/0x60\n __kasan_record_aux_stack+0xad/0xc0\n insert_work+0x32/0x100\n __queue_work+0x5c9/0x870\n queue_work_on+0x82/0x90\n open_cached_dir+0x1369/0x1fb0\n smb2_query_path_info+0x43c/0x6e0\n cifs_get_fattr+0x346/0xf10\n cifs_get_inode_info+0x157/0x210\n cifs_revalidate_dentry_attr+0x2d1/0x460\n cifs_getattr+0x173/0x470\n vfs_statx_path+0x10f/0x160\n vfs_statx+0xe9/0x150\n vfs_fstatat+0x5e/0xc0\n __do_sys_newfstatat+0x91/0xf0\n do_syscall_64+0x95/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe buggy address belongs to the object at ffff88811cc24c00\n which belongs to the cache kmalloc-1k of size 1024\nThe buggy address is located 16 bytes inside of\n freed 1024-byte region [ffff88811cc24c00, ffff88811cc25000)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5901db6d-d444-41aa-9439-3d02a987cbcc",
      "id": "CVE-2024-56568",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Defer probe of clients after smmu device bound\n\nNull pointer dereference occurs due to a race between smmu\ndriver probe and client driver probe, when of_dma_configure()\nfor client is called after the iommu_device_register() for smmu driver\nprobe has executed but before the driver_bound() for smmu driver\nhas been called.\n\nFollowing is how the race occurs:\n\nT1:Smmu device probe\t\tT2: Client device probe\n\nreally_probe()\narm_smmu_device_probe()\niommu_device_register()\n\t\t\t\t\treally_probe()\n\t\t\t\t\tplatform_dma_configure()\n\t\t\t\t\tof_dma_configure()\n\t\t\t\t\tof_dma_configure_id()\n\t\t\t\t\tof_iommu_configure()\n\t\t\t\t\tiommu_probe_device()\n\t\t\t\t\tiommu_init_device()\n\t\t\t\t\tarm_smmu_probe_device()\n\t\t\t\t\tarm_smmu_get_by_fwnode()\n\t\t\t\t\t\tdriver_find_device_by_fwnode()\n\t\t\t\t\t\tdriver_find_device()\n\t\t\t\t\t\tnext_device()\n\t\t\t\t\t\tklist_next()\n\t\t\t\t\t\t    /* null ptr\n\t\t\t\t\t\t       assigned to smmu */\n\t\t\t\t\t/* null ptr dereference\n\t\t\t\t\t   while smmu-\u003estreamid_mask */\ndriver_bound()\n\tklist_add_tail()\n\nWhen this null smmu pointer is dereferenced later in\narm_smmu_probe_device, the device crashes.\n\nFix this by deferring the probe of the client device\nuntil the smmu device has bound to the arm smmu driver.\n\n[will: Add comment]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47b5721e-c06f-43c8-bac6-2d03ec3e6059",
      "id": "CVE-2024-56588",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Create all dump files during debugfs initialization\n\nFor the current debugfs of hisi_sas, after user triggers dump, the\ndriver allocate memory space to save the register information and create\ndebugfs files to display the saved information. In this process, the\ndebugfs files created after each dump.\n\nTherefore, when the dump is triggered while the driver is unbind, the\nfollowing hang occurs:\n\n[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0\n[67840.862947] Mem abort info:\n[67840.865855]   ESR = 0x0000000096000004\n[67840.869713]   EC = 0x25: DABT (current EL), IL = 32 bits\n[67840.875125]   SET = 0, FnV = 0\n[67840.878291]   EA = 0, S1PTW = 0\n[67840.881545]   FSC = 0x04: level 0 translation fault\n[67840.886528] Data abort info:\n[67840.889524]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[67840.895117]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[67840.900284]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000\n[67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000\n[67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[67841.003628] pc : down_write+0x30/0x98\n[67841.007546] lr : start_creating.part.0+0x60/0x198\n[67841.012495] sp : ffff8000b979ba20\n[67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40\n[67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8\n[67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18\n[67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020\n[67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff\n[67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18\n[67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18\n[67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9\n[67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001\n[67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0\n[67841.089759] Call trace:\n[67841.092456]  down_write+0x30/0x98\n[67841.096017]  start_creating.part.0+0x60/0x198\n[67841.100613]  debugfs_create_dir+0x48/0x1f8\n[67841.104950]  debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw]\n[67841.111447]  debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw]\n[67841.118111]  debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw]\n[67841.125115]  full_proxy_write+0x68/0xc8\n[67841.129175]  vfs_write+0xd8/0x3f0\n[67841.132708]  ksys_write+0x70/0x108\n[67841.136317]  __arm64_sys_write+0x24/0x38\n[67841.140440]  invoke_syscall+0x50/0x128\n[67841.144385]  el0_svc_common.constprop.0+0xc8/0xf0\n[67841.149273]  do_el0_svc+0x24/0x38\n[67841.152773]  el0_svc+0x38/0xd8\n[67841.156009]  el0t_64_sync_handler+0xc0/0xc8\n[67841.160361]  el0t_64_sync+0x1a4/0x1a8\n[67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05)\n[67841.170443] ---[ end trace 0000000000000000 ]---\n\nTo fix this issue, create all directories and files during debugfs\ninitialization. In this way, the driver only needs to allocate memory\nspace to save information each time the user triggers dumping.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cff9e137-998e-4ec2-a0d9-52e5e60cce2a",
      "id": "CVE-2024-56596",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in jfs_readdir\n\nThe stbl might contain some invalid values. Added a check to\nreturn error code in that case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bc2e59eb-4498-47fc-8e00-29329af6f8bc",
      "id": "CVE-2024-56633",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg\n\nThe current sk memory accounting logic in __SK_REDIRECT is pre-uncharging\ntosend bytes, which is either msg-\u003esg.size or a smaller value apply_bytes.\n\nPotential problems with this strategy are as follows:\n\n- If the actual sent bytes are smaller than tosend, we need to charge some\n  bytes back, as in line 487, which is okay but seems not clean.\n\n- When tosend is set to apply_bytes, as in line 417, and (ret \u003c 0), we may\n  miss uncharging (msg-\u003esg.size - apply_bytes) bytes.\n\n[...]\n415 tosend = msg-\u003esg.size;\n416 if (psock-\u003eapply_bytes \u0026\u0026 psock-\u003eapply_bytes \u003c tosend)\n417   tosend = psock-\u003eapply_bytes;\n[...]\n443 sk_msg_return(sk, msg, tosend);\n444 release_sock(sk);\n446 origsize = msg-\u003esg.size;\n447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress,\n448                             msg, tosend, flags);\n449 sent = origsize - msg-\u003esg.size;\n[...]\n454 lock_sock(sk);\n455 if (unlikely(ret \u003c 0)) {\n456   int free = sk_msg_free_nocharge(sk, msg);\n458   if (!cork)\n459     *copied -= free;\n460 }\n[...]\n487 if (eval == __SK_REDIRECT)\n488   sk_mem_charge(sk, tosend - sent);\n[...]\n\nWhen running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply,\nthe following warning will be reported:\n\n------------[ cut here ]------------\nWARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0\nModules linked in:\nCPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nWorkqueue: events sk_psock_destroy\nRIP: 0010:inet_sock_destruct+0x190/0x1a0\nRSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206\nRAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800\nRDX: 0000000000000303 RSI: 0000000000000011 RDI: ffff9aab4475b900\nRBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0\nR10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400\nR13: ffff9aab49c60598 R14: ffff9aab49c60598 R15: dead000000000100\nFS:  0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\n? __warn+0x89/0x130\n? inet_sock_destruct+0x190/0x1a0\n? report_bug+0xfc/0x1e0\n? handle_bug+0x5c/0xa0\n? exc_invalid_op+0x17/0x70\n? asm_exc_invalid_op+0x1a/0x20\n? inet_sock_destruct+0x190/0x1a0\n__sk_destruct+0x25/0x220\nsk_psock_destroy+0x2b2/0x310\nprocess_scheduled_works+0xa3/0x3e0\nworker_thread+0x117/0x240\n? __pfx_worker_thread+0x10/0x10\nkthread+0xcf/0x100\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x31/0x40\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1a/0x30\n\u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---\n\nIn __SK_REDIRECT, a more concise way is delaying the uncharging after sent\nbytes are finalized, and uncharge this value. When (ret \u003c 0), we shall\ninvoke sk_msg_free.\n\nSame thing happens in case __SK_DROP, when tosend is set to apply_bytes,\nwe may miss uncharging (msg-\u003esg.size - apply_bytes) bytes. The same\nwarning will be reported in selftest.\n\n[...]\n468 case __SK_DROP:\n469 default:\n470 sk_msg_free_partial(sk, msg, tosend);\n471 sk_msg_apply_bytes(psock, tosend);\n472 *copied -= (tosend + delta);\n473 return -EACCES;\n[...]\n\nSo instead of sk_msg_free_partial we can do sk_msg_free here.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a5dcdac-ea15-4a9a-9c81-84c5122a6af2",
      "id": "CVE-2024-56698",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix looping of queued SG entries\n\nThe dwc3_request-\u003enum_queued_sgs is decremented on completion. If a\npartially completed request is handled, then the\ndwc3_request-\u003enum_queued_sgs no longer reflects the total number of\nnum_queued_sgs (it would be cleared).\n\nCorrectly check the number of request SG entries remained to be prepare\nand queued. Failure to do this may cause null pointer dereference when\naccessing non-existent SG entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7081478e-fd84-46ea-83d3-d9413c73b9ca",
      "id": "CVE-2024-57950",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize denominator defaults to 1\n\n[WHAT \u0026 HOW]\nVariables, used as denominators and maybe not assigned to other values,\nshould be initialized to non-zero to avoid DIVIDE_BY_ZERO, as reported\nby Coverity.\n\n(cherry picked from commit e2c4c6c10542ccfe4a0830bb6c9fd5b177b7bbb7)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a4baf1f7-d655-45fe-9cae-8b76a01bd311",
      "id": "CVE-2025-38320",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()\n\nKASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth().\n\nCall Trace:\n[   97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8\n[   97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550\n[   97.285732]\n[   97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11\n[   97.287032] Hardware name: linux,dummy-virt (DT)\n[   97.287815] Call trace:\n[   97.288279]  dump_backtrace+0xa0/0x128\n[   97.288946]  show_stack+0x20/0x38\n[   97.289551]  dump_stack_lvl+0x78/0xc8\n[   97.290203]  print_address_description.constprop.0+0x84/0x3c8\n[   97.291159]  print_report+0xb0/0x280\n[   97.291792]  kasan_report+0x84/0xd0\n[   97.292421]  __asan_load8+0x9c/0xc0\n[   97.293042]  regs_get_kernel_stack_nth+0xa8/0xc8\n[   97.293835]  process_fetch_insn+0x770/0xa30\n[   97.294562]  kprobe_trace_func+0x254/0x3b0\n[   97.295271]  kprobe_dispatcher+0x98/0xe0\n[   97.295955]  kprobe_breakpoint_handler+0x1b0/0x210\n[   97.296774]  call_break_hook+0xc4/0x100\n[   97.297451]  brk_handler+0x24/0x78\n[   97.298073]  do_debug_exception+0xac/0x178\n[   97.298785]  el1_dbg+0x70/0x90\n[   97.299344]  el1h_64_sync_handler+0xcc/0xe8\n[   97.300066]  el1h_64_sync+0x78/0x80\n[   97.300699]  kernel_clone+0x0/0x500\n[   97.301331]  __arm64_sys_clone+0x70/0x90\n[   97.302084]  invoke_syscall+0x68/0x198\n[   97.302746]  el0_svc_common.constprop.0+0x11c/0x150\n[   97.303569]  do_el0_svc+0x38/0x50\n[   97.304164]  el0_svc+0x44/0x1d8\n[   97.304749]  el0t_64_sync_handler+0x100/0x130\n[   97.305500]  el0t_64_sync+0x188/0x190\n[   97.306151]\n[   97.306475] The buggy address belongs to stack of task 1.sh/2550\n[   97.307461]  and is located at offset 0 in frame:\n[   97.308257]  __se_sys_clone+0x0/0x138\n[   97.308910]\n[   97.309241] This frame has 1 object:\n[   97.309873]  [48, 184) 'args'\n[   97.309876]\n[   97.310749] The buggy address belongs to the virtual mapping at\n[   97.310749]  [ffff800089270000, ffff800089279000) created by:\n[   97.310749]  dup_task_struct+0xc0/0x2e8\n[   97.313347]\n[   97.313674] The buggy address belongs to the physical page:\n[   97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a\n[   97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff)\n[   97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000\n[   97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\n[   97.319445] page dumped because: kasan: bad access detected\n[   97.320371]\n[   97.320694] Memory state around the buggy address:\n[   97.321511]  ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   97.322681]  ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   97.323846] \u003effff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00\n[   97.325023]                          ^\n[   97.325683]  ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3\n[   97.326856]  ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\nThis issue seems to be related to the behavior of some gcc compilers and\nwas also fixed on the s390 architecture before:\n\n commit d93a855c31b7 (\"s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()\")\n\nAs described in that commit, regs_get_kernel_stack_nth() has confirmed that\n`addr` is on the stack, so reading the value at `*addr` should be allowed.\nUse READ_ONCE_NOCHECK() helper to silence the KASAN check for this case.\n\n[will: Use '*addr' as the argument to READ_ONCE_NOCHECK()]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "175ecf56-d5ef-4a89-add8-f90290ec4925",
      "id": "CVE-2024-58007",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: socinfo: Avoid out of bounds read of serial number\n\nOn MSM8916 devices, the serial number exposed in sysfs is constant and does\nnot change across individual devices. It's always:\n\n  db410c:/sys/devices/soc0$ cat serial_number\n  2644893864\n\nThe firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not\nhave support for the serial_num field in the socinfo struct. There is an\nexisting check to avoid exposing the serial number in that case, but it's\nnot correct: When checking the item_size returned by SMEM, we need to make\nsure the *end* of the serial_num is within bounds, instead of comparing\nwith the *start* offset. The serial_number currently exposed on MSM8916\ndevices is just an out of bounds read of whatever comes after the socinfo\nstruct in SMEM.\n\nFix this by changing offsetof() to offsetofend(), so that the size of the\nfield is also taken into account.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88101366-bf8a-4be2-b9ae-7b88a87f1bf7",
      "id": "CVE-2025-21934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix an API misues when rio_add_net() fails\n\nrio_add_net() calls device_register() and fails when device_register()\nfails.  Thus, put_device() should be used rather than kfree().  Add\n\"mport-\u003enet = NULL;\" to avoid a use after free issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c6836bc-b148-4dfc-a810-4deec21eb14e",
      "id": "CVE-2025-23147",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Add NULL pointer check in i3c_master_queue_ibi()\n\nThe I3C master driver may receive an IBI from a target device that has not\nbeen probed yet. In such cases, the master calls `i3c_master_queue_ibi()`\nto queue an IBI work task, leading to \"Unable to handle kernel read from\nunreadable memory\" and resulting in a kernel panic.\n\nTypical IBI handling flow:\n1. The I3C master scans target devices and probes their respective drivers.\n2. The target device driver calls `i3c_device_request_ibi()` to enable IBI\n   and assigns `dev-\u003eibi = ibi`.\n3. The I3C master receives an IBI from the target device and calls\n   `i3c_master_queue_ibi()` to queue the target device driver’s IBI\n   handler task.\n\nHowever, since target device events are asynchronous to the I3C probe\nsequence, step 3 may occur before step 2, causing `dev-\u003eibi` to be `NULL`,\nleading to a kernel panic.\n\nAdd a NULL pointer check in `i3c_master_queue_ibi()` to prevent accessing\nan uninitialized `dev-\u003eibi`, ensuring stability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52481c95-6253-446c-8cff-787d95c67646",
      "id": "CVE-2025-23148",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()\n\nsoc_dev_attr-\u003erevision could be NULL, thus,\na pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\"ice: Fix some null pointer dereference issues in ice_ptp.c\").\n\nThis issue is found by our static analysis tool.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fc9e0f23-7173-4348-8787-0f7dd49a8754",
      "id": "CVE-2025-38063",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix unconditional IO throttle caused by REQ_PREFLUSH\n\nWhen a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush()\ngenerates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC,\nwhich causes the flush_bio to be throttled by wbt_wait().\n\nAn example from v5.4, similar problem also exists in upstream:\n\n    crash\u003e bt 2091206\n    PID: 2091206  TASK: ffff2050df92a300  CPU: 109  COMMAND: \"kworker/u260:0\"\n     #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8\n     #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4\n     #2 [ffff800084a2f880] schedule at ffff800040bfa4b4\n     #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4\n     #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc\n     #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0\n     #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254\n     #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38\n     #8 [ffff800084a2fa60] generic_make_request at ffff800040570138\n     #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4\n    #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs]\n    #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs]\n    #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs]\n    #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs]\n    #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs]\n    #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs]\n    #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08\n    #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc\n    #18 [ffff800084a2fe70] kthread at ffff800040118de4\n\nAfter commit 2def2845cc33 (\"xfs: don't allow log IO to be throttled\"),\nthe metadata submitted by xlog_write_iclog() should not be throttled.\nBut due to the existence of the dm layer, throttling flush_bio indirectly\ncauses the metadata bio to be throttled.\n\nFix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes\nwbt_should_throttle() return false to avoid wbt_wait().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "31068482-b797-4c2c-802e-bade271a7351",
      "id": "CVE-2025-38515",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Increment job count before swapping tail spsc queue\n\nA small race exists between spsc_queue_push and the run-job worker, in\nwhich spsc_queue_push may return not-first while the run-job worker has\nalready idled due to the job count being zero. If this race occurs, job\nscheduling stops, leading to hangs while waiting on the job’s DMA\nfences.\n\nSeal this race by incrementing the job count before appending to the\nSPSC queue.\n\nThis race was observed on a drm-tip 6.16-rc1 build with the Xe driver in\nan SVM test case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "50303802-4837-4ed7-9acc-153a7abecc77",
      "id": "CVE-2025-38524",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recv-recv race of completed call\n\nIf a call receives an event (such as incoming data), the call gets placed\non the socket's queue and a thread in recvmsg can be awakened to go and\nprocess it.  Once the thread has picked up the call off of the queue,\nfurther events will cause it to be requeued, and once the socket lock is\ndropped (recvmsg uses call-\u003euser_mutex to allow the socket to be used in\nparallel), a second thread can come in and its recvmsg can pop the call off\nthe socket queue again.\n\nIn such a case, the first thread will be receiving stuff from the call and\nthe second thread will be blocked on call-\u003euser_mutex.  The first thread\ncan, at this point, process both the event that it picked call for and the\nevent that the second thread picked the call for and may see the call\nterminate - in which case the call will be \"released\", decoupling the call\nfrom the user call ID assigned to it (RXRPC_USER_CALL_ID in the control\nmessage).\n\nThe first thread will return okay, but then the second thread will wake up\nholding the user_mutex and, if it sees that the call has been released by\nthe first thread, it will BUG thusly:\n\n\tkernel BUG at net/rxrpc/recvmsg.c:474!\n\nFix this by just dequeuing the call and ignoring it if it is seen to be\nalready released.  We can't tell userspace about it anyway as the user call\nID has become stale.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4f82dd7d-c69f-44b0-b98c-d31fd7a8399c",
      "id": "CVE-2025-38544",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix bug due to prealloc collision\n\nWhen userspace is using AF_RXRPC to provide a server, it has to preallocate\nincoming calls and assign to them call IDs that will be used to thread\nrelated recvmsg() and sendmsg() together.  The preallocated call IDs will\nautomatically be attached to calls as they come in until the pool is empty.\n\nTo the kernel, the call IDs are just arbitrary numbers, but userspace can\nuse the call ID to hold a pointer to prepared structs.  In any case, the\nuser isn't permitted to create two calls with the same call ID (call IDs\nbecome available again when the call ends) and EBADSLT should result from\nsendmsg() if an attempt is made to preallocate a call with an in-use call\nID.\n\nHowever, the cleanup in the error handling will trigger both assertions in\nrxrpc_cleanup_call() because the call isn't marked complete and isn't\nmarked as having been released.\n\nFix this by setting the call state in rxrpc_service_prealloc_one() and then\nmarking it as being released before calling the cleanup function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "90caa11a-1525-448b-8f58-c8f0527ff16e",
      "id": "CVE-2025-39713",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()\n\nIn the interrupt handler rain_interrupt(), the buffer full check on\nrain-\u003ebuf_len is performed before acquiring rain-\u003ebuf_lock. This\ncreates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as\nrain-\u003ebuf_len is concurrently accessed and modified in the work\nhandler rain_irq_work_handler() under the same lock.\n\nMultiple interrupt invocations can race, with each reading buf_len\nbefore it becomes full and then proceeding. This can lead to both\ninterrupts attempting to write to the buffer, incrementing buf_len\nbeyond its capacity (DATA_SIZE) and causing a buffer overflow.\n\nFix this bug by moving the spin_lock() to before the buffer full\ncheck. This ensures that the check and the subsequent buffer modification\nare performed atomically, preventing the race condition. An corresponding\nspin_unlock() is added to the overflow path to correctly release the\nlock.\n\nThis possible bug was found by an experimental static analysis tool\ndeveloped by our team.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2a9d74b-963d-4dd1-b5bd-225eef7bca36",
      "id": "CVE-2021-46930",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: mtu3: fix list_head check warning\n\nThis is caused by uninitialization of list_head.\n\nBUG: KASAN: use-after-free in __list_del_entry_valid+0x34/0xe4\n\nCall trace:\ndump_backtrace+0x0/0x298\nshow_stack+0x24/0x34\ndump_stack+0x130/0x1a8\nprint_address_description+0x88/0x56c\n__kasan_report+0x1b8/0x2a0\nkasan_report+0x14/0x20\n__asan_load8+0x9c/0xa0\n__list_del_entry_valid+0x34/0xe4\nmtu3_req_complete+0x4c/0x300 [mtu3]\nmtu3_gadget_stop+0x168/0x448 [mtu3]\nusb_gadget_unregister_driver+0x204/0x3a0\nunregister_gadget_item+0x44/0xa4",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c642b29-4198-4107-bdbe-ab76995afdb9",
      "id": "CVE-2020-16166",
      "description": "The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e210663-5a36-4b17-853d-c039bd29fa7c",
      "id": "CVE-2020-25672",
      "description": "A memory leak vulnerability was found in Linux kernel in llcp_sock_connect",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a0ca337f-bf8b-425a-ac60-e657f4e70feb",
      "id": "CVE-2020-25705",
      "description": "A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0efe3837-ce51-438a-a679-28415e7631ab",
      "id": "CVE-2021-46951",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: efi: Use local variable for calculating final log size\n\nWhen tpm_read_log_efi is called multiple times, which happens when\none loads and unloads a TPM2 driver multiple times, then the global\nvariable efi_tpm_final_log_size will at some point become a negative\nnumber due to the subtraction of final_events_preboot_size occurring\neach time. Use a local variable to avoid this integer underflow.\n\nThe following issue is now resolved:\n\nMar  8 15:35:12 hibinst kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\nMar  8 15:35:12 hibinst kernel: Workqueue: tpm-vtpm vtpm_proxy_work [tpm_vtpm_proxy]\nMar  8 15:35:12 hibinst kernel: RIP: 0010:__memcpy+0x12/0x20\nMar  8 15:35:12 hibinst kernel: Code: 00 b8 01 00 00 00 85 d2 74 0a c7 05 44 7b ef 00 0f 00 00 00 c3 cc cc cc 66 66 90 66 90 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 \u003cf3\u003e 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 f3 a4\nMar  8 15:35:12 hibinst kernel: RSP: 0018:ffff9ac4c0fcfde0 EFLAGS: 00010206\nMar  8 15:35:12 hibinst kernel: RAX: ffff88f878cefed5 RBX: ffff88f878ce9000 RCX: 1ffffffffffffe0f\nMar  8 15:35:12 hibinst kernel: RDX: 0000000000000003 RSI: ffff9ac4c003bff9 RDI: ffff88f878cf0e4d\nMar  8 15:35:12 hibinst kernel: RBP: ffff9ac4c003b000 R08: 0000000000001000 R09: 000000007e9d6073\nMar  8 15:35:12 hibinst kernel: R10: ffff9ac4c003b000 R11: ffff88f879ad3500 R12: 0000000000000ed5\nMar  8 15:35:12 hibinst kernel: R13: ffff88f878ce9760 R14: 0000000000000002 R15: ffff88f77de7f018\nMar  8 15:35:12 hibinst kernel: FS:  0000000000000000(0000) GS:ffff88f87bd00000(0000) knlGS:0000000000000000\nMar  8 15:35:12 hibinst kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nMar  8 15:35:12 hibinst kernel: CR2: ffff9ac4c003c000 CR3: 00000001785a6004 CR4: 0000000000060ee0\nMar  8 15:35:12 hibinst kernel: Call Trace:\nMar  8 15:35:12 hibinst kernel: tpm_read_log_efi+0x152/0x1a7\nMar  8 15:35:12 hibinst kernel: tpm_bios_log_setup+0xc8/0x1c0\nMar  8 15:35:12 hibinst kernel: tpm_chip_register+0x8f/0x260\nMar  8 15:35:12 hibinst kernel: vtpm_proxy_work+0x16/0x60 [tpm_vtpm_proxy]\nMar  8 15:35:12 hibinst kernel: process_one_work+0x1b4/0x370\nMar  8 15:35:12 hibinst kernel: worker_thread+0x53/0x3e0\nMar  8 15:35:12 hibinst kernel: ? process_one_work+0x370/0x370",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "439e4518-b17d-4dfa-912b-2569477b4678",
      "id": "CVE-2022-49088",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe\n\nThis node pointer is returned by of_find_compatible_node() with\nrefcount incremented. Calling of_node_put() to aovid the refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "68d1ede0-6cbc-4150-b1de-0a72b96ccf0a",
      "id": "CVE-2020-27784",
      "description": "A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d9a2ebb-3f57-40f6-94b7-6bc9cb0f3fb7",
      "id": "CVE-2021-20322",
      "description": "A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb5c09ee-66e4-4355-b4e5-cd3c160b056a",
      "id": "CVE-2021-38206",
      "description": "The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "56f1a7e4-838f-475d-a982-9b2e5a22ff29",
      "id": "CVE-2021-3923",
      "description": "A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "22f38475-e03d-4102-afdf-da375a52d604",
      "id": "CVE-2021-4095",
      "description": "A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f6fb6336-a8f3-4031-9184-270c2d36ab0d",
      "id": "CVE-2021-4157",
      "description": "An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ecb4c3af-c5a0-468e-8e88-d57762cb0970",
      "id": "CVE-2021-46993",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: Fix out-of-bound access in uclamp\n\nUtil-clamp places tasks in different buckets based on their clamp values\nfor performance reasons. However, the size of buckets is currently\ncomputed using a rounding division, which can lead to an off-by-one\nerror in some configurations.\n\nFor instance, with 20 buckets, the bucket size will be 1024/20=51. A\ntask with a clamp of 1024 will be mapped to bucket id 1024/51=20. Sadly,\ncorrect indexes are in range [0,19], hence leading to an out of bound\nmemory access.\n\nClamp the bucket id to fix the issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "37ea78be-5c67-48c3-b4f3-0620805baea4",
      "id": "CVE-2021-47114",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix data corruption by fallocate\n\nWhen fallocate punches holes out of inode size, if original isize is in\nthe middle of last cluster, then the part from isize to the end of the\ncluster will be zeroed with buffer write, at that time isize is not yet\nupdated to match the new size, if writeback is kicked in, it will invoke\nocfs2_writepage()-\u003eblock_write_full_page() where the pages out of inode\nsize will be dropped.  That will cause file corruption.  Fix this by\nzero out eof blocks when extending the inode size.\n\nRunning the following command with qemu-image 4.2.1 can get a corrupted\ncoverted image file easily.\n\n    qemu-img convert -p -t none -T none -f qcow2 $qcow_image \\\n             -O qcow2 -o compat=1.1 $qcow_image.conv\n\nThe usage of fallocate in qemu is like this, it first punches holes out\nof inode size, then extend the inode size.\n\n    fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0\n    fallocate(11, 0, 2276196352, 65536) = 0\n\nv1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html\nv2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "611d6f55-25ab-4bef-b34f-45f99d90a63f",
      "id": "CVE-2021-47131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fix use-after-free after the TLS device goes down and up\n\nWhen a netdev with active TLS offload goes down, tls_device_down is\ncalled to stop the offload and tear down the TLS context. However, the\nsocket stays alive, and it still points to the TLS context, which is now\ndeallocated. If a netdev goes up, while the connection is still active,\nand the data flow resumes after a number of TCP retransmissions, it will\nlead to a use-after-free of the TLS context.\n\nThis commit addresses this bug by keeping the context alive until its\nnormal destruction, and implements the necessary fallbacks, so that the\nconnection can resume in software (non-offloaded) kTLS mode.\n\nOn the TX side tls_sw_fallback is used to encrypt all packets. The RX\nside already has all the necessary fallbacks, because receiving\nnon-decrypted packets is supported. The thing needed on the RX side is\nto block resync requests, which are normally produced after receiving\nnon-decrypted packets.\n\nThe necessary synchronization is implemented for a graceful teardown:\nfirst the fallbacks are deployed, then the driver resources are released\n(it used to be possible to have a tls_dev_resync after tls_dev_del).\n\nA new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback\nmode. It's used to skip the RX resync logic completely, as it becomes\nuseless, and some objects may be released (for example, resync_async,\nwhich is allocated and freed by the driver).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "af1aa150-10da-44df-997f-f1bb62039f20",
      "id": "CVE-2021-47395",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap\n\nLimit max values for vht mcs and nss in ieee80211_parse_tx_radiotap\nroutine in order to fix the following warning reported by syzbot:\n\nWARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline]\nWARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244\nModules linked in:\nCPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline]\nRIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244\nRSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216\nRAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000\nRDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003\nRBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100\nR10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8\nR13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004\nFS:  00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\nCall Trace:\n ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740\n netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089\n __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165\n __bpf_tx_skb net/core/filter.c:2114 [inline]\n __bpf_redirect_no_mac net/core/filter.c:2139 [inline]\n __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162\n ____bpf_clone_redirect net/core/filter.c:2429 [inline]\n bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401\n bpf_prog_eeb6f53a69e5c6a2+0x59/0x234\n bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline]\n __bpf_prog_run include/linux/filter.h:624 [inline]\n bpf_prog_run include/linux/filter.h:631 [inline]\n bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119\n bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663\n bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline]\n __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605\n __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]\n __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x4665f9",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c30d323-9729-47fc-b7b3-ea91c2e89b34",
      "id": "CVE-2021-47496",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: Fix flipped sign in tls_err_abort() calls\n\nsk-\u003esk_err appears to expect a positive value, a convention that ktls\ndoesn't always follow and that leads to memory corruption in other code.\nFor instance,\n\n    [kworker]\n    tls_encrypt_done(..., err=\u003cnegative error from crypto request\u003e)\n      tls_err_abort(.., err)\n        sk-\u003esk_err = err;\n\n    [task]\n    splice_from_pipe_feed\n      ...\n        tls_sw_do_sendpage\n          if (sk-\u003esk_err) {\n            ret = -sk-\u003esk_err;  // ret is positive\n\n    splice_from_pipe_feed (continued)\n      ret = actor(...)  // ret is still positive and interpreted as bytes\n                        // written, resulting in underflow of buf-\u003elen and\n                        // sd-\u003elen, leading to huge buf-\u003eoffset and bogus\n                        // addresses computed in later calls to actor()\n\nFix all tls_err_abort() callers to pass a negative error code\nconsistently and centralize the error-prone sign flip there, throwing in\na warning to catch future misuse and uninlining the function so it\nreally does only warn once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c5ec566b-b217-4d05-8b71-214d2267a342",
      "id": "CVE-2022-48628",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: drop messages from MDS when unmounting\n\nWhen unmounting all the dirty buffers will be flushed and after\nthe last osd request is finished the last reference of the i_count\nwill be released. Then it will flush the dirty cap/snap to MDSs,\nand the unmounting won't wait the possible acks, which will ihold\nthe inodes when updating the metadata locally but makes no sense\nany more, of this. This will make the evict_inodes() to skip these\ninodes.\n\nIf encrypt is enabled the kernel generate a warning when removing\nthe encrypt keys when the skipped inodes still hold the keyring:\n\nWARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0\nCPU: 4 PID: 168846 Comm: umount Tainted: G S  6.1.0-rc5-ceph-g72ead199864c #1\nHardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015\nRIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0\nRSP: 0018:ffffc9000b277e28 EFLAGS: 00010202\nRAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00\nRDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000\nRBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000\nR10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40\nR13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000\nFS:  00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\ngeneric_shutdown_super+0x47/0x120\nkill_anon_super+0x14/0x30\nceph_kill_sb+0x36/0x90 [ceph]\ndeactivate_locked_super+0x29/0x60\ncleanup_mnt+0xb8/0x140\ntask_work_run+0x67/0xb0\nexit_to_user_mode_prepare+0x23d/0x240\nsyscall_exit_to_user_mode+0x25/0x60\ndo_syscall_64+0x40/0x80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fd83dc39e9b\n\nLater the kernel will crash when iput() the inodes and dereferencing\nthe \"sb-\u003es_master_keys\", which has been released by the\ngeneric_shutdown_super().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f91ec420-9d69-4f9f-90b7-a13b450dc9e4",
      "id": "CVE-2021-47498",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm rq: don't queue request to blk-mq during DM suspend\n\nDM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue.\n\nBut blk-mq's unquiesce may come from outside events, such as elevator\nswitch, updating nr_requests or others, and request may come during\nsuspend, so simply ask for blk-mq to requeue it.\n\nFixes one kernel panic issue when running updating nr_requests and\ndm-mpath suspend/resume stress test.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5fe2db29-f299-42ed-ab4e-7b2e653c6db4",
      "id": "CVE-2021-47527",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: fix transmit-buffer reset and memleak\n\nCommit 761ed4a94582 (\"tty: serial_core: convert uart_close to use\ntty_port_close\") converted serial core to use tty_port_close() but\nfailed to notice that the transmit buffer still needs to be freed on\nfinal close.\n\nNot freeing the transmit buffer means that the buffer is no longer\ncleared on next open so that any ioctl() waiting for the buffer to drain\nmight wait indefinitely (e.g. on termios changes) or that stale data can\nend up being transmitted in case tx is restarted.\n\nFurthermore, the buffer of any port that has been opened would leak on\ndriver unbind.\n\nNote that the port lock is held when clearing the buffer pointer due to\nthe ldisc race worked around by commit a5ba1d95e46e (\"uart: fix race\nbetween uart_put_char() and uart_shutdown()\").\n\nAlso note that the tty-port shutdown() callback is not called for\nconsole ports so it is not strictly necessary to free the buffer page\nafter releasing the lock (cf. d72402145ace (\"tty/serial: do not free\ntrasnmit buffer page under port lock\")).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1b91e3c0-1d3c-4f59-b9cb-89934b8ba0c5",
      "id": "CVE-2021-47645",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com\n\nOn the case tmp_dcim=1, the index of buffer is miscalculated.\nThis generate a NULL pointer dereference later.\n\nSo let's fix the calcul and add a check to prevent this to reappear.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b7725d02-1ed2-4ef2-8a39-3553353cd19d",
      "id": "CVE-2022-43750",
      "description": "drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b1db5cc-323b-4c4a-a880-eca485328bc3",
      "id": "CVE-2022-45886",
      "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb5bfc1d-4eb2-40a1-b740-ca0b24fb630d",
      "id": "CVE-2022-48703",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR\n\nIn some case, the GDDV returns a package with a buffer which has\nzero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).\n\nThen the data_vault_read() got NULL point dereference problem when\naccessing the 0x10 value in data_vault.\n\n[   71.024560] BUG: kernel NULL pointer dereference, address:\n0000000000000010\n\nThis patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or\nNULL value in data_vault.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a2b5267c-13ad-4592-b1ca-f382e8556bc3",
      "id": "CVE-2022-48773",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create\n\nIf there are failures then we must not leave the non-NULL pointers with\nthe error value, otherwise `rpcrdma_ep_destroy` gets confused and tries\nfree them, resulting in an Oops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5bc423f3-2105-4621-9d3a-a11672ca469b",
      "id": "CVE-2022-48824",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: myrs: Fix crash in error case\n\nIn myrs_detect(), cs-\u003edisable_intr is NULL when privdata-\u003ehw_init() fails\nwith non-zero. In this case, myrs_cleanup(cs) will call a NULL ptr and\ncrash the kernel.\n\n[    1.105606] myrs 0000:00:03.0: Unknown Initialization Error 5A\n[    1.105872] myrs 0000:00:03.0: Failed to initialize Controller\n[    1.106082] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    1.110774] Call Trace:\n[    1.110950]  myrs_cleanup+0xe4/0x150 [myrs]\n[    1.111135]  myrs_probe.cold+0x91/0x56a [myrs]\n[    1.111302]  ? DAC960_GEM_intr_handler+0x1f0/0x1f0 [myrs]\n[    1.111500]  local_pci_probe+0x48/0x90",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f2c0d9ee-cab0-4eea-bb4e-8aef35f15951",
      "id": "CVE-2022-48845",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: smp: fill in sibling and core maps earlier\n\nAfter enabling CONFIG_SCHED_CORE (landed during 5.14 cycle),\n2-core 2-thread-per-core interAptiv (CPS-driven) started emitting\nthe following:\n\n[    0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi))\n[    0.048183] ------------[ cut here ]------------\n[    0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_core_cpu_starting+0x198/0x240\n[    0.048220] Modules linked in:\n[    0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7b319f24073fd9a3c2aa7ad15fb7993eec0b26f\n[    0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 00000004 00000000 c314fdd1\n[    0.048278]         830cbd64 819c0000 81800000 817f0000 83070bf4 00000001 830cbd08 00000000\n[    0.048307]         00000000 00000000 815fcbc4 00000000 00000000 00000000 00000000 00000000\n[    0.048334]         00000000 00000000 00000000 00000000 817f0000 00000000 00000000 817f6f34\n[    0.048361]         817f0000 818a3c00 817f0000 00000004 00000000 00000000 4dc33260 0018c933\n[    0.048389]         ...\n[    0.048396] Call Trace:\n[    0.048399] [\u003c8105a7bc\u003e] show_stack+0x3c/0x140\n[    0.048424] [\u003c8131c2a0\u003e] dump_stack_lvl+0x60/0x80\n[    0.048440] [\u003c8108b5c0\u003e] __warn+0xc0/0xf4\n[    0.048454] [\u003c8108b658\u003e] warn_slowpath_fmt+0x64/0x10c\n[    0.048467] [\u003c810bd418\u003e] sched_core_cpu_starting+0x198/0x240\n[    0.048483] [\u003c810c6514\u003e] sched_cpu_starting+0x14/0x80\n[    0.048497] [\u003c8108c0f8\u003e] cpuhp_invoke_callback_range+0x78/0x140\n[    0.048510] [\u003c8108d914\u003e] notify_cpu_starting+0x94/0x140\n[    0.048523] [\u003c8106593c\u003e] start_secondary+0xbc/0x280\n[    0.048539]\n[    0.048543] ---[ end trace 0000000000000000 ]---\n[    0.048636] Synchronize counters for CPU 1: done.\n\n...for each but CPU 0/boot.\nBasic debug printks right before the mentioned line say:\n\n[    0.048170] CPU: 1, smt_mask:\n\nSo smt_mask, which is sibling mask obviously, is empty when entering\nthe function.\nThis is critical, as sched_core_cpu_starting() calculates\ncore-scheduling parameters only once per CPU start, and it's crucial\nto have all the parameters filled in at that moment (at least it\nuses cpu_smt_mask() which in fact is `\u0026cpu_sibling_map[cpu]` on\nMIPS).\n\nA bit of debugging led me to that set_cpu_sibling_map() performing\nthe actual map calculation, was being invocated after\nnotify_cpu_start(), and exactly the latter function starts CPU HP\ncallback round (sched_core_cpu_starting() is basically a CPU HP\ncallback).\nWhile the flow is same on ARM64 (maps after the notifier, although\nbefore calling set_cpu_online()), x86 started calculating sibling\nmaps earlier than starting the CPU HP callbacks in Linux 4.14 (see\n[0] for the reference). Neither me nor my brief tests couldn't find\nany potential caveats in calculating the maps right after performing\ndelay calibration, but the WARN splat is now gone.\nThe very same debug prints now yield exactly what I expected from\nthem:\n\n[    0.048433] CPU: 1, smt_mask: 0-1\n\n[0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=76ce7cfe35ef",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "405af053-51f5-40f3-8e6c-8a3052ae2f26",
      "id": "CVE-2022-49032",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: health: afe4404: Fix oob read in afe4404_[read|write]_raw\n\nKASAN report out-of-bounds read as follows:\n\nBUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380\nRead of size 4 at addr ffffffffc00e4658 by task cat/278\n\nCall Trace:\n afe4404_read_raw\n iio_read_channel_info\n dev_attr_show\n\nThe buggy address belongs to the variable:\n afe4404_channel_leds+0x18/0xffffffffffffe9c0\n\nThis issue can be reproduce by singe command:\n\n $ cat /sys/bus/i2c/devices/0-0058/iio\\:device0/in_intensity6_raw\n\nThe array size of afe4404_channel_leds and afe4404_channel_offdacs\nare less than channels, so access with chan-\u003eaddress cause OOB read\nin afe4404_[read|write]_raw. Fix it by moving access before use them.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6eb66c07-2124-4bac-8934-82718b9089b8",
      "id": "CVE-2022-49053",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcmu: Fix possible page UAF\n\ntcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not\ntake refcount properly and just returns page pointer. When\ntcmu_try_get_data_page() returns, the returned page may have been freed by\ntcmu_blocks_release().\n\nWe need to get_page() under cmdr_lock to avoid concurrent\ntcmu_blocks_release().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "93d65a9a-a576-48e1-9747-6da56fdff9a0",
      "id": "CVE-2022-49114",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix use after free in fc_exch_abts_resp()\n\nfc_exch_release(ep) will decrease the ep's reference count. When the\nreference count reaches zero, it is freed. But ep is still used in the\nfollowing code, which will lead to a use after free.\n\nReturn after the fc_exch_release() call to avoid use after free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8efb99b9-23f1-4d0d-a5fa-2bad87c8a927",
      "id": "CVE-2022-49138",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Ignore multiple conn complete events\n\nWhen one of the three connection complete events is received multiple\ntimes for the same handle, the device is registered multiple times which\nleads to memory corruptions. Therefore, consequent events for a single\nconnection are ignored.\n\nThe conn-\u003estate can hold different values, therefore HCI_CONN_HANDLE_UNSET\nis introduced to identify new connections. To make sure the events do not\ncontain this or another invalid handle HCI_CONN_HANDLE_MAX and checks\nare introduced.\n\nBuglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1c984d2d-9762-4c95-ac22-890068e1f5b4",
      "id": "CVE-2022-49145",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Avoid out of bounds access when parsing _CPC data\n\nIf the NumEntries field in the _CPC return package is less than 2, do\nnot attempt to access the \"Revision\" element of that package, because\nit may not be present then.\n\nBugLink: https://lore.kernel.org/lkml/20220322143534.GC32582@xsang-OptiPlex-9020/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ae13dc6-9083-44d4-9bd5-db2926c2c6c3",
      "id": "CVE-2022-49226",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: asix: add proper error handling of usb read errors\n\nSyzbot once again hit uninit value in asix driver. The problem still the\nsame -- asix_read_cmd() reads less bytes, than was requested by caller.\n\nSince all read requests are performed via asix_read_cmd() let's catch\nusb related error there and add __must_check notation to be sure all\ncallers actually check return value.\n\nSo, this patch adds sanity check inside asix_read_cmd(), that simply\nchecks if bytes read are not less, than was requested and adds missing\nerror handling of asix_read_cmd() all across the driver code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a129337-16c9-46ac-ae4c-d625777b46ff",
      "id": "CVE-2022-49279",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: prevent integer overflow on 32 bit systems\n\nOn a 32 bit system, the \"len * sizeof(*p)\" operation can have an\ninteger overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "06ef24fe-49dd-4fce-8189-c0b84b4025bc",
      "id": "CVE-2022-49323",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()\n\nIt will cause null-ptr-deref when using 'res', if platform_get_resource()\nreturns NULL, so move using 'res' after devm_ioremap_resource() that\nwill check it to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d7ed925-d052-4fe0-84a0-158e45a34274",
      "id": "CVE-2022-49330",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix tcp_mtup_probe_success vs wrong snd_cwnd\n\nsyzbot got a new report [1] finally pointing to a very old bug,\nadded in initial support for MTU probing.\n\ntcp_mtu_probe() has checks about starting an MTU probe if\ntcp_snd_cwnd(tp) \u003e= 11.\n\nBut nothing prevents tcp_snd_cwnd(tp) to be reduced later\nand before the MTU probe succeeds.\n\nThis bug would lead to potential zero-divides.\n\nDebugging added in commit 40570375356c (\"tcp: add accessors\nto read/set tp-\u003esnd_cwnd\") has paid off :)\n\nWhile we are at it, address potential overflows in this code.\n\n[1]\nWARNING: CPU: 1 PID: 14132 at include/net/tcp.h:1219 tcp_mtup_probe_success+0x366/0x570 net/ipv4/tcp_input.c:2712\nModules linked in:\nCPU: 1 PID: 14132 Comm: syz-executor.2 Not tainted 5.18.0-syzkaller-07857-gbabf0bb978e3 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:tcp_snd_cwnd_set include/net/tcp.h:1219 [inline]\nRIP: 0010:tcp_mtup_probe_success+0x366/0x570 net/ipv4/tcp_input.c:2712\nCode: 74 08 48 89 ef e8 da 80 17 f9 48 8b 45 00 65 48 ff 80 80 03 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 aa b0 c5 f8 \u003c0f\u003e 0b e9 16 fe ff ff 48 8b 4c 24 08 80 e1 07 38 c1 0f 8c c7 fc ff\nRSP: 0018:ffffc900079e70f8 EFLAGS: 00010287\nRAX: ffffffff88c0f7f6 RBX: ffff8880756e7a80 RCX: 0000000000040000\nRDX: ffffc9000c6c4000 RSI: 0000000000031f9e RDI: 0000000000031f9f\nRBP: 0000000000000000 R08: ffffffff88c0f606 R09: ffffc900079e7520\nR10: ffffed101011226d R11: 1ffff1101011226c R12: 1ffff1100eadcf50\nR13: ffff8880756e72c0 R14: 1ffff1100eadcf89 R15: dffffc0000000000\nFS:  00007f643236e700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1ab3f1e2a0 CR3: 0000000064fe7000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n tcp_clean_rtx_queue+0x223a/0x2da0 net/ipv4/tcp_input.c:3356\n tcp_ack+0x1962/0x3c90 net/ipv4/tcp_input.c:3861\n tcp_rcv_established+0x7c8/0x1ac0 net/ipv4/tcp_input.c:5973\n tcp_v6_do_rcv+0x57b/0x1210 net/ipv6/tcp_ipv6.c:1476\n sk_backlog_rcv include/net/sock.h:1061 [inline]\n __release_sock+0x1d8/0x4c0 net/core/sock.c:2849\n release_sock+0x5d/0x1c0 net/core/sock.c:3404\n sk_stream_wait_memory+0x700/0xdc0 net/core/stream.c:145\n tcp_sendmsg_locked+0x111d/0x3fc0 net/ipv4/tcp.c:1410\n tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1448\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n __sys_sendto+0x439/0x5c0 net/socket.c:2119\n __do_sys_sendto net/socket.c:2131 [inline]\n __se_sys_sendto net/socket.c:2127 [inline]\n __x64_sys_sendto+0xda/0xf0 net/socket.c:2127\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f6431289109\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f643236e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f643139c100 RCX: 00007f6431289109\nRDX: 00000000d0d0c2ac RSI: 0000000020000080 RDI: 000000000000000a\nRBP: 00007f64312e308d R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fff372533af R14: 00007f643236e300 R15: 0000000000022000",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "11bcdf92-83fc-4f23-a6a8-3aef96e83085",
      "id": "CVE-2022-49603",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: Fix data-races around sysctl_ip_fwd_update_priority.\n\nWhile reading sysctl_ip_fwd_update_priority, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8e45556e-ae4f-413c-85de-afc3fde4ac35",
      "id": "CVE-2022-49650",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: qcom: bam_dma: fix runtime PM underflow\n\nCommit dbad41e7bb5f (\"dmaengine: qcom: bam_dma: check if the runtime pm enabled\")\ncaused unbalanced pm_runtime_get/put() calls when the bam is\ncontrolled remotely. This commit reverts it and just enables pm_runtime\nin all cases, the clk_* functions already just nop when the clock is NULL.\n\nAlso clean up a bit by removing unnecessary bamclk null checks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bdea91a1-202c-4742-9b18-fecfb0beaeae",
      "id": "CVE-2022-49826",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-transport: fix double ata_host_put() in ata_tport_add()\n\nIn the error path in ata_tport_add(), when calling put_device(),\nata_tport_release() is called, it will put the refcount of 'ap-\u003ehost'.\n\nAnd then ata_host_put() is called again, the refcount is decreased\nto 0, ata_host_release() is called, all ports are freed and set to\nnull.\n\nWhen unbinding the device after failure, ata_host_stop() is called\nto release the resources, it leads a null-ptr-deref(), because all\nthe ports all freed and null.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000008\nCPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G            E      6.1.0-rc3+ #8\npstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : ata_host_stop+0x3c/0x84 [libata]\nlr : release_nodes+0x64/0xd0\nCall trace:\n ata_host_stop+0x3c/0x84 [libata]\n release_nodes+0x64/0xd0\n devres_release_all+0xbc/0x1b0\n device_unbind_cleanup+0x20/0x70\n really_probe+0x158/0x320\n __driver_probe_device+0x84/0x120\n driver_probe_device+0x44/0x120\n __driver_attach+0xb4/0x220\n bus_for_each_dev+0x78/0xdc\n driver_attach+0x2c/0x40\n bus_add_driver+0x184/0x240\n driver_register+0x80/0x13c\n __pci_register_driver+0x4c/0x60\n ahci_pci_driver_init+0x30/0x1000 [ahci]\n\nFix this by removing redundant ata_host_put() in the error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f0ffa451-61ca-4a53-b4cf-4c075fee7343",
      "id": "CVE-2022-49837",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix memory leaks in __check_func_call\n\nkmemleak reports this issue:\n\nunreferenced object 0xffff88817139d000 (size 2048):\n  comm \"test_progs\", pid 33246, jiffies 4307381979 (age 45851.820s)\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c0000000045f075f0\u003e] kmalloc_trace+0x27/0xa0\n    [\u003c0000000098b7c90a\u003e] __check_func_call+0x316/0x1230\n    [\u003c00000000b4c3c403\u003e] check_helper_call+0x172e/0x4700\n    [\u003c00000000aa3875b7\u003e] do_check+0x21d8/0x45e0\n    [\u003c000000001147357b\u003e] do_check_common+0x767/0xaf0\n    [\u003c00000000b5a595b4\u003e] bpf_check+0x43e3/0x5bc0\n    [\u003c0000000011e391b1\u003e] bpf_prog_load+0xf26/0x1940\n    [\u003c0000000007f765c0\u003e] __sys_bpf+0xd2c/0x3650\n    [\u003c00000000839815d6\u003e] __x64_sys_bpf+0x75/0xc0\n    [\u003c00000000946ee250\u003e] do_syscall_64+0x3b/0x90\n    [\u003c0000000000506b7f\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe root case here is: In function prepare_func_exit(), the callee is\nnot released in the abnormal scenario after \"state-\u003ecurframe--;\". To\nfix, move \"state-\u003ecurframe--;\" to the very bottom of the function,\nright when we free callee and reset frame[] pointer to NULL, as Andrii\nsuggested.\n\nIn addition, function __check_func_call() has a similar problem. In\nthe abnormal scenario before \"state-\u003ecurframe++;\", the callee also\nshould be released by free_func_state().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9efe614-06d5-4196-b374-2cfe945c7212",
      "id": "CVE-2022-49907",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdio: fix undefined behavior in bit shift for __mdiobus_register\n\nShifting signed 32-bit value by 31 bits is undefined, so changing\nsignificant bit to unsigned. The UBSAN warning calltrace like below:\n\nUBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27\nleft shift of 1 by 31 places cannot be represented in type 'int'\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x7d/0xa5\n dump_stack+0x15/0x1b\n ubsan_epilogue+0xe/0x4e\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c\n __mdiobus_register+0x49d/0x4e0\n fixed_mdio_bus_init+0xd8/0x12d\n do_one_initcall+0x76/0x430\n kernel_init_freeable+0x3b3/0x422\n kernel_init+0x24/0x1e0\n ret_from_fork+0x1f/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76982745-e83c-4ce6-8bf7-da64fe0a2616",
      "id": "CVE-2022-50375",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown\n\nlpuart_dma_shutdown tears down lpuart dma, but lpuart_flush_buffer can\nstill occur which in turn tries to access dma apis if lpuart_dma_tx_use\nflag is true. At this point since dma is torn down, these dma apis can\nabort. Set lpuart_dma_tx_use and the corresponding rx flag\nlpuart_dma_rx_use to false in lpuart_dma_shutdown so that dmas are not\naccessed after they are relinquished.\n\nOtherwise, when try to kill btattach, kernel may panic. This patch may\nfix this issue.\nroot@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200\n^C[   90.182296] Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP\n[   90.189806] Modules linked in: moal(O) mlan(O)\n[   90.194258] CPU: 0 PID: 503 Comm: btattach Tainted: G           O      5.15.32-06136-g34eecdf2f9e4 #37\n[   90.203554] Hardware name: NXP i.MX8ULP 9X9 EVK (DT)\n[   90.208513] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   90.215470] pc : fsl_edma3_disable_request+0x8/0x60\n[   90.220358] lr : fsl_edma3_terminate_all+0x34/0x20c\n[   90.225237] sp : ffff800013f0bac0\n[   90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800\n[   90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24: ffff000008404a00\n[   90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000\n[   90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000\n[   90.257078] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[   90.264211] x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000040\n[   90.271344] x11: ffff00000600c248 x10: ffff800013f0bb10 x9 : ffff000057bcb090\n[   90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804\n[   90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480\n[   90.292742] x2 : ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800\n[   90.299876] Call trace:\n[   90.302321]  fsl_edma3_disable_request+0x8/0x60\n[   90.306851]  lpuart_flush_buffer+0x40/0x160\n[   90.311037]  uart_flush_buffer+0x88/0x120\n[   90.315050]  tty_driver_flush_buffer+0x20/0x30\n[   90.319496]  hci_uart_flush+0x44/0x90\n[   90.323162]  +0x34/0x12c\n[   90.327253]  tty_ldisc_close+0x38/0x70\n[   90.331005]  tty_ldisc_release+0xa8/0x190\n[   90.335018]  tty_release_struct+0x24/0x8c\n[   90.339022]  tty_release+0x3ec/0x4c0\n[   90.342593]  __fput+0x70/0x234\n[   90.345652]  ____fput+0x14/0x20\n[   90.348790]  task_work_run+0x84/0x17c\n[   90.352455]  do_exit+0x310/0x96c\n[   90.355688]  do_group_exit+0x3c/0xa0\n[   90.359259]  __arm64_sys_exit_group+0x1c/0x20\n[   90.363609]  invoke_syscall+0x48/0x114\n[   90.367362]  el0_svc_common.constprop.0+0xd4/0xfc\n[   90.372068]  do_el0_svc+0x2c/0x94\n[   90.375379]  el0_svc+0x28/0x80\n[   90.378438]  el0t_64_sync_handler+0xa8/0x130\n[   90.382711]  el0t_64_sync+0x1a0/0x1a4\n[   90.386376] Code: 17ffffda d503201f d503233f f9409802 (b9400041)\n[   90.392467] ---[ end trace 2f60524b4a43f1f6 ]---\n[   90.397073] note: btattach[503] exited with preempt_count 1\n[   90.402636] Fixing recursive fault but reboot is needed!",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea436779-8c2b-47cd-84fc-20a8f9fa3377",
      "id": "CVE-2022-49934",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix UAF in ieee80211_scan_rx()\n\nieee80211_scan_rx() tries to access scan_req-\u003eflags after a\nnull check, but a UAF is observed when the scan is completed\nand __ieee80211_scan_completed() executes, which then calls\ncfg80211_scan_done() leading to the freeing of scan_req.\n\nSince scan_req is rcu_dereference()'d, prevent the racing in\n__ieee80211_scan_completed() by ensuring that from mac80211's\nPOV it is no longer accessed from an RCU read critical section\nbefore we call cfg80211_scan_done().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a59d1d42-7b2e-42aa-a17c-216ed39ab679",
      "id": "CVE-2022-50062",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bgmac: Fix a BUG triggered by wrong bytes_compl\n\nOn one of our machines we got:\n\nkernel BUG at lib/dynamic_queue_limits.c:27!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM\nCPU: 0 PID: 1166 Comm: irq/41-bgmac Tainted: G        W  O    4.14.275-rt132 #1\nHardware name: BRCM XGS iProc\ntask: ee3415c0 task.stack: ee32a000\nPC is at dql_completed+0x168/0x178\nLR is at bgmac_poll+0x18c/0x6d8\npc : [\u003cc03b9430\u003e]    lr : [\u003cc04b5a18\u003e]    psr: 800a0313\nsp : ee32be14  ip : 000005ea  fp : 00000bd4\nr10: ee558500  r9 : c0116298  r8 : 00000002\nr7 : 00000000  r6 : ef128810  r5 : 01993267  r4 : 01993851\nr3 : ee558000  r2 : 000070e1  r1 : 00000bd4  r0 : ee52c180\nFlags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none\nControl: 12c5387d  Table: 8e88c04a  DAC: 00000051\nProcess irq/41-bgmac (pid: 1166, stack limit = 0xee32a210)\nStack: (0xee32be14 to 0xee32c000)\nbe00:                                              ee558520 ee52c100 ef128810\nbe20: 00000000 00000002 c0116298 c04b5a18 00000000 c0a0c8c4 c0951780 00000040\nbe40: c0701780 ee558500 ee55d520 ef05b340 ef6f9780 ee558520 00000001 00000040\nbe60: ffffe000 c0a56878 ef6fa040 c0952040 0000012c c0528744 ef6f97b0 fffcfb6a\nbe80: c0a04104 2eda8000 c0a0c4ec c0a0d368 ee32bf44 c0153534 ee32be98 ee32be98\nbea0: ee32bea0 ee32bea0 ee32bea8 ee32bea8 00000000 c01462e4 ffffe000 ef6f22a8\nbec0: ffffe000 00000008 ee32bee4 c0147430 ffffe000 c094a2a8 00000003 ffffe000\nbee0: c0a54528 00208040 0000000c c0a0c8c4 c0a65980 c0124d3c 00000008 ee558520\nbf00: c094a23c c0a02080 00000000 c07a9910 ef136970 ef136970 ee30a440 ef136900\nbf20: ee30a440 00000001 ef136900 ee30a440 c016d990 00000000 c0108db0 c012500c\nbf40: ef136900 c016da14 ee30a464 ffffe000 00000001 c016dd14 00000000 c016db28\nbf60: ffffe000 ee21a080 ee30a400 00000000 ee32a000 ee30a440 c016dbfc ee25fd70\nbf80: ee21a09c c013edcc ee32a000 ee30a400 c013ec7c 00000000 00000000 00000000\nbfa0: 00000000 00000000 00000000 c0108470 00000000 00000000 00000000 00000000\nbfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\nbfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000\n[\u003cc03b9430\u003e] (dql_completed) from [\u003cc04b5a18\u003e] (bgmac_poll+0x18c/0x6d8)\n[\u003cc04b5a18\u003e] (bgmac_poll) from [\u003cc0528744\u003e] (net_rx_action+0x1c4/0x494)\n[\u003cc0528744\u003e] (net_rx_action) from [\u003cc0124d3c\u003e] (do_current_softirqs+0x1ec/0x43c)\n[\u003cc0124d3c\u003e] (do_current_softirqs) from [\u003cc012500c\u003e] (__local_bh_enable+0x80/0x98)\n[\u003cc012500c\u003e] (__local_bh_enable) from [\u003cc016da14\u003e] (irq_forced_thread_fn+0x84/0x98)\n[\u003cc016da14\u003e] (irq_forced_thread_fn) from [\u003cc016dd14\u003e] (irq_thread+0x118/0x1c0)\n[\u003cc016dd14\u003e] (irq_thread) from [\u003cc013edcc\u003e] (kthread+0x150/0x158)\n[\u003cc013edcc\u003e] (kthread) from [\u003cc0108470\u003e] (ret_from_fork+0x14/0x24)\nCode: a83f15e0 0200001a 0630a0e1 c3ffffea (f201f0e7)\n\nThe issue seems similar to commit 90b3b339364c (\"net: hisilicon: Fix a BUG\ntrigered by wrong bytes_compl\") and potentially introduced by commit\nb38c83dd0866 (\"bgmac: simplify tx ring index handling\").\n\nIf there is an RX interrupt between setting ring-\u003eend\nand netdev_sent_queue() we can hit the BUG_ON as bgmac_dma_tx_free()\ncan miscalculate the queue size while called from bgmac_poll().\n\nThe machine which triggered the BUG runs a v4.14 RT kernel - but the issue\nseems present in mainline too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "afa0464d-8b48-4142-af48-2b006ecc270b",
      "id": "CVE-2022-50092",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: fix use-after-free crash in dm_sm_register_threshold_callback\n\nFault inject on pool metadata device reports:\n  BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80\n  Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950\n\n  CPU: 7 PID: 950 Comm: dmsetup Tainted: G        W         5.19.0-rc6 #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x44\n   print_address_description.constprop.0.cold+0xeb/0x3f4\n   kasan_report.cold+0xe6/0x147\n   dm_pool_register_metadata_threshold+0x40/0x80\n   pool_ctr+0xa0a/0x1150\n   dm_table_add_target+0x2c8/0x640\n   table_load+0x1fd/0x430\n   ctl_ioctl+0x2c4/0x5a0\n   dm_ctl_ioctl+0xa/0x10\n   __x64_sys_ioctl+0xb3/0xd0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis can be easily reproduced using:\n  echo offline \u003e /sys/block/sda/device/state\n  dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10\n  dmsetup load pool --table \"0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0\"\n\nIf a metadata commit fails, the transaction will be aborted and the\nmetadata space maps will be destroyed. If a DM table reload then\nhappens for this failed thin-pool, a use-after-free will occur in\ndm_sm_register_threshold_callback (called from\ndm_pool_register_metadata_threshold).\n\nFix this by in dm_pool_register_metadata_threshold() by returning the\n-EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr()\nwith a new error message: \"Error registering metadata threshold\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "76862744-97bd-49e3-8be0-43dc898c1903",
      "id": "CVE-2022-50116",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix deadlock and link starvation in outgoing data path\n\nThe current implementation queues up new control and user packets as needed\nand processes this queue down to the ldisc in the same code path.\nThat means that the upper and the lower layer are hard coupled in the code.\nDue to this deadlocks can happen as seen below while transmitting data,\nespecially during ldisc congestion. Furthermore, the data channels starve\nthe control channel on high transmission load on the ldisc.\n\nIntroduce an additional control channel data queue to prevent timeouts and\nlink hangups during ldisc congestion. This is being processed before the\nuser channel data queue in gsm_data_kick(), i.e. with the highest priority.\nPut the queue to ldisc data path into a workqueue and trigger it whenever\nnew data has been put into the transmission queue. Change\ngsm_dlci_data_sweep() accordingly to fill up the transmission queue until\nTX_THRESH_HI. This solves the locking issue, keeps latency low and provides\ngood performance on high data load.\nNote that now all packets from a DLCI are removed from the internal queue\nif the associated DLCI was closed. This ensures that no data is sent by the\nintroduced write task to an already closed DLCI.\n\nBUG: spinlock recursion on CPU#0, test_v24_loop/124\n lock: serial8250_ports+0x3a8/0x7500, .magic: dead4ead, .owner: test_v24_loop/124, .owner_cpu: 0\nCPU: 0 PID: 124 Comm: test_v24_loop Tainted: G           O      5.18.0-rc2 #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x34/0x44\n do_raw_spin_lock+0x76/0xa0\n _raw_spin_lock_irqsave+0x72/0x80\n uart_write_room+0x3b/0xc0\n gsm_data_kick+0x14b/0x240 [n_gsm]\n gsmld_write_wakeup+0x35/0x70 [n_gsm]\n tty_wakeup+0x53/0x60\n tty_port_default_wakeup+0x1b/0x30\n serial8250_tx_chars+0x12f/0x220\n serial8250_handle_irq.part.0+0xfe/0x150\n serial8250_default_handle_irq+0x48/0x80\n serial8250_interrupt+0x56/0xa0\n __handle_irq_event_percpu+0x78/0x1f0\n handle_irq_event+0x34/0x70\n handle_fasteoi_irq+0x90/0x1e0\n __common_interrupt+0x69/0x100\n common_interrupt+0x48/0xc0\n asm_common_interrupt+0x1e/0x40\nRIP: 0010:__do_softirq+0x83/0x34e\nCode: 2a 0a ff 0f b7 ed c7 44 24 10 0a 00 00 00 48 c7 c7 51 2a 64 82 e8 2d\ne2 d5 ff 65 66 c7 05 83 af 1e 7e 00 00 fb b8 ff ff ff ff \u003c49\u003e c7 c2 40 61\n80 82 0f bc c5 41 89 c4 41 83 c4 01 0f 84 e6 00 00\nRSP: 0018:ffffc90000003f98 EFLAGS: 00000286\nRAX: 00000000ffffffff RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff82642a51 RDI: ffffffff825bb5e7\nRBP: 0000000000000200 R08: 00000008de3271a8 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000\nR13: 0000000000000030 R14: 0000000000000000 R15: 0000000000000000\n ? __do_softirq+0x73/0x34e\n irq_exit_rcu+0xb5/0x100\n common_interrupt+0xa4/0xc0\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_common_interrupt+0x1e/0x40\nRIP: 0010:_raw_spin_unlock_irqrestore+0x2e/0x50\nCode: 00 55 48 89 fd 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 85 28 36 ff\n48 89 ef e8 cd 58 36 ff 80 e7 02 74 01 fb bf 01 00 00 00 \u003ce8\u003e 3d 97 33 ff\n65 8b 05 96 23 2b 7e 85 c0 74 03 5b 5d c3 0f 1f 44\nRSP: 0018:ffffc9000020fd08 EFLAGS: 00000202\nRAX: 0000000000000000 RBX: 0000000000000246 RCX: 0000000000000000\nRDX: 0000000000000004 RSI: ffffffff8257fd74 RDI: 0000000000000001\nRBP: ffff8880057de3a0 R08: 00000008de233000 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000\nR13: 0000000000000100 R14: 0000000000000202 R15: ffff8880057df0b8\n ? _raw_spin_unlock_irqrestore+0x23/0x50\n gsmtty_write+0x65/0x80 [n_gsm]\n n_tty_write+0x33f/0x530\n ? swake_up_all+0xe0/0xe0\n file_tty_write.constprop.0+0x1b1/0x320\n ? n_tty_flush_buffer+0xb0/0xb0\n new_sync_write+0x10c/0x190\n vfs_write+0x282/0x310\n ksys_write+0x68/0xe0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f3e5e35c15c\nCode: 8b 7c 24 08 89 c5 e8 c5 ff ff ff 89 ef 89 44 24\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e4256e8a-852c-4806-9bca-8abefed5f31e",
      "id": "CVE-2022-50153",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: Fix refcount leak in ehci_hcd_ppc_of_probe\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a57f2792-4886-4402-bc9f-b408e3605bad",
      "id": "CVE-2022-50164",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue\n\nAfter successfull station association, if station queues are disabled for\nsome reason, the related lists are not emptied. So if some new element is\nadded to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old\none and produce a BUG like this:\n\n[   46.535263] list_add corruption. prev-\u003enext should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388).\n[   46.535283] ------------[ cut here ]------------\n[   46.535284] kernel BUG at lib/list_debug.c:26!\n[   46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI\n[   46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1\n[   46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN       , BIOS A07 08/24/2012\n[   46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f\n[   46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff \u003c0f\u003e 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1\n[   46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286\n[   46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000\n[   46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff\n[   46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666\n[   46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388\n[   46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0\n[   46.666108] FS:  00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000\n[   46.674331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0\n[   46.687422] Call Trace:\n[   46.689906]  \u003cTASK\u003e\n[   46.691950]  iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm]\n[   46.697601]  ieee80211_queue_skb+0x4b3/0x720 [mac80211]\n[   46.702973]  ? sta_info_get+0x46/0x60 [mac80211]\n[   46.707703]  ieee80211_tx+0xad/0x110 [mac80211]\n[   46.712355]  __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211]\n...\n\nIn order to avoid this problem, we must also remove the related lists when\nstation queues are disabled.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "929ef669-812f-4cd7-b82e-3605da30d8d2",
      "id": "CVE-2022-50197",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: zynq: Fix refcount leak in zynq_get_revision\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b839ea5b-aeac-444a-8498-40f7d38a44ac",
      "id": "CVE-2022-50347",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and calling mmc_free_host() in the\nerror path, besides, led_classdev_unregister() and pm_runtime_disable() also\nneed be called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5903b1e3-f01a-477d-92f3-26826361f18e",
      "id": "CVE-2022-50423",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()\n\nThere is an use-after-free reported by KASAN:\n\n  BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82\n  Read of size 1 at addr ffff888112afc460 by task modprobe/2111\n  CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n  Call Trace:\n   \u003cTASK\u003e\n   kasan_report+0xae/0xe0\n   acpi_ut_remove_reference+0x3b/0x82\n   acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5\n   acpi_ds_store_object_to_local+0x15d/0x3a0\n   acpi_ex_store+0x78d/0x7fd\n   acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b\n   acpi_ps_parse_aml+0x217/0x8d5\n   ...\n   \u003c/TASK\u003e\n\nThe root cause of the problem is that the acpi_operand_object\nis freed when acpi_ut_walk_package_tree() fails in\nacpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in\nacpi_ut_copy_iobject_to_iobject(). The problem was introduced\nby \"8aa5e56eeb61\" commit, this commit is to fix memory leak in\nacpi_ut_copy_iobject_to_iobject(), repeatedly adding remove\noperation, lead to \"acpi_operand_object\" used after free.\n\nFix it by removing acpi_ut_remove_reference() in\nacpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()\nis called to copy an internal package object into another internal\npackage object, when it fails, the memory of acpi_operand_object\nshould be freed by the caller.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2c55088b-866c-44f4-bf05-715590d8d83d",
      "id": "CVE-2023-23039",
      "description": "An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63512670-9c65-4da3-8f00-84775d4e85ad",
      "id": "CVE-2023-39192",
      "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ae24b6c-0719-4555-891e-bdaee83cfe7c",
      "id": "CVE-2023-53380",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix null-ptr-deref of mreplace in raid10_sync_request\n\nThere are two check of 'mreplace' in raid10_sync_request(). In the first\ncheck, 'need_replace' will be set and 'mreplace' will be used later if\nno-Faulty 'mreplace' exists, In the second check, 'mreplace' will be\nset to NULL if it is Faulty, but 'need_replace' will not be changed\naccordingly. null-ptr-deref occurs if Faulty is set between two check.\n\nFix it by merging two checks into one. And replace 'need_replace' with\n'mreplace' because their values are always the same.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "01b94842-05d9-4170-bb42-45f394e602ad",
      "id": "CVE-2023-52598",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ptrace: handle setting of fpc register correctly\n\nIf the content of the floating point control (fpc) register of a traced\nprocess is modified with the ptrace interface the new value is tested for\nvalidity by temporarily loading it into the fpc register.\n\nThis may lead to corruption of the fpc register of the tracing process:\nif an interrupt happens while the value is temporarily loaded into the\nfpc register, and within interrupt context floating point or vector\nregisters are used, the current fp/vx registers are saved with\nsave_fpu_regs() assuming they belong to user space and will be loaded into\nfp/vx registers when returning to user space.\n\ntest_fp_ctl() restores the original user space fpc register value, however\nit will be discarded, when returning to user space.\n\nIn result the tracer will incorrectly continue to run with the value that\nwas supposed to be used for the traced process.\n\nFix this by saving fpu register contents with save_fpu_regs() before using\ntest_fp_ctl().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91577cae-5576-4c91-aab5-603e2c55244c",
      "id": "CVE-2023-52754",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imon: fix access to invalid resource for the second interface\n\nimon driver probes two USB interfaces, and at the probe of the second\ninterface, the driver assumes blindly that the first interface got\nbound with the same imon driver.  It's usually true, but it's still\npossible that the first interface is bound with another driver via a\nmalformed descriptor.  Then it may lead to a memory corruption, as\nspotted by syzkaller; imon driver accesses the data from drvdata as\nstruct imon_context object although it's a completely different one\nthat was assigned by another driver.\n\nThis patch adds a sanity check -- whether the first interface is\nreally bound with the imon driver or not -- for avoiding the problem\nabove at the probe time.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9a4fb3f4-d355-4ad0-b865-6e591cbea12e",
      "id": "CVE-2023-52873",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data\n\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff8e5baf-240c-4d0b-a681-79df4535a3dd",
      "id": "CVE-2023-52975",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress\n\nBug report and analysis from Ding Hui.\n\nDuring iSCSI session logout, if another task accesses the shost ipaddress\nattr, we can get a KASAN UAF report like this:\n\n[  276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0\n[  276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088\n[  276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G            E      6.1.0-rc8+ #3\n[  276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[  276.944470] Call Trace:\n[  276.944943]  \u003cTASK\u003e\n[  276.945397]  dump_stack_lvl+0x34/0x48\n[  276.945887]  print_address_description.constprop.0+0x86/0x1e7\n[  276.946421]  print_report+0x36/0x4f\n[  276.947358]  kasan_report+0xad/0x130\n[  276.948234]  kasan_check_range+0x35/0x1c0\n[  276.948674]  _raw_spin_lock_bh+0x78/0xe0\n[  276.949989]  iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp]\n[  276.951765]  show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi]\n[  276.952185]  dev_attr_show+0x3f/0x80\n[  276.953005]  sysfs_kf_seq_show+0x1fb/0x3e0\n[  276.953401]  seq_read_iter+0x402/0x1020\n[  276.954260]  vfs_read+0x532/0x7b0\n[  276.955113]  ksys_read+0xed/0x1c0\n[  276.955952]  do_syscall_64+0x38/0x90\n[  276.956347]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  276.956769] RIP: 0033:0x7f5d3a679222\n[  276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24\n[  276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[  276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222\n[  276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003\n[  276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000\n[  276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000\n[  276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58\n[  276.960536]  \u003c/TASK\u003e\n[  276.961357] Allocated by task 2209:\n[  276.961756]  kasan_save_stack+0x1e/0x40\n[  276.962170]  kasan_set_track+0x21/0x30\n[  276.962557]  __kasan_kmalloc+0x7e/0x90\n[  276.962923]  __kmalloc+0x5b/0x140\n[  276.963308]  iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi]\n[  276.963712]  iscsi_session_setup+0xda/0xba0 [libiscsi]\n[  276.964078]  iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp]\n[  276.964431]  iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi]\n[  276.964793]  iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi]\n[  276.965153]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]\n[  276.965546]  netlink_unicast+0x4d5/0x7b0\n[  276.965905]  netlink_sendmsg+0x78d/0xc30\n[  276.966236]  sock_sendmsg+0xe5/0x120\n[  276.966576]  ____sys_sendmsg+0x5fe/0x860\n[  276.966923]  ___sys_sendmsg+0xe0/0x170\n[  276.967300]  __sys_sendmsg+0xc8/0x170\n[  276.967666]  do_syscall_64+0x38/0x90\n[  276.968028]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  276.968773] Freed by task 2209:\n[  276.969111]  kasan_save_stack+0x1e/0x40\n[  276.969449]  kasan_set_track+0x21/0x30\n[  276.969789]  kasan_save_free_info+0x2a/0x50\n[  276.970146]  __kasan_slab_free+0x106/0x190\n[  276.970470]  __kmem_cache_free+0x133/0x270\n[  276.970816]  device_release+0x98/0x210\n[  276.971145]  kobject_cleanup+0x101/0x360\n[  276.971462]  iscsi_session_teardown+0x3fb/0x530 [libiscsi]\n[  276.971775]  iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp]\n[  276.972143]  iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi]\n[  276.972485]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]\n[  276.972808]  netlink_unicast+0x4d5/0x7b0\n[  276.973201]  netlink_sendmsg+0x78d/0xc30\n[  276.973544]  sock_sendmsg+0xe5/0x120\n[  276.973864]  ____sys_sendmsg+0x5fe/0x860\n[  276.974248]  ___sys_\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d00c6328-4878-4a20-b0a5-3318c41de62e",
      "id": "CVE-2023-53023",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: Fix use-after-free in local_cleanup()\n\nFix a use-after-free that occurs in kfree_skb() called from\nlocal_cleanup(). This could happen when killing nfc daemon (e.g. neard)\nafter detaching an nfc device.\nWhen detaching an nfc device, local_cleanup() called from\nnfc_llcp_unregister_device() frees local-\u003erx_pending and decreases\nlocal-\u003eref by kref_put() in nfc_llcp_local_put().\nIn the terminating process, nfc daemon releases all sockets and it leads\nto decreasing local-\u003eref. After the last release of local-\u003eref,\nlocal_cleanup() called from local_release() frees local-\u003erx_pending\nagain, which leads to the bug.\n\nSetting local-\u003erx_pending to NULL in local_cleanup() could prevent\nuse-after-free when local_cleanup() is called twice.\n\nFound by a modified version of syzkaller.\n\nBUG: KASAN: use-after-free in kfree_skb()\n\nCall Trace:\ndump_stack_lvl (lib/dump_stack.c:106)\nprint_address_description.constprop.0.cold (mm/kasan/report.c:306)\nkasan_check_range (mm/kasan/generic.c:189)\nkfree_skb (net/core/skbuff.c:955)\nlocal_cleanup (net/nfc/llcp_core.c:159)\nnfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)\nnfc_llcp_local_put (net/nfc/llcp_core.c:181)\nllcp_sock_destruct (net/nfc/llcp_sock.c:959)\n__sk_destruct (net/core/sock.c:2133)\nsk_destruct (net/core/sock.c:2181)\n__sk_free (net/core/sock.c:2192)\nsk_free (net/core/sock.c:2203)\nllcp_sock_release (net/nfc/llcp_sock.c:646)\n__sock_release (net/socket.c:650)\nsock_close (net/socket.c:1365)\n__fput (fs/file_table.c:306)\ntask_work_run (kernel/task_work.c:179)\nptrace_notify (kernel/signal.c:2354)\nsyscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)\nsyscall_exit_to_user_mode (kernel/entry/common.c:296)\ndo_syscall_64 (arch/x86/entry/common.c:86)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)\n\nAllocated by task 4719:\nkasan_save_stack (mm/kasan/common.c:45)\n__kasan_slab_alloc (mm/kasan/common.c:325)\nslab_post_alloc_hook (mm/slab.h:766)\nkmem_cache_alloc_node (mm/slub.c:3497)\n__alloc_skb (net/core/skbuff.c:552)\npn533_recv_response (drivers/nfc/pn533/usb.c:65)\n__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671)\nusb_giveback_urb_bh (drivers/usb/core/hcd.c:1704)\ntasklet_action_common.isra.0 (kernel/softirq.c:797)\n__do_softirq (kernel/softirq.c:571)\n\nFreed by task 1901:\nkasan_save_stack (mm/kasan/common.c:45)\nkasan_set_track (mm/kasan/common.c:52)\nkasan_save_free_info (mm/kasan/genericdd.c:518)\n__kasan_slab_free (mm/kasan/common.c:236)\nkmem_cache_free (mm/slub.c:3809)\nkfree_skbmem (net/core/skbuff.c:874)\nkfree_skb (net/core/skbuff.c:931)\nlocal_cleanup (net/nfc/llcp_core.c:159)\nnfc_llcp_unregister_device (net/nfc/llcp_core.c:1617)\nnfc_unregister_device (net/nfc/core.c:1179)\npn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846)\npn533_usb_disconnect (drivers/nfc/pn533/usb.c:579)\nusb_unbind_interface (drivers/usb/core/driver.c:458)\ndevice_release_driver_internal (drivers/base/dd.c:1279)\nbus_remove_device (drivers/base/bus.c:529)\ndevice_del (drivers/base/core.c:3665)\nusb_disable_device (drivers/usb/core/message.c:1420)\nusb_disconnect (drivers/usb/core.c:2261)\nhub_event (drivers/usb/core/hub.c:5833)\nprocess_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281)\nworker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)\nkthread (kernel/kthread.c:319)\nret_from_fork (arch/x86/entry/entry_64.S:301)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "82ec2c76-4ac2-49b0-9a30-0375131e46f2",
      "id": "CVE-2023-53145",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition\n\nIn btsdio_probe, the data-\u003ework is bound with btsdio_work. It will be\nstarted in btsdio_send_frame.\n\nIf the btsdio_remove runs with a unfinished work, there may be a race\ncondition that hdev is freed but used in btsdio_work. Fix it by\ncanceling the work before do cleanup in btsdio_remove.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "610a2533-316a-4666-a021-b891c0dfa05a",
      "id": "CVE-2023-53436",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: snic: Fix possible memory leak if device_add() fails\n\nIf device_add() returns error, the name allocated by dev_set_name() needs\nbe freed. As the comment of device_add() says, put_device() should be used\nto give up the reference in the error path. So fix this by calling\nput_device(), then the name can be freed in kobject_cleanp().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0166be11-79a5-452d-bb4f-04e4340cd8d0",
      "id": "CVE-2023-53204",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix data-races around user-\u003eunix_inflight.\n\nuser-\u003eunix_inflight is changed under spin_lock(unix_gc_lock),\nbut too_many_unix_fds() reads it locklessly.\n\nLet's annotate the write/read accesses to user-\u003eunix_inflight.\n\nBUG: KCSAN: data-race in unix_attach_fds / unix_inflight\n\nwrite to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:\n unix_inflight+0x157/0x180 net/unix/scm.c:66\n unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123\n unix_scm_to_skb net/unix/af_unix.c:1827 [inline]\n unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950\n unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]\n unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292\n sock_sendmsg_nosec net/socket.c:725 [inline]\n sock_sendmsg+0x148/0x160 net/socket.c:748\n ____sys_sendmsg+0x4e4/0x610 net/socket.c:2494\n ___sys_sendmsg+0xc6/0x140 net/socket.c:2548\n __sys_sendmsg+0x94/0x140 net/socket.c:2577\n __do_sys_sendmsg net/socket.c:2586 [inline]\n __se_sys_sendmsg net/socket.c:2584 [inline]\n __x64_sys_sendmsg+0x45/0x50 net/socket.c:2584\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nread to 0xffffffff8546f2d0 of 8 bytes by task 44814 on cpu 0:\n too_many_unix_fds net/unix/scm.c:101 [inline]\n unix_attach_fds+0x54/0x1e0 net/unix/scm.c:110\n unix_scm_to_skb net/unix/af_unix.c:1827 [inline]\n unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950\n unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]\n unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292\n sock_sendmsg_nosec net/socket.c:725 [inline]\n sock_sendmsg+0x148/0x160 net/socket.c:748\n ____sys_sendmsg+0x4e4/0x610 net/socket.c:2494\n ___sys_sendmsg+0xc6/0x140 net/socket.c:2548\n __sys_sendmsg+0x94/0x140 net/socket.c:2577\n __do_sys_sendmsg net/socket.c:2586 [inline]\n __se_sys_sendmsg net/socket.c:2584 [inline]\n __x64_sys_sendmsg+0x45/0x50 net/socket.c:2584\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nvalue changed: 0x000000000000000c -\u003e 0x000000000000000d\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 44814 Comm: systemd-coredum Not tainted 6.4.0-11989-g6843306689af #6\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9d0036b4-8263-4892-8d26-3f1edbce6ab0",
      "id": "CVE-2023-53230",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix warning in cifs_smb3_do_mount()\n\nThis fixes the following warning reported by kernel test robot\n\n  fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible\n  memory leak of 'cifs_sb'",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "470d3b63-308b-4fd7-9018-f835c4849fb5",
      "id": "CVE-2023-53257",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check S1G action frame size\n\nBefore checking the action code, check that it even\nexists in the frame.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dc8644e0-2639-4ced-b60f-1798f0dd1fb8",
      "id": "CVE-2023-53287",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Put the cdns set active part outside the spin lock\n\nThe device may be scheduled during the resume process,\nso this cannot appear in atomic operations. Since\npm_runtime_set_active will resume suppliers, put set\nactive outside the spin lock, which is only used to\nprotect the struct cdns data structure, otherwise the\nkernel will report the following warning:\n\n  BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh\n  preempt_count: 1, expected: 0\n  RCU nest depth: 0, expected: 0\n  CPU: 0 PID: 651 Comm: sh Tainted: G        WC         6.1.20 #1\n  Hardware name: Freescale i.MX8QM MEK (DT)\n  Call trace:\n    dump_backtrace.part.0+0xe0/0xf0\n    show_stack+0x18/0x30\n    dump_stack_lvl+0x64/0x80\n    dump_stack+0x1c/0x38\n    __might_resched+0x1fc/0x240\n    __might_sleep+0x68/0xc0\n    __pm_runtime_resume+0x9c/0xe0\n    rpm_get_suppliers+0x68/0x1b0\n    __pm_runtime_set_status+0x298/0x560\n    cdns_resume+0xb0/0x1c0\n    cdns3_controller_resume.isra.0+0x1e0/0x250\n    cdns3_plat_resume+0x28/0x40",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cebad14-e011-4944-aaba-d4d1aa7e7c87",
      "id": "CVE-2023-53321",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: drop short frames\n\nWhile technically some control frames like ACK are shorter and\nend after Address 1, such frames shouldn't be forwarded through\nwmediumd or similar userspace, so require the full 3-address\nheader to avoid accessing invalid memory if shorter frames are\npassed in.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9ea74f7-cc77-40d8-8343-1b244ad778b2",
      "id": "CVE-2024-26594",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate mech token in session setup\n\nIf client send invalid mech token in session setup request, ksmbd\nvalidate and make the error if it is invalid.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1db13d8d-ae7b-42ac-b9c0-4d88c800a14b",
      "id": "CVE-2024-26669",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: flower: Fix chain template offload\n\nWhen a qdisc is deleted from a net device the stack instructs the\nunderlying driver to remove its flow offload callback from the\nassociated filter block using the 'FLOW_BLOCK_UNBIND' command. The stack\nthen continues to replay the removal of the filters in the block for\nthis driver by iterating over the chains in the block and invoking the\n'reoffload' operation of the classifier being used. In turn, the\nclassifier in its 'reoffload' operation prepares and emits a\n'FLOW_CLS_DESTROY' command for each filter.\n\nHowever, the stack does not do the same for chain templates and the\nunderlying driver never receives a 'FLOW_CLS_TMPLT_DESTROY' command when\na qdisc is deleted. This results in a memory leak [1] which can be\nreproduced using [2].\n\nFix by introducing a 'tmplt_reoffload' operation and have the stack\ninvoke it with the appropriate arguments as part of the replay.\nImplement the operation in the sole classifier that supports chain\ntemplates (flower) by emitting the 'FLOW_CLS_TMPLT_{CREATE,DESTROY}'\ncommand based on whether a flow offload callback is being bound to a\nfilter block or being unbound from one.\n\nAs far as I can tell, the issue happens since cited commit which\nreordered tcf_block_offload_unbind() before tcf_block_flush_all_chains()\nin __tcf_block_put(). The order cannot be reversed as the filter block\nis expected to be freed after flushing all the chains.\n\n[1]\nunreferenced object 0xffff888107e28800 (size 2048):\n  comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff  ..|......[......\n    01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff  ................\n  backtrace:\n    [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u003cffffffff81ab374e\u003e] __kmalloc+0x4e/0x90\n    [\u003cffffffff832aec6d\u003e] mlxsw_sp_acl_ruleset_get+0x34d/0x7a0\n    [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\n    [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\n    [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\n    [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\n    [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\n    [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\n    [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\n    [\u003cffffffff8379d29a\u003e] ___sys_sendmsg+0x13a/0x1e0\n    [\u003cffffffff8379d50c\u003e] __sys_sendmsg+0x11c/0x1f0\n    [\u003cffffffff843b9ce0\u003e] do_syscall_64+0x40/0xe0\nunreferenced object 0xffff88816d2c0400 (size 1024):\n  comm \"tc\", pid 1079, jiffies 4294958525 (age 3074.287s)\n  hex dump (first 32 bytes):\n    40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00  @.......W.8.....\n    10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff  ..,m......,m....\n  backtrace:\n    [\u003cffffffff81c06a68\u003e] __kmem_cache_alloc_node+0x1e8/0x320\n    [\u003cffffffff81ab36c1\u003e] __kmalloc_node+0x51/0x90\n    [\u003cffffffff81a8ed96\u003e] kvmalloc_node+0xa6/0x1f0\n    [\u003cffffffff82827d03\u003e] bucket_table_alloc.isra.0+0x83/0x460\n    [\u003cffffffff82828d2b\u003e] rhashtable_init+0x43b/0x7c0\n    [\u003cffffffff832aed48\u003e] mlxsw_sp_acl_ruleset_get+0x428/0x7a0\n    [\u003cffffffff832bc195\u003e] mlxsw_sp_flower_tmplt_create+0x145/0x180\n    [\u003cffffffff832b2e1a\u003e] mlxsw_sp_flow_block_cb+0x1ea/0x280\n    [\u003cffffffff83a10613\u003e] tc_setup_cb_call+0x183/0x340\n    [\u003cffffffff83a9f85a\u003e] fl_tmplt_create+0x3da/0x4c0\n    [\u003cffffffff83a22435\u003e] tc_ctl_chain+0xa15/0x1170\n    [\u003cffffffff838a863c\u003e] rtnetlink_rcv_msg+0x3cc/0xed0\n    [\u003cffffffff83ac87f0\u003e] netlink_rcv_skb+0x170/0x440\n    [\u003cffffffff83ac6270\u003e] netlink_unicast+0x540/0x820\n    [\u003cffffffff83ac6e28\u003e] netlink_sendmsg+0x8d8/0xda0\n    [\u003cffffffff83793def\u003e] ____sys_sendmsg+0x30f/0xa80\n\n[2]\n # tc qdisc add dev swp1 clsact\n # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32\n # tc qdisc del dev\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ce6e3710-36a3-4ec1-88aa-c86b11c79faf",
      "id": "CVE-2024-26974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - resolve race condition during AER recovery\n\nDuring the PCI AER system's error recovery process, the kernel driver\nmay encounter a race condition with freeing the reset_data structure's\nmemory. If the device restart will take more than 10 seconds the function\nscheduling that restart will exit due to a timeout, and the reset_data\nstructure will be freed. However, this data structure is used for\ncompletion notification after the restart is completed, which leads\nto a UAF bug.\n\nThis results in a KFENCE bug notice.\n\n  BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat]\n  Use-after-free read at 0x00000000bc56fddf (in kfence-#142):\n  adf_device_reset_worker+0x38/0xa0 [intel_qat]\n  process_one_work+0x173/0x340\n\nTo resolve this race condition, the memory associated to the container\nof the work_struct is freed on the worker if the timeout expired,\notherwise on the function that schedules the worker.\nThe timeout detection can be done by checking if the caller is\nstill waiting for completion or not by using completion_done() function.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c1d12b7d-9d7b-4f22-bf08-8531c422fd76",
      "id": "CVE-2024-26981",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix OOB in nilfs_set_de_type\n\nThe size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is\ndefined as \"S_IFMT \u003e\u003e S_SHIFT\", but the nilfs_set_de_type() function,\nwhich uses this array, specifies the index to read from the array in the\nsame way as \"(mode \u0026 S_IFMT) \u003e\u003e S_SHIFT\".\n\nstatic void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode\n *inode)\n{\n\tumode_t mode = inode-\u003ei_mode;\n\n\tde-\u003efile_type = nilfs_type_by_mode[(mode \u0026 S_IFMT)\u003e\u003eS_SHIFT]; // oob\n}\n\nHowever, when the index is determined this way, an out-of-bounds (OOB)\nerror occurs by referring to an index that is 1 larger than the array size\nwhen the condition \"mode \u0026 S_IFMT == S_IFMT\" is satisfied.  Therefore, a\npatch to resize the nilfs_type_by_mode array should be applied to prevent\nOOB errors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "771e3513-7481-46d9-85cd-67660a4a6b10",
      "id": "CVE-2021-47078",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Clear all QP fields if creation failed\n\nrxe_qp_do_cleanup() relies on valid pointer values in QP for the properly\ncreated ones, but in case rxe_qp_from_init() failed it was filled with\ngarbage and caused tot the following error.\n\n  refcount_t: underflow; use-after-free.\n  WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Modules linked in:\n  CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28\n  Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 \u003c0f\u003e 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55\n  RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67\n  RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000\n  R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800\n  R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000\n  FS:  00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   __refcount_sub_and_test include/linux/refcount.h:283 [inline]\n   __refcount_dec_and_test include/linux/refcount.h:315 [inline]\n   refcount_dec_and_test include/linux/refcount.h:333 [inline]\n   kref_put include/linux/kref.h:64 [inline]\n   rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805\n   execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327\n   rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391\n   kref_put include/linux/kref.h:65 [inline]\n   rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425\n   _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline]\n   ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231\n   ib_create_qp include/rdma/ib_verbs.h:3644 [inline]\n   create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920\n   ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline]\n   ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092\n   add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717\n   enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331\n   ib_register_device drivers/infiniband/core/device.c:1413 [inline]\n   ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365\n   rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147\n   rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247\n   rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503\n   rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline]\n   rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250\n   nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555\n   rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195\n   rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n   rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259\n   netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]\n   netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338\n   netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927\n   sock_sendmsg_nosec net/socket.c:654 [inline]\n   sock_sendmsg+0xcf/0x120 net/socket.c:674\n   ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350\n   ___sys_sendmsg+0xf3/0x170 net/socket.c:2404\n   __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433\n   do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47\n   entry_SYSCALL_64_after_hwframe+0\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2b8eca4-b376-48b3-943d-914daab97563",
      "id": "CVE-2024-27053",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix RCU usage in connect path\n\nWith lockdep enabled, calls to the connect function from cfg802.11 layer\nlead to the following warning:\n\n=============================\nWARNING: suspicious RCU usage\n6.7.0-rc1-wt+ #333 Not tainted\n-----------------------------\ndrivers/net/wireless/microchip/wilc1000/hif.c:386\nsuspicious rcu_dereference_check() usage!\n[...]\nstack backtrace:\nCPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333\nHardware name: Atmel SAMA5\n unwind_backtrace from show_stack+0x18/0x1c\n show_stack from dump_stack_lvl+0x34/0x48\n dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4\n wilc_parse_join_bss_param from connect+0x2c4/0x648\n connect from cfg80211_connect+0x30c/0xb74\n cfg80211_connect from nl80211_connect+0x860/0xa94\n nl80211_connect from genl_rcv_msg+0x3fc/0x59c\n genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8\n netlink_rcv_skb from genl_rcv+0x2c/0x3c\n genl_rcv from netlink_unicast+0x3b0/0x550\n netlink_unicast from netlink_sendmsg+0x368/0x688\n netlink_sendmsg from ____sys_sendmsg+0x190/0x430\n ____sys_sendmsg from ___sys_sendmsg+0x110/0x158\n ___sys_sendmsg from sys_sendmsg+0xe8/0x150\n sys_sendmsg from ret_fast_syscall+0x0/0x1c\n\nThis warning is emitted because in the connect path, when trying to parse\ntarget BSS parameters, we dereference a RCU pointer whithout being in RCU\ncritical section.\nFix RCU dereference usage by moving it to a RCU read critical section. To\navoid wrapping the whole wilc_parse_join_bss_param under the critical\nsection, just use the critical section to copy ies data",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9645de5f-4c1a-46e2-b24e-8ded4252368e",
      "id": "CVE-2024-27403",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: reset dst in route object after setting up flow\n\ndst is transferred to the flow object, route object does not own it\nanymore.  Reset dst in route object, otherwise if flow_offload_add()\nfails, error path releases dst twice, leading to a refcount underflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "da1792b3-1010-46f0-9054-463e5b581b68",
      "id": "CVE-2024-27413",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/capsule-loader: fix incorrect allocation size\n\ngcc-14 notices that the allocation with sizeof(void) on 32-bit architectures\nis not enough for a 64-bit phys_addr_t:\n\ndrivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open':\ndrivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size]\n  295 |         cap_info-\u003ephys = kzalloc(sizeof(void *), GFP_KERNEL);\n      |                        ^\n\nUse the correct type instead here.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8b7cb7af-396a-4972-a50b-5064f1ad24d3",
      "id": "CVE-2024-35823",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: fix unicode buffer corruption when deleting characters\n\nThis is the same issue that was fixed for the VGA text buffer in commit\n39cdb68c64d8 (\"vt: fix memory overlapping when deleting chars in the\nbuffer\"). The cure is also the same i.e. replace memcpy() with memmove()\ndue to the overlaping buffers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "190d9d0a-8a78-4d1b-8549-2ec3fe5620b1",
      "id": "CVE-2024-35865",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_valid_oplock_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a7bf2e6e-2835-4abe-a524-4cba6d8189ee",
      "id": "CVE-2024-35870",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in smb2_reconnect_server()\n\nThe UAF bug is due to smb2_reconnect_server() accessing a session that\nis already being teared down by another thread that is executing\n__cifs_put_smb_ses().  This can happen when (a) the client has\nconnection to the server but no session or (b) another thread ends up\nsetting @ses-\u003eses_status again to something different than\nSES_EXITING.\n\nTo fix this, we need to make sure to unconditionally set\n@ses-\u003eses_status to SES_EXITING and prevent any other threads from\nsetting a new status while we're still tearing it down.\n\nThe following can be reproduced by adding some delay to right after\nthe ipc is freed in __cifs_put_smb_ses() - which will give\nsmb2_reconnect_server() worker a chance to run and then accessing\n@ses-\u003eipc:\n\nkinit ...\nmount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10\n[disconnect srv]\nls /mnt/1 \u0026\u003e/dev/null\nsleep 30\nkdestroy\n[reconnect srv]\nsleep 10\numount /mnt/1\n...\nCIFS: VFS: Verify user has a krb5 ticket and keyutils is installed\nCIFS: VFS: \\\\srv Send error in SessSetup = -126\nCIFS: VFS: Verify user has a krb5 ticket and keyutils is installed\nCIFS: VFS: \\\\srv Send error in SessSetup = -126\ngeneral protection fault, probably for non-canonical address\n0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39\n04/01/2014\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\nRIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0\nCode: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad\nde 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 \u003c48\u003e 8b 01 48 39 f8 75\n7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8\nRSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83\nRAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b\nRDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800\nRBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000\nR13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000\nFS: 0000000000000000(0000) GS:ffff888157c00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? die_addr+0x36/0x90\n ? exc_general_protection+0x1c1/0x3f0\n ? asm_exc_general_protection+0x26/0x30\n ? __list_del_entry_valid_or_report+0x33/0xf0\n __cifs_put_smb_ses+0x1ae/0x500 [cifs]\n smb2_reconnect_server+0x4ed/0x710 [cifs]\n process_one_work+0x205/0x6b0\n worker_thread+0x191/0x360\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe2/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7176215c-88fc-43d1-b2f4-3b4547123355",
      "id": "CVE-2024-35947",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndyndbg: fix old BUG_ON in \u003econtrol parser\n\nFix a BUG_ON from 2009.  Even if it looks \"unreachable\" (I didn't\nreally look), lets make sure by removing it, doing pr_err and return\n-EINVAL instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d079e30c-6a37-4a92-8f84-6f721b49e812",
      "id": "CVE-2024-38589",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: fix possible dead-lock in nr_rt_ioctl()\n\nsyzbot loves netrom, and found a possible deadlock in nr_rt_ioctl [1]\n\nMake sure we always acquire nr_node_list_lock before nr_node_lock(nr_node)\n\n[1]\nWARNING: possible circular locking dependency detected\n6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 Not tainted\n------------------------------------------------------\nsyz-executor350/5129 is trying to acquire lock:\n ffff8880186e2070 (\u0026nr_node-\u003enode_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n ffff8880186e2070 (\u0026nr_node-\u003enode_lock){+...}-{2:2}, at: nr_node_lock include/net/netrom.h:152 [inline]\n ffff8880186e2070 (\u0026nr_node-\u003enode_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:464 [inline]\n ffff8880186e2070 (\u0026nr_node-\u003enode_lock){+...}-{2:2}, at: nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697\n\nbut task is already holding lock:\n ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline]\n ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #1 (nr_node_list_lock){+...}-{2:2}:\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754\n        __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]\n        _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178\n        spin_lock_bh include/linux/spinlock.h:356 [inline]\n        nr_remove_node net/netrom/nr_route.c:299 [inline]\n        nr_del_node+0x4b4/0x820 net/netrom/nr_route.c:355\n        nr_rt_ioctl+0xa95/0x1090 net/netrom/nr_route.c:683\n        sock_do_ioctl+0x158/0x460 net/socket.c:1222\n        sock_ioctl+0x629/0x8e0 net/socket.c:1341\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:904 [inline]\n        __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-\u003e #0 (\u0026nr_node-\u003enode_lock){+...}-{2:2}:\n        check_prev_add kernel/locking/lockdep.c:3134 [inline]\n        check_prevs_add kernel/locking/lockdep.c:3253 [inline]\n        validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869\n        __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754\n        __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]\n        _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178\n        spin_lock_bh include/linux/spinlock.h:356 [inline]\n        nr_node_lock include/net/netrom.h:152 [inline]\n        nr_dec_obs net/netrom/nr_route.c:464 [inline]\n        nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697\n        sock_do_ioctl+0x158/0x460 net/socket.c:1222\n        sock_ioctl+0x629/0x8e0 net/socket.c:1341\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:904 [inline]\n        __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nother info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(nr_node_list_lock);\n                               lock(\u0026nr_node-\u003enode_lock);\n                               lock(nr_node_list_lock);\n  lock(\u0026nr_node-\u003enode_lock);\n\n *** DEADLOCK ***\n\n1 lock held by syz-executor350/5129:\n  #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n  #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline]\n  #0: ffffffff8f70\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d65e8cc-947f-45bd-8e1b-7d50e9173e65",
      "id": "CVE-2024-39494",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Fix use-after-free on a dentry's dname.name\n\n-\u003ed_name.name can change on rename and the earlier value can be freed;\nthere are conditions sufficient to stabilize it (-\u003ed_lock on dentry,\n-\u003ed_lock on its parent, -\u003ei_rwsem exclusive on the parent's inode,\nrename_lock), but none of those are met at any of the sites. Take a stable\nsnapshot of the name instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d4127356-0cf3-4a06-9ef3-bda570823712",
      "id": "CVE-2024-40961",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible NULL deref in fib6_nh_init()\n\nsyzbot reminds us that in6_dev_get() can return NULL.\n\nfib6_nh_init()\n    ip6_validate_gw(  \u0026idev  )\n        ip6_route_check_nh(  idev  )\n            *idev = in6_dev_get(dev); // can be NULL\n\nOops: general protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 11237 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00249-gbe27b8965297 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024\n RIP: 0010:fib6_nh_init+0x640/0x2160 net/ipv6/route.c:3606\nCode: 00 00 fc ff df 4c 8b 64 24 58 48 8b 44 24 28 4c 8b 74 24 30 48 89 c1 48 89 44 24 28 48 8d 98 e0 05 00 00 48 89 d8 48 c1 e8 03 \u003c42\u003e 0f b6 04 38 84 c0 0f 85 b3 17 00 00 8b 1b 31 ff 89 de e8 b8 8b\nRSP: 0018:ffffc900032775a0 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000000000\nRDX: 0000000000000010 RSI: ffffc90003277a54 RDI: ffff88802b3a08d8\nRBP: ffffc900032778b0 R08: 00000000000002fc R09: 0000000000000000\nR10: 00000000000002fc R11: 0000000000000000 R12: ffff88802b3a08b8\nR13: 1ffff9200064eec8 R14: ffffc90003277a00 R15: dffffc0000000000\nFS:  00007f940feb06c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000245e8000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  ip6_route_info_create+0x99e/0x12b0 net/ipv6/route.c:3809\n  ip6_route_add+0x28/0x160 net/ipv6/route.c:3853\n  ipv6_route_ioctl+0x588/0x870 net/ipv6/route.c:4483\n  inet6_ioctl+0x21a/0x280 net/ipv6/af_inet6.c:579\n  sock_do_ioctl+0x158/0x460 net/socket.c:1222\n  sock_ioctl+0x629/0x8e0 net/socket.c:1341\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f940f07cea9",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99655bb2-dc13-41f2-8cdf-38aac29ee220",
      "id": "CVE-2024-40987",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix UBSAN warning in kv_dpm.c\n\nAdds bounds check for sumo_vid_mapping_entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83cc00b2-47fb-41b4-be55-b2af0b10e4ee",
      "id": "CVE-2024-40990",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Add check for srq max_sge attribute\n\nmax_sge attribute is passed by the user, and is inserted and used\nunchecked, so verify that the value doesn't exceed maximum allowed value\nbefore using it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c245e158-0240-4066-b47e-9ec2200ad8e6",
      "id": "CVE-2024-43835",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix napi_skb_cache_put warning\n\nAfter the commit bdacf3e34945 (\"net: Use nested-BH locking for\nnapi_alloc_cache.\") was merged, the following warning began to appear:\n\n\t WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0\n\n\t  __warn+0x12f/0x340\n\t  napi_skb_cache_put+0x82/0x4b0\n\t  napi_skb_cache_put+0x82/0x4b0\n\t  report_bug+0x165/0x370\n\t  handle_bug+0x3d/0x80\n\t  exc_invalid_op+0x1a/0x50\n\t  asm_exc_invalid_op+0x1a/0x20\n\t  __free_old_xmit+0x1c8/0x510\n\t  napi_skb_cache_put+0x82/0x4b0\n\t  __free_old_xmit+0x1c8/0x510\n\t  __free_old_xmit+0x1c8/0x510\n\t  __pfx___free_old_xmit+0x10/0x10\n\nThe issue arises because virtio is assuming it's running in NAPI context\neven when it's not, such as in the netpoll case.\n\nTo resolve this, modify virtnet_poll_tx() to only set NAPI when budget\nis available. Same for virtnet_poll_cleantx(), which always assumed that\nit was in a NAPI context.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "88849cae-4667-4411-b8e9-3ea16abaa3ad",
      "id": "CVE-2024-40999",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: Add validation for completion descriptors consistency\n\nValidate that `first` flag is set only for the first\ndescriptor in multi-buffer packets.\nIn case of an invalid descriptor, a reset will occur.\nA new reset reason for RX data corruption has been added.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "86216ed6-aefe-4966-b431-b9e687d2af37",
      "id": "CVE-2024-41014",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: add bounds checking to xlog_recover_process_data\n\nThere is a lack of verification of the space occupied by fixed members\nof xlog_op_header in the xlog_recover_process_data.\n\nWe can create a crafted image to trigger an out of bounds read by\nfollowing these steps:\n    1) Mount an image of xfs, and do some file operations to leave records\n    2) Before umounting, copy the image for subsequent steps to simulate\n       abnormal exit. Because umount will ensure that tail_blk and\n       head_blk are the same, which will result in the inability to enter\n       xlog_recover_process_data\n    3) Write a tool to parse and modify the copied image in step 2\n    4) Make the end of the xlog_op_header entries only 1 byte away from\n       xlog_rec_header-\u003eh_size\n    5) xlog_rec_header-\u003eh_num_logops++\n    6) Modify xlog_rec_header-\u003eh_crc\n\nFix:\nAdd a check to make sure there is sufficient space to access fixed members\nof xlog_op_header.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "97927f88-a88d-4f8e-9f63-60566d4563ed",
      "id": "CVE-2024-42067",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()\n\nset_memory_rox() can fail, leaving memory unprotected.\n\nCheck return and bail out when bpf_jit_binary_lock_ro() returns\nan error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "967d4038-4ad5-4acc-8caf-a06cd30429ce",
      "id": "CVE-2024-42157",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Wipe sensitive data on failure\n\nWipe sensitive data from stack also if the copy_to_user() fails.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63582bfe-2f92-4363-9f37-d23c6c19fb40",
      "id": "CVE-2024-42228",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc\n\nInitialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001.\nV2: To really improve the handling we would actually\n   need to have a separate value of 0xffffffff.(Christian)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cea2d6c-e419-4f27-945f-cf55786bced0",
      "id": "CVE-2024-46747",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup\n\nreport_fixup for the Cougar 500k Gaming Keyboard was not verifying\nthat the report descriptor size was correct before accessing it",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e8bfce15-ff4e-467e-b5d3-b9c2dde71d15",
      "id": "CVE-2024-43839",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbna: adjust 'name' buf size of bna_tcb and bna_ccb structures\n\nTo have enough space to write all possible sprintf() args. Currently\n'name' size is 16, but the first '%s' specifier may already need at\nleast 16 characters, since 'bnad-\u003enetdev-\u003ename' is used there.\n\nFor '%d' specifiers, assume that they require:\n * 1 char for 'tx_id + tx_info-\u003etcb[i]-\u003eid' sum, BNAD_MAX_TXQ_PER_TX is 8\n * 2 chars for 'rx_id + rx_info-\u003erx_ctrl[i].ccb-\u003eid', BNAD_MAX_RXP_PER_RX\n   is 16\n\nAnd replace sprintf with snprintf.\n\nDetected using the static analysis tool - Svace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ba360944-1b44-4709-acdb-047f4a325b37",
      "id": "CVE-2024-43880",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_erp: Fix object nesting warning\n\nACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM\n(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can\ncontain more ACLs (i.e., tc filters), but the number of masks in each\nregion (i.e., tc chain) is limited.\n\nIn order to mitigate the effects of the above limitation, the device\nallows filters to share a single mask if their masks only differ in up\nto 8 consecutive bits. For example, dst_ip/25 can be represented using\ndst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the\nnumber of masks being used (and therefore does not support mask\naggregation), but can contain a limited number of filters.\n\nThe driver uses the \"objagg\" library to perform the mask aggregation by\npassing it objects that consist of the filter's mask and whether the\nfilter is to be inserted into the A-TCAM or the C-TCAM since filters in\ndifferent TCAMs cannot share a mask.\n\nThe set of created objects is dependent on the insertion order of the\nfilters and is not necessarily optimal. Therefore, the driver will\nperiodically ask the library to compute a more optimal set (\"hints\") by\nlooking at all the existing objects.\n\nWhen the library asks the driver whether two objects can be aggregated\nthe driver only compares the provided masks and ignores the A-TCAM /\nC-TCAM indication. This is the right thing to do since the goal is to\nmove as many filters as possible to the A-TCAM. The driver also forbids\ntwo identical masks from being aggregated since this can only happen if\none was intentionally put in the C-TCAM to avoid a conflict in the\nA-TCAM.\n\nThe above can result in the following set of hints:\n\nH1: {mask X, A-TCAM} -\u003e H2: {mask Y, A-TCAM} // X is Y + delta\nH3: {mask Y, C-TCAM} -\u003e H4: {mask Z, A-TCAM} // Y is Z + delta\n\nAfter getting the hints from the library the driver will start migrating\nfilters from one region to another while consulting the computed hints\nand instructing the device to perform a lookup in both regions during\nthe transition.\n\nAssuming a filter with mask X is being migrated into the A-TCAM in the\nnew region, the hints lookup will return H1. Since H2 is the parent of\nH1, the library will try to find the object associated with it and\ncreate it if necessary in which case another hints lookup (recursive)\nwill be performed. This hints lookup for {mask Y, A-TCAM} will either\nreturn H2 or H3 since the driver passes the library an object comparison\nfunction that ignores the A-TCAM / C-TCAM indication.\n\nThis can eventually lead to nested objects which are not supported by\nthe library [1].\n\nFix by removing the object comparison function from both the driver and\nthe library as the driver was the only user. That way the lookup will\nonly return exact matches.\n\nI do not have a reliable reproducer that can reproduce the issue in a\ntimely manner, but before the fix the issue would reproduce in several\nminutes and with the fix it does not reproduce in over an hour.\n\nNote that the current usefulness of the hints is limited because they\ninclude the C-TCAM indication and represent aggregation that cannot\nactually happen. This will be addressed in net-next.\n\n[1]\nWARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0\nModules linked in:\nCPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42\nHardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:objagg_obj_parent_assign+0xb5/0xd0\n[...]\nCall Trace:\n \u003cTASK\u003e\n __objagg_obj_get+0x2bb/0x580\n objagg_obj_get+0xe/0x80\n mlxsw_sp_acl_erp_mask_get+0xb5/0xf0\n mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bec7383d-501b-42a7-9c10-33e7b1797c1d",
      "id": "CVE-2024-43890",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix overflow in get_free_elt()\n\n\"tracing_map-\u003enext_elt\" in get_free_elt() is at risk of overflowing.\n\nOnce it overflows, new elements can still be inserted into the tracing_map\neven though the maximum number of elements (`max_elts`) has been reached.\nContinuing to insert elements after the overflow could result in the\ntracing_map containing \"tracing_map-\u003emax_size\" elements, leaving no empty\nentries.\nIf any attempt is made to insert an element into a full tracing_map using\n`__tracing_map_insert()`, it will cause an infinite loop with preemption\ndisabled, leading to a CPU hang problem.\n\nFix this by preventing any further increments to \"tracing_map-\u003enext_elt\"\nonce it reaches \"tracing_map-\u003emax_elt\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5e15c851-041f-4cc9-99fa-f31b347db367",
      "id": "CVE-2024-44965",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Fix pti_clone_pgtable() alignment assumption\n\nGuenter reported dodgy crashes on an i386-nosmp build using GCC-11\nthat had the form of endless traps until entry stack exhaust and then\n#DF from the stack guard.\n\nIt turned out that pti_clone_pgtable() had alignment assumptions on\nthe start address, notably it hard assumes start is PMD aligned. This\nis true on x86_64, but very much not true on i386.\n\nThese assumptions can cause the end condition to malfunction, leading\nto a 'short' clone. Guess what happens when the user mapping has a\nshort copy of the entry text?\n\nUse the correct increment form for addr to avoid alignment\nassumptions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "96da3c61-b495-436d-b890-59cf22ecbc5a",
      "id": "CVE-2024-46752",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: replace BUG_ON() with error handling at update_ref_for_cow()\n\nInstead of a BUG_ON() just return an error, log an error message and\nabort the transaction in case we find an extent buffer belonging to the\nrelocation tree that doesn't have the full backref flag set. This is\nunexpected and should never happen (save for bugs or a potential bad\nmemory).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bf3cb9a1-0830-4aad-851a-d2cd13b55644",
      "id": "CVE-2024-46809",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check BIOS images before it is used\n\nBIOS images may fail to load and null checks are added before they are\nused.\n\nThis fixes 6 NULL_RETURNS issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0bb4d040-ff02-4c8f-b972-9c0b11dc7486",
      "id": "CVE-2024-47670",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: add bounds checking to ocfs2_xattr_find_entry()\n\nAdd a paranoia check to make sure it doesn't stray beyond valid memory\nregion containing ocfs2 xattr entries when scanning for a match.  It will\nprevent out-of-bound access in case of crafted images.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14e43d33-9c19-43fb-9c9a-25994c087d50",
      "id": "CVE-2024-47673",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: pause TCM when the firmware is stopped\n\nNot doing so will make us send a host command to the transport while the\nfirmware is not alive, which will trigger a WARNING.\n\nbad state = 0\nWARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]\nRIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]\nCall Trace:\n \u003cTASK\u003e\n iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm]\n iwl_mvm_config_scan+0x198/0x260 [iwlmvm]\n iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm]\n iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm]\n process_one_work+0x29e/0x640\n worker_thread+0x2df/0x690\n ? rescuer_thread+0x540/0x540\n kthread+0x192/0x1e0\n ? set_kthread_struct+0x90/0x90\n ret_from_fork+0x22/0x30",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2271891f-fd15-4724-af63-2fda37d0ad93",
      "id": "CVE-2024-47742",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Block path traversal\n\nMost firmware names are hardcoded strings, or are constructed from fairly\nconstrained format strings where the dynamic parts are just some hex\nnumbers or such.\n\nHowever, there are a couple codepaths in the kernel where firmware file\nnames contain string components that are passed through from a device or\nsemi-privileged userspace; the ones I could find (not counting interfaces\nthat require root privileges) are:\n\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\n   filename from \"ModelName\", a string that was previously parsed out of\n   some descriptor (\"Vital Product Data\") in lpfc_fill_vpd()\n - nfp_net_fw_find() seems to construct a firmware filename from a model\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \"nffw.partno\"), which I\n   think parses some descriptor that was read from the device.\n   (But this case likely isn't exploitable because the format string looks\n   like \"netronome/nic_%s\", and there shouldn't be any *folders* starting\n   with \"netronome/nic_\". The previous case was different because there,\n   the \"%s\" is *at the start* of the format string.)\n - module_flash_fw_schedule() is reachable from the\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\n   enough to pass the privilege check), and takes a userspace-provided\n   firmware name.\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\n   network namespace that a special kind of ethernet device is mapped into,\n   so I think this is not a viable attack path in practice.)\n\nFix it by rejecting any firmware names containing \"..\" path components.\n\nFor what it's worth, I went looking and haven't found any USB device\ndrivers that use the firmware loader dangerously.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e053532f-f87e-47db-831e-2fa64874bb78",
      "id": "CVE-2024-49917",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr-\u003efuncs in dcn30_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn30_init_hw` function. The issue could occur when `dc-\u003eclk_mgr` or\n`dc-\u003eclk_mgr-\u003efuncs` is null.\n\nThe fix adds a check to ensure `dc-\u003eclk_mgr` and `dc-\u003eclk_mgr-\u003efuncs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc-\u003eclk_mgr' could be null (see line 628)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "89b75716-fcff-4dc1-8bad-dd900e46b2fe",
      "id": "CVE-2024-49919",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn201_acquire_free_pipe_for_layer` function. The issue could occur\nwhen `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016 dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe' could be null (see line 1010)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "478f1814-b31b-4a46-a7d2-b4112b0e1d59",
      "id": "CVE-2024-49920",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before multiple uses\n\n[WHAT \u0026 HOW]\nPoniters, such as stream_enc and dc-\u003ebw_vbios, are null checked previously\nin the same function, so Coverity warns \"implies that stream_enc and\ndc-\u003ebw_vbios might be null\". They are used multiple times in the\nsubsequent code and need to be checked.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ae1ef0d3-a03b-459a-a372-706d491b4b38",
      "id": "CVE-2024-49930",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx()\nfunction access ath11k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To fix\nthis issue, modify ath11k_dp_process_rx() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff9db969-8e2c-4994-a970-033c7816b0ac",
      "id": "CVE-2024-50269",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: sunxi: Fix accessing an released usb phy\n\nCommit 6ed05c68cbca (\"usb: musb: sunxi: Explicitly release USB PHY on\nexit\") will cause that usb phy @glue-\u003exceiv is accessed after released.\n\n1) register platform driver @sunxi_musb_driver\n// get the usb phy @glue-\u003exceiv\nsunxi_musb_probe() -\u003e devm_usb_get_phy().\n\n2) register and unregister platform driver @musb_driver\nmusb_probe() -\u003e sunxi_musb_init()\nuse the phy here\n//the phy is released here\nmusb_remove() -\u003e sunxi_musb_exit() -\u003e devm_usb_put_phy()\n\n3) register @musb_driver again\nmusb_probe() -\u003e sunxi_musb_init()\nuse the phy here but the phy has been released at 2).\n...\n\nFixed by reverting the commit, namely, removing devm_usb_put_phy()\nfrom sunxi_musb_exit().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5f73934c-12a5-4065-8052-fc2329376a54",
      "id": "CVE-2024-50302",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: zero-initialize the report buffer\n\nSince the report buffer is used by all kinds of drivers in various ways, let's\nzero-initialize it during allocation to make sure that it can't be ever used\nto leak kernel memory via specially-crafted report.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "806dc20c-6c89-4060-bfc9-9a61a2409a99",
      "id": "CVE-2025-22125",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: don't ignore IO flags\n\nIf blk-wbt is enabled by default, it's found that raid write performance\nis quite bad because all IO are throttled by wbt of underlying disks,\ndue to flag REQ_IDLE is ignored. And turns out this behaviour exist since\nblk-wbt is introduced.\n\nOther than REQ_IDLE, other flags should not be ignored as well, for\nexample REQ_META can be set for filesystems, clearing it can cause priority\nreverse problems; And REQ_NOWAIT should not be cleared as well, because\nio will wait instead of failing directly in underlying disks.\n\nFix those problems by keep IO flags from master bio.\n\nFises: f51d46d0e7cb (\"md: add support for REQ_NOWAIT\")",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4afe516e-4394-422a-a082-1c164eae09a8",
      "id": "CVE-2024-56558",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: make sure exp active before svc_export_show\n\nThe function `e_show` was called with protection from RCU. This only\nensures that `exp` will not be freed. Therefore, the reference count for\n`exp` can drop to zero, which will trigger a refcount use-after-free\nwarning when `exp_get` is called. To resolve this issue, use\n`cache_get_rcu` to ensure that `exp` remains active.\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 3 PID: 819 at lib/refcount.c:25\nrefcount_warn_saturate+0xb1/0x120\nCPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xb1/0x120\n...\nCall Trace:\n \u003cTASK\u003e\n e_show+0x20b/0x230 [nfsd]\n seq_read_iter+0x589/0x770\n seq_read+0x1e5/0x270\n vfs_read+0x125/0x530\n ksys_read+0xc1/0x160\n do_syscall_64+0x5f/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d7cf7f66-bbf3-4b60-8835-f3b89a4c5b4b",
      "id": "CVE-2024-56562",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()\n\nif (dev-\u003eboardinfo \u0026\u0026 dev-\u003eboardinfo-\u003einit_dyn_addr)\n                                      ^^^ here check \"init_dyn_addr\"\n\ti3c_bus_set_addr_slot_status(\u0026master-\u003ebus, dev-\u003einfo.dyn_addr, ...)\n\t\t\t\t\t\t             ^^^^\n\t\t\t\t\t\t\tfree \"dyn_addr\"\nFix copy/paste error \"dyn_addr\" by replacing it with \"init_dyn_addr\".",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ae27b5a-5450-402a-8e76-0f42c0032297",
      "id": "CVE-2024-56650",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n \u003c/TASK\u003e\n\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "be772143-f07c-4627-8c46-4214d0f418d6",
      "id": "CVE-2024-57843",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9004684a-30aa-4883-96df-b1df83a664b5",
      "id": "CVE-2024-57900",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nila: serialize calls to nf_register_net_hooks()\n\nsyzbot found a race in ila_add_mapping() [1]\n\ncommit 031ae72825ce (\"ila: call nf_unregister_net_hooks() sooner\")\nattempted to fix a similar issue.\n\nLooking at the syzbot repro, we have concurrent ILA_CMD_ADD commands.\n\nAdd a mutex to make sure at most one thread is calling nf_register_net_hooks().\n\n[1]\n BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]\n BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604\nRead of size 4 at addr ffff888028f40008 by task dhcpcd/5501\n\nCPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n \u003cIRQ\u003e\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0xc3/0x620 mm/kasan/report.c:489\n  kasan_report+0xd9/0x110 mm/kasan/report.c:602\n  rht_key_hashfn include/linux/rhashtable.h:159 [inline]\n  __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604\n  rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n  rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n  ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline]\n  ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]\n  ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626\n  nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269\n  NF_HOOK include/linux/netfilter.h:312 [inline]\n  ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309\n  __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672\n  __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785\n  process_backlog+0x443/0x15f0 net/core/dev.c:6117\n  __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883\n  napi_poll net/core/dev.c:6952 [inline]\n  net_rx_action+0xa94/0x1010 net/core/dev.c:7074\n  handle_softirqs+0x213/0x8f0 kernel/softirq.c:561\n  __do_softirq kernel/softirq.c:595 [inline]\n  invoke_softirq kernel/softirq.c:435 [inline]\n  __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n  sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "49b7c036-9d45-497f-aa14-48f1603d70fb",
      "id": "CVE-2025-21672",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix merge preference rule failure condition\n\nsyzbot reported a lock held when returning to userspace[1].  This is\nbecause if argc is less than 0 and the function returns directly, the held\ninode lock is not released.\n\nFix this by store the error in ret and jump to done to clean up instead of\nreturning directly.\n\n[dh: Modified Lizhi Xu's original patch to make it honour the error code\nfrom afs_split_string()]\n\n[1]\nWARNING: lock held when returning to user space!\n6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted\n------------------------------------------------\nsyz-executor133/5823 is leaving the kernel with locks still held!\n1 lock held by syz-executor133/5823:\n #0: ffff888071cffc00 (\u0026sb-\u003es_type-\u003ei_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]\n #0: ffff888071cffc00 (\u0026sb-\u003es_type-\u003ei_mutex_key#9){++++}-{4:4}, at: afs_proc_addr_prefs_write+0x2bb/0x14e0 fs/afs/addr_prefs.c:388",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "02100ace-cfda-4db9-b11c-2cc1e2616468",
      "id": "CVE-2025-37856",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: harden block_group::bg_list against list_del() races\n\nAs far as I can tell, these calls of list_del_init() on bg_list cannot\nrun concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),\nas they are in transaction error paths and situations where the block\ngroup is readonly.\n\nHowever, if there is any chance at all of racing with mark_bg_unused(),\nor a different future user of bg_list, better to be safe than sorry.\n\nOtherwise we risk the following interleaving (bg_list refcount in parens)\n\nT1 (some random op)                       T2 (btrfs_mark_bg_unused)\n                                        !list_empty(\u0026bg-\u003ebg_list); (1)\nlist_del_init(\u0026bg-\u003ebg_list); (1)\n                                        list_move_tail (1)\nbtrfs_put_block_group (0)\n                                        btrfs_delete_unused_bgs\n                                             bg = list_first_entry\n                                             list_del_init(\u0026bg-\u003ebg_list);\n                                             btrfs_put_block_group(bg); (-1)\n\nUltimately, this results in a broken ref count that hits zero one deref\nearly and the real final deref underflows the refcount, resulting in a WARNING.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d71cba90-1404-4716-a0fd-fdb050970d9a",
      "id": "CVE-2025-38039",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled\n\nWhen attempting to enable MQPRIO while HTB offload is already\nconfigured, the driver currently returns `-EINVAL` and triggers a\n`WARN_ON`, leading to an unnecessary call trace.\n\nUpdate the code to handle this case more gracefully by returning\n`-EOPNOTSUPP` instead, while also providing a helpful user message.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "791f57e3-e0b1-4d74-8353-9e392144137d",
      "id": "CVE-2025-38115",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: fix a potential crash on gso_skb handling\n\nSFQ has an assumption of always being able to queue at least one packet.\n\nHowever, after the blamed commit, sch-\u003eq.len can be inflated by packets\nin sch-\u003egso_skb, and an enqueue() on an empty SFQ qdisc can be followed\nby an immediate drop.\n\nFix sfq_drop() to properly clear q-\u003etail in this situation.\n\n\nip netns add lb\nip link add dev to-lb type veth peer name in-lb netns lb\nethtool -K to-lb tso off                 # force qdisc to requeue gso_skb\nip netns exec lb ethtool -K in-lb gro on # enable NAPI\nip link set dev to-lb up\nip -netns lb link set dev in-lb up\nip addr add dev to-lb 192.168.20.1/24\nip -netns lb addr add dev in-lb 192.168.20.2/24\ntc qdisc replace dev to-lb root sfq limit 100\n\nip netns exec lb netserver\n\nnetperf -H 192.168.20.2 -l 100 \u0026\nnetperf -H 192.168.20.2 -l 100 \u0026\nnetperf -H 192.168.20.2 -l 100 \u0026\nnetperf -H 192.168.20.2 -l 100 \u0026",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2c28d52-5521-4132-bf82-13dd7655c28c",
      "id": "CVE-2025-38185",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: atmtcp: Free invalid length skb in atmtcp_c_send().\n\nsyzbot reported the splat below. [0]\n\nvcc_sendmsg() copies data passed from userspace to skb and passes\nit to vcc-\u003edev-\u003eops-\u003esend().\n\natmtcp_c_send() accesses skb-\u003edata as struct atmtcp_hdr after\nchecking if skb-\u003elen is 0, but it's not enough.\n\nAlso, when skb-\u003elen == 0, skb and sk (vcc) were leaked because\ndev_kfree_skb() is not called and sk_wmem_alloc adjustment is missing\nto revert atm_account_tx() in vcc_sendmsg(), which is expected\nto be done in atm_pop_raw().\n\nLet's properly free skb with an invalid length in atmtcp_c_send().\n\n[0]:\nBUG: KMSAN: uninit-value in atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294\n atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294\n vcc_sendmsg+0xd7c/0xff0 net/atm/common.c:644\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:727\n ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620\n __sys_sendmsg net/socket.c:2652 [inline]\n __do_sys_sendmsg net/socket.c:2657 [inline]\n __se_sys_sendmsg net/socket.c:2655 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655\n x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4154 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4249\n kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:579\n __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670\n alloc_skb include/linux/skbuff.h:1336 [inline]\n vcc_sendmsg+0xb40/0xff0 net/atm/common.c:628\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:727\n ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620\n __sys_sendmsg net/socket.c:2652 [inline]\n __do_sys_sendmsg net/socket.c:2657 [inline]\n __se_sys_sendmsg net/socket.c:2655 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655\n x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8a949398-6f60-405c-8d7a-83c2cb2bbda2",
      "id": "CVE-2025-38212",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: fix to protect IPCS lookups using RCU\n\nsyzbot reported that it discovered a use-after-free vulnerability, [0]\n\n[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/\n\nidr_for_each() is protected by rwsem, but this is not enough.  If it is\nnot protected by RCU read-critical region, when idr_for_each() calls\nradix_tree_node_free() through call_rcu() to free the radix_tree_node\nstructure, the node will be freed immediately, and when reading the next\nnode in radix_tree_for_each_slot(), the already freed memory may be read.\n\nTherefore, we need to add code to make sure that idr_for_each() is\nprotected within the RCU read-critical region when we call it in\nshm_destroy_orphaned().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4d1d5d7c-22ea-4b9c-9ef8-e8efbae79650",
      "id": "CVE-2025-39726",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ism: fix concurrency management in ism_cmd()\n\nThe s390x ISM device data sheet clearly states that only one\nrequest-response sequence is allowable per ISM function at any point in\ntime.  Unfortunately as of today the s390/ism driver in Linux does not\nhonor that requirement. This patch aims to rectify that.\n\nThis problem was discovered based on Aliaksei's bug report which states\nthat for certain workloads the ISM functions end up entering error state\n(with PEC 2 as seen from the logs) after a while and as a consequence\nconnections handled by the respective function break, and for future\nconnection requests the ISM device is not considered -- given it is in a\ndysfunctional state. During further debugging PEC 3A was observed as\nwell.\n\nA kernel message like\n[ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a\nis a reliable indicator of the stated function entering error state\nwith PEC 2. Let me also point out that a kernel message like\n[ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery\nis a reliable indicator that the ISM function won't be auto-recovered\nbecause the ISM driver currently lacks support for it.\n\nOn a technical level, without this synchronization, commands (inputs to\nthe FW) may be partially or fully overwritten (corrupted) by another CPU\ntrying to issue commands on the same function. There is hard evidence that\nthis can lead to DMB token values being used as DMB IOVAs, leading to\nPEC 2 PCI events indicating invalid DMA. But this is only one of the\nfailure modes imaginable. In theory even completely losing one command\nand executing another one twice and then trying to interpret the outputs\nas if the command we intended to execute was actually executed and not\nthe other one is also possible.  Frankly, I don't feel confident about\nproviding an exhaustive list of possible consequences.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e5675e64-dae1-4284-85fc-d0af1c4d20d8",
      "id": "CVE-2022-49526",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: don't set sb values if can't pass sanity check\n\nIf bitmap area contains invalid data, kernel will crash then mdadm\ntriggers \"Segmentation fault\".\nThis is cluster-md speical bug. In non-clustered env, mdadm will\nhandle broken metadata case. In clustered array, only kernel space\nhandles bitmap slot info. But even this bug only happened in clustered\nenv, current sanity check is wrong, the code should be changed.\n\nHow to trigger: (faulty injection)\n\ndd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda\ndd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb\nmdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb\nmdadm -Ss\necho aaa \u003e magic.txt\n == below modifying slot 2 bitmap data ==\ndd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 \u003c== destroy magic\ndd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 \u003c== ZERO chunksize\nmdadm -A /dev/md0 /dev/sda /dev/sdb\n == kernel crashes. mdadm outputs \"Segmentation fault\" ==\n\nReason of kernel crash:\n\nIn md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't\nblock chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T()\ntrigger \"divide error\".\n\nCrash log:\n\nkernel: md: md0 stopped.\nkernel: md/raid1:md0: not clean -- starting background reconstruction\nkernel: md/raid1:md0: active with 2 out of 2 mirrors\nkernel: dlm: ... ...\nkernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1\nkernel: md0: invalid bitmap file superblock: bad magic\nkernel: md_bitmap_copy_from_slot can't get bitmap from slot 2\nkernel: md-cluster: Could not gather bitmaps from slot 2\nkernel: divide error: 0000 [#1] SMP NOPTI\nkernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default\nkernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nkernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod]\nkernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246\nkernel: ... ...\nkernel: Call Trace:\nkernel:  ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0]\nkernel:  md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a]\nkernel:  load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0]\nkernel:  md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a]\nkernel:  do_md_run+0x30/0x100 [md_mod 24ea..d3a]\nkernel:  md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a]\nkernel:  ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a]\nkernel:  ? blkdev_ioctl+0xb1/0x2b0\nkernel:  block_ioctl+0x3b/0x40\nkernel:  __x64_sys_ioctl+0x7f/0xb0\nkernel:  do_syscall_64+0x59/0x80\nkernel:  ? exit_to_user_mode_prepare+0x1ab/0x230\nkernel:  ? syscall_exit_to_user_mode+0x18/0x40\nkernel:  ? do_syscall_64+0x69/0x80\nkernel:  entry_SYSCALL_64_after_hwframe+0x44/0xae\nkernel: RIP: 0033:0x7f4a15fa722b\nkernel: ... ...\nkernel: ---[ end trace 8afa7612f559c868 ]---\nkernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1a4450dd-6d56-4669-a6b9-42cad401c292",
      "id": "CVE-2019-3887",
      "description": "A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "55f9f3d4-17a6-40e6-912f-49ade691839c",
      "id": "CVE-2020-11609",
      "description": "An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fd3fd3c3-c1d5-437c-9a24-47c5af14786a",
      "id": "CVE-2020-25643",
      "description": "A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d324adb8-83cb-497e-b5db-2b6df3ecd3f1",
      "id": "CVE-2020-27815",
      "description": "A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f6c5a95e-f92f-4ba9-9f0b-4cac41cfafa6",
      "id": "CVE-2021-23133",
      "description": "A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)-\u003esctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0458f340-7a2e-43ae-868e-f6216a43d470",
      "id": "CVE-2021-3573",
      "description": "A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ea71d235-0331-4430-a4eb-214a1c1713b5",
      "id": "CVE-2023-0459",
      "description": "Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the \"access_ok\" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6a149e9-dd5c-4635-8f5e-3bf19237b3d3",
      "id": "CVE-2021-3752",
      "description": "A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "daee91dc-30b1-45a2-b9cf-287a32b0b106",
      "id": "CVE-2021-4197",
      "description": "An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d85c2ca6-9c5c-48d2-b648-500dca78ea80",
      "id": "CVE-2021-45868",
      "description": "In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "569ca71c-3ec2-40e8-8dde-b3d39a2f8fb3",
      "id": "CVE-2021-47000",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix inode leak on getattr error in __fh_to_dentry",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "454a3b4c-17e0-4a43-b291-80a56f29da50",
      "id": "CVE-2021-47126",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions\n\nReported by syzbot:\nHEAD commit:    90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm..\ngit tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master\ndashboard link: https://syzkaller.appspot.com/bug?extid=123aa35098fd3c000eb7\ncompiler:       Debian clang version 11.0.1-2\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline]\nBUG: KASAN: slab-out-of-bounds in fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732\nRead of size 8 at addr ffff8880145c78f8 by task syz-executor.4/17760\n\nCPU: 0 PID: 17760 Comm: syz-executor.4 Not tainted 5.12.0-rc8-syzkaller #0\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack lib/dump_stack.c:79 [inline]\n dump_stack+0x202/0x31e lib/dump_stack.c:120\n print_address_description+0x5f/0x3b0 mm/kasan/report.c:232\n __kasan_report mm/kasan/report.c:399 [inline]\n kasan_report+0x15c/0x200 mm/kasan/report.c:416\n fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline]\n fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732\n fib6_nh_release+0x9a/0x430 net/ipv6/route.c:3536\n fib6_info_destroy_rcu+0xcb/0x1c0 net/ipv6/ip6_fib.c:174\n rcu_do_batch kernel/rcu/tree.c:2559 [inline]\n rcu_core+0x8f6/0x1450 kernel/rcu/tree.c:2794\n __do_softirq+0x372/0x7a6 kernel/softirq.c:345\n invoke_softirq kernel/softirq.c:221 [inline]\n __irq_exit_rcu+0x22c/0x260 kernel/softirq.c:422\n irq_exit_rcu+0x5/0x20 kernel/softirq.c:434\n sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100\n \u003c/IRQ\u003e\n asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632\nRIP: 0010:lock_acquire+0x1f6/0x720 kernel/locking/lockdep.c:5515\nCode: f6 84 24 a1 00 00 00 02 0f 85 8d 02 00 00 f7 c3 00 02 00 00 49 bd 00 00 00 00 00 fc ff df 74 01 fb 48 c7 44 24 40 0e 36 e0 45 \u003c4b\u003e c7 44 3d 00 00 00 00 00 4b c7 44 3d 09 00 00 00 00 43 c7 44 3d\nRSP: 0018:ffffc90009e06560 EFLAGS: 00000206\nRAX: 1ffff920013c0cc0 RBX: 0000000000000246 RCX: dffffc0000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc90009e066e0 R08: dffffc0000000000 R09: fffffbfff1f992b1\nR10: fffffbfff1f992b1 R11: 0000000000000000 R12: 0000000000000000\nR13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920013c0cb4\n rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:267\n rcu_read_lock include/linux/rcupdate.h:656 [inline]\n ext4_get_group_info+0xea/0x340 fs/ext4/ext4.h:3231\n ext4_mb_prefetch+0x123/0x5d0 fs/ext4/mballoc.c:2212\n ext4_mb_regular_allocator+0x8a5/0x28f0 fs/ext4/mballoc.c:2379\n ext4_mb_new_blocks+0xc6e/0x24f0 fs/ext4/mballoc.c:4982\n ext4_ext_map_blocks+0x2be3/0x7210 fs/ext4/extents.c:4238\n ext4_map_blocks+0xab3/0x1cb0 fs/ext4/inode.c:638\n ext4_getblk+0x187/0x6c0 fs/ext4/inode.c:848\n ext4_bread+0x2a/0x1c0 fs/ext4/inode.c:900\n ext4_append+0x1a4/0x360 fs/ext4/namei.c:67\n ext4_init_new_dir+0x337/0xa10 fs/ext4/namei.c:2768\n ext4_mkdir+0x4b8/0xc00 fs/ext4/namei.c:2814\n vfs_mkdir+0x45b/0x640 fs/namei.c:3819\n ovl_do_mkdir fs/overlayfs/overlayfs.h:161 [inline]\n ovl_mkdir_real+0x53/0x1a0 fs/overlayfs/dir.c:146\n ovl_create_real+0x280/0x490 fs/overlayfs/dir.c:193\n ovl_workdir_create+0x425/0x600 fs/overlayfs/super.c:788\n ovl_make_workdir+0xed/0x1140 fs/overlayfs/super.c:1355\n ovl_get_workdir fs/overlayfs/super.c:1492 [inline]\n ovl_fill_super+0x39ee/0x5370 fs/overlayfs/super.c:2035\n mount_nodev+0x52/0xe0 fs/super.c:1413\n legacy_get_tree+0xea/0x180 fs/fs_context.c:592\n vfs_get_tree+0x86/0x270 fs/super.c:1497\n do_new_mount fs/namespace.c:2903 [inline]\n path_mount+0x196f/0x2be0 fs/namespace.c:3233\n do_mount fs/namespace.c:3246 [inline]\n __do_sys_mount fs/namespace.c:3454 [inline]\n __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3431\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x4665f9\nCode: ff ff c3 66 2e 0f 1f 84 \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d8405ac-de00-4c90-9acc-e9d1dfdd94af",
      "id": "CVE-2021-47129",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: skip expectations for confirmed conntrack\n\nnft_ct_expect_obj_eval() calls nf_ct_ext_add() for a confirmed\nconntrack entry. However, nf_ct_ext_add() can only be called for\n!nf_ct_is_confirmed().\n\n[ 1825.349056] WARNING: CPU: 0 PID: 1279 at net/netfilter/nf_conntrack_extend.c:48 nf_ct_xt_add+0x18e/0x1a0 [nf_conntrack]\n[ 1825.351391] RIP: 0010:nf_ct_ext_add+0x18e/0x1a0 [nf_conntrack]\n[ 1825.351493] Code: 41 5c 41 5d 41 5e 41 5f c3 41 bc 0a 00 00 00 e9 15 ff ff ff ba 09 00 00 00 31 f6 4c 89 ff e8 69 6c 3d e9 eb 96 45 31 ed eb cd \u003c0f\u003e 0b e9 b1 fe ff ff e8 86 79 14 e9 eb bf 0f 1f 40 00 0f 1f 44 00\n[ 1825.351721] RSP: 0018:ffffc90002e1f1e8 EFLAGS: 00010202\n[ 1825.351790] RAX: 000000000000000e RBX: ffff88814f5783c0 RCX: ffffffffc0e4f887\n[ 1825.351881] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88814f578440\n[ 1825.351971] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88814f578447\n[ 1825.352060] R10: ffffed1029eaf088 R11: 0000000000000001 R12: ffff88814f578440\n[ 1825.352150] R13: ffff8882053f3a00 R14: 0000000000000000 R15: 0000000000000a20\n[ 1825.352240] FS:  00007f992261c900(0000) GS:ffff889faec00000(0000) knlGS:0000000000000000\n[ 1825.352343] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1825.352417] CR2: 000056070a4d1158 CR3: 000000015efe0000 CR4: 0000000000350ee0\n[ 1825.352508] Call Trace:\n[ 1825.352544]  nf_ct_helper_ext_add+0x10/0x60 [nf_conntrack]\n[ 1825.352641]  nft_ct_expect_obj_eval+0x1b8/0x1e0 [nft_ct]\n[ 1825.352716]  nft_do_chain+0x232/0x850 [nf_tables]\n\nAdd the ct helper extension only for unconfirmed conntrack. Skip rule\nevaluation if the ct helper extension does not exist. Thus, you can\nonly create expectations from the first packet.\n\nIt should be possible to remove this limitation by adding a new action\nto attach a generic ct helper to the first packet. Then, use this ct\nhelper extension from follow up packets to create the ct expectation.\n\nWhile at it, add a missing check to skip the template conntrack too\nand remove check for IPCT_UNTRACK which is implicit to !ct.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7e463899-8ba3-4834-8172-489dd3fe0ee6",
      "id": "CVE-2021-47161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-dspi: Fix a resource leak in an error handling path\n\n'dspi_request_dma()' should be undone by a 'dspi_release_dma()' call in the\nerror handling path of the probe function, as already done in the remove\nfunction",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a83196a8-4577-4128-9a74-a6c849e549c6",
      "id": "CVE-2021-47478",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: Fix out of bound access for corrupted isofs image\n\nWhen isofs image is suitably corrupted isofs_read_inode() can read data\nbeyond the end of buffer. Sanity-check the directory entry length before\nusing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2724b2f0-e440-471f-a0e8-89900ec2d3b7",
      "id": "CVE-2021-47182",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix scsi_mode_sense() buffer length handling\n\nSeveral problems exist with scsi_mode_sense() buffer length handling:\n\n 1) The allocation length field of the MODE SENSE(10) command is 16-bits,\n    occupying bytes 7 and 8 of the CDB. With this command, access to mode\n    pages larger than 255 bytes is thus possible. However, the CDB\n    allocation length field is set by assigning len to byte 8 only, thus\n    truncating buffer length larger than 255.\n\n 2) If scsi_mode_sense() is called with len smaller than 8 with\n    sdev-\u003euse_10_for_ms set, or smaller than 4 otherwise, the buffer length\n    is increased to 8 and 4 respectively, and the buffer is zero filled\n    with these increased values, thus corrupting the memory following the\n    buffer.\n\nFix these 2 problems by using put_unaligned_be16() to set the allocation\nlength field of MODE SENSE(10) CDB and by returning an error when len is\ntoo small.\n\nFurthermore, if len is larger than 255B, always try MODE SENSE(10) first,\neven if the device driver did not set sdev-\u003euse_10_for_ms. In case of\ninvalid opcode error for MODE SENSE(10), access to mode pages larger than\n255 bytes are not retried using MODE SENSE(6). To avoid buffer length\noverflows for the MODE_SENSE(10) case, check that len is smaller than 65535\nbytes.\n\nWhile at it, also fix the folowing:\n\n * Use get_unaligned_be16() to retrieve the mode data length and block\n   descriptor length fields of the mode sense reply header instead of using\n   an open coded calculation.\n\n * Fix the kdoc dbd argument explanation: the DBD bit stands for Disable\n   Block Descriptor, which is the opposite of what the dbd argument\n   description was.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e406b47-23fa-44ae-9da0-eba59293c0d2",
      "id": "CVE-2021-47193",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Fix memory leak during rmmod\n\nDriver failed to release all memory allocated. This would lead to memory\nleak during driver removal.\n\nProperly free memory when the module is removed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2afdfbfa-20fc-4fd7-9863-574cbcb62499",
      "id": "CVE-2021-47223",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: fix vlan tunnel dst null pointer dereference\n\nThis patch fixes a tunnel_dst null pointer dereference due to lockless\naccess in the tunnel egress path. When deleting a vlan tunnel the\ntunnel_dst pointer is set to NULL without waiting a grace period (i.e.\nwhile it's still usable) and packets egressing are dereferencing it\nwithout checking. Use READ/WRITE_ONCE to annotate the lockless use of\ntunnel_id, use RCU for accessing tunnel_dst and make sure it is read\nonly once and checked in the egress path. The dst is already properly RCU\nprotected so we don't need to do anything fancy than to make sure\ntunnel_id and tunnel_dst are read only once and checked in the egress path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c94ddbcf-4099-4d66-92cb-b2055b02f847",
      "id": "CVE-2022-41850",
      "description": "roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report-\u003evalue is in progress.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "29248d2b-a98b-454c-9752-d3ed3e5c33ef",
      "id": "CVE-2021-47412",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't call rq_qos_ops-\u003edone_bio if the bio isn't tracked\n\nrq_qos framework is only applied on request based driver, so:\n\n1) rq_qos_done_bio() needn't to be called for bio based driver\n\n2) rq_qos_done_bio() needn't to be called for bio which isn't tracked,\nsuch as bios ended from error handling code.\n\nEspecially in bio_endio():\n\n1) request queue is referred via bio-\u003ebi_bdev-\u003ebd_disk-\u003equeue, which\nmay be gone since request queue refcount may not be held in above two\ncases\n\n2) q-\u003erq_qos may be freed in blk_cleanup_queue() when calling into\n__rq_qos_done_bio()\n\nFix the potential kernel panic by not calling rq_qos_ops-\u003edone_bio if\nthe bio isn't tracked. This way is safe because both ioc_rqos_done_bio()\nand blkcg_iolatency_done_bio() are nop if the bio isn't tracked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3aea0315-cacf-4c89-bded-2588f2d90048",
      "id": "CVE-2021-47426",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, s390: Fix potential memory leak about jit_data\n\nMake sure to free jit_data through kfree() in the error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6abfe271-4793-40e7-a749-dde8b76370ac",
      "id": "CVE-2021-47473",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()\n\nCommit 8c0eb596baa5 (\"[SCSI] qla2xxx: Fix a memory leak in an error path of\nqla2x00_process_els()\"), intended to change:\n\n        bsg_job-\u003erequest-\u003emsgcode == FC_BSG_HST_ELS_NOLOGIN\n\n\n        bsg_job-\u003erequest-\u003emsgcode != FC_BSG_RPT_ELS\n\nbut changed it to:\n\n        bsg_job-\u003erequest-\u003emsgcode == FC_BSG_RPT_ELS\n\ninstead.\n\nChange the == to a != to avoid leaking the fcport structure or freeing\nunallocated memory.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c20a1727-eade-4c27-b306-85b21ed15d5c",
      "id": "CVE-2022-49691",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nerspan: do not assume transport header is always set\n\nRewrite tests in ip6erspan_tunnel_xmit() and\nerspan_fb_xmit() to not assume transport header is set.\n\nsyzbot reported:\n\nWARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline]\nWARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963\nModules linked in:\nCPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014\nRIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline]\nRIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963\nCode: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 \u003c0f\u003e 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00\nRSP: 0018:ffffc90005daf910 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000\nRDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003\nRBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff\nR10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40\nR13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000\nFS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0\nCall Trace:\n\u003cTASK\u003e\n__netdev_start_xmit include/linux/netdevice.h:4805 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4819 [inline]\nxmit_one net/core/dev.c:3588 [inline]\ndev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604\nsch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342\n__dev_xmit_skb net/core/dev.c:3815 [inline]\n__dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219\ndev_queue_xmit include/linux/netdevice.h:2994 [inline]\ntx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63\nkthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229\nkthread+0x2e9/0x3a0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302\n\u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "346daa11-5b8c-4cb9-96c4-653b75c2aac5",
      "id": "CVE-2021-47542",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()\n\nIn qlcnic_83xx_add_rings(), the indirect function of\nahw-\u003ehw_ops-\u003ealloc_mbx_args will be called to allocate memory for\ncmd.req.arg, and there is a dereference of it in qlcnic_83xx_add_rings(),\nwhich could lead to a NULL pointer dereference on failure of the\nindirect function like qlcnic_83xx_alloc_mbx_args().\n\nFix this bug by adding a check of alloc_mbx_args(), this patch\nimitates the logic of mbx_cmd()'s failure handling.\n\nThis bug was found by a static analyzer. The analysis employs\ndifferential checking to identify inconsistent security operations\n(e.g., checks or kfrees) between two code paths and confirms that the\ninconsistent operations are not recovered in the current function or\nthe callers, so they constitute bugs.\n\nNote that, as a bug found by static analysis, it can be a false\npositive or hard to trigger. Multiple researchers have cross-reviewed\nthe bug.\n\nBuilds with CONFIG_QLCNIC=m show no new warnings, and our\nstatic analyzer no longer warns about this code.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99d1a34b-f3a6-4606-ab75-59b58cb827fb",
      "id": "CVE-2022-25265",
      "description": "In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bee12a2e-41ae-4867-a53e-a7bf13802180",
      "id": "CVE-2022-29582",
      "description": "In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "697fbabe-339e-4c5b-aa88-44cb98e262a4",
      "id": "CVE-2022-48743",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: amd-xgbe: Fix skb data length underflow\n\nThere will be BUG_ON() triggered in include/linux/skbuff.h leading to\nintermittent kernel panic, when the skb length underflow is detected.\n\nFix this by dropping the packet if such length underflows are seen\nbecause of inconsistencies in the hardware descriptors.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f92c2f2-2704-4633-9996-3fdd3b8b0542",
      "id": "CVE-2022-48760",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Fix hang in usb_kill_urb by adding memory barriers\n\nThe syzbot fuzzer has identified a bug in which processes hang waiting\nfor usb_kill_urb() to return.  It turns out the issue is not unlinking\nthe URB; that works just fine.  Rather, the problem arises when the\nwakeup notification that the URB has completed is not received.\n\nThe reason is memory-access ordering on SMP systems.  In outline form,\nusb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on\ndifferent CPUs perform the following actions:\n\nCPU 0\t\t\t\t\tCPU 1\n----------------------------\t\t---------------------------------\nusb_kill_urb():\t\t\t\t__usb_hcd_giveback_urb():\n  ...\t\t\t\t\t  ...\n  atomic_inc(\u0026urb-\u003ereject);\t\t  atomic_dec(\u0026urb-\u003euse_count);\n  ...\t\t\t\t\t  ...\n  wait_event(usb_kill_urb_queue,\n\tatomic_read(\u0026urb-\u003euse_count) == 0);\n\t\t\t\t\t  if (atomic_read(\u0026urb-\u003ereject))\n\t\t\t\t\t\twake_up(\u0026usb_kill_urb_queue);\n\nConfining your attention to urb-\u003ereject and urb-\u003euse_count, you can\nsee that the overall pattern of accesses on CPU 0 is:\n\n\twrite urb-\u003ereject, then read urb-\u003euse_count;\n\nwhereas the overall pattern of accesses on CPU 1 is:\n\n\twrite urb-\u003euse_count, then read urb-\u003ereject.\n\nThis pattern is referred to in memory-model circles as SB (for \"Store\nBuffering\"), and it is well known that without suitable enforcement of\nthe desired order of accesses -- in the form of memory barriers -- it\nis entirely possible for one or both CPUs to execute their reads ahead\nof their writes.  The end result will be that sometimes CPU 0 sees the\nold un-decremented value of urb-\u003euse_count while CPU 1 sees the old\nun-incremented value of urb-\u003ereject.  Consequently CPU 0 ends up on\nthe wait queue and never gets woken up, leading to the observed hang\nin usb_kill_urb().\n\nThe same pattern of accesses occurs in usb_poison_urb() and the\nfailure pathway of usb_hcd_submit_urb().\n\nThe problem is fixed by adding suitable memory barriers.  To provide\nproper memory-access ordering in the SB pattern, a full barrier is\nrequired on both CPUs.  The atomic_inc() and atomic_dec() accesses\nthemselves don't provide any memory ordering, but since they are\npresent, we can use the optimized smp_mb__after_atomic() memory\nbarrier in the various routines to obtain the desired effect.\n\nThis patch adds the necessary memory barriers.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b2d6dccf-8e70-4a06-b46d-ab8c0afb30fa",
      "id": "CVE-2022-48849",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: bypass tiling flag check in virtual display case (v2)\n\nvkms leverages common amdgpu framebuffer creation, and\nalso as it does not support FB modifier, there is no need\nto check tiling flags when initing framebuffer when virtual\ndisplay is enabled.\n\nThis can fix below calltrace:\n\namdgpu 0000:00:08.0: GFX9+ requires FB check based on format modifier\nWARNING: CPU: 0 PID: 1023 at drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:1150 amdgpu_display_framebuffer_init+0x8e7/0xb40 [amdgpu]\n\nv2: check adev-\u003eenable_virtual_display instead as vkms can be\n\tenabled in bare metal as well.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "595b7f12-766a-4533-a094-9aee6324bf6d",
      "id": "CVE-2022-48887",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Remove rcu locks from user resources\n\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\nthe rcu paths were buggy and it was easy to make the driver crash by\nsubmitting command buffers from two different threads. Because the\nlookups never show up in performance profiles replace them with a\nregular spin lock which fixes the races in accesses to those shared\nresources.\n\nFixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and\nseen crashes with apps using shared resources.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb716c18-d5b3-4998-9bbd-5eb9c4465f16",
      "id": "CVE-2022-48947",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix u8 overflow\n\nBy keep sending L2CAP_CONF_REQ packets, chan-\u003enum_conf_rsp increases\nmultiple times and eventually it will wrap around the maximum number\n(i.e., 255).\nThis patch prevents this by adding a boundary check with\nL2CAP_MAX_CONF_RSP\n\nBtmon log:\nBluetooth monitor ver 5.64\n= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594\n= Note: Bluetooth subsystem version 2.22                               0.264636\n@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191\n= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604\n@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741\n= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426\n(...)\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106\n        invalid packet size (12 != 1033)\n        08 00 01 00 02 01 04 00 01 10 ff ff              ............\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561\n        invalid packet size (14 != 1547)\n        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......\n= bluetoothd: Bluetooth daemon 5.43                                   14.401828\n\u003e ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753\n        invalid packet size (12 != 1033)\n        08 00 01 00 04 01 04 00 40 00 00 00              ........@...",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "40b25c62-8915-434d-bded-8fb7c9cd5cd5",
      "id": "CVE-2022-48990",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free during gpu recovery\n\n[Why]\n    [  754.862560] refcount_t: underflow; use-after-free.\n    [  754.862898] Call Trace:\n    [  754.862903]  \u003cTASK\u003e\n    [  754.862913]  amdgpu_job_free_cb+0xc2/0xe1 [amdgpu]\n    [  754.863543]  drm_sched_main.cold+0x34/0x39 [amd_sched]\n\n[How]\n    The fw_fence may be not init, check whether dma_fence_init\n    is performed before job free",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4b8aa1f6-f216-4960-a129-9ce156aae957",
      "id": "CVE-2023-30772",
      "description": "The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6df6d1c5-4536-4b53-85ea-79b638a2dd3b",
      "id": "CVE-2022-49128",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: Add missing pm_runtime_put_sync\n\npm_runtime_get_sync() will increase the rumtime PM counter\neven when it returns an error. Thus a pairing decrement is needed\nto prevent refcount leak. Fix this by replacing this API with\npm_runtime_resume_and_get(), which will not change the runtime\nPM counter on error. Besides, a matching decrement is needed\non the error handling path to keep the counter balanced.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c8084ee4-f48d-4dc8-9400-b2a8468ada4d",
      "id": "CVE-2022-49131",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: fix kernel panic during unload/load ath11k modules\n\nCall netif_napi_del() from ath11k_ahb_free_ext_irq() to fix\nthe following kernel panic when unload/load ath11k modules\nfor few iterations.\n\n[  971.201365] Unable to handle kernel paging request at virtual address 6d97a208\n[  971.204227] pgd = 594c2919\n[  971.211478] [6d97a208] *pgd=00000000\n[  971.214120] Internal error: Oops: 5 [#1] PREEMPT SMP ARM\n[  971.412024] CPU: 2 PID: 4435 Comm: insmod Not tainted 5.4.89 #0\n[  971.434256] Hardware name: Generic DT based system\n[  971.440165] PC is at napi_by_id+0x10/0x40\n[  971.445019] LR is at netif_napi_add+0x160/0x1dc\n\n[  971.743127] (napi_by_id) from [\u003c807d89a0\u003e] (netif_napi_add+0x160/0x1dc)\n[  971.751295] (netif_napi_add) from [\u003c7f1209ac\u003e] (ath11k_ahb_config_irq+0xf8/0x414 [ath11k_ahb])\n[  971.759164] (ath11k_ahb_config_irq [ath11k_ahb]) from [\u003c7f12135c\u003e] (ath11k_ahb_probe+0x40c/0x51c [ath11k_ahb])\n[  971.768567] (ath11k_ahb_probe [ath11k_ahb]) from [\u003c80666864\u003e] (platform_drv_probe+0x48/0x94)\n[  971.779670] (platform_drv_probe) from [\u003c80664718\u003e] (really_probe+0x1c8/0x450)\n[  971.789389] (really_probe) from [\u003c80664cc4\u003e] (driver_probe_device+0x15c/0x1b8)\n[  971.797547] (driver_probe_device) from [\u003c80664f60\u003e] (device_driver_attach+0x44/0x60)\n[  971.805795] (device_driver_attach) from [\u003c806650a0\u003e] (__driver_attach+0x124/0x140)\n[  971.814822] (__driver_attach) from [\u003c80662adc\u003e] (bus_for_each_dev+0x58/0xa4)\n[  971.823328] (bus_for_each_dev) from [\u003c80663a2c\u003e] (bus_add_driver+0xf0/0x1e8)\n[  971.831662] (bus_add_driver) from [\u003c806658a4\u003e] (driver_register+0xa8/0xf0)\n[  971.839822] (driver_register) from [\u003c8030269c\u003e] (do_one_initcall+0x78/0x1ac)\n[  971.847638] (do_one_initcall) from [\u003c80392524\u003e] (do_init_module+0x54/0x200)\n[  971.855968] (do_init_module) from [\u003c803945b0\u003e] (load_module+0x1e30/0x1ffc)\n[  971.864126] (load_module) from [\u003c803948b0\u003e] (sys_init_module+0x134/0x17c)\n[  971.871852] (sys_init_module) from [\u003c80301000\u003e] (ret_fast_syscall+0x0/0x50)\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "180fdba3-0ddc-4216-ba1b-216bdaede765",
      "id": "CVE-2022-49191",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmxser: fix xmit_buf leak in activate when LSR == 0xff\n\nWhen LSR is 0xff in -\u003eactivate() (rather unlike), we return an error.\nProvided -\u003eshutdown() is not called when -\u003eactivate() fails, nothing\nactually frees the buffer in this case.\n\nFix this by properly freeing the buffer in a designated label. We jump\nthere also from the \"!info-\u003etype\" if now too.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ef0a4e12-f621-4891-b1c0-b51bdaf8ac0b",
      "id": "CVE-2022-49194",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Use stronger register read/writes to assure ordering\n\nGCC12 appears to be much smarter about its dependency tracking and is\naware that the relaxed variants are just normal loads and stores and\nthis is causing problems like:\n\n[  210.074549] ------------[ cut here ]------------\n[  210.079223] NETDEV WATCHDOG: enabcm6e4ei0 (bcmgenet): transmit queue 1 timed out\n[  210.086717] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:529 dev_watchdog+0x234/0x240\n[  210.095044] Modules linked in: genet(E) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat]\n[  210.146561] ACPI CPPC: PCC check channel failed for ss: 0. ret=-110\n[  210.146927] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E     5.17.0-rc7G12+ #58\n[  210.153226] CPPC Cpufreq:cppc_scale_freq_workfn: failed to read perf counters\n[  210.161349] Hardware name: Raspberry Pi Foundation Raspberry Pi 4 Model B/Raspberry Pi 4 Model B, BIOS EDK2-DEV 02/08/2022\n[  210.161353] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  210.161358] pc : dev_watchdog+0x234/0x240\n[  210.161364] lr : dev_watchdog+0x234/0x240\n[  210.161368] sp : ffff8000080a3a40\n[  210.161370] x29: ffff8000080a3a40 x28: ffffcd425af87000 x27: ffff8000080a3b20\n[  210.205150] x26: ffffcd425aa00000 x25: 0000000000000001 x24: ffffcd425af8ec08\n[  210.212321] x23: 0000000000000100 x22: ffffcd425af87000 x21: ffff55b142688000\n[  210.219491] x20: 0000000000000001 x19: ffff55b1426884c8 x18: ffffffffffffffff\n[  210.226661] x17: 64656d6974203120 x16: 0000000000000001 x15: 6d736e617274203a\n[  210.233831] x14: 2974656e65676d63 x13: ffffcd4259c300d8 x12: ffffcd425b07d5f0\n[  210.241001] x11: 00000000ffffffff x10: ffffcd425b07d5f0 x9 : ffffcd4258bdad9c\n[  210.248171] x8 : 00000000ffffdfff x7 : 000000000000003f x6 : 0000000000000000\n[  210.255341] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000001000\n[  210.262511] x2 : 0000000000001000 x1 : 0000000000000005 x0 : 0000000000000044\n[  210.269682] Call trace:\n[  210.272133]  dev_watchdog+0x234/0x240\n[  210.275811]  call_timer_fn+0x3c/0x15c\n[  210.279489]  __run_timers.part.0+0x288/0x310\n[  210.283777]  run_timer_softirq+0x48/0x80\n[  210.287716]  __do_softirq+0x128/0x360\n[  210.291392]  __irq_exit_rcu+0x138/0x140\n[  210.295243]  irq_exit_rcu+0x1c/0x30\n[  210.298745]  el1_interrupt+0x38/0x54\n[  210.302334]  el1h_64_irq_handler+0x18/0x24\n[  210.306445]  el1h_64_irq+0x7c/0x80\n[  210.309857]  arch_cpu_idle+0x18/0x2c\n[  210.313445]  default_idle_call+0x4c/0x140\n[  210.317470]  cpuidle_idle_call+0x14c/0x1a0\n[  210.321584]  do_idle+0xb0/0x100\n[  210.324737]  cpu_startup_entry+0x30/0x8c\n[  210.328675]  secondary_start_kernel+0xe4/0x110\n[  210.333138]  __secondary_switched+0x94/0x98\n\nThe assumption when these were relaxed seems to be that device memory\nwould be mapped non reordering, and that other constructs\n(spinlocks/etc) would provide the barriers to assure that packet data\nand in memory rings/queues were ordered with respect to device\nregister reads/writes. This itself seems a bit sketchy, but the real\nproblem with GCC12 is that it is moving the actual reads/writes around\nat will as though they were independent operations when in truth they\nare not, but the compiler can't know that. When looking at the\nassembly dumps for many of these routines its possible to see very\nclean, but not strictly in program order operations occurring as the\ncompiler would be free to do if these weren't actually register\nreads/write operations.\n\nIts possible to suppress the timeout with a liberal bit of dma_mb()'s\nsprinkled around but the device still seems unable to reliably\nsend/receive data. A better plan is to use the safer readl/writel\neverywhere.\n\nSince this partially reverts an older commit, which notes the use of\nthe relaxed variants for performance reasons. I would suggest that\nany performance problems \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dee14553-4287-4010-b82d-3091fa38a434",
      "id": "CVE-2022-49209",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full\n\nIf tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc()\nreturns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial\nmemory has been alloced by sk_msg_alloc(), that is, msg_tx-\u003esg.size is\ngreater than osize after sk_msg_alloc(), memleak occurs. To fix we use\nsk_msg_trim() to release the allocated memory, then goto wait for memory.\n\nOther call paths of sk_msg_alloc() have the similar issue, such as\ntls_sw_sendmsg(), so handle sk_msg_trim logic inside sk_msg_alloc(),\nas Cong Wang suggested.\n\nThis issue can cause the following info:\nWARNING: CPU: 3 PID: 7950 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0\nCall Trace:\n \u003cTASK\u003e\n inet_csk_destroy_sock+0x55/0x110\n __tcp_close+0x279/0x470\n tcp_close+0x1f/0x60\n inet_release+0x3f/0x80\n __sock_release+0x3d/0xb0\n sock_close+0x11/0x20\n __fput+0x92/0x250\n task_work_run+0x6a/0xa0\n do_exit+0x33b/0xb60\n do_group_exit+0x2f/0xa0\n get_signal+0xb6/0x950\n arch_do_signal_or_restart+0xac/0x2a0\n exit_to_user_mode_prepare+0xa9/0x200\n syscall_exit_to_user_mode+0x12/0x30\n do_syscall_64+0x46/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n \u003c/TASK\u003e\n\nWARNING: CPU: 3 PID: 2094 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x24/0x1f0\n sk_psock_destroy+0x19b/0x1c0\n process_one_work+0x1b3/0x3c0\n kthread+0xe6/0x110\n ret_from_fork+0x22/0x30\n \u003c/TASK\u003e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e245fff0-831c-4b14-87a0-dfc4d8468e7a",
      "id": "CVE-2022-49380",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215897\n\nI have encountered a bug in F2FS file system in kernel v5.17.\n\nThe kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can\nreproduce the bug by running the following commands:\n\nThe kernel message is shown below:\n\nkernel BUG at fs/f2fs/f2fs.h:2511!\nCall Trace:\n f2fs_remove_inode_page+0x2a2/0x830\n f2fs_evict_inode+0x9b7/0x1510\n evict+0x282/0x4e0\n do_unlinkat+0x33a/0x540\n __x64_sys_unlinkat+0x8e/0xd0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is: .total_valid_block_count or .total_valid_node_count\ncould fuzzed to zero, then once dec_valid_node_count() was called, it\nwill cause BUG_ON(), this patch fixes to print warning info and set\nSBI_NEED_FSCK into CP instead of panic.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "de1275a0-60b3-4663-8be9-7b6761dac78b",
      "id": "CVE-2022-49429",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Prevent panic when SDMA is disabled\n\nIf the hfi1 module is loaded with HFI1_CAP_SDMA off, a call to\nhfi1_write_iter() will dereference a NULL pointer and panic. A typical\nstack frame is:\n\n  sdma_select_user_engine [hfi1]\n  hfi1_user_sdma_process_request [hfi1]\n  hfi1_write_iter [hfi1]\n  do_iter_readv_writev\n  do_iter_write\n  vfs_writev\n  do_writev\n  do_syscall_64\n\nThe fix is to test for SDMA in hfi1_write_iter() and fail the I/O with\nEINVAL.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0c81b9a8-6e3a-4968-8c0c-8ead85802446",
      "id": "CVE-2022-49468",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/core: Fix memory leak in __thermal_cooling_device_register()\n\nI got memory leak as follows when doing fault injection test:\n\nunreferenced object 0xffff888010080000 (size 264312):\n  comm \"182\", pid 102533, jiffies 4296434960 (age 10.100s)\n  hex dump (first 32 bytes):\n    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........\n    ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff  ........@.......\n  backtrace:\n    [\u003c0000000038b2f4fc\u003e] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969\n    [\u003c00000000ebcb8da5\u003e] __kmalloc+0x373/0x420 include/linux/slab.h:510\n    [\u003c0000000084137f13\u003e] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586\n    [\u003c00000000352b8755\u003e] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927\n    [\u003c00000000fb9f331b\u003e] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041\n    [\u003c000000009b8012d2\u003e] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211\n    [\u003c00000000da0b7e04\u003e] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561\n\nIf device_register() fails, thermal_cooling_device_destroy_sysfs() need be called\nto free the memory allocated in thermal_cooling_device_setup_sysfs().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10441cdc-b04a-4e4e-a781-279454f22d67",
      "id": "CVE-2022-49546",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: fix memory leak of elf header buffer\n\nThis is reported by kmemleak detector:\n\nunreferenced object 0xffffc900002a9000 (size 4096):\n  comm \"kexec\", pid 14950, jiffies 4295110793 (age 373.951s)\n  hex dump (first 32 bytes):\n    7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  .ELF............\n    04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00  ..\u003e.............\n  backtrace:\n    [\u003c0000000016a8ef9f\u003e] __vmalloc_node_range+0x101/0x170\n    [\u003c000000002b66b6c0\u003e] __vmalloc_node+0xb4/0x160\n    [\u003c00000000ad40107d\u003e] crash_prepare_elf64_headers+0x8e/0xcd0\n    [\u003c0000000019afff23\u003e] crash_load_segments+0x260/0x470\n    [\u003c0000000019ebe95c\u003e] bzImage64_load+0x814/0xad0\n    [\u003c0000000093e16b05\u003e] arch_kexec_kernel_image_load+0x1be/0x2a0\n    [\u003c000000009ef2fc88\u003e] kimage_file_alloc_init+0x2ec/0x5a0\n    [\u003c0000000038f5a97a\u003e] __do_sys_kexec_file_load+0x28d/0x530\n    [\u003c0000000087c19992\u003e] do_syscall_64+0x3b/0x90\n    [\u003c0000000066e063a4\u003e] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nIn crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to\nstore elf headers.  While it's not freed back to system correctly when\nkdump kernel is reloaded or unloaded.  Then memory leak is caused.  Fix it\nby introducing x86 specific function arch_kimage_file_post_load_cleanup(),\nand freeing the buffer there.\n\nAnd also remove the incorrect elf header buffer freeing code.  Before\ncalling arch specific kexec_file loading function, the image instance has\nbeen initialized.  So 'image-\u003eelf_headers' must be NULL.  It doesn't make\nsense to free the elf header buffer in the place.\n\nThree different people have reported three bugs about the memory leak on\nx86_64 inside Redhat.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d482f51-ecec-4384-841c-a2337cf54afd",
      "id": "CVE-2022-49712",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe\n\nof_parse_phandle() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() to avoid refcount leak.\nof_node_put() will check NULL pointer.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "704d3287-4fe9-43ec-aad7-a55fbb7cecd8",
      "id": "CVE-2022-49766",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: Bounds-check struct nlmsgerr creation\n\nIn preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),\nswitch from __nlmsg_put to nlmsg_put(), and explain the bounds check\nfor dealing with the memcpy() across a composite flexible array struct.\nAvoids this future run-time warning:\n\n  memcpy: detected field-spanning write (size 32) of single field \"\u0026errmsg-\u003emsg\" at net/netlink/af_netlink.c:2447 (size 16)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91b5b769-342d-480f-8161-b023e6c340ae",
      "id": "CVE-2022-49788",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()\n\n`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,\nwhich may carry uninitialized data to the userspace, as observed by\nKMSAN:\n\n  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121\n   instrument_copy_to_user ./include/linux/instrumented.h:121\n   _copy_to_user+0x5f/0xb0 lib/usercopy.c:33\n   copy_to_user ./include/linux/uaccess.h:169\n   vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431\n   vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925\n   vfs_ioctl fs/ioctl.c:51\n  ...\n\n  Uninit was stored to memory at:\n   kmemdup+0x74/0xb0 mm/util.c:131\n   dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271\n   vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339\n   qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479\n   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662\n   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750\n   vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940\n   vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488\n   vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927\n  ...\n\n  Local variable ev created at:\n   qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456\n   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662\n   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750\n\n  Bytes 28-31 of 48 are uninitialized\n  Memory access of size 48 starts at ffff888035155e00\n  Data copied to user address 0000000020000100\n\nUse memset() to prevent the infoleaks.\n\nAlso speculatively fix qp_notify_peer_local(), which may suffer from the\nsame problem.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2a70ac08-2cad-406b-a200-8443eac7504e",
      "id": "CVE-2022-49821",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible memory leak in mISDN_dsp_element_register()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nuse put_device() to give up the reference, so that the name can be\nfreed in kobject_cleanup() when the refcount is 0.\n\nThe 'entry' is going to be freed in mISDN_dsp_dev_release(), so the\nkfree() is removed. list_del() is called in mISDN_dsp_dev_release(),\nso it need be initialized.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e987a0e4-34be-4efe-b5b6-2e60dfbbb011",
      "id": "CVE-2022-49836",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsiox: fix possible memory leak in siox_device_add()\n\nIf device_register() returns error in siox_device_add(),\nthe name allocated by dev_set_name() need be freed. As\ncomment of device_register() says, it should use put_device()\nto give up the reference in the error path. So fix this\nby calling put_device(), then the name can be freed in\nkobject_cleanup(), and sdevice is freed in siox_device_release(),\nset it to null in error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d45e4b1d-3806-489f-b721-c012df588024",
      "id": "CVE-2022-49979",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix refcount bug in sk_psock_get (2)\n\nSyzkaller reports refcount bug as follows:\n------------[ cut here ]------------\nrefcount_t: saturated; leaking memory.\nWARNING: CPU: 1 PID: 3605 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19\nModules linked in:\nCPU: 1 PID: 3605 Comm: syz-executor208 Not tainted 5.18.0-syzkaller-03023-g7e062cda7d90 #0\n \u003cTASK\u003e\n __refcount_add_not_zero include/linux/refcount.h:163 [inline]\n __refcount_inc_not_zero include/linux/refcount.h:227 [inline]\n refcount_inc_not_zero include/linux/refcount.h:245 [inline]\n sk_psock_get+0x3bc/0x410 include/linux/skmsg.h:439\n tls_data_ready+0x6d/0x1b0 net/tls/tls_sw.c:2091\n tcp_data_ready+0x106/0x520 net/ipv4/tcp_input.c:4983\n tcp_data_queue+0x25f2/0x4c90 net/ipv4/tcp_input.c:5057\n tcp_rcv_state_process+0x1774/0x4e80 net/ipv4/tcp_input.c:6659\n tcp_v4_do_rcv+0x339/0x980 net/ipv4/tcp_ipv4.c:1682\n sk_backlog_rcv include/net/sock.h:1061 [inline]\n __release_sock+0x134/0x3b0 net/core/sock.c:2849\n release_sock+0x54/0x1b0 net/core/sock.c:3404\n inet_shutdown+0x1e0/0x430 net/ipv4/af_inet.c:909\n __sys_shutdown_sock net/socket.c:2331 [inline]\n __sys_shutdown_sock net/socket.c:2325 [inline]\n __sys_shutdown+0xf1/0x1b0 net/socket.c:2343\n __do_sys_shutdown net/socket.c:2351 [inline]\n __se_sys_shutdown net/socket.c:2349 [inline]\n __x64_sys_shutdown+0x50/0x70 net/socket.c:2349\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n \u003c/TASK\u003e\n\nDuring SMC fallback process in connect syscall, kernel will\nreplaces TCP with SMC. In order to forward wakeup\nsmc socket waitqueue after fallback, kernel will sets\nclcsk-\u003esk_user_data to origin smc socket in\nsmc_fback_replace_callbacks().\n\nLater, in shutdown syscall, kernel will calls\nsk_psock_get(), which treats the clcsk-\u003esk_user_data\nas psock type, triggering the refcnt warning.\n\nSo, the root cause is that smc and psock, both will use\nsk_user_data field. So they will mismatch this field\neasily.\n\nThis patch solves it by using another bit(defined as\nSK_USER_DATA_PSOCK) in PTRMASK, to mark whether\nsk_user_data points to a psock object or not.\nThis patch depends on a PTRMASK introduced in commit f1ff5ce2cd5e\n(\"net, sk_msg: Clear sk_user_data pointer on clone if tagged\").\n\nFor there will possibly be more flags in the sk_user_data field,\nthis patch also refactor sk_user_data flags code to be more generic\nto improve its maintainability.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3dd14405-9297-4f09-a24e-28e98ed47b04",
      "id": "CVE-2022-50086",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't allow the same type rq_qos add more than once\n\nIn our test of iocost, we encountered some list add/del corruptions of\ninner_walk list in ioc_timer_fn.\n\nThe reason can be described as follows:\n\ncpu 0\t\t\t\t\tcpu 1\nioc_qos_write\t\t\t\tioc_qos_write\n\nioc = q_to_ioc(queue);\nif (!ioc) {\n        ioc = kzalloc();\n\t\t\t\t\tioc = q_to_ioc(queue);\n\t\t\t\t\tif (!ioc) {\n\t\t\t\t\t\tioc = kzalloc();\n\t\t\t\t\t\t...\n\t\t\t\t\t\trq_qos_add(q, rqos);\n\t\t\t\t\t}\n        ...\n        rq_qos_add(q, rqos);\n        ...\n}\n\nWhen the io.cost.qos file is written by two cpus concurrently, rq_qos may\nbe added to one disk twice. In that case, there will be two iocs enabled\nand running on one disk. They own different iocgs on their active list. In\nthe ioc_timer_fn function, because of the iocgs from two iocs have the\nsame root iocg, the root iocg's walk_list may be overwritten by each other\nand this leads to list add/del corruptions in building or destroying the\ninner_walk list.\n\nAnd so far, the blk-rq-qos framework works in case that one instance for\none type rq_qos per queue by default. This patch make this explicit and\nalso fix the crash above.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1ab8eaa7-9ba1-4678-bdec-73b303f771d7",
      "id": "CVE-2022-50109",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: amba-clcd: Fix refcount leak bugs\n\nIn clcdfb_of_init_display(), we should call of_node_put() for the\nreferences returned by of_graph_get_next_endpoint() and\nof_graph_get_remote_port_parent() which have increased the refcount.\n\nBesides, we should call of_node_put() both in fail path or when\nthe references are not used anymore.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "347313b0-77e8-4902-9fdc-efc9a21daeba",
      "id": "CVE-2022-50174",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: avoid kernel hung in hinic_get_stats64()\n\nWhen using hinic device as a bond slave device, and reading device stats\nof master bond device, the kernel may hung.\n\nThe kernel panic calltrace as follows:\nKernel panic - not syncing: softlockup: hung tasks\nCall trace:\n  native_queued_spin_lock_slowpath+0x1ec/0x31c\n  dev_get_stats+0x60/0xcc\n  dev_seq_printf_stats+0x40/0x120\n  dev_seq_show+0x1c/0x40\n  seq_read_iter+0x3c8/0x4dc\n  seq_read+0xe0/0x130\n  proc_reg_read+0xa8/0xe0\n  vfs_read+0xb0/0x1d4\n  ksys_read+0x70/0xfc\n  __arm64_sys_read+0x20/0x30\n  el0_svc_common+0x88/0x234\n  do_el0_svc+0x2c/0x90\n  el0_svc+0x1c/0x30\n  el0_sync_handler+0xa8/0xb0\n  el0_sync+0x148/0x180\n\nAnd the calltrace of task that actually caused kernel hungs as follows:\n  __switch_to+124\n  __schedule+548\n  schedule+72\n  schedule_timeout+348\n  __down_common+188\n  __down+24\n  down+104\n  hinic_get_stats64+44 [hinic]\n  dev_get_stats+92\n  bond_get_stats+172 [bonding]\n  dev_get_stats+92\n  dev_seq_printf_stats+60\n  dev_seq_show+24\n  seq_read_iter+964\n  seq_read+220\n  proc_reg_read+164\n  vfs_read+172\n  ksys_read+108\n  __arm64_sys_read+28\n  el0_svc_common+132\n  do_el0_svc+40\n  el0_svc+24\n  el0_sync_handler+164\n  el0_sync+324\n\nWhen getting device stats from bond, kernel will call bond_get_stats().\nIt first holds the spinlock bond-\u003estats_lock, and then call\nhinic_get_stats64() to collect hinic device's stats.\nHowever, hinic_get_stats64() calls `down(\u0026nic_dev-\u003emgmt_lock)` to\nprotect its critical section, which may schedule current task out.\nAnd if system is under high pressure, the task cannot be woken up\nimmediately, which eventually triggers kernel hung panic.\n\nSince previous patch has replaced hinic_dev.tx_stats/rx_stats with local\nvariable in hinic_get_stats64(), there is nothing need to be protected\nby lock, so just removing down()/up() is ok.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ade6a86-95e6-4c5e-8412-3ab5f493e9cf",
      "id": "CVE-2022-50229",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: Fix a UAF bug on the error path of probing\n\nWhen the driver fails in snd_card_register() at probe time, it will free\nthe 'bcd2k-\u003emidi_out_urb' before killing it, which may cause a UAF bug.\n\nThe following log can reveal it:\n\n[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]\n[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0\n[   50.729530] Call Trace:\n[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]\n\nFix this by adding usb_kill_urb() before usb_free_urb().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ff7fb6c6-1aa4-476f-a4c5-bf7cb129fd0c",
      "id": "CVE-2022-50385",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix an Oops in nfs_d_automount()\n\nWhen mounting from a NFSv4 referral, path-\u003edentry can end up being a\nnegative dentry, so derive the struct nfs_server from the dentry\nitself instead.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "15a9f77d-c84c-4b2a-8e85-79941cbe9e40",
      "id": "CVE-2022-50393",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: SDMA update use unlocked iterator\n\nSDMA update page table may be called from unlocked context, this\ngenerate below warning. Use unlocked iterator to handle this case.\n\nWARNING: CPU: 0 PID: 1475 at\ndrivers/dma-buf/dma-resv.c:483 dma_resv_iter_next\nCall Trace:\n dma_resv_iter_first+0x43/0xa0\n amdgpu_vm_sdma_update+0x69/0x2d0 [amdgpu]\n amdgpu_vm_ptes_update+0x29c/0x870 [amdgpu]\n amdgpu_vm_update_range+0x2f6/0x6c0 [amdgpu]\n svm_range_unmap_from_gpus+0x115/0x300 [amdgpu]\n svm_range_cpu_invalidate_pagetables+0x510/0x5e0 [amdgpu]\n __mmu_notifier_invalidate_range_start+0x1d3/0x230\n unmap_vmas+0x140/0x150\n unmap_region+0xa8/0x110",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0a996b68-f80a-4008-8701-7886ccbd37c5",
      "id": "CVE-2022-50422",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix use-after-free bug in smp_execute_task_sg()\n\nWhen executing SMP task failed, the smp_execute_task_sg() calls del_timer()\nto delete \"slow_task-\u003etimer\". However, if the timer handler\nsas_task_internal_timedout() is running, the del_timer() in\nsmp_execute_task_sg() will not stop it and a UAF will happen. The process\nis shown below:\n\n      (thread 1)               |        (thread 2)\nsmp_execute_task_sg()          | sas_task_internal_timedout()\n ...                           |\n del_timer()                   |\n ...                           |  ...\n sas_free_task(task)           |\n  kfree(task-\u003eslow_task) //FREE|\n                               |  task-\u003eslow_task-\u003e... //USE\n\nFix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure\nthe timer handler have finished before the \"task-\u003eslow_task\" is\ndeallocated.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dcf11978-e107-4e84-abc8-2b934d10daba",
      "id": "CVE-2023-0458",
      "description": "A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bb2f6650-6174-44c4-b32d-8235e9b8ad13",
      "id": "CVE-2023-0461",
      "description": "There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.\n\nThere is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.\n\nWhen CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.\n\nThe setsockopt TCP_ULP operation does not require any privilege.\n\nWe recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7c83776-a422-4d45-b18f-2989e7471eca",
      "id": "CVE-2023-1476",
      "description": "A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "194726a0-0aab-40e9-b067-042a605a7bd9",
      "id": "CVE-2023-2007",
      "description": "The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "275ab121-78d0-4b35-a499-6a5e1e28ba98",
      "id": "CVE-2024-35933",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: Fix null ptr deref in btintel_read_version\n\nIf hci_cmd_sync_complete() is triggered and skb is NULL, then\nhdev-\u003ereq_skb is NULL, which will cause this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "87df165d-9ed4-455b-9bc7-de24ceeba604",
      "id": "CVE-2023-22999",
      "description": "In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2b784eec-3a52-4db1-9220-be1a7c7ba266",
      "id": "CVE-2023-23000",
      "description": "In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e1a79d6a-0762-4144-90fe-b3dbce2e4966",
      "id": "CVE-2023-3390",
      "description": "A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c.\n\nMishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue.\n\nWe recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1949f2bb-d2e8-43bc-ab4e-ab00708ec4fd",
      "id": "CVE-2023-3776",
      "description": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.\n\nIf tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.\n\nWe recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4ee0f78c-f212-4eae-993c-686ce50665b3",
      "id": "CVE-2023-52831",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpu/hotplug: Don't offline the last non-isolated CPU\n\nIf a system has isolated CPUs via the \"isolcpus=\" command line parameter,\nthen an attempt to offline the last housekeeping CPU will result in a\nWARN_ON() when rebuilding the scheduler domains and a subsequent panic due\nto and unhandled empty CPU mas in partition_sched_domains_locked().\n\ncpuset_hotplug_workfn()\n  rebuild_sched_domains_locked()\n    ndoms = generate_sched_domains(\u0026doms, \u0026attr);\n      cpumask_and(doms[0], top_cpuset.effective_cpus, housekeeping_cpumask(HK_FLAG_DOMAIN));\n\nThus results in an empty CPU mask which triggers the warning and then the\nsubsequent crash:\n\nWARNING: CPU: 4 PID: 80 at kernel/sched/topology.c:2366 build_sched_domains+0x120c/0x1408\nCall trace:\n build_sched_domains+0x120c/0x1408\n partition_sched_domains_locked+0x234/0x880\n rebuild_sched_domains_locked+0x37c/0x798\n rebuild_sched_domains+0x30/0x58\n cpuset_hotplug_workfn+0x2a8/0x930\n\nUnable to handle kernel paging request at virtual address fffe80027ab37080\n partition_sched_domains_locked+0x318/0x880\n rebuild_sched_domains_locked+0x37c/0x798\n\nAside of the resulting crash, it does not make any sense to offline the last\nlast housekeeping CPU.\n\nPrevent this by masking out the non-housekeeping CPUs when selecting a\ntarget CPU for initiating the CPU unplug operation via the work queue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "acd0808c-a21f-4686-b1cc-23d4fb7582c5",
      "id": "CVE-2023-51042",
      "description": "In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "62b0042f-3187-4934-b178-0a9fd4892b06",
      "id": "CVE-2023-52510",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: ca8210: Fix a potential UAF in ca8210_probe\n\nIf of_clk_add_provider() fails in ca8210_register_ext_clock(),\nit calls clk_unregister() to release priv-\u003eclk and returns an\nerror. However, the caller ca8210_probe() then calls ca8210_remove(),\nwhere priv-\u003eclk is freed again in ca8210_unregister_ext_clock(). In\nthis case, a use-after-free may happen in the second time we call\nclk_unregister().\n\nFix this by removing the first clk_unregister(). Also, priv-\u003eclk could\nbe an error code on failure of clk_register_fixed_rate(). Use\nIS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab9b103a-aa34-4795-a902-d9991a5ced91",
      "id": "CVE-2023-52679",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: Fix double free in of_parse_phandle_with_args_map\n\nIn of_parse_phandle_with_args_map() the inner loop that\niterates through the map entries calls of_node_put(new)\nto free the reference acquired by the previous iteration\nof the inner loop. This assumes that the value of \"new\" is\nNULL on the first iteration of the inner loop.\n\nMake sure that this is true in all iterations of the outer\nloop by setting \"new\" to NULL after its value is assigned to \"cur\".\n\nExtend the unittest to detect the double free and add an additional\ntest case that actually triggers this path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f307f76d-bde6-414a-a059-990ef1aca9ce",
      "id": "CVE-2023-52686",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/powernv: Add a null pointer check in opal_event_init()\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3a35ddc0-3161-4b57-83eb-fb0609a41da3",
      "id": "CVE-2023-52730",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdio: fix possible resource leaks in some error paths\n\nIf sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can\nnot release the resources, because the sdio function is not presented\nin these two cases, it won't call of_node_put() or put_device().\n\nTo fix these leaks, make sdio_func_present() only control whether\ndevice_del() needs to be called or not, then always call of_node_put()\nand put_device().\n\nIn error case in sdio_init_func(), the reference of 'card-\u003edev' is\nnot get, to avoid redundant put in sdio_free_func_cis(), move the\nget_device() to sdio_alloc_func() and put_device() to sdio_release_func(),\nit can keep the get/put function be balanced.\n\nWithout this patch, while doing fault inject test, it can get the\nfollowing leak reports, after this fix, the leak is gone.\n\nunreferenced object 0xffff888112514000 (size 2048):\n  comm \"kworker/3:2\", pid 65, jiffies 4294741614 (age 124.774s)\n  hex dump (first 32 bytes):\n    00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff  ..o.....`X......\n    10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff  .@Q......@Q.....\n  backtrace:\n    [\u003c000000009e5931da\u003e] kmalloc_trace+0x21/0x110\n    [\u003c000000002f839ccb\u003e] mmc_alloc_card+0x38/0xb0 [mmc_core]\n    [\u003c0000000004adcbf6\u003e] mmc_sdio_init_card+0xde/0x170 [mmc_core]\n    [\u003c000000007538fea0\u003e] mmc_attach_sdio+0xcb/0x1b0 [mmc_core]\n    [\u003c00000000d4fdeba7\u003e] mmc_rescan+0x54a/0x640 [mmc_core]\n\nunreferenced object 0xffff888112511000 (size 2048):\n  comm \"kworker/3:2\", pid 65, jiffies 4294741623 (age 124.766s)\n  hex dump (first 32 bytes):\n    00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff  .@Q......X......\n    10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff  ..Q.......Q.....\n  backtrace:\n    [\u003c000000009e5931da\u003e] kmalloc_trace+0x21/0x110\n    [\u003c00000000fcbe706c\u003e] sdio_alloc_func+0x35/0x100 [mmc_core]\n    [\u003c00000000c68f4b50\u003e] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core]\n    [\u003c00000000d4fdeba7\u003e] mmc_rescan+0x54a/0x640 [mmc_core]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7d06cfd0-8b92-4175-b0ae-3bb7c8773af5",
      "id": "CVE-2023-52898",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Fix null pointer dereference when host dies\n\nMake sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race\nand cause null pointer dereference when host suddenly dies.\n\nUsb core may call xhci_free_dev() which frees the xhci-\u003edevs[slot_id]\nvirt device at the same time that xhci_kill_endpoint_urbs() tries to\nloop through all the device's endpoints, checking if there are any\ncancelled urbs left to give back.\n\nhold the xhci spinlock while freeing the virt device",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0e946cc5-9ba6-438d-8f58-97c66dbc4795",
      "id": "CVE-2023-52932",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swapfile: add cond_resched() in get_swap_pages()\n\nThe softlockup still occurs in get_swap_pages() under memory pressure.  64\nCPU cores, 64GB memory, and 28 zram devices, the disksize of each zram\ndevice is 50MB with same priority as si.  Use the stress-ng tool to\nincrease memory pressure, causing the system to oom frequently.\n\nThe plist_for_each_entry_safe() loops in get_swap_pages() could reach tens\nof thousands of times to find available space (extreme case:\ncond_resched() is not called in scan_swap_map_slots()).  Let's add\ncond_resched() into get_swap_pages() when failed to find available space\nto avoid softlockup.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dec8c3e6-687d-4887-8e52-d7ec9c0e18f7",
      "id": "CVE-2023-53241",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: call op_release, even when op_func returns an error\n\nFor ops with \"trivial\" replies, nfsd4_encode_operation will shortcut\nmost of the encoding work and skip to just marshalling up the status.\nOne of the things it skips is calling op_release. This could cause a\nmemory leak in the layoutget codepath if there is an error at an\ninopportune time.\n\nHave the compound processing engine always call op_release, even when\nop_func sets an error in op-\u003estatus. With this change, we also need\nnfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL\non error to avoid a double free.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fb1ff85d-12f4-472d-bfb2-96772fe4f8b8",
      "id": "CVE-2023-53415",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc3: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.\n\nNote, the root dentry for the debugfs directory for the device needs to\nbe saved so we don't have to keep looking it up, which required a bit\nmore refactoring to properly create and remove it when needed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a66e569a-3b45-4048-b617-a4bc717ff8f5",
      "id": "CVE-2023-53417",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: sl811: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8dc25116-a7bc-427a-9f44-cf0aa515d067",
      "id": "CVE-2024-27019",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()\n\nnft_unregister_obj() can concurrent with __nft_obj_type_get(),\nand there is not any protection when iterate over nf_tables_objects\nlist in __nft_obj_type_get(). Therefore, there is potential data-race\nof nf_tables_objects list entry.\n\nUse list_for_each_entry_rcu() to iterate over nf_tables_objects\nlist in __nft_obj_type_get(), and use rcu_read_lock() in the caller\nnft_obj_type_get() to protect the entire type query process.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "00992fd8-a241-4285-ae9d-1e979731d77e",
      "id": "CVE-2023-53427",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix warning and UAF when destroy the MR list\n\nIf the MR allocate failed, the MR recovery work not initialized\nand list not cleared. Then will be warning and UAF when release\nthe MR:\n\n  WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110\n  CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82\n  RIP: 0010:__flush_work.isra.0+0xf7/0x110\n  Call Trace:\n   \u003cTASK\u003e\n   __cancel_work_timer+0x2ba/0x2e0\n   smbd_destroy+0x4e1/0x990\n   _smbd_get_connection+0x1cbd/0x2110\n   smbd_get_connection+0x21/0x40\n   cifs_get_tcp_session+0x8ef/0xda0\n   mount_get_conns+0x60/0x750\n   cifs_mount+0x103/0xd00\n   cifs_smb3_do_mount+0x1dd/0xcb0\n   smb3_get_tree+0x1d5/0x300\n   vfs_get_tree+0x41/0xf0\n   path_mount+0x9b3/0xdd0\n   __x64_sys_mount+0x190/0x1d0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\n  BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990\n  Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824\n  CPU: 4 PID: 824 Comm: mount.cifs Tainted: G        W          6.1.0-rc5+ #82\n  Call Trace:\n   dump_stack_lvl+0x34/0x44\n   print_report+0x171/0x472\n   kasan_report+0xad/0x130\n   smbd_destroy+0x4fc/0x990\n   _smbd_get_connection+0x1cbd/0x2110\n   smbd_get_connection+0x21/0x40\n   cifs_get_tcp_session+0x8ef/0xda0\n   mount_get_conns+0x60/0x750\n   cifs_mount+0x103/0xd00\n   cifs_smb3_do_mount+0x1dd/0xcb0\n   smb3_get_tree+0x1d5/0x300\n   vfs_get_tree+0x41/0xf0\n   path_mount+0x9b3/0xdd0\n   __x64_sys_mount+0x190/0x1d0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\n  Allocated by task 824:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   __kasan_kmalloc+0x7a/0x90\n   _smbd_get_connection+0x1b6f/0x2110\n   smbd_get_connection+0x21/0x40\n   cifs_get_tcp_session+0x8ef/0xda0\n   mount_get_conns+0x60/0x750\n   cifs_mount+0x103/0xd00\n   cifs_smb3_do_mount+0x1dd/0xcb0\n   smb3_get_tree+0x1d5/0x300\n   vfs_get_tree+0x41/0xf0\n   path_mount+0x9b3/0xdd0\n   __x64_sys_mount+0x190/0x1d0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\n  Freed by task 824:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   kasan_save_free_info+0x2a/0x40\n   ____kasan_slab_free+0x143/0x1b0\n   __kmem_cache_free+0xc8/0x330\n   _smbd_get_connection+0x1c6a/0x2110\n   smbd_get_connection+0x21/0x40\n   cifs_get_tcp_session+0x8ef/0xda0\n   mount_get_conns+0x60/0x750\n   cifs_mount+0x103/0xd00\n   cifs_smb3_do_mount+0x1dd/0xcb0\n   smb3_get_tree+0x1d5/0x300\n   vfs_get_tree+0x41/0xf0\n   path_mount+0x9b3/0xdd0\n   __x64_sys_mount+0x190/0x1d0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nLet's initialize the MR recovery work before MR allocate to prevent\nthe warning, remove the MRs from the list to prevent the UAF.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "99333833-b0d4-47b4-8018-a4e807f22d71",
      "id": "CVE-2024-26587",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netdevsim: don't try to destroy PHC on VFs\n\nPHC gets initialized in nsim_init_netdevsim(), which\nis only called if (nsim_dev_port_is_pf()).\n\nCreate a counterpart of nsim_init_netdevsim() and\nmove the mock_phc_destroy() there.\n\nThis fixes a crash trying to destroy netdevsim with\nVFs instantiated, as caught by running the devlink.sh test:\n\n    BUG: kernel NULL pointer dereference, address: 00000000000000b8\n    RIP: 0010:mock_phc_destroy+0xd/0x30\n    Call Trace:\n     \u003cTASK\u003e\n     nsim_destroy+0x4a/0x70 [netdevsim]\n     __nsim_dev_port_del+0x47/0x70 [netdevsim]\n     nsim_dev_reload_destroy+0x105/0x120 [netdevsim]\n     nsim_drv_remove+0x2f/0xb0 [netdevsim]\n     device_release_driver_internal+0x1a1/0x210\n     bus_remove_device+0xd5/0x120\n     device_del+0x159/0x490\n     device_unregister+0x12/0x30\n     del_device_store+0x11a/0x1a0 [netdevsim]\n     kernfs_fop_write_iter+0x130/0x1d0\n     vfs_write+0x30b/0x4b0\n     ksys_write+0x69/0xf0\n     do_syscall_64+0xcc/0x1e0\n     entry_SYSCALL_64_after_hwframe+0x6f/0x77",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "227adcfb-1c38-48b7-90a0-9d24aaedc1a9",
      "id": "CVE-2024-26601",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: regenerate buddy after block freeing failed if under fc replay\n\nThis mostly reverts commit 6bd97bf273bd (\"ext4: remove redundant\nmb_regenerate_buddy()\") and reintroduces mb_regenerate_buddy(). Based on\ncode in mb_free_blocks(), fast commit replay can end up marking as free\nblocks that are already marked as such. This causes corruption of the\nbuddy bitmap so we need to regenerate it in that case.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "28cb90fa-5c74-419d-8f37-881de452e903",
      "id": "CVE-2024-26743",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/qedr: Fix qedr_create_user_qp error flow\n\nAvoid the following warning by making sure to free the allocated\nresources in case that qedr_init_user_queue() fail.\n\n-----------[ cut here ]-----------\nWARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nModules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3\nghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt]\nCPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1\nHardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022\nRIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nCode: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 \u003c0f\u003e 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff\nRSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286\nRAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016\nRDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600\nRBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80\nR13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0\nCall Trace:\n\u003cTASK\u003e\n? show_trace_log_lvl+0x1c4/0x2df\n? show_trace_log_lvl+0x1c4/0x2df\n? ib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? __warn+0x81/0x110\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\n? report_bug+0x10a/0x140\n? handle_bug+0x3c/0x70\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs]\nib_uverbs_close+0x1f/0xb0 [ib_uverbs]\n__fput+0x94/0x250\ntask_work_run+0x5c/0x90\ndo_exit+0x270/0x4a0\ndo_group_exit+0x2d/0x90\nget_signal+0x87c/0x8c0\narch_do_signal_or_restart+0x25/0x100\n? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs]\nexit_to_user_mode_loop+0x9c/0x130\nexit_to_user_mode_prepare+0xb6/0x100\nsyscall_exit_to_user_mode+0x12/0x40\ndo_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? syscall_exit_work+0x103/0x130\n? syscall_exit_to_user_mode+0x22/0x40\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\n? common_interrupt+0x43/0xa0\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x1470abe3ec6b\nCode: Unable to access opcode bytes at RIP 0x1470abe3ec41.\nRSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b\nRDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004\nRBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00\nR10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358\nR13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470\n\u003c/TASK\u003e\n--[ end trace 888a9b92e04c5c97 ]--",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dd245bda-369a-4aa1-a07a-520ab6df0817",
      "id": "CVE-2024-26859",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/bnx2x: Prevent access to a freed page in page_pool\n\nFix race condition leading to system crash during EEH error handling\n\nDuring EEH error recovery, the bnx2x driver's transmit timeout logic\ncould cause a race condition when handling reset tasks. The\nbnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),\nwhich ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()\nSGEs are freed using bnx2x_free_rx_sge_range(). However, this could\noverlap with the EEH driver's attempt to reset the device using\nbnx2x_io_slot_reset(), which also tries to free SGEs. This race\ncondition can result in system crashes due to accessing freed memory\nlocations in bnx2x_free_rx_sge()\n\n799  static inline void bnx2x_free_rx_sge(struct bnx2x *bp,\n800\t\t\t\tstruct bnx2x_fastpath *fp, u16 index)\n801  {\n802\tstruct sw_rx_page *sw_buf = \u0026fp-\u003erx_page_ring[index];\n803     struct page *page = sw_buf-\u003epage;\n....\nwhere sw_buf was set to NULL after the call to dma_unmap_page()\nby the preceding thread.\n\n    EEH: Beginning: 'slot_reset'\n    PCI 0011:01:00.0#10000: EEH: Invoking bnx2x-\u003eslot_reset()\n    bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...\n    bnx2x 0011:01:00.0: enabling device (0140 -\u003e 0142)\n    bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --\u003e driver unload\n    Kernel attempted to read user page (0) - exploit attempt? (uid: 0)\n    BUG: Kernel NULL pointer dereference on read at 0x00000000\n    Faulting instruction address: 0xc0080000025065fc\n    Oops: Kernel access of bad area, sig: 11 [#1]\n    .....\n    Call Trace:\n    [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)\n    [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0\n    [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550\n    [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60\n    [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170\n    [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0\n    [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64\n\nTo solve this issue, we need to verify page pool allocations before\nfreeing.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e9a1e479-16ae-4a66-86e4-75a89d103a22",
      "id": "CVE-2024-26920",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/trigger: Fix to return error if failed to alloc snapshot\n\nFix register_snapshot_trigger() to return error code if it failed to\nallocate a snapshot instead of 0 (success). Unless that, it will register\nsnapshot trigger without an error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9f975f8f-9ef8-42e4-9bad-8765122591ab",
      "id": "CVE-2024-35997",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up\n\nThe flag I2C_HID_READ_PENDING is used to serialize I2C operations.\nHowever, this is not necessary, because I2C core already has its own\nlocking for that.\n\nMore importantly, this flag can cause a lock-up: if the flag is set in\ni2c_hid_xfer() and an interrupt happens, the interrupt handler\n(i2c_hid_irq) will check this flag and return immediately without doing\nanything, then the interrupt handler will be invoked again in an\ninfinite loop.\n\nSince interrupt handler is an RT task, it takes over the CPU and the\nflag-clearing task never gets scheduled, thus we have a lock-up.\n\nDelete this unnecessary flag.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "60e09555-b922-4fb3-b2e8-fd26c8b4f5af",
      "id": "CVE-2024-36015",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppdev: Add an error check in register_device\n\nIn register_device, the return value of ida_simple_get is unchecked,\nin witch ida_simple_get will use an invalid index value.\n\nTo address this issue, index should be checked after ida_simple_get. When\nthe index value is abnormal, a warning message should be printed, the port\nshould be dropped, and the value should be recorded.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0f673308-d6a7-499c-8944-c572c4a345d0",
      "id": "CVE-2024-36479",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: bridge: add owner module and take its refcount\n\nThe current implementation of the fpga bridge assumes that the low-level\nmodule registers a driver for the parent device and uses its owner pointer\nto take the module's refcount. This approach is problematic since it can\nlead to a null pointer dereference while attempting to get the bridge if\nthe parent device does not have a driver.\n\nTo address this problem, add a module owner pointer to the fpga_bridge\nstruct and use it to take the module's refcount. Modify the function for\nregistering a bridge to take an additional owner module parameter and\nrename it to avoid conflicts. Use the old function name for a helper macro\nthat automatically sets the module that registers the bridge as the owner.\nThis ensures compatibility with existing low-level control modules and\nreduces the chances of registering a bridge without setting the owner.\n\nAlso, update the documentation to keep it consistent with the new interface\nfor registering an fpga bridge.\n\nOther changes: opportunistically move put_device() from __fpga_bridge_get()\nto fpga_bridge_get() and of_fpga_bridge_get() to improve code clarity since\nthe bridge device is taken in these functions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "636c3dd6-71c3-49f9-8262-e970bba1549f",
      "id": "CVE-2024-36969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix division by zero in setup_dsc_config\n\nWhen slice_height is 0, the division by slice_height in the calculation\nof the number of slices will cause a division by zero driver crash. This\nleaves the kernel in a state that requires a reboot. This patch adds a\ncheck to avoid the division by zero.\n\nThe stack trace below is for the 6.8.4 Kernel. I reproduced the issue on\na Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor\nconnected via Thunderbolt. The amdgpu driver crashed with this exception\nwhen I rebooted the system with the monitor connected.\n\nkernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)\nkernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154)\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175)\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2))\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548)\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu\n\nAfter applying this patch, the driver no longer crashes when the monitor\nis connected and the system is rebooted. I believe this is the same\nissue reported for 3113.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9c721d8c-c67c-40f0-80f3-c34340998cdd",
      "id": "CVE-2024-43858",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix array-index-out-of-bounds in diFree",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "03bae848-eb38-4f8b-bb41-13d81438acd4",
      "id": "CVE-2024-40998",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix uninitialized ratelimit_state-\u003elock access in __ext4_fill_super()\n\nIn the following concurrency we will access the uninitialized rs-\u003elock:\n\next4_fill_super\n  ext4_register_sysfs\n   // sysfs registered msg_ratelimit_interval_ms\n                             // Other processes modify rs-\u003einterval to\n                             // non-zero via msg_ratelimit_interval_ms\n  ext4_orphan_cleanup\n    ext4_msg(sb, KERN_INFO, \"Errors on filesystem, \"\n      __ext4_msg\n        ___ratelimit(\u0026(EXT4_SB(sb)-\u003es_msg_ratelimit_state)\n          if (!rs-\u003einterval)  // do nothing if interval is 0\n            return 1;\n          raw_spin_trylock_irqsave(\u0026rs-\u003elock, flags)\n            raw_spin_trylock(lock)\n              _raw_spin_trylock\n                __raw_spin_trylock\n                  spin_acquire(\u0026lock-\u003edep_map, 0, 1, _RET_IP_)\n                    lock_acquire\n                      __lock_acquire\n                        register_lock_class\n                          assign_lock_key\n                            dump_stack();\n  ratelimit_state_init(\u0026sbi-\u003es_msg_ratelimit_state, 5 * HZ, 10);\n    raw_spin_lock_init(\u0026rs-\u003elock);\n    // init rs-\u003elock here\n\nand get the following dump_stack:\n\n=========================================================\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nCPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504\n[...]\nCall Trace:\n dump_stack_lvl+0xc5/0x170\n dump_stack+0x18/0x30\n register_lock_class+0x740/0x7c0\n __lock_acquire+0x69/0x13a0\n lock_acquire+0x120/0x450\n _raw_spin_trylock+0x98/0xd0\n ___ratelimit+0xf6/0x220\n __ext4_msg+0x7f/0x160 [ext4]\n ext4_orphan_cleanup+0x665/0x740 [ext4]\n __ext4_fill_super+0x21ea/0x2b10 [ext4]\n ext4_fill_super+0x14d/0x360 [ext4]\n[...]\n=========================================================\n\nNormally interval is 0 until s_msg_ratelimit_state is initialized, so\n___ratelimit() does nothing. But registering sysfs precedes initializing\nrs-\u003elock, so it is possible to change rs-\u003einterval to a non-zero value\nvia the msg_ratelimit_interval_ms interface of sysfs while rs-\u003elock is\nuninitialized, and then a call to ext4_msg triggers the problem by\naccessing an uninitialized rs-\u003elock. Therefore register sysfs after all\ninitializations are complete to avoid such problems.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "020f2e9d-5325-4994-b41b-b09448ed9001",
      "id": "CVE-2024-41059",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix uninit-value in copy_name\n\n[syzbot reported]\nBUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160\n sized_strscpy+0xc4/0x160\n copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411\n hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750\n vfs_listxattr fs/xattr.c:493 [inline]\n listxattr+0x1f3/0x6b0 fs/xattr.c:840\n path_listxattr fs/xattr.c:864 [inline]\n __do_sys_listxattr fs/xattr.c:876 [inline]\n __se_sys_listxattr fs/xattr.c:873 [inline]\n __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873\n x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3877 [inline]\n slab_alloc_node mm/slub.c:3918 [inline]\n kmalloc_trace+0x57b/0xbe0 mm/slub.c:4065\n kmalloc include/linux/slab.h:628 [inline]\n hfsplus_listxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699\n vfs_listxattr fs/xattr.c:493 [inline]\n listxattr+0x1f3/0x6b0 fs/xattr.c:840\n path_listxattr fs/xattr.c:864 [inline]\n __do_sys_listxattr fs/xattr.c:876 [inline]\n __se_sys_listxattr fs/xattr.c:873 [inline]\n __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873\n x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[Fix]\nWhen allocating memory to strbuf, initialize memory to 0.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "63ae517a-e05a-484e-ab85-d605737e308f",
      "id": "CVE-2024-41076",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix memory leak in nfs4_set_security_label\n\nWe leak nfs_fattr and nfs4_label every time we set a security xattr.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0dcf5c59-1279-4217-bd80-8c4e1f447100",
      "id": "CVE-2024-42161",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD\n\n[Changes from V1:\n - Use a default branch in the switch statement to initialize `val'.]\n\nGCC warns that `val' may be used uninitialized in the\nBPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:\n\n\t[...]\n\tunsigned long long val;\t\t\t\t\t\t      \\\n\t[...]\t\t\t\t\t\t\t\t      \\\n\tswitch (__CORE_RELO(s, field, BYTE_SIZE)) {\t\t\t      \\\n\tcase 1: val = *(const unsigned char *)p; break;\t\t\t      \\\n\tcase 2: val = *(const unsigned short *)p; break;\t\t      \\\n\tcase 4: val = *(const unsigned int *)p; break;\t\t\t      \\\n\tcase 8: val = *(const unsigned long long *)p; break;\t\t      \\\n        }       \t\t\t\t\t\t\t      \\\n\t[...]\n\tval;\t\t\t\t\t\t\t\t      \\\n\t}\t\t\t\t\t\t\t\t      \\\n\nThis patch adds a default entry in the switch statement that sets\n`val' to zero in order to avoid the warning, and random values to be\nused in case __builtin_preserve_field_info returns unexpected values\nfor BPF_FIELD_BYTE_SIZE.\n\nTested in bpf-next master.\nNo regressions.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6b6a5141-a22b-46f5-8ae6-cf1e167a1952",
      "id": "CVE-2024-42259",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix Virtual Memory mapping boundaries calculation\n\nCalculating the size of the mapped area as the lesser value\nbetween the requested size and the actual size does not consider\nthe partial mapping offset. This can cause page fault access.\n\nFix the calculation of the starting and ending addresses, the\ntotal size is now deduced from the difference between the end and\nstart addresses.\n\nAdditionally, the calculations have been rewritten in a clearer\nand more understandable form.\n\n[Joonas: Add Requires: tag]\nRequires: 60a2066c5005 (\"drm/i915/gem: Adjust vma offset for framebuffer mmap offset\")\n(cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "75c6aacb-cdb9-4f16-9a3e-81f16ed9d044",
      "id": "CVE-2024-44963",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() when freeing tree block after error\n\nWhen freeing a tree block, at btrfs_free_tree_block(), if we fail to\ncreate a delayed reference we don't deal with the error and just do a\nBUG_ON(). The error most likely to happen is -ENOMEM, and we have a\ncomment mentioning that only -ENOMEM can happen, but that is not true,\nbecause in case qgroups are enabled any error returned from\nbtrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned\nfrom btrfs_search_slot() for example) can be propagated back to\nbtrfs_free_tree_block().\n\nSo stop doing a BUG_ON() and return the error to the callers and make\nthem abort the transaction to prevent leaking space. Syzbot was\ntriggering this, likely due to memory allocation failure injection.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c90b436a-38a5-41d1-8138-141f09efe0b9",
      "id": "CVE-2024-46749",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()\n\nThis adds a check before freeing the rx-\u003eskb in flush and close\nfunctions to handle the kernel crash seen while removing driver after FW\ndownload fails or before FW download completes.\n\ndmesg log:\n[   54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080\n[   54.643398] Mem abort info:\n[   54.646204]   ESR = 0x0000000096000004\n[   54.649964]   EC = 0x25: DABT (current EL), IL = 32 bits\n[   54.655286]   SET = 0, FnV = 0\n[   54.658348]   EA = 0, S1PTW = 0\n[   54.661498]   FSC = 0x04: level 0 translation fault\n[   54.666391] Data abort info:\n[   54.669273]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[   54.674768]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[   54.674771]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[   54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000\n[   54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000\n[   54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[   54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse\n[   54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2\n[   54.744364] Hardware name: FSL i.MX8MM EVK board (DT)\n[   54.744368] Workqueue: hci0 hci_power_on\n[   54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   54.757249] pc : kfree_skb_reason+0x18/0xb0\n[   54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart]\n[   54.782921] sp : ffff8000805ebca0\n[   54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000\n[   54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230\n[   54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92\n[   54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff\n[   54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857\n[   54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642\n[   54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688\n[   54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000\n[   54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000\n[   54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac\n[   54.857599] Call trace:\n[   54.857601]  kfree_skb_reason+0x18/0xb0\n[   54.863878]  btnxpuart_flush+0x40/0x58 [btnxpuart]\n[   54.863888]  hci_dev_open_sync+0x3a8/0xa04\n[   54.872773]  hci_power_on+0x54/0x2e4\n[   54.881832]  process_one_work+0x138/0x260\n[   54.881842]  worker_thread+0x32c/0x438\n[   54.881847]  kthread+0x118/0x11c\n[   54.881853]  ret_from_fork+0x10/0x20\n[   54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400)\n[   54.896410] ---[ end trace 0000000000000000 ]---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2d2dab36-86cf-47b3-b5df-e521bf2f1695",
      "id": "CVE-2024-46800",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch/netem: fix use after free in netem_dequeue\n\nIf netem_dequeue() enqueues packet to inner qdisc and that qdisc\nreturns __NET_XMIT_STOLEN. The packet is dropped but\nqdisc_tree_reduce_backlog() is not called to update the parent's\nq.qlen, leading to the similar use-after-free as Commit\ne04991a48dbaf382 (\"netem: fix return value if duplicate enqueue\nfails\")\n\nCommands to trigger KASAN UaF:\n\nip link add type dummy\nip link set lo up\nip link set dummy0 up\ntc qdisc add dev lo parent root handle 1: drr\ntc filter add dev lo parent 1: basic classid 1:1\ntc class add dev lo classid 1:1 drr\ntc qdisc add dev lo parent 1:1 handle 2: netem\ntc qdisc add dev lo parent 2: handle 3: drr\ntc filter add dev lo parent 3: basic classid 3:1 action mirred egress\nredirect dev dummy0\ntc class add dev lo classid 3:1 drr\nping -c1 -W0.01 localhost # Trigger bug\ntc class del dev lo classid 1:1\ntc class add dev lo classid 1:1 drr\nping -c1 -W0.01 localhost # UaF",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f2559dd9-5850-4467-b64a-240210c10477",
      "id": "CVE-2024-47710",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsock_map: Add a cond_resched() in sock_hash_free()\n\nSeveral syzbot soft lockup reports all have in common sock_hash_free()\n\nIf a map with a large number of buckets is destroyed, we need to yield\nthe cpu when needed.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "efeee07b-d890-40c9-8eba-de76dcaad586",
      "id": "CVE-2024-47740",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: Require FMODE_WRITE for atomic write ioctls\n\nThe F2FS ioctls for starting and committing atomic writes check for\ninode_owner_or_capable(), but this does not give LSMs like SELinux or\nLandlock an opportunity to deny the write access - if the caller's FSUID\nmatches the inode's UID, inode_owner_or_capable() immediately returns true.\n\nThere are scenarios where LSMs want to deny a process the ability to write\nparticular files, even files that the FSUID of the process owns; but this\ncan currently partially be bypassed using atomic write ioctls in two ways:\n\n - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can\n   truncate an inode to size 0\n - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert\n   changes another process concurrently made to a file\n\nFix it by requiring FMODE_WRITE for these operations, just like for\nF2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these\nioctls when intending to write into the file, that seems unlikely to break\nanything.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0910ab88-8b49-4f04-aade-13e8051bfe36",
      "id": "CVE-2024-49914",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for pipe_ctx-\u003eplane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in the\n`dcn20_program_pipe` function. The issue could occur when\n`pipe_ctx-\u003eplane_state` is null.\n\nThe fix adds a check to ensure `pipe_ctx-\u003eplane_state` is not null\nbefore accessing. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx-\u003eplane_state' could be null (see line 1877)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c2577f8c-8eba-4296-9db7-65d1b560405c",
      "id": "CVE-2024-49969",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 color transformation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_hw_format` function in the DCN30 color\nmanagement module. The issue could occur when the index 'i' exceeds the\nnumber of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.red' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.green' 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf-\u003etf_pts.blue' 1025 \u003c= s32max",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48af90d2-3e11-49be-9d39-7b96c5173436",
      "id": "CVE-2024-49971",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Increase array size of dummy_boolean\n\n[WHY]\ndml2_core_shared_mode_support and dml_core_mode_support access the third\nelement of dummy_boolean, i.e. hw_debug5 = \u0026s-\u003edummy_boolean[2], when\ndummy_boolean has size of 2. Any assignment to hw_debug5 causes an\nOVERRUN.\n\n[HOW]\nIncrease dummy_boolean's array size to 3.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "5ec043de-5a11-4f4d-bda2-758837cd273b",
      "id": "CVE-2024-50082",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race\n\nWe're seeing crashes from rq_qos_wake_function that look like this:\n\n  BUG: unable to handle page fault for address: ffffafe180a40084\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  PGD 100000067 P4D 100000067 PUD 10027c067 PMD 10115d067 PTE 0\n  Oops: Oops: 0002 [#1] PREEMPT SMP PTI\n  CPU: 17 UID: 0 PID: 0 Comm: swapper/17 Not tainted 6.12.0-rc3-00013-geca631b8fe80 #11\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n  RIP: 0010:_raw_spin_lock_irqsave+0x1d/0x40\n  Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 9c 41 5c fa 65 ff 05 62 97 30 4c 31 c0 ba 01 00 00 00 \u003cf0\u003e 0f b1 17 75 0a 4c 89 e0 41 5c c3 cc cc cc cc 89 c6 e8 2c 0b 00\n  RSP: 0018:ffffafe180580ca0 EFLAGS: 00010046\n  RAX: 0000000000000000 RBX: ffffafe180a3f7a8 RCX: 0000000000000011\n  RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffafe180a40084\n  RBP: 0000000000000000 R08: 00000000001e7240 R09: 0000000000000011\n  R10: 0000000000000028 R11: 0000000000000888 R12: 0000000000000002\n  R13: ffffafe180a40084 R14: 0000000000000000 R15: 0000000000000003\n  FS:  0000000000000000(0000) GS:ffff9aaf1f280000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffffafe180a40084 CR3: 000000010e428002 CR4: 0000000000770ef0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n   \u003cIRQ\u003e\n   try_to_wake_up+0x5a/0x6a0\n   rq_qos_wake_function+0x71/0x80\n   __wake_up_common+0x75/0xa0\n   __wake_up+0x36/0x60\n   scale_up.part.0+0x50/0x110\n   wb_timer_fn+0x227/0x450\n   ...\n\nSo rq_qos_wake_function() calls wake_up_process(data-\u003etask), which calls\ntry_to_wake_up(), which faults in raw_spin_lock_irqsave(\u0026p-\u003epi_lock).\n\np comes from data-\u003etask, and data comes from the waitqueue entry, which\nis stored on the waiter's stack in rq_qos_wait(). Analyzing the core\ndump with drgn, I found that the waiter had already woken up and moved\non to a completely unrelated code path, clobbering what was previously\ndata-\u003etask. Meanwhile, the waker was passing the clobbered garbage in\ndata-\u003etask to wake_up_process(), leading to the crash.\n\nWhat's happening is that in between rq_qos_wake_function() deleting the\nwaitqueue entry and calling wake_up_process(), rq_qos_wait() is finding\nthat it already got a token and returning. The race looks like this:\n\nrq_qos_wait()                           rq_qos_wake_function()\n==============================================================\nprepare_to_wait_exclusive()\n                                        data-\u003egot_token = true;\n                                        list_del_init(\u0026curr-\u003eentry);\nif (data.got_token)\n        break;\nfinish_wait(\u0026rqw-\u003ewait, \u0026data.wq);\n  ^- returns immediately because\n     list_empty_careful(\u0026wq_entry-\u003eentry)\n     is true\n... return, go do something else ...\n                                        wake_up_process(data-\u003etask)\n                                          (NO LONGER VALID!)-^\n\nNormally, finish_wait() is supposed to synchronize against the waker.\nBut, as noted above, it is returning immediately because the waitqueue\nentry has already been removed from the waitqueue.\n\nThe bug is that rq_qos_wake_function() is accessing the waitqueue entry\nAFTER deleting it. Note that autoremove_wake_function() wakes the waiter\nand THEN deletes the waitqueue entry, which is the proper order.\n\nFix it by swapping the order. We also need to use\nlist_del_init_careful() to match the list_empty_careful() in\nfinish_wait().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "91ff7cb0-e244-42e1-93b2-ec0732a03087",
      "id": "CVE-2024-50247",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Check if more than chunk-size bytes are written\n\nA incorrectly formatted chunk may decompress into\nmore than LZNT_CHUNK_SIZE bytes and a index out of bounds\nwill occur in s_max_off.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e89b80db-216b-485b-b3fd-e9bb3462b9e0",
      "id": "CVE-2024-50256",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()\n\nI got a syzbot report without a repro [1] crashing in nf_send_reset6()\n\nI think the issue is that dev-\u003ehard_header_len is zero, and we attempt\nlater to push an Ethernet header.\n\nUse LL_MAX_HEADER, as other functions in net/ipv6/netfilter/nf_reject_ipv6.c.\n\n[1]\n\nskbuff: skb_under_panic: text:ffffffff89b1d008 len:74 put:14 head:ffff88803123aa00 data:ffff88803123a9f2 tail:0x3c end:0x140 dev:syz_tun\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 7373 Comm: syz.1.568 Not tainted 6.12.0-rc2-syzkaller-00631-g6d858708d465 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0d 8d 48 c7 c6 60 a6 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 ba 30 38 02 48 83 c4 20 90 \u003c0f\u003e 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc900045269b0 EFLAGS: 00010282\nRAX: 0000000000000088 RBX: dffffc0000000000 RCX: cd66dacdc5d8e800\nRDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000\nRBP: ffff88802d39a3d0 R08: ffffffff8174afec R09: 1ffff920008a4ccc\nR10: dffffc0000000000 R11: fffff520008a4ccd R12: 0000000000000140\nR13: ffff88803123aa00 R14: ffff88803123a9f2 R15: 000000000000003c\nFS:  00007fdbee5ff6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000005d322000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  eth_header+0x38/0x1f0 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3208 [inline]\n  nf_send_reset6+0xce6/0x1270 net/ipv6/netfilter/nf_reject_ipv6.c:358\n  nft_reject_inet_eval+0x3b9/0x690 net/netfilter/nft_reject_inet.c:48\n  expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n  nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288\n  nft_do_chain_inet+0x418/0x6b0 net/netfilter/nft_chain_filter.c:161\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626\n  nf_hook include/linux/netfilter.h:269 [inline]\n  NF_HOOK include/linux/netfilter.h:312 [inline]\n  br_nf_pre_routing_ipv6+0x63e/0x770 net/bridge/br_netfilter_ipv6.c:184\n  nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n  nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]\n  br_handle_frame+0x9fd/0x1530 net/bridge/br_input.c:424\n  __netif_receive_skb_core+0x13e8/0x4570 net/core/dev.c:5562\n  __netif_receive_skb_one_core net/core/dev.c:5666 [inline]\n  __netif_receive_skb+0x12f/0x650 net/core/dev.c:5781\n  netif_receive_skb_internal net/core/dev.c:5867 [inline]\n  netif_receive_skb+0x1e8/0x890 net/core/dev.c:5926\n  tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550\n  tun_get_user+0x3056/0x47e0 drivers/net/tun.c:2007\n  tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053\n  new_sync_write fs/read_write.c:590 [inline]\n  vfs_write+0xa6d/0xc90 fs/read_write.c:683\n  ksys_write+0x183/0x2b0 fs/read_write.c:736\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fdbeeb7d1ff\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48\nRSP: 002b:00007fdbee5ff000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007fdbeed36058 RCX: 00007fdbeeb7d1ff\nRDX: 000000000000008e RSI: 0000000020000040 RDI: 00000000000000c8\nRBP: 00007fdbeebf12be R08: 0000000\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8ec3d859-6be0-4e2e-ae01-726ff5d84bb8",
      "id": "CVE-2024-52559",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()\n\nThe \"submit-\u003ecmd[i].size\" and \"submit-\u003ecmd[i].offset\" variables are u32\nvalues that come from the user via the submit_lookup_cmds() function.\nThis addition could lead to an integer wrapping bug so use size_add()\nto prevent that.\n\nPatchwork: https://patchwork.freedesktop.org/patch/624696/",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e7e20d75-723d-4ab3-8cd8-03d80fa4824d",
      "id": "CVE-2024-53050",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in hdcp2_get_capability\n\nAdd encoder check in intel_hdcp2_get_capability to avoid\nnull pointer error.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a146f964-6d73-4141-845c-2b0f9d0aa5e5",
      "id": "CVE-2024-53058",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data\n\nIn case the non-paged data of a SKB carries protocol header and protocol\npayload to be transmitted on a certain platform that the DMA AXI address\nwidth is configured to 40-bit/48-bit, or the size of the non-paged data\nis bigger than TSO_MAX_BUFF_SIZE on a certain platform that the DMA AXI\naddress width is configured to 32-bit, then this SKB requires at least\ntwo DMA transmit descriptors to serve it.\n\nFor example, three descriptors are allocated to split one DMA buffer\nmapped from one piece of non-paged data:\n    dma_desc[N + 0],\n    dma_desc[N + 1],\n    dma_desc[N + 2].\nThen three elements of tx_q-\u003etx_skbuff_dma[] will be allocated to hold\nextra information to be reused in stmmac_tx_clean():\n    tx_q-\u003etx_skbuff_dma[N + 0],\n    tx_q-\u003etx_skbuff_dma[N + 1],\n    tx_q-\u003etx_skbuff_dma[N + 2].\nNow we focus on tx_q-\u003etx_skbuff_dma[entry].buf, which is the DMA buffer\naddress returned by DMA mapping call. stmmac_tx_clean() will try to\nunmap the DMA buffer _ONLY_IF_ tx_q-\u003etx_skbuff_dma[entry].buf\nis a valid buffer address.\n\nThe expected behavior that saves DMA buffer address of this non-paged\ndata to tx_q-\u003etx_skbuff_dma[entry].buf is:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = dma_map_single();\nUnfortunately, the current code misbehaves like this:\n    tx_q-\u003etx_skbuff_dma[N + 0].buf = dma_map_single();\n    tx_q-\u003etx_skbuff_dma[N + 1].buf = NULL;\n    tx_q-\u003etx_skbuff_dma[N + 2].buf = NULL;\n\nOn the stmmac_tx_clean() side, when dma_desc[N + 0] is closed by the\nDMA engine, tx_q-\u003etx_skbuff_dma[N + 0].buf is a valid buffer address\nobviously, then the DMA buffer will be unmapped immediately.\nThere may be a rare case that the DMA engine does not finish the\npending dma_desc[N + 1], dma_desc[N + 2] yet. Now things will go\nhorribly wrong, DMA is going to access a unmapped/unreferenced memory\nregion, corrupted data will be transmited or iommu fault will be\ntriggered :(\n\nIn contrast, the for-loop that maps SKB fragments behaves perfectly\nas expected, and that is how the driver should do for both non-paged\ndata and paged frags actually.\n\nThis patch corrects DMA map/unmap sequences by fixing the array index\nfor tx_q-\u003etx_skbuff_dma[entry].buf when assigning DMA buffer address.\n\nTested and verified on DWXGMAC CORE 3.20a",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8da7b5e6-069a-4091-bcac-0764248e7669",
      "id": "CVE-2024-53104",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format\n\nThis can lead to out of bounds writes since frames of this type were not\ntaken into account when calculating the size of the frames buffer in\nuvc_parse_streaming.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6db74207-84ca-4bdd-a91b-f3d03ef6e082",
      "id": "CVE-2021-26934",
      "description": "An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn't stated accordingly in its support status entry.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d6429b66-0981-4e61-9ec0-cd1943e227e0",
      "id": "CVE-2024-53141",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: add missing range check in bitmap_ip_uadt\n\nWhen tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists,\nthe values of ip and ip_to are slightly swapped. Therefore, the range check\nfor ip should be done later, but this part is missing and it seems that the\nvulnerability occurs.\n\nSo we should add missing range checks and remove unnecessary range checks.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "afe94289-5e3c-4077-875e-1f77a8d4b867",
      "id": "CVE-2024-53214",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Properly hide first-in-list PCIe extended capability\n\nThere are cases where a PCIe extended capability should be hidden from\nthe user. For example, an unknown capability (i.e., capability with ID\ngreater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally\nchosen to be hidden from the user.\n\nHiding a capability is done by virtualizing and modifying the 'Next\nCapability Offset' field of the previous capability so it points to the\ncapability after the one that should be hidden.\n\nThe special case where the first capability in the list should be hidden\nis handled differently because there is no previous capability that can\nbe modified. In this case, the capability ID and version are zeroed\nwhile leaving the next pointer intact. This hides the capability and\nleaves an anchor for the rest of the capability list.\n\nHowever, today, hiding the first capability in the list is not done\nproperly if the capability is unknown, as struct\nvfio_pci_core_device-\u003epci_config_map is set to the capability ID during\ninitialization but the capability ID is not properly checked later when\nused in vfio_config_do_rw(). This leads to the following warning [1] and\nto an out-of-bounds access to ecap_perms array.\n\nFix it by checking cap_id in vfio_config_do_rw(), and if it is greater\nthan PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct\nread only access instead of the ecap_perms array.\n\nNote that this is safe since the above is the only case where cap_id can\nexceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which\nare already checked before).\n\n[1]\n\nWARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]\nCPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1\n(snip)\nCall Trace:\n \u003cTASK\u003e\n ? show_regs+0x69/0x80\n ? __warn+0x8d/0x140\n ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]\n ? report_bug+0x18f/0x1a0\n ? handle_bug+0x63/0xa0\n ? exc_invalid_op+0x19/0x70\n ? asm_exc_invalid_op+0x1b/0x20\n ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]\n ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core]\n vfio_pci_rw+0x101/0x1b0 [vfio_pci_core]\n vfio_pci_core_read+0x1d/0x30 [vfio_pci_core]\n vfio_device_fops_read+0x27/0x40 [vfio]\n vfs_read+0xbd/0x340\n ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio]\n ? __rseq_handle_notify_resume+0xa4/0x4b0\n __x64_sys_pread64+0x96/0xc0\n x64_sys_call+0x1c3d/0x20d0\n do_syscall_64+0x4d/0x120\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "9cc8794b-8236-41c9-a166-6ac9b6c0a06b",
      "id": "CVE-2025-39901",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: remove read access to debugfs files\n\nThe 'command' and 'netdev_ops' debugfs files are a legacy debugging\ninterface supported by the i40e driver since its early days by commit\n02e9c290814c (\"i40e: debugfs interface\").\n\nBoth of these debugfs files provide a read handler which is mostly useless,\nand which is implemented with questionable logic. They both use a static\n256 byte buffer which is initialized to the empty string. In the case of\nthe 'command' file this buffer is literally never used and simply wastes\nspace. In the case of the 'netdev_ops' file, the last command written is\nsaved here.\n\nOn read, the files contents are presented as the name of the device\nfollowed by a colon and then the contents of their respective static\nbuffer. For 'command' this will always be \"\u003cdevice\u003e: \". For 'netdev_ops',\nthis will be \"\u003cdevice\u003e: \u003clast command written\u003e\". But note the buffer is\nshared between all devices operated by this module. At best, it is mostly\nmeaningless information, and at worse it could be accessed simultaneously\nas there doesn't appear to be any locking mechanism.\n\nWe have also recently received multiple reports for both read functions\nabout their use of snprintf and potential overflow that could result in\nreading arbitrary kernel memory. For the 'command' file, this is definitely\nimpossible, since the static buffer is always zero and never written to.\nFor the 'netdev_ops' file, it does appear to be possible, if the user\ncarefully crafts the command input, it will be copied into the buffer,\nwhich could be large enough to cause snprintf to truncate, which then\ncauses the copy_to_user to read beyond the length of the buffer allocated\nby kzalloc.\n\nA minimal fix would be to replace snprintf() with scnprintf() which would\ncap the return to the number of bytes written, preventing an overflow. A\nmore involved fix would be to drop the mostly useless static buffers,\nsaving 512 bytes and modifying the read functions to stop needing those as\ninput.\n\nInstead, lets just completely drop the read access to these files. These\nare debug interfaces exposed as part of debugfs, and I don't believe that\ndropping read access will break any script, as the provided output is\npretty useless. You can find the netdev name through other more standard\ninterfaces, and the 'netdev_ops' interface can easily result in garbage if\nyou issue simultaneous writes to multiple devices at once.\n\nIn order to properly remove the i40e_dbg_netdev_ops_buf, we need to\nrefactor its write function to avoid using the static buffer. Instead, use\nthe same logic as the i40e_dbg_command_write, with an allocated buffer.\nUpdate the code to use this instead of the static buffer, and ensure we\nfree the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on\nmultiple devices, and allows us to remove the now unused static buffer\nalong with removing the read access.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "14b607e2-6fff-463f-9989-662ed5ae4ea9",
      "id": "CVE-2024-56637",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Hold module reference while requesting a module\n\nUser space may unload ip_set.ko while it is itself requesting a set type\nbackend module, leading to a kernel crash. The race condition may be\nprovoked by inserting an mdelay() right after the nfnl_unlock() call.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0775f9aa-f487-481d-9809-972ec30e2fab",
      "id": "CVE-2024-56784",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adding array index check to prevent memory corruption\n\n[Why \u0026 How]\nArray indices out of bound caused memory corruption. Adding checks to\nensure that array index stays in bound.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6e2cc6cf-b970-4b59-ad83-89fd4d84f5fc",
      "id": "CVE-2024-57908",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: kmx61: fix information leak in triggered buffer\n\nThe 'buffer' local array is used to push data to user space from a\ntriggered buffer, but it does not set values for inactive channels, as\nit only uses iio_for_each_active_channel() to assign new values.\n\nInitialize the array to zero before using it to avoid pushing\nuninitialized information to userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0fd7df42-7227-4fd8-9bd1-865ebbaa8d48",
      "id": "CVE-2025-38085",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\n\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\n\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process.  While I don't see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\n\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0d0e46f2-7c8f-4684-903a-b31a29c4d495",
      "id": "CVE-2024-57938",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sctp: Prevent autoclose integer overflow in sctp_association_init()\n\nWhile by default max_autoclose equals to INT_MAX / HZ, one may set\nnet.sctp.max_autoclose to UINT_MAX. There is code in\nsctp_association_init() that can consequently trigger overflow.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "4cc6be0c-92a6-41bb-9dde-3ab7240fd880",
      "id": "CVE-2025-22008",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: check that dummy regulator has been probed before using it\n\nDue to asynchronous driver probing there is a chance that the dummy\nregulator hasn't already been probed when first accessing it.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0888b0d9-9a6e-436e-ac74-9570ac238eea",
      "id": "CVE-2020-25668",
      "description": "A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ec8b57f-a4a3-457e-ac86-020181476b9e",
      "id": "CVE-2025-22121",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n\nThere's issue as follows:\nBUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790\nRead of size 4 at addr ffff88807b003000 by task syz-executor.0/15172\n\nCPU: 3 PID: 15172 Comm: syz-executor.0\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0xbe/0xfd lib/dump_stack.c:123\n print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137\n ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896\n ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323\n evict+0x39f/0x880 fs/inode.c:622\n iput_final fs/inode.c:1746 [inline]\n iput fs/inode.c:1772 [inline]\n iput+0x525/0x6c0 fs/inode.c:1758\n ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]\n ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300\n mount_bdev+0x355/0x410 fs/super.c:1446\n legacy_get_tree+0xfe/0x220 fs/fs_context.c:611\n vfs_get_tree+0x8d/0x2f0 fs/super.c:1576\n do_new_mount fs/namespace.c:2983 [inline]\n path_mount+0x119a/0x1ad0 fs/namespace.c:3316\n do_mount+0xfc/0x110 fs/namespace.c:3329\n __do_sys_mount fs/namespace.c:3540 [inline]\n __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nMemory state around the buggy address:\n ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003effff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                   ^\n ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAbove issue happens as ext4_xattr_delete_inode() isn't check xattr\nis valid if xattr is in inode.\nTo solve above issue call xattr_check_inode() check if xattr if valid\nin inode. In fact, we can directly verify in ext4_iget_extra_inode(),\nso that there is no divergent verification.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "57332c33-43a6-4411-9ae9-f2c2654c872e",
      "id": "CVE-2025-23163",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vlan: don't propagate flags on open\n\nWith the device instance lock, there is now a possibility of a deadlock:\n\n[    1.211455] ============================================\n[    1.211571] WARNING: possible recursive locking detected\n[    1.211687] 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 Not tainted\n[    1.211823] --------------------------------------------\n[    1.211936] ip/184 is trying to acquire lock:\n[    1.212032] ffff8881024a4c30 (\u0026dev-\u003elock){+.+.}-{4:4}, at: dev_set_allmulti+0x4e/0xb0\n[    1.212207]\n[    1.212207] but task is already holding lock:\n[    1.212332] ffff8881024a4c30 (\u0026dev-\u003elock){+.+.}-{4:4}, at: dev_open+0x50/0xb0\n[    1.212487]\n[    1.212487] other info that might help us debug this:\n[    1.212626]  Possible unsafe locking scenario:\n[    1.212626]\n[    1.212751]        CPU0\n[    1.212815]        ----\n[    1.212871]   lock(\u0026dev-\u003elock);\n[    1.212944]   lock(\u0026dev-\u003elock);\n[    1.213016]\n[    1.213016]  *** DEADLOCK ***\n[    1.213016]\n[    1.213143]  May be due to missing lock nesting notation\n[    1.213143]\n[    1.213294] 3 locks held by ip/184:\n[    1.213371]  #0: ffffffff838b53e0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x1b/0xa0\n[    1.213543]  #1: ffffffff84e5fc70 (\u0026net-\u003ertnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x37/0xa0\n[    1.213727]  #2: ffff8881024a4c30 (\u0026dev-\u003elock){+.+.}-{4:4}, at: dev_open+0x50/0xb0\n[    1.213895]\n[    1.213895] stack backtrace:\n[    1.213991] CPU: 0 UID: 0 PID: 184 Comm: ip Not tainted 6.14.0-rc5-01215-g032756b4ca7a-dirty #5\n[    1.213993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\n[    1.213994] Call Trace:\n[    1.213995]  \u003cTASK\u003e\n[    1.213996]  dump_stack_lvl+0x8e/0xd0\n[    1.214000]  print_deadlock_bug+0x28b/0x2a0\n[    1.214020]  lock_acquire+0xea/0x2a0\n[    1.214027]  __mutex_lock+0xbf/0xd40\n[    1.214038]  dev_set_allmulti+0x4e/0xb0 # real_dev-\u003eflags \u0026 IFF_ALLMULTI\n[    1.214040]  vlan_dev_open+0xa5/0x170 # ndo_open on vlandev\n[    1.214042]  __dev_open+0x145/0x270\n[    1.214046]  __dev_change_flags+0xb0/0x1e0\n[    1.214051]  netif_change_flags+0x22/0x60 # IFF_UP vlandev\n[    1.214053]  dev_change_flags+0x61/0xb0 # for each device in group from dev-\u003evlan_info\n[    1.214055]  vlan_device_event+0x766/0x7c0 # on netdevsim0\n[    1.214058]  notifier_call_chain+0x78/0x120\n[    1.214062]  netif_open+0x6d/0x90\n[    1.214064]  dev_open+0x5b/0xb0 # locks netdevsim0\n[    1.214066]  bond_enslave+0x64c/0x1230\n[    1.214075]  do_set_master+0x175/0x1e0 # on netdevsim0\n[    1.214077]  do_setlink+0x516/0x13b0\n[    1.214094]  rtnl_newlink+0xaba/0xb80\n[    1.214132]  rtnetlink_rcv_msg+0x440/0x490\n[    1.214144]  netlink_rcv_skb+0xeb/0x120\n[    1.214150]  netlink_unicast+0x1f9/0x320\n[    1.214153]  netlink_sendmsg+0x346/0x3f0\n[    1.214157]  __sock_sendmsg+0x86/0xb0\n[    1.214160]  ____sys_sendmsg+0x1c8/0x220\n[    1.214164]  ___sys_sendmsg+0x28f/0x2d0\n[    1.214179]  __x64_sys_sendmsg+0xef/0x140\n[    1.214184]  do_syscall_64+0xec/0x1d0\n[    1.214190]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[    1.214191] RIP: 0033:0x7f2d1b4a7e56\n\nDevice setup:\n\n     netdevsim0 (down)\n     ^        ^\n  bond        netdevsim1.100@netdevsim1 allmulticast=on (down)\n\nWhen we enslave the lower device (netdevsim0) which has a vlan, we\npropagate vlan's allmuti/promisc flags during ndo_open. This causes\n(re)locking on of the real_dev.\n\nPropagate allmulti/promisc on flags change, not on the open. There\nis a slight semantics change that vlans that are down now propagate\nthe flags, but this seems unlikely to result in the real issues.\n\nReproducer:\n\n  echo 0 1 \u003e /sys/bus/netdevsim/new_device\n\n  dev_path=$(ls -d /sys/bus/netdevsim/devices/netdevsim0/net/*)\n  dev=$(echo $dev_path | rev | cut -d/ -f1 | rev)\n\n  ip link set dev $dev name netdevsim0\n  ip link set dev netdevsim0 up\n\n  ip link add link netdevsim0 name netdevsim0.100 type vlan id 100\n  ip link set dev netdevsim0.100 allm\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8d68b911-b3c6-4460-8f42-d57132c1e3f1",
      "id": "CVE-2025-37745",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: hibernate: Avoid deadlock in hibernate_compressor_param_set()\n\nsyzbot reported a deadlock in lock_system_sleep() (see below).\n\nThe write operation to \"/sys/module/hibernate/parameters/compressor\"\nconflicts with the registration of ieee80211 device, resulting in a deadlock\nwhen attempting to acquire system_transition_mutex under param_lock.\n\nTo avoid this deadlock, change hibernate_compressor_param_set() to use\nmutex_trylock() for attempting to acquire system_transition_mutex and\nreturn -EBUSY when it fails.\n\nTask flags need not be saved or adjusted before calling\nmutex_trylock(\u0026system_transition_mutex) because the caller is not going\nto end up waiting for this mutex and if it runs concurrently with system\nsuspend in progress, it will be frozen properly when it returns to user\nspace.\n\nsyzbot report:\n\nsyz-executor895/5833 is trying to acquire lock:\nffffffff8e0828c8 (system_transition_mutex){+.+.}-{4:4}, at: lock_system_sleep+0x87/0xa0 kernel/power/main.c:56\n\nbut task is already holding lock:\nffffffff8e07dc68 (param_lock){+.+.}-{4:4}, at: kernel_param_lock kernel/params.c:607 [inline]\nffffffff8e07dc68 (param_lock){+.+.}-{4:4}, at: param_attr_store+0xe6/0x300 kernel/params.c:586\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u003e #3 (param_lock){+.+.}-{4:4}:\n       __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n       __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730\n       ieee80211_rate_control_ops_get net/mac80211/rate.c:220 [inline]\n       rate_control_alloc net/mac80211/rate.c:266 [inline]\n       ieee80211_init_rate_ctrl_alg+0x18d/0x6b0 net/mac80211/rate.c:1015\n       ieee80211_register_hw+0x20cd/0x4060 net/mac80211/main.c:1531\n       mac80211_hwsim_new_radio+0x304e/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5558\n       init_mac80211_hwsim+0x432/0x8c0 drivers/net/wireless/virtual/mac80211_hwsim.c:6910\n       do_one_initcall+0x128/0x700 init/main.c:1257\n       do_initcall_level init/main.c:1319 [inline]\n       do_initcalls init/main.c:1335 [inline]\n       do_basic_setup init/main.c:1354 [inline]\n       kernel_init_freeable+0x5c7/0x900 init/main.c:1568\n       kernel_init+0x1c/0x2b0 init/main.c:1457\n       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148\n       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n-\u003e #2 (rtnl_mutex){+.+.}-{4:4}:\n       __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n       __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730\n       wg_pm_notification drivers/net/wireguard/device.c:80 [inline]\n       wg_pm_notification+0x49/0x180 drivers/net/wireguard/device.c:64\n       notifier_call_chain+0xb7/0x410 kernel/notifier.c:85\n       notifier_call_chain_robust kernel/notifier.c:120 [inline]\n       blocking_notifier_call_chain_robust kernel/notifier.c:345 [inline]\n       blocking_notifier_call_chain_robust+0xc9/0x170 kernel/notifier.c:333\n       pm_notifier_call_chain_robust+0x27/0x60 kernel/power/main.c:102\n       snapshot_open+0x189/0x2b0 kernel/power/user.c:77\n       misc_open+0x35a/0x420 drivers/char/misc.c:179\n       chrdev_open+0x237/0x6a0 fs/char_dev.c:414\n       do_dentry_open+0x735/0x1c40 fs/open.c:956\n       vfs_open+0x82/0x3f0 fs/open.c:1086\n       do_open fs/namei.c:3830 [inline]\n       path_openat+0x1e88/0x2d80 fs/namei.c:3989\n       do_filp_open+0x20c/0x470 fs/namei.c:4016\n       do_sys_openat2+0x17a/0x1e0 fs/open.c:1428\n       do_sys_open fs/open.c:1443 [inline]\n       __do_sys_openat fs/open.c:1459 [inline]\n       __se_sys_openat fs/open.c:1454 [inline]\n       __x64_sys_openat+0x175/0x210 fs/open.c:1454\n       do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-\u003e #1 ((pm_chain_head).rwsem){++++}-{4:4}:\n       down_read+0x9a/0x330 kernel/locking/rwsem.c:1524\n       blocking_notifier_call_chain_robust kerne\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3d7b5b9c-5798-4ea4-842f-eca67835caa2",
      "id": "CVE-2025-37877",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Clear iommu-dma ops on cleanup\n\nIf iommu_device_register() encounters an error, it can end up tearing\ndown already-configured groups and default domains, however this\ncurrently still leaves devices hooked up to iommu-dma (and even\nhistorically the behaviour in this area was at best inconsistent across\narchitectures/drivers...) Although in the case that an IOMMU is present\nwhose driver has failed to probe, users cannot necessarily expect DMA to\nwork anyway, it's still arguable that we should do our best to put\nthings back as if the IOMMU driver was never there at all, and certainly\nthe potential for crashing in iommu-dma itself is undesirable. Make sure\nwe clean up the dev-\u003edma_iommu flag along with everything else.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0835f76f-6ccd-438a-9a3d-3d6753db7c03",
      "id": "CVE-2025-37949",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxenbus: Use kref to track req lifetime\n\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n \u003cTASK\u003e\n __wake_up_common_lock+0x82/0xd0\n process_msg+0x18e/0x2f0\n xenbus_thread+0x165/0x1c0\n\nprocess_msg+0x18e is req-\u003ecb(req).  req-\u003ecb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply().  It seems\nlike it was xs_wake_up() in this case.\n\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req.  When xenbus_thread resumes, it faults on the zero-ed\ndata.\n\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\n\nChange to keeping two krefs on each request.  One for the caller, and\none for xenbus_thread.  Each will kref_put() when finished, and the last\nwill free it.\n\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "52658281-48f2-4fee-b08e-4274b49c3747",
      "id": "CVE-2025-38090",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/rapidio/rio_cm.c: prevent possible heap overwrite\n\nIn\n\nriocm_cdev_ioctl(RIO_CM_CHAN_SEND)\n   -\u003e cm_chan_msg_send()\n      -\u003e riocm_ch_send()\n\ncm_chan_msg_send() checks that userspace didn't send too much data but\nriocm_ch_send() failed to check that userspace sent sufficient data.  The\nresult is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr\nwhich were outside the bounds of the space which cm_chan_msg_send()\nallocated.\n\nAddress this by teaching riocm_ch_send() to check that the entire\nrio_ch_chan_hdr was copied in from userspace.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "8f719123-3a36-4a84-bdd0-f3880d1e66eb",
      "id": "CVE-2025-38143",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbacklight: pm8941: Add NULL check in wled_configure()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\nwled_configure() does not check for this case, which results in a NULL\npointer dereference.\n\nAdd NULL check after devm_kasprintf() to prevent this issue.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "886509b1-cb1e-48ba-a7a0-0b75438ee95f",
      "id": "CVE-2025-38345",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi operand cache leak in dswstate.c\n\nACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732\n\nI found an ACPI cache leak in ACPI early termination and boot continuing case.\n\nWhen early termination occurs due to malicious ACPI table, Linux kernel\nterminates ACPI function and continues to boot process. While kernel terminates\nACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.\n\nBoot log of ACPI operand cache leak is as follows:\n\u003e[    0.585957] ACPI: Added _OSI(Module Device)\n\u003e[    0.587218] ACPI: Added _OSI(Processor Device)\n\u003e[    0.588530] ACPI: Added _OSI(3.0 _SCP Extensions)\n\u003e[    0.589790] ACPI: Added _OSI(Processor Aggregator Device)\n\u003e[    0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155)\n\u003e[    0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88)\n\u003e[    0.597858] ACPI: Unable to start the ACPI Interpreter\n\u003e[    0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n\u003e[    0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects\n\u003e[    0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26\n\u003e[    0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006\n\u003e[    0.609177] Call Trace:\n\u003e[    0.610063]  ? dump_stack+0x5c/0x81\n\u003e[    0.611118]  ? kmem_cache_destroy+0x1aa/0x1c0\n\u003e[    0.612632]  ? acpi_sleep_proc_init+0x27/0x27\n\u003e[    0.613906]  ? acpi_os_delete_cache+0xa/0x10\n\u003e[    0.617986]  ? acpi_ut_delete_caches+0x3f/0x7b\n\u003e[    0.619293]  ? acpi_terminate+0xa/0x14\n\u003e[    0.620394]  ? acpi_init+0x2af/0x34f\n\u003e[    0.621616]  ? __class_create+0x4c/0x80\n\u003e[    0.623412]  ? video_setup+0x7f/0x7f\n\u003e[    0.624585]  ? acpi_sleep_proc_init+0x27/0x27\n\u003e[    0.625861]  ? do_one_initcall+0x4e/0x1a0\n\u003e[    0.627513]  ? kernel_init_freeable+0x19e/0x21f\n\u003e[    0.628972]  ? rest_init+0x80/0x80\n\u003e[    0.630043]  ? kernel_init+0xa/0x100\n\u003e[    0.631084]  ? ret_from_fork+0x25/0x30\n\u003e[    0.633343] vgaarb: loaded\n\u003e[    0.635036] EDAC MC: Ver: 3.0.0\n\u003e[    0.638601] PCI: Probing PCI hardware\n\u003e[    0.639833] PCI host bridge to bus 0000:00\n\u003e[    0.641031] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]\n\u003e ... Continue to boot and log is omitted ...\n\nI analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_\ndelete() function miscalculated the top of the stack. acpi_ds_obj_stack_push()\nfunction uses walk_state-\u003eoperand_index for start position of the top, but\nacpi_ds_obj_stack_pop_and_delete() function considers index 0 for it.\nTherefore, this causes acpi operand memory leak.\n\nThis cache leak causes a security threat because an old kernel (\u003c= 4.9) shows\nmemory locations of kernel functions in stack dump. Some malicious users\ncould use this information to neutralize kernel ASLR.\n\nI made a patch to fix ACPI operand cache leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ffa0214a-793e-48ac-8a8c-284dd725792e",
      "id": "CVE-2025-38348",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()\n\nRobert Morris reported:\n\n|If a malicious USB device pretends to be an Intersil p54 wifi\n|interface and generates an eeprom_readback message with a large\n|eeprom-\u003ev1.len, p54_rx_eeprom_readback() will copy data from the\n|message beyond the end of priv-\u003eeeprom.\n|\n|static void p54_rx_eeprom_readback(struct p54_common *priv,\n|                                   struct sk_buff *skb)\n|{\n|        struct p54_hdr *hdr = (struct p54_hdr *) skb-\u003edata;\n|        struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr-\u003edata;\n|\n|        if (priv-\u003efw_var \u003e= 0x509) {\n|                memcpy(priv-\u003eeeprom, eeprom-\u003ev2.data,\n|                       le16_to_cpu(eeprom-\u003ev2.len));\n|        } else {\n|                memcpy(priv-\u003eeeprom, eeprom-\u003ev1.data,\n|                       le16_to_cpu(eeprom-\u003ev1.len));\n|        }\n| [...]\n\nThe eeprom-\u003ev{1,2}.len is set by the driver in p54_download_eeprom().\nThe device is supposed to provide the same length back to the driver.\nBut yes, it's possible (like shown in the report) to alter the value\nto something that causes a crash/panic due to overrun.\n\nThis patch addresses the issue by adding the size to the common device\ncontext, so p54_rx_eeprom_readback no longer relies on possibly tampered\nvalues... That said, it also checks if the \"firmware\" altered the value\nand no longer copies them.\n\nThe one, small saving grace is: Before the driver tries to read the eeprom,\nit needs to upload \u003ea\u003c firmware. the vendor firmware has a proprietary\nlicense and as a reason, it is not present on most distributions by\ndefault.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "12019363-91f6-4786-9fd7-6531c8bddde3",
      "id": "CVE-2025-39693",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid a NULL pointer dereference\n\n[WHY]\nAlthough unlikely drm_atomic_get_new_connector_state() or\ndrm_atomic_get_old_connector_state() can return NULL.\n\n[HOW]\nCheck returns before dereference.\n\n(cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a00c2f8e-559e-453e-bc57-de6e5a372162",
      "id": "CVE-2021-47249",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix memory leak in rds_recvmsg\n\nSyzbot reported memory leak in rds. The problem\nwas in unputted refcount in case of error.\n\nint rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,\n\t\tint msg_flags)\n{\n...\n\n\tif (!rds_next_incoming(rs, \u0026inc)) {\n\t\t...\n\t}\n\nAfter this \"if\" inc refcount incremented and\n\n\tif (rds_cmsg_recv(inc, msg, rs)) {\n\t\tret = -EFAULT;\n\t\tgoto out;\n\t}\n...\nout:\n\treturn ret;\n}\n\nin case of rds_cmsg_recv() fail the refcount won't be\ndecremented. And it's easy to see from ftrace log, that\nrds_inc_addref() don't have rds_inc_put() pair in\nrds_recvmsg() after rds_cmsg_recv()\n\n 1)               |  rds_recvmsg() {\n 1)   3.721 us    |    rds_inc_addref();\n 1)   3.853 us    |    rds_message_inc_copy_to_user();\n 1) + 10.395 us   |    rds_cmsg_recv();\n 1) + 34.260 us   |  }",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "dfae28d7-947f-4993-a52c-32566b5c8053",
      "id": "CVE-2021-47405",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: free raw_report buffers in usbhid_stop\n\nFree the unsent raw_report buffers when the device is removed.\n\nFixes a memory leak reported by syzbot at:\nhttps://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7ccec3db-0e53-4e23-86e1-a052228453de",
      "id": "CVE-2021-47521",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: sja1000: fix use after free in ems_pcmcia_add_card()\n\nIf the last channel is not available then \"dev\" is freed.  Fortunately,\nwe can just use \"pdev-\u003eirq\" instead.\n\nAlso we should check if at least one channel was set up.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f685f48f-a61a-4863-a906-82e04cf388e2",
      "id": "CVE-2021-47606",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netlink: af_netlink: Prevent empty skb by adding a check on len.\n\nAdding a check on len parameter to avoid empty skb. This prevents a\ndivision error in netem_enqueue function which is caused when skb-\u003elen=0\nand skb-\u003edata_len=0 in the randomized corruption step as shown below.\n\nskb-\u003edata[prandom_u32() % skb_headlen(skb)] ^= 1\u003c\u003c(prandom_u32() % 8);\n\nCrash Report:\n[  343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family\n0 port 6081 - 0\n[  343.216110] netem: version 1.3\n[  343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[  343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+\n[  343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS 1.11.0-2.el7 04/01/2014\n[  343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]\n[  343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff\nff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f\n74 \u003cf7\u003e f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03\n[  343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246\n[  343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:\n0000000000000000\n[  343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:\nffff88800f8eda40\n[  343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:\nffffffff94fb8445\n[  343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:\n0000000000000000\n[  343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:\n0000000000000020\n[  343.247291] FS:  00007fdde2bd7700(0000) GS:ffff888109780000(0000)\nknlGS:0000000000000000\n[  343.248350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:\n00000000000006e0\n[  343.250076] Call Trace:\n[  343.250423]  \u003cTASK\u003e\n[  343.250713]  ? memcpy+0x4d/0x60\n[  343.251162]  ? netem_init+0xa0/0xa0 [sch_netem]\n[  343.251795]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.252443]  netem_enqueue+0xe28/0x33c0 [sch_netem]\n[  343.253102]  ? stack_trace_save+0x87/0xb0\n[  343.253655]  ? filter_irq_stacks+0xb0/0xb0\n[  343.254220]  ? netem_init+0xa0/0xa0 [sch_netem]\n[  343.254837]  ? __kasan_check_write+0x14/0x20\n[  343.255418]  ? _raw_spin_lock+0x88/0xd6\n[  343.255953]  dev_qdisc_enqueue+0x50/0x180\n[  343.256508]  __dev_queue_xmit+0x1a7e/0x3090\n[  343.257083]  ? netdev_core_pick_tx+0x300/0x300\n[  343.257690]  ? check_kcov_mode+0x10/0x40\n[  343.258219]  ? _raw_spin_unlock_irqrestore+0x29/0x40\n[  343.258899]  ? __kasan_init_slab_obj+0x24/0x30\n[  343.259529]  ? setup_object.isra.71+0x23/0x90\n[  343.260121]  ? new_slab+0x26e/0x4b0\n[  343.260609]  ? kasan_poison+0x3a/0x50\n[  343.261118]  ? kasan_unpoison+0x28/0x50\n[  343.261637]  ? __kasan_slab_alloc+0x71/0x90\n[  343.262214]  ? memcpy+0x4d/0x60\n[  343.262674]  ? write_comp_data+0x2f/0x90\n[  343.263209]  ? __kasan_check_write+0x14/0x20\n[  343.263802]  ? __skb_clone+0x5d6/0x840\n[  343.264329]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.264958]  dev_queue_xmit+0x1c/0x20\n[  343.265470]  netlink_deliver_tap+0x652/0x9c0\n[  343.266067]  netlink_unicast+0x5a0/0x7f0\n[  343.266608]  ? netlink_attachskb+0x860/0x860\n[  343.267183]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.267820]  ? write_comp_data+0x2f/0x90\n[  343.268367]  netlink_sendmsg+0x922/0xe80\n[  343.268899]  ? netlink_unicast+0x7f0/0x7f0\n[  343.269472]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.270099]  ? write_comp_data+0x2f/0x90\n[  343.270644]  ? netlink_unicast+0x7f0/0x7f0\n[  343.271210]  sock_sendmsg+0x155/0x190\n[  343.271721]  ____sys_sendmsg+0x75f/0x8f0\n[  343.272262]  ? kernel_sendmsg+0x60/0x60\n[  343.272788]  ? write_comp_data+0x2f/0x90\n[  343.273332]  ? write_comp_data+0x2f/0x90\n[  343.273869]  ___sys_sendmsg+0x10f/0x190\n[  343.274405]  ? sendmsg_copy_msghdr+0x80/0x80\n[  343.274984]  ? slab_post_alloc_hook+0x70/0x230\n[  343.275597]  ? futex_wait_setup+0x240/0x240\n[  343.276175]  ? security_file_alloc+0x3e/0x170\n[  343.276779]  ? write_comp_d\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7feccf18-4d28-4931-be5d-2233ebd588f7",
      "id": "CVE-2022-1158",
      "description": "A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "100594d4-ab32-4b27-8626-b2aeb6521413",
      "id": "CVE-2022-48734",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock between quota disable and qgroup rescan worker\n\nQuota disable ioctl starts a transaction before waiting for the qgroup\nrescan worker completes. However, this wait can be infinite and results\nin deadlock because of circular dependency among the quota disable\nioctl, the qgroup rescan worker and the other task with transaction such\nas block group relocation task.\n\nThe deadlock happens with the steps following:\n\n1) Task A calls ioctl to disable quota. It starts a transaction and\n   waits for qgroup rescan worker completes.\n2) Task B such as block group relocation task starts a transaction and\n   joins to the transaction that task A started. Then task B commits to\n   the transaction. In this commit, task B waits for a commit by task A.\n3) Task C as the qgroup rescan worker starts its job and starts a\n   transaction. In this transaction start, task C waits for completion\n   of the transaction that task A started and task B committed.\n\nThis deadlock was found with fstests test case btrfs/115 and a zoned\nnull_blk device. The test case enables and disables quota, and the\nblock group reclaim was triggered during the quota disable by chance.\nThe deadlock was also observed by running quota enable and disable in\nparallel with 'btrfs balance' command on regular null_blk devices.\n\nAn example report of the deadlock:\n\n  [372.469894] INFO: task kworker/u16:6:103 blocked for more than 122 seconds.\n  [372.479944]       Not tainted 5.16.0-rc8 #7\n  [372.485067] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  [372.493898] task:kworker/u16:6   state:D stack:    0 pid:  103 ppid:     2 flags:0x00004000\n  [372.503285] Workqueue: btrfs-qgroup-rescan btrfs_work_helper [btrfs]\n  [372.510782] Call Trace:\n  [372.514092]  \u003cTASK\u003e\n  [372.521684]  __schedule+0xb56/0x4850\n  [372.530104]  ? io_schedule_timeout+0x190/0x190\n  [372.538842]  ? lockdep_hardirqs_on+0x7e/0x100\n  [372.547092]  ? _raw_spin_unlock_irqrestore+0x3e/0x60\n  [372.555591]  schedule+0xe0/0x270\n  [372.561894]  btrfs_commit_transaction+0x18bb/0x2610 [btrfs]\n  [372.570506]  ? btrfs_apply_pending_changes+0x50/0x50 [btrfs]\n  [372.578875]  ? free_unref_page+0x3f2/0x650\n  [372.585484]  ? finish_wait+0x270/0x270\n  [372.591594]  ? release_extent_buffer+0x224/0x420 [btrfs]\n  [372.599264]  btrfs_qgroup_rescan_worker+0xc13/0x10c0 [btrfs]\n  [372.607157]  ? lock_release+0x3a9/0x6d0\n  [372.613054]  ? btrfs_qgroup_account_extent+0xda0/0xda0 [btrfs]\n  [372.620960]  ? do_raw_spin_lock+0x11e/0x250\n  [372.627137]  ? rwlock_bug.part.0+0x90/0x90\n  [372.633215]  ? lock_is_held_type+0xe4/0x140\n  [372.639404]  btrfs_work_helper+0x1ae/0xa90 [btrfs]\n  [372.646268]  process_one_work+0x7e9/0x1320\n  [372.652321]  ? lock_release+0x6d0/0x6d0\n  [372.658081]  ? pwq_dec_nr_in_flight+0x230/0x230\n  [372.664513]  ? rwlock_bug.part.0+0x90/0x90\n  [372.670529]  worker_thread+0x59e/0xf90\n  [372.676172]  ? process_one_work+0x1320/0x1320\n  [372.682440]  kthread+0x3b9/0x490\n  [372.687550]  ? _raw_spin_unlock_irq+0x24/0x50\n  [372.693811]  ? set_kthread_struct+0x100/0x100\n  [372.700052]  ret_from_fork+0x22/0x30\n  [372.705517]  \u003c/TASK\u003e\n  [372.709747] INFO: task btrfs-transacti:2347 blocked for more than 123 seconds.\n  [372.729827]       Not tainted 5.16.0-rc8 #7\n  [372.745907] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  [372.767106] task:btrfs-transacti state:D stack:    0 pid: 2347 ppid:     2 flags:0x00004000\n  [372.787776] Call Trace:\n  [372.801652]  \u003cTASK\u003e\n  [372.812961]  __schedule+0xb56/0x4850\n  [372.830011]  ? io_schedule_timeout+0x190/0x190\n  [372.852547]  ? lockdep_hardirqs_on+0x7e/0x100\n  [372.871761]  ? _raw_spin_unlock_irqrestore+0x3e/0x60\n  [372.886792]  schedule+0xe0/0x270\n  [372.901685]  wait_current_trans+0x22c/0x310 [btrfs]\n  [372.919743]  ? btrfs_put_transaction+0x3d0/0x3d0 [btrfs]\n  [372.938923]  ? finish_wait+0x270/0x270\n  [372.959085]  ? join_transaction+0xc7\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3c30d92b-5320-471f-8efc-3f519f6e2bd3",
      "id": "CVE-2022-48792",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task\n\nCurrently a use-after-free may occur if a sas_task is aborted by the upper\nlayer before we handle the I/O completion in mpi_ssp_completion() or\nmpi_sata_completion().\n\nIn this case, the following are the two steps in handling those I/O\ncompletions:\n\n - Call complete() to inform the upper layer handler of completion of\n   the I/O.\n\n - Release driver resources associated with the sas_task in\n   pm8001_ccb_task_free() call.\n\nWhen complete() is called, the upper layer may free the sas_task. As such,\nwe should not touch the associated sas_task afterwards, but we do so in the\npm8001_ccb_task_free() call.\n\nFix by swapping the complete() and pm8001_ccb_task_free() calls ordering.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7af4142c-529b-4897-989c-c99e550565f5",
      "id": "CVE-2022-48795",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix data TLB miss in sba_unmap_sg\n\nRolf Eike Beer reported the following bug:\n\n[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018\n[1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4\n[1274934.746891] Hardware name: 9000/785/C8000\n[1274934.746891]\n[1274934.746891]      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI\n[1274934.746891] PSW: 00001000000001001111111000001110 Not tainted\n[1274934.746891] r00-03  000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000\n[1274934.746891] r04-07  0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001\n[1274934.746891] r08-11  0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001\n[1274934.746891] r12-15  0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0\n[1274934.746891] r16-19  0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007\n[1274934.746891] r20-23  0000000000000006 000000004a368950 0000000000000000 0000000000000001\n[1274934.746891] r24-27  0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0\n[1274934.746891] r28-31  0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118\n[1274934.746891] sr00-03  00000000066e5800 0000000000000000 0000000000000000 00000000066e5800\n[1274934.746891] sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000\n[1274934.746891]\n[1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec\n[1274934.746891]  IIR: 48780030    ISR: 0000000000000000  IOR: 0000004140000018\n[1274934.746891]  CPU:        3   CR30: 00000040e3a9c000 CR31: ffffffffffffffff\n[1274934.746891]  ORIG_R28: 0000000040acdd58\n[1274934.746891]  IAOQ[0]: sba_unmap_sg+0xb0/0x118\n[1274934.746891]  IAOQ[1]: sba_unmap_sg+0xb4/0x118\n[1274934.746891]  RP(r2): sba_unmap_sg+0xac/0x118\n[1274934.746891] Backtrace:\n[1274934.746891]  [\u003c00000000402740cc\u003e] dma_unmap_sg_attrs+0x6c/0x70\n[1274934.746891]  [\u003c000000004074d6bc\u003e] scsi_dma_unmap+0x54/0x60\n[1274934.746891]  [\u003c00000000407a3488\u003e] mptscsih_io_done+0x150/0xd70\n[1274934.746891]  [\u003c0000000040798600\u003e] mpt_interrupt+0x168/0xa68\n[1274934.746891]  [\u003c0000000040255a48\u003e] __handle_irq_event_percpu+0xc8/0x278\n[1274934.746891]  [\u003c0000000040255c34\u003e] handle_irq_event_percpu+0x3c/0xd8\n[1274934.746891]  [\u003c000000004025ecb4\u003e] handle_percpu_irq+0xb4/0xf0\n[1274934.746891]  [\u003c00000000402548e0\u003e] generic_handle_irq+0x50/0x70\n[1274934.746891]  [\u003c000000004019a254\u003e] call_on_stack+0x18/0x24\n[1274934.746891]\n[1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?)\n\nThe bug is caused by overrunning the sglist and incorrectly testing\nsg_dma_len(sglist) before nents. Normally this doesn't cause a crash,\nbut in this case sglist crossed a page boundary. This occurs in the\nfollowing code:\n\n\twhile (sg_dma_len(sglist) \u0026\u0026 nents--) {\n\nThe fix is simply to test nents first and move the decrement of nents\ninto the loop.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "3f90c92c-dce7-45ff-b627-8fd64695add5",
      "id": "CVE-2022-48926",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: rndis: add spinlock for rndis response list\n\nThere's no lock for rndis response list. It could cause list corruption\nif there're two different list_add at the same time like below.\nIt's better to add in rndis_add_response / rndis_free_response\n/ rndis_get_next_response to prevent any race condition on response list.\n\n[  361.894299] [1:   irq/191-dwc3:16979] list_add corruption.\nnext-\u003eprev should be prev (ffffff80651764d0),\nbut was ffffff883dc36f80. (next=ffffff80651764d0).\n\n[  361.904380] [1:   irq/191-dwc3:16979] Call trace:\n[  361.904391] [1:   irq/191-dwc3:16979]  __list_add_valid+0x74/0x90\n[  361.904401] [1:   irq/191-dwc3:16979]  rndis_msg_parser+0x168/0x8c0\n[  361.904409] [1:   irq/191-dwc3:16979]  rndis_command_complete+0x24/0x84\n[  361.904417] [1:   irq/191-dwc3:16979]  usb_gadget_giveback_request+0x20/0xe4\n[  361.904426] [1:   irq/191-dwc3:16979]  dwc3_gadget_giveback+0x44/0x60\n[  361.904434] [1:   irq/191-dwc3:16979]  dwc3_ep0_complete_data+0x1e8/0x3a0\n[  361.904442] [1:   irq/191-dwc3:16979]  dwc3_ep0_interrupt+0x29c/0x3dc\n[  361.904450] [1:   irq/191-dwc3:16979]  dwc3_process_event_entry+0x78/0x6cc\n[  361.904457] [1:   irq/191-dwc3:16979]  dwc3_process_event_buf+0xa0/0x1ec\n[  361.904465] [1:   irq/191-dwc3:16979]  dwc3_thread_interrupt+0x34/0x5c",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "0fa36864-925f-4487-b990-e561ed645d28",
      "id": "CVE-2022-48966",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvneta: Prevent out of bounds read in mvneta_config_rss()\n\nThe pp-\u003eindir[0] value comes from the user.  It is passed to:\n\n\tif (cpu_online(pp-\u003erxq_def))\n\ninside the mvneta_percpu_elect() function.  It needs bounds checkeding\nto ensure that it is not beyond the end of the cpu bitmap.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d32065d4-ecc6-4a85-82c1-d39512a85006",
      "id": "CVE-2022-48994",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed.\n\nseq_copy_in_user() and seq_copy_in_kernel() did not have prototypes\nmatching snd_seq_dump_func_t. Adjust this and remove the casts. There\nare not resulting binary output differences.\n\nThis was found as a result of Clang's new -Wcast-function-type-strict\nflag, which is more sensitive than the simpler -Wcast-function-type,\nwhich only checks for type width mismatches.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "f7e422b0-087c-47a5-8667-bded67d6cbed",
      "id": "CVE-2022-49115",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Fix misused goto label\n\nFix a misused goto label jump since that can result in a memory leak.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7bc857c1-d80a-4421-bab9-ecaaeb35e49a",
      "id": "CVE-2022-49169",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: use spin_lock to avoid hang\n\n[14696.634553] task:cat             state:D stack:    0 pid:1613738 ppid:1613735 flags:0x00000004\n[14696.638285] Call Trace:\n[14696.639038]  \u003cTASK\u003e\n[14696.640032]  __schedule+0x302/0x930\n[14696.640969]  schedule+0x58/0xd0\n[14696.641799]  schedule_preempt_disabled+0x18/0x30\n[14696.642890]  __mutex_lock.constprop.0+0x2fb/0x4f0\n[14696.644035]  ? mod_objcg_state+0x10c/0x310\n[14696.645040]  ? obj_cgroup_charge+0xe1/0x170\n[14696.646067]  __mutex_lock_slowpath+0x13/0x20\n[14696.647126]  mutex_lock+0x34/0x40\n[14696.648070]  stat_show+0x25/0x17c0 [f2fs]\n[14696.649218]  seq_read_iter+0x120/0x4b0\n[14696.650289]  ? aa_file_perm+0x12a/0x500\n[14696.651357]  ? lru_cache_add+0x1c/0x20\n[14696.652470]  seq_read+0xfd/0x140\n[14696.653445]  full_proxy_read+0x5c/0x80\n[14696.654535]  vfs_read+0xa0/0x1a0\n[14696.655497]  ksys_read+0x67/0xe0\n[14696.656502]  __x64_sys_read+0x1a/0x20\n[14696.657580]  do_syscall_64+0x3b/0xc0\n[14696.658671]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[14696.660068] RIP: 0033:0x7efe39df1cb2\n[14696.661133] RSP: 002b:00007ffc8badd948 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[14696.662958] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007efe39df1cb2\n[14696.664757] RDX: 0000000000020000 RSI: 00007efe399df000 RDI: 0000000000000003\n[14696.666542] RBP: 00007efe399df000 R08: 00007efe399de010 R09: 00007efe399de010\n[14696.668363] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000000000\n[14696.670155] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000\n[14696.671965]  \u003c/TASK\u003e\n[14696.672826] task:umount          state:D stack:    0 pid:1614985 ppid:1614984 flags:0x00004000\n[14696.674930] Call Trace:\n[14696.675903]  \u003cTASK\u003e\n[14696.676780]  __schedule+0x302/0x930\n[14696.677927]  schedule+0x58/0xd0\n[14696.679019]  schedule_preempt_disabled+0x18/0x30\n[14696.680412]  __mutex_lock.constprop.0+0x2fb/0x4f0\n[14696.681783]  ? destroy_inode+0x65/0x80\n[14696.683006]  __mutex_lock_slowpath+0x13/0x20\n[14696.684305]  mutex_lock+0x34/0x40\n[14696.685442]  f2fs_destroy_stats+0x1e/0x60 [f2fs]\n[14696.686803]  f2fs_put_super+0x158/0x390 [f2fs]\n[14696.688238]  generic_shutdown_super+0x7a/0x120\n[14696.689621]  kill_block_super+0x27/0x50\n[14696.690894]  kill_f2fs_super+0x7f/0x100 [f2fs]\n[14696.692311]  deactivate_locked_super+0x35/0xa0\n[14696.693698]  deactivate_super+0x40/0x50\n[14696.694985]  cleanup_mnt+0x139/0x190\n[14696.696209]  __cleanup_mnt+0x12/0x20\n[14696.697390]  task_work_run+0x64/0xa0\n[14696.698587]  exit_to_user_mode_prepare+0x1b7/0x1c0\n[14696.700053]  syscall_exit_to_user_mode+0x27/0x50\n[14696.701418]  do_syscall_64+0x48/0xc0\n[14696.702630]  entry_SYSCALL_64_after_hwframe+0x44/0xae",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "da133375-5ffe-47ea-9108-30df3b0b19a0",
      "id": "CVE-2022-49644",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()\n\nIf drm_connector_init fails, intel_connector_free will be called to take\ncare of proper free. So it is necessary to drop the refcount of port\nbefore intel_connector_free.\n\n(cherry picked from commit cea9ed611e85d36a05db52b6457bf584b7d969e2)",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab609a71-37d2-4878-afaf-c59cf1dcfe84",
      "id": "CVE-2022-49685",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: trigger: sysfs: fix use-after-free on remove\n\nEnsure that the irq_work has completed before the trigger is freed.\n\n ==================================================================\n BUG: KASAN: use-after-free in irq_work_run_list\n Read of size 8 at addr 0000000064702248 by task python3/25\n\n Call Trace:\n  irq_work_run_list\n  irq_work_tick\n  update_process_times\n  tick_sched_handle\n  tick_sched_timer\n  __hrtimer_run_queues\n  hrtimer_interrupt\n\n Allocated by task 25:\n  kmem_cache_alloc_trace\n  iio_sysfs_trig_add\n  dev_attr_store\n  sysfs_kf_write\n  kernfs_fop_write_iter\n  new_sync_write\n  vfs_write\n  ksys_write\n  sys_write\n\n Freed by task 25:\n  kfree\n  iio_sysfs_trig_remove\n  dev_attr_store\n  sysfs_kf_write\n  kernfs_fop_write_iter\n  new_sync_write\n  vfs_write\n  ksys_write\n  sys_write\n\n ==================================================================",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "552a942a-c43f-43a0-8af8-3b9a9c0da070",
      "id": "CVE-2022-49942",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected\n\nWhen we are not connected to a channel, sending channel \"switch\"\nannouncement doesn't make any sense.\n\nThe BSS list is empty in that case. This causes the for loop in\ncfg80211_get_bss() to be bypassed, so the function returns NULL\n(check line 1424 of net/wireless/scan.c), causing the WARN_ON()\nin ieee80211_ibss_csa_beacon() to get triggered (check line 500\nof net/mac80211/ibss.c), which was consequently reported on the\nsyzkaller dashboard.\n\nThus, check if we have an existing connection before generating\nthe CSA beacon in ieee80211_ibss_finish_csa().",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "eba4de8a-6c39-437b-b390-2fdb7d1a09f2",
      "id": "CVE-2022-50055",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix adminq error handling\n\niavf_alloc_asq_bufs/iavf_alloc_arq_bufs allocates with dma_alloc_coherent\nmemory for VF mailbox.\nFree DMA regions for both ASQ and ARQ in case error happens during\nconfiguration of ASQ/ARQ registers.\nWithout this change it is possible to see when unloading interface:\n74626.583369: dma_debug_device_change: device driver has pending DMA allocations while released from device [count=32]\nOne of leaked entries details: [device address=0x0000000b27ff9000] [size=4096 bytes] [mapped with DMA_BIDIRECTIONAL] [mapped as coherent]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "bff87822-6b84-4083-b323-ee701a6813cb",
      "id": "CVE-2022-50252",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter-\u003eq_vector[v_idx] array position.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "10cc8768-a718-4937-951c-7dd3e72ed1ac",
      "id": "CVE-2022-50353",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: wmt-sdmmc: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value, the memory\nthat allocated in mmc_alloc_host() will be leaked and it will lead a kernel\ncrash because of deleting not added device in the remove path.\n\nSo fix this by checking the return value and goto error path which will call\nmmc_free_host(), besides, clk_disable_unprepare() also needs be called.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a32f8238-d7f8-4ed3-9b82-3509ad7f0327",
      "id": "CVE-2023-42756",
      "description": "A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "47346d05-b24a-42ca-b023-7f6d5419d538",
      "id": "CVE-2023-52438",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix use-after-free in shinker's callback\n\nThe mmap read lock is used during the shrinker's callback, which means\nthat using alloc-\u003evma pointer isn't safe as it can race with munmap().\nAs of commit dd2283f2605e (\"mm: mmap: zap pages with read mmap_sem in\nmunmap\") the mmap lock is downgraded after the vma has been isolated.\n\nI was able to reproduce this issue by manually adding some delays and\ntriggering page reclaiming through the shrinker's debug sysfs. The\nfollowing KASAN report confirms the UAF:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8\n  Read of size 8 at addr ffff356ed50e50f0 by task bash/478\n\n  CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   zap_page_range_single+0x470/0x4b8\n   binder_alloc_free_page+0x608/0xadc\n   __list_lru_walk_one+0x130/0x3b0\n   list_lru_walk_node+0xc4/0x22c\n   binder_shrink_scan+0x108/0x1dc\n   shrinker_debugfs_scan_write+0x2b4/0x500\n   full_proxy_write+0xd4/0x140\n   vfs_write+0x1ac/0x758\n   ksys_write+0xf0/0x1dc\n   __arm64_sys_write+0x6c/0x9c\n\n  Allocated by task 492:\n   kmem_cache_alloc+0x130/0x368\n   vm_area_alloc+0x2c/0x190\n   mmap_region+0x258/0x18bc\n   do_mmap+0x694/0xa60\n   vm_mmap_pgoff+0x170/0x29c\n   ksys_mmap_pgoff+0x290/0x3a0\n   __arm64_sys_mmap+0xcc/0x144\n\n  Freed by task 491:\n   kmem_cache_free+0x17c/0x3c8\n   vm_area_free_rcu_cb+0x74/0x98\n   rcu_core+0xa38/0x26d4\n   rcu_core_si+0x10/0x1c\n   __do_softirq+0x2fc/0xd24\n\n  Last potentially related work creation:\n   __call_rcu_common.constprop.0+0x6c/0xba0\n   call_rcu+0x10/0x1c\n   vm_area_free+0x18/0x24\n   remove_vma+0xe4/0x118\n   do_vmi_align_munmap.isra.0+0x718/0xb5c\n   do_vmi_munmap+0xdc/0x1fc\n   __vm_munmap+0x10c/0x278\n   __arm64_sys_munmap+0x58/0x7c\n\nFix this issue by performing instead a vma_lookup() which will fail to\nfind the vma that was isolated before the mmap lock downgrade. Note that\nthis option has better performance than upgrading to a mmap write lock\nwhich would increase contention. Plus, mmap_write_trylock() has been\nrecently removed anyway.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ab09f44f-f5fc-43fd-bf5f-662a8dc0bc98",
      "id": "CVE-2023-53431",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Handle enclosure with just a primary component gracefully\n\nThis reverts commit 3fe97ff3d949 (\"scsi: ses: Don't attach if enclosure\nhas no components\") and introduces proper handling of case where there are\nno detected secondary components, but primary component (enumerated in\nnum_enclosures) does exist. That fix was originally proposed by Ding Hui\n\u003cdinghui@sangfor.com.cn\u003e.\n\nCompletely ignoring devices that have one primary enclosure and no\nsecondary one results in ses_intf_add() bailing completely\n\n\tscsi 2:0:0:254: enclosure has no enumerated components\n        scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such\n\neven on valid configurations with 1 primary and 0 secondary enclosures as\nbelow:\n\n\t# sg_ses /dev/sg0\n\t  3PARdata  SES               3321\n\tSupported diagnostic pages:\n\t  Supported Diagnostic Pages [sdp] [0x0]\n\t  Configuration (SES) [cf] [0x1]\n\t  Short Enclosure Status (SES) [ses] [0x8]\n\t# sg_ses -p cf /dev/sg0\n\t  3PARdata  SES               3321\n\tConfiguration diagnostic page:\n\t  number of secondary subenclosures: 0\n\t  generation code: 0x0\n\t  enclosure descriptor list\n\t    Subenclosure identifier: 0 [primary]\n\t      relative ES process id: 0, number of ES processes: 1\n\t      number of type descriptor headers: 1\n\t      enclosure logical identifier (hex): 20000002ac02068d\n\t      enclosure vendor: 3PARdata  product: VV                rev: 3321\n\t  type descriptor header and text list\n\t    Element type: Unspecified, subenclosure id: 0\n\t      number of possible elements: 1\n\nThe changelog for the original fix follows\n\n=====\nWe can get a crash when disconnecting the iSCSI session,\nthe call trace like this:\n\n  [ffff00002a00fb70] kfree at ffff00000830e224\n  [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4\n  [ffff00002a00fbd0] device_del at ffff0000086b6a98\n  [ffff00002a00fc50] device_unregister at ffff0000086b6d58\n  [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c\n  [ffff00002a00fca0] scsi_remove_device at ffff000008706134\n  [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4\n  [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0\n  [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4\n  [ffff00002a00fdb0] process_one_work at ffff00000810f35c\n  [ffff00002a00fe00] worker_thread at ffff00000810f648\n  [ffff00002a00fe70] kthread at ffff000008116e98\n\nIn ses_intf_add, components count could be 0, and kcalloc 0 size scomp,\nbut not saved in edev-\u003ecomponent[i].scratch\n\nIn this situation, edev-\u003ecomponent[0].scratch is an invalid pointer,\nwhen kfree it in ses_intf_remove_enclosure, a crash like above would happen\nThe call trace also could be other random cases when kfree cannot catch\nthe invalid pointer\n\nWe should not use edev-\u003ecomponent[] array when the components count is 0\nWe also need check index when use edev-\u003ecomponent[] array in\nses_enclosure_data_process\n=====",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "c248fac1-2ddc-40ee-a5f8-37fa13fd314c",
      "id": "CVE-2024-26641",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()\n\nsyzbot found __ip6_tnl_rcv() could access unitiliazed data [1].\n\nCall pskb_inet_may_pull() to fix this, and initialize ipv6h\nvariable after this call as it can change skb-\u003ehead.\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727\n  __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845\n  ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888\n gre_rcv+0x143f/0x1870\n  ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:461 [inline]\n  ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5532 [inline]\n  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646\n  netif_receive_skb_internal net/core/dev.c:5732 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5791\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n  tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n  slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n  slab_alloc_node mm/slub.c:3478 [inline]\n  kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n  __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n  alloc_skb include/linux/skbuff.h:1286 [inline]\n  alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n  sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787\n  tun_alloc_skb drivers/net/tun.c:1531 [inline]\n  tun_get_user+0x1e8a/0x66d0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2084 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x786/0x1200 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xd0 fs/read_write.c:652\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nCPU: 0 PID: 5034 Comm: syz-executor331 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a3429ff3-b659-4aaa-be46-6aa640adc65a",
      "id": "CVE-2024-26751",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: ep93xx: Add terminator to gpiod_lookup_table\n\nWithout the terminator, if a con_id is passed to gpio_find() that\ndoes not exist in the lookup table the function will not stop looping\ncorrectly, and eventually cause an oops.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "48d1cd9b-fcb8-4cb1-b3d6-fed90700b12f",
      "id": "CVE-2024-26778",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: savage: Error out if pixclock equals zero\n\nThe userspace program could pass any values to the driver through\nioctl() interface. If the driver doesn't check the value of pixclock,\nit may cause divide-by-zero error.\n\nAlthough pixclock is checked in savagefb_decode_var(), but it is not\nchecked properly in savagefb_probe(). Fix this by checking whether\npixclock is zero in the function savagefb_check_var() before\ninfo-\u003evar.pixclock is used as the divisor.\n\nThis is similar to CVE-2022-3061 in i740fb which was fixed by\ncommit 15cf0b8.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "ebf7c1b8-dce2-4778-9f58-46e0e8f78562",
      "id": "CVE-2024-27074",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: go7007: fix a memleak in go7007_load_encoder\n\nIn go7007_load_encoder, bounce(i.e. go-\u003eboot_fw), is allocated without\na deallocation thereafter. After the following call chain:\n\nsaa7134_go7007_init\n  |-\u003e go7007_boot_encoder\n        |-\u003e go7007_load_encoder\n  |-\u003e kfree(go)\n\ngo is freed and thus bounce is leaked.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cd304ca6-34c7-4183-8455-6527d0407017",
      "id": "CVE-2024-36004",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Do not use WQ_MEM_RECLAIM flag for workqueue\n\nIssue reported by customer during SRIOV testing, call trace:\nWhen both i40e and the i40iw driver are loaded, a warning\nin check_flush_dependency is being triggered. This seems\nto be because of the i40e driver workqueue is allocated with\nthe WQ_MEM_RECLAIM flag, and the i40iw one is not.\n\nSimilar error was encountered on ice too and it was fixed by\nremoving the flag. Do the same for i40e too.\n\n[Feb 9 09:08] ------------[ cut here ]------------\n[  +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is\nflushing !WQ_MEM_RECLAIM infiniband:0x0\n[  +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966\ncheck_flush_dependency+0x10b/0x120\n[  +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq\nsnd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4\nnls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr\nrfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma\nintel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif\nisst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal\nintel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core\niTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore\nioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich\nintel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad\nxfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe\ndrm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel\nlibata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror\ndm_region_hash dm_log dm_mod fuse\n[  +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not\ntainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1\n[  +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS\nSE5C620.86B.02.01.0013.121520200651 12/15/2020\n[  +0.000001] Workqueue: i40e i40e_service_task [i40e]\n[  +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120\n[  +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48\n81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd\nff \u003c0f\u003e 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90\n[  +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282\n[  +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX:\n0000000000000027\n[  +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI:\nffff94d47f620bc0\n[  +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09:\n00000000ffff7fff\n[  +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12:\nffff94c5451ea180\n[  +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15:\nffff94c5f1330ab0\n[  +0.000001] FS:  0000000000000000(0000) GS:ffff94d47f600000(0000)\nknlGS:0000000000000000\n[  +0.000002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4:\n00000000007706f0\n[  +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[  +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[  +0.000001] PKRU: 55555554\n[  +0.000001] Call Trace:\n[  +0.000001]  \u003cTASK\u003e\n[  +0.000002]  ? __warn+0x80/0x130\n[  +0.000003]  ? check_flush_dependency+0x10b/0x120\n[  +0.000002]  ? report_bug+0x195/0x1a0\n[  +0.000005]  ? handle_bug+0x3c/0x70\n[  +0.000003]  ? exc_invalid_op+0x14/0x70\n[  +0.000002]  ? asm_exc_invalid_op+0x16/0x20\n[  +0.000006]  ? check_flush_dependency+0x10b/0x120\n[  +0.000002]  ? check_flush_dependency+0x10b/0x120\n[  +0.000002]  __flush_workqueue+0x126/0x3f0\n[  +0.000015]  ib_cache_cleanup_one+0x1c/0xe0 [ib_core]\n[  +0.000056]  __ib_unregister_device+0x6a/0xb0 [ib_core]\n[  +0.000023]  ib_unregister_device_and_put+0x34/0x50 [ib_core]\n[  +0.000020]  i40iw_close+0x4b/0x90 [irdma]\n[  +0.000022]  i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e]\n[  +0.000035]  i40e_service_task+0x126/0x190 [i40e]\n[  +0.000024]  process_one_work+0x174/0x340\n[  +0.000003]  worker_th\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "676cfbcb-239d-4d43-a1e6-ed06bf28b87a",
      "id": "CVE-2024-40974",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Enforce hcall result buffer validity and size\n\nplpar_hcall(), plpar_hcall9(), and related functions expect callers to\nprovide valid result buffers of certain minimum size. Currently this\nis communicated only through comments in the code and the compiler has\nno idea.\n\nFor example, if I write a bug like this:\n\n  long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE\n  plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);\n\nThis compiles with no diagnostics emitted, but likely results in stack\ncorruption at runtime when plpar_hcall9() stores results past the end\nof the array. (To be clear this is a contrived example and I have not\nfound a real instance yet.)\n\nTo make this class of error less likely, we can use explicitly-sized\narray parameters instead of pointers in the declarations for the hcall\nAPIs. When compiled with -Warray-bounds[1], the code above now\nprovokes a diagnostic like this:\n\nerror: array argument is too small;\nis of size 32, callee requires at least 72 [-Werror,-Warray-bounds]\n   60 |                 plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,\n      |                 ^                                   ~~~~~~\n\n[1] Enabled for LLVM builds but not GCC for now. See commit\n    0da6e5fd6c37 (\"gcc: disable '-Warray-bounds' for gcc-13 too\") and\n    related changes.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "6cf09051-074b-4b3d-b90e-d0c5b0d677b9",
      "id": "CVE-2024-42114",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values\n\nsyzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM\nto 2^31.\n\nWe had a similar issue in sch_fq, fixed with commit\nd9e15a273306 (\"pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM\")\n\nwatchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24]\nModules linked in:\nirq event stamp: 131135\n hardirqs last  enabled at (131134): [\u003cffff80008ae8778c\u003e] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]\n hardirqs last  enabled at (131134): [\u003cffff80008ae8778c\u003e] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95\n hardirqs last disabled at (131135): [\u003cffff80008ae85378\u003e] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]\n hardirqs last disabled at (131135): [\u003cffff80008ae85378\u003e] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551\n softirqs last  enabled at (125892): [\u003cffff80008907e82c\u003e] neigh_hh_init net/core/neighbour.c:1538 [inline]\n softirqs last  enabled at (125892): [\u003cffff80008907e82c\u003e] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553\n softirqs last disabled at (125896): [\u003cffff80008904166c\u003e] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19\nCPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nWorkqueue: mld mld_ifc_work\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __list_del include/linux/list.h:195 [inline]\n pc : __list_del_entry include/linux/list.h:218 [inline]\n pc : list_move_tail include/linux/list.h:310 [inline]\n pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline]\n pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854\n lr : __list_del_entry include/linux/list.h:218 [inline]\n lr : list_move_tail include/linux/list.h:310 [inline]\n lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline]\n lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854\nsp : ffff800093d36700\nx29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000\nx26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0\nx23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0\nx20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0\nx17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8\nx14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff\nx11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000\nx8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000\nx5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc\nx2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470\nCall trace:\n  __list_del include/linux/list.h:195 [inline]\n  __list_del_entry include/linux/list.h:218 [inline]\n  list_move_tail include/linux/list.h:310 [inline]\n  fq_tin_dequeue include/net/fq_impl.h:112 [inline]\n  ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854\n  wake_tx_push_queue net/mac80211/util.c:294 [inline]\n  ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315\n  drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline]\n  schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline]\n  ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664\n  ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966\n  ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062\n  __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338\n  ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532\n  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n  xmit_one net/core/dev.c:3531 [inline]\n  dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547\n  __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341\n  dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n  neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563\n  neigh_output include/net/neighbour.h:542 [inline]\n  ip6_fini\n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "83d199b6-e765-4f88-b061-ef37fb966039",
      "id": "CVE-2024-42134",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Check if is_avq is NULL\n\n[bug]\nIn the virtio_pci_common.c function vp_del_vqs, vp_dev-\u003eis_avq is involved\nto determine whether it is admin virtqueue, but this function vp_dev-\u003eis_avq\n may be empty. For installations, virtio_pci_legacy does not assign a value\n to vp_dev-\u003eis_avq.\n\n[fix]\nCheck whether it is vp_dev-\u003eis_avq before use.\n\n[test]\nTest with virsh Attach device\nBefore this patch, the following command would crash the guest system\n\nAfter applying the patch, everything seems to be working fine.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "e2571560-f82d-4ae0-8865-ea389718cfce",
      "id": "CVE-2024-46750",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Add missing bridge lock to pci_bus_lock()\n\nOne of the true positives that the cfg_access_lock lockdep effort\nidentified is this sequence:\n\n  WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70\n  RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70\n  Call Trace:\n   \u003cTASK\u003e\n   ? __warn+0x8c/0x190\n   ? pci_bridge_secondary_bus_reset+0x5d/0x70\n   ? report_bug+0x1f8/0x200\n   ? handle_bug+0x3c/0x70\n   ? exc_invalid_op+0x18/0x70\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? pci_bridge_secondary_bus_reset+0x5d/0x70\n   pci_reset_bus+0x1d8/0x270\n   vmd_probe+0x778/0xa10\n   pci_device_probe+0x95/0x120\n\nWhere pci_reset_bus() users are triggering unlocked secondary bus resets.\nIronically pci_bus_reset(), several calls down from pci_reset_bus(), uses\npci_bus_lock() before issuing the reset which locks everything *but* the\nbridge itself.\n\nFor the same motivation as adding:\n\n  bridge = pci_upstream_bridge(dev);\n  if (bridge)\n    pci_dev_lock(bridge);\n\nto pci_reset_function() for the \"bus\" and \"cxl_bus\" reset cases, add\npci_dev_lock() for @bus-\u003eself to pci_bus_lock().\n\n[bhelgaas: squash in recursive locking deadlock fix from Keith Busch:\nhttps://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "fa26221d-2f1d-484c-b779-ea088fffef05",
      "id": "CVE-2024-46810",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ\n\nMake sure the connector is fully initialized before signalling any\nHPD events via drm_kms_helper_hotplug_event(), otherwise this may\nlead to NULL pointer dereference.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a696ea44-1a98-477e-81ad-8f71d07819a7",
      "id": "CVE-2024-46840",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: clean up our handling of refs == 0 in snapshot delete\n\nIn reada we BUG_ON(refs == 0), which could be unkind since we aren't\nholding a lock on the extent leaf and thus could get a transient\nincorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which\ncould happen if we have extent tree corruption.  Change that to return\n-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,\nhowever we return -EIO, which -EUCLEAN is a more appropriate error code.\nFinally in walk_up_proc we have the same BUG_ON(refs == 0), so convert\nthat to proper error handling.  Also adjust the error message so we can\nactually do something with the information.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "a86f4d5b-7787-4740-b9e9-f2fe2f82c1da",
      "id": "CVE-2024-56776",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: avoid potential dereference of error pointers\n\nThe return value of drm_atomic_get_crtc_state() needs to be\nchecked. To avoid use of error pointer 'crtc_state' in case\nof the failure.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "2e2410d6-ade9-4f8e-9d41-7566dbb8a0d5",
      "id": "CVE-2024-57899",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix mbss changed flags corruption on 32 bit systems\n\nOn 32-bit systems, the size of an unsigned long is 4 bytes,\nwhile a u64 is 8 bytes. Therefore, when using\nor_each_set_bit(bit, \u0026bits, sizeof(changed) * BITS_PER_BYTE),\nthe code is incorrectly searching for a bit in a 32-bit\nvariable that is expected to be 64 bits in size,\nleading to incorrect bit finding.\n\nSolution: Ensure that the size of the bits variable is correctly\nadjusted for each architecture.\n\n Call Trace:\n  ? show_regs+0x54/0x58\n  ? __warn+0x6b/0xd4\n  ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]\n  ? report_bug+0x113/0x150\n  ? exc_overflow+0x30/0x30\n  ? handle_bug+0x27/0x44\n  ? exc_invalid_op+0x18/0x50\n  ? handle_exception+0xf6/0xf6\n  ? exc_overflow+0x30/0x30\n  ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]\n  ? exc_overflow+0x30/0x30\n  ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]\n  ? ieee80211_mesh_work+0xff/0x260 [mac80211]\n  ? cfg80211_wiphy_work+0x72/0x98 [cfg80211]\n  ? process_one_work+0xf1/0x1fc\n  ? worker_thread+0x2c0/0x3b4\n  ? kthread+0xc7/0xf0\n  ? mod_delayed_work_on+0x4c/0x4c\n  ? kthread_complete_and_exit+0x14/0x14\n  ? ret_from_fork+0x24/0x38\n  ? kthread_complete_and_exit+0x14/0x14\n  ? ret_from_fork_asm+0xf/0x14\n  ? entry_INT80_32+0xf0/0xf0\n\n[restore no-op path for no changes]",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "b9fcfc8d-f2aa-43ab-80d4-1cf493d8b9d7",
      "id": "CVE-2024-58001",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle a symlink read error correctly\n\nPatch series \"Convert ocfs2 to use folios\".\n\nMark did a conversion of ocfs2 to use folios and sent it to me as a\ngiant patch for review ;-)\n\nSo I've redone it as individual patches, and credited Mark for the patches\nwhere his code is substantially the same.  It's not a bad way to do it;\nhis patch had some bugs and my patches had some bugs.  Hopefully all our\nbugs were different from each other.  And hopefully Mark likes all the\nchanges I made to his code!\n\n\nThis patch (of 23):\n\nIf we can't read the buffer, be sure to unlock the page before returning.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "acc735f1-c964-4221-a010-d4ccdca77f98",
      "id": "CVE-2025-21871",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: optee: Fix supplicant wait loop\n\nOP-TEE supplicant is a user-space daemon and it's possible for it\nbe hung or crashed or killed in the middle of processing an OP-TEE\nRPC call. It becomes more complicated when there is incorrect shutdown\nordering of the supplicant process vs the OP-TEE client application which\ncan eventually lead to system hang-up waiting for the closure of the\nclient application.\n\nAllow the client process waiting in kernel for supplicant response to\nbe killed rather than indefinitely waiting in an unkillable state. Also,\na normal uninterruptible wait should not have resulted in the hung-task\nwatchdog getting triggered, but the endless loop would.\n\nThis fixes issues observed during system reboot/shutdown when supplicant\ngot hung for some reason or gets crashed/killed which lead to client\ngetting hung in an unkillable state. It in turn lead to system being in\nhung up state requiring hard power off/on to recover.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "623f0a1e-5984-440a-b2be-24e268fd70ee",
      "id": "CVE-2025-21957",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla1280: Fix kernel oops when debug level \u003e 2\n\nA null dereference or oops exception will eventually occur when qla1280.c\ndriver is compiled with DEBUG_QLA1280 enabled and ql_debug_level \u003e 2.  I\nthink its clear from the code that the intention here is sg_dma_len(s) not\nlength of sg_next(s) when printing the debug info.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "cf489010-e8ef-4476-b1ed-2b05843dbae8",
      "id": "CVE-2025-22018",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Fix NULL pointer dereference\n\nWhen MPOA_cache_impos_rcvd() receives the msg, it can trigger\nNull Pointer Dereference Vulnerability if both entry and\nholding_time are NULL. Because there is only for the situation\nwhere entry is NULL and holding_time exists, it can be passed\nwhen both entry and holding_time are NULL. If these are NULL,\nthe entry will be passd to eg_cache_put() as parameter and\nit is referenced by entry-\u003euse code in it.\n\nkasan log:\n\n[    3.316691] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006:I\n[    3.317568] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[    3.318188] CPU: 3 UID: 0 PID: 79 Comm: ex Not tainted 6.14.0-rc2 #102\n[    3.318601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n[    3.319298] RIP: 0010:eg_cache_remove_entry+0xa5/0x470\n[    3.319677] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80\n[    3.321220] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006\n[    3.321596] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e\n[    3.322112] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030\n[    3.322643] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88\n[    3.323181] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15\n[    3.323707] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068\n[    3.324185] FS:  000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000\n[    3.325042] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    3.325545] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0\n[    3.326430] Call Trace:\n[    3.326725]  \u003cTASK\u003e\n[    3.326927]  ? die_addr+0x3c/0xa0\n[    3.327330]  ? exc_general_protection+0x161/0x2a0\n[    3.327662]  ? asm_exc_general_protection+0x26/0x30\n[    3.328214]  ? vprintk_emit+0x15e/0x420\n[    3.328543]  ? eg_cache_remove_entry+0xa5/0x470\n[    3.328910]  ? eg_cache_remove_entry+0x9a/0x470\n[    3.329294]  ? __pfx_eg_cache_remove_entry+0x10/0x10\n[    3.329664]  ? console_unlock+0x107/0x1d0\n[    3.329946]  ? __pfx_console_unlock+0x10/0x10\n[    3.330283]  ? do_syscall_64+0xa6/0x1a0\n[    3.330584]  ? entry_SYSCALL_64_after_hwframe+0x47/0x7f\n[    3.331090]  ? __pfx_prb_read_valid+0x10/0x10\n[    3.331395]  ? down_trylock+0x52/0x80\n[    3.331703]  ? vprintk_emit+0x15e/0x420\n[    3.331986]  ? __pfx_vprintk_emit+0x10/0x10\n[    3.332279]  ? down_trylock+0x52/0x80\n[    3.332527]  ? _printk+0xbf/0x100\n[    3.332762]  ? __pfx__printk+0x10/0x10\n[    3.333007]  ? _raw_write_lock_irq+0x81/0xe0\n[    3.333284]  ? __pfx__raw_write_lock_irq+0x10/0x10\n[    3.333614]  msg_from_mpoad+0x1185/0x2750\n[    3.333893]  ? __build_skb_around+0x27b/0x3a0\n[    3.334183]  ? __pfx_msg_from_mpoad+0x10/0x10\n[    3.334501]  ? __alloc_skb+0x1c0/0x310\n[    3.334809]  ? __pfx___alloc_skb+0x10/0x10\n[    3.335283]  ? _raw_spin_lock+0xe0/0xe0\n[    3.335632]  ? finish_wait+0x8d/0x1e0\n[    3.335975]  vcc_sendmsg+0x684/0xba0\n[    3.336250]  ? __pfx_vcc_sendmsg+0x10/0x10\n[    3.336587]  ? __pfx_autoremove_wake_function+0x10/0x10\n[    3.337056]  ? fdget+0x176/0x3e0\n[    3.337348]  __sys_sendto+0x4a2/0x510\n[    3.337663]  ? __pfx___sys_sendto+0x10/0x10\n[    3.337969]  ? ioctl_has_perm.constprop.0.isra.0+0x284/0x400\n[    3.338364]  ? sock_ioctl+0x1bb/0x5a0\n[    3.338653]  ? __rseq_handle_notify_resume+0x825/0xd20\n[    3.339017]  ? __pfx_sock_ioctl+0x10/0x10\n[    3.339316]  ? __pfx___rseq_handle_notify_resume+0x10/0x10\n[    3.339727]  ? selinux_file_ioctl+0xa4/0x260\n[    3.340166]  __x64_sys_sendto+0xe0/0x1c0\n[    3.340526]  ? syscall_exit_to_user_mode+0x123/0x140\n[    3.340898]  do_syscall_64+0xa6/0x1a0\n[    3.341170]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[    3.341533] RIP: 0033:0x44a380\n[    3.341757] Code: 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c00\n[    \n---truncated---",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "d44fa60d-2604-45a8-868c-eea83f44596e",
      "id": "CVE-2025-37923",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix oob write in trace_seq_to_buffer()\n\nsyzbot reported this bug:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]\nBUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822\nWrite of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260\n\nCPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc3/0x670 mm/kasan/report.c:521\n kasan_report+0xe0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106\n trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]\n tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822\n ....\n==================================================================\n\nIt has been reported that trace_seq_to_buffer() tries to copy more data\nthan PAGE_SIZE to buf. Therefore, to prevent this, we should use the\nsmaller of trace_seq_used(\u0026iter-\u003eseq) and PAGE_SIZE as an argument.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "7a5662de-4c48-42be-a0b7-21b4a2cd61a8",
      "id": "CVE-2025-38420",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: do not ping device which has failed to load firmware\n\nSyzkaller reports [1, 2] crashes caused by an attempts to ping\nthe device which has failed to load firmware. Since such a device\ndoesn't pass 'ieee80211_register_hw()', an internal workqueue\nmanaged by 'ieee80211_queue_work()' is not yet created and an\nattempt to queue work on it causes null-ptr-deref.\n\n[1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff\n[2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    },
    {
      "bom-ref": "1bc9d04e-3223-4b39-bcaa-1996300efd33",
      "id": "CVE-2025-38612",
      "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()\n\nIn the error paths after fb_info structure is successfully allocated,\nthe memory allocated in fb_deferred_io_init() for info-\u003epagerefs is not\nfreed. Fix that by adding the cleanup function on the error path.",
      "affects": [
        {
          "ref": "ce7b2454-e780-48c8-8220-bf483c988a5e"
        }
      ]
    }
  ]
}
